@neta-art/cohub 8.18.0 → 8.20.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { $ as BoardEffectInputSchema, A as SkillsApi, B as DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, C as SessionPatchReducer, D as ReferencesApi, E as SessionAccessApi, F as ChannelsApi, G as parseDesktopCommand, H as DESKTOP_COMMAND_VERSION, I as DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, J as NAVIGATION_ERROR_MESSAGE_MAX_LENGTH, K as parseDesktopCommandId, L as DESKTOP_COMMAND_MAX_TIMEOUT_MS, M as ModelsApi, N as GenerationsApi, O as SearchApi, P as CronJobsApi, Q as BoardSemanticMutationSchema, R as DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, S as parseAssistantMessageCommit, T as ensureRealtimeConnected, U as isDesktopCallMethod, V as DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, W as isTerminalDesktopCommandStatus, X as BoardItemPatchSchema, Y as BoardAuthoringItemSchema, Z as BoardSemanticCommandSchema, _ as PublicInviteApi, a as DesktopCommandsApi, at as BoardCompositionSchema, b as SessionGenerationStreamClient, c as ReferralsApi, ct as parseBoardCompositionInput, d as TasksApi, dt as BOARD_BUILTIN_CAPABILITIES, et as BoardEffectSchema, f as BoardClient, ft as BOARD_BUILTIN_CLIP_KINDS, g as SpacesApi, h as SpaceWebhooksApi, i as WorkCommerceApi, it as BoardCompositionInputSchema, j as PromptsApi, k as PublicAssetsApi, l as UsersApi, lt as BoardConnectionSchema, m as SpacePublicFilesApi, mt as DEFAULT_BOARD_RENDER_LIMITS, n as createHttpClient, nt as BOARD_ANIMATION_CHANNELS, o as UiCommandsApi, ot as BoardProceduralClipSchema, p as SpaceClient, pt as BOARD_BUILTIN_EFFECT_KINDS, q as resolveOpenSurface, r as AppCommerceApi, rt as BOARD_ANIMATION_CHANNEL_CAPABILITIES, s as AppsApi, st as BoardTrackSchema, t as CohubHttpClient, tt as parseBoardEffectInput, u as UserApi, ut as BOARD_ARROW_STROKE_SIZE, v as buildSpaceInvitePath, w as createSessionPatchReducer, x as createSessionGenerationStreamClient, y as buildSpacePath, z as DESKTOP_COMMAND_PENDING_TTL_SECONDS } from "./chunks/http.js";
 import { _ as requestSourceToHeaders, a as sanitizeAccessToken, b as REALTIME_ROOM_EVENT_NAME_PATTERN, c as REQUEST_SOURCE_VIA_MAX_LENGTH, d as isRequestSourceEmpty, f as isRequestSourceUuid, g as readRequestSourceFromEnv, h as parseRequestSourceFromHeaders, i as matchesUnauthorizedErrorToken, l as hasRequestSourceIdentity, m as normalizeRequestSource, n as HttpTransport, o as COHUB_SOURCE_HEADER, p as mergeRequestSourceIntoMeta, r as joinApiUrl, s as COHUB_SOURCE_HEADER_NAMES, t as HttpError, u as isRequestSourceClientId, v as resolveRequestSourceChannel, y as isUuid } from "./chunks/transport.js";
-import { a as normalizeWebsocketUrl, c as resolveExecutionAppId, d as resolveWebsocketUrl, f as PERMISSIONS, h as scopeListHasPermission, i as normalizeVoiceInputWebsocketUrl, l as resolveExecutionToken, m as isUserLevelPermission, n as getCohubContext, o as resolveApiBaseUrl, p as USER_LEVEL_PERMISSIONS, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS, u as resolveVoiceInputWebsocketUrl } from "./chunks/environment.js";
+import { a as normalizeWebsocketUrl, c as resolveExecutionAppId, d as resolveWebBaseUrl, f as resolveWebsocketUrl, g as scopeListHasPermission, h as isUserLevelPermission, i as normalizeVoiceInputWebsocketUrl, l as resolveExecutionToken, m as USER_LEVEL_PERMISSIONS, n as getCohubContext, o as resolveApiBaseUrl, p as PERMISSIONS, r as normalizeBaseUrl, s as resolveCohubEnvironment, t as COHUB_ENVIRONMENTS, u as resolveVoiceInputWebsocketUrl } from "./chunks/environment.js";
 import { a as extractBillingPayload, c as isFeatureNotEntitledError, i as FEATURE_NOT_ENTITLED_ERROR_CODE, l as isHttpErrorCode, n as createWebsocketClient, o as isBillingAccessBlockedCode, r as BILLING_ACCESS_BLOCKED_ERROR_CODE, s as isBillingAccessBlockedError, t as WebsocketClient } from "./chunks/websocket.js";
 import { VoiceApi, VoiceInputClient, createVoiceInputClient } from "./voice-input.js";
 import { filterSpacePickerItems, normalizeSpacePickerQuery, orderSpacePickerItems, selectSpacePickerItems } from "./space-picker.js";
@@ -14,6 +14,15 @@ const appAuthorizationTargetSchema = z.discriminatedUnion("kind", [
 	}),
 	z.object({ kind: z.literal("pick-space") })
 ]);
+const APP_SILENT_SHELL_SCOPE_SET = /* @__PURE__ */ new Set([
+	"space.view",
+	"file.view",
+	"file.view.filtered",
+	"session.view",
+	"taskrun.view",
+	"checkpoint.view"
+]);
+const isAppSilentShellScope = (scope) => APP_SILENT_SHELL_SCOPE_SET.has(scope);
 const appAuthorizationRequestSchema = z.object({
 	target: appAuthorizationTargetSchema,
 	scopes: z.array(z.string().min(1)).min(1).max(128),
@@ -1344,6 +1353,457 @@ function validateArchiveBoundary(index, parent) {
 	if (!index.segments.length && parent?.sha256 !== index.sha256) throw new Error("Unchanged archive checksum mismatch");
 }
 //#endregion
+//#region ../protocol/dist/runtime/projection.js
+const DEFAULT_TIMESTAMP = "1970-01-01T00:00:00.000Z";
+const asMeta = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+const safeId = (value) => value.replace(/[^A-Za-z0-9_-]/g, "_");
+const entryId = (messageId, ordinal) => `cohub_${safeId(messageId)}_${ordinal}`;
+const isProjectionCompaction = (message) => message.role === "system" && message.content.some((block) => block.type === "system_note" && block.note_type === "compacted");
+const isPendingGeneration = (message) => message.role === "assistant" && message.meta?.messageKind === "generation_result" && !["completed", "failed"].includes(String(message.meta.generationStatus));
+const messageMeta = (message) => asMeta(message.meta);
+const timestampOf = (message, fallback) => message.createdAt || fallback;
+function stableJson(value) {
+	if (value === void 0) return "undefined";
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+}
+function fingerprint(value) {
+	let hash = 14695981039346656037n;
+	for (const character of stableJson(value)) {
+		hash ^= BigInt(character.codePointAt(0) ?? 0);
+		hash = BigInt.asUintN(64, hash * 1099511628211n);
+	}
+	return hash.toString(16).padStart(16, "0");
+}
+function sourceFingerprint(turns) {
+	return `${turns.length}:${fingerprint(turns)}`;
+}
+function projectNativeMessageMeta(message) {
+	const source = messageMeta(message);
+	const safe = {
+		sourceSessionId: message.sourceSessionId,
+		sequence: message.sequence,
+		createdAt: message.createdAt
+	};
+	for (const key of [
+		"agentSessionEntryId",
+		"messageKind",
+		"nativeApi",
+		"generationStatus"
+	]) if (source[key] !== void 0) safe[key] = source[key];
+	const compaction = asMeta(source.compaction);
+	if (Object.keys(compaction).length) safe.compaction = Object.fromEntries([
+		"compactionId",
+		"compactedAt",
+		"tokensBefore",
+		"firstKeptEntryId"
+	].filter((key) => compaction[key] !== void 0).map((key) => [key, compaction[key]]));
+	return {
+		...safe,
+		messageId: message.id,
+		turnId: message.turnId
+	};
+}
+function projectPiBlock(block) {
+	if (block.type === "text") return {
+		type: "text",
+		text: block.text
+	};
+	if (block.type === "thinking") return {
+		type: "thinking",
+		thinking: block.thinking,
+		...block.signature ? { thinkingSignature: block.signature } : {}
+	};
+	if (block.type === "image" && block.source.type === "base64") return {
+		type: "image",
+		data: block.source.data,
+		mimeType: block.source.media_type
+	};
+	if (block.type === "tool_use") return {
+		type: "toolCall",
+		id: block.id,
+		name: block.name,
+		arguments: block.input
+	};
+	return null;
+}
+function containsExternalImage(content) {
+	return content.some((block) => block.type === "image" && block.source.type === "url" || block.type === "tool_result" && Array.isArray(block.content) && containsExternalImage(block.content));
+}
+function projectPiMessage(message, warnings, toolNames) {
+	const meta = projectNativeMessageMeta(message);
+	if (containsExternalImage(message.content)) warnings.push({
+		sourceMessageId: message.id,
+		sourceTurnId: message.turnId,
+		reason: "external image URL omitted from native projection"
+	});
+	if (message.role === "system") return [];
+	if (message.role === "user") {
+		const content = message.content.map(projectPiBlock).filter((block) => block !== null);
+		return content.length ? [{
+			role: "user",
+			content,
+			timestamp: Date.parse(message.createdAt) || 0,
+			meta
+		}] : [];
+	}
+	const calls = new Map(message.content.flatMap((block) => block.type === "tool_use" ? [[block.id, block.name]] : []));
+	for (const [id, name] of calls) toolNames.set(id, name);
+	const result = [];
+	const content = message.content.map(projectPiBlock).filter((block) => block !== null);
+	if (content.length) result.push({
+		role: "assistant",
+		content,
+		api: typeof messageMeta(message).nativeApi === "string" ? messageMeta(message).nativeApi : "history",
+		provider: message.provider ?? "history",
+		model: message.model ?? "history",
+		usage: message.usage ?? emptyUsage(),
+		stopReason: message.stopReason === "tool_use" ? "toolUse" : message.stopReason ?? (calls.size ? "toolUse" : "stop"),
+		...message.errorMessage ? { errorMessage: message.errorMessage } : {},
+		timestamp: Date.parse(message.createdAt) || 0,
+		meta
+	});
+	for (const block of message.content) {
+		if (block.type !== "tool_result") continue;
+		const toolName = calls.get(block.tool_use_id) ?? toolNames.get(block.tool_use_id);
+		if (!toolName) continue;
+		result.push({
+			role: "toolResult",
+			toolCallId: block.tool_use_id,
+			toolName,
+			content: typeof block.content === "string" ? [{
+				type: "text",
+				text: block.content
+			}] : block.content.map(projectPiBlock).filter((item) => item !== null),
+			isError: block.is_error ?? false,
+			timestamp: Date.parse(message.createdAt) || 0,
+			meta
+		});
+	}
+	return result;
+}
+function emptyUsage() {
+	return {
+		input: 0,
+		output: 0,
+		cacheRead: 0,
+		cacheWrite: 0,
+		totalTokens: 0,
+		cost: null
+	};
+}
+function projectionMetadata(input) {
+	return {
+		schema: "cohub.projection.v2",
+		spaceId: input.spaceId,
+		sessionId: input.sessionId
+	};
+}
+function trimProjectionTurnsToCompaction(turns) {
+	let boundaryTurn = -1;
+	let boundaryMessage = -1;
+	let boundaryOrder = Number.NEGATIVE_INFINITY;
+	turns.forEach((turn, turnIndex) => {
+		turn.messages.forEach((message, messageIndex) => {
+			if (!isProjectionCompaction(message)) return;
+			const compactedAt = asMeta(messageMeta(message).compaction).compactedAt;
+			const parsed = typeof compactedAt === "string" ? Date.parse(compactedAt) : NaN;
+			const order = Number.isFinite(parsed) ? parsed : turnIndex * 1e6 + messageIndex;
+			if (order >= boundaryOrder) {
+				boundaryTurn = turnIndex;
+				boundaryMessage = messageIndex;
+				boundaryOrder = order;
+			}
+		});
+	});
+	if (boundaryTurn < 0) return turns;
+	return turns.slice(boundaryTurn).flatMap((turn, index) => {
+		const messages = index === 0 ? turn.messages.slice(boundaryMessage).filter((message, messageIndex) => messageIndex === 0 || !isProjectionCompaction(message)) : turn.messages.filter((message) => !isProjectionCompaction(message));
+		return messages.length ? [{
+			...turn,
+			messages
+		}] : [];
+	});
+}
+function piProjection(input) {
+	const sourceTurns = trimProjectionTurnsToCompaction(input.turns);
+	const fallbackTimestamp = input.timestamp ?? DEFAULT_TIMESTAMP;
+	const records = [{
+		key: `header:${input.nativeSessionId}`,
+		sourceTurnId: null,
+		sourceMessageId: null,
+		record: {
+			type: "session",
+			version: 3,
+			id: input.nativeSessionId,
+			timestamp: fallbackTimestamp,
+			cwd: input.cwd,
+			affinity: {
+				sessionId: input.sessionId,
+				threadId: input.nativeSessionId
+			},
+			cohub: projectionMetadata(input)
+		}
+	}];
+	const warnings = [];
+	const nativeIds = /* @__PURE__ */ new Map();
+	const toolNames = /* @__PURE__ */ new Map();
+	const compactions = [];
+	let parentId = null;
+	for (const turn of sourceTurns) for (const message of turn.messages) {
+		if (isPendingGeneration(message)) continue;
+		if (isProjectionCompaction(message)) {
+			const id = `cohub_${safeId(message.id)}_compaction`;
+			const record = {
+				type: "compaction",
+				id,
+				parentId,
+				timestamp: timestampOf(message, fallbackTimestamp),
+				summary: message.content.flatMap((block) => block.type === "system_note" ? [block.text] : []).join("\n"),
+				firstKeptEntryId: "",
+				tokensBefore: Number(asMeta(messageMeta(message).compaction).tokensBefore) || 0
+			};
+			const projectionRecord = {
+				key: `${message.id}:${message.turnId}:compaction`,
+				sourceTurnId: message.turnId,
+				sourceMessageId: message.id,
+				record
+			};
+			records.push(projectionRecord);
+			compactions.push({
+				record: projectionRecord,
+				firstKeptEntryId: typeof asMeta(messageMeta(message).compaction).firstKeptEntryId === "string" ? String(asMeta(messageMeta(message).compaction).firstKeptEntryId) : null
+			});
+			parentId = id;
+			continue;
+		}
+		const projected = projectPiMessage(message, warnings, toolNames);
+		projected.forEach((nativeMessage, ordinal) => {
+			const id = entryId(message.id, ordinal);
+			const record = {
+				type: "message",
+				id,
+				parentId,
+				timestamp: timestampOf(message, fallbackTimestamp),
+				message: nativeMessage
+			};
+			records.push({
+				key: `${message.id}:${message.turnId}:${ordinal}`,
+				sourceTurnId: message.turnId,
+				sourceMessageId: message.id,
+				record
+			});
+			if (!nativeIds.has(message.id)) nativeIds.set(message.id, id);
+			const sourceEntry = messageMeta(message).agentSessionEntryId;
+			if (typeof sourceEntry === "string" && !nativeIds.has(sourceEntry)) nativeIds.set(sourceEntry, id);
+			parentId = id;
+		});
+		if (projected.length === 0 && message.content.length) warnings.push({
+			sourceMessageId: message.id,
+			sourceTurnId: message.turnId,
+			reason: "message has no native Pi representation"
+		});
+	}
+	for (const compaction of compactions) compaction.record.record.firstKeptEntryId = compaction.firstKeptEntryId ? nativeIds.get(compaction.firstKeptEntryId) ?? "" : "";
+	return {
+		target: "pi",
+		records,
+		cursor: {
+			sourceSequence: input.turns.at(-1)?.sequence ?? null,
+			sourceTurnId: input.turns.at(-1)?.sourceTurnId ?? null,
+			sourceFingerprint: sourceFingerprint(input.turns)
+		},
+		warnings
+	};
+}
+function codexInputContent(block) {
+	if (block.type === "text") return [{
+		type: "input_text",
+		text: block.text
+	}];
+	if (block.type === "image" && block.source.type === "base64") return [{
+		type: "input_image",
+		image_url: `data:${block.source.media_type};base64,${block.source.data}`
+	}];
+	return [];
+}
+function codexOutput(block) {
+	return block.type === "text" ? [{
+		type: "output_text",
+		text: block.text
+	}] : [];
+}
+function codexMessageRecords(input, message, warnings) {
+	const timestamp = timestampOf(message, input.timestamp ?? DEFAULT_TIMESTAMP);
+	const records = [];
+	const metadata = { cohub: {
+		...projectionMetadata(input),
+		...projectNativeMessageMeta(message),
+		turnId: message.turnId,
+		messageId: message.id
+	} };
+	if (containsExternalImage(message.content)) warnings.push({
+		sourceMessageId: message.id,
+		sourceTurnId: message.turnId,
+		reason: "external image URL omitted from native projection"
+	});
+	const push = (ordinal, payload) => records.push({
+		key: `${message.id}:${message.turnId}:${ordinal}`,
+		sourceTurnId: message.turnId,
+		sourceMessageId: message.id,
+		record: {
+			timestamp,
+			type: "response_item",
+			payload,
+			metadata
+		}
+	});
+	const plain = message.content.flatMap((block) => block.type === "text" ? [block.text] : []).join("\n");
+	for (const block of message.content) {
+		if (block.type === "image" && block.source.type === "url") continue;
+		if (block.type === "text") push(records.length, {
+			type: "message",
+			role: message.role,
+			content: message.role === "assistant" ? codexOutput(block) : codexInputContent(block)
+		});
+		else if (block.type === "image") {
+			const content = codexInputContent(block);
+			if (content.length) push(records.length, {
+				type: "message",
+				role: "user",
+				content
+			});
+		} else if (block.type === "thinking") push(records.length, {
+			type: "reasoning",
+			summary: [{
+				type: "summary_text",
+				text: block.thinking
+			}],
+			content: null,
+			encrypted_content: null
+		});
+		else if (block.type === "tool_use") push(records.length, {
+			type: "function_call",
+			name: block.name,
+			arguments: JSON.stringify(block.input),
+			call_id: block.id
+		});
+		else if (block.type === "tool_result") push(records.length, {
+			type: "function_call_output",
+			call_id: block.tool_use_id,
+			output: typeof block.content === "string" ? block.content : block.content.flatMap((item) => item.type === "text" ? [item.text] : []).join("\n")
+		});
+	}
+	if (plain) records.push({
+		key: `${message.id}:${message.turnId}:event`,
+		sourceTurnId: message.turnId,
+		sourceMessageId: message.id,
+		record: {
+			timestamp,
+			type: "event_msg",
+			payload: {
+				type: message.role === "user" ? "user_message" : "agent_message",
+				message: plain,
+				kind: "plain"
+			}
+		}
+	});
+	return records;
+}
+function codexTerminalPayload(turn) {
+	const lastAgentMessage = turn.assistantContent?.flatMap((block) => block.type === "text" ? [block.text] : []).join("\n") || null;
+	if (turn.status === "completed") return {
+		type: "turn_complete",
+		turn_id: turn.id,
+		last_agent_message: lastAgentMessage
+	};
+	return {
+		type: "turn_aborted",
+		turn_id: turn.id,
+		reason: turn.status,
+		last_agent_message: lastAgentMessage
+	};
+}
+function codexProjection(input) {
+	const sourceTurns = trimProjectionTurnsToCompaction(input.turns);
+	const fallbackTimestamp = input.timestamp ?? DEFAULT_TIMESTAMP;
+	const records = [{
+		key: `header:${input.nativeSessionId}`,
+		sourceTurnId: null,
+		sourceMessageId: null,
+		record: {
+			timestamp: fallbackTimestamp,
+			type: "session_meta",
+			payload: {
+				id: input.nativeSessionId,
+				session_id: input.nativeSessionId,
+				timestamp: fallbackTimestamp,
+				cwd: input.cwd,
+				originator: "cohub",
+				cli_version: "cohub-runtime",
+				source: "cli",
+				model_provider: input.provider ?? null,
+				history_mode: "legacy",
+				cohub: projectionMetadata(input)
+			}
+		}
+	}];
+	const warnings = [];
+	for (const turn of sourceTurns) {
+		const start = turn.startedAt ?? turn.createdAt;
+		records.push({
+			key: `turn:${turn.id}:started`,
+			sourceTurnId: turn.sourceTurnId,
+			sourceMessageId: null,
+			record: {
+				timestamp: start,
+				type: "event_msg",
+				payload: {
+					type: "turn_started",
+					turn_id: turn.id,
+					started_at: Math.floor(Date.parse(start) / 1e3),
+					model_context_window: null,
+					collaboration_mode_kind: "default"
+				}
+			}
+		});
+		for (const message of turn.messages) if (!isPendingGeneration(message)) records.push(...codexMessageRecords(input, message, warnings));
+		records.push({
+			key: `turn:${turn.id}:terminal`,
+			sourceTurnId: turn.sourceTurnId,
+			sourceMessageId: null,
+			record: {
+				timestamp: turn.completedAt ?? turn.createdAt,
+				type: "event_msg",
+				payload: codexTerminalPayload(turn)
+			}
+		});
+	}
+	return {
+		target: "codex",
+		records,
+		cursor: {
+			sourceSequence: input.turns.at(-1)?.sequence ?? null,
+			sourceTurnId: input.turns.at(-1)?.sourceTurnId ?? null,
+			sourceFingerprint: sourceFingerprint(input.turns)
+		},
+		warnings
+	};
+}
+function projectNativeSession(input, target) {
+	return target === "pi" ? piProjection(input) : codexProjection(input);
+}
+function serializeProjectionRecords(records) {
+	return records.length ? `${records.map((record) => JSON.stringify(record.record)).join("\n")}\n` : "";
+}
+function serializeProjection(projection) {
+	return serializeProjectionRecords(projection.records);
+}
+function fingerprintProjectionTurns(turns) {
+	return `${turns.length}:${fingerprint(turns)}`;
+}
+//#endregion
 //#region ../protocol/dist/runtime/context.js
 const createEmptyUsage = () => ({
 	input: 0,
@@ -1483,6 +1943,7 @@ function contextToPiMessages(messages, options = {}) {
 //#region ../protocol/dist/runtime/index.js
 const RUNTIME_PROTOCOL_VERSION = 1;
 const RUNTIME_MAX_FRAME_BYTES = 33554432;
+const RUNTIME_RECOVERY_BATCH_SIZE = 64;
 z.enum([
 	"cohub",
 	"pi",
@@ -1502,8 +1963,14 @@ const runtimeCapabilitiesSchema = z.object({
 		name: z.string().max(255)
 	})).max(2e3)
 });
+const runtimePendingExecutionSchema = z.object({
+	sessionId: z.string().uuid(),
+	turnId: z.string().uuid(),
+	harness: z.enum(["pi", "codex"])
+}).strict();
 z.object({
 	connectionId: z.string().uuid(),
+	runtimeId: z.string().uuid().optional(),
 	endpoint: z.url({ protocol: /^wss?$/ }),
 	ownerUserId: z.string().min(1),
 	capabilities: runtimeCapabilitiesSchema
@@ -1512,7 +1979,35 @@ const runtimeReadySchema = z.object({
 	type: z.literal("runtime.ready"),
 	connectionId: z.string().uuid()
 });
+const runtimeTraceContextSchema = z.object({
+	requestId: z.string().regex(/^[a-zA-Z0-9._:-]{1,128}$/).optional(),
+	traceId: z.string().regex(/^[0-9a-f]{32}$/i).nullable().optional(),
+	spanId: z.string().regex(/^[0-9a-f]{16}$/i).nullable().optional(),
+	traceparent: z.string().regex(/^[0-9a-f]{2}-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$/i).nullable().optional()
+}).strict();
+z.object({
+	backend: z.enum([
+		"fsevents",
+		"fsnotify",
+		"scan",
+		"none"
+	]),
+	state: z.enum([
+		"running",
+		"degraded",
+		"unavailable"
+	]),
+	reason: z.enum([
+		"polling",
+		"watch_error",
+		"start_failed",
+		"coverage_incomplete",
+		"root_changed"
+	]).optional(),
+	observedAt: z.iso.datetime()
+});
 z.object({
+	expectedTurnId: z.string().uuid(),
 	revision: z.string().min(1),
 	confirmed: z.literal(true)
 }).strict();
@@ -1577,8 +2072,7 @@ const runtimeEventSchema = z.discriminatedUnion("type", [
 	}),
 	z.object({
 		type: z.literal("context.required"),
-		pendingTurnIds: z.array(id).max(2).optional(),
-		historyOnly: z.boolean().optional()
+		pendingTurnIds: z.array(id).max(2).optional()
 	}),
 	z.object({ type: z.literal("turn.acknowledged") }),
 	z.object({
@@ -1594,7 +2088,11 @@ z.discriminatedUnion("type", [
 		spaceId: id,
 		token: z.string().min(1).max(16384),
 		capabilities: runtimeCapabilitiesSchema
-	}),
+	}).strict(),
+	z.object({
+		type: z.literal("runtime.recovery"),
+		executions: z.array(runtimePendingExecutionSchema).min(1).max(64)
+	}).strict(),
 	z.object({ type: z.literal("runtime.heartbeat") }),
 	z.object({
 		type: z.literal("runtime.auth"),
@@ -1639,7 +2137,8 @@ const runtimeCommandSchema = z.discriminatedUnion("type", [
 			sessionId: id,
 			turnId: id,
 			harness: z.enum(["pi", "codex"])
-		})
+		}),
+		traceContext: runtimeTraceContextSchema.optional()
 	}),
 	z.object({
 		type: z.literal("turn.start"),
@@ -1661,6 +2160,8 @@ const runtimeCommandSchema = z.discriminatedUnion("type", [
 			provider: z.string().nullable().optional(),
 			model: z.string().nullable().optional(),
 			thinkingLevel: z.string().nullable().optional(),
+			requestId: z.string().regex(/^[a-zA-Z0-9._:-]{1,128}$/).nullable().optional(),
+			traceContext: runtimeTraceContextSchema.optional(),
 			accessMode: z.enum(["read_only", "full_access"])
 		}).refine((input) => {
 			const owner = input.messages.at(-1);
@@ -2823,50 +3324,97 @@ var ParentBridgeTransport = class {
 		});
 	}
 };
-/**
-* Broker-mode transport for standalone-deployed apps. Opens a popup window to
-* the Cohub auth broker page, performs a ready-handshake, sends the request via
-* postMessage, and resolves with the broker's response. The popup is closed
-* after a single request is fulfilled (one-shot, per §7.2 of the plan).
-*
-* Non-interactive messages (`context`, `checkout-state`) are answered locally
-* without opening a popup — the app already knows its own appId, and
-* checkout state is not available on the app's own origin in broker mode.
-*/
 var PopupBrokerTransport = class {
 	supportsNavigation = false;
+	memoryOnly = true;
 	brokerOrigin;
 	appId;
 	getAppId;
+	app;
+	getApp;
+	viewerGrants = [];
+	viewerIdentity;
+	getViewerIdentity() {
+		return this.viewerIdentity;
+	}
+	observeViewerIdentity(next) {
+		if (next !== void 0 && this.viewerIdentity !== void 0 && next !== this.viewerIdentity) this.viewerGrants = [];
+		if (next !== void 0) this.viewerIdentity = next;
+	}
 	constructor(config) {
 		this.brokerOrigin = config.brokerOrigin;
 		this.appId = config.appId;
 		this.getAppId = config.getAppId;
-		if (!this.appId && this.getAppId) this.getAppId();
+		this.app = config.app;
+		this.getApp = config.getApp;
+		if (!this.app && this.getApp) this.getApp();
+		else if (!this.appId && this.getAppId) this.getAppId();
+	}
+	async resolveApp() {
+		if (this.app) return this.app;
+		const resolved = await this.getApp?.();
+		if (resolved) return resolved;
+		const appId = this.appId ?? await this.getAppId?.() ?? null;
+		return appId ? {
+			id: appId,
+			slug: "",
+			url: null,
+			homeSpace: {
+				id: "",
+				name: null
+			},
+			appScopes: []
+		} : null;
 	}
-	resolveAppId() {
-		if (this.appId) return Promise.resolve(this.appId);
-		if (this.getAppId) return this.getAppId();
-		return Promise.resolve(null);
+	async resolveAppId() {
+		return (await this.resolveApp())?.id ?? null;
 	}
 	async request(message, options) {
-		if (message.type === "cohub.app.context") return {
-			type: "cohub.app.context.result",
-			context: {
-				mode: "broker",
-				app: {
-					id: await this.resolveAppId() ?? "",
-					slug: "",
-					url: null
-				},
-				space: { id: "" },
-				permissions: {
-					scopes: [],
-					appScopes: [],
-					viewerScopes: []
+		if (message.type === "cohub.app.context") {
+			const app = await this.resolveApp();
+			if (!app) return null;
+			const viewerScopes = Array.from(new Set(this.viewerGrants.flatMap((grant) => grant.scopes)));
+			return {
+				type: "cohub.app.context.result",
+				context: {
+					capabilities: {
+						authorization: 2,
+						serverGrants: true
+					},
+					mode: "broker",
+					app: {
+						id: app.id,
+						slug: app.slug,
+						url: app.url,
+						homeSpace: { ...app.homeSpace }
+					},
+					space: {
+						id: app.homeSpace.id,
+						name: app.homeSpace.name
+					},
+					...this.viewerIdentity !== void 0 ? { viewer: this.viewerIdentity ? { userUuid: this.viewerIdentity } : null } : {},
+					invocation: {
+						surface: "broker",
+						source: "route"
+					},
+					shell: {
+						surface: "broker",
+						space: null,
+						session: null,
+						turn: null
+					},
+					permissions: {
+						scopes: Array.from(/* @__PURE__ */ new Set([...app.appScopes, ...viewerScopes])),
+						appScopes: [...app.appScopes],
+						viewerScopes,
+						viewerGrants: this.viewerGrants.map((grant) => ({
+							...grant,
+							scopes: [...grant.scopes]
+						}))
+					}
 				}
-			}
-		};
+			};
+		}
 		if (message.type === "cohub.app.checkout-state") return {
 			type: "cohub.app.checkout-state.result",
 			status: null,
@@ -2883,7 +3431,7 @@ var PopupBrokerTransport = class {
 			}
 			const appOrigin = window.location.origin;
 			const brokerUrl = `${this.brokerOrigin}/app-auth?app=${encodeURIComponent(appId)}&origin=${encodeURIComponent(appOrigin)}`;
-			const popup = window.open(brokerUrl, "cohub-app-auth", "popup,width=480,height=640");
+			const popup = window.open(brokerUrl, `cohub-app-auth-${appId}`, "popup,width=480,height=640");
 			if (!popup) {
 				reject(/* @__PURE__ */ new Error("Failed to open authorization window. Please allow popups for this site."));
 				return;
@@ -2922,6 +3470,8 @@ var PopupBrokerTransport = class {
 					return;
 				}
 				if (data.type === "cohub.app.broker.ready" && !ready) {
+					const brokerViewer = data.viewer;
+					this.observeViewerIdentity(brokerViewer === null ? null : typeof brokerViewer?.userUuid === "string" ? brokerViewer.userUuid : void 0);
 					if (message.type === "cohub.app.authorize.v2" && data.authorizationVersion !== 2) {
 						finish(() => reject(new AppRuntimeError("unsupported", "This host does not support structured authorization.")));
 						return;
@@ -2945,6 +3495,29 @@ var PopupBrokerTransport = class {
 						reject(new AppRuntimeError(data.code ?? "request_failed", data.message, requestId));
 						return;
 					}
+					const rawResult = data.result;
+					if (message.type === "cohub.app.authorize.v2") {
+						const parsedResult = appAuthorizationResultSchema.safeParse(rawResult);
+						if (!parsedResult.success) {
+							reject(new AppRuntimeError("invalid_response", "Invalid authorization result.", requestId));
+							return;
+						}
+						const authorization = parsedResult.data;
+						if (authorization.status === "granted") {
+							const token = data.token;
+							if (typeof token !== "string" || !token) {
+								reject(new AppRuntimeError("invalid_response", "Authorization token is missing.", requestId));
+								return;
+							}
+							const knownScopes = new Set(PERMISSIONS);
+							const scopes = authorization.grant.scopes.filter((scope) => knownScopes.has(scope));
+							const existing = this.viewerGrants.filter((grant) => grant.spaceId !== authorization.grant.spaceId);
+							this.viewerGrants = [...existing, {
+								spaceId: authorization.grant.spaceId,
+								scopes
+							}];
+						}
+					}
 					resolve(data);
 				});
 			};
@@ -3112,7 +3685,7 @@ var AppRuntimeApi = class {
 		return this.storageKeysReady;
 	}
 	readStoredToken() {
-		if (this.transport instanceof PopupBrokerTransport) {
+		if (this.transport.memoryOnly) {
 			this.writeStoredToken(null);
 			return null;
 		}
@@ -3124,7 +3697,7 @@ var AppRuntimeApi = class {
 		}
 	}
 	writeStoredToken(token) {
-		if (this.transport instanceof PopupBrokerTransport) token = null;
+		if (this.transport.memoryOnly) token = null;
 		if (!this.tokenStorageKey || typeof localStorage === "undefined") return;
 		try {
 			if (token) localStorage.setItem(this.tokenStorageKey, token);
@@ -3132,6 +3705,12 @@ var AppRuntimeApi = class {
 		} catch {}
 	}
 	readStoredGrants() {
+		if (this.transport.memoryOnly) {
+			if (this.grantsStorageKey && typeof localStorage !== "undefined") try {
+				localStorage.removeItem(this.grantsStorageKey);
+			} catch {}
+			return null;
+		}
 		if (!this.grantsStorageKey || typeof localStorage === "undefined") return null;
 		try {
 			const raw = localStorage.getItem(this.grantsStorageKey);
@@ -3144,6 +3723,7 @@ var AppRuntimeApi = class {
 		}
 	}
 	writeStoredGrants(grants) {
+		if (this.transport.memoryOnly) return;
 		if (!this.grantsStorageKey || typeof localStorage === "undefined") return;
 		try {
 			if (grants && grants.length > 0) localStorage.setItem(this.grantsStorageKey, JSON.stringify(grants));
@@ -3152,12 +3732,11 @@ var AppRuntimeApi = class {
 	}
 	serverGrants = false;
 	viewerIdentity;
-	identityVersion = 0;
-	contextUnsubscribe = null;
-	observeContext(context) {
-		if (context.capabilities?.serverGrants) this.serverGrants = true;
-		if (context.viewer === void 0) return;
-		const viewer = context.viewer?.userUuid ?? null;
+	observeTransportIdentity() {
+		const viewer = this.transport.getViewerIdentity?.();
+		if (viewer !== void 0) this.observeViewer(viewer);
+	}
+	observeViewer(viewer) {
 		if (this.viewerIdentity !== void 0 && viewer !== this.viewerIdentity) {
 			this.identityVersion++;
 			this.token = null;
@@ -3167,7 +3746,15 @@ var AppRuntimeApi = class {
 		}
 		this.viewerIdentity = viewer;
 	}
+	identityVersion = 0;
+	contextUnsubscribe = null;
+	observeContext(context) {
+		if (context.capabilities?.serverGrants) this.serverGrants = true;
+		if (context.viewer === void 0) return;
+		this.observeViewer(context.viewer?.userUuid ?? null);
+	}
 	async context() {
+		this.observeTransportIdentity();
 		const response = await this.transport.request({ type: "cohub.app.context" }, {
 			timeoutMs: 8e3,
 			retryIntervalMs: 250
@@ -3253,6 +3840,7 @@ var AppRuntimeApi = class {
 	}
 	async getAccessToken(options) {
 		await this.ensureStorageKeys();
+		this.observeTransportIdentity();
 		const identityVersion = this.identityVersion;
 		if (this.token && !options?.forceRefresh) return this.token;
 		if (options?.forceRefresh) {
@@ -3268,14 +3856,16 @@ var AppRuntimeApi = class {
 					scopes: grant.scopes,
 					spaceId: grant.spaceId
 				}, { timeoutMs: 12e4 });
-				if (identityVersion !== this.identityVersion) return null;
+				this.observeTransportIdentity();
+				if (identityVersion !== this.identityVersion && !this.transport.memoryOnly) return null;
 				const token = response?.token ?? null;
 				if (!token) continue;
 				this.token = token;
 				next = recordConsent(next, responseSpaceId(response?.space?.id) ?? grant.spaceId, grant.scopes);
 				refreshed = true;
 			} catch {
-				if (identityVersion !== this.identityVersion) return null;
+				this.observeTransportIdentity();
+				if (identityVersion !== this.identityVersion && !this.transport.memoryOnly) return null;
 				next = recordConsent(next, grant.spaceId, grant.scopes);
 			}
 			this.authorizedGrants = next;
@@ -3289,7 +3879,8 @@ var AppRuntimeApi = class {
 			type: "cohub.app.token",
 			forceRefresh: Boolean(options?.forceRefresh)
 		}, { timeoutMs: 2e4 });
-		if (identityVersion !== this.identityVersion) return null;
+		this.observeTransportIdentity();
+		if (identityVersion !== this.identityVersion && !this.transport.memoryOnly) return null;
 		this.token = response?.token ?? null;
 		this.writeStoredToken(this.token);
 		return this.token;
@@ -3306,7 +3897,8 @@ var AppRuntimeApi = class {
 			type: "cohub.app.authorize.v2",
 			...parsed.data
 		}, { timeoutMs: 12e4 });
-		if (identityVersion !== this.identityVersion) throw new AppRuntimeError("session_changed", "The signed-in account changed. Please try again.");
+		this.observeTransportIdentity();
+		if (identityVersion !== this.identityVersion && !this.transport.memoryOnly) throw new AppRuntimeError("session_changed", "The signed-in account changed. Please try again.");
 		if (!response) throw new AppRuntimeError("host_timeout", "Authorization host did not respond. It may not support structured authorization.");
 		const result = appAuthorizationResultSchema.safeParse(response.result);
 		if (!result.success) throw new AppRuntimeError("invalid_response", "Invalid authorization result.");
@@ -3332,6 +3924,7 @@ var AppRuntimeApi = class {
 	*/
 	async requestAuthorization(input) {
 		await this.ensureStorageKeys();
+		this.observeTransportIdentity();
 		const response = await this.transport.request({
 			type: "cohub.app.authorize",
 			scopes: input.scopes,
@@ -3339,6 +3932,7 @@ var AppRuntimeApi = class {
 			spaceId: input.spaceId,
 			alwaysAsk: input.alwaysAsk
 		}, { timeoutMs: 12e4 });
+		this.observeTransportIdentity();
 		const token = response?.token ?? null;
 		if (token) {
 			this.token = token;
@@ -3357,6 +3951,7 @@ var AppRuntimeApi = class {
 	*/
 	async requestSpaceAuthorization(input) {
 		await this.ensureStorageKeys();
+		this.observeTransportIdentity();
 		const response = await this.transport.request({
 			type: "cohub.app.authorize",
 			scopes: input.scopes,
@@ -3364,6 +3959,7 @@ var AppRuntimeApi = class {
 			selectSpace: true,
 			alwaysAsk: input.alwaysAsk
 		}, { timeoutMs: 12e4 });
+		this.observeTransportIdentity();
 		const token = response?.token ?? null;
 		const spaceId = typeof response?.space?.id === "string" ? response.space.id : null;
 		const spaceName = typeof response?.space?.name === "string" ? response.space.name : null;
@@ -3393,12 +3989,14 @@ var AppRuntimeApi = class {
 	*/
 	async requestCreateSpaceAuthorization(input) {
 		await this.ensureStorageKeys();
+		this.observeTransportIdentity();
 		const response = await this.transport.request({
 			type: "cohub.app.authorize",
 			scopes: input.scopes,
 			reason: input.reason,
 			createSpace: input.space
 		}, { timeoutMs: 12e4 });
+		this.observeTransportIdentity();
 		const token = response?.token ?? null;
 		const spaceId = typeof response?.space?.id === "string" ? response.space.id : null;
 		const spaceName = typeof response?.space?.name === "string" ? response.space.name : null;
@@ -3433,6 +4031,83 @@ var AppRuntimeApi = class {
 		}) ?? null;
 	}
 };
+/** Resolves complete App identity from the browser's current standalone origin. */
+function createOriginAppResolver(deps) {
+	let cached = null;
+	return () => {
+		if (cached) return cached;
+		const run = (async () => {
+			const doFetch = deps.fetch ?? globalThis.fetch;
+			const origin = deps.origin?.() ?? (typeof window !== "undefined" ? window.location.origin : null);
+			if (typeof doFetch !== "function" || !origin) return null;
+			const response = await doFetch(`${deps.apiBaseUrl}/api/apps/by-origin`, {
+				credentials: "omit",
+				headers: { Accept: "application/json" }
+			});
+			if (response.status === 404) return null;
+			if (!response.ok) throw new Error(`getByOrigin failed: ${response.status}`);
+			const data = await response.json();
+			const app = data?.app;
+			const space = data?.space;
+			if (typeof app?.id !== "string" || typeof app.slug !== "string" || typeof app.spaceId !== "string" || typeof space?.id !== "string" || space.id !== app.spaceId) return null;
+			const knownScopes = new Set(PERMISSIONS);
+			const appScopes = Array.isArray(app.appScopes) ? app.appScopes.filter((scope) => typeof scope === "string" && knownScopes.has(scope)) : [];
+			return {
+				id: app.id,
+				slug: app.slug,
+				url: origin,
+				homeSpace: {
+					id: space.id,
+					name: typeof space.name === "string" ? space.name : null
+				},
+				appScopes
+			};
+		})().catch(() => {
+			cached = null;
+			return null;
+		});
+		cached = run;
+		return run;
+	};
+}
+/**
+* Defers standalone origin discovery until the runtime is first used.
+* Apps should initialize `context()` before click-triggered authorization so
+* discovery does not consume the browser's transient user activation.
+*/
+var OriginBrokerTransport = class {
+	brokerOrigin;
+	resolveApp;
+	supportsNavigation = false;
+	memoryOnly = true;
+	transport = null;
+	resolvedTransport = null;
+	getViewerIdentity() {
+		return this.resolvedTransport?.getViewerIdentity();
+	}
+	constructor(brokerOrigin, resolveApp) {
+		this.brokerOrigin = brokerOrigin;
+		this.resolveApp = resolveApp;
+	}
+	resolveTransport() {
+		if (this.transport) return this.transport;
+		const attempt = this.resolveApp().then((app) => app ? new PopupBrokerTransport({
+			brokerOrigin: this.brokerOrigin,
+			app
+		}) : null).then((transport) => {
+			this.resolvedTransport = transport;
+			return transport;
+		}).catch(() => null);
+		this.transport = attempt;
+		attempt.then((transport) => {
+			if (!transport && this.transport === attempt) this.transport = null;
+		});
+		return attempt;
+	}
+	async request(message, options) {
+		return (await this.resolveTransport())?.request(message, options) ?? null;
+	}
+};
 /**
 * Builds a memoized appId resolver that reverse-looks-up the appId from the
 * public slug triple via `GET /api/apps/by-slug/:username/:spaceSlug/:appSlug`
@@ -3461,11 +4136,10 @@ function createSlugAppIdResolver(deps) {
 	};
 }
 /**
-* Resolves the appropriate transport based on the app mode configuration.
-* Auto-detection: inside an iframe → bridge; standalone with broker config →
-* broker; otherwise → bridge (returns null for non-app contexts).
+* Resolves the appropriate transport. Iframes use the parent bridge;
+* standalone pages use explicit legacy configuration or Origin discovery.
 */
-function resolveAppTransport(config, appIdResolver) {
+function resolveAppTransport(config, appIdResolver, originAppResolver, defaultBrokerOrigin) {
 	const explicitMode = config?.mode;
 	const brokerOrigin = config?.brokerOrigin;
 	const appId = config?.appId;
@@ -3479,7 +4153,9 @@ function resolveAppTransport(config, appIdResolver) {
 	if (explicitMode === "bridge") return new ParentBridgeTransport();
 	if (explicitMode === "broker") return createBroker();
 	if (typeof window !== "undefined" && window.parent !== window) return new ParentBridgeTransport();
-	return hasBrokerConfig ? createBroker() : new ParentBridgeTransport();
+	if (hasBrokerConfig) return createBroker();
+	if (originAppResolver && defaultBrokerOrigin) return new OriginBrokerTransport(defaultBrokerOrigin, originAppResolver);
+	return new ParentBridgeTransport();
 }
 const createAppRuntime = (transport, appId, appIdResolver) => new AppRuntimeApi(transport, appId, appIdResolver);
 //#endregion
@@ -3532,7 +4208,10 @@ var CohubClient = class {
 			spaceSlug: appRuntime.spaceSlug,
 			appSlug: appRuntime.appSlug
 		}) : void 0;
-		const appTransport = resolveAppTransport(appRuntime, appIdResolver);
+		const appTransport = resolveAppTransport(appRuntime, appIdResolver, createOriginAppResolver({
+			apiBaseUrl,
+			fetch: options.fetch
+		}), resolveWebBaseUrl({ env: options.env }));
 		this.appRuntime = createAppRuntime(appTransport, appRuntime?.appId, appIdResolver);
 		const executionToken = resolveExecutionToken();
 		const getAccessToken = options.getAccessToken ?? (executionToken ? () => executionToken : (tokenOptions) => this.appRuntime.getAccessToken(tokenOptions));
@@ -4007,7 +4686,7 @@ const isDefinitiveAuthorizationFailure = (error) => error instanceof AppAuthoriz
 	401,
 	403,
 	404
-].includes(error.status);
+].includes(error.status) && error.code !== "host_unavailable";
 /** A grant the server rejected (revoked / not found) — safe to drop from cache. */
 const isGrantRejection = (error) => error instanceof AppAuthorizationError && [403, 404].includes(error.status);
 /** A stale access token — never a revoked grant, so never clear the cache. */
@@ -4435,20 +5114,25 @@ function createAppBridgeCore(config) {
 			throw new AppLoginRedirect();
 		}
 		const authorizingViewer = await getViewerUuid();
-		const response = await fetch(`${apiOrigin}/api/apps/${app.id}/authorize`, {
-			method: "POST",
-			signal: timeoutSignal(AUTHORIZE_TIMEOUT_MS),
-			headers: {
-				Authorization: `Bearer ${userToken}`,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({
-				scopes,
-				...spaceId ? { spaceId } : {},
-				...options?.silent ? { silent: true } : {},
-				...incremental ? { scopeMode: "extend" } : {}
-			})
-		});
+		let response;
+		try {
+			response = await fetch(`${apiOrigin}/api/apps/${app.id}/authorize`, {
+				method: "POST",
+				signal: timeoutSignal(AUTHORIZE_TIMEOUT_MS),
+				headers: {
+					Authorization: `Bearer ${userToken}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify({
+					scopes,
+					...spaceId ? { spaceId } : {},
+					...options?.silent ? { silent: true } : {},
+					...incremental ? { scopeMode: "extend" } : {}
+				})
+			});
+		} catch (error) {
+			throw new AppAuthorizationError(error instanceof DOMException && error.name === "TimeoutError" ? "Authorization request timed out." : "Authorization request failed.", 503, "host_unavailable");
+		}
 		const payload = await response.json().catch(() => null);
 		if (!response.ok) throw new AppAuthorizationError(typeof payload?.message === "string" ? payload.message : "Authorization failed.", response.status, typeof payload?.code === "string" ? payload.code : void 0);
 		if (authorizingViewer !== await getViewerUuid()) throw new AppAuthorizationError("The signed-in account changed. Please try again.", 409, "session_changed");
@@ -4489,6 +5173,55 @@ function createAppBridgeCore(config) {
 		}
 	}
 	/**
+	* Silently renews the approved read-only scopes on the current Shell Space.
+	*
+	* Deciding that a request needs no dialog is the Host's job: it compares the
+	* target against the Space it is actually showing. That check only decides
+	* *whether to ask*; the server still decides *what may be granted* through
+	* the silent path, so a revoked consent can never come back on its own.
+	*/
+	const shellAuthorizationInFlight = /* @__PURE__ */ new Map();
+	const shellAuthorizationCache = /* @__PURE__ */ new Map();
+	const SHELL_AUTH_CACHE_MS = 3e4;
+	async function authorizeShellSilently(scopes, spaceId) {
+		const shellContext = config.getShell?.() ?? config.shell;
+		const shell = shellContext?.space ?? null;
+		if (!shellContext || authorizationContext.surface === "broker" || !shell || shell.id !== spaceId) throw new AppAuthorizationError("Shell authorization is unavailable for this surface.", 403, "consent_required");
+		const viewerUuid = await getViewerUuid();
+		if (!viewerUuid) {
+			await startSignIn();
+			throw new AppLoginRedirect();
+		}
+		const cacheKey = `${viewerUuid}:${app.id}:${spaceId}:${[...scopes].sort().join(",")}`;
+		const cached = shellAuthorizationCache.get(cacheKey);
+		if (cached && cached.expiresAt > Date.now()) return cached.result;
+		if (cached) shellAuthorizationCache.delete(cacheKey);
+		const pending = shellAuthorizationInFlight.get(cacheKey);
+		if (pending) return pending;
+		const request = authorize(scopes, spaceId, { silent: true });
+		shellAuthorizationInFlight.set(cacheKey, request);
+		try {
+			const result = await request;
+			shellAuthorizationCache.set(cacheKey, {
+				result,
+				expiresAt: Date.now() + SHELL_AUTH_CACHE_MS
+			});
+			return result;
+		} finally {
+			shellAuthorizationInFlight.delete(cacheKey);
+		}
+	}
+	/**
+	* Reads the Shell Space supplied by the current Host. Invocation context is
+	* deliberately excluded: an App may be opened from one Space while the Shell
+	* shows another; the Host/Shell broker remains the authorization authority.
+	*/
+	function resolveShellSpace() {
+		const shell = config.getShell?.() ?? config.shell;
+		if (!shell || shell.surface === "broker") return null;
+		return shell.space;
+	}
+	/**
 	* Attempts silent renewal against each target in order. Returns true when the
 	* request was answered (success or terminal error); false when every target
 	* was a rejected grant, so the caller should fall back to consent.
@@ -4940,6 +5673,28 @@ function createAppBridgeCore(config) {
 					await startSignIn();
 					return;
 				}
+				const shellSpace = resolveShellSpace();
+				const shellTargetId = spaceId ?? shellSpace?.id;
+				if (!alwaysAsk && !selectSpace && Boolean(shellTargetId && (!spaceId || shellSpace?.id === spaceId)) && scopes.every(isAppSilentShellScope) && shellTargetId) try {
+					const result = await authorizeShellSilently(scopes, shellTargetId);
+					if (state.pendingAuth !== reserved) return;
+					setGrantedAppScopes(await getViewerUuid(), app.id, result.scopes, result.spaceId);
+					replyPendingAuth(reserved, authorizeResult(result.token, result.spaceId, shellSpace?.name ?? null));
+					resetDialogState();
+					safeNotify();
+					return;
+				} catch (error) {
+					if (error instanceof AppLoginRedirect) throw error;
+					if (!isDefinitiveAuthorizationFailure(error)) {
+						replyPendingAuth(reserved, {
+							type: "cohub.app.error",
+							message: error instanceof Error ? error.message : "Authorization failed."
+						});
+						resetDialogState();
+						safeNotify();
+						return;
+					}
+				}
 				const spaceLevel = Boolean(spaceId) || selectSpace || scopes.some((scope) => !isUserLevelPermission(scope));
 				const lastPicked = readLastPickedSpace();
 				const contextSpaceId = resolveContextSpaceId();
@@ -5419,4 +6174,4 @@ function createBoardExtensionRegistry() {
 }
 const BOARD_CHANNELS = BOARD_ANIMATION_CHANNELS;
 //#endregion
-export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppRuntimeError, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, RUNTIME_ARCHIVE_SEGMENT_BYTES, RUNTIME_MAX_FRAME_BYTES, RUNTIME_PROTOCOL_VERSION, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, USER_LEVEL_PERMISSIONS, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, contextToPiMessages, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, filterSpacePickerItems, findGenerationModelPolicy, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, harnessArchiveIndexSchema, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isLocalHarness, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUserLevelPermission, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeSpacePickerQuery, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, orderSpacePickerItems, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveHarness, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebsocketUrl, runtimeCommandSchema, runtimeEventSchema, runtimeReadySchema, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, selectRuntimeContextMessages, selectSpacePickerItems, setGrantedAppScopes, track, validateArchiveBoundary };
+export { APP_COMPOSER_CHIP_CONTENT_MAX_BYTES, APP_COMPOSER_CHIP_KEY_MAX_LENGTH, APP_COMPOSER_CHIP_LABEL_MAX_LENGTH, APP_SURFACE_READY_TIMEOUT_MS, APP_SURFACE_REQUEST_TIMEOUT_MS, AppCommerceApi, AppRealtimeApi, AppRefParseError, AppRoom, AppRuntimeApi, AppRuntimeApi as WorkRuntimeApi, AppRuntimeError, AppSurfaceApi, AppsApi, BILLING_ACCESS_BLOCKED_ERROR_CODE, BOARD_ANIMATION_CHANNEL_CAPABILITIES, BOARD_CHANNELS, BOARD_COLOR_IDS, BOARD_GEO_KINDS, BillingApi, BoardAnimationSpecSchema, BoardAuthoringItemSchema, BoardClient, BoardCompositionInputSchema, BoardCompositionSchema, BoardDealParamsSchema, BoardEffectInputSchema, BoardEffectSchema, BoardExtensionRegistry, BoardItemPatchSchema, BoardPlaybackPolicySchema, BoardSemanticCommandSchema, COHUB_ENVIRONMENTS, COHUB_SOURCE_HEADER, COHUB_SOURCE_HEADER_NAMES, CohubClient, CohubHttpClient, DEFAULT_BOARD_LIMITS, DESKTOP_COMMAND_DEFAULT_TIMEOUT_MS, DESKTOP_COMMAND_MAX_TIMEOUT_MS, DESKTOP_COMMAND_PAYLOAD_MAX_BYTES, DESKTOP_COMMAND_PENDING_TTL_SECONDS, DESKTOP_COMMAND_SETTLEMENT_GRACE_SECONDS, DESKTOP_COMMAND_TERMINAL_TTL_SECONDS, DESKTOP_COMMAND_VERSION, DesktopCommandsApi, FEATURE_NOT_ENTITLED_ERROR_CODE, GenerationPolicyError, HttpError, OriginBrokerTransport, PERMISSIONS, ParentBridgeTransport, PopupBrokerTransport, REQUEST_SOURCE_VIA_MAX_LENGTH, RUNTIME_ARCHIVE_SEGMENT_BYTES, RUNTIME_MAX_FRAME_BYTES, RUNTIME_PROTOCOL_VERSION, RUNTIME_RECOVERY_BATCH_SIZE, ReferencesApi, ReferralsApi, SessionGenerationStreamClient, SessionPatchReducer, SpacePublicFilesApi, SpaceWebhooksApi, USER_LEVEL_PERMISSIONS, UiCommandsApi, UsersApi, VoiceApi, VoiceInputClient, WebsocketClient, WorkCommerceApi, WorkRealtimeApi, WorkRefParseError, WorkRoom, WorkSurfaceApi, assertGenerationRequestAllowedByPolicy, attachAppEmbed, buildAppSurfaceRequest, buildSpaceInvitePath, buildSpacePath, clearGrantedAppScopes, compileComposition, composition, contextToPiMessages, createAppBridgeCore, createAppBridgeCore as createWorkBridgeCore, createAppRuntime, createAppRuntime as createWorkRuntime, createBoardExtensionRegistry, createCohubClient, createHttpClient, createOriginAppResolver, createSessionGenerationStreamClient, createSessionPatchReducer, createSlugAppIdResolver, createSlugAppIdResolver as createSlugWorkIdResolver, createVoiceInputClient, createWebsocketClient, decodeGenerationPolicy, encodeGenerationPolicy, extractBillingPayload, filterDiscoverableGenerationModels, filterGenerationDeclarationsByPolicy, filterSpacePickerItems, findGenerationModelPolicy, fingerprintProjectionTurns, formatAppRef, formatWorkRef, getAllowedGenerationModelIds, getCohubContext, harnessArchiveIndexSchema, hasGrantedAppScopes, hasRequestSourceIdentity, isAppId, isBillingAccessBlockedCode, isBillingAccessBlockedError, isDesktopCallMethod, isFeatureNotEntitledError, isGenerationModelHidden, isHttpErrorCode, isLocalHarness, isProjectionCompaction, isRequestSourceClientId, isRequestSourceEmpty, isRequestSourceUuid, isTerminalDesktopCommandStatus, isUserLevelPermission, isUuid, isWorkId, joinApiUrl, matchesUnauthorizedErrorToken, mergeRequestSourceIntoMeta, normalizeBaseUrl, normalizeGenerationPolicy, normalizeRequestSource, normalizeSpacePickerQuery, normalizeVoiceInputWebsocketUrl, normalizeWebsocketUrl, orderSpacePickerItems, parseAppRef, parseAppSurfaceReady, parseAppSurfaceResponse, parseAssistantMessageCommit, parseBoardCompositionInput, parseBoardEffectInput, parseBoardPlaybackPolicy, parseDesktopCommand, parseGenerationPolicyFromEnv, parseRequestSourceFromHeaders, parseWorkRef, proceduralClip, projectNativeMessageMeta, projectNativeSession, readRequestSourceFromEnv, requestSourceToHeaders, resolveApiBaseUrl, resolveAppTransport, resolveAppTransport as resolveWorkTransport, resolveCohubEnvironment, resolveExecutionAppId, resolveExecutionToken, resolveHarness, resolveOpenSurface, resolveRequestSourceChannel, resolveVoiceInputWebsocketUrl, resolveWebBaseUrl, resolveWebsocketUrl, runtimeCommandSchema, runtimeEventSchema, runtimeReadySchema, sampleCompositionTracks, sampleEasing, sampleTrack, sanitizeAccessToken, scopeListHasPermission, selectRuntimeContextMessages, selectSpacePickerItems, serializeProjection, serializeProjectionRecords, setGrantedAppScopes, track, trimProjectionTurnsToCompaction, validateArchiveBoundary };