@nextclaw/ui 0.13.8 → 0.13.9

package/src/features/panel-apps/managers/panel-app-bridge.manager.test.ts

@@ -9,6 +9,7 @@ const mocks = vi.hoisted(() => ({
   generateAgentObject: vi.fn(),
   grantAgentCapability: vi.fn(),
   grantServiceAction: vi.fn(),
+  grantServiceActions: vi.fn(),
   invokeServiceAction: vi.fn(),
   listServiceActions: vi.fn(),
   sendAgentMessage: vi.fn(),
@@ -25,6 +26,7 @@ vi.mock('@/shared/lib/api', () => ({
     },
     serviceApps: {
       grantServiceAction: mocks.grantServiceAction,
+      grantServiceActions: mocks.grantServiceActions,
       invokeServiceAction: mocks.invokeServiceAction,
       listServiceActions: mocks.listServiceActions,
       revokeServiceAction: vi.fn(),
@@ -36,22 +38,54 @@ afterEach(() => {
   vi.clearAllMocks();
 });
 
+function createManager(): PanelAppBridgeManager {
+  return new PanelAppBridgeManager({
+    requestAuthorization: mocks.requestAuthorization,
+  } as unknown as ServiceActionAuthorizationManager);
+}
+
+function createIframeHarness(manager: PanelAppBridgeManager) {
+  const postMessage = vi.fn();
+  const contentWindow = { postMessage } as unknown as Window;
+  const iframe = { contentWindow } as HTMLIFrameElement;
+  return {
+    postMessage,
+    send: (
+      data: unknown,
+      iframeInstanceId = 'tab-1:0:0',
+    ) => manager.handleIframeMessage({
+      event: { data, source: contentWindow } as MessageEvent,
+      iframe,
+      iframeInstanceId,
+      tab: {
+        currentUrl: '/api/panel-apps/mood-calendar/content',
+        history: [],
+        historyIndex: 0,
+        id: 'tab-1',
+        kind: 'content',
+        navVersion: 0,
+        title: 'Mood Calendar',
+      },
+    }),
+  };
+}
+
+function mockBridgeSession(token = 'token-1') {
+  mocks.createBridgeSession.mockResolvedValue({
+    expiresAt: '2026-05-28T00:00:00.000Z',
+    id: `session-${token}`,
+    panelAppId: 'mood-calendar',
+    tabId: 'tab-1',
+    token,
+  });
+}
+
 describe('PanelAppBridgeManager', () => {
-  it('opens the authorization flow before retrying a protected service action', async () => {
-    const manager = new PanelAppBridgeManager({
-      requestAuthorization: mocks.requestAuthorization,
-    } as unknown as ServiceActionAuthorizationManager);
-    const postMessage = vi.fn();
-    const contentWindow = { postMessage } as unknown as Window;
-    const iframe = { contentWindow } as HTMLIFrameElement;
+  it('authorizes missing service actions in one flow before retrying a protected action', async () => {
+    const manager = createManager();
+    const { postMessage, send } = createIframeHarness(manager);
     const actionId = 'mood-tracker.saveMood';
-    mocks.createBridgeSession.mockResolvedValue({
-      expiresAt: '2026-05-28T00:00:00.000Z',
-      id: 'session-1',
-      panelAppId: 'mood-calendar',
-      tabId: 'tab-1',
-      token: 'token-1',
-    });
+    mockBridgeSession();
     mocks.invokeServiceAction
       .mockRejectedValueOnce(new NextClawClientError({
         code: 'AUTHORIZATION_REQUIRED',
@@ -59,58 +93,77 @@ describe('PanelAppBridgeManager', () => {
       }))
       .mockResolvedValueOnce({ actionId, result: { saved: true } });
     mocks.listServiceActions.mockResolvedValue({
-      actions: [{
-        appId: 'mood-tracker',
-        description: 'Save daily mood entries',
-        id: actionId,
-        name: 'saveMood',
-        risk: 'write',
-        title: 'Save mood',
-      }],
+      actions: [
+        {
+          appId: 'mood-tracker',
+          description: 'Save daily mood entries',
+          grantState: 'not-granted',
+          id: actionId,
+          name: 'saveMood',
+          risk: 'write',
+          title: 'Save mood',
+        },
+        {
+          appId: 'mood-tracker',
+          description: 'Read mood history',
+          grantState: 'not-granted',
+          id: 'mood-tracker.listMoods',
+          name: 'listMoods',
+          risk: 'read',
+          title: 'List moods',
+        },
+      ],
     });
     mocks.requestAuthorization.mockResolvedValue(true);
-    mocks.grantServiceAction.mockResolvedValue({
-      actionId,
-      caller: { surface: 'panel-app', appId: 'mood-calendar' },
-      grantedAt: '2026-05-28T00:00:00.000Z',
-      risk: 'write',
+    mocks.grantServiceActions.mockResolvedValue({
+      grants: [
+        {
+          actionId,
+          caller: { surface: 'panel-app', appId: 'mood-calendar' },
+          grantedAt: '2026-05-28T00:00:00.000Z',
+          risk: 'write',
+        },
+        {
+          actionId: 'mood-tracker.listMoods',
+          caller: { surface: 'panel-app', appId: 'mood-calendar' },
+          grantedAt: '2026-05-28T00:00:00.000Z',
+          risk: 'read',
+        },
+      ],
     });
 
-    manager.handleIframeMessage({
-      event: {
-        data: {
-          method: 'invoke',
-          payload: { actionId, input: { mood: 'happy' } },
-          requestId: 'request-1',
-          type: 'nextclaw:panel-app-service-actions:request',
-        },
-        source: contentWindow,
-      } as MessageEvent,
-      iframe,
-      iframeInstanceId: 'tab-1:0:0',
-      tab: {
-        currentUrl: '/api/panel-apps/mood-calendar/content',
-        history: [],
-        historyIndex: 0,
-        id: 'tab-1',
-        kind: 'content',
-        navVersion: 0,
-        title: 'Mood Calendar',
-      },
+    send({
+      method: 'invoke',
+      payload: { actionId, input: { mood: 'happy' } },
+      requestId: 'request-1',
+      type: 'nextclaw:panel-app-service-actions:request',
     });
 
     await waitFor(() => expect(postMessage).toHaveBeenCalled());
 
     expect(mocks.requestAuthorization).toHaveBeenCalledWith(expect.objectContaining({
-      actionId,
-      actionTitle: 'Save mood',
+      actions: [
+        expect.objectContaining({
+          actionId,
+          actionTitle: 'Save mood',
+          risk: 'write',
+        }),
+        expect.objectContaining({
+          actionId: 'mood-tracker.listMoods',
+          actionTitle: 'List moods',
+          risk: 'read',
+        }),
+      ],
       inputPreview: expect.stringContaining('happy'),
       panelAppId: 'mood-calendar',
-      risk: 'write',
     }));
-    expect(mocks.grantServiceAction).toHaveBeenCalledWith(actionId, {
+    expect(mocks.grantServiceActions).toHaveBeenCalledWith([
+      actionId,
+      'mood-tracker.listMoods',
+    ], {
       bridgeSessionToken: 'token-1',
     });
+    expect(mocks.grantServiceAction).not.toHaveBeenCalled();
     expect(mocks.invokeServiceAction).toHaveBeenCalledTimes(2);
     expect(postMessage).toHaveBeenCalledWith({
       data: { actionId, result: { saved: true } },
@@ -121,19 +174,9 @@ describe('PanelAppBridgeManager', () => {
   });
 
   it('opens the authorization flow before retrying a protected generateObject call', async () => {
-    const manager = new PanelAppBridgeManager({
-      requestAuthorization: mocks.requestAuthorization,
-    } as unknown as ServiceActionAuthorizationManager);
-    const postMessage = vi.fn();
-    const contentWindow = { postMessage } as unknown as Window;
-    const iframe = { contentWindow } as HTMLIFrameElement;
-    mocks.createBridgeSession.mockResolvedValue({
-      expiresAt: '2026-05-28T00:00:00.000Z',
-      id: 'session-1',
-      panelAppId: 'mood-calendar',
-      tabId: 'tab-1',
-      token: 'token-1',
-    });
+    const manager = createManager();
+    const { postMessage, send } = createIframeHarness(manager);
+    mockBridgeSession();
     mocks.generateAgentObject
       .mockRejectedValueOnce(new NextClawClientError({
         code: 'AUTHORIZATION_REQUIRED',
@@ -147,41 +190,24 @@ describe('PanelAppBridgeManager', () => {
       grantedAt: '2026-05-28T00:00:00.000Z',
     });
 
-    manager.handleIframeMessage({
-      event: {
-        data: {
-          method: 'agent.generateObject',
-          payload: {
-            input: {
-              peerId: 'mood-summary',
-              prompt: 'summarize',
-              schema: { type: 'object' },
-            },
-          },
-          requestId: 'request-2',
-          type: 'nextclaw:panel-app-service-actions:request',
+    send({
+      method: 'agent.generateObject',
+      payload: {
+        input: {
+          peerId: 'mood-summary',
+          prompt: 'summarize',
+          schema: { type: 'object' },
         },
-        source: contentWindow,
-      } as MessageEvent,
-      iframe,
-      iframeInstanceId: 'tab-1:0:0',
-      tab: {
-        currentUrl: '/api/panel-apps/mood-calendar/content',
-        history: [],
-        historyIndex: 0,
-        id: 'tab-1',
-        kind: 'content',
-        navVersion: 0,
-        title: 'Mood Calendar',
       },
+      requestId: 'request-2',
+      type: 'nextclaw:panel-app-service-actions:request',
     });
 
     await waitFor(() => expect(postMessage).toHaveBeenCalled());
 
     expect(mocks.requestAuthorization).toHaveBeenCalledWith(expect.objectContaining({
-      actionId: 'agent:generateObject',
+      actions: [expect.objectContaining({ actionId: 'agent:generateObject' })],
       panelAppId: 'mood-calendar',
-      risk: 'write',
     }));
     expect(mocks.grantAgentCapability).toHaveBeenCalledWith('agent:generateObject', {
       bridgeSessionToken: 'token-1',
@@ -196,12 +222,8 @@ describe('PanelAppBridgeManager', () => {
   });
 
   it('creates a fresh bridge session for each iframe instance', async () => {
-    const manager = new PanelAppBridgeManager({
-      requestAuthorization: mocks.requestAuthorization,
-    } as unknown as ServiceActionAuthorizationManager);
-    const postMessage = vi.fn();
-    const contentWindow = { postMessage } as unknown as Window;
-    const iframe = { contentWindow } as HTMLIFrameElement;
+    const manager = createManager();
+    const { postMessage, send } = createIframeHarness(manager);
     mocks.createBridgeSession
       .mockResolvedValueOnce({
         expiresAt: '2026-05-28T00:00:00.000Z',
@@ -224,27 +246,11 @@ describe('PanelAppBridgeManager', () => {
       ['request-2', 'tab-1:0:0'],
       ['request-3', 'tab-1:0:1'],
     ]) {
-      manager.handleIframeMessage({
-        event: {
-          data: {
-            method: 'list',
-            requestId,
-            type: 'nextclaw:panel-app-service-actions:request',
-          },
-          source: contentWindow,
-        } as MessageEvent,
-        iframe,
-        iframeInstanceId,
-        tab: {
-          currentUrl: '/api/panel-apps/mood-calendar/content',
-          history: [],
-          historyIndex: 0,
-          id: 'tab-1',
-          kind: 'content',
-          navVersion: 0,
-          title: 'Mood Calendar',
-        },
-      });
+      send({
+        method: 'list',
+        requestId,
+        type: 'nextclaw:panel-app-service-actions:request',
+      }, iframeInstanceId);
     }
 
     await waitFor(() => expect(postMessage).toHaveBeenCalledTimes(3));

package/src/features/panel-apps/managers/panel-app-bridge.manager.ts

@@ -195,12 +195,14 @@ export class PanelAppBridgeManager {
   ): Promise<PanelAppCapabilityGrantView> => {
     const allowed = await this.authorizationManager.requestAuthorization({
       panelAppId: session.panelAppId,
-      actionId: capability,
-      actionTitle: capability === 'agent:send' ? 'Send agent message' : 'Generate object',
-      actionDescription: capability === 'agent:send'
-        ? 'Send a message to a NextClaw Agent session.'
-        : 'Send context to a NextClaw Agent session and receive a structured object.',
-      risk: 'write',
+      actions: [{
+        actionId: capability,
+        actionTitle: capability === 'agent:send' ? 'Send agent message' : 'Generate object',
+        actionDescription: capability === 'agent:send'
+          ? 'Send a message to a NextClaw Agent session.'
+          : 'Send context to a NextClaw Agent session and receive a structured object.',
+        risk: 'write',
+      }],
     });
     if (!allowed) {
       throw new NextClawClientError({
@@ -219,13 +221,15 @@ export class PanelAppBridgeManager {
     actionId: string,
     input?: Record<string, unknown>,
   ): Promise<ServiceActionGrantView> => {
-    const action = await this.findAction(session, actionId);
+    const actions = await this.listGrantCandidateActions(session, actionId);
     const allowed = await this.authorizationManager.requestAuthorization({
       panelAppId: session.panelAppId,
-      actionId,
-      actionTitle: action?.title,
-      actionDescription: action?.description,
-      risk: action?.risk,
+      actions: actions.map((action) => ({
+        actionId: action.id,
+        actionTitle: action.title,
+        actionDescription: action.description,
+        risk: action.risk,
+      })),
       inputPreview: this.createInputPreview(input),
     });
     if (!allowed) {
@@ -234,22 +238,48 @@ export class PanelAppBridgeManager {
         message: `Permission rejected for ${actionId}.`,
       });
     }
-    return await nextclawClient.serviceApps.grantServiceAction(
-      actionId,
+    const result = await nextclawClient.serviceApps.grantServiceActions(
+      actions.map((action) => action.id),
       { bridgeSessionToken: session.token },
     );
+    const grant = result.grants.find((entry) => entry.actionId === actionId) ?? result.grants[0];
+    if (!grant) {
+      throw new Error(`No permission grant returned for ${actionId}.`);
+    }
+    return grant;
   };
 
-  private findAction = async (
+  private listGrantCandidateActions = async (
     session: PanelAppBridgeSessionView,
     actionId: string,
-  ): Promise<ServiceActionListView['actions'][number] | undefined> => {
-    const actions = await nextclawClient.serviceApps.listServiceActions({
+  ): Promise<Array<ServiceActionListView['actions'][number]>> => {
+    const actionList = await nextclawClient.serviceApps.listServiceActions({
       bridgeSessionToken: session.token,
     });
-    return actions.actions.find(
+    const target = actionList.actions.find(
       (action: ServiceActionListView['actions'][number]) => action.id === actionId,
     );
+    if (target && target.grantState !== 'not-granted') {
+      return [target];
+    }
+    const ungrantedActions = actionList.actions.filter((action) =>
+      action.grantState === 'not-granted'
+    );
+    const orderedActions = [
+      ...ungrantedActions.filter((action) => action.id === actionId),
+      ...ungrantedActions.filter((action) => action.id !== actionId),
+    ];
+    if (orderedActions.length > 0) {
+      return orderedActions;
+    }
+    return [{
+      appId: target?.appId ?? actionId.split('.')[0] ?? actionId,
+      description: target?.description,
+      id: actionId,
+      name: target?.name ?? actionId,
+      risk: target?.risk ?? 'dangerous',
+      title: target?.title,
+    }];
   };
 
   private createInputPreview = (input: Record<string, unknown> | undefined): string | undefined => {

package/src/features/service-apps/components/service-action-authorization-dialog.tsx

@@ -39,11 +39,16 @@ export function ServiceActionAuthorizationDialog() {
         {pending ? (
           <div className="space-y-3 rounded-md border border-gray-100 bg-gray-50 p-3 text-sm">
             <AuthorizationField label={t('serviceActionAuthorizationSource')} value={pending.panelAppId} />
-            <AuthorizationField label={t('serviceActionAuthorizationAction')} value={pending.actionTitle ?? pending.actionId} />
-            {pending.actionDescription ? (
-              <AuthorizationField label={t('serviceActionAuthorizationPurpose')} value={pending.actionDescription} />
-            ) : null}
-            <AuthorizationField label={t('serviceActionAuthorizationRisk')} value={pending.risk ?? 'dangerous'} />
+            <div className="space-y-2">
+              <div className="text-xs font-medium text-gray-500">
+                {t('serviceActionAuthorizationActions')}
+              </div>
+              <div className="max-h-64 space-y-2 overflow-auto">
+                {pending.actions.map((action) => (
+                  <AuthorizationActionItem key={action.actionId} action={action} />
+                ))}
+              </div>
+            </div>
             {pending.inputPreview ? (
               <AuthorizationField label={t('serviceActionAuthorizationInput')} value={pending.inputPreview} />
             ) : null}
@@ -62,6 +67,34 @@ export function ServiceActionAuthorizationDialog() {
   );
 }
 
+function AuthorizationActionItem({
+  action,
+}: {
+  action: {
+    actionId: string;
+    actionTitle?: string;
+    actionDescription?: string;
+    risk?: string;
+  };
+}) {
+  return (
+    <div className="space-y-1 rounded border border-gray-200 bg-white px-3 py-2">
+      <div className="flex items-start justify-between gap-3">
+        <div className="min-w-0 break-words text-xs font-medium text-gray-900">
+          {action.actionTitle ?? action.actionId}
+        </div>
+        <div className="shrink-0 rounded bg-amber-50 px-1.5 py-0.5 text-[11px] font-medium text-amber-700">
+          {action.risk ?? 'dangerous'}
+        </div>
+      </div>
+      <div className="break-words text-[11px] text-gray-500">{action.actionId}</div>
+      {action.actionDescription ? (
+        <div className="break-words text-xs text-gray-600">{action.actionDescription}</div>
+      ) : null}
+    </div>
+  );
+}
+
 function AuthorizationField({
   label,
   value,

package/src/features/service-apps/stores/service-action-authorization.store.ts

@@ -3,13 +3,17 @@ import type { ServiceActionListView } from '@nextclaw/client-sdk';
 
 type ServiceActionRisk = ServiceActionListView['actions'][number]['risk'];
 
-export type ServiceActionAuthorizationRequest = {
-  id: string;
-  panelAppId: string;
+export type ServiceActionAuthorizationItem = {
   actionId: string;
   actionTitle?: string;
   actionDescription?: string;
   risk?: ServiceActionRisk;
+};
+
+export type ServiceActionAuthorizationRequest = {
+  id: string;
+  panelAppId: string;
+  actions: ServiceActionAuthorizationItem[];
   inputPreview?: string;
 };
 

package/src/features/system-status/components/desktop-update-config.test.tsx

@@ -4,6 +4,7 @@ import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { useRuntimeUpdateStore } from '@/features/system-status';
 import { DesktopUpdateConfig } from '@/features/system-status/components/desktop-update-config';
 import { setLanguage } from '@/shared/lib/i18n';
+import type * as SystemStatusModule from '@/features/system-status';
 
 const mocks = vi.hoisted(() => ({
   start: vi.fn(),
@@ -16,7 +17,7 @@ const mocks = vi.hoisted(() => ({
 }));
 
 vi.mock('@/features/system-status', async () => {
-  const actual = await vi.importActual<typeof import('@/features/system-status')>(
+  const actual = await vi.importActual<typeof SystemStatusModule>(
     '@/features/system-status'
   );
   return {

package/src/features/system-status/hooks/use-system-status.ts

@@ -17,10 +17,7 @@ export function useSystemStatusSources() {
       timeoutMs: 5_000,
     }),
     refetchInterval: (query) => {
-      return systemStatusManager.getRuntimeBootstrapPollInterval(
-        query.state.data,
-        query.state.fetchFailureCount
-      );
+      return systemStatusManager.getRuntimeBootstrapPollInterval(query.state.data);
     },
     retry: false,
   });