@trops/dash-core 0.1.504 → 0.1.506

package/dist/electron/index.js

@@ -3,7 +3,7 @@
 var require$$0$1 = require('electron');
 var require$$1$1 = require('path');
 var require$$0$2 = require('fs');
-var require$$8$1 = require('objects-to-csv');
+var require$$9$1 = require('objects-to-csv');
 var require$$1$2 = require('readline');
 var require$$2 = require('xtreamer');
 var require$$3$1 = require('xml2js');
@@ -11,7 +11,7 @@ var require$$4 = require('JSONStream');
 var require$$5 = require('stream');
 var require$$6 = require('csv-parser');
 var require$$0$3 = require('quickjs-emscripten');
-var require$$10 = require('https');
+var require$$11 = require('https');
 var require$$0$5 = require('@modelcontextprotocol/sdk/client/index.js');
 var require$$1$3 = require('@modelcontextprotocol/sdk/client/stdio.js');
 var require$$0$4 = require('pkce-challenge');
@@ -28,13 +28,13 @@ var require$$0$7 = require('openai');
 require('live-plugin-manager');
 var require$$0$a = require('@anthropic-ai/sdk');
 var require$$3$4 = require('crypto');
-var require$$8$2 = require('zod');
+var require$$8$1 = require('zod');
 var require$$0$8 = require('http');
 var require$$1$5 = require('http2');
 var require$$2$4 = require('node-forge');
 var require$$0$9 = require('css');
 var require$$1$6 = require('node-vibrant/node');
-var require$$0$b = require('ws');
+var require$$3$5 = require('ws');
 
 var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
 
@@ -1054,7 +1054,7 @@ var secureStoreController$1 = {
   decryptString,
 };
 
-const path$m = require$$1$1;
+const path$n = require$$1$1;
 const {
   readFileSync,
   writeFileSync: writeFileSync$3,
@@ -1072,7 +1072,7 @@ const {
 function ensureDirectoryExistence$1(filePath) {
   try {
     // isDirectory
-    var dirname = path$m.dirname(filePath);
+    var dirname = path$n.dirname(filePath);
     // check if the directory exists...return true
     // if not, we can pass in the dirname as the filepath
     // and check each directory recursively.
@@ -1187,7 +1187,7 @@ function removeFilesFromDirectory(directory, excludeFiles = []) {
 
       for (const file of files) {
         if (!excludeFiles.includes(file)) {
-          unlinkSync(path$m.join(directory, file), (err) => {
+          unlinkSync(path$n.join(directory, file), (err) => {
             if (err) throw err;
           });
         }
@@ -1204,8 +1204,8 @@ var file = {
   checkDirectory: checkDirectory$1,
 };
 
-const { app: app$e } = require$$0$1;
-const path$l = require$$1$1;
+const { app: app$f } = require$$0$1;
+const path$m = require$$1$1;
 const { writeFileSync: writeFileSync$2 } = require$$0$2;
 const { getFileContents: getFileContents$7 } = file;
 
@@ -1252,8 +1252,8 @@ const workspaceController$3 = {
   saveWorkspaceForApplication: (win, appId, workspaceObject) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$l.join(
-        app$e.getPath("userData"),
+      const filename = path$m.join(
+        app$f.getPath("userData"),
         appName$7,
         appId,
         configFilename$5,
@@ -1301,8 +1301,8 @@ const workspaceController$3 = {
   saveMenuItemsForApplication: (win, appId, menuItems) => {
     try {
       // filename to the workspaces file
-      const filename = path$l.join(
-        app$e.getPath("userData"),
+      const filename = path$m.join(
+        app$f.getPath("userData"),
         appName$7,
         appId,
         configFilename$5,
@@ -1350,8 +1350,8 @@ const workspaceController$3 = {
    */
   deleteWorkspaceForApplication: (win, appId, workspaceId) => {
     try {
-      const filename = path$l.join(
-        app$e.getPath("userData"),
+      const filename = path$m.join(
+        app$f.getPath("userData"),
         appName$7,
         appId,
         configFilename$5,
@@ -1384,8 +1384,8 @@ const workspaceController$3 = {
 
   listWorkspacesForApplication: (win, appId) => {
     try {
-      const filename = path$l.join(
-        app$e.getPath("userData"),
+      const filename = path$m.join(
+        app$f.getPath("userData"),
         appName$7,
         appId,
         configFilename$5,
@@ -1412,8 +1412,8 @@ const workspaceController$3 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$l.join(
-        app$e.getPath("userData"),
+      const filename = path$m.join(
+        app$f.getPath("userData"),
         appName$7,
         appId,
         configFilename$5,
@@ -1456,8 +1456,8 @@ const workspaceController$3 = {
 
 var workspaceController_1 = workspaceController$3;
 
-const { app: app$d } = require$$0$1;
-const path$k = require$$1$1;
+const { app: app$e } = require$$0$1;
+const path$l = require$$1$1;
 const { writeFileSync: writeFileSync$1 } = require$$0$2;
 const { getFileContents: getFileContents$6 } = file;
 
@@ -1477,8 +1477,8 @@ const themeController$5 = {
   saveThemeForApplication: (win, appId, name, obj) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$k.join(
-        app$d.getPath("userData"),
+      const filename = path$l.join(
+        app$e.getPath("userData"),
         appName$6,
         appId,
         configFilename$4,
@@ -1523,8 +1523,8 @@ const themeController$5 = {
    */
   listThemesForApplication: (win, appId) => {
     try {
-      const filename = path$k.join(
-        app$d.getPath("userData"),
+      const filename = path$l.join(
+        app$e.getPath("userData"),
         appName$6,
         appId,
         configFilename$4,
@@ -1565,8 +1565,8 @@ const themeController$5 = {
    */
   deleteThemeForApplication: (win, appId, themeKey) => {
     try {
-      const filename = path$k.join(
-        app$d.getPath("userData"),
+      const filename = path$l.join(
+        app$e.getPath("userData"),
         appName$6,
         appId,
         configFilename$4,
@@ -1642,9 +1642,9 @@ var themeController_1 = themeController$5;
  *      `/data/`.
  */
 
-const path$j = require$$1$1;
-const fs$e = require$$0$2;
-const { app: app$c } = require$$0$1;
+const path$k = require$$1$1;
+const fs$f = require$$0$2;
+const { app: app$d } = require$$0$1;
 
 const APP_NAME = "Dashboard";
 
@@ -1653,10 +1653,10 @@ const APP_NAME = "Dashboard";
  * @returns {string[]} ordered allowed roots for that category
  */
 function getAllowedRoots$2(category) {
-  const userData = app$c.getPath("userData");
+  const userData = app$d.getPath("userData");
   switch (category) {
     case "data": {
-      const def = path$j.join(userData, APP_NAME, "data");
+      const def = path$k.join(userData, APP_NAME, "data");
       // The user can configure a custom data directory in
       // Settings → General → Data Directory. If set, that
       // location is ALSO an allowed root. We don't replace the
@@ -1666,13 +1666,13 @@ function getAllowedRoots$2(category) {
       return override ? [def, override] : [def];
     }
     case "themes":
-      return [path$j.join(userData, APP_NAME, "themes")];
+      return [path$k.join(userData, APP_NAME, "themes")];
     case "widgets":
-      return [path$j.join(userData, "widgets")];
+      return [path$k.join(userData, "widgets")];
     case "plugins":
-      return [path$j.join(userData, "plugins")];
+      return [path$k.join(userData, "plugins")];
     case "downloads":
-      return [app$c.getPath("downloads")];
+      return [app$d.getPath("downloads")];
     default:
       throw new Error("safePath: unknown allowed-roots category: " + category);
   }
@@ -1687,13 +1687,13 @@ function getAllowedRoots$2(category) {
  */
 function readDataDirectoryFromSettings() {
   try {
-    const settingsPath = path$j.join(
-      app$c.getPath("userData"),
+    const settingsPath = path$k.join(
+      app$d.getPath("userData"),
       APP_NAME,
       "settings.json",
     );
-    if (!fs$e.existsSync(settingsPath)) return undefined;
-    const raw = fs$e.readFileSync(settingsPath, "utf8");
+    if (!fs$f.existsSync(settingsPath)) return undefined;
+    const raw = fs$f.readFileSync(settingsPath, "utf8");
     const settings = JSON.parse(raw);
     const dir = settings && settings.dataDirectory;
     if (typeof dir === "string" && dir) return dir;
@@ -1719,18 +1719,18 @@ function safePath$3(requested, allowedRoots) {
     throw new Error("safePath: allowedRoots must be a non-empty array");
   }
 
-  const resolved = path$j.resolve(requested);
+  const resolved = path$k.resolve(requested);
 
   // Real-path through symlinks. If the file doesn't exist yet (a
   // create-new operation), real-path the parent so a symlink in the
   // parent chain can't trick us.
   let real = resolved;
   try {
-    real = fs$e.realpathSync(resolved);
+    real = fs$f.realpathSync(resolved);
   } catch (_e) {
     try {
-      const parent = fs$e.realpathSync(path$j.dirname(resolved));
-      real = path$j.join(parent, path$j.basename(resolved));
+      const parent = fs$f.realpathSync(path$k.dirname(resolved));
+      real = path$k.join(parent, path$k.basename(resolved));
     } catch (_e2) {
       // Parent doesn't exist either. Use the resolved-but-not-
       // real path; the caller's mkdirSync will happen inside the
@@ -1742,14 +1742,14 @@ function safePath$3(requested, allowedRoots) {
   for (const root of allowedRoots) {
     let realRoot = root;
     try {
-      if (fs$e.existsSync(root)) realRoot = fs$e.realpathSync(root);
+      if (fs$f.existsSync(root)) realRoot = fs$f.realpathSync(root);
     } catch (_e) {
       // root doesn't exist or isn't reachable — keep as-is for
       // the comparison below
     }
     // Exact match OR strictly-inside (with separator to prevent
     // /data-evil/ matching /data/).
-    if (real === realRoot || real.startsWith(realRoot + path$j.sep)) {
+    if (real === realRoot || real.startsWith(realRoot + path$k.sep)) {
       return real;
     }
   }
@@ -1810,9 +1810,9 @@ var safePath_1 = {
  *   clearCache() → void   // test-only
  */
 
-const fs$d = require$$0$2;
-const path$i = require$$1$1;
-const { app: app$b } = require$$0$1;
+const fs$e = require$$0$2;
+const path$j = require$$1$1;
+const { app: app$c } = require$$0$1;
 
 const FILE_NAME = "widgetMcpGrants.json";
 
@@ -1821,14 +1821,14 @@ const FILE_NAME = "widgetMcpGrants.json";
 let _cache$1 = null;
 
 function grantsFilePath() {
-  return path$i.join(app$b.getPath("userData"), FILE_NAME);
+  return path$j.join(app$c.getPath("userData"), FILE_NAME);
 }
 
 function loadFromDisk() {
   const p = grantsFilePath();
-  if (!fs$d.existsSync(p)) return {};
+  if (!fs$e.existsSync(p)) return {};
   try {
-    const raw = fs$d.readFileSync(p, "utf8");
+    const raw = fs$e.readFileSync(p, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return {};
     return parsed;
@@ -1848,9 +1848,9 @@ function writeToDisk(data) {
   const tmp = p + ".tmp";
   // Ensure parent dir exists (userData should already, but be defensive
   // for first-launch / freshly-cleared profile cases).
-  fs$d.mkdirSync(path$i.dirname(p), { recursive: true });
-  fs$d.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf8");
-  fs$d.renameSync(tmp, p);
+  fs$e.mkdirSync(path$j.dirname(p), { recursive: true });
+  fs$e.writeFileSync(tmp, JSON.stringify(data, null, 2), "utf8");
+  fs$e.renameSync(tmp, p);
 }
 
 // Recognized origins for a persisted grant.
@@ -1935,6 +1935,12 @@ function sanitizePerms(perms) {
             ? raw.writePaths.filter((p) => typeof p === "string")
             : [],
         };
+      } else if (name === "network") {
+        domains.network = {
+          hosts: Array.isArray(raw.hosts)
+            ? raw.hosts.filter((h) => typeof h === "string")
+            : [],
+        };
       }
       // Future domains plug in here. Unknown domain names are dropped.
     }
@@ -1952,13 +1958,13 @@ function sanitizePerms(perms) {
   return out;
 }
 
-function getGrant$3(widgetId) {
+function getGrant$4(widgetId) {
   if (typeof widgetId !== "string" || !widgetId) return null;
   const all = ensureCache();
   return all[widgetId] || null;
 }
 
-function setGrant$3(widgetId, perms) {
+function setGrant$4(widgetId, perms) {
   if (typeof widgetId !== "string" || !widgetId) return false;
   const sanitized = sanitizePerms(perms);
   if (!sanitized) return false;
@@ -2039,8 +2045,8 @@ function clearCache$1() {
 }
 
 var grantedPermissions = {
-  getGrant: getGrant$3,
-  setGrant: setGrant$3,
+  getGrant: getGrant$4,
+  setGrant: setGrant$4,
   revokeGrant: revokeGrant$1,
   revokeServer: revokeServer$1,
   listAllGrants: listAllGrants$1,
@@ -2159,7 +2165,7 @@ function validateRequest(req) {
  *
  * `scope` informs the caller how to write the resulting grant.
  */
-function requestApproval$2(req, opts = {}) {
+function requestApproval$3(req, opts = {}) {
   const validation = validateRequest(req);
   if (validation) {
     return Promise.reject(new Error(validation));
@@ -2251,7 +2257,7 @@ function setupJitConsentHandlers() {
 }
 
 var jitConsent$1 = {
-  requestApproval: requestApproval$2,
+  requestApproval: requestApproval$3,
   setupJitConsentHandlers,
   _handleResponse,
   _resetForTest,
@@ -2295,8 +2301,8 @@ var jitConsent$1 = {
  * read-only entry) stay synchronous.
  */
 
-const { getGrant: getGrant$2, setGrant: setGrant$2 } = grantedPermissions;
-const { requestApproval: requestApproval$1 } = jitConsent$1;
+const { getGrant: getGrant$3, setGrant: setGrant$3 } = grantedPermissions;
+const { requestApproval: requestApproval$2 } = jitConsent$1;
 
 // Action names treated as writes. Anything not in this set is a read.
 // Conservative — when in doubt, classify as a read so write-protected
@@ -2315,7 +2321,7 @@ function isFsWriteAction(action) {
   return WRITE_ACTIONS.has(action);
 }
 
-function _isNoGrantDenial$1(reason) {
+function _isNoGrantDenial$2(reason) {
   return (
     typeof reason === "string" && /no fs permissions granted/i.test(reason)
   );
@@ -2352,7 +2358,7 @@ function gateFsCall$1({ widgetId, action, args }) {
     };
   }
 
-  const grant = getGrant$2(widgetId);
+  const grant = getGrant$3(widgetId);
   const fsPerms = grant && grant.domains && grant.domains.fs;
   if (!fsPerms) {
     return {
@@ -2453,11 +2459,11 @@ async function gateFsCallWithJit$1(req, opts = {}) {
   const initial = gateFsCall$1(req);
   if (initial.allow) return initial;
   if (!opts.enableJit) return initial;
-  if (!_isNoGrantDenial$1(initial.reason)) return initial;
+  if (!_isNoGrantDenial$2(initial.reason)) return initial;
 
   let decision;
   try {
-    decision = await requestApproval$1(
+    decision = await requestApproval$2(
       {
         widgetId: req.widgetId,
         domain: "fs",
@@ -2506,9 +2512,9 @@ async function gateFsCallWithJit$1(req, opts = {}) {
   addition.grantOrigin = "live";
 
   try {
-    const current = getGrant$2(req.widgetId);
+    const current = getGrant$3(req.widgetId);
     const merged = _mergeFsGrant(current, addition);
-    setGrant$2(req.widgetId, merged);
+    setGrant$3(req.widgetId, merged);
   } catch (e) {
     return {
       allow: false,
@@ -2528,6 +2534,232 @@ var fsGate = {
   WRITE_ACTIONS,
 };
 
+/**
+ * networkGate.js
+ *
+ * Per-widget gate for outbound-network IPC actions (Phase 3 of JIT
+ * consent). Same shape as `fsGate.js` but for hostname-based scoping.
+ *
+ * Channels currently gated by this:
+ *   - readDataFromURL (dataController)  — fetch a URL into a file
+ *   - wsConnect       (webSocketController) — open a WebSocket
+ *
+ * Channels NOT gated:
+ *   - WS_SEND/DISCONNECT/STATUS/GET_ALL — operate on already-authorized
+ *     connections, intentionally shared across widgets via the
+ *     `consumers: Set<webContentsId>` design.
+ *   - THEME_EXTRACT_FROM_URL — admin-only callers (Settings panels);
+ *     no widget caller exists in the codebase.
+ *
+ * Grant shape (under `grant.domains.network`):
+ *   {
+ *     hosts: ["api.example.com", "*", ...]
+ *   }
+ *
+ * Hostname matching:
+ *   - Exact match (case-insensitive)
+ *   - "*" wildcard in the grant matches any host (escape hatch;
+ *     surfaced in the JIT modal as "no host scope — risky")
+ *   - Subdomain wildcards ("*.example.com") are NOT supported in this
+ *     slice — deferred to a follow-up.
+ *
+ * URL parsing uses the WHATWG URL constructor. Malformed URLs deny
+ * synchronously and do NOT escalate to JIT (a JIT prompt would let a
+ * widget probe URL parser quirks, which we'd rather not).
+ *
+ * JIT escalation: when the runtime calls `gateNetworkCallWithJit` and
+ * the gate denies for "no network permissions granted", a
+ * permission-required IPC fires and the user's response is merged
+ * into the persisted grant. Other denial reasons (host not in
+ * allowlist, malformed url, missing url) stay synchronous.
+ */
+
+const { getGrant: getGrant$2, setGrant: setGrant$2 } = grantedPermissions;
+const { requestApproval: requestApproval$1 } = jitConsent$1;
+
+function _isNoGrantDenial$1(reason) {
+  return (
+    typeof reason === "string" && /no network permissions granted/i.test(reason)
+  );
+}
+
+function _hostMatches(host, allowedList) {
+  if (!Array.isArray(allowedList) || allowedList.length === 0) return false;
+  if (allowedList.includes("*")) return true;
+  const lower = host.toLowerCase();
+  return allowedList.some(
+    (h) => typeof h === "string" && h.toLowerCase() === lower,
+  );
+}
+
+function _parseHost(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Synchronous gate evaluation.
+ * @returns {{ allow: true } | { allow: false, reason: string }}
+ */
+function gateNetworkCall$2({ widgetId, action, args }) {
+  if (!widgetId) {
+    return {
+      allow: false,
+      reason: "no widgetId supplied; cannot determine network permissions",
+    };
+  }
+
+  const url = args && typeof args === "object" ? args.url : null;
+  if (typeof url !== "string" || !url) {
+    return {
+      allow: false,
+      reason:
+        "network gate: action '" +
+        action +
+        "' requires args.url (got: " +
+        JSON.stringify(url) +
+        ")",
+    };
+  }
+
+  const host = _parseHost(url);
+  if (!host) {
+    return {
+      allow: false,
+      reason: "network gate: malformed url '" + url + "'",
+    };
+  }
+
+  const grant = getGrant$2(widgetId);
+  const netPerms = grant && grant.domains && grant.domains.network;
+  if (!netPerms) {
+    return {
+      allow: false,
+      reason:
+        "widget '" +
+        widgetId +
+        "' has no network permissions granted; user must approve at runtime or in Settings → Privacy & Security",
+    };
+  }
+
+  if (_hostMatches(host, netPerms.hosts)) {
+    return { allow: true };
+  }
+  return {
+    allow: false,
+    reason:
+      "network gate: host '" +
+      host +
+      "' rejected — not in allowed hosts for widget '" +
+      widgetId +
+      "'",
+  };
+}
+
+/**
+ * Merge an approved JIT decision's grant into the widget's existing
+ * grant under domains.network. Mirrors fsGate._mergeFsGrant.
+ */
+function _mergeNetworkGrant(current, addition) {
+  const out = {
+    grantOrigin: addition.grantOrigin || current?.grantOrigin || null,
+    servers: { ...(current?.servers || {}) },
+    domains: { ...(current?.domains || {}) },
+  };
+  const additionNet = addition?.domains?.network;
+  if (additionNet) {
+    const existingNet = out.domains.network || { hosts: [] };
+    out.domains.network = {
+      hosts: [
+        ...new Set([
+          ...(existingNet.hosts || []),
+          ...(Array.isArray(additionNet.hosts) ? additionNet.hosts : []),
+        ]),
+      ],
+    };
+  }
+  return out;
+}
+
+/**
+ * Async gate that escalates "no network grant" denials to a JIT
+ * consent prompt when `opts.enableJit` is true. On approval, merges
+ * the decision's grant blob into the persisted grant and re-evaluates.
+ */
+async function gateNetworkCallWithJit$2(req, opts = {}) {
+  const initial = gateNetworkCall$2(req);
+  if (initial.allow) return initial;
+  if (!opts.enableJit) return initial;
+  if (!_isNoGrantDenial$1(initial.reason)) return initial;
+
+  let decision;
+  try {
+    decision = await requestApproval$1(
+      {
+        widgetId: req.widgetId,
+        domain: "network",
+        action: req.action,
+        args: req.args || {},
+      },
+      { timeoutMs: opts.timeoutMs },
+    );
+  } catch (e) {
+    return {
+      allow: false,
+      reason:
+        "JIT consent " +
+        (e && e.message ? e.message : "failed") +
+        "; original denial: " +
+        initial.reason,
+    };
+  }
+
+  if (!decision || decision.approve !== true) {
+    return {
+      allow: false,
+      reason:
+        "user declined JIT consent for widget '" +
+        req.widgetId +
+        "' calling network '" +
+        req.action +
+        "'",
+    };
+  }
+
+  const host = _parseHost(req.args?.url) || "*";
+  const addition =
+    decision.granted && typeof decision.granted === "object"
+      ? decision.granted
+      : {
+          grantOrigin: "live",
+          domains: { network: { hosts: [host] } },
+        };
+  addition.grantOrigin = "live";
+
+  try {
+    const current = getGrant$2(req.widgetId);
+    const merged = _mergeNetworkGrant(current, addition);
+    setGrant$2(req.widgetId, merged);
+  } catch (e) {
+    return {
+      allow: false,
+      reason:
+        "JIT consent: failed to persist network grant: " +
+        (e && e.message ? e.message : String(e)),
+    };
+  }
+
+  return gateNetworkCall$2(req);
+}
+
+var networkGate = {
+  gateNetworkCall: gateNetworkCall$2,
+  gateNetworkCallWithJit: gateNetworkCallWithJit$2,
+};
+
 /**
  * securityFlags.js
  *
@@ -2549,15 +2781,15 @@ var fsGate = {
  * settings.json IO.
  */
 
-function readEnforceFlag$2(settings) {
+function readEnforceFlag$3(settings) {
   return settings?.security?.enforceWidgetMcpPermissions !== false;
 }
 
-function readJitFlag$2(settings) {
+function readJitFlag$3(settings) {
   return settings?.security?.enableJitConsent !== false;
 }
 
-var securityFlags = { readEnforceFlag: readEnforceFlag$2, readJitFlag: readJitFlag$2 };
+var securityFlags = { readEnforceFlag: readEnforceFlag$3, readJitFlag: readJitFlag$3 };
 
 /**
  * safeJsExecutor.js
@@ -3258,28 +3490,32 @@ function requireTransform () {
 	return transform;
 }
 
-const { app: app$a } = require$$0$1;
-var fs$c = require$$0$2;
-const path$h = require$$1$1;
+const { app: app$b } = require$$0$1;
+var fs$d = require$$0$2;
+const path$i = require$$1$1;
 const events$5 = events$8;
 const { getFileContents: getFileContents$5, writeToFile: writeToFile$2 } = file;
 const { safePath: safePath$2, getAllowedRoots: getAllowedRoots$1 } = safePath_1;
 const { gateFsCall, gateFsCallWithJit } = fsGate;
-const { readEnforceFlag: readEnforceFlag$1, readJitFlag: readJitFlag$1 } = securityFlags;
+const {
+  gateNetworkCall: gateNetworkCall$1,
+  gateNetworkCallWithJit: gateNetworkCallWithJit$1,
+} = networkGate;
+const { readEnforceFlag: readEnforceFlag$2, readJitFlag: readJitFlag$2 } = securityFlags;
 
 // Reads the enforcement + JIT flags from settings.json. Mirrors the
 // helper in mcpController. The flag is shared across MCP and fs domains
 // — see Phase 2 plan for rationale (the cosmetic rename to a
 // domain-neutral name is a separate slice).
-function _loadFlags() {
+function _loadFlags$1() {
   try {
-    const settingsPath = path$h.join(
-      app$a.getPath("userData"),
+    const settingsPath = path$i.join(
+      app$b.getPath("userData"),
       appName$5,
       "settings.json",
     );
-    if (!fs$c.existsSync(settingsPath)) return null;
-    return JSON.parse(fs$c.readFileSync(settingsPath, "utf8"));
+    if (!fs$d.existsSync(settingsPath)) return null;
+    return JSON.parse(fs$d.readFileSync(settingsPath, "utf8"));
   } catch (_e) {
     return null;
   }
@@ -3293,10 +3529,10 @@ function _loadFlags() {
  * @returns {Promise<boolean>}
  */
 async function _runFsGate(win, action, widgetId, args, errorEvent) {
-  const settings = _loadFlags();
-  if (!readEnforceFlag$1(settings)) return true; // gate disabled
+  const settings = _loadFlags$1();
+  if (!readEnforceFlag$2(settings)) return true; // gate disabled
   if (!widgetId) return true; // legacy callers without widgetId — see plan
-  const gate = readJitFlag$1(settings)
+  const gate = readJitFlag$2(settings)
     ? await gateFsCallWithJit({ widgetId, action, args }, { enableJit: true })
     : gateFsCall({ widgetId, action, args });
   if (gate.allow) return true;
@@ -3309,10 +3545,34 @@ async function _runFsGate(win, action, widgetId, args, errorEvent) {
   return false;
 }
 
+/**
+ * Phase 3 network gate. Same shape as _runFsGate but for outbound
+ * URLs. Mirrors fs's "disabled / no widgetId / sync vs async" branching.
+ */
+async function _runNetworkGate$1(win, action, widgetId, args, errorEvent) {
+  const settings = _loadFlags$1();
+  if (!readEnforceFlag$2(settings)) return true;
+  if (!widgetId) return true;
+  const gate = readJitFlag$2(settings)
+    ? await gateNetworkCallWithJit$1(
+        { widgetId, action, args },
+        { enableJit: true },
+      )
+    : gateNetworkCall$1({ widgetId, action, args });
+  if (gate.allow) return true;
+  if (win && errorEvent) {
+    win.webContents.send(errorEvent, {
+      success: false,
+      message: "network permission gate: " + gate.reason,
+    });
+  }
+  return false;
+}
+
 // Convert Json to Csv
-const ObjectsToCsv = require$$8$1;
+const ObjectsToCsv = require$$9$1;
 const Transform = requireTransform();
-const https$3 = require$$10;
+const https$3 = require$$11;
 const appName$5 = "Dashboard";
 
 const dataController$1 = {
@@ -3329,8 +3589,8 @@ const dataController$1 = {
       // Validate the renderer-supplied filename is contained within
       // the data directory. path.join doesn't reject `..` segments;
       // safePath does.
-      const candidate = path$h.join(
-        app$a.getPath("userData"),
+      const candidate = path$i.join(
+        app$b.getPath("userData"),
         appName$5,
         appId,
         "data",
@@ -3468,7 +3728,18 @@ const dataController$1 = {
     }
   },
 
-  readDataFromURL: (win, url, toFilepath) => {
+  readDataFromURL: async (win, url, toFilepath, widgetId = null) => {
+    // Phase 3 network gate. Runs before HTTPS-protocol + safePath
+    // checks so JIT can prompt the user without leaking URL parser
+    // edge cases through error timing.
+    const gateOk = await _runNetworkGate$1(
+      win,
+      "readDataFromURL",
+      widgetId,
+      { url },
+      events$5.READ_DATA_URL_ERROR,
+    );
+    if (!gateOk) return;
     try {
       // Validate URL is https protocol only
       let parsedUrl;
@@ -3488,7 +3759,7 @@ const dataController$1 = {
       // intent, plus realpath/symlink protection.
       const resolvedFilepath = safePath$2(toFilepath, getAllowedRoots$1("data"));
 
-      const writeStream = fs$c.createWriteStream(resolvedFilepath);
+      const writeStream = fs$d.createWriteStream(resolvedFilepath);
 
       https$3
         .get(url, (resp) => {
@@ -3670,8 +3941,8 @@ const dataController$1 = {
       if (data) {
         // Validate filename is contained within the data directory.
         // path.join doesn't reject `..` segments; safePath does.
-        const candidate = path$h.join(
-          app$a.getPath("userData"),
+        const candidate = path$i.join(
+          app$b.getPath("userData"),
           appName$5,
           "data",
           filename,
@@ -3772,8 +4043,8 @@ const dataController$1 = {
     try {
       if (filename) {
         // filename to the pages file (live pages)
-        const fromFilename = path$h.join(
-          app$a.getPath("userData"),
+        const fromFilename = path$i.join(
+          app$b.getPath("userData"),
           appName$5,
           "data",
           filename,
@@ -3853,9 +4124,9 @@ var dataController_1 = dataController$1;
  * settingsController
  */
 
-const { app: app$9 } = require$$0$1;
-const path$g = require$$1$1;
-const fs$b = require$$0$2;
+const { app: app$a } = require$$0$1;
+const path$h = require$$1$1;
+const fs$c = require$$0$2;
 const { getFileContents: getFileContents$4, writeToFile: writeToFile$1 } = file;
 
 const configFilename$3 = "settings.json";
@@ -3863,15 +4134,15 @@ const appName$4 = "Dashboard";
 
 // Helper function to recursively copy directory
 function copyDirectory(source, destination) {
-  if (!fs$b.existsSync(destination)) {
-    fs$b.mkdirSync(destination, { recursive: true });
+  if (!fs$c.existsSync(destination)) {
+    fs$c.mkdirSync(destination, { recursive: true });
   }
 
-  const files = fs$b.readdirSync(source);
+  const files = fs$c.readdirSync(source);
   for (const file of files) {
-    const srcPath = path$g.join(source, file);
-    const destPath = path$g.join(destination, file);
-    const stat = fs$b.lstatSync(srcPath);
+    const srcPath = path$h.join(source, file);
+    const destPath = path$h.join(destination, file);
+    const stat = fs$c.lstatSync(srcPath);
 
     // Skip symlinks to prevent following links to sensitive files
     if (stat.isSymbolicLink()) {
@@ -3882,7 +4153,7 @@ function copyDirectory(source, destination) {
     if (stat.isDirectory()) {
       copyDirectory(srcPath, destPath);
     } else {
-      fs$b.copyFileSync(srcPath, destPath);
+      fs$c.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -3898,8 +4169,8 @@ const settingsController$4 = {
     try {
       if (data) {
         // <appId>/settings.json
-        const filename = path$g.join(
-          app$9.getPath("userData"),
+        const filename = path$h.join(
+          app$a.getPath("userData"),
           appName$4,
           configFilename$3,
         );
@@ -3934,8 +4205,8 @@ const settingsController$4 = {
   getSettingsForApplication: (win) => {
     try {
       // <appId>/settings.json
-      const filename = path$g.join(
-        app$9.getPath("userData"),
+      const filename = path$h.join(
+        app$a.getPath("userData"),
         appName$4,
         configFilename$3,
       );
@@ -3965,15 +4236,15 @@ const settingsController$4 = {
    */
   getDataDirectory: (win) => {
     try {
-      const settingsPath = path$g.join(
-        app$9.getPath("userData"),
+      const settingsPath = path$h.join(
+        app$a.getPath("userData"),
         appName$4,
         configFilename$3,
       );
       const settings = getFileContents$4(settingsPath, {});
       const userDataDir =
         settings.userDataDirectory ||
-        path$g.join(app$9.getPath("userData"), appName$4);
+        path$h.join(app$a.getPath("userData"), appName$4);
 
       console.log("[settingsController] Data directory retrieved successfully");
       // Return the data for ipcMain.handle() - modern promise-based approach
@@ -4000,18 +4271,18 @@ const settingsController$4 = {
   setDataDirectory: (win, newPath) => {
     try {
       // Validate the path exists and is a directory
-      if (!fs$b.existsSync(newPath)) {
-        fs$b.mkdirSync(newPath, { recursive: true });
+      if (!fs$c.existsSync(newPath)) {
+        fs$c.mkdirSync(newPath, { recursive: true });
       }
 
-      const stats = fs$b.statSync(newPath);
+      const stats = fs$c.statSync(newPath);
       if (!stats.isDirectory()) {
         throw new Error("Path is not a directory");
       }
 
       // Update settings
-      const settingsPath = path$g.join(
-        app$9.getPath("userData"),
+      const settingsPath = path$h.join(
+        app$a.getPath("userData"),
         appName$4,
         configFilename$3,
       );
@@ -4044,20 +4315,20 @@ const settingsController$4 = {
   migrateDataDirectory: (win, oldPath, newPath) => {
     try {
       // Resolve paths to prevent traversal
-      const resolvedOldPath = path$g.resolve(oldPath);
-      const resolvedNewPath = path$g.resolve(newPath);
+      const resolvedOldPath = path$h.resolve(oldPath);
+      const resolvedNewPath = path$h.resolve(newPath);
 
       // Validate oldPath is the current configured data directory
-      const settingsCheckPath = path$g.join(
-        app$9.getPath("userData"),
+      const settingsCheckPath = path$h.join(
+        app$a.getPath("userData"),
         appName$4,
         configFilename$3,
       );
       const currentSettings = getFileContents$4(settingsCheckPath, {});
       const currentDataDir =
         currentSettings.userDataDirectory ||
-        path$g.join(app$9.getPath("userData"), appName$4);
-      if (resolvedOldPath !== path$g.resolve(currentDataDir)) {
+        path$h.join(app$a.getPath("userData"), appName$4);
+      if (resolvedOldPath !== path$h.resolve(currentDataDir)) {
         throw new Error("Source path must be the current data directory");
       }
 
@@ -4081,20 +4352,20 @@ const settingsController$4 = {
       }
 
       // Validate paths
-      if (!fs$b.existsSync(resolvedOldPath)) {
+      if (!fs$c.existsSync(resolvedOldPath)) {
         throw new Error("Source directory does not exist");
       }
 
-      if (!fs$b.existsSync(resolvedNewPath)) {
-        fs$b.mkdirSync(resolvedNewPath, { recursive: true });
+      if (!fs$c.existsSync(resolvedNewPath)) {
+        fs$c.mkdirSync(resolvedNewPath, { recursive: true });
       }
 
       // Copy files
       copyDirectory(resolvedOldPath, resolvedNewPath);
 
       // Update settings to use new path
-      const settingsPath = path$g.join(
-        app$9.getPath("userData"),
+      const settingsPath = path$h.join(
+        app$a.getPath("userData"),
         appName$4,
         configFilename$3,
       );
@@ -4758,8 +5029,8 @@ function requireProviderController () {
 	return providerController_1;
 }
 
-const { app: app$8 } = require$$0$1;
-const path$f = require$$1$1;
+const { app: app$9 } = require$$0$1;
+const path$g = require$$1$1;
 const events$4 = events$8;
 const { getFileContents: getFileContents$3 } = file;
 
@@ -4775,8 +5046,8 @@ const layoutController$1 = {
    */
   listLayoutsForApplication: (win, appId) => {
     try {
-      const filename = path$f.join(
-        app$8.getPath("userData"),
+      const filename = path$g.join(
+        app$9.getPath("userData"),
         appName$3,
         appId,
         configFilename$2,
@@ -22439,15 +22710,15 @@ const {
 const {
   StreamableHTTPClientTransport,
 } = streamableHttp$1;
-const path$e = require$$1$1;
-const fs$a = require$$0$2;
+const path$f = require$$1$1;
+const fs$b = require$$0$2;
 const os$2 = require$$2$1;
 const responseCache$2 = responseCache_1;
 const { gateToolCall, gateToolCallWithJit } = permissionGate;
 const { serverKey, parseServerKey } = mcpServerKey;
 const { applyPathScopeToCredentials } = mcpScopeResolver;
-const { readEnforceFlag, readJitFlag } = securityFlags;
-const { app: app$7 } = require$$0$1;
+const { readEnforceFlag: readEnforceFlag$1, readJitFlag: readJitFlag$1 } = securityFlags;
+const { app: app$8 } = require$$0$1;
 
 /**
  * Load the user's settings.json (or null on absence/parse error). The
@@ -22456,13 +22727,13 @@ const { app: app$7 } = require$$0$1;
  */
 function loadSettingsForFlags() {
   try {
-    const settingsPath = path$e.join(
-      app$7.getPath("userData"),
+    const settingsPath = path$f.join(
+      app$8.getPath("userData"),
       "Dashboard",
       "settings.json",
     );
-    if (!fs$a.existsSync(settingsPath)) return null;
-    const raw = fs$a.readFileSync(settingsPath, "utf8");
+    if (!fs$b.existsSync(settingsPath)) return null;
+    const raw = fs$b.readFileSync(settingsPath, "utf8");
     return JSON.parse(raw);
   } catch (_e) {
     return null;
@@ -22475,13 +22746,13 @@ function loadSettingsForFlags() {
 // confirm-on-disable dialog. See electron/utils/securityFlags.js for
 // the pinned default semantics.
 function isWidgetPermissionEnforcementEnabled() {
-  return readEnforceFlag(loadSettingsForFlags());
+  return readEnforceFlag$1(loadSettingsForFlags());
 }
 
 // JIT consent flag. **Default ON.** Same semantics as the enforcement
 // flag — explicit false to opt out, otherwise on.
 function isJitConsentEnabled() {
-  return readJitFlag(loadSettingsForFlags());
+  return readJitFlag$1(loadSettingsForFlags());
 }
 
 /**
@@ -22629,7 +22900,7 @@ function getShellPath$1() {
     fallbackDirs.push(`${home}/.nodenv/shims`);
     try {
       const nvmDir = `${home}/.nvm/versions/node`;
-      const versions = fs$a.readdirSync(nvmDir).sort();
+      const versions = fs$b.readdirSync(nvmDir).sort();
       if (versions.length > 0) {
         // Find the highest compatible version (v18/v20/v22)
         for (let i = versions.length - 1; i >= 0; i--) {
@@ -22765,15 +23036,15 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
   const credPath = tokenRefresh.credentialsPath.replace(/^~/, home);
   const keysPath = tokenRefresh.oauthKeysPath.replace(/^~/, home);
 
-  if (!fs$a.existsSync(credPath) || !fs$a.existsSync(keysPath)) {
+  if (!fs$b.existsSync(credPath) || !fs$b.existsSync(keysPath)) {
     console.log(
       "[mcpController] Token refresh skipped: credential files not found",
     );
     return;
   }
 
-  const credentials = JSON.parse(fs$a.readFileSync(credPath, "utf8"));
-  const keysFile = JSON.parse(fs$a.readFileSync(keysPath, "utf8"));
+  const credentials = JSON.parse(fs$b.readFileSync(credPath, "utf8"));
+  const keysFile = JSON.parse(fs$b.readFileSync(keysPath, "utf8"));
   const keyData = keysFile.installed || keysFile.web;
 
   if (
@@ -22798,7 +23069,7 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
 
   console.log("[mcpController] Refreshing Google OAuth token...");
 
-  const https = require$$10;
+  const https = require$$11;
   const postData = [
     `client_id=${encodeURIComponent(keyData.client_id)}`,
     `client_secret=${encodeURIComponent(keyData.client_secret)}`,
@@ -22842,7 +23113,7 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
     credentials.refresh_token = body.refresh_token;
   }
 
-  fs$a.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
+  fs$b.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
   console.log("[mcpController] Google OAuth token refreshed successfully");
 }
 
@@ -23029,7 +23300,7 @@ const mcpController$3 = {
           }
 
           // Interpolate {{MCP_DIR}} in args to resolve local MCP server scripts
-          const mcpDir = path$e.join(__dirname, "..", "mcp");
+          const mcpDir = path$f.join(__dirname, "..", "mcp");
           for (let i = 0; i < args.length; i++) {
             if (
               typeof args[i] === "string" &&
@@ -23480,20 +23751,20 @@ const mcpController$3 = {
    */
   getCatalog: (win) => {
     try {
-      const catalogPath = path$e.join(
+      const catalogPath = path$f.join(
         __dirname,
         "..",
         "mcp",
         "mcpServerCatalog.json",
       );
 
-      if (!fs$a.existsSync(catalogPath)) {
+      if (!fs$b.existsSync(catalogPath)) {
         return {
           catalog: [],
         };
       }
 
-      const catalogData = fs$a.readFileSync(catalogPath, "utf8");
+      const catalogData = fs$b.readFileSync(catalogPath, "utf8");
       const catalog = JSON.parse(catalogData);
 
       return {
@@ -23521,18 +23792,18 @@ const mcpController$3 = {
    */
   getKnownExternalCatalog: () => {
     try {
-      const catalogPath = path$e.join(
+      const catalogPath = path$f.join(
         __dirname,
         "..",
         "mcp",
         "knownExternalMcpServers.json",
       );
 
-      if (!fs$a.existsSync(catalogPath)) {
+      if (!fs$b.existsSync(catalogPath)) {
         return { success: true, servers: [] };
       }
 
-      const catalogData = fs$a.readFileSync(catalogPath, "utf8");
+      const catalogData = fs$b.readFileSync(catalogPath, "utf8");
       const catalog = JSON.parse(catalogData);
 
       return {
@@ -23597,8 +23868,8 @@ const mcpController$3 = {
         const destPath = to.replace(/^~/, os$2.homedir());
         const destDir = require$$1$1.dirname(destPath);
         try {
-          fs$a.mkdirSync(destDir, { recursive: true });
-          fs$a.copyFileSync(sourcePath, destPath);
+          fs$b.mkdirSync(destDir, { recursive: true });
+          fs$b.copyFileSync(sourcePath, destPath);
         } catch (err) {
           return {
             error: true,
@@ -23634,7 +23905,7 @@ const mcpController$3 = {
     }
 
     // Interpolate {{MCP_DIR}} in authCommand args (same as startServer)
-    const mcpDir = path$e.join(__dirname, "..", "mcp");
+    const mcpDir = path$f.join(__dirname, "..", "mcp");
     const resolvedArgs = (authCommand.args || []).map((arg) =>
       typeof arg === "string" && arg.includes("{{MCP_DIR}}")
         ? arg.replace(/\{\{MCP_DIR\}\}/g, mcpDir)
@@ -24182,8 +24453,8 @@ function commonjsRequire(path) {
  * Runs in the Electron main process at widget install time.
  */
 
-const fs$9 = require$$0$2;
-const path$d = require$$1$1;
+const fs$a = require$$0$2;
+const path$e = require$$1$1;
 
 /**
  * Structured error thrown by compileWidget() when the underlying
@@ -24218,7 +24489,7 @@ function getEsbuildDiagnostics() {
 
   try {
     const pkgJsonPath = require.resolve("esbuild/package.json");
-    diagnostics.esbuildPackageDir = path$d.dirname(pkgJsonPath);
+    diagnostics.esbuildPackageDir = path$e.dirname(pkgJsonPath);
     diagnostics.esbuildVersion = commonjsRequire(pkgJsonPath).version;
   } catch (err) {
     diagnostics.esbuildResolveError = err.message;
@@ -24228,15 +24499,15 @@ function getEsbuildDiagnostics() {
     const archPkgJson = require.resolve(
       `${diagnostics.archPackage}/package.json`,
     );
-    const archDir = path$d.dirname(archPkgJson);
+    const archDir = path$e.dirname(archPkgJson);
     // esbuild's native binary on macOS/Linux is bin/esbuild;
     // on Windows it's esbuild.exe at the package root.
     const candidate =
       process.platform === "win32"
-        ? path$d.join(archDir, "esbuild.exe")
-        : path$d.join(archDir, "bin", "esbuild");
+        ? path$e.join(archDir, "esbuild.exe")
+        : path$e.join(archDir, "bin", "esbuild");
     diagnostics.nativeBinaryPath = candidate;
-    diagnostics.nativeBinaryExists = fs$9.existsSync(candidate);
+    diagnostics.nativeBinaryExists = fs$a.existsSync(candidate);
   } catch (err) {
     diagnostics.archResolveError = err.message;
   }
@@ -24282,26 +24553,26 @@ async function healthCheck() {
  * @returns {string|null} Path to the widgets/ directory, or null
  */
 function findWidgetsDir$2(widgetPath) {
-  const direct = path$d.join(widgetPath, "widgets");
-  if (fs$9.existsSync(direct)) {
+  const direct = path$e.join(widgetPath, "widgets");
+  if (fs$a.existsSync(direct)) {
     return direct;
   }
 
   // Check configs/widgets/ (packageZip.js nests .dash.js files here)
-  const configsWidgets = path$d.join(widgetPath, "configs", "widgets");
-  if (fs$9.existsSync(configsWidgets)) {
+  const configsWidgets = path$e.join(widgetPath, "configs", "widgets");
+  if (fs$a.existsSync(configsWidgets)) {
     return configsWidgets;
   }
 
   // Check configs/ directory (used by packageZip.js for distributed widgets)
-  const configs = path$d.join(widgetPath, "configs");
-  if (fs$9.existsSync(configs)) {
+  const configs = path$e.join(widgetPath, "configs");
+  if (fs$a.existsSync(configs)) {
     return configs;
   }
 
   // Check one level deeper for nested ZIP extraction
   try {
-    const entries = fs$9.readdirSync(widgetPath, { withFileTypes: true });
+    const entries = fs$a.readdirSync(widgetPath, { withFileTypes: true });
     const subdirs = entries.filter(
       (e) =>
         e.isDirectory() &&
@@ -24311,8 +24582,8 @@ function findWidgetsDir$2(widgetPath) {
     );
 
     for (const subdir of subdirs) {
-      const nested = path$d.join(widgetPath, subdir.name, "widgets");
-      if (fs$9.existsSync(nested)) {
+      const nested = path$e.join(widgetPath, subdir.name, "widgets");
+      if (fs$a.existsSync(nested)) {
         console.log(`[WidgetCompiler] Found nested widgets/ at ${nested}`);
         return nested;
       }
@@ -24346,7 +24617,7 @@ async function compileWidget$1(widgetPath) {
   }
 
   // Discover .dash.js config files
-  const files = fs$9.readdirSync(widgetsDir);
+  const files = fs$a.readdirSync(widgetsDir);
   const dashFiles = files.filter((f) => f.endsWith(".dash.js"));
 
   if (dashFiles.length === 0) {
@@ -24360,15 +24631,15 @@ async function compileWidget$1(widgetPath) {
   // Compute relative path from the entry file (in widgetPath) to widgetsDir,
   // since widgetsDir may be nested (e.g., ./weather-widget/widgets/).
   const relWidgetsDir =
-    "./" + path$d.relative(widgetPath, widgetsDir).split(path$d.sep).join("/");
+    "./" + path$e.relative(widgetPath, widgetsDir).split(path$e.sep).join("/");
   const imports = [];
   const exportParts = [];
 
   for (const dashFile of dashFiles) {
     const componentName = dashFile.replace(".dash.js", "");
     const componentFile = `${componentName}.js`;
-    const componentFilePath = path$d.join(widgetsDir, componentFile);
-    const hasComponent = fs$9.existsSync(componentFilePath);
+    const componentFilePath = path$e.join(widgetsDir, componentFile);
+    const hasComponent = fs$a.existsSync(componentFilePath);
 
     // Import the config (always)
     imports.push(
@@ -24400,17 +24671,17 @@ async function compileWidget$1(widgetPath) {
   const entryContent = [...imports, "", ...exportParts, ""].join("\n");
 
   // Write temporary entry file in the widget root
-  const entryPath = path$d.join(widgetPath, "__compile_entry.js");
-  const distDir = path$d.join(widgetPath, "dist");
-  const outPath = path$d.join(distDir, "index.cjs.js");
+  const entryPath = path$e.join(widgetPath, "__compile_entry.js");
+  const distDir = path$e.join(widgetPath, "dist");
+  const outPath = path$e.join(distDir, "index.cjs.js");
 
   try {
     // Ensure dist/ directory exists
-    if (!fs$9.existsSync(distDir)) {
-      fs$9.mkdirSync(distDir, { recursive: true });
+    if (!fs$a.existsSync(distDir)) {
+      fs$a.mkdirSync(distDir, { recursive: true });
     }
 
-    fs$9.writeFileSync(entryPath, entryContent, "utf8");
+    fs$a.writeFileSync(entryPath, entryContent, "utf8");
 
     console.log(
       `[WidgetCompiler] Compiling ${dashFiles.length} component(s) from ${widgetPath}`,
@@ -24466,8 +24737,8 @@ async function compileWidget$1(widgetPath) {
   } finally {
     // Clean up temporary entry file
     try {
-      if (fs$9.existsSync(entryPath)) {
-        fs$9.unlinkSync(entryPath);
+      if (fs$a.existsSync(entryPath)) {
+        fs$a.unlinkSync(entryPath);
       }
     } catch (cleanupError) {
       // Non-fatal
@@ -24499,8 +24770,8 @@ var widgetCompiler$1 = {
  * Integrates with ComponentManager for automatic registration
  */
 
-const fs$8 = require$$0$2;
-const path$c = require$$1$1;
+const fs$9 = require$$0$2;
+const path$d = require$$1$1;
 const vm = require$$2$2;
 const { findWidgetsDir: findWidgetsDir$1 } = widgetCompiler$1;
 
@@ -24588,14 +24859,14 @@ class DynamicWidgetLoader {
       );
 
       const widgetsDir =
-        findWidgetsDir$1(widgetPath) || path$c.join(widgetPath, "widgets");
-      const componentPath = path$c.join(widgetsDir, `${componentName}.js`);
-      const configPath = path$c.join(widgetsDir, `${componentName}.dash.js`);
+        findWidgetsDir$1(widgetPath) || path$d.join(widgetPath, "widgets");
+      const componentPath = path$d.join(widgetsDir, `${componentName}.js`);
+      const configPath = path$d.join(widgetsDir, `${componentName}.dash.js`);
 
-      if (!fs$8.existsSync(componentPath)) {
+      if (!fs$9.existsSync(componentPath)) {
         throw new Error(`Component file not found: ${componentPath}`);
       }
-      if (!fs$8.existsSync(configPath)) {
+      if (!fs$9.existsSync(configPath)) {
         throw new Error(`Config file not found: ${configPath}`);
       }
 
@@ -24646,7 +24917,7 @@ class DynamicWidgetLoader {
    */
   async loadConfigFile(configPath) {
     try {
-      const source = fs$8.readFileSync(configPath, "utf8");
+      const source = fs$9.readFileSync(configPath, "utf8");
 
       let exportMatch = source.match(/export\s+default\s+({[\s\S]*});?\s*$/);
 
@@ -24714,7 +24985,7 @@ class DynamicWidgetLoader {
         return [];
       }
 
-      const files = fs$8.readdirSync(widgetsDir);
+      const files = fs$9.readdirSync(widgetsDir);
       const widgets = new Set();
 
       files.forEach((file) => {
@@ -24790,10 +25061,10 @@ var dynamicWidgetLoaderExports = dynamicWidgetLoader$3.exports;
  *     Test-only. Drops the in-process cache so tests can re-read.
  */
 
-const fs$7 = require$$0$2;
-const path$b = require$$1$1;
+const fs$8 = require$$0$2;
+const path$c = require$$1$1;
 const os$1 = require$$2$1;
-const { app: app$6 } = require$$0$1;
+const { app: app$7 } = require$$0$1;
 
 // Cache: widgetId → permissions | null. Populated lazily on first
 // lookup; invalidated when a widget is installed/uninstalled (the
@@ -24808,7 +25079,7 @@ function expandHome(p) {
   if (typeof p !== "string" || !p) return p;
   if (p === "~") return os$1.homedir();
   if (p.startsWith("~/") || p.startsWith("~\\")) {
-    return path$b.join(os$1.homedir(), p.slice(2));
+    return path$c.join(os$1.homedir(), p.slice(2));
   }
   return p;
 }
@@ -24848,10 +25119,10 @@ function parseManifestPermissions(packageJson) {
  */
 function resolveWidgetPackagePath(widgetId) {
   if (typeof widgetId !== "string" || !widgetId) return null;
-  const widgetsRoot = path$b.join(app$6.getPath("userData"), "widgets");
+  const widgetsRoot = path$c.join(app$7.getPath("userData"), "widgets");
   // Split scope from name for "@scope/name" form.
   const parts = widgetId.startsWith("@") ? widgetId.split("/") : [widgetId];
-  return path$b.join(widgetsRoot, ...parts, "package.json");
+  return path$c.join(widgetsRoot, ...parts, "package.json");
 }
 
 /**
@@ -24865,12 +25136,12 @@ function resolveWidgetPackagePath(widgetId) {
 function getWidgetMcpPermissions$1(widgetId) {
   if (_cache.has(widgetId)) return _cache.get(widgetId);
   const pkgPath = resolveWidgetPackagePath(widgetId);
-  if (!pkgPath || !fs$7.existsSync(pkgPath)) {
+  if (!pkgPath || !fs$8.existsSync(pkgPath)) {
     _cache.set(widgetId, null);
     return null;
   }
   try {
-    const raw = fs$7.readFileSync(pkgPath, "utf8");
+    const raw = fs$8.readFileSync(pkgPath, "utf8");
     const pkg = JSON.parse(raw);
     const perms = parseManifestPermissions(pkg);
     _cache.set(widgetId, perms);
@@ -24919,8 +25190,8 @@ var widgetPermissions = {
  * (Slices 1-3) is the actual boundary.
  */
 
-const fs$6 = require$$0$2;
-const path$a = require$$1$1;
+const fs$7 = require$$0$2;
+const path$b = require$$1$1;
 
 const SOURCE_EXTENSIONS = new Set([
   ".js",
@@ -24973,24 +25244,24 @@ function readSourceFiles(dir) {
   function walk(current, relBase) {
     let entries;
     try {
-      entries = fs$6.readdirSync(current, { withFileTypes: true });
+      entries = fs$7.readdirSync(current, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
-      const abs = path$a.join(current, entry.name);
-      const rel = relBase ? path$a.join(relBase, entry.name) : entry.name;
+      const abs = path$b.join(current, entry.name);
+      const rel = relBase ? path$b.join(relBase, entry.name) : entry.name;
       if (entry.isDirectory()) {
         if (skipDirs.has(entry.name)) continue;
         walk(abs, rel);
       } else if (entry.isFile()) {
-        const ext = path$a.extname(entry.name).toLowerCase();
+        const ext = path$b.extname(entry.name).toLowerCase();
         if (!SOURCE_EXTENSIONS.has(ext)) continue;
         if (result.length >= SCAN_FILE_LIMIT) return;
         try {
           result.push({
             relPath: rel,
-            source: fs$6.readFileSync(abs, "utf8"),
+            source: fs$7.readFileSync(abs, "utf8"),
           });
         } catch {
           // unreadable — skip
@@ -25010,7 +25281,7 @@ function scanForMcpUsage(input) {
   let fileList = [];
   if (input.files && typeof input.files === "object") {
     for (const [relPath, source] of Object.entries(input.files)) {
-      const ext = path$a.extname(relPath).toLowerCase();
+      const ext = path$b.extname(relPath).toLowerCase();
       if (!SOURCE_EXTENSIONS.has(ext)) continue;
       if (typeof source !== "string") continue;
       fileList.push({ relPath, source });
@@ -27146,8 +27417,8 @@ var widgetRegistryExports = widgetRegistry$1.exports;
  * - Support two-level browsing: packages (bundles) and widgets within packages
  */
 
-const path$9 = require$$1$1;
-const fs$5 = require$$0$2;
+const path$a = require$$1$1;
+const fs$6 = require$$0$2;
 const os = require$$2$1;
 const { toPackageId } = packageId;
 const { getStoredToken: getStoredToken$3 } = registryAuthController$2;
@@ -27183,7 +27454,7 @@ function getCacheKey() {
  * Get the local test registry path for dev mode
  */
 function getTestRegistryPath() {
-  return path$9.join(__dirname, "..", "registry", "test-registry-index.json");
+  return path$a.join(__dirname, "..", "registry", "test-registry-index.json");
 }
 
 /**
@@ -27223,12 +27494,12 @@ async function fetchRegistryIndex(forceRefresh = false) {
     if (isDev()) {
       // In dev mode, try local test file first
       const testPath = getTestRegistryPath();
-      if (fs$5.existsSync(testPath)) {
+      if (fs$6.existsSync(testPath)) {
         console.log(
           "[RegistryController] Loading test registry from:",
           testPath,
         );
-        const raw = fs$5.readFileSync(testPath, "utf8");
+        const raw = fs$6.readFileSync(testPath, "utf8");
         indexData = JSON.parse(raw);
       } else {
         // Fall back to API (supports DASH_REGISTRY_URL as full-URL override)
@@ -27641,7 +27912,7 @@ async function fetchPackageSource(packageName, componentName = null) {
 
   const zip = new AdmZip(buffer);
   const safeName = (pkg.name || "pkg").replace(/[^a-zA-Z0-9-_]/g, "_");
-  const tempDir = path$9.join(
+  const tempDir = path$a.join(
     os.tmpdir(),
     `dash-registry-preview-${safeName}-${Date.now()}`,
   );
@@ -27650,13 +27921,13 @@ async function fetchPackageSource(packageName, componentName = null) {
     validateZipEntries(zip, tempDir);
     zip.extractAllTo(tempDir, true);
 
-    const widgetsDir = path$9.join(tempDir, "widgets");
+    const widgetsDir = path$a.join(tempDir, "widgets");
     let componentCode = "";
     let configCode = "";
     let widgetName = null;
 
-    if (fs$5.existsSync(widgetsDir)) {
-      const files = fs$5.readdirSync(widgetsDir);
+    if (fs$6.existsSync(widgetsDir)) {
+      const files = fs$6.readdirSync(widgetsDir);
       const dashFiles = files.filter((f) => f.endsWith(".dash.js"));
       const componentFiles = files.filter(
         (f) => f.endsWith(".js") && !f.endsWith(".dash.js") && f !== "index.js",
@@ -27678,7 +27949,7 @@ async function fetchPackageSource(packageName, componentName = null) {
       if (!configFile) configFile = dashFiles[0];
 
       if (configFile) {
-        configCode = fs$5.readFileSync(path$9.join(widgetsDir, configFile), "utf8");
+        configCode = fs$6.readFileSync(path$a.join(widgetsDir, configFile), "utf8");
         widgetName = configFile.replace(/\.dash\.js$/, "");
       }
 
@@ -27692,8 +27963,8 @@ async function fetchPackageSource(packageName, componentName = null) {
       if (!componentFile) componentFile = componentFiles[0];
 
       if (componentFile) {
-        componentCode = fs$5.readFileSync(
-          path$9.join(widgetsDir, componentFile),
+        componentCode = fs$6.readFileSync(
+          path$a.join(widgetsDir, componentFile),
           "utf8",
         );
         if (!widgetName) widgetName = componentFile.replace(/\.js$/, "");
@@ -27701,16 +27972,16 @@ async function fetchPackageSource(packageName, componentName = null) {
     }
 
     let bundleSource = null;
-    const bundlePath = path$9.join(tempDir, "dist", "index.cjs.js");
-    if (fs$5.existsSync(bundlePath)) {
-      bundleSource = fs$5.readFileSync(bundlePath, "utf8");
+    const bundlePath = path$a.join(tempDir, "dist", "index.cjs.js");
+    if (fs$6.existsSync(bundlePath)) {
+      bundleSource = fs$6.readFileSync(bundlePath, "utf8");
     }
 
     let dashMeta = {};
-    const dashPath = path$9.join(tempDir, "dash.json");
-    if (fs$5.existsSync(dashPath)) {
+    const dashPath = path$a.join(tempDir, "dash.json");
+    if (fs$6.existsSync(dashPath)) {
       try {
-        dashMeta = JSON.parse(fs$5.readFileSync(dashPath, "utf8"));
+        dashMeta = JSON.parse(fs$6.readFileSync(dashPath, "utf8"));
       } catch {
         // Ignore — metadata is optional for preview
       }
@@ -27729,7 +28000,7 @@ async function fetchPackageSource(packageName, componentName = null) {
     };
   } finally {
     try {
-      fs$5.rmSync(tempDir, { recursive: true, force: true });
+      fs$6.rmSync(tempDir, { recursive: true, force: true });
     } catch (err) {
       console.warn(
         `[RegistryController] Failed to clean up preview temp dir ${tempDir}:`,
@@ -27749,10 +28020,10 @@ var registryController$3 = {
   fetchPackageSource,
 };
 
-var fs$4 = require$$0$2;
+var fs$5 = require$$0$2;
 var JSONStream = require$$4;
 const algoliasearch$1 = require$$2$3;
-const path$8 = require$$3$3;
+const path$9 = require$$3$3;
 const { ensureDirectoryExistence, checkDirectory } = file;
 
 let AlgoliaIndex$1 = class AlgoliaIndex {
@@ -27790,7 +28061,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
       var batchNumber = 1;
 
       // create the readStream to parse the large file (json)
-      var readStream = fs$4.createReadStream(filepath).pipe(parser);
+      var readStream = fs$5.createReadStream(filepath).pipe(parser);
 
       var batch = [];
 
@@ -27804,7 +28075,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
               // lets write to the batch file
               if (countForBatch === batchSize) {
                 // write to the batch file
-                var writeStream = fs$4.createWriteStream(
+                var writeStream = fs$5.createWriteStream(
                   batchFilepath + "/batch_" + batchNumber + ".json",
                 );
                 writeStream.write(JSON.stringify(batch));
@@ -27855,11 +28126,11 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
     return new Promise((resolve, reject) => {
       try {
         checkDirectory(directoryPath);
-        fs$4.readdir(directoryPath, (err, files) => {
+        fs$5.readdir(directoryPath, (err, files) => {
           if (err) reject(err);
           if (files) {
             files.forEach((file) => {
-              fs$4.unlinkSync(path$8.join(directoryPath, file));
+              fs$5.unlinkSync(path$9.join(directoryPath, file));
             });
             resolve();
           }
@@ -27878,11 +28149,11 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
   ) {
     try {
       // read the directory...
-      const files = await fs$4.readdirSync(batchFilepath);
+      const files = await fs$5.readdirSync(batchFilepath);
       let results = [];
       for (const fileIndex in files) {
         // for each file lets read the file and then push to algolia
-        const pathToBatch = path$8.join(batchFilepath, files[fileIndex]);
+        const pathToBatch = path$9.join(batchFilepath, files[fileIndex]);
         const fileContents = await this.readFile(pathToBatch);
         if (fileContents) {
           if ("data" in fileContents && "filepath" in fileContents) {
@@ -27907,7 +28178,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
 
   async readFile(filepath) {
     return await new Promise((resolve, reject) => {
-      fs$4.readFile(filepath, "utf8", (err, data) => {
+      fs$5.readFile(filepath, "utf8", (err, data) => {
         if (err) {
           reject(err);
         }
@@ -28057,7 +28328,7 @@ var algolia = AlgoliaIndex$1;
 const algoliasearch = require$$2$3;
 const events$3 = events$8;
 const AlgoliaIndex = algolia;
-var fs$3 = require$$0$2;
+var fs$4 = require$$0$2;
 const { safePath, getAllowedRoots } = safePath_1;
 
 const algoliaController$1 = {
@@ -28166,7 +28437,7 @@ const algoliaController$1 = {
         // init the Algolia Index helper
         const a = new AlgoliaIndex(appId, apiKey, indexName);
         // create the write stream to store the hits
-        const writeStream = fs$3.createWriteStream(toFilename);
+        const writeStream = fs$4.createWriteStream(toFilename);
         writeStream.write("[");
 
         let sep = "";
@@ -28419,8 +28690,8 @@ function upsertMenuItem$1(items, menuItem) {
 
 var upsertMenuItem_1 = { upsertMenuItem: upsertMenuItem$1 };
 
-const { app: app$5 } = require$$0$1;
-const path$7 = require$$1$1;
+const { app: app$6 } = require$$0$1;
+const path$8 = require$$1$1;
 const { writeFileSync } = require$$0$2;
 const { getFileContents: getFileContents$2 } = file;
 const { upsertMenuItem } = upsertMenuItem_1;
@@ -28431,8 +28702,8 @@ const appName$2 = "Dashboard";
 const menuItemsController$1 = {
   saveMenuItemForApplication: (win, appId, menuItem) => {
     try {
-      const filename = path$7.join(
-        app$5.getPath("userData"),
+      const filename = path$8.join(
+        app$6.getPath("userData"),
         appName$2,
         appId,
         configFilename$1,
@@ -28450,8 +28721,8 @@ const menuItemsController$1 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$7.join(
-        app$5.getPath("userData"),
+      const filename = path$8.join(
+        app$6.getPath("userData"),
         appName$2,
         appId,
         configFilename$1,
@@ -28476,14 +28747,14 @@ const menuItemsController$1 = {
 
 var menuItemsController_1 = menuItemsController$1;
 
-const path$6 = require$$1$1;
-const { app: app$4 } = require$$0$1;
+const path$7 = require$$1$1;
+const { app: app$5 } = require$$0$1;
 
 const pluginController$1 = {
   install: (win, packageName, filepath) => {
     try {
-      const rootPath = path$6.join(
-        app$4.getPath("userData"),
+      const rootPath = path$7.join(
+        app$5.getPath("userData"),
         "plugins",
         packageName,
       );
@@ -45747,7 +46018,7 @@ const completable_js_1 = completable;
 const uriTemplate_js_1 = uriTemplate;
 const toolNameValidation_js_1 = toolNameValidation;
 const mcp_server_js_1 = mcpServer$1;
-const zod_1 = require$$8$2;
+const zod_1 = require$$8$1;
 /**
  * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
  * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -48278,8 +48549,8 @@ streamableHttp.StreamableHTTPServerTransport = StreamableHTTPServerTransport$1;
  *   https.createServer({ key, cert }, handler);
  */
 
-const fs$2 = require$$0$2;
-const path$5 = require$$1$1;
+const fs$3 = require$$0$2;
+const path$6 = require$$1$1;
 const forge = require$$2$4;
 
 /**
@@ -48288,14 +48559,14 @@ const forge = require$$2$4;
  * @returns {{ cert: string, key: string }} PEM-encoded certificate and private key
  */
 function getOrCreateCert$1(certsDir) {
-  const certPath = path$5.join(certsDir, "cert.pem");
-  const keyPath = path$5.join(certsDir, "key.pem");
+  const certPath = path$6.join(certsDir, "cert.pem");
+  const keyPath = path$6.join(certsDir, "key.pem");
 
   // Return existing cert if valid
-  if (fs$2.existsSync(certPath) && fs$2.existsSync(keyPath)) {
+  if (fs$3.existsSync(certPath) && fs$3.existsSync(keyPath)) {
     try {
-      const cert = fs$2.readFileSync(certPath, "utf8");
-      const key = fs$2.readFileSync(keyPath, "utf8");
+      const cert = fs$3.readFileSync(certPath, "utf8");
+      const key = fs$3.readFileSync(keyPath, "utf8");
       // Verify cert is not expired
       const parsed = forge.pki.certificateFromPem(cert);
       if (parsed.validity.notAfter > new Date()) {
@@ -48361,9 +48632,9 @@ function getOrCreateCert$1(certsDir) {
   const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
 
   // Write to disk
-  fs$2.mkdirSync(certsDir, { recursive: true });
-  fs$2.writeFileSync(certPath, certPem, { mode: 0o644 });
-  fs$2.writeFileSync(keyPath, keyPem, { mode: 0o600 });
+  fs$3.mkdirSync(certsDir, { recursive: true });
+  fs$3.writeFileSync(certPath, certPem, { mode: 0o644 });
+  fs$3.writeFileSync(keyPath, keyPem, { mode: 0o600 });
 
   console.log(`[tlsCert] Certificate saved to ${certsDir}`);
 
@@ -48380,7 +48651,7 @@ var tlsCert = { getOrCreateCert: getOrCreateCert$1 };
  * for Zod schemas in tool input validation (safeParseAsync).
  */
 
-const z$1 = require$$8$2;
+const z$1 = require$$8$1;
 
 /**
  * Convert a JSON Schema property definition to a Zod v3 schema.
@@ -48473,7 +48744,7 @@ var jsonSchemaToZod_1 = { jsonSchemaToZod: jsonSchemaToZod$1, jsonSchemaProperty
  *   - Rate limiting via token bucket (60 req/min)
  */
 
-const https$1 = require$$10;
+const https$1 = require$$11;
 const { randomUUID } = require$$3$4;
 const { BrowserWindow: BrowserWindow$1 } = require$$0$1;
 const { McpServer } = mcp;
@@ -48604,7 +48875,7 @@ function registerPrompt$1(promptDef) {
   registeredPrompts.push(promptDef);
 }
 
-const z = require$$8$2;
+const z = require$$8$1;
 const { jsonSchemaToZod } = jsonSchemaToZod_1;
 
 /**
@@ -50282,7 +50553,7 @@ var themeFromUrlErrors$1 = {
 
 const css = require$$0$9;
 const { Vibrant } = require$$1$6;
-const https = require$$10;
+const https = require$$11;
 const http = require$$0$8;
 const { URL: URL$1 } = require$$4$1;
 const {
@@ -57023,8 +57294,8 @@ var dashboardConfigUtils$1 = {
  * Handles publishing packages and generating registry URLs.
  */
 
-const fs$1 = require$$0$2;
-const path$4 = require$$1$1;
+const fs$2 = require$$0$2;
+const path$5 = require$$1$1;
 const { getStoredToken: getStoredToken$2 } = registryAuthController$2;
 
 const REGISTRY_BASE_URL =
@@ -57050,14 +57321,14 @@ async function publishToRegistry$1(zipPath, manifest) {
 
   try {
     // Read the ZIP file
-    const zipBuffer = fs$1.readFileSync(zipPath);
+    const zipBuffer = fs$2.readFileSync(zipPath);
 
     // Create FormData with the ZIP and manifest
     const formData = new FormData();
     formData.append(
       "file",
       new Blob([zipBuffer], { type: "application/zip" }),
-      path$4.basename(zipPath),
+      path$5.basename(zipPath),
     );
     formData.append("manifest", JSON.stringify(manifest));
 
@@ -57299,8 +57570,8 @@ function requireWidgetPublishManifest () {
  * Mirrors dashboardConfigController patterns for ZIP creation, manifest generation,
  * and registry interaction.
  */
-const path$3 = require$$1$1;
-const { app: app$3, dialog: dialog$1 } = require$$0$1;
+const path$4 = require$$1$1;
+const { app: app$4, dialog: dialog$1 } = require$$0$1;
 const AdmZip$2 = require$$3$2;
 
 const themeController$3 = themeController_1;
@@ -57805,7 +58076,7 @@ async function installThemeFromRegistry$1(win, appId, packageName) {
       // Validate entry path (security: prevent path traversal)
       if (
         themeEntry.entryName.includes("..") ||
-        path$3.isAbsolute(themeEntry.entryName)
+        path$4.isAbsolute(themeEntry.entryName)
       ) {
         return {
           success: false,
@@ -58038,8 +58309,8 @@ var themeRegistryController$1 = {
  * applies event wiring. (Import is implemented in DASH-13.)
  */
 
-const { app: app$2, dialog } = require$$0$1;
-const path$2 = require$$1$1;
+const { app: app$3, dialog } = require$$0$1;
+const path$3 = require$$1$1;
 const AdmZip$1 = require$$3$2;
 const { getFileContents: getFileContents$1 } = file;
 const {
@@ -58088,8 +58359,8 @@ async function exportDashboardConfig$1(
 ) {
   try {
     // 1. Read workspace from workspaces.json
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -58202,8 +58473,8 @@ async function exportDashboardConfig$1(
 
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Export Dashboard as ZIP",
-      defaultPath: path$2.join(
-        app$2.getPath("desktop"),
+      defaultPath: path$3.join(
+        app$3.getPath("desktop"),
         `dashboard-${sanitizedName}.zip`,
       ),
       filters: [{ name: "ZIP Archive", extensions: ["zip"] }],
@@ -58268,7 +58539,7 @@ async function selectDashboardFile$1(win) {
 
     // Extract and validate
     const zip = new AdmZip$1(zipPath);
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -58378,7 +58649,7 @@ async function importDashboardConfig$1(
     const zip = new AdmZip$1(zipPath);
 
     // Validate ZIP entries for path traversal
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -59018,7 +59289,7 @@ async function installDashboardFromRegistry$1(
     const zip = new AdmZip$1(zipBuffer);
 
     // 3. Validate ZIP entries
-    const tempDir = path$2.join(app$2.getPath("temp"), "dash-registry-import");
+    const tempDir = path$3.join(app$3.getPath("temp"), "dash-registry-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -59154,8 +59425,8 @@ async function collectDashboardDependencies$1(
 ) {
   try {
     // 1. Read workspace
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59433,8 +59704,8 @@ async function prepareDashboardForPublish$1(
     const { resolveNextVersion } = requireWidgetPublishManifest();
 
     // 1. Read workspace
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59711,8 +59982,8 @@ async function prepareDashboardForPublish$1(
     const sanitizedName = manifest.name;
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Save Dashboard Package for Registry",
-      defaultPath: path$2.join(
-        app$2.getPath("desktop"),
+      defaultPath: path$3.join(
+        app$3.getPath("desktop"),
         `dashboard-${sanitizedName}-v${manifest.version}.zip`,
       ),
       filters: [{ name: "ZIP Archive", extensions: ["zip"] }],
@@ -59879,8 +60150,8 @@ async function checkDashboardUpdatesForApp$1(appId) {
   const { fetchRegistryIndex } = registryController$3;
 
   try {
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -59950,8 +60221,8 @@ function getProviderSetupManifest$1(appId, requiredProviders = []) {
  */
 function getDashboardPublishPreview$1(appId, workspaceId, widgetRegistry = null) {
   try {
-    const filename = path$2.join(
-      app$2.getPath("userData"),
+    const filename = path$3.join(
+      app$3.getPath("userData"),
       appName$1,
       appId,
       configFilename,
@@ -60259,9 +60530,50 @@ var notificationController_1 = notificationController$2;
  *
  * Uses the `ws` package (installed in dash-electron) for WebSocket clients.
  * Multiple widgets referencing the same provider share a single socket.
+ *
+ * Phase 3 (network domain JIT) gates `connect` by hostname when a
+ * widgetId is supplied. Once a connection exists, `send` /
+ * `disconnect` / `getStatus` / `getAll` operate on the
+ * already-authorized socket and are intentionally NOT re-gated —
+ * connections are designed to be shared across widgets via the
+ * `consumers: Set` field, and re-gating sends would break that.
  */
 
-const WebSocket = require$$0$b;
+const { app: app$2 } = require$$0$1;
+const fs$1 = require$$0$2;
+const path$2 = require$$1$1;
+const WebSocket = require$$3$5;
+const {
+  gateNetworkCall,
+  gateNetworkCallWithJit,
+} = networkGate;
+const { readEnforceFlag, readJitFlag } = securityFlags;
+
+function _loadFlags() {
+  try {
+    const settingsPath = path$2.join(
+      app$2.getPath("userData"),
+      "Dashboard",
+      "settings.json",
+    );
+    if (!fs$1.existsSync(settingsPath)) return null;
+    return JSON.parse(fs$1.readFileSync(settingsPath, "utf8"));
+  } catch (_e) {
+    return null;
+  }
+}
+
+async function _runNetworkGate(action, widgetId, args) {
+  const settings = _loadFlags();
+  if (!readEnforceFlag(settings)) return { allow: true };
+  if (!widgetId) return { allow: true }; // legacy callers
+  return readJitFlag(settings)
+    ? await gateNetworkCallWithJit(
+        { widgetId, action, args },
+        { enableJit: true },
+      )
+    : gateNetworkCall({ widgetId, action, args });
+}
 
 /**
  * Active WebSocket connections
@@ -60692,7 +61004,26 @@ const webSocketController$1 = {
    * @param {object} config - { url, headers, subprotocols, credentials }
    * @returns {{ success, providerName, status } | { error, message }}
    */
-  connect: async (win, providerName, config) => {
+  connect: async (win, providerName, config, widgetId = null) => {
+    // Phase 3 network gate — fires only when an explicit widgetId is
+    // supplied. The interpolated URL (with credentials substituted) is
+    // what we actually open the socket to, so the gate uses it for
+    // hostname extraction.
+    const interpolatedForGate = config?.credentials
+      ? interpolate(config.url, config.credentials)
+      : config?.url;
+    const gateResult = await _runNetworkGate("wsConnect", widgetId, {
+      url: interpolatedForGate,
+    });
+    if (!gateResult.allow) {
+      return {
+        error: true,
+        message: "network permission gate: " + gateResult.reason,
+        providerName,
+        status: STATUS.ERROR,
+      };
+    }
+
     // 1. Already connected? Return existing connection
     const existing = activeConnections.get(providerName);
     if (existing && existing.status === STATUS.CONNECTED) {
@@ -62728,8 +63059,8 @@ const dataApi$2 = {
     ipcRenderer$m.invoke(READ_JSON, { filepath, objectCount });
   },
 
-  readDataFromURL: (url, toFilepath) => {
-    ipcRenderer$m.invoke(READ_DATA_URL, { url, toFilepath });
+  readDataFromURL: (url, toFilepath, widgetId = null) => {
+    ipcRenderer$m.invoke(READ_DATA_URL, { url, toFilepath, widgetId });
   },
 
   /*
@@ -64732,8 +65063,8 @@ const webSocketApi$2 = {
    * @param {object} config { url, headers, subprotocols, credentials }
    * @returns {Promise<{ success, providerName, status } | { error, message }>}
    */
-  connect: (providerName, config) =>
-    ipcRenderer$4.invoke(WS_CONNECT, { providerName, config }),
+  connect: (providerName, config, widgetId = null) =>
+    ipcRenderer$4.invoke(WS_CONNECT, { providerName, config, widgetId }),
 
   /**
    * disconnect