@trops/dash-core 0.1.525 → 0.1.527

package/dist/electron/index.js

@@ -3549,17 +3549,42 @@ function parseManifestPermissions(packageJson) {
   return { servers };
 }
 
+/**
+ * Translate a dotted component widget id into the npm package id whose
+ * package.json holds the manifest. Mirrors the construction logic in
+ * `src/Components/Dashboard/WidgetsTab.js` (`<scope>.<pkg>.<comp>`):
+ *
+ *   "@trops/gmail"                       → "@trops/gmail"
+ *   "trops.gmail.GmailCompose"           → "@trops/gmail"
+ *   "ai-built.pipeline.ProspectWorkspace" → "@ai-built/pipeline"
+ *   "pipeline.AutomationHub"             → "pipeline"   (bare, no scope)
+ *   "legacy-bare-package"                → "legacy-bare-package"
+ *
+ * The grant store keys grants by the dotted form; the on-disk widget
+ * folder is keyed by the npm form. This bridges the two.
+ */
+function dottedComponentIdToPackageId(widgetId) {
+  if (typeof widgetId !== "string" || !widgetId) return null;
+  if (widgetId.startsWith("@")) return widgetId;
+  const parts = widgetId.split(".");
+  if (parts.length >= 3) return `@${parts[0]}/${parts[1]}`;
+  if (parts.length === 2) return parts[0];
+  return widgetId;
+}
+
 /**
  * Find a widget's installed package.json on disk. Widgets live under
  * userData/widgets/<scope>/<name>/ for scoped packages or
- * userData/widgets/<name>/ for unscoped. The widgetId is the npm
- * package name (e.g. "@trops/notes-summarizer" or "notes-summarizer").
+ * userData/widgets/<name>/ for unscoped. Accepts either npm package
+ * ids ("@trops/gmail") or dotted component ids
+ * ("trops.gmail.GmailCompose") — the latter is translated first.
  */
 function resolveWidgetPackagePath(widgetId) {
-  if (typeof widgetId !== "string" || !widgetId) return null;
+  const packageId = dottedComponentIdToPackageId(widgetId);
+  if (typeof packageId !== "string" || !packageId) return null;
   const widgetsRoot = path$f.join(app$a.getPath("userData"), "widgets");
   // Split scope from name for "@scope/name" form.
-  const parts = widgetId.startsWith("@") ? widgetId.split("/") : [widgetId];
+  const parts = packageId.startsWith("@") ? packageId.split("/") : [packageId];
   return path$f.join(widgetsRoot, ...parts, "package.json");
 }
 
@@ -3603,6 +3628,7 @@ function clearCache() {
 var widgetPermissions = {
   getWidgetMcpPermissions: getWidgetMcpPermissions$1,
   parseManifestPermissions,
+  dottedComponentIdToPackageId,
   expandHome,
   clearCache,
 };
@@ -4000,11 +4026,39 @@ function requireScanWidgetPackagePermissions () {
 	  return merged;
 	}
 
+	/**
+	 * Run `applyScanToPackageJson` over a list of widget package paths.
+	 * Used at registry boot to backfill `dash.permissions.mcp` for widgets
+	 * installed before the publish/install scanner hooks existed (or that
+	 * have since updated their tool set without re-publishing). Idempotent
+	 * — additive merge means repeated boots produce no further writes.
+	 *
+	 * @param {string[]} packagePaths
+	 * @returns {{scanned: number, modified: number, errors: Array<{path: string, error: string}>}}
+	 */
+	function backfillPackagePermissions(packagePaths) {
+	  const summary = { scanned: 0, modified: 0, errors: [] };
+	  if (!Array.isArray(packagePaths)) return summary;
+	  for (const pkgPath of packagePaths) {
+	    if (typeof pkgPath !== "string" || !pkgPath) continue;
+	    if (!fs.existsSync(pkgPath)) continue;
+	    summary.scanned += 1;
+	    try {
+	      const merged = applyScanToPackageJson(pkgPath);
+	      if (merged) summary.modified += 1;
+	    } catch (e) {
+	      summary.errors.push({ path: pkgPath, error: e.message });
+	    }
+	  }
+	  return summary;
+	}
+
 	scanWidgetPackagePermissions_1 = {
 	  scanFileForMcpUsage,
 	  scanWidgetPackagePermissions,
 	  mergePermissions,
 	  applyScanToPackageJson,
+	  backfillPackagePermissions,
 	};
 	return scanWidgetPackagePermissions_1;
 }
@@ -4795,6 +4849,33 @@ var schedulerController_1 = schedulerController$2;
 
 	    // Reconcile: re-register orphaned widget packages found on disk
 	    this.reconcileWithDisk();
+
+	    // Slice 13b: backfill `dash.permissions.mcp` for any registered
+	    // widget that was installed before the publish/install scanner
+	    // hooks existed (or that has since updated tools without
+	    // re-publishing). Additive merge — idempotent across boots.
+	    try {
+	      const {
+	        backfillPackagePermissions,
+	      } = requireScanWidgetPackagePermissions();
+	      const paths = Array.from(this.widgets.values())
+	        .map((w) => w.path)
+	        .filter(Boolean);
+	      const summary = backfillPackagePermissions(paths);
+	      if (summary.modified > 0) {
+	        console.log(
+	          `[WidgetRegistry] Backfilled MCP permissions for ${summary.modified}/${summary.scanned} widget(s)`,
+	        );
+	      }
+	      if (summary.errors.length) {
+	        console.warn(`[WidgetRegistry] MCP backfill errors:`, summary.errors);
+	      }
+	    } catch (e) {
+	      console.warn(
+	        "[WidgetRegistry] MCP permissions backfill failed:",
+	        e.message,
+	      );
+	    }
 	  }
 
 	  /**