@wix/himalaya-cli 0.1377.0 → 0.1379.0

package/templates/yoga-studio-owner/tier5-src/_shared/aria-chat.ts

@@ -88,6 +88,7 @@ import {
   type WidgetOptionRow,
   type WidgetView,
 } from "./aria-widget-view.js";
+import { oauthView, DEFAULT_OAUTH_COPY, OAUTH_AUTHORIZED_NOTE, OAUTH_DECLINED_NOTE, type OAuthCopy } from "./aria-widget-oauth.js";
 import { substituteSelection } from "./aria-widget-model.js";
 import { MENTION_PAGE_SIZE, allowlisted, emptyMentionModel, mentionView,
   type MentionItemRow, type MentionLabels, type MentionModel, type MentionProvider, type MentionView } from "./aria-mentions.js";
@@ -468,6 +469,7 @@ export interface AriaChatLabels {
   mentionItemsFailed?: (category: string) => string;
   /** Shown when a response widget's item provider cannot be queried. */
   widgetItemsFailed?: Resolvable<string>;
+  oauth?: Partial<Record<keyof OAuthCopy, Resolvable<string>>>;
   /** Shown when this host cannot reach Wix's item provider service. */
   widgetItemsUnavailable?: Resolvable<string>;
   /** Attachment copy — see `AriaChatOptions.attachments`. Chip states: */
@@ -994,13 +996,23 @@ function withAttachments(content: string, names: readonly string[]): { content:
   return { content, attachText, attachHidden: !attachText };
 }
 
+/** Only OAuth protocol suffixes are hidden in owner replies. Ordinary owner text
+ *  stays literal; apply this to optimistic rows and their later server echoes. */
+function visibleOwnerReply(content: string): string {
+  for (const note of [OAUTH_AUTHORIZED_NOTE, OAUTH_DECLINED_NOTE]) {
+    const suffix = `<HIDDEN>${note}</HIDDEN>`;
+    if (content.endsWith(suffix)) return content.slice(0, -suffix.length).trimEnd();
+  }
+  return content;
+}
+
 /** A greeting or optimistic bubble: no links, all slots defaulted. `attached`
  *  names the files an optimistic USER bubble is being sent with, and `refs` is
  *  its mention line, already formatted. */
 export function plainBubble(
   id: string, role: string, who: string, content: string, attached: readonly string[] = [], refs = "",
 ): AriaBubble {
-  const a = withAttachments(content, attached);
+  const a = withAttachments(role === "USER" ? visibleOwnerReply(content) : content, attached);
   return { id, role, who, notUser: role !== "USER", notAria: role === "USER", spoken: spokenOf(who, a.content),
     refs, refsHidden: !refs, ...linkFieldsOf("", role), ...a };
 }
@@ -1086,7 +1098,7 @@ function bubbleOf(
   // A row the service is still writing is scanned as STREAMING: an
   // envelope whose `>>` has not arrived yet is held back rather than
   // painted as raw JSON until the row finishes.
-  const prose = role === "USER" ? raw : assistantProse(raw, !writing);
+  const prose = role === "USER" ? visibleOwnerReply(raw) : assistantProse(raw, !writing);
   const content = role === "USER" ? prose : stripMarkdown(prose);
   // A turn that is only attachments still happened, and dropping it would hide
   // what the owner sent: `withAttachments` makes the file line its content.
@@ -1512,7 +1524,7 @@ export interface AriaChatCore {
    *  region is `$service:`-bound and has no item, and the worker already holds
    *  the value anyway — so the descriptor names the action and nothing else,
    *  which is also one less place for a model-supplied url to travel through. */
-  widgetPrimary(s: AriaChatState): Promise<AriaChatState>;
+  widgetPrimary(s: AriaChatState): Promise<AriaChatState | undefined>;
   widgetSecondary(s: AriaChatState): Promise<AriaChatState>;
   /** Toggle one option of a MULTI_SELECT-style widget. Synchronous: it is a
    *  state edit, and making it async would put a turn boundary where there is
@@ -1651,6 +1663,16 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     o.labels?.dictationEmpty ?? "Didn't catch that. Check microphone access and try again.",
   );
   const dictationFailedText = () => res(o.labels?.dictationFailed ?? "Dictation isn't available right now.");
+  const oauthCopy = (): OAuthCopy => Object.fromEntries(
+    Object.entries(DEFAULT_OAUTH_COPY).map(([key, fallback]) =>
+      [key, res(o.labels?.oauth?.[key as keyof OAuthCopy] ?? fallback)]),
+  ) as unknown as OAuthCopy;
+  let oauthKey = "";
+  let oauthSeq = 0;
+  /** The identity of the OAuth ask on screen: its message and its URL. */
+  const oauthKeyOf = (w: WidgetView): string => w.kind === "OAUTH_REQUIRED"
+    ? `${w.sourceMessageId ?? ""}\0${w.oauthAuthorizationUrl ?? ""}` : "";
+  let oauthOpening = "";
   const widgetItemsFailedText = () => res(o.labels?.widgetItemsFailed ?? "Couldn't load these items.");
   const widgetItemsUnavailableText = () => res(o.labels?.widgetItemsUnavailable ?? "Items aren't available here.");
   const attachUploadingText = () => res(o.labels?.attachUploading ?? "Uploading…");
@@ -2522,6 +2544,10 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // transcript row itself is unchanged.
     if (!next.sourceMessageId || prev.sourceMessageId !== next.sourceMessageId) return next;
     if (prev.kind !== next.kind) return next;
+    if (next.kind === "OAUTH_REQUIRED" && prev.oauthAuthorizationUrl === next.oauthAuthorizationUrl) {
+      return { ...oauthView(next, next.oauthAuthorizationUrl ?? "", disclosedLabel, oauthCopy(), prev.oauthPhase),
+        notice: prev.notice, noticeHidden: prev.noticeHidden };
+    }
     // Keep the latest service status while this exact job and transcript row
     // remain visible. Rebuilding from the envelope must not restart a terminal
     // job or replace progress with its initial status message.
@@ -2634,36 +2660,43 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   const localized = (w: WidgetView): WidgetView =>
     w.kind === "QUESTIONNAIRE"
       ? questionnaireSynced(w, w.questionIndex, questionnaireCopy(), !w.answersTextHidden)
-      : w;
-
-  const observed = (msgs: ConversationMessage[], prev?: WidgetView) => ({
-    _srvUsers: countTurns(msgs, "USER"),
-    _srvAssistants: countTurns(msgs, "ASSISTANT"),
-    // Derived HERE, with the counts, because this is the one expression every
-    // transcript rebuild already spreads — load, resume, tick and both newChat
-    // arms. That is what makes the widget impossible to leave stale: a rebuild
-    // that forgot to clear it would also have to have forgotten the counts,
-    // which the reply-detection depends on. `observed([])` (new chat) yields
-    // NO_WIDGET for free.
-    // Content is normalized HERE, not in the view: `messageText` decodes the
-    // `{ text: … }` shape the service also sends (treated as empty before,
-    // so those widgets never appeared at all), and `stripHidden` removes
-    // `<HIDDEN>` spans — which are transcript-only, and were promoting hidden
-    // envelopes into live interactive cards. The transcript path already did
-    // both; the widget path did neither.
-    widget: carrySelection(
-      localized(activeWidgetOf(
-        // A draft offers no controls: the agent has not finished asking, and
-        // an answer tapped now would start a second turn on top of this one.
-        // An empty newest row is NO_WIDGET — the placeholder rule.
-        msgs.map((m) => ({ id: m.id, role: m.role, content: stillWriting(m) ? "" : stripHidden(messageText(m)) })),
-        disclosedLabel,
-        o.subtree,
-        (url) => isWixMediaHost(hostOf(url)),
-      )),
-      prev,
-    ),
-  });
+      : w.kind === "OAUTH_REQUIRED"
+        ? oauthView(w, w.oauthAuthorizationUrl ?? "", disclosedLabel, oauthCopy(), w.oauthPhase)
+        : w;
+
+  const observed = (msgs: ConversationMessage[], prev?: WidgetView) => {
+    const result = {
+      _srvUsers: countTurns(msgs, "USER"),
+      _srvAssistants: countTurns(msgs, "ASSISTANT"),
+      // Derived HERE, with the counts, because this is the one expression every
+      // transcript rebuild already spreads — load, resume, tick and both newChat
+      // arms. That is what makes the widget impossible to leave stale: a rebuild
+      // that forgot to clear it would also have to have forgotten the counts,
+      // which the reply-detection depends on. `observed([])` (new chat) yields
+      // NO_WIDGET for free.
+      // Content is normalized HERE, not in the view: `messageText` decodes the
+      // `{ text: … }` shape the service also sends (treated as empty before,
+      // so those widgets never appeared at all), and `stripHidden` removes
+      // `<HIDDEN>` spans — which are transcript-only, and were promoting hidden
+      // envelopes into live interactive cards. The transcript path already did
+      // both; the widget path did neither.
+      widget: carrySelection(
+        localized(activeWidgetOf(
+          // A draft offers no controls: the agent has not finished asking, and
+          // an answer tapped now would start a second turn on top of this one.
+          // An empty newest row is NO_WIDGET — the placeholder rule.
+          msgs.map((m) => ({ id: m.id, role: m.role, content: stillWriting(m) ? "" : stripHidden(messageText(m)) })),
+          disclosedLabel,
+          o.subtree,
+          (url) => isWixMediaHost(hostOf(url)),
+        )),
+        prev,
+      ),
+    };
+    const key = oauthKeyOf(result.widget);
+    if (key !== oauthKey) { oauthKey = key; oauthSeq++; }
+    return result;
+  };
 
   const greetingOnly = (): AriaBubble[] => [plainBubble(GREETING_ID, "ASSISTANT", assistant(), res(o.greeting))];
 
@@ -4028,12 +4061,38 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     // The url wins when both are present: a button that names a destination
     // should go there, and `respondText` beside it is the fallback the
     // service sends for clients that cannot open one.
-    widgetPrimary: (s) => s.widget.primaryUrl
-      ? openWidgetUrl(s, s.widget.primaryUrl)
-      : impl.widgetRespond(s, { value: "primary" }),
-    widgetSecondary: (s) => s.widget.secondaryUrl
-      ? openWidgetUrl(s, s.widget.secondaryUrl)
-      : impl.widgetRespond(s, { value: "secondary" }),
+    widgetPrimary: async (s) => {
+      const w = s.widget;
+      if (w.kind !== "OAUTH_REQUIRED") return w.primaryUrl
+        ? openWidgetUrl(s, w.primaryUrl) : impl.widgetRespond(s, { value: "primary" });
+      if (w.primaryHidden || !w.oauthAuthorizationUrl || s._pending) return s;
+      if (w.oauthPhase === "authorizing") {
+        oauthSeq++;
+        return impl.widgetRespond(s, { value: "primary" });
+      }
+      // Key from the card itself: a worker rebuilt over persisted state restores
+      // the card without a transcript rebuild, so the module-local key is still
+      // empty and the in-flight guard below would swallow the first Authorize.
+      const key = oauthKeyOf(w);
+      if (key !== oauthKey) { oauthKey = key; oauthSeq++; }
+      if (oauthOpening === key) return undefined;
+      oauthOpening = key;
+      const seq = ++oauthSeq, turn = turnSeq, draft = draftSeq;
+      let opened = false;
+      try { opened = !!(await o.openLink?.(w.oauthAuthorizationUrl)); } catch { /* shown below */ }
+      finally { if (oauthOpening === key) oauthOpening = ""; }
+      // Never merge an old action snapshot over a newer conversation, widget
+      // or composer edit. An external browser opening can take arbitrarily long.
+      if (seq !== oauthSeq || key !== oauthKey || turn !== turnSeq || draft !== draftSeq) return undefined;
+      return opened
+        ? { ...s, widget: oauthView(w, w.oauthAuthorizationUrl, disclosedLabel, oauthCopy(), "authorizing") }
+        : { ...s, widget: { ...w, notice: oauthCopy().openFailed, noticeHidden: false } };
+    },
+    widgetSecondary: (s) => {
+      if (s.widget.kind === "OAUTH_REQUIRED") oauthSeq++;
+      return s.widget.secondaryUrl ? openWidgetUrl(s, s.widget.secondaryUrl)
+        : impl.widgetRespond(s, { value: "secondary" });
+    },
 
     dictate: (s) => {
       if (!o.dictation || s.listening) return s;
@@ -4478,7 +4537,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     widgetAnswer: (s, arg) => gated(impl.widgetAnswer(s, arg)),
     widgetStep: (s, arg) => gated(impl.widgetStep(s, arg)),
     widgetRespond: (s, arg) => impl.widgetRespond(s, arg).then(gated),
-    widgetPrimary: (s) => impl.widgetPrimary(s).then(gated),
+    widgetPrimary: (s) => impl.widgetPrimary(s).then((r) => r ? gated(r) : r),
     widgetSecondary: (s) => impl.widgetSecondary(s).then(gated),
     dictate: (s) => gated(impl.dictate(s)),
     finishDictation: (s) => gated(impl.finishDictation(s)),

package/templates/yoga-studio-owner/tier5-src/_shared/aria-widget-oauth.ts

@@ -0,0 +1,42 @@
+import type { Disclose, WidgetView } from "./aria-widget-view.js";
+import { isWebUrl } from "./aria-widget-model.js";
+
+export interface OAuthCopy {
+  title: string; body: string; pending: string; authorize: string; decline: string;
+  done: string; authorized: string; declined: string; openFailed: string;
+}
+
+export const DEFAULT_OAUTH_COPY: OAuthCopy = {
+  title: "Connect an account", body: "Authorize access to continue this task.",
+  pending: "Finish authorization in your browser, then return and choose Done.",
+  authorize: "Authorize", decline: "Decline", done: "Done",
+  authorized: "Authorized", declined: "Declined",
+  openFailed: "Couldn't open authorization. Try again or decline.",
+};
+
+// These instructions are wire content from the native Aria client, not copy.
+export const OAUTH_AUTHORIZED_NOTE = "The user completed the OAuth authorization flow. Please retry the previous tool call.";
+export const OAUTH_DECLINED_NOTE = "The user declined OAuth authorization. Do not retry the tool.";
+
+/** A browser-open result is not an OAuth callback. Only the owner's subsequent
+ * Done action sends completion. The destination is disclosed by the same helper
+ * as every other widget URL; no guessed server callback is invoked. */
+export function oauthView(
+  view: WidgetView, rawUrl: string, disclose: Disclose,
+  copy: OAuthCopy = DEFAULT_OAUTH_COPY, phase: "pending" | "authorizing" = "pending",
+): WidgetView {
+  const url = isWebUrl(rawUrl.trim()) ? rawUrl.trim() : "";
+  const authorizing = phase === "authorizing" && !!url;
+  return {
+    ...view, notice: "", noticeHidden: true, hidden: false, oauthPhase: authorizing ? "authorizing" : "pending",
+    oauthAuthorizationUrl: url,
+    title: copy.title, titleHidden: !copy.title,
+    text: authorizing ? copy.pending : copy.body, textHidden: false,
+    primaryLabel: authorizing ? copy.done : disclose({ label: copy.authorize, url }),
+    primaryUrl: authorizing ? "" : url,
+    primaryHidden: !url, primaryDisabled: false, primaryEnabled: true,
+    primaryRespondText: authorizing ? `${copy.authorized}\n<HIDDEN>${OAUTH_AUTHORIZED_NOTE}</HIDDEN>` : "",
+    secondaryLabel: copy.decline, secondaryHidden: false, secondaryUrl: "",
+    secondaryRespondText: `${copy.declined}\n<HIDDEN>${OAUTH_DECLINED_NOTE}</HIDDEN>`,
+  };
+}

package/templates/yoga-studio-owner/tier5-src/_shared/aria-widget-view.ts

@@ -14,6 +14,7 @@
 
 import type { NormalizedWidget, WidgetKind, WidgetOption } from "./aria-widget-model.js";
 import { SELECTED_TOKEN, VALUES_TOKEN, isWebUrl, stripMarkdown } from "./aria-widget-model.js";
+import { oauthView } from "./aria-widget-oauth.js";
 import { composeGenericCard } from "./aria-generic-widget.js";
 import { normalizeWidget } from "./aria-widget-kinds.js";
 import { scanEnvelopes, widgetsOfParts } from "./aria-widgets.js";
@@ -127,6 +128,8 @@ export interface WidgetStep {
 /** The active widget, as the screen reads it. */
 export interface WidgetView {
   kind: WidgetCase;
+  oauthPhase?: "pending" | "authorizing";
+  oauthAuthorizationUrl?: string;
   /** Transcript row that owns this widget; prevents state carrying into a later
    *  identical-looking ask. */
   sourceMessageId?: string;
@@ -1021,6 +1024,9 @@ export function viewOf(
   // A questionnaire is shown one question at a time; its on-screen fields are
   // derived, never stored, so they start from the same function every later
   // change goes through. The worker re-derives with its own copy.
+  if (w.kind === "OAUTH_REQUIRED") {
+    return oauthView(view, typeof extra.authorizationUrl === "string" ? extra.authorizationUrl : "", disclose);
+  }
   return w.kind === "QUESTIONNAIRE"
     ? questionnaireSynced(view, 0, DEFAULT_QUESTIONNAIRE_COPY, false)
     : view;

package/templates/yoga-studio-owner/tier5-src/himi-owner-lite-aria/index.ts

@@ -248,6 +248,17 @@ const core = createAriaChat({
     // sentence around it is localized.
     mentionItemsFailed: (category: string) =>
       copyTemplate("ownerAria.mention.itemsFailed", "Couldn't load {category}.", { category }),
+    oauth: {
+      title: () => copyParam("ownerAria.oauth.title", "Connect an account"),
+      body: () => copyParam("ownerAria.oauth.body", "Authorize access to continue this task."),
+      pending: () => copyParam("ownerAria.oauth.pending", "Finish authorization in your browser, then return and choose Done."),
+      authorize: () => copyParam("ownerAria.oauth.authorize", "Authorize"),
+      decline: () => copyParam("ownerAria.oauth.decline", "Decline"),
+      done: () => copyParam("ownerAria.oauth.done", "Done"),
+      authorized: () => copyParam("ownerAria.oauth.authorized", "Authorized"),
+      declined: () => copyParam("ownerAria.oauth.declined", "Declined"),
+      openFailed: () => copyParam("ownerAria.oauth.openFailed", "Couldn't open authorization. Try again or decline."),
+    },
     widgetItemsFailed: () => copyParam("ownerAria.widget.itemsFailed", "Couldn't load these items."),
     widgetItemsUnavailable: () => copyParam("ownerAria.widget.itemsUnavailable", "Items aren't available here."),
     attachUploading: () => copyParam("ownerAria.attach.uploading", "Uploading…"),
@@ -432,7 +443,7 @@ const svc = defineService<AriaChatState, {
   // moved on must not commit its pre-await snapshot over the new one.
   copyMessage: (s: AriaChatState, arg?: AriaActionArg) => Promise<AriaChatState | undefined>;
   regenerate: (s: AriaChatState) => Promise<AriaChatState>;
-  widgetPrimary: (s: AriaChatState) => Promise<AriaChatState>;
+  widgetPrimary: (s: AriaChatState) => Promise<AriaChatState | undefined>;
   widgetSecondary: (s: AriaChatState) => Promise<AriaChatState>;
   widgetToggle: (s: AriaChatState, arg?: AriaActionArg) => AriaChatState;
   widgetSelectOne: (s: AriaChatState, arg?: AriaActionArg) => AriaChatState;