npm - auramaxx - Versions diffs - 1.0.0-alpha.4 - Mend

auramaxx 1.0.0-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (363) hide show

package/LICENSE +26 -0
package/README.md +112 -0
package/bin/aurawallet.js +121 -0
package/docs/ADAPTERS.md +467 -0
package/docs/API.md +2679 -0
package/docs/APPS.md +198 -0
package/docs/ARCHITECTURE.md +350 -0
package/docs/AUTH.md +698 -0
package/docs/BEST-PRACTICES.md +121 -0
package/docs/CLI.md +61 -0
package/docs/DEVELOPING-APPS.md +452 -0
package/docs/EXTENSION.md +97 -0
package/docs/JOBS.md +33 -0
package/docs/MCP.md +76 -0
package/docs/PROTOCOL.md +142 -0
package/docs/SETUP.md +219 -0
package/docs/WORKSPACE.md +672 -0
package/docs/agent-auth.md +63 -0
package/docs/aura-file.md +48 -0
package/docs/credentials.md +53 -0
package/docs/external/getting-started.md +65 -0
package/docs/external/overview.md +45 -0
package/docs/external/use-cases.md +48 -0
package/docs/external/why-aura.md +35 -0
package/docs/jobs/connect-agent.md +77 -0
package/docs/jobs/migrate-from-dotenv.md +79 -0
package/docs/jobs/recover-from-lockout.md +72 -0
package/docs/jobs/secure-ci.md +63 -0
package/docs/oauth2.md +42 -0
package/docs/passkeys.md +60 -0
package/docs/security.md +540 -0
package/docs/specs/aura-open-protocol.md +61 -0
package/docs/specs/aura-provider-plugin.md +24 -0
package/docs/specs/aura-registry-model.md +31 -0
package/docs/specs/fixtures/invalid-bad-key.aura +1 -0
package/docs/specs/fixtures/invalid-bad-unicode-escape.aura +1 -0
package/docs/specs/fixtures/invalid-duplicate-key.aura +2 -0
package/docs/specs/fixtures/valid-basic.aura +4 -0
package/docs/specs/fixtures/valid-provider-ref.aura +1 -0
package/docs/specs/fixtures/valid-quoted-escapes.aura +2 -0
package/docs/templates/RELEASE_NOTES_TEMPLATE.md +22 -0
package/docs/totp.md +40 -0
package/docs/wallet/AI.md +508 -0
package/docs/wallet/DEVELOPING-STRATEGIES.md +713 -0
package/docs/wallet/README.md +47 -0
package/docs/wallet/STRATEGY.md +89 -0
package/next.config.ts +21 -0
package/package.json +151 -0
package/postcss.config.mjs +8 -0
package/prisma/migrations/20260214170000_baseline/migration.sql +511 -0
package/prisma/migrations/20260216214537_add_passkey_model/migration.sql +18 -0
package/prisma/migrations/20260217150500_add_credential_access_audit/migration.sql +31 -0
package/prisma/migrations/migration_lock.toml +3 -0
package/prisma/schema.prisma +447 -0
package/public/logo-chevron.svg +31 -0
package/public/logo-concentric.svg +31 -0
package/public/logo-crosshatch.svg +39 -0
package/public/logo-dashed.svg +39 -0
package/public/logo-horizontal.svg +31 -0
package/public/logo-m56.svg +64 -0
package/public/logo.webp +0 -0
package/scripts/add-app.js +245 -0
package/scripts/init.sh +57 -0
package/scripts/migrate-apikeys-to-credentials.ts +35 -0
package/scripts/sandbox-agent-flow.sh +235 -0
package/scripts/sandbox.sh +175 -0
package/scripts/validate-job-docs.mjs +125 -0
package/server/abi/SwapHelper.json +438 -0
package/server/cli/approval.ts +447 -0
package/server/cli/commands/app.ts +204 -0
package/server/cli/commands/cron.ts +24 -0
package/server/cli/commands/doctor.ts +1007 -0
package/server/cli/commands/env.ts +456 -0
package/server/cli/commands/init.ts +752 -0
package/server/cli/commands/mcp.ts +125 -0
package/server/cli/commands/restore.ts +314 -0
package/server/cli/commands/shell-hook.ts +468 -0
package/server/cli/commands/start.ts +62 -0
package/server/cli/commands/status.ts +59 -0
package/server/cli/commands/stop.ts +14 -0
package/server/cli/commands/token.ts +180 -0
package/server/cli/commands/unlock.ts +49 -0
package/server/cli/commands/vault.ts +417 -0
package/server/cli/index.ts +328 -0
package/server/cli/lib/aura-parser.ts +64 -0
package/server/cli/lib/credential-create.ts +74 -0
package/server/cli/lib/credential-resolve.ts +254 -0
package/server/cli/lib/dotenv-migrate.ts +116 -0
package/server/cli/lib/dotenv-parser.ts +146 -0
package/server/cli/lib/http.ts +91 -0
package/server/cli/lib/init-steps.ts +76 -0
package/server/cli/lib/local-agent-trust.ts +45 -0
package/server/cli/lib/process.ts +136 -0
package/server/cli/lib/prompt.ts +85 -0
package/server/cli/lib/theme.ts +240 -0
package/server/cli/socket.ts +570 -0
package/server/cli/transport-client.ts +50 -0
package/server/cron/index.ts +137 -0
package/server/cron/job.ts +31 -0
package/server/cron/jobs/balance-sync.ts +436 -0
package/server/cron/jobs/incoming-scan.ts +506 -0
package/server/cron/jobs/native-price.ts +70 -0
package/server/cron/jobs/orphan-cleanup.ts +40 -0
package/server/cron/jobs/strategy-runner.ts +175 -0
package/server/cron/scheduler.ts +125 -0
package/server/index.ts +406 -0
package/server/lib/adapters/factory.ts +110 -0
package/server/lib/adapters/index.ts +19 -0
package/server/lib/adapters/router.ts +297 -0
package/server/lib/adapters/telegram.ts +645 -0
package/server/lib/adapters/types.ts +89 -0
package/server/lib/adapters/webhook.ts +95 -0
package/server/lib/address.ts +49 -0
package/server/lib/agent-auth/contracts.ts +1194 -0
package/server/lib/agent-profiles.ts +328 -0
package/server/lib/ai.ts +285 -0
package/server/lib/api-registry/contracts.ts +86 -0
package/server/lib/api-registry/validation.ts +172 -0
package/server/lib/apikey-migration.ts +189 -0
package/server/lib/app-installer.ts +505 -0
package/server/lib/app-tokens.ts +247 -0
package/server/lib/auth.ts +314 -0
package/server/lib/batch.ts +242 -0
package/server/lib/cold.ts +874 -0
package/server/lib/config.ts +381 -0
package/server/lib/credential-access-audit.ts +85 -0
package/server/lib/credential-access-policy.ts +110 -0
package/server/lib/credential-health.ts +343 -0
package/server/lib/credential-import.ts +487 -0
package/server/lib/credential-scope.ts +87 -0
package/server/lib/credential-shares.ts +190 -0
package/server/lib/credential-transport.ts +342 -0
package/server/lib/credential-vault.ts +77 -0
package/server/lib/credentials.ts +333 -0
package/server/lib/crypto.ts +8 -0
package/server/lib/db.ts +15 -0
package/server/lib/defaults.ts +366 -0
package/server/lib/dex/index.ts +80 -0
package/server/lib/dex/relay.ts +235 -0
package/server/lib/dex/types.ts +59 -0
package/server/lib/dex/uniswap.ts +370 -0
package/server/lib/e2e-agent/artifacts.ts +36 -0
package/server/lib/e2e-agent/contracts.ts +112 -0
package/server/lib/e2e-agent/validation.ts +135 -0
package/server/lib/encrypt.ts +128 -0
package/server/lib/error.ts +20 -0
package/server/lib/events.ts +205 -0
package/server/lib/hot.ts +357 -0
package/server/lib/key-fingerprint.ts +28 -0
package/server/lib/logger.ts +331 -0
package/server/lib/network.ts +137 -0
package/server/lib/notifications.ts +219 -0
package/server/lib/oauth2-refresh.ts +241 -0
package/server/lib/oursecret.ts +54 -0
package/server/lib/passkey-credential.ts +360 -0
package/server/lib/passkey.ts +68 -0
package/server/lib/permissions.ts +248 -0
package/server/lib/pino.ts +24 -0
package/server/lib/policy-preview.ts +138 -0
package/server/lib/price.ts +338 -0
package/server/lib/prices.ts +34 -0
package/server/lib/project-scope.ts +239 -0
package/server/lib/resolve-action.ts +427 -0
package/server/lib/resolve.ts +36 -0
package/server/lib/sessions.ts +632 -0
package/server/lib/solana/connection.ts +26 -0
package/server/lib/solana/jupiter.ts +128 -0
package/server/lib/solana/transfer.ts +108 -0
package/server/lib/solana/wallet.ts +136 -0
package/server/lib/strategy/emits.ts +21 -0
package/server/lib/strategy/engine.ts +1305 -0
package/server/lib/strategy/executor.ts +115 -0
package/server/lib/strategy/hook-context.ts +158 -0
package/server/lib/strategy/hooks.ts +990 -0
package/server/lib/strategy/index.ts +28 -0
package/server/lib/strategy/installer.ts +305 -0
package/server/lib/strategy/loader.ts +256 -0
package/server/lib/strategy/message.ts +235 -0
package/server/lib/strategy/repository.ts +218 -0
package/server/lib/strategy/session-logger.ts +693 -0
package/server/lib/strategy/sources.ts +288 -0
package/server/lib/strategy/state.ts +189 -0
package/server/lib/strategy/templates.ts +403 -0
package/server/lib/strategy/tick.ts +404 -0
package/server/lib/strategy/types.ts +230 -0
package/server/lib/swap.ts +3 -0
package/server/lib/temp.ts +86 -0
package/server/lib/token-metadata.ts +86 -0
package/server/lib/token-safety.ts +200 -0
package/server/lib/token-search.ts +444 -0
package/server/lib/totp.ts +194 -0
package/server/lib/transactions.ts +123 -0
package/server/lib/transport.ts +75 -0
package/server/lib/txhistory/decoder.ts +262 -0
package/server/lib/txhistory/enricher.ts +652 -0
package/server/lib/txhistory/index.ts +391 -0
package/server/lib/txhistory/signatures.ts +59 -0
package/server/lib/verified-summary.ts +421 -0
package/server/mcp/profile-policy.ts +30 -0
package/server/mcp/server.ts +619 -0
package/server/mcp/tools.ts +523 -0
package/server/middleware/auth.ts +119 -0
package/server/middleware/requestLogger.ts +84 -0
package/server/routes/actions.ts +459 -0
package/server/routes/adapters.ts +703 -0
package/server/routes/addressbook.ts +113 -0
package/server/routes/ai.ts +34 -0
package/server/routes/apikeys.ts +295 -0
package/server/routes/apps.ts +601 -0
package/server/routes/auth.ts +457 -0
package/server/routes/backup.ts +340 -0
package/server/routes/batch.ts +270 -0
package/server/routes/bookmarks.ts +162 -0
package/server/routes/credential-shares.ts +198 -0
package/server/routes/credential-vaults.ts +154 -0
package/server/routes/credentials.ts +1290 -0
package/server/routes/dashboard.ts +71 -0
package/server/routes/defaults.ts +124 -0
package/server/routes/fund.ts +229 -0
package/server/routes/import.ts +352 -0
package/server/routes/launch.ts +665 -0
package/server/routes/lock.ts +54 -0
package/server/routes/logs.ts +68 -0
package/server/routes/nuke.ts +111 -0
package/server/routes/passkey-credentials.ts +99 -0
package/server/routes/passkey.ts +346 -0
package/server/routes/portfolio.ts +217 -0
package/server/routes/price.ts +63 -0
package/server/routes/resolve.ts +31 -0
package/server/routes/security.ts +45 -0
package/server/routes/send-evm.ts +241 -0
package/server/routes/send-solana.ts +281 -0
package/server/routes/send.ts +178 -0
package/server/routes/setup.ts +210 -0
package/server/routes/strategy.ts +894 -0
package/server/routes/swap-evm.ts +353 -0
package/server/routes/swap-solana.ts +177 -0
package/server/routes/swap.ts +356 -0
package/server/routes/token.ts +247 -0
package/server/routes/unlock.ts +403 -0
package/server/routes/wallet-assets.ts +361 -0
package/server/routes/wallet-transactions.ts +515 -0
package/server/routes/wallet.ts +710 -0
package/server/types.ts +146 -0
package/skills/aurawallet/SKILL.md +739 -0
package/skills/aurawallet-setup/SKILL.md +74 -0
package/skills/security-review/SKILL.md +148 -0
package/src/app/api/agent-requests/route.ts +30 -0
package/src/app/api/apps/install/route.ts +126 -0
package/src/app/api/apps/manifests/route.ts +16 -0
package/src/app/api/apps/static/[...path]/route.ts +57 -0
package/src/app/api/events/route.ts +92 -0
package/src/app/api/page.tsx +212 -0
package/src/app/api/workspace/[id]/apps/[wid]/route.ts +119 -0
package/src/app/api/workspace/[id]/apps/route.ts +81 -0
package/src/app/api/workspace/[id]/export/route.ts +67 -0
package/src/app/api/workspace/[id]/route.ts +168 -0
package/src/app/api/workspace/auth.ts +34 -0
package/src/app/api/workspace/config/route.ts +106 -0
package/src/app/api/workspace/import/route.ts +127 -0
package/src/app/api/workspace/route.ts +116 -0
package/src/app/app/page.tsx +2122 -0
package/src/app/apple-icon.png +0 -0
package/src/app/docs/page.tsx +178 -0
package/src/app/favicon.ico +0 -0
package/src/app/globals.css +572 -0
package/src/app/health/page.tsx +5 -0
package/src/app/hello/page.tsx +15 -0
package/src/app/icon.png +0 -0
package/src/app/layout.tsx +34 -0
package/src/app/page.tsx +986 -0
package/src/app/providers.tsx +90 -0
package/src/app/share/[token]/page.tsx +295 -0
package/src/components/ChainSelector.tsx +144 -0
package/src/components/HumanActionBar.tsx +695 -0
package/src/components/NotificationDrawer.tsx +129 -0
package/src/components/apps/AgentKeysApp.tsx +490 -0
package/src/components/apps/App.tsx +153 -0
package/src/components/apps/AppGrid.tsx +15 -0
package/src/components/apps/DetailedAddressDrawer.tsx +325 -0
package/src/components/apps/DraggableApp.tsx +562 -0
package/src/components/apps/IFrameApp.tsx +73 -0
package/src/components/apps/LogsApp.tsx +360 -0
package/src/components/apps/SendApp.tsx +394 -0
package/src/components/apps/SetupWizardApp.tsx +1004 -0
package/src/components/apps/SystemDefaultsApp.tsx +845 -0
package/src/components/apps/ThirdPartyApp.tsx +428 -0
package/src/components/apps/TokenApp.tsx +319 -0
package/src/components/apps/TransactionsApp.tsx +438 -0
package/src/components/apps/WalletDetailApp.tsx +1505 -0
package/src/components/apps/index.ts +13 -0
package/src/components/design-system/Button.tsx +53 -0
package/src/components/design-system/ChainIndicator.tsx +65 -0
package/src/components/design-system/ChainSelector.tsx +137 -0
package/src/components/design-system/ConfirmationModal.tsx +106 -0
package/src/components/design-system/ConfirmationPopover.tsx +81 -0
package/src/components/design-system/Drawer.tsx +123 -0
package/src/components/design-system/FilterDropdown.tsx +72 -0
package/src/components/design-system/Modal.tsx +206 -0
package/src/components/design-system/Popover.tsx +142 -0
package/src/components/design-system/TextInput.tsx +85 -0
package/src/components/design-system/Toggle.tsx +58 -0
package/src/components/design-system/index.ts +11 -0
package/src/components/docs/DocsThemeToggle.tsx +49 -0
package/src/components/health/CredentialHealthDashboard.tsx +214 -0
package/src/components/icons/ChainIcons.tsx +72 -0
package/src/components/layout/AppStoreDrawer.tsx +369 -0
package/src/components/layout/ContentArea.tsx +21 -0
package/src/components/layout/TabBar.tsx +278 -0
package/src/components/layout/WalletSidebar.tsx +1033 -0
package/src/components/layout/index.ts +4 -0
package/src/components/marketing/AuraWalletSpecOverlay.tsx +635 -0
package/src/components/marketing/DeviceMorphExperience.tsx +216 -0
package/src/components/vault/ApiKeysConsole.tsx +1080 -0
package/src/components/vault/AuditConsole.tsx +584 -0
package/src/components/vault/CredentialDetail.tsx +455 -0
package/src/components/vault/CredentialEmpty.tsx +55 -0
package/src/components/vault/CredentialField.tsx +361 -0
package/src/components/vault/CredentialForm.tsx +1212 -0
package/src/components/vault/CredentialList.tsx +165 -0
package/src/components/vault/CredentialRow.tsx +97 -0
package/src/components/vault/CredentialShareModal.tsx +178 -0
package/src/components/vault/CredentialVault.tsx +754 -0
package/src/components/vault/CredentialWalletWidget.tsx +103 -0
package/src/components/vault/ImportCredentialsModal.tsx +515 -0
package/src/components/vault/LargeTypeModal.tsx +64 -0
package/src/components/vault/PasswordGenerator.tsx +224 -0
package/src/components/vault/TOTPDisplay.tsx +123 -0
package/src/components/vault/VaultSidebar.tsx +413 -0
package/src/components/vault/types.ts +54 -0
package/src/context/AuthContext.tsx +337 -0
package/src/context/PriceContext.tsx +113 -0
package/src/context/ThemeContext.tsx +164 -0
package/src/context/WebSocketContext.tsx +269 -0
package/src/context/WorkspaceContext.tsx +668 -0
package/src/hooks/index.ts +3 -0
package/src/hooks/useAgentActions.ts +368 -0
package/src/hooks/useBalance.ts +103 -0
package/src/hooks/useBalances.ts +129 -0
package/src/instrumentation.ts +12 -0
package/src/lib/api.ts +449 -0
package/src/lib/app-loader.ts +148 -0
package/src/lib/app-registry.ts +178 -0
package/src/lib/app-sdk.ts +157 -0
package/src/lib/audit-console-adapter.ts +151 -0
package/src/lib/auth-client.ts +75 -0
package/src/lib/config.ts +74 -0
package/src/lib/crypto.ts +112 -0
package/src/lib/db.ts +21 -0
package/src/lib/docs.ts +390 -0
package/src/lib/events.ts +361 -0
package/src/lib/pino.ts +24 -0
package/src/lib/theme-handlers.ts +168 -0
package/src/lib/theme.ts +351 -0
package/src/lib/tokenData.ts +378 -0
package/src/lib/vault-crypto.ts +129 -0
package/src/lib/websocket-server.ts +302 -0
package/src/lib/websocket-setup.ts +79 -0
package/src/lib/wordlist.ts +2050 -0
package/src/lib/workspace-handlers.ts +285 -0
package/start.sh +80 -0
package/tailwind.config.ts +99 -0
package/tsconfig.json +42 -0

package/src/components/apps/ThirdPartyApp.tsx ADDED Viewed

@@ -0,0 +1,428 @@
+'use client';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+import { Box, Loader2 } from 'lucide-react';
+import { APP_SDK_SOURCE } from '@/lib/app-sdk';
+import { useAuth } from '@/context/AuthContext';
+import { useWebSocket } from '@/context/WebSocketContext';
+import { api, Api } from '@/lib/api';
+interface ThirdPartyAppProps {
+  config?: {
+    appPath?: string;
+    appName?: string;
+    _refreshKey?: number;
+  };
+}
+interface AppManifestSummary {
+  id: string;
+  name: string;
+  permissions: string[];
+}
+interface AppManifestsResponse {
+  success: boolean;
+  manifests?: AppManifestSummary[];
+}
+/**
+ * Collect CSS variables from the current document for theme injection.
+ */
+function collectCssVariables(): string {
+  const vars: string[] = [];
+  const computed = getComputedStyle(document.documentElement);
+  const varNames = [
+    '--color-background', '--color-background-alt', '--color-surface',
+    '--color-surface-alt', '--color-text', '--color-text-muted',
+    '--color-text-faint', '--color-border', '--color-border-muted',
+    '--color-border-focus', '--color-accent', '--color-info',
+    '--color-success', '--color-warning',
+  ];
+  for (const name of varNames) {
+    const value = computed.getPropertyValue(name).trim();
+    if (value) vars.push(`${name}: ${value};`);
+  }
+  return `:root { ${vars.join(' ')} }`;
+}
+/**
+ * Build a default HTML page for headless apps (no index.html).
+ */
+function buildDefaultHtml(appName: string): string {
+  const safeName = appName.replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  return `<body>
+  <div style="display:flex;flex-direction:column;align-items:center;justify-content:center;
+    height:100vh;font-family:ui-monospace,monospace;color:var(--color-text-muted,#6b7280);">
+    <div style="font-size:10px;letter-spacing:0.1em;text-transform:uppercase;">${safeName}</div>
+    <div style="font-size:8px;margin-top:4px;opacity:0.6;">HEADLESS APP — NO UI</div>
+  </div>
+</body>`;
+}
+/**
+ * Build self-contained sandboxed HTML by inlining the app's index.html content.
+ * The app HTML is fetched on the HOST side (React), then baked into a blob URL.
+ * This avoids fetch() inside the sandbox (which has no origin to resolve against).
+ *
+ * Injects __AURA_TOKEN__, __AURA_API_BASE__, __AURA_APP_ID__ globals
+ * so the SDK can make direct fetch() calls to the wallet API.
+ */
+function buildAppHtml(
+  appHtml: string,
+  themeStyles: string,
+  appId: string,
+  token: string | null,
+): string {
+  // Parse the app's HTML to extract styles, body, and scripts
+  const parser = new DOMParser();
+  const doc = parser.parseFromString(appHtml, 'text/html');
+  // Collect <style> tags from app
+  const appStyles: string[] = [];
+  doc.querySelectorAll('style').forEach(s => {
+    appStyles.push(s.textContent || '');
+  });
+  // Collect inline scripts (skip external src scripts — they can't load in sandbox)
+  const appScripts: string[] = [];
+  doc.querySelectorAll('script').forEach(s => {
+    if (!s.src && s.textContent) {
+      // Escape </script to prevent breaking out of our wrapper
+      appScripts.push(s.textContent.replace(/<\/script/gi, '<\\/script'));
+    }
+  });
+  // Remove script tags from body so they aren't included twice
+  // (once in bodyContent and once in appScripts)
+  doc.querySelectorAll('script').forEach(s => s.remove());
+  const bodyContent = doc.body.innerHTML;
+  // Escape token for safe embedding in script
+  const safeToken = token ? token.replace(/\\/g, '\\\\').replace(/"/g, '\\"') : '';
+  return `<!DOCTYPE html>
+<html>
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<style>${themeStyles}</style>
+<style>
+  * { margin: 0; padding: 0; box-sizing: border-box; }
+  body { font-family: ui-monospace, monospace; overflow: auto; background: var(--color-surface, #fff); color: var(--color-text, #0a0a0a); }
+</style>
+${appStyles.map(s => `<style>${s}</style>`).join('\n')}
+<script>
+window.__AURA_TOKEN__ = "${safeToken}";
+window.__AURA_API_BASE__ = "${api.getBaseUrl(Api.Wallet)}";
+window.__AURA_APP_ID__ = "${appId}";
+<\/script>
+<script>${APP_SDK_SOURCE}<\/script>
+</head>
+<body>
+${bodyContent}
+${appScripts.map(s => `<script>${s}<\/script>`).join('\n')}
+</body>
+</html>`;
+}
+export default function ThirdPartyApp({ config }: ThirdPartyAppProps) {
+  const appPath = config?.appPath;
+  const refreshKey = config?._refreshKey;
+  const iframeRef = useRef<HTMLIFrameElement>(null);
+  const [blobUrl, setBlobUrl] = useState<string | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [approvalRequired, setApprovalRequired] = useState(false);
+  const [approvalLoading, setApprovalLoading] = useState(false);
+  const [approvalError, setApprovalError] = useState<string | null>(null);
+  const [approvalDetailsLoading, setApprovalDetailsLoading] = useState(false);
+  const [approvalDetails, setApprovalDetails] = useState<AppManifestSummary | null>(null);
+  const [approvalRefreshKey, setApprovalRefreshKey] = useState(0);
+  const { token: authToken } = useAuth();
+  const { subscribe } = useWebSocket();
+  // Track active WS subscriptions so we can unsubscribe on unmount
+  const subscriptionsRef = useRef<Map<string, () => void>>(new Map());
+  // Helper: forward a WS event to the iframe as app:data postMessage
+  const forwardToIframe = useCallback((channel: string, data: unknown) => {
+    iframeRef.current?.contentWindow?.postMessage(
+      { type: 'app:data', channel, data },
+      '*',
+    );
+  }, []);
+  // Auto-subscribe to app:emit for this app's custom events
+  useEffect(() => {
+    if (!appPath) return;
+    const unsub = subscribe('app:emit' as any, (event: any) => {
+      const d = event.data;
+      if (d?.strategyId === appPath && d?.channel) {
+        forwardToIframe(d.channel, d.data);
+      }
+    });
+    return unsub;
+  }, [appPath, subscribe, forwardToIframe]);
+  // Backward compat: still forward strategy:tick as strategy:state postMessage
+  useEffect(() => {
+    if (!appPath) return;
+    return subscribe('strategy:tick' as any, (event: any) => {
+      const data = event.data;
+      if (data?.strategyId === appPath && data?.state) {
+        iframeRef.current?.contentWindow?.postMessage(
+          { type: 'strategy:state', state: data.state },
+          '*',
+        );
+      }
+    });
+  }, [appPath, subscribe]);
+  // Handle postMessage from the app iframe
+  const handleMessage = useCallback((event: MessageEvent) => {
+    const msg = event.data;
+    if (!msg || !msg.type) return;
+    // Only handle messages from our iframe
+    const iframe = iframeRef.current;
+    if (!iframe || event.source !== iframe.contentWindow) return;
+    // Process app:open-url — iframe wants to open a link in the parent context
+    if (msg.type === 'app:open-url' && typeof msg.url === 'string') {
+      window.open(msg.url, '_blank', 'noopener');
+      return;
+    }
+    // Process app:subscribe — iframe wants to receive a WS event channel
+    if (msg.type === 'app:subscribe' && typeof msg.channel === 'string') {
+      const channel: string = msg.channel;
+      // Skip if already subscribed to this channel
+      if (subscriptionsRef.current.has(channel)) return;
+      const unsub = subscribe(channel as any, (wsEvent: any) => {
+        forwardToIframe(channel, wsEvent.data);
+      });
+      subscriptionsRef.current.set(channel, unsub);
+    }
+  }, [subscribe, forwardToIframe]);
+  // Listen for postMessage from app iframe
+  useEffect(() => {
+    window.addEventListener('message', handleMessage);
+    return () => window.removeEventListener('message', handleMessage);
+  }, [handleMessage]);
+  // Cleanup all WS subscriptions on unmount
+  useEffect(() => {
+    const subs = subscriptionsRef.current;
+    return () => {
+      for (const unsub of subs.values()) {
+        unsub();
+      }
+      subs.clear();
+    };
+  }, []);
+  // Fetch app HTML and token on host side, build blob URL
+  useEffect(() => {
+    if (!appPath) return;
+    let revoked = false;
+    let url: string | null = null;
+    setLoading(true);
+    setError(null);
+    setApprovalRequired(false);
+    setApprovalError(null);
+    setApprovalDetailsLoading(false);
+    setApprovalDetails(null);
+    (async () => {
+      const loadApprovalDetails = async () => {
+        if (revoked) return;
+        setApprovalDetailsLoading(true);
+        try {
+          const manifestsRes = await fetch('/api/apps/manifests');
+          if (!manifestsRes.ok) return;
+          const manifestsData = await manifestsRes.json() as AppManifestsResponse;
+          if (!manifestsData.success || !Array.isArray(manifestsData.manifests)) return;
+          if (revoked) return;
+          const match = manifestsData.manifests.find((m) => m.id === appPath);
+          if (!match) return;
+          const permissions = Array.isArray(match.permissions)
+            ? match.permissions.filter((perm) => typeof perm === 'string')
+            : [];
+          setApprovalDetails({
+            id: match.id,
+            name: match.name || match.id,
+            permissions,
+          });
+        } catch {
+          // Keep approval card usable even if manifest metadata fails to load
+        } finally {
+          if (!revoked) setApprovalDetailsLoading(false);
+        }
+      };
+      try {
+        const htmlRes = await fetch(`/api/apps/static/${appPath}/index.html`);
+        const html = htmlRes.ok
+          ? await htmlRes.text()
+          : buildDefaultHtml(config?.appName || appPath);
+        let tokenRes: { success: boolean; token?: string };
+        try {
+          tokenRes = await api.get<{ success: boolean; token?: string }>(
+            Api.Wallet, `/apps/${appPath}/token`
+          );
+        } catch (err) {
+          const status = (err as Error & { status?: number }).status;
+          const message = err instanceof Error ? err.message : 'Failed to fetch app token';
+          if (status === 404 || message.includes('No token for app')) {
+            if (!revoked) {
+              setApprovalRequired(true);
+              setBlobUrl(null);
+              void loadApprovalDetails();
+            }
+            return;
+          }
+          throw err;
+        }
+        if (revoked) return;
+        const token = tokenRes.token ?? null;
+        if (!tokenRes.success || !token) {
+          setApprovalRequired(true);
+          setBlobUrl(null);
+          void loadApprovalDetails();
+          return;
+        }
+        const themeStyles = collectCssVariables();
+        const fullHtml = buildAppHtml(html, themeStyles, appPath, token);
+        const blob = new Blob([fullHtml], { type: 'text/html' });
+        url = URL.createObjectURL(blob);
+        setBlobUrl(url);
+      } catch (err) {
+        if (!revoked) {
+          setBlobUrl(null);
+          setError(err instanceof Error ? err.message : 'Failed to load app');
+        }
+      } finally {
+        if (!revoked) setLoading(false);
+      }
+    })();
+    return () => {
+      revoked = true;
+      if (url) URL.revokeObjectURL(url);
+    };
+  }, [appPath, refreshKey, authToken, approvalRefreshKey]);
+  const handleApprove = useCallback(async () => {
+    if (!appPath) return;
+    setApprovalLoading(true);
+    setApprovalError(null);
+    try {
+      await api.post<{ success: boolean; error?: string }>(Api.Wallet, `/apps/${appPath}/approve`);
+      setApprovalRequired(false);
+      setApprovalRefreshKey((k) => k + 1);
+    } catch (err) {
+      setApprovalError(err instanceof Error ? err.message : 'Failed to approve app');
+    } finally {
+      setApprovalLoading(false);
+    }
+  }, [appPath]);
+  if (!appPath) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full min-h-[100px] text-[var(--color-text-muted,#6b7280)]">
+        <Box size={24} className="mb-2" />
+        <span className="font-mono text-xs">NO APP CONFIGURED</span>
+        <span className="font-mono text-[9px] text-[var(--color-text-faint,#9ca3af)] mt-1">
+          Set config.appPath to load a app
+        </span>
+      </div>
+    );
+  }
+  if (loading) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full min-h-[100px]">
+        <Loader2 size={20} className="animate-spin text-[var(--color-text-faint,#9ca3af)] mb-2" />
+        <span className="font-mono text-[9px] text-[var(--color-text-muted,#6b7280)]">LOADING APP...</span>
+      </div>
+    );
+  }
+  if (approvalRequired) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full min-h-[100px] p-4">
+        <Box size={20} className="mb-2 text-[var(--color-text-muted,#6b7280)]" />
+        <span className="font-mono text-[9px] text-[var(--color-text,#0a0a0a)]">APP APPROVAL REQUIRED</span>
+        <span className="font-mono text-[8px] text-[var(--color-text-muted,#6b7280)] mt-1 text-center">
+          This app needs approval before it can run.
+        </span>
+        <div className="w-full max-w-[280px] mt-3 px-2 py-2 border border-[var(--color-border,#d4d4d8)] bg-[var(--color-background-alt,#f4f4f5)]">
+          <div className="font-mono text-[8px] text-[var(--color-text-muted,#6b7280)]">REQUESTED PERMISSIONS</div>
+          {approvalDetailsLoading ? (
+            <div className="flex items-center gap-1 mt-1">
+              <Loader2 size={10} className="animate-spin text-[var(--color-text-faint,#9ca3af)]" />
+              <span className="font-mono text-[8px] text-[var(--color-text-muted,#6b7280)]">Loading details...</span>
+            </div>
+          ) : approvalDetails?.permissions.length ? (
+            <div className="mt-1 flex flex-wrap gap-1">
+              {approvalDetails.permissions.map((permission) => (
+                <span
+                  key={permission}
+                  className="px-1.5 py-0.5 border border-[var(--color-border,#d4d4d8)] font-mono text-[8px] text-[var(--color-text,#0a0a0a)]"
+                >
+                  {permission}
+                </span>
+              ))}
+            </div>
+          ) : (
+            <span className="font-mono text-[8px] text-[var(--color-text-muted,#6b7280)]">No explicit permissions listed.</span>
+          )}
+        </div>
+        <button
+          onClick={() => void handleApprove()}
+          disabled={approvalLoading}
+          className="mt-3 px-3 py-2 border border-[var(--color-border,#d4d4d8)] bg-[var(--color-surface,#ffffff)] font-mono text-[9px] tracking-widest text-[var(--color-text,#0a0a0a)] hover:border-[var(--color-border-focus,#0a0a0a)] disabled:opacity-50 disabled:cursor-default"
+        >
+          {approvalLoading ? 'APPROVING...' : 'APPROVE'}
+        </button>
+        {approvalError && (
+          <span className="font-mono text-[8px] text-[var(--color-warning,#ff4d00)] mt-2 text-center">{approvalError}</span>
+        )}
+      </div>
+    );
+  }
+  if (error) {
+    return (
+      <div className="flex flex-col items-center justify-center h-full min-h-[100px] p-4">
+        <Box size={20} className="mb-2 text-[var(--color-warning,#ff4d00)]" />
+        <span className="font-mono text-[9px] text-[var(--color-warning,#ff4d00)]">FAILED TO LOAD APP</span>
+        <span className="font-mono text-[8px] text-[var(--color-text-muted,#6b7280)] mt-1 text-center">{error}</span>
+      </div>
+    );
+  }
+  if (!blobUrl) return null;
+  return (
+    <div className="relative h-full min-h-[100px]">
+      {/* SECURITY: sandbox without allow-same-origin. allow-popups-outside-sandbox
+          ensures links opened in new tabs are NOT sandboxed (so X.com etc. work). */}
+      <iframe
+        ref={iframeRef}
+        src={blobUrl}
+        sandbox="allow-scripts allow-popups allow-popups-outside-sandbox"
+        title={config?.appName || appPath}
+        className="w-full h-full border-0"
+        style={{ minHeight: '100px' }}
+      />
+    </div>
+  );
+}