flujo-ai 3.34.0 → 3.35.0

package/.next/types/app/v1/chat/conversations/[conversationId]/resources/[resourceId]/content/route.ts

@@ -0,0 +1,347 @@
+// File: C:\Users\Moe\Documents\GitHub\FLUJO\src\app\v1\chat\conversations\[conversationId]\resources\[resourceId]\content\route.ts
+import * as entry from '../../../../../../../../../../src/app/v1/chat/conversations/[conversationId]/resources/[resourceId]/content/route.js'
+import type { NextRequest } from 'next/server.js'
+
+type TEntry = typeof import('../../../../../../../../../../src/app/v1/chat/conversations/[conversationId]/resources/[resourceId]/content/route.js')
+
+type SegmentParams<T extends Object = any> = T extends Record<string, any>
+  ? { [K in keyof T]: T[K] extends string ? string | string[] | undefined : never }
+  : T
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+type RouteContext = { params: Promise<SegmentParams> }
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: SegmentParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+export interface PageProps {
+  params?: Promise<SegmentParams>
+  searchParams?: Promise<any>
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: Promise<SegmentParams>
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/docs" | "/executions" | "/flows" | "/mcp" | "/models" | "/packages" | "/settings" | "/waves"
-type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/generator" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/scan-targets" | "/api/packages/search" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/feedback" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/packages" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/telemetry/daily-active" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/inject" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
+type AppRouteHandlerRoutes = "/api/approvals" | "/api/approvals/[id]" | "/api/backup" | "/api/browse" | "/api/bugs/enhance" | "/api/cwd" | "/api/encryption/secure" | "/api/env" | "/api/flow" | "/api/flow/[id]" | "/api/flow/[id]/versions" | "/api/flow/[id]/versions/[versionId]" | "/api/flow/compile" | "/api/flow/generate" | "/api/flow/generator" | "/api/flow/improve" | "/api/flow/prompt-renderer" | "/api/flow/quick-chat" | "/api/flow/repair" | "/api/git" | "/api/init" | "/api/local-models/capability" | "/api/local-models/pull" | "/api/local-models/suggest" | "/api/mcp-registry" | "/api/mcp-registry/spotlight" | "/api/mcp/app-sandbox" | "/api/mcp/cancel" | "/api/mcp/oauth-capability" | "/api/mcp/servers" | "/api/mcp/servers/[name]" | "/api/mcp/servers/[name]/prompts" | "/api/mcp/servers/[name]/prompts/get" | "/api/mcp/servers/[name]/resources" | "/api/mcp/servers/[name]/resources/read" | "/api/mcp/servers/[name]/status" | "/api/mcp/servers/[name]/tools" | "/api/mcp/servers/[name]/tools/[toolName]" | "/api/mcp/test-connection" | "/api/mcp/test-connection/stream" | "/api/model" | "/api/model/[id]" | "/api/model/provider" | "/api/model/test" | "/api/oauth/callback" | "/api/oauth/initiate" | "/api/oauth/reset" | "/api/packages/build" | "/api/packages/derive-secrets" | "/api/packages/install" | "/api/packages/install/status" | "/api/packages/installed" | "/api/packages/resolve" | "/api/packages/scan-targets" | "/api/packages/search" | "/api/packages/uninstall" | "/api/planned-executions" | "/api/planned-executions/[id]" | "/api/planned-executions/[id]/run" | "/api/planned-executions/[id]/runs" | "/api/planned-executions/preview-schedule" | "/api/planned-executions/reconcile" | "/api/registry/auth" | "/api/registry/auth/resend" | "/api/registry/auth/reset" | "/api/registry/feedback" | "/api/registry/oauth/callback" | "/api/registry/oauth/initiate" | "/api/registry/packages" | "/api/registry/publish" | "/api/registry/settings" | "/api/restore" | "/api/runs/active" | "/api/storage" | "/api/telemetry/daily-active" | "/api/update" | "/api/waves" | "/api/webhooks/[id]" | "/mcp-flows" | "/mcp-proxy/[server]" | "/v1/chat/completions" | "/v1/chat/conversations" | "/v1/chat/conversations/[conversationId]" | "/v1/chat/conversations/[conversationId]/breakpoints" | "/v1/chat/conversations/[conversationId]/cancel" | "/v1/chat/conversations/[conversationId]/debug/continue" | "/v1/chat/conversations/[conversationId]/debug/step" | "/v1/chat/conversations/[conversationId]/edit-state" | "/v1/chat/conversations/[conversationId]/events" | "/v1/chat/conversations/[conversationId]/inject" | "/v1/chat/conversations/[conversationId]/resources" | "/v1/chat/conversations/[conversationId]/resources/[resourceId]/content" | "/v1/chat/conversations/[conversationId]/respond" | "/v1/chat/events" | "/v1/models"
 type PageRoutes = never
 type LayoutRoutes = "/"
 type RedirectRoutes = never
@@ -111,6 +111,7 @@ interface ParamMap {
   "/v1/chat/conversations/[conversationId]/events": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/inject": { "conversationId": string; }
   "/v1/chat/conversations/[conversationId]/resources": { "conversationId": string; }
+  "/v1/chat/conversations/[conversationId]/resources/[resourceId]/content": { "conversationId": string; "resourceId": string; }
   "/v1/chat/conversations/[conversationId]/respond": { "conversationId": string; }
   "/v1/chat/events": {}
   "/v1/models": {}

package/.next/types/validator.ts

@@ -929,6 +929,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/v1/chat/conversations/[conversationId]/resources/[resourceId]/content/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/v1/chat/conversations/[conversationId]/resources/[resourceId]/content">> = Specific
+  const handler = {} as typeof import("../../src/app/v1/chat/conversations/[conversationId]/resources/[resourceId]/content/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/v1/chat/conversations/[conversationId]/resources/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/v1/chat/conversations/[conversationId]/resources">> = Specific

package/README.md

@@ -1,26 +1,25 @@
-<img width="720" height="405" alt="output" src="https://github.com/user-attachments/assets/87ff1b2c-fec2-4652-a049-98e5ee699e00" />
-
-### ▶ FLUJO in 60 seconds
-
-[![Watch: FLUJO in 60 seconds — animated short](githubpages/img/short-poster.jpeg)](https://mario-andreschak.github.io/FLUJO/githubpages/short.html)
-
-*Click to watch*
-
-## ⚡ Quick Install (recommended)
-
-The installer sets up everything FLUJO needs (Git, Node.js, Python, uv), clones FLUJO, builds it, and creates a global `flujo` command. This is the recommended way to run FLUJO — MCP servers get all their runtimes too.
-
-**Windows installer (recommended)** — click below to download the latest `flujo-setup.exe`:
-
-[![Download Setup.exe — Windows Installer](docs/images/readme/download-setup.png)](https://github.com/mario-andreschak/FLUJO/releases/latest/download/flujo-setup.exe)
-
-**Windows PowerShell** — alternatively, press Start, type powershell, press Enter, copy & paste the command below and press Enter again:
-
-```powershell
-irm https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.ps1 | iex
-```
-
-**Linux / macOS** — paste into a terminal:
+
+### ▶ FLUJO — Your AI. In Flow.
+
+[![Watch FLUJO — Your AI. In Flow.](githubpages/img/short-poster.png)](https://mario-andreschak.github.io/FLUJO/githubpages/short/)
+
+*Click to watch the 2:28 interactive product film*
+
+## ⚡ Quick Install (recommended)
+
+The installer sets up everything FLUJO needs (Git, Node.js, Python, uv), clones FLUJO, builds it, and creates a global `flujo` command. This is the recommended way to run FLUJO — MCP servers get all their runtimes too.
+
+**Windows installer (recommended)** — click below to download the latest `flujo-setup.exe`:
+
+[![Download Setup.exe — Windows Installer](docs/images/readme/download-setup.png)](https://github.com/mario-andreschak/FLUJO/releases/latest/download/flujo-setup.exe)
+
+**Windows PowerShell** — alternatively, press Start, type powershell, press Enter, copy & paste the command below and press Enter again:
+
+```powershell
+irm https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.ps1 | iex
+```
+
+**Linux / macOS** — paste into a terminal:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/mario-andreschak/FLUJO/main/scripts/install.sh | bash
@@ -46,17 +45,17 @@ For *anything* that you struggle with (MCP Installation, Application Issues, Usa
 # FLUJO
 
 [![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-3.34.0-green.svg)](package.json)
-
-FLUJO is an open-source, local-first platform for building **MCP-powered AI workflows**. It brings together model management, Model-Context-Protocol (MCP) servers, a visual flow builder, and a chat interface in one app — so you can wire models and tools together, run them headlessly on triggers, and expose the result to other apps, without giving up control of your keys and data.
-
-FLUJO shares one anonymous daily-active pulse by default. The payload is limited
-to the app version, platform, install method, UTC date, and a random identifier
-that changes every day; it contains no flows, prompts, models, keys, filenames,
-account details, or permanent installation identifier. A daily in-app notice
-discloses the check. Sharing and the notice can be controlled independently
-under **Settings → Privacy & Usage**. Set `FLUJO_TELEMETRY_URL` to point at a
-self-hosted compatible collector.
+[![Version](https://img.shields.io/badge/version-3.35.0-green.svg)](package.json)
+
+FLUJO is an open-source, local-first platform for building **MCP-powered AI workflows**. It brings together model management, Model-Context-Protocol (MCP) servers, a visual flow builder, and a chat interface in one app — so you can wire models and tools together, run them headlessly on triggers, and expose the result to other apps, without giving up control of your keys and data.
+
+FLUJO shares one anonymous daily-active pulse by default. The payload is limited
+to the app version, platform, install method, UTC date, and a random identifier
+that changes every day; it contains no flows, prompts, models, keys, filenames,
+account details, or permanent installation identifier. A daily in-app notice
+discloses the check. Sharing and the notice can be controlled independently
+under **Settings → Privacy & Usage**. Set `FLUJO_TELEMETRY_URL` to point at a
+self-hosted compatible collector.
 
 ![FLUJO Overview](docs/images/readme/home.png)
 
@@ -248,11 +247,11 @@ Then open http://localhost:4200.
   `docker-compose.yml`).
 - **Claude Subscription** in-container: generate a token on your host with
   `claude setup-token` and pass it as `CLAUDE_CODE_OAUTH_TOKEN`.
-- **fileWatch triggers**: bind-mount the host folder you want to watch into the
-  container (see the commented volume example in `docker-compose.yml`).
-- **MCP Apps**: Compose also publishes the isolated sandbox origin on
-  `http://localhost:4201`, loopback-only. Keep both `4200` and `4201` mappings
-  when using interactive MCP Apps.
+- **fileWatch triggers**: bind-mount the host folder you want to watch into the
+  container (see the commented volume example in `docker-compose.yml`).
+- **MCP Apps**: Compose also publishes the isolated sandbox origin on
+  `http://localhost:4201`, loopback-only. Keep both `4200` and `4201` mappings
+  when using interactive MCP Apps.
 
 > ⚠️ **Security:** FLUJO has no authentication layer and its git API runs
 > commands on the server, so the port is bound to **localhost only** by default.
@@ -286,28 +285,28 @@ checks:
 > ⚠️ **Security precondition:** only set this when **nothing untrusted can reach
 > FLUJO's port at those names**. The DNS-rebinding protection is still enforced
 > — an attacker page's Origin never matches these entries — but widening the
-> trusted-host set is only safe on a private network fronted by your own
-> authenticating proxy.
-
-#### MCP Apps behind HTTPS
-
-MCP Apps must run on a different origin from FLUJO. For a hosted HTTPS install,
-give the sandbox its own HTTPS origin (for example
-`https://flujo-apps.example.internal`) and have the trusted proxy TLS-terminate
-that origin to the container's plain HTTP port `4201`. Configure:
-
-```text
-FLUJO_MCP_APP_SANDBOX_PUBLIC_URL=https://flujo-apps.example.internal/sandbox.html
-FLUJO_MCP_APP_HOST_ORIGINS=https://flujo.example.internal
-```
-
-`FLUJO_MCP_APP_HOST_ORIGINS` is a comma-separated allowlist of exact
-`http(s)://host[:port]` origins permitted to embed the sandbox. Preserve the
-browser's `Referer` header through the proxy; the sandbox checks it against this
-allowlist and pins its `frame-ancestors` CSP to that exact origin. Do not serve
-the sandbox beneath FLUJO's own origin, and do not point the browser directly at
-port `4201` from an HTTPS page—the listener expects TLS termination at the
-separate proxy origin.
+> trusted-host set is only safe on a private network fronted by your own
+> authenticating proxy.
+
+#### MCP Apps behind HTTPS
+
+MCP Apps must run on a different origin from FLUJO. For a hosted HTTPS install,
+give the sandbox its own HTTPS origin (for example
+`https://flujo-apps.example.internal`) and have the trusted proxy TLS-terminate
+that origin to the container's plain HTTP port `4201`. Configure:
+
+```text
+FLUJO_MCP_APP_SANDBOX_PUBLIC_URL=https://flujo-apps.example.internal/sandbox.html
+FLUJO_MCP_APP_HOST_ORIGINS=https://flujo.example.internal
+```
+
+`FLUJO_MCP_APP_HOST_ORIGINS` is a comma-separated allowlist of exact
+`http(s)://host[:port]` origins permitted to embed the sandbox. Preserve the
+browser's `Referer` header through the proxy; the sandbox checks it against this
+allowlist and pins its `frame-ancestors` CSP to that exact origin. Do not serve
+the sandbox beneath FLUJO's own origin, and do not point the browser directly at
+port `4201` from an HTTPS page—the listener expects TLS termination at the
+separate proxy origin.
 
 ### Run via npx (npm package)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flujo-ai",
-  "version": "3.34.0",
+  "version": "3.35.0",
   "bin": {
     "flujo": "bin/flujo.mjs"
   },