gloomberb 0.16.3 → 0.16.4

package/src/plugins/builtin/cloud/mcp-connect/dialog.tsx

@@ -0,0 +1,360 @@
+/**
+ * "Connect an AI assistant": pick an MCP client, copy the one command or
+ * config it needs. Signing in from the client needs no key; a key is the
+ * fallback, created here through the account API and shown once.
+ *
+ * The command bar runs outside the React tree, so `requestMcpConnectDialog`
+ * hands the request to `McpConnectDialogHost`, which the shell mounts for the
+ * life of the app, like the sign-in dialogs. Surfaces that already hold the
+ * dialog API (the account pane) call `openMcpConnectDialog` directly.
+ *
+ * The created key lives in this dialog's state only: it is never logged,
+ * stored or synced, and it is gone once the dialog closes.
+ */
+import { useCallback, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import { apiClient } from "../../../../api-client";
+import { usePlanAccess } from "../../../../api-client/plan-access";
+import { Button } from "../../../../components/ui/button";
+import { Divider } from "../../../../components/ui/display";
+import { ExternalLinkText } from "../../../../components/ui/external-link";
+import { DialogFrame } from "../../../../components/ui/frame";
+import { SegmentedControl } from "../../../../components/ui/toggle";
+import { t, tf } from "../../../../i18n";
+import { useAppLanguage } from "../../../../i18n/react";
+import { useViewport } from "../../../../react/input";
+import { useThemeColors } from "../../../../theme/theme-context";
+import { Box, Text, TextAttributes, useRendererHost, useUiCapabilities } from "../../../../ui";
+import { useDialog, useDialogKeyboard, type DialogApi, type PromptContext } from "../../../../ui/dialog";
+import { isPlainKey } from "../../../../utils/keyboard";
+import { useCloudUpgradeAction } from "../../shared/cloud-upgrade";
+import { requestAuthDialog } from "../auth-dialog";
+import {
+  currentMcpEndpointUrl,
+  MCP_CLIENTS,
+  MCP_DOCS_URL,
+  mcpClientSetup,
+  mcpKeyFailure,
+  type McpClientId,
+  type McpKeyFailure,
+} from "./model";
+import { useMcpConnectSections } from "./sections";
+
+/** Wide enough for a key and its closing quote on one snippet row. */
+const MAX_CONTENT_WIDTH = 78;
+const MIN_CONTENT_WIDTH = 32;
+/** Border plus padding the terminal dialog host draws around the content. */
+const TERMINAL_DIALOG_CHROME = 6;
+/** The access a key made here gets: the server's default, as in Cloud settings. */
+const KEY_SCOPE = "read";
+
+/** Content width for a viewport: as wide as a command line reads well, never wider than the screen. */
+function mcpConnectContentWidth(viewportWidth: number | undefined): number {
+  const available = (viewportWidth ?? MAX_CONTENT_WIDTH + 10) - 10;
+  return Math.max(MIN_CONTENT_WIDTH, Math.min(MAX_CONTENT_WIDTH, Math.floor(available)));
+}
+
+type KeyState =
+  | { phase: "idle" }
+  | { phase: "creating" }
+  | { phase: "created"; token: string; name: string }
+  | { phase: "failed"; failure: McpKeyFailure };
+
+type Status = { tone: "positive" | "warning" | "negative" | "muted"; text: string } | null;
+
+function useCloudSignedIn(): boolean {
+  return useSyncExternalStore(
+    (onChange) => apiClient.subscribeCurrentUser(onChange),
+    () => apiClient.isSignedIn(),
+    () => apiClient.isSignedIn(),
+  );
+}
+
+function statusColor(tone: NonNullable<Status>["tone"], colors: ReturnType<typeof useThemeColors>): string {
+  if (tone === "muted") return colors.textDim;
+  return colors[tone];
+}
+
+/**
+ * The snippet, one row per line. A line with the key in it runs past the
+ * block, and breaking it at its spaces strands a word per row, so it wraps at
+ * the edge, as a shell prints it; every other line wraps at its spaces.
+ */
+function SnippetBlock({ text, secret, width }: { text: string; secret: string | null; width: number }) {
+  const colors = useThemeColors();
+  const { nativePaneChrome } = useUiCapabilities();
+  return (
+    <Box
+      flexDirection="column"
+      width={width}
+      paddingX={1}
+      backgroundColor={nativePaneChrome ? colors.bg : colors.panel}
+      style={nativePaneChrome ? { padding: "8px 10px", borderRadius: 4 } : undefined}
+      data-gloom-role="mcp-connect-snippet"
+    >
+      {text.split("\n").map((line, index) => {
+        const atEdge = !!secret && line.includes(secret);
+        return (
+          <Text
+            key={index}
+            fg={colors.textBright}
+            wrapText
+            wrapMode={atEdge ? "char" : "word"}
+            style={nativePaneChrome && atEdge ? { wordBreak: "break-all" } : undefined}
+          >
+            {line || " "}
+          </Text>
+        );
+      })}
+    </Box>
+  );
+}
+
+function McpConnectDialog({
+  dialogId,
+  dismiss,
+  width: openedWidth,
+}: PromptContext<void> & { width: number }) {
+  useAppLanguage();
+  // Follows a window or terminal resized while the dialog is open. The
+  // terminal's box keeps the width it opened with, so the content never
+  // grows past it there; the desktop sizes the box to the content.
+  const viewport = useViewport();
+  const { nativePaneChrome } = useUiCapabilities();
+  const fit = mcpConnectContentWidth(viewport.width);
+  const width = nativePaneChrome ? fit : Math.min(openedWidth, fit);
+  const colors = useThemeColors();
+  const renderer = useRendererHost();
+  const access = usePlanAccess();
+  const signedIn = useCloudSignedIn();
+  const openUpgrade = useCloudUpgradeAction("mcp-connect");
+  const sections = useMcpConnectSections();
+  const endpoint = useMemo(() => currentMcpEndpointUrl(), []);
+  const [client, setClient] = useState<McpClientId>("claude-code");
+  const [key, setKey] = useState<KeyState>({ phase: "idle" });
+  const [copyStatus, setCopyStatus] = useState<Status>(null);
+  const [keyStatus, setKeyStatus] = useState<Status>(null);
+  const creatingRef = useRef(false);
+  const liveRef = useRef(true);
+  useEffect(() => () => {
+    liveRef.current = false;
+  }, []);
+  // A sign-in or an upgrade made from this dialog changes the session; a
+  // failure from before it no longer says anything.
+  useEffect(() => apiClient.subscribeCurrentUser(() => {
+    setKey((current) => (current.phase === "failed" ? { phase: "idle" } : current));
+  }), []);
+
+  const token = key.phase === "created" ? key.token : null;
+  const clientDef = MCP_CLIENTS.find((entry) => entry.id === client) ?? MCP_CLIENTS[0]!;
+  const setup = mcpClientSetup(client, endpoint, token);
+
+  const selectClient = useCallback((next: string) => {
+    if (!MCP_CLIENTS.some((entry) => entry.id === next)) return;
+    setClient(next as McpClientId);
+    setCopyStatus(null);
+  }, []);
+
+  const copy = useCallback(async (text: string, done: string, report: (status: Status) => void) => {
+    try {
+      await renderer.copyText(text);
+      report({ tone: "positive", text: done });
+    } catch {
+      report({ tone: "warning", text: t("Copy failed. Select the text above.") });
+    }
+  }, [renderer]);
+
+  const copySetup = useCallback(() => copy(setup.text, t("Copied."), setCopyStatus), [copy, setup.text]);
+
+  const createKey = useCallback(async () => {
+    if (creatingRef.current || token) return;
+    creatingRef.current = true;
+    setKey({ phase: "creating" });
+    setKeyStatus(null);
+    try {
+      const created = await apiClient.createMcpKey({ name: clientDef.keyName, scope: KEY_SCOPE });
+      if (!liveRef.current) return;
+      setKey({ phase: "created", token: created.token, name: created.apiKey.name || clientDef.keyName });
+      setCopyStatus(null);
+    } catch (error) {
+      if (liveRef.current) setKey({ phase: "failed", failure: mcpKeyFailure(error) });
+    } finally {
+      creatingRef.current = false;
+    }
+  }, [clientDef.keyName, token]);
+
+  const signIn = useCallback(() => {
+    // Stacks over this dialog; the key row follows the session once it lands.
+    if (!requestAuthDialog({ mode: "login" })) {
+      setKeyStatus({ tone: "warning", text: t("Sign-in is not available right now.") });
+    }
+  }, []);
+
+  const failure = key.phase === "failed" ? key.failure : null;
+  // `hint` is the footer's word for the same action.
+  const keyAction = ((): { label: string; hint: string; run: () => void; disabled?: boolean } => {
+    if (token) return { label: t("Copy key"), hint: t("copy key"), run: () => { void copy(token, t("Key copied."), setKeyStatus); } };
+    if (!signedIn || failure?.kind === "signin") return { label: t("Sign in to Gloom Cloud"), hint: t("sign in"), run: signIn };
+    if (!access.hasProAccess || failure?.kind === "pro") {
+      return { label: t("Upgrade to Pro"), hint: t("upgrade"), run: () => { void openUpgrade(); } };
+    }
+    if (key.phase === "creating") return { label: t("Creating..."), hint: t("create a key"), run: () => {}, disabled: true };
+    return { label: t("Create a key"), hint: t("create a key"), run: () => { void createKey(); } };
+  })();
+
+  // What the key row says beside its button: the plan the key needs, or why
+  // the last attempt failed. Signed out, the button says it all.
+  const keyNote: Status = (() => {
+    if (token || failure?.kind === "signin") return null;
+    if (failure?.kind === "offline") return { tone: "muted", text: t(failure.message) };
+    if (failure?.kind === "refused") return { tone: "warning", text: t(failure.message) };
+    if (signedIn && (!access.hasProAccess || failure?.kind === "pro")) {
+      return { tone: "muted", text: t("The MCP server is part of Gloom Pro.") };
+    }
+    return null;
+  })();
+
+  useDialogKeyboard((event) => {
+    if (isPlainKey(event, "c", "enter", "return")) {
+      event.preventDefault?.();
+      event.stopPropagation?.();
+      void copySetup();
+      return;
+    }
+    if (isPlainKey(event, "k")) {
+      event.preventDefault?.();
+      event.stopPropagation?.();
+      if (!keyAction.disabled) keyAction.run();
+      return;
+    }
+    if (isPlainKey(event, "d")) {
+      event.preventDefault?.();
+      event.stopPropagation?.();
+      void renderer.openExternal(MCP_DOCS_URL).catch(() => {});
+      return;
+    }
+    if (event.name === "escape") {
+      event.stopPropagation?.();
+      dismiss();
+    }
+  }, { scope: dialogId });
+
+  const footer = tf("c copy · ←/→ client · k {action} · d docs · Esc close", { action: keyAction.hint });
+  const narrow = width < 46;
+
+  return (
+    <DialogFrame
+      title={t("Connect an AI assistant")}
+      subtitle={t("Gloom's research tools in Claude Code, Codex, Cursor or any MCP client.")}
+      // Too narrow for the key line, which is a keyboard's business anyway (a phone).
+      footer={narrow ? undefined : footer}
+      onClose={dismiss}
+    >
+      <Box flexDirection="column" width={width} gap={1}>
+        {/* A row, so the desktop control is as wide as its options rather than the dialog. */}
+        <Box flexDirection="row">
+          <SegmentedControl
+            options={MCP_CLIENTS.map((entry) => ({ label: t(entry.label), value: entry.id }))}
+            value={client}
+            onChange={selectClient}
+            focused
+            shortcutScope={dialogId}
+            wrap={narrow}
+          />
+        </Box>
+
+        <Box flexDirection="column">
+          <Text fg={colors.textDim} wrapText>{t(setup.hint)}</Text>
+          <Box height={1} />
+          <SnippetBlock text={setup.text} secret={token} width={width} />
+          <Box height={1} />
+          <Box flexDirection="row" gap={2} alignItems="center">
+            <Button label={t("Copy")} shortcut="c" variant="primary" onPress={() => { void copySetup(); }} />
+            {copyStatus ? <Text fg={statusColor(copyStatus.tone, colors)}>{copyStatus.text}</Text> : null}
+          </Box>
+        </Box>
+
+        <Box flexDirection="column" data-gloom-role="mcp-connect-key">
+          {/* The terminal separates the two paths with a blank row; the desktop draws a rule. */}
+          {nativePaneChrome ? <Divider width={width} /> : null}
+          {key.phase === "created" ? (
+            <Text fg={colors.warning} attributes={TextAttributes.BOLD} wrapText>
+              {tf("Key for {name} created. It is filled in above and is shown only once.", { name: key.name })}
+            </Text>
+          ) : (
+            <Text fg={colors.textDim}>{t("Use a key instead")}</Text>
+          )}
+          <Box flexDirection="row" gap={2} alignItems="center" flexWrap="wrap">
+            <Button
+              label={keyAction.label}
+              shortcut="k"
+              disabled={keyAction.disabled}
+              onPress={keyAction.run}
+            />
+            {keyStatus ?? keyNote ? (
+              <Text fg={statusColor((keyStatus ?? keyNote)!.tone, colors)} wrapText>{(keyStatus ?? keyNote)!.text}</Text>
+            ) : null}
+          </Box>
+        </Box>
+
+        {sections.map((section) => (
+          <Box key={section.id} flexDirection="column">
+            {nativePaneChrome ? <Divider width={width} /> : null}
+            <section.Component width={width} dialogId={dialogId} dismiss={dismiss} />
+          </Box>
+        ))}
+
+        <Box flexDirection="row" gap={1}>
+          <Text fg={colors.textDim}>{t("Tools and access levels:")}</Text>
+          <ExternalLinkText url={MCP_DOCS_URL} label="gloom.sh/docs/mcp" />
+        </Box>
+      </Box>
+    </DialogFrame>
+  );
+}
+
+/** Opens the dialog and settles once it closes. */
+export function openMcpConnectDialog(dialog: DialogApi, options: { viewportWidth?: number } = {}): Promise<void> {
+  const width = mcpConnectContentWidth(options.viewportWidth);
+  return dialog
+    .prompt<void>({
+      // A click beside it must not throw away a key that is shown once.
+      closeOnClickOutside: false,
+      // The terminal host defaults to 60 columns; the desktop sizes to the content.
+      style: { width: width + TERMINAL_DIALOG_CHROME },
+      content: (context) => <McpConnectDialog {...context} width={width} />,
+    })
+    .then(() => {}, () => {});
+}
+
+const dialogRequestListeners = new Set<() => void>();
+
+/** Returns false when no dialog host is mounted, so callers can fall back. */
+export function requestMcpConnectDialog(): boolean {
+  if (dialogRequestListeners.size === 0) return false;
+  for (const listener of dialogRequestListeners) listener();
+  return true;
+}
+
+export function McpConnectDialogHost() {
+  const dialog = useDialog();
+  const viewport = useViewport();
+  const viewportWidthRef = useRef(viewport.width);
+  viewportWidthRef.current = viewport.width;
+  const openRef = useRef(false);
+
+  useEffect(() => {
+    const listener = () => {
+      if (openRef.current) return;
+      openRef.current = true;
+      void openMcpConnectDialog(dialog, { viewportWidth: viewportWidthRef.current }).finally(() => {
+        openRef.current = false;
+      });
+    };
+    dialogRequestListeners.add(listener);
+    return () => {
+      dialogRequestListeners.delete(listener);
+    };
+  }, [dialog]);
+
+  return null;
+}

package/src/plugins/builtin/cloud/mcp-connect/model.ts

@@ -0,0 +1,135 @@
+/**
+ * What the "Connect an AI assistant" dialog shows for each MCP client: the
+ * endpoint this build talks to, and the one command or config snippet the
+ * client needs. The commands are the ones gloom.sh/docs/mcp gives; change them
+ * there first.
+ */
+import { ApiRequestError } from "../../../../api-client/errors";
+import { DEFAULT_API_URL, getCloudApiBaseUrl } from "../../../../api-client/request";
+
+const MCP_ENDPOINT_PATH = "/mcp";
+/** What a snippet shows until a key is created; the docs use the same stand-in. */
+const MCP_KEY_PLACEHOLDER = "gloom_mcp_...";
+export const MCP_DOCS_URL = "https://gloom.sh/docs/mcp";
+
+export type McpClientId = "claude-code" | "codex" | "json" | "other";
+
+export interface McpClient {
+  id: McpClientId;
+  label: string;
+  /** The key's name in Cloud settings, so it can be told apart and revoked later. */
+  keyName: string;
+}
+
+export const MCP_CLIENTS: readonly McpClient[] = [
+  { id: "claude-code", label: "Claude Code", keyName: "Claude Code" },
+  { id: "codex", label: "Codex", keyName: "Codex" },
+  { id: "json", label: "Cursor / JSON", keyName: "Cursor" },
+  { id: "other", label: "Other", keyName: "MCP client" },
+];
+
+/**
+ * The MCP endpoint next to the API this build is configured for, so a dev or
+ * staging build shows its own server. The web app reaches the API through its
+ * own `/api` path, which only forwards to the public API and which an MCP
+ * client outside the browser cannot use, so it gets the public endpoint.
+ */
+export function mcpEndpointUrl(apiBaseUrl: string, pageOrigin: string | null): string {
+  const base = apiBaseUrl.trim().replace(/\/+$/, "");
+  if (pageOrigin && base === `${pageOrigin}/api`) return `${DEFAULT_API_URL}${MCP_ENDPOINT_PATH}`;
+  return `${base}${MCP_ENDPOINT_PATH}`;
+}
+
+export function currentMcpEndpointUrl(): string {
+  const origin = typeof location !== "undefined" && typeof location.origin === "string" ? location.origin : null;
+  return mcpEndpointUrl(getCloudApiBaseUrl(), origin);
+}
+
+export interface McpKeyFailure {
+  /**
+   * `pro`: the account needs Pro. `signin`: the session is gone. `refused`: the
+   * server said no and why (the key limit). `offline`: no answer from the server.
+   */
+  kind: "pro" | "signin" | "offline" | "refused";
+  message: string;
+}
+
+/**
+ * Why creating a key failed, in one calm line. A refusal the server explains
+ * (the key limit) keeps the server's words; anything without an answer from
+ * the server reads as unreachable.
+ */
+export function mcpKeyFailure(error: unknown): McpKeyFailure {
+  if (error instanceof ApiRequestError && error.status !== undefined) {
+    if (error.status === 402) return { kind: "pro", message: "The MCP server is part of Gloom Pro." };
+    if (error.status === 401) return { kind: "signin", message: "Sign in to Gloom Cloud again." };
+    if (error.status === 429) return { kind: "refused", message: "Too many requests. Try again in a moment." };
+    if (error.status >= 400 && error.status < 500 && error.status !== 408 && error.status !== 429 && error.message.trim()) {
+      return { kind: "refused", message: error.message.trim() };
+    }
+  }
+  return { kind: "offline", message: "Gloom Cloud can't be reached right now. Try again in a moment." };
+}
+
+export interface McpClientSetup {
+  /** What Copy puts on the clipboard, exactly as shown. */
+  text: string;
+  /** One line on where it goes. */
+  hint: string;
+  /** The client connects only with a key, and none was created yet. */
+  needsKey: boolean;
+}
+
+/**
+ * The snippet for one client. Without a key, clients that sign in through the
+ * browser (Claude Code, Cursor and most recent clients) only need the
+ * endpoint; Codex takes a bearer token from an environment variable, so it
+ * shows the docs' placeholder until a key exists.
+ */
+export function mcpClientSetup(client: McpClientId, endpoint: string, key: string | null): McpClientSetup {
+  const token = key ?? MCP_KEY_PLACEHOLDER;
+  switch (client) {
+    case "claude-code":
+      return key
+        ? {
+          text: `claude mcp add --transport http gloom ${endpoint} \\\n  --header "Authorization: Bearer ${key}"`,
+          hint: "Run it in a terminal.",
+          needsKey: false,
+        }
+        : {
+          text: `claude mcp add --transport http gloom ${endpoint}`,
+          hint: "Run it in a terminal. Claude Code signs in through your browser.",
+          needsKey: false,
+        };
+    case "codex":
+      return {
+        text: `export GLOOM_MCP_KEY=${token}\ncodex mcp add gloom --url ${endpoint} \\\n  --bearer-token-env-var GLOOM_MCP_KEY`,
+        hint: key ? "Run it in a terminal." : "Codex connects with a key. Create one below.",
+        needsKey: !key,
+      };
+    case "json": {
+      const server = key
+        ? `{\n      "url": ${JSON.stringify(endpoint)},\n      "headers": { "Authorization": ${JSON.stringify(`Bearer ${key}`)} }\n    }`
+        : `{ "url": ${JSON.stringify(endpoint)} }`;
+      return {
+        text: `{\n  "mcpServers": {\n    "gloom": ${server}\n  }\n}`,
+        hint: key
+          ? "Add it to the client's MCP config."
+          : "Add it to the client's MCP config. The client signs in on first use.",
+        needsKey: false,
+      };
+    }
+    case "other":
+      return key
+        ? {
+          text: `${endpoint}\nAuthorization: Bearer ${token}`,
+          hint: "The endpoint, and the header that sends the key.",
+          needsKey: false,
+        }
+        : {
+          text: endpoint,
+          hint: "The endpoint. Clients sign in on first use, or send a key as a bearer token.",
+          needsKey: false,
+        };
+  }
+}

package/src/plugins/builtin/cloud/mcp-connect/sections.ts

@@ -0,0 +1,62 @@
+/**
+ * EXTENSION POINT for the "Connect an AI assistant" dialog.
+ *
+ * The dialog sets up a client. Anything that reports on clients already
+ * connected registers a section here and the dialog renders it under the key
+ * row, in `order`, separated by a divider. The terminal control work ("Allow
+ * it to control this terminal": which assistants are connected or approved,
+ * and revoking one) plugs in here rather than growing the dialog itself.
+ *
+ * A section renders inside the dialog, so it gets the content width and the
+ * dialog's keyboard scope; keys it binds must not clash with the dialog's own
+ * (`c`, `k`, Left/Right, Enter, Esc).
+ */
+import { useSyncExternalStore, type ComponentType } from "react";
+
+export interface McpConnectSectionProps {
+  /** Content width in cells. */
+  width: number;
+  /** The dialog's keyboard scope, for `useDialogKeyboard`. */
+  dialogId?: string;
+  /** Closes the dialog, for a section that sends the person somewhere else. */
+  dismiss?: () => void;
+}
+
+export interface McpConnectSection {
+  id: string;
+  /** Lower first. */
+  order?: number;
+  Component: ComponentType<McpConnectSectionProps>;
+}
+
+const sections = new Map<string, McpConnectSection>();
+const listeners = new Set<() => void>();
+let snapshot: readonly McpConnectSection[] = [];
+
+function publish(): void {
+  snapshot = [...sections.values()].sort((left, right) => (left.order ?? 0) - (right.order ?? 0));
+  for (const listener of listeners) listener();
+}
+
+/** Adds a section to the dialog; the returned function removes it. A second registration with the same id replaces the first. */
+export function registerMcpConnectSection(section: McpConnectSection): () => void {
+  sections.set(section.id, section);
+  publish();
+  return () => {
+    if (sections.get(section.id) !== section) return;
+    sections.delete(section.id);
+    publish();
+  };
+}
+
+function subscribe(listener: () => void): () => void {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+}
+
+/** The registered sections, in order; follows registrations made while the dialog is open. */
+export function useMcpConnectSections(): readonly McpConnectSection[] {
+  return useSyncExternalStore(subscribe, () => snapshot, () => snapshot);
+}

package/src/plugins/builtin/cloud/plugin.tsx

@@ -14,12 +14,17 @@ import { askgConversationListStore } from "./askg/conversation-store";
 import { ASKG_PANE_ID, ASKGPane } from "./askg/pane";
 import { askGloomQuestion } from "./askg/pending-question";
 import { registerCloudAuthCommands } from "./auth-commands";
+import { registerMcpConnectCommand } from "./mcp-connect/command";
 import { registerCloudUpgradeCommand } from "./upgrade-command";
 import { CloudUpgradeStatusWidget } from "./upgrade-status-widget";
 import { registerTrialOfferCommand, TrialOfferStatusWidget } from "./trial-offer-status-widget";
 import { CloudVerificationStatusWidget } from "./verification-status-widget";
 import { createPublicPaneShare } from "../shared/public-pane";
 import { teamModule } from "./team/module";
+import { registerMcpConnectSection } from "./mcp-connect/sections";
+import { TerminalControlSection } from "./terminal-relay/connect-section";
+import { terminalRelayGrants } from "./terminal-relay/grants";
+import { TerminalRelayStatusWidget } from "./terminal-relay/indicator";
 import { thesisModule } from "./thesis/module";
 
 function createCloudDataModule(): PluginModule {
@@ -39,7 +44,7 @@ function createCloudDataModule(): PluginModule {
   };
 }
 
-/** Sign-in and upgrade commands, and the email verification, upgrade and trial prompts. */
+/** Sign-in, upgrade and MCP setup commands, and the email verification, upgrade and trial prompts. */
 const cloudAccountModule: PluginModule = {
   slots: {
     "status:widget": () => (
@@ -54,6 +59,7 @@ const cloudAccountModule: PluginModule = {
     registerCloudAuthCommands(ctx);
     registerCloudUpgradeCommand(ctx);
     registerTrialOfferCommand(ctx);
+    registerMcpConnectCommand(ctx);
   },
 };
 
@@ -95,6 +101,34 @@ const askgModule: PluginModule = {
   }],
 };
 
+/**
+ * Remote control from the Gloom Cloud MCP: which assistants were approved
+ * live with the profile, and the status chip shows one at work. The relay
+ * itself is mounted by the app (terminal-relay/host.tsx) and stays off while
+ * this plugin is.
+ */
+let removeTerminalControlSection: (() => void) | null = null;
+
+const terminalRelayModule: PluginModule = {
+  slots: {
+    "status:widget": () => <TerminalRelayStatusWidget />,
+  },
+  setup(ctx) {
+    terminalRelayGrants.attach(ctx.persistence);
+    removeTerminalControlSection?.();
+    removeTerminalControlSection = registerMcpConnectSection({
+      id: "terminal-control",
+      order: 10,
+      Component: TerminalControlSection,
+    });
+  },
+  dispose() {
+    removeTerminalControlSection?.();
+    removeTerminalControlSection = null;
+    terminalRelayGrants.detach();
+  },
+};
+
 const congressTradesModule: PluginModule = {
   panes: [{
     id: CONGRESS_TRADES_PANE_ID,
@@ -141,6 +175,7 @@ export function createGloomberbCloudPlugin(extraModules: readonly PluginModule[]
       accountManagementModule,
       cloudAccountModule,
       askgModule,
+      terminalRelayModule,
       ...extraModules,
       congressTradesModule,
       cloudTweetsModule,

package/src/plugins/builtin/cloud/starter-symbols.ts

@@ -0,0 +1,8 @@
+/**
+ * Every ticker the app seeds: `DEFAULT_WATCHLIST_TICKERS` in
+ * src/state/app/bootstrap.ts and `FIRST_RUN_WATCHLIST` in
+ * src/components/onboarding/first-run-workspace.ts. A test keeps them equal.
+ */
+export const STARTER_SYMBOLS: ReadonlySet<string> = new Set([
+  "AAPL", "MSFT", "GOOGL", "AMZN", "NVDA", "TSLA", "META", "BRK.B", "JPM", "V", "BTC-USD", "ETH-USD", "SPY", "QQQ",
+]);