minecodex 2.0.14 → 2.0.16

package/packages/plugin/plugin.json

@@ -0,0 +1,16 @@
+{
+  "name": "minecodex",
+  "version": "0.1.0",
+  "description": "Manage local MineCodex enhancements without changing their runtime.",
+  "author": { "name": "Vontean" },
+  "mcpServers": "./.mcp.json",
+  "interface": {
+    "displayName": "MineCodex",
+    "shortDescription": "Manage your local Codex enhancements",
+    "developerName": "Vontean",
+    "category": "Developer Tools",
+    "capabilities": ["Interactive", "Read", "Write"],
+    "logo": "./assets/icon.svg",
+    "composerIcon": "./assets/icon.svg"
+  }
+}

package/packages/plugin/src/app.mjs

@@ -0,0 +1,17 @@
+import { App } from "@modelcontextprotocol/ext-apps";
+
+const app = new App({ name: "MineCodex", version: "0.1.0" });
+app.ontoolresult = () => {};
+await app.connect();
+window.minecodexMcpApp = app;
+function syncHost(context) {
+  // 宿主事件是增量更新；尺寸变化不能覆盖已同步的主题。
+  if (!Object.hasOwn(context ?? {}, "theme")) return;
+  window.minecodexHostTheme = context?.theme;
+  window.dispatchEvent(new Event("minecodex-host-theme"));
+}
+app.addEventListener("hostcontextchanged", syncHost);
+syncHost(app.getHostContext());
+await import("../../../apps/dashboard/app.js");
+await import("../../../apps/dashboard/assets/data-transfer.js");
+await import("../../../apps/dashboard/assets/terrain.js");

package/packages/plugin/src/control-client.mjs

@@ -0,0 +1,41 @@
+import { readFile } from "node:fs/promises";
+import { FEATURE_IDS } from "../../cli/src/config.mjs";
+
+const READ_ROUTES = new Set(["/api/status", "/api/features", "/api/update", "/api/data", "/api/data/export"]);
+export function assertControlRequest({ route, method = "GET", body }) {
+  if (method === "GET" && READ_ROUTES.has(route) && body === undefined) return;
+  if (method === "PATCH" && route.startsWith("/api/features/") && FEATURE_IDS.includes(route.slice(14))
+    && body && Object.keys(body).length === 1 && typeof body.enabled === "boolean") return;
+  if (method === "POST" && ["/api/restart", "/api/data/preview", "/api/data/import"].includes(route)
+    && body && typeof body === "object" && !Array.isArray(body)) return;
+  throw new Error("Unsupported MineCodex operation");
+}
+
+export function createControlClient({ paths, port = 47830, fetchImpl = fetch }) {
+  const origin = `http://127.0.0.1:${port}`;
+  const icons = new Map();
+  async function request(route, method = "GET", body, locale = "en") {
+    assertControlRequest({ route, method, body });
+    const token = (await readFile(paths.tokenPath, "utf8")).trim();
+    const headers = { Authorization: `Bearer ${token}`, Origin: origin, "Accept-Language": locale };
+    if (body !== undefined) headers["Content-Type"] = "application/json";
+    const response = await fetchImpl(origin + route, {
+      method, headers, ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+      signal: AbortSignal.timeout(route === "/api/restart" ? 60_000 : 20_000),
+      redirect: "error",
+    });
+    const data = await response.json();
+    if (Array.isArray(data.features)) {
+      for (const feature of data.features) {
+        if (!FEATURE_IDS.includes(feature.id) || !feature.iconUrl) continue;
+        if (!icons.has(feature.id)) {
+          const icon = await fetchImpl(`${origin}/api/icons/${feature.id}.svg`, { headers, signal: AbortSignal.timeout(5_000), redirect: "error" });
+          if (icon.ok) icons.set(feature.id, `data:image/svg+xml;base64,${Buffer.from(await icon.text()).toString("base64")}`);
+        }
+        feature.iconUrl = icons.get(feature.id) ?? "";
+      }
+    }
+    return { status: response.status, body: data };
+  }
+  return { request };
+}

package/packages/plugin/src/install.mjs

@@ -0,0 +1,26 @@
+import { mkdir, readFile, writeFile, copyFile } from "node:fs/promises";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execute = promisify(execFile);
+
+export async function installPlugin({ paths, execFileImpl = execute, codex = "codex", node = process.execPath }) {
+  const root = path.join(paths.supportDir, "plugin-marketplace");
+  const plugin = path.join(root, "plugins/minecodex");
+  await mkdir(path.join(plugin, ".codex-plugin"), { recursive: true });
+  await mkdir(path.join(plugin, "assets"), { recursive: true });
+  await mkdir(path.join(root, ".agents/plugins"), { recursive: true });
+  const manifest = JSON.parse(await readFile(path.join(paths.packageRoot, "packages/plugin/plugin.json"), "utf8"));
+  await writeFile(path.join(plugin, ".codex-plugin/plugin.json"), JSON.stringify(manifest, null, 2) + "\n");
+  await copyFile(path.join(paths.packageRoot, "assets/brand/minecodex-icon.svg"), path.join(plugin, "assets/icon.svg"));
+  await writeFile(path.join(plugin, ".mcp.json"), JSON.stringify({ mcpServers: { minecodex: {
+    command: node, args: [path.join(paths.packageRoot, "packages/cli/bin/mcx.mjs"), "plugin", "serve"],
+  } } }, null, 2) + "\n");
+  await writeFile(path.join(root, ".agents/plugins/marketplace.json"), JSON.stringify({
+    name: "minecodex-local", interface: { displayName: "MineCodex" },
+    plugins: [{ name: "minecodex", source: { source: "local", path: "./plugins/minecodex" }, policy: { installation: "AVAILABLE", authentication: "ON_INSTALL" } }],
+  }, null, 2) + "\n");
+  await execFileImpl(codex, ["plugin", "marketplace", "add", root, "--json"]);
+  const result = await execFileImpl(codex, ["plugin", "add", "minecodex@minecodex-local", "--json"]);
+  return { root, result: JSON.parse(result.stdout) };
+}

package/packages/plugin/src/navigation-icons.mjs

@@ -0,0 +1,8 @@
+import { readFileSync } from "node:fs";
+
+// 入口与品牌资源归官方插件；UI Adapter 只消费默认／选中资源契约。
+const icon = path => `data:image/svg+xml;base64,${readFileSync(new URL(path, import.meta.url)).toString("base64")}`;
+export const MCP_NAVIGATION_ICONS = [
+  { tool: "minecodex_open", default: icon("../../../assets/brand/minecodex-icon.svg"), selected: icon("../../../assets/brand/minecodex-icon-selected.svg") },
+  { tool: "minecodex_prompts_open", default: icon("../../../features/notes/assets/icons/prompt-entry.svg"), selected: icon("../../../features/notes/assets/icons/prompt-entry-selected.svg") },
+];

package/packages/plugin/src/prompts-app.mjs

@@ -0,0 +1,45 @@
+import { App } from '@modelcontextprotocol/ext-apps';
+import { installPrompts } from 'minecodex:prompts';
+import icons from '../../../features/notes/src/frontend/icons.json';
+import previews from '../../../features/notes/assets/prompt-previews.json';
+import styles from '../../../features/notes/src/frontend/styles.css' with {type:'text'};
+import { applyMcpTheme } from '../../ui/src/native/mcp-theme.mjs';
+import { installLayers } from '../../ui/src/foundation/layers.mjs';
+import { installSurfaces } from '../../ui/src/foundation/surfaces.mjs';
+import { installDialog } from '../../ui/src/components/dialog.mjs';
+import { installButton } from '../../ui/src/components/button.mjs';
+import { installFeatureTooltips } from '../../ui/src/components/tooltip.mjs';
+
+const app = new App({name:'Prompt',version:'0.1.0'});
+app.ontoolresult = () => {};
+await app.connect();
+applyMcpTheme(app.getHostContext());
+app.addEventListener('hostcontextchanged', applyMcpTheme);
+const controller = new AbortController();
+const signal = controller.signal;
+const ui = {};
+for (const installer of [installLayers,installSurfaces,installDialog,installButton,installFeatureTooltips]) Object.assign(ui,installer(signal,ui));
+ui.page = node => {ui.surface(node,'page'); return ui.layer(node,'page');};
+ui.releasePage = () => {};
+const cleanup = installPrompts(signal, {
+  management:true, ui, resources:{icons,previews,styles},
+  insertPrompt: promptId => new Promise((resolve,reject) => {
+    const channel = new MessageChannel();
+    let timer;
+    const finish = error => {
+      clearTimeout(timer);channel.port1.close();signal.removeEventListener('abort',abort);
+      error ? reject(error) : resolve();
+    };
+    const abort = () => finish(new Error('Prompt page closed'));
+    signal.addEventListener('abort',abort,{once:true});
+    timer = setTimeout(() => finish(new Error('No available input in the focused window')),4500);
+    channel.port1.onmessage = ({data}) => finish(data.ok ? null : new Error(data.error));
+    window.top.postMessage({type:'minecodex:insert-prompt',promptId,expiresAt:Date.now()+4000},'*',[channel.port2]);
+  }),
+  requestHostAction: async (_,args) => {
+    const result = await app.callServerTool({name:args.method && args.method !== 'GET' ? 'minecodex_prompts_write' : 'minecodex_prompts_read',arguments:args});
+    if (result.isError) throw new Error(result.content?.find(item=>item.type === 'text')?.text ?? 'Prompts request failed');
+    return result.structuredContent.result;
+  },
+});
+app.onteardown = async () => {controller.abort();cleanup();return {};};

package/packages/plugin/src/prompts-client.mjs

@@ -0,0 +1,16 @@
+import { assertPromptsRequest } from "../../../features/notes/src/adapters/codex/requests.mjs";
+import { readConfig } from '../../cli/src/config.mjs';
+
+export function createPromptsClient({ paths, port = 47832, fetchImpl = fetch }) {
+  return { async request(route, method = 'GET', body) {
+    assertPromptsRequest(route, method);
+    if (!(await readConfig(paths.configPath)).features.notes) throw new Error('Enable Prompts in MineCodex first');
+    const response = await fetchImpl(`http://127.0.0.1:${port}${route}`, {
+      method, headers: {Origin:'app://-', 'Content-Type':'application/json'},
+      ...(body !== undefined ? {body:JSON.stringify(body)} : {}), redirect:'error', signal:AbortSignal.timeout(8000),
+    });
+    const result = response.status === 204 ? null : await response.json();
+    if (!response.ok) throw new Error(result?.error?.message ?? 'Prompts service unavailable');
+    return result;
+  } };
+}

package/packages/plugin/src/server.mjs

@@ -0,0 +1,74 @@
+import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { registerAppResource, registerAppTool as registerSdkAppTool, RESOURCE_MIME_TYPE } from "@modelcontextprotocol/ext-apps/server";
+import { z } from "zod";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { resolvePaths } from "../../cli/src/paths.mjs";
+import { createControlClient } from "./control-client.mjs";
+import { createPromptsClient } from "./prompts-client.mjs";
+import { createAppHtml, createPromptsHtml } from "./ui-resource.mjs";
+
+export const APP_URI = "ui://minecodex/control-panel.html";
+export const PROMPTS_URI = "ui://minecodex/prompts.html";
+export function createPluginServer({ promptsClient, paths = resolvePaths(), client = createControlClient({ paths, port: Number(process.env.MINECODEX_CONTROL_PORT ?? 47830) }) } = {}) {
+  const icons = [{ src: `data:image/svg+xml;base64,${readFileSync(path.join(paths.packageRoot, "assets/brand/minecodex-icon.svg")).toString("base64")}`, mimeType: "image/svg+xml" }];
+  const server = new McpServer({ name: "minecodex", version: "0.1.0", icons });
+  const promptIcons = [{src:`data:image/svg+xml;base64,${readFileSync(path.join(paths.packageRoot,"features/notes/assets/icons/prompt-entry.svg")).toString("base64")}`,mimeType:"image/svg+xml",sizes:["20x20"]}];
+  const tools = [];
+  // 使用公开 tools/list 协议补齐 SDK 高层注册尚未转发的工具图标。
+  function registerAppTool(target, name, config, callback) {
+    registerSdkAppTool(target,name,config,callback);
+    tools.push({name,title:config.title,description:config.description,inputSchema:z.toJSONSchema(z.object(config.inputSchema)),
+      annotations:config.annotations,_meta:config._meta,icons:name.startsWith("minecodex_prompts_") ? promptIcons : icons});
+  }
+  const ui = { resourceUri: APP_URI, visibility: ["app"] };
+  registerAppTool(server, "minecodex_open", {
+    title: "MineCodex", description: "Open the local MineCodex control panel.", inputSchema: {},
+    annotations: { readOnlyHint: true, openWorldHint: false },
+    _meta: { ui, "openai/ui": { entrypoints: [{ type: "global" }] } },
+  }, async () => ({ content: [], structuredContent: {view:"control-panel"} }));
+  const inputSchema = { route: z.string(), method: z.enum(["GET", "PATCH", "POST"]).default("GET"), locale: z.enum(["en", "zh-CN"]).default("en"), body: z.record(z.string(), z.unknown()).optional() };
+  for (const write of [false, true]) {
+    registerAppTool(server, write ? "minecodex_write" : "minecodex_read", {
+      description: write ? "Save a user-selected setting, transfer data, or explicitly restart Codex from the control panel." : "Read local MineCodex control panel information.",
+      inputSchema, _meta: { ui },
+      annotations: { readOnlyHint: !write, destructiveHint: write, openWorldHint: false },
+    }, async (input) => {
+      if ((input.method !== "GET") !== write) throw new Error("Operation does not match the tool");
+      return { content: [], structuredContent: await client.request(input.route, input.method, input.body, input.locale) };
+    });
+  }
+  promptsClient ??= createPromptsClient({paths});
+  const promptsUi = {resourceUri:PROMPTS_URI,visibility:["app"]};
+  registerAppTool(server,"minecodex_prompts_open",{
+    title:"Prompt",description:"Manage MineCodex prompts, categories and usage.",inputSchema:{},
+    annotations:{readOnlyHint:true,openWorldHint:false},
+    _meta:{ui:promptsUi,"openai/ui":{entrypoints:[{type:"global"}]}},
+  },async()=>({content:[],structuredContent:{view:"prompts"}}));
+  for (const write of [false,true]) registerAppTool(server,write ? "minecodex_prompts_write" : "minecodex_prompts_read",{
+    description:write ? "Apply an explicit Prompts edit or record successful usage." : "Read MineCodex Prompts.",
+    inputSchema:{route:z.string(),method:z.enum(["GET","POST","PATCH","DELETE"]).default("GET"),body:z.record(z.string(),z.unknown()).optional()},
+    annotations:{readOnlyHint:!write,openWorldHint:false},_meta:{ui:promptsUi},
+  },async({route,method,body})=>{
+    if ((method !== "GET") !== write) throw new Error("Operation does not match the tool");
+    return {content:[],structuredContent:{result:await promptsClient.request(route,method,body)}};
+  });
+  let promptsHtml;
+  registerAppResource(server,"prompts",PROMPTS_URI,{},async()=>({contents:[{
+    uri:PROMPTS_URI,mimeType:RESOURCE_MIME_TYPE,text:promptsHtml ??= await createPromptsHtml(paths.packageRoot),
+    _meta:{ui:{csp:{connectDomains:[],resourceDomains:["data:","blob:"]}}},
+  }]}));
+  let html;
+  registerAppResource(server, "control-panel", APP_URI, {}, async () => ({ contents: [{
+    uri: APP_URI, mimeType: RESOURCE_MIME_TYPE, text: html ??= await createAppHtml(paths.packageRoot),
+    _meta: { ui: { csp: { connectDomains: [], resourceDomains: ["data:", "blob:"] } } },
+  }] }));
+  server.server.setRequestHandler(ListToolsRequestSchema, async () => ({tools}));
+  return server;
+}
+export async function servePlugin(options) {
+  // 只提供界面与通信。退出插件进程不会停止增强服务或 Codex。
+  await createPluginServer(options).connect(new StdioServerTransport());
+}

package/packages/plugin/src/ui-resource.mjs

@@ -0,0 +1,22 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+const mime = { ".svg": "image/svg+xml", ".ttf": "font/ttf" };
+export async function createAppHtml(packageRoot) {
+  const directory = path.join(packageRoot, "apps/dashboard");
+  let html = await readFile(path.join(directory, "index.html"), "utf8");
+  let css = await readFile(path.join(directory, "styles.css"), "utf8");
+  for (const match of [...css.matchAll(/url\("(\/[^"?]+)(?:\?[^" ]*)?"\)/g)]) {
+    const asset = await readFile(path.join(directory, match[1]));
+    css = css.replaceAll(match[0], `url("data:${mime[path.extname(match[1])]};base64,${asset.toString("base64")}")`);
+  }
+  const script = await readFile(path.join(packageRoot, "packages/plugin/assets/app.js"), "utf8");
+  html = html.replace(/\s*<link[^>]+>/g, "").replace(/\s*<script[\s\S]*?<\/script>/g, "");
+  return html.replace("</head>", `<style>${css}</style></head>`)
+    .replace("</body>", `<script type="module">${script.replaceAll("</script", "<\\/script")}</script></body>`);
+}
+
+export async function createPromptsHtml(packageRoot) {
+  const script = await readFile(path.join(packageRoot,'packages/plugin/assets/prompts.js'),'utf8');
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+  <style>${await readFile(path.join(packageRoot,"packages/ui/src/native/mcp-theme.css"),"utf8")}  </style></head><body><script type="module">${script.replaceAll('</script','<\\/script')}</script></body></html>`;
+}

package/packages/runtime-host/src/codex-injection.mjs

@@ -1,5 +1,4 @@
 import { createRendererSelfCheck, tokenRequirements } from "./renderer-self-check.mjs";
-import { readFileSync } from "node:fs";
 import { createCodexEnvironment } from "../../codex-adapter/src/renderer/environment.mjs";
 // 注入源生成：createInjectionSource 产出注入到 Codex Renderer 的自包含脚本字符串。
 // 该字符串经 CDP 注入后独立执行，因此 install 函数体必须自包含；
@@ -7,14 +6,11 @@ import { createCodexEnvironment } from "../../codex-adapter/src/renderer/environ
 
 import { createModelSliderInstallerSource } from "../../../features/model-slider/src/injection-source.mjs";
 import { createUIInstallerSource } from "../../ui/src/install.mjs";
+import { MCP_NAVIGATION_ICONS } from "../../plugin/src/navigation-icons.mjs";
 import { randomBytes } from "node:crypto";
 import { CODEX_THEME_TOKENS, CODEX_THEME_TOKEN_ALIASES, MINECODEX_THEME_BINDINGS } from "../../ui/src/native/tokens.mjs";
 
-export const RUNTIME_VERSION = 109;
-const PROJECT_ICON = Object.fromEntries([16, 20].map(size => [size,
-  readFileSync(new URL(`../../ui/assets/minecodex-menu-${size}.svg`, import.meta.url), "utf8"),
-]));
-const EXTERNAL_ICON = readFileSync(new URL("../../ui/assets/arrow-up-right.svg", import.meta.url), "utf8");
+export const RUNTIME_VERSION = 113;
 export const HOST_BINDING_NAME = "__codexPersonalHostAction";
 export const CSP_BOOTSTRAP_VERSION = 1;
 export const CSP_BOOTSTRAP_KEY = "__mineCodexCspBootstrapVersion";
@@ -148,7 +144,7 @@ export function createInjectionSource(features, {
 
     const lifetime = new AbortController();
     const codex = createCodexEnvironment();
-    const featureUI = installUI(lifetime.signal, {codex,themeTokens:config.themeTokens,themeTokenAliases:config.themeTokenAliases,themeBindings:config.themeBindings});
+    const featureUI = installUI(lifetime.signal, {codex,mcpServer:"minecodex",mcpPluginId:"minecodex@minecodex-local",mcpNavigationIcons:config.mcpNavigationIcons,themeTokens:config.themeTokens,themeTokenAliases:config.themeTokenAliases,themeBindings:config.themeBindings});
     const rightPanelRouteKinds = new Set(config.rightPanelRouteKinds);
 
     const entryMarker = "data-codex-personal-feature";
@@ -210,8 +206,6 @@ export function createInjectionSource(features, {
       } : null,
       hostActions: new Set(feature.hostActions ?? []),
     }));
-    featureUI.accountMenuEntry?.({ label:"MineCodex", icon:config.projectIcon, externalIcon:config.externalIcon,
-      onOpen:() => requestPageHostAction("minecodex", "open-control-panel", {}) });
     const selfCheck = createRendererSelfCheck(features, config.sessionId, featureUI.theme);
     const featureById = new Map(features.map((feature) => [feature.id, feature]));
     const sidebarFeatures = features.filter((feature) => feature.entry?.kind === "sidebar");
@@ -2193,7 +2187,7 @@ export function createInjectionSource(features, {
     }
 
     function requestPageHostAction(featureId, action, payload) {
-      if (!(featureId === "minecodex" && action === "open-control-panel") && !featureById.get(featureId)?.hostActions.has(action)) return Promise.reject(new Error("Host action is not registered"));
+      if (!featureById.get(featureId)?.hostActions.has(action)) return Promise.reject(new Error("Host action is not registered"));
       if (typeof globalThis[config.bindingName] !== "function") return Promise.reject(new Error("Host bridge is unavailable"));
       return new Promise((resolve, reject) => {
         const requestId = crypto.randomUUID();
@@ -2463,8 +2457,6 @@ export function createInjectionSource(features, {
     } : null,
   }));
   return `(${install.toString()})(${JSON.stringify({
-    projectIcon: PROJECT_ICON,
-    externalIcon: EXTERNAL_ICON,
     version: RUNTIME_VERSION,
     sessionId: runtimeSessionId,
     bindingName,
@@ -2474,6 +2466,7 @@ export function createInjectionSource(features, {
     themeTokens: CODEX_THEME_TOKENS,
     themeTokenAliases: CODEX_THEME_TOKEN_ALIASES,
     themeBindings: MINECODEX_THEME_BINDINGS,
+    mcpNavigationIcons: MCP_NAVIGATION_ICONS,
     features: runtimeFeatures,
   })}, ${createUIInstallerSource()}, ${createModelSliderInstallerSource()}, ${createCodexEnvironment.toString()}, ${createRendererSelfCheck.toString()})`;
 }

package/packages/runtime-host/src/codex-runtime.mjs

@@ -1,6 +1,4 @@
-import { execFile as execFileCallback } from "node:child_process";
-import { promisify } from "node:util";
-import { fileURLToPath } from "node:url";
+import { assertPromptsRequest } from "../../../features/notes/src/adapters/codex/requests.mjs";
 import { LocalImageSource } from "../../../features/images/src/backend/local-image-source.mjs";
 import { cloudImagesAction } from "../../../features/images/src/backend/cloud-library.mjs";
 // CodexRuntime：Codex Renderer 生命周期与 host action 执行。
@@ -81,9 +79,7 @@ export class CodexRuntime {
     onStatusChange = null,
     sitesService = null,
     onManagedCodexPidChange = null,
-    openControlPanel = () => promisify(execFileCallback)(process.execPath, [fileURLToPath(new URL("../../cli/bin/mcx.mjs", import.meta.url)), "gui"], { timeout:20_000 }),
   }) {
-    this.openControlPanel = openControlPanel;
     this.features = features;
     this.sitesService = sitesService ?? (features.some(feature => feature.id === "sites") ? new SitesService() : null);
     this.localImageSource = features.some(feature => feature.id === "images") ? new LocalImageSource({dataDir:path.join(profileDir,"minecodex-image-gen")}) : null;
@@ -539,11 +535,6 @@ export class CodexRuntime {
       return;
     }
     if (request.token !== this.bindingTokens.get(targetId) || typeof request.requestId !== "string") return;
-    if (request.featureId === "minecodex" && request.action === "open-control-panel") {
-      try { await this.openControlPanel(); await this.resolveHostAction(client, request.requestId, {ok:true,result:{opened:true}}); }
-      catch (error) { await this.resolveHostAction(client, request.requestId, {ok:false,error:{code:"CONTROL_PANEL_FAILED",message:error.stderr?.trim() || error.message}}); }
-      return;
-    }
     const feature = this.features.find((candidate) => candidate.id === request.featureId);
     if (feature?.id === "session-status" && request.action === "refresh-session-status") {
       if (this.sessionStatusReader && this.clients.get(targetId) === client && !this.stopping) {
@@ -601,13 +592,9 @@ export class CodexRuntime {
     if (feature.id === "notes" && request.action === "quick-prompts") {
       try {
         const { route, method = "GET", body } = request.payload ?? {};
-        const allowed = (route === "/api/state" && method === "GET")
-          || (["/api/prompts", "/api/categories", "/api/reorder"].includes(route) && method === "POST")
-          || (/^\/api\/categories\/[a-zA-Z0-9-]+$/.test(route) && ["PATCH", "DELETE"].includes(method))
-          || (/^\/api\/prompts\/[a-zA-Z0-9-]+$/.test(route) && ["PATCH", "DELETE"].includes(method))
-          || (/^\/api\/prompts\/[a-zA-Z0-9-]+\/use$/.test(route) && method === "POST");
+        assertPromptsRequest(route, method);
         const origin = pageScriptServiceOrigin(feature);
-        if (!allowed || !origin) throw new Error("Prompt request is not allowed");
+        if (!origin) throw new Error("Prompt request is not allowed");
         const response = await this.fetchImpl(new URL(route, origin), {
           method, headers: { "Content-Type": "application/json", Origin: CODEX_APP_ORIGIN },
           body: body === undefined ? undefined : JSON.stringify(body),

package/packages/ui/src/install.mjs

@@ -1,5 +1,5 @@
-import { createNativeAccountMenuAdapter } from "./native/account-menu.mjs";
-import { installAccountMenuEntry } from "./components/account-menu.mjs";
+import { installMcpAppChrome } from "./native/mcp-app.mjs";
+import { installMcpNavigationIcons } from "./native/mcp-navigation.mjs";
 import { createNativeThemeAdapter } from "./native/theme.mjs";
 import { createNativePageAdapter } from "./native/page.mjs";
 import { createNativeRailAdapter } from "./native/navigation-rail.mjs";
@@ -21,7 +21,8 @@ export function createUIInstallerSource() {
     Object.assign(ui, (${installPage.toString()})(signal, ui, (${createNativePageAdapter.toString()})(context.codex)));
     Object.assign(ui, (${installNavigationRail.toString()})(signal, ui, (${createNativeRailAdapter.toString()})(context.codex)));
     Object.assign(ui, (${installFeatureTooltips.toString()})(signal));
-    Object.assign(ui, (${installAccountMenuEntry.toString()})(signal, ui, (${createNativeAccountMenuAdapter.toString()})(context.codex)));
+    if (context.mcpServer) (${installMcpAppChrome.toString()})(signal, context.codex, {server:context.mcpServer,pluginId:context.mcpPluginId});
+    if (context.mcpNavigationIcons) (${installMcpNavigationIcons.toString()})(signal, (${createNativeRailAdapter.toString()})(context.codex), {server:context.mcpServer,pluginId:context.mcpPluginId,icons:context.mcpNavigationIcons});
     return ui;
   }`;
 }

package/packages/ui/src/native/mcp-app.mjs

@@ -0,0 +1,32 @@
+// Codex 26.930：GlobalView 的重复标题由宿主生成，不能从 iframe 控制。
+export function installMcpAppChrome(signal, codex, {server,pluginId}) {
+  const headers = new Map();
+  function restore(header, hidden) {
+    if (header.hasAttribute('data-mcx-hidden-app-header')) {
+      header.hidden = hidden;
+      header.removeAttribute('data-mcx-hidden-app-header');
+    }
+  }
+  function sync() {
+    const owned = new Set();
+    for (const surface of document.querySelectorAll('[data-mcp-extension-surface]')) {
+      const owner = codex.props(surface, props => props.source?.server != null);
+      if (!owner || !(owner.source.server === server || (pluginId != null && owner.source.pluginId === pluginId))) continue;
+      const header = surface.querySelector(':scope > [data-mcp-extension-header]');
+      if (!header) continue;
+      owned.add(header);
+      if (!headers.has(header)) headers.set(header, header.hidden);
+      header.setAttribute('data-mcx-hidden-app-header','');
+      header.hidden = true;
+    }
+    for (const [header,hidden] of headers) if (!owned.has(header)) {
+      restore(header,hidden);headers.delete(header);
+    }
+  }
+  const observer = new MutationObserver(sync);
+  observer.observe(document.documentElement,{childList:true,subtree:true,characterData:true});
+  sync();
+  const cleanup=()=>{observer.disconnect();for (const [header,hidden] of headers) restore(header,hidden);headers.clear();};
+  signal.addEventListener('abort',cleanup,{once:true});
+  return cleanup;
+}

package/packages/ui/src/native/mcp-navigation.mjs

@@ -0,0 +1,52 @@
+// MCP 原生 railIcons 默认与选中共用资源；只更换 mask 图片，颜色与交互仍归原生节点。
+export function installMcpNavigationIcons(signal, nativeRail, {server, pluginId, icons}) {
+  const resources = new Map(icons.map(icon => [icon.tool,icon]));
+  const snapshots = new Map();
+  function restore(image, state) {
+    if (image.getAttribute('href') !== state.applied) return;
+    if (state.original === null) image.removeAttribute('href');
+    else image.setAttribute('href',state.original);
+  }
+  function identity(node) {
+    const item = nativeRail.item(node);
+    const entry = item?.railIcons?.default?.props?.entry;
+    if (!entry || !(entry.source?.server === server || (pluginId != null && entry.source?.pluginId === pluginId))) return null;
+    let tool;
+    try {tool = decodeURIComponent(entry.path.split('/').at(-1));} catch {return null;}
+    const resource = resources.get(tool);
+    if (!resource?.default || !resource.selected) return null;
+    return {key:entry.path,resource};
+  }
+  function sync() {
+    const owned = new Set();
+    for (const node of document.querySelectorAll('[data-app-navigation-rail] [data-sidebar-destination^="mcp:"]')) {
+      const owner = identity(node);
+      if (!owner) continue;
+      const image = node.querySelector('svg defs mask image');
+      if (!image) continue; // 原生刷新状态显示 spinner 时没有图标 mask。
+      owned.add(image);
+      let state = snapshots.get(image);
+      if (state && state.key !== owner.key) {
+        restore(image,state);snapshots.delete(image);state = null;
+      }
+      const current = image.getAttribute('href');
+      if (!state) {state = {key:owner.key,original:current,applied:null};snapshots.set(image,state);}
+      else if (current !== state.applied) state.original = current;
+      const selected = node.getAttribute('aria-current') === 'page'
+        || (node.hasAttribute('data-selected') && node.getAttribute('data-selected') !== 'false');
+      const next = selected ? owner.resource.selected : owner.resource.default;
+      state.applied = next;
+      if (current !== next) image.setAttribute('href',next);
+    }
+    for (const [image,state] of snapshots) if (!owned.has(image)) {
+      restore(image,state);snapshots.delete(image);
+    }
+  }
+  const observer = new MutationObserver(sync);
+  observer.observe(document.documentElement,{childList:true,subtree:true,attributes:true,
+    attributeFilter:['href','aria-current','data-selected','data-sidebar-destination']});
+  const cleanup = () => {observer.disconnect();for (const [image,state] of snapshots) restore(image,state);snapshots.clear();};
+  signal.addEventListener('abort',cleanup,{once:true});
+  if (signal.aborted) cleanup(); else sync();
+  return cleanup;
+}

package/packages/ui/src/native/mcp-theme.css

@@ -0,0 +1,4 @@
+:root { --color-background-primary:light-dark(#fff,#212121); --color-background-secondary:light-dark(#f8f8f8,#303030); --color-background-tertiary:light-dark(#eee,#3c3c3c); --color-text-primary:light-dark(#202020,#eee); --color-text-secondary:light-dark(#626262,#aaa); --color-text-tertiary:light-dark(#777,#999); --color-border-primary:light-dark(#ddd,#555); --color-border-secondary:light-dark(#eee,#444); --color-border-info:#0285ff; --color-text-danger:light-dark(#ba2a2a,#ff6764); --font-sans:system-ui,sans-serif; --font-text-sm-size:13px; --font-text-md-size:14px; --font-text-xs-size:12px; --font-heading-lg-size:28px; --font-heading-md-size:20px; --border-radius-md:8px; --border-radius-lg:10px; --border-radius-xl:15px; --border-radius-full:999px;
+    --mcx-spacing:4px; --mcx-radius-2xl:20px; --mcx-radius-3xl:25px; --mcx-text-sm--line-height:1.43; --mcx-font-weight-semibold:600; --mcx-font-weight-normal:400; --font-weight-medium:500; --mcx-control-size-lg:36px; --mcx-control-font-size-md:13px; --mcx-control-gutter-md:16px; --mcx-control-gutter-pill-scaling:1; --mcx-button-gap-lg:8px; --mcx-modal-container-inner-padding:20px; --mcx-shadow-lg:0 8px 24px #0002; --mcx-shadow-xl-spread:0 12px 36px #0003; --mcx-color-border-overlay:var(--mcx-color-border); --mcx-blur-sm:4px; --mcx-blur-xl:24px; --mcx-color-dialog-overlay:#0002; --mcx-color-background-danger-soft-alpha:color-mix(in oklab,var(--color-text-danger) 12%,transparent); --mcx-color-background-danger-soft-alpha-hover:color-mix(in oklab,var(--color-text-danger) 20%,transparent); --color-background-primary-soft:var(--color-background-secondary); --cursor-interaction:pointer; }
+    html,body {margin:0;min-height:100%;height:100%;color:var(--color-text-primary);background:var(--color-background-primary);font-family:var(--font-sans);}
+    button,input,textarea {font:inherit;color:inherit;} button {border:0;background:transparent;padding:0;} .sr-only {position:absolute;width:1px;height:1px;overflow:hidden;clip:rect(0,0,0,0);}

package/packages/ui/src/native/mcp-theme.mjs

@@ -0,0 +1,20 @@
+// MCP Apps 的宿主变量是 iframe 的主题来源；不读取父窗口 DOM。
+export function applyMcpTheme(context) {
+  const root = document.documentElement;
+  root.dataset.theme = context.theme ?? root.dataset.theme ?? 'light';
+  root.style.colorScheme = root.dataset.theme;
+  for (const [name,value] of Object.entries(context.styles?.variables ?? {})) root.style.setProperty(name,value);
+  const aliases = {
+    'color-surface':'--color-background-primary', 'color-surface-elevated-secondary':'--color-background-secondary',
+    'color-text-primary':'--color-text-primary', 'color-text-secondary':'--color-text-secondary', 'color-text-tertiary':'--color-text-tertiary',
+    'color-border':'--color-border-primary', 'color-border-subtle':'--color-border-secondary', 'color-border-primary-outline':'--color-border-primary',
+    'color-background-primary-ghost-hover':'--color-background-tertiary', 'color-background-primary-outline-hover':'--color-background-tertiary',
+    'color-background-primary-solid':'--color-text-primary', 'color-text-primary-solid':'--color-background-primary',
+    'color-background-primary-solid-hover':'--color-text-secondary', 'color-ring':'--color-border-info', 'color-text-danger':'--color-text-danger',
+    'font-sans-default':'--font-sans', 'text-sm':'--font-text-sm-size', 'text-base':'--font-text-md-size', 'text-xs':'--font-text-xs-size',
+    'text-heading-lg':'--font-heading-lg-size', 'text-heading-md':'--font-heading-md-size',
+    'radius-md':'--border-radius-md','radius-lg':'--border-radius-lg','radius-xl':'--border-radius-xl', 'radius-full':'--border-radius-full',
+  };
+  for (const [target,source] of Object.entries(aliases)) root.style.setProperty(`--mcx-${target}`,`var(${source})`);
+  if (context.locale) root.lang = context.locale;
+}

package/packages/ui/assets/arrow-up-right.svg

@@ -1,13 +0,0 @@
-<svg
-  xmlns="http://www.w3.org/2000/svg"
-  width="24"
-  height="24"
-  viewBox="0 0 24 24"
-  fill="none"
-  stroke="currentColor"
-  stroke-width="1.575"
-  stroke-linecap="round"
-  stroke-linejoin="round"
->
-  <path d="M7 7h10v10M7 17 17 7" />
-</svg>

package/packages/ui/assets/minecodex-menu-16.svg

@@ -1,7 +0,0 @@
-<!-- Generated by scripts/build-brand-icons.mjs from assets/brand/minecodex-icon.svg. -->
-<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16" fill="none">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M6.23992 1.43098C7.46406 1.1031 8.54982 1.45396 9.38542 2.21516C10.5383 1.98366 11.9155 2.29793 12.8093 3.19172C13.6945 4.07741 14.0164 5.30994 13.7829 6.44953C14.5557 7.31992 14.8933 8.54971 14.569 9.76008C14.2447 10.9704 13.3375 11.8664 12.2331 12.2337C11.8657 13.3376 10.9704 14.2443 9.76042 14.5687C8.54999 14.893 7.32025 14.5555 6.44988 13.7825C5.3103 14.0161 4.07777 13.6943 3.19206 12.8089C2.30603 11.9228 1.98129 10.6886 2.2155 9.54817C1.44398 8.67777 1.10733 7.44883 1.43132 6.23957C1.7556 5.02965 2.66205 4.13253 3.76628 3.76496C4.13401 2.66129 5.0304 1.75519 6.23992 1.43098ZM8.84636 3.15461C8.21242 2.48417 7.42544 2.20118 6.51238 2.44563C5.58126 2.69512 4.90916 3.43143 4.69988 4.30989L4.62566 4.62434L4.3112 4.69953C3.43254 4.90862 2.69555 5.58058 2.44597 6.51203C2.19659 7.44329 2.49878 8.39365 3.15495 9.01399L3.38933 9.23567L3.29753 9.54524C3.03946 10.4106 3.25264 11.384 3.93425 12.0657C4.61596 12.7473 5.59015 12.9608 6.45574 12.7025L6.76531 12.6097L6.98699 12.845C7.6075 13.5014 8.55777 13.8045 9.48894 13.555C10.4198 13.3054 11.0903 12.5676 11.2995 11.6888L11.3747 11.3753L11.6891 11.3001C12.568 11.091 13.3058 10.4198 13.5553 9.4886C13.8048 8.55744 13.5017 7.60715 12.8454 6.98664L12.611 6.76496L12.7028 6.45539C12.961 5.59001 12.7483 4.61562 12.0671 3.93391C11.3946 3.26145 10.2567 3.03482 9.37761 3.29719L9.06804 3.38996L8.84636 3.15461Z" fill="currentColor"/>
-  <g transform="scale(0.6666666666666666)"><g id="pickaxe" transform="translate(6.24 6.24) scale(.48)" fill="currentColor">
-    <path d="M15.686 4.314 16.3 3.7a1 1 0 0 1 1.4 0l2.6 2.6a1 1 0 0 1 0 1.4l-.614.614a12.501 12.501 0 0 1 1.356 10.225 1 1 0 0 1-1.751-.119 22 22 0 0 0-3.393-6.319l-.198.199a1 1 0 0 1-1.4 0l-.219.169L6.619 20.38a1 1 0 1 1-3-3l7.912-7.912.169.232a1 1 0 0 1 0-1.4l.198-.197A22 22 0 0 0 5.58 4.71a1 1 0 0 1-.119-1.752 12.5 12.5 0 0 1 10.225 1.356Z"/>
-  </g></g>
-</svg>

package/packages/ui/assets/minecodex-menu-20.svg

@@ -1,7 +0,0 @@
-<!-- Generated by scripts/build-brand-icons.mjs from assets/brand/minecodex-icon.svg. -->
-<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 20 20" fill="none">
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M7.79787 1.78095C9.33018 1.37054 10.6892 1.80862 11.7354 2.76044C13.1781 2.47254 14.8994 2.86492 16.0176 3.9831C17.1255 5.09146 17.5294 6.63391 17.2383 8.06025C18.2036 9.15 18.6252 10.6879 18.2197 12.2018C17.8139 13.7157 16.6796 14.8375 15.2988 15.2985C14.838 16.6794 13.7171 17.8134 12.2031 18.2194C10.689 18.6252 9.15041 18.2035 8.06057 17.238C6.63426 17.5291 5.09181 17.1254 3.98342 16.0173C2.87514 14.909 2.4696 13.3659 2.76076 11.9392C1.7958 10.8492 1.37577 9.31111 1.78127 7.79755C2.1869 6.28392 3.31944 5.16128 4.70022 4.69989C5.1615 3.31914 6.28421 2.18664 7.79787 1.78095ZM11.0518 3.94892C10.2613 3.11295 9.28034 2.76056 8.1426 3.06513C6.98179 3.37617 6.14459 4.29507 5.88381 5.39032L5.78908 5.78778L5.39065 5.88251C4.29532 6.14315 3.37656 6.98118 3.06545 8.14228C2.75466 9.30301 3.1314 10.4872 3.94924 11.2604L4.24709 11.5417L4.1299 11.9343C3.80831 13.013 4.07409 14.2271 4.92385 15.0768C5.77357 15.9262 6.98753 16.1917 8.06643 15.8698L8.459 15.7526L8.74025 16.0505C9.51379 16.8686 10.6978 17.2453 11.8584 16.9343C13.0186 16.6232 13.8554 15.7053 14.1162 14.6101L14.211 14.2116L14.6094 14.1169C15.705 13.8562 16.6245 13.0189 16.9356 11.8581C17.2464 10.6976 16.8687 9.51342 16.0508 8.73993L15.753 8.45868L15.8701 8.0661C16.192 6.98728 15.9265 5.77328 15.0772 4.92353C14.2391 4.08548 12.8208 3.80245 11.7246 4.12958L11.333 4.24677L11.0518 3.94892Z" fill="currentColor"/>
-  <g transform="scale(0.8333333333333334)"><g id="pickaxe" transform="translate(6.24 6.24) scale(.48)" fill="currentColor">
-    <path d="M15.686 4.314 16.3 3.7a1 1 0 0 1 1.4 0l2.6 2.6a1 1 0 0 1 0 1.4l-.614.614a12.501 12.501 0 0 1 1.356 10.225 1 1 0 0 1-1.751-.119 22 22 0 0 0-3.393-6.319l-.198.199a1 1 0 0 1-1.4 0l-.219.169L6.619 20.38a1 1 0 1 1-3-3l7.912-7.912.169.232a1 1 0 0 1 0-1.4l.198-.197A22 22 0 0 0 5.58 4.71a1 1 0 0 1-.119-1.752 12.5 12.5 0 0 1 10.225 1.356Z"/>
-  </g></g>
-</svg>