skybridge 0.0.0-dev.ccf1ae1 → 0.0.0-dev.cd1bd15

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Alpic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/bin/run.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+
+import { execute } from "@oclif/core";
+
+await execute({ dir: import.meta.url });

package/dist/{src/server → server}/index.d.ts

@@ -1,4 +1,3 @@
-export { devtoolsStaticServer } from "./devtoolsStaticServer.js";
 export type { AnyToolRegistry, InferTools, ToolInput, ToolNames, ToolOutput, ToolResponseMetadata, } from "./inferUtilityTypes.js";
 export type { McpServerTypes, ToolDef, WidgetHostType } from "./server.js";
 export { McpServer } from "./server.js";

package/dist/{src/server → server}/index.js

@@ -1,4 +1,3 @@
-export { devtoolsStaticServer } from "./devtoolsStaticServer.js";
 export { McpServer } from "./server.js";
 export { widgetsDevServer } from "./widgetsDevServer.js";
 //# sourceMappingURL=index.js.map

package/dist/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/server/inferUtilityTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inferUtilityTypes.js","sourceRoot":"","sources":["../../src/server/inferUtilityTypes.ts"],"names":[],"mappings":""}

package/dist/{src/server → server}/server.d.ts

@@ -1,3 +1,4 @@
+import type { McpUiResourceMeta } from "@modelcontextprotocol/ext-apps";
 import { McpServer as McpServerBase, type RegisteredTool } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { AnySchema, SchemaOutput, ZodRawShapeCompat } from "@modelcontextprotocol/sdk/server/zod-compat.js";
 import type { RequestHandlerExtra } from "@modelcontextprotocol/sdk/shared/protocol.js";
@@ -7,8 +8,34 @@ export type ToolDef<TInput = unknown, TOutput = unknown, TResponseMetadata = unk
     output: TOutput;
     responseMetadata: TResponseMetadata;
 };
+/**
+ * Extended MCP Apps CSP with upcoming fields from ext-apps PR #158
+ * and Skybridge-specific fields for OpenAI compatibility
+ * @see https://github.com/modelcontextprotocol/ext-apps/pull/158
+ */
+type ExtendedMcpUiResourceCsp = McpUiResourceMeta["csp"] & {
+    /** Origins allowed for nested iframe embeds */
+    frameDomains?: string[];
+    /** Origins permitted for the <base> tag URI directive */
+    baseUriDomains?: string[];
+    /**
+     * Origins that can receive openExternal redirects without safe-link modal (OpenAI-specific)
+     * @see https://developers.openai.com/apps-sdk/reference#component-resource-_meta-fields
+     */
+    redirectDomains?: string[];
+};
+/** Extended MCP Apps resource metadata with upcoming CSP fields */
+type ExtendedMcpUiResourceMeta = Omit<McpUiResourceMeta, "csp"> & {
+    csp?: ExtendedMcpUiResourceCsp;
+};
+/** User-provided resource configuration with optional CSP override */
+export type WidgetResourceMeta = {
+    ui?: ExtendedMcpUiResourceMeta;
+} & Resource["_meta"];
 export type WidgetHostType = "apps-sdk" | "mcp-app";
-type McpServerOriginalResourceConfig = Omit<Resource, "uri" | "name" | "mimeType">;
+type McpServerOriginalResourceConfig = Omit<Resource, "uri" | "name" | "mimeType" | "_meta"> & {
+    _meta?: WidgetResourceMeta;
+};
 type McpServerOriginalToolConfig = Omit<Parameters<typeof McpServerBase.prototype.registerTool<ZodRawShapeCompat, ZodRawShapeCompat>>[1], "inputSchema" | "outputSchema">;
 type Simplify<T> = {
     [K in keyof T]: T[K];

package/dist/server/server.js

@@ -0,0 +1,130 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { McpServer as McpServerBase, } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { toMerged } from "es-toolkit";
+import { templateHelper } from "./templateHelper.js";
+export class McpServer extends McpServerBase {
+    registerWidget(name, resourceConfig, toolConfig, toolCallback) {
+        const userMeta = resourceConfig._meta;
+        const appsSdkResourceConfig = {
+            hostType: "apps-sdk",
+            uri: `ui://widgets/apps-sdk/${name}.html`,
+            mimeType: "text/html+skybridge",
+            buildContentMeta: ({ resourceDomains, connectDomains, domain }) => {
+                const userUi = userMeta?.ui;
+                const userCsp = userUi?.csp;
+                const defaults = {
+                    "openai/widgetCSP": {
+                        resource_domains: resourceDomains,
+                        connect_domains: connectDomains,
+                    },
+                    "openai/widgetDomain": domain,
+                    "openai/widgetDescription": toolConfig.description,
+                };
+                const fromUi = {
+                    "openai/widgetCSP": {
+                        resource_domains: userCsp?.resourceDomains,
+                        connect_domains: userCsp?.connectDomains,
+                        frame_domains: userCsp?.frameDomains,
+                        redirect_domains: userCsp?.redirectDomains,
+                    },
+                    "openai/widgetDomain": userUi?.domain,
+                    "openai/widgetPrefersBorder": userUi?.prefersBorder,
+                };
+                const directOpenaiKeys = Object.fromEntries(Object.entries(userMeta ?? {}).filter(([key]) => key.startsWith("openai/")));
+                return toMerged(toMerged(defaults, fromUi), directOpenaiKeys);
+            },
+        };
+        const extAppsResourceConfig = {
+            hostType: "mcp-app",
+            uri: `ui://widgets/ext-apps/${name}.html`,
+            mimeType: "text/html;profile=mcp-app",
+            buildContentMeta: ({ resourceDomains, connectDomains, domain }) => {
+                const defaults = {
+                    ui: {
+                        csp: {
+                            resourceDomains,
+                            connectDomains,
+                        },
+                        domain,
+                    },
+                };
+                return toMerged(defaults, { ui: userMeta?.ui });
+            },
+        };
+        [appsSdkResourceConfig, extAppsResourceConfig].forEach((widgetConfig) => {
+            this.registerWidgetResource({
+                name,
+                widgetConfig,
+                resourceConfig,
+            });
+        });
+        const toolMeta = {
+            ...toolConfig._meta,
+            "openai/outputTemplate": appsSdkResourceConfig.uri,
+            ui: {
+                resourceUri: extAppsResourceConfig.uri,
+            },
+        };
+        this.registerTool(name, {
+            ...toolConfig,
+            _meta: toolMeta,
+        }, toolCallback);
+        return this;
+    }
+    registerTool(name, config, cb) {
+        super.registerTool(name, config, cb);
+        return this;
+    }
+    registerWidgetResource({ name, widgetConfig, resourceConfig, }) {
+        const { hostType, uri: widgetUri, mimeType, buildContentMeta, } = widgetConfig;
+        this.registerResource(name, widgetUri, { ...resourceConfig, _meta: resourceConfig._meta }, async (uri, extra) => {
+            const isProduction = process.env.NODE_ENV === "production";
+            const serverUrl = isProduction
+                ? `https://${extra?.requestInfo?.headers?.["x-forwarded-host"] ?? extra?.requestInfo?.headers?.host}`
+                : "http://localhost:3000";
+            const wsServerUrl = serverUrl.replace(/^http/, "ws");
+            const html = isProduction
+                ? templateHelper.renderProduction({
+                    hostType,
+                    serverUrl,
+                    widgetFile: this.lookupDistFileWithIndexFallback(`src/widgets/${name}`),
+                    styleFile: this.lookupDistFile("style.css"),
+                })
+                : templateHelper.renderDevelopment({
+                    hostType,
+                    serverUrl,
+                    widgetName: name,
+                });
+            const connectDomains = [serverUrl, wsServerUrl];
+            if (!isProduction) {
+                const VITE_HMR_WEBSOCKET_DEFAULT_URL = "ws://localhost:24678";
+                connectDomains.push(VITE_HMR_WEBSOCKET_DEFAULT_URL);
+            }
+            const contentMeta = buildContentMeta({
+                resourceDomains: [serverUrl],
+                connectDomains,
+                domain: serverUrl,
+            });
+            return {
+                contents: [
+                    { uri: uri.href, mimeType, text: html, _meta: contentMeta },
+                ],
+            };
+        });
+    }
+    lookupDistFile(key) {
+        const manifest = this.readManifest();
+        return manifest[key]?.file;
+    }
+    lookupDistFileWithIndexFallback(basePath) {
+        const manifest = this.readManifest();
+        const flatFileKey = `${basePath}.tsx`;
+        const indexFileKey = `${basePath}/index.tsx`;
+        return manifest[flatFileKey]?.file ?? manifest[indexFileKey]?.file;
+    }
+    readManifest() {
+        return JSON.parse(readFileSync(path.join(process.cwd(), "dist", "assets", ".vite", "manifest.json"), "utf-8"));
+    }
+}
+//# sourceMappingURL=server.js.map

package/dist/server/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAK7B,OAAO,EACL,SAAS,IAAI,aAAa,GAG3B,MAAM,yCAAyC,CAAC;AAcjD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA8KrD,MAAM,OAAO,SAEX,SAAQ,aAAa;IAGrB,cAAc,CAKZ,IAAW,EACX,cAA+C,EAC/C,UAGC,EACD,YAA0C;QAQ1C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC;QAEtC,MAAM,qBAAqB,GAA6C;YACtE,QAAQ,EAAE,UAAU;YACpB,GAAG,EAAE,yBAAyB,IAAI,OAAO;YACzC,QAAQ,EAAE,qBAAqB;YAC/B,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;gBAChE,MAAM,MAAM,GAAG,QAAQ,EAAE,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,GAAG,CAAC;gBAE5B,MAAM,QAAQ,GAAuB;oBACnC,kBAAkB,EAAE;wBAClB,gBAAgB,EAAE,eAAe;wBACjC,eAAe,EAAE,cAAc;qBAChC;oBACD,qBAAqB,EAAE,MAAM;oBAC7B,0BAA0B,EAAE,UAAU,CAAC,WAAW;iBACnD,CAAC;gBAEF,MAAM,MAAM,GAOR;oBACF,kBAAkB,EAAE;wBAClB,gBAAgB,EAAE,OAAO,EAAE,eAAe;wBAC1C,eAAe,EAAE,OAAO,EAAE,cAAc;wBACxC,aAAa,EAAE,OAAO,EAAE,YAAY;wBACpC,gBAAgB,EAAE,OAAO,EAAE,eAAe;qBAC3C;oBACD,qBAAqB,EAAE,MAAM,EAAE,MAAM;oBACrC,4BAA4B,EAAE,MAAM,EAAE,aAAa;iBACpD,CAAC;gBAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,CACzC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAC9C,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAC1B,CACF,CAAC;gBAEF,OAAO,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAChE,CAAC;SACF,CAAC;QAEF,MAAM,qBAAqB,GAA8C;YACvE,QAAQ,EAAE,SAAS;YACnB,GAAG,EAAE,yBAAyB,IAAI,OAAO;YACzC,QAAQ,EAAE,2BAA2B;YACrC,gBAAgB,EAAE,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,EAAE;gBAChE,MAAM,QAAQ,GAAwB;oBACpC,EAAE,EAAE;wBACF,GAAG,EAAE;4BACH,eAAe;4BACf,cAAc;yBACf;wBACD,MAAM;qBACP;iBACF,CAAC;gBAEF,OAAO,QAAQ,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAClD,CAAC;SACF,CAAC;QAEF,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;YACtE,IAAI,CAAC,sBAAsB,CAAC;gBAC1B,IAAI;gBACJ,YAAY;gBACZ,cAAc;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAa;YACzB,GAAG,UAAU,CAAC,KAAK;YACnB,uBAAuB,EAAE,qBAAqB,CAAC,GAAG;YAClD,EAAE,EAAE;gBACF,WAAW,EAAE,qBAAqB,CAAC,GAAG;aACvC;SACF,CAAC;QAEF,IAAI,CAAC,YAAY,CACf,IAAI,EACJ;YACE,GAAG,UAAU;YACb,KAAK,EAAE,QAAQ;SAChB,EACD,YAAY,CACb,CAAC;QAEF,OAAO,IAMN,CAAC;IACJ,CAAC;IAwBQ,YAAY,CACnB,IAAY,EACZ,MAA6B,EAC7B,EAA2B;QAE3B,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,EAC7B,IAAI,EACJ,YAAY,EACZ,cAAc,GAKf;QACC,MAAM,EACJ,QAAQ,EACR,GAAG,EAAE,SAAS,EACd,QAAQ,EACR,gBAAgB,GACjB,GAAG,YAAY,CAAC;QAEjB,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,SAAS,EACT,EAAE,GAAG,cAAc,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,EAClD,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACnB,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;YAE3D,MAAM,SAAS,GAAG,YAAY;gBAC5B,CAAC,CAAC,WAAW,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,IAAI,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE;gBACrG,CAAC,CAAC,uBAAuB,CAAC;YAE5B,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAErD,MAAM,IAAI,GAAG,YAAY;gBACvB,CAAC,CAAC,cAAc,CAAC,gBAAgB,CAAC;oBAC9B,QAAQ;oBACR,SAAS;oBACT,UAAU,EAAE,IAAI,CAAC,+BAA+B,CAC9C,eAAe,IAAI,EAAE,CACtB;oBACD,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC;iBAC5C,CAAC;gBACJ,CAAC,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC/B,QAAQ;oBACR,SAAS;oBACT,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YAEP,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAChD,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,8BAA8B,GAAG,sBAAsB,CAAC;gBAC9D,cAAc,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,WAAW,GAAG,gBAAgB,CAAC;gBACnC,eAAe,EAAE,CAAC,SAAS,CAAC;gBAC5B,cAAc;gBACd,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YAEH,OAAO;gBACL,QAAQ,EAAE;oBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC5D;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC;IAC7B,CAAC;IAEO,+BAA+B,CAAC,QAAgB;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAErC,MAAM,WAAW,GAAG,GAAG,QAAQ,MAAM,CAAC;QACtC,MAAM,YAAY,GAAG,GAAG,QAAQ,YAAY,CAAC;QAC7C,OAAO,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC;IACrE,CAAC;IAEO,YAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CACf,YAAY,CACV,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,eAAe,CAAC,EACpE,OAAO,CACR,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/server/templateHelper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templateHelper.js","sourceRoot":"","sources":["../../src/server/templateHelper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAGpC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,cAAc;IACV,aAAa,GAAG,IAAI,GAAG,EAAsC,CAAC;IAE9D,YAAY,CAAC,YAAoB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,YAAY,MAAM,CAAC,CAAC;QACzE,MAAM,cAAc,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAEpD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC/C,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,gBAAgB,CAAC,IAKhB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,iBAAiB,CAAC,IAIjB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC"}

package/dist/server/templates/development.hbs

@@ -0,0 +1,66 @@
+<base href="{{serverUrl}}" />
+<script type="module">window.skybridge = { hostType: "{{hostType}}" };</script>
+<script type="module">
+  import { injectIntoGlobalHook } from "{{serverUrl}}/assets/@react-refresh";
+  injectIntoGlobalHook(window); window.$RefreshReg$ = () => {};
+  window.$RefreshSig$ = () => (type) => type;
+  window.__vite_plugin_react_preamble_installed__ = true;
+</script>
+<script type="module" src="{{serverUrl}}/@vite/client"></script>
+<script type="module">
+  // Checks for browser support and shows error if local network access is denied
+  (async () => {
+    if (!navigator.permissions?.query) {
+      return;
+    }
+
+    // Skip for non-http(s) protocols (file://, custom protocols in Electron, etc.)
+    const protocol = window.location.protocol;
+    const isNonHttpProtocol = protocol !== 'http:' && protocol !== 'https:'
+    if (isNonHttpProtocol) {
+      return;
+    }
+
+    const host = window.location.hostname;
+    const isLoopback = host === 'localhost'
+      || /^127\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.test(host)
+      || host === '::1';
+    if (isLoopback) {
+      return;
+    }
+    
+    try {
+      const status = await navigator.permissions.query({ name: "local-network-access" });
+      if (status.state === "denied") {
+        const errorDiv = document.createElement("div");
+        errorDiv.style.cssText = "background: #fef2f2; border: 2px solid #ef4444; border-radius: 8px; padding: 16px; text-align: center; z-index: 10000; font-family: system-ui, sans-serif;";
+
+        const errorTitle = document.createElement("div");
+        errorTitle.style.cssText = "color: #ef4444; font-size: 18px; font-weight: 600; margin-bottom: 8px;";
+        errorTitle.textContent = "Error: Local network access permission is denied.";
+
+        const errorMessage = document.createElement("div");
+        errorMessage.style.cssText = "color: #ef4444; font-size: 14px;";
+        errorMessage.textContent = "Local network access is required for your widget to connect to the local dev server. Please enable it in your browser settings. ";
+
+        const link = document.createElement("a");
+        link.href = "https://developer.chrome.com/blog/local-network-access";
+        link.target = "_blank";
+        link.rel = "noopener noreferrer";
+        link.style.cssText = "color: #ef4444; text-decoration: underline;";
+        link.textContent = "Learn more";
+        errorMessage.appendChild(link);
+
+        errorDiv.appendChild(errorTitle);
+        errorDiv.appendChild(errorMessage);
+        document.body.appendChild(errorDiv);
+      }
+    } catch (e) {
+      // Permission API doesn't support local-network-access, ignore silently
+    }
+  })();
+</script>
+<div id="root"></div>
+<script type="module" id="dev-widget-entry">
+  import('{{serverUrl}}/src/widgets/{{widgetName}}');
+</script>

package/dist/{src/server → server}/widgetsDevServer.d.ts

@@ -1,4 +1,4 @@
-import { type RequestHandler } from "express";
+import { type Router } from "express";
 /**
  * Install Vite dev server
  * This router MUST be installed at the application root, like so:
@@ -9,4 +9,4 @@ import { type RequestHandler } from "express";
  *   app.use(await widgetsRouter());
  * }
  */
-export declare const widgetsDevServer: () => Promise<RequestHandler>;
+export declare const widgetsDevServer: () => Promise<Router>;

package/dist/{src/server → server}/widgetsDevServer.js

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import path from "node:path";
 import cors from "cors";
 import express, {} from "express";
@@ -14,10 +15,17 @@ import express, {} from "express";
 export const widgetsDevServer = async () => {
     const router = express.Router();
     const { createServer, searchForWorkspaceRoot, loadConfigFromFile } = await import("vite");
-    const workspaceRoot = searchForWorkspaceRoot(process.cwd());
-    const webAppRoot = path.join(workspaceRoot, "web");
+    // Since 0.16.0, the template is a single package that does not rely on workspace.
+    // It means that, when starting the server, the working dir is the template root
+    // hence we don't need to walk up the tree to find the workspace, which does not exist anymore.
+    let webAppRoot = path.join(process.cwd(), "web");
+    // fallback to the old behavior for backward compatibility
+    const hasWebAppRoot = existsSync(webAppRoot);
+    if (!hasWebAppRoot) {
+        const workspaceRoot = searchForWorkspaceRoot(process.cwd());
+        webAppRoot = path.join(workspaceRoot, "web");
+    }
     const configResult = await loadConfigFromFile({ command: "serve", mode: "development" }, path.join(webAppRoot, "vite.config.ts"), webAppRoot);
-    // biome-ignore lint/correctness/noUnusedVariables: Remove build-specific options that don't apply to dev server
     const { build, preview, ...devConfig } = configResult?.config || {};
     const vite = await createServer({
         ...devConfig,

package/dist/server/widgetsDevServer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widgetsDevServer.js","sourceRoot":"","sources":["../../src/server/widgetsDevServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,IAAqB,EAAE;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,GAChE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAEvB,kFAAkF;IAClF,gFAAgF;IAChF,+FAA+F;IAC/F,IAAI,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAEjD,0DAA0D;IAC1D,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EACvC,UAAU,CACX,CAAC;IAEF,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAEpE,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,UAAU,EAAE,KAAK,EAAE,kFAAkF;QACrG,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;SACrB;QACD,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE;YACZ,OAAO,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;SACvC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/test/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/test/utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;GAEG;AACH,MAAM,UAAU,mBAAmB;IAKjC,mCAAmC;IACnC,MAAM,MAAM,GAAG,IAAI,SAAS,CAC1B;QACE,IAAI,EAAE,kBAAkB;QACxB,OAAO,EAAE,OAAO;KACjB,EACD,EAAE,YAAY,EAAE,EAAE,EAAE,CACrB,CAAC;IAEF,6CAA6C;IAC7C,MAAM,oBAAoB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAE1D,OAAO;QACL,MAAM;QACN,oBAAoB;QACpB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;SAC7D,cAAc,CACb,eAAe,EACf,EAAE,EACF;QACE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACpC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAChC;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;gBACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;gBACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;aAClB,CAAC,CACH;YACD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SACvB;KACF,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QACxB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,WAAW,EAAE,EAAE,CAAC;YAClE,iBAAiB,EAAE;gBACjB,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACjD,UAAU,EAAE,CAAC;aACd;SACF,CAAC;IACJ,CAAC,CACF;SACA,cAAc,CACb,kBAAkB,EAClB,EAAE,EACF;QACE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC5B;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YAC1D,iBAAiB,EAAE;gBACjB,IAAI,EAAE,MAAM;gBACZ,WAAW,EAAE,cAAc;gBAC3B,MAAM,EAAE,CAAC,YAAY,CAAC;aACvB;SACF,CAAC;IACJ,CAAC,CACF;SACA,cAAc,CACb,iBAAiB,EACjB,EAAE,EACF;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE,EAAE;QACf,YAAY,EAAE,EAAE;KACjB,EACD,KAAK,IAAI,EAAE;QACT,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YACpD,iBAAiB,EAAE,EAAE;SACtB,CAAC;IACJ,CAAC,CACF;SACA,cAAc,CACb,wBAAwB,EACxB,EAAE,EACF;QACE,WAAW,EAAE,2CAA2C;QACxD,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE;gBACjB,eAAe,EAAE,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;gBACpD,aAAa,EAAE,CAAC;aACjB;SACF,CAAC;IACJ,CAAC,CACF;SACA,YAAY,CACX,iBAAiB,EACjB;QACE,WAAW,EAAE,sBAAsB;QACnC,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SACvB;QACD,YAAY,EAAE;YACZ,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;SACrB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE;QAC/B,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,MAAM,EAAE,EAAE,CAAC;YACxD,iBAAiB,EAAE;gBACjB,UAAU,EAAE,IAAI,GAAG,UAAU;gBAC7B,QAAQ,EAAE,KAAK;aAChB;SACF,CAAC;IACJ,CAAC,CACF;SACA,YAAY,CACX,eAAe,EACf;QACE,WAAW,EAAE,yCAAyC;QACtD,WAAW,EAAE;YACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SACnB;KACF,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACnB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE;gBACjB,WAAW,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE;gBACvD,SAAS,EAAE,YAAY;aACxB;SACF,CAAC;IACJ,CAAC,CACF;SACA,cAAc,CACb,sBAAsB,EACtB,EAAE,EACF;QACE,WAAW,EAAE,uCAAuC;QACpD,WAAW,EAAE;YACX,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;SACvB;KACF,EACD,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACvB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,UAAU,EAAE,EAAE,CAAC;YAC5D,iBAAiB,EAAE;gBACjB,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE;aACvC;YACD,KAAK,EAAE;gBACL,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,KAAK;aACd;SACF,CAAC;IACJ,CAAC,CACF;SACA,YAAY,CACX,oBAAoB,EACpB;QACE,WAAW,EAAE,qCAAqC;QAClD,WAAW,EAAE;YACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;SAClB;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QAClB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;YACpD,iBAAiB,EAAE;gBACjB,OAAO,EAAE,CAAC,KAAK,CAAC;aACjB;YACD,KAAK,EAAE;gBACL,aAAa,EAAE,GAAG;gBAClB,MAAM,EAAE,OAAO;aAChB;SACF,CAAC;IACJ,CAAC,CACF;SACA,cAAc,CACb,2BAA2B,EAC3B,EAAE,EACF;QACE,WAAW,EACT,gEAAgE;QAClE,WAAW,EAAE;YACX,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;SAC3B;KACF,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;QAC1B,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,wBAAwB;YACxB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;gBACnD,iBAAiB,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE;aACrD,CAAC;QACJ,CAAC;QACD,2BAA2B;QAC3B,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC5C,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACrC,KAAK,EAAE;gBACL,WAAW,EAAE,aAAa;gBAC1B,MAAM,EAAE,WAAW;aACpB;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACN,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,OAAO,IAAI,SAAS,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,EACtC,EAAE,CACH,CAAC,cAAc,CACd,eAAe,EACf,EAAE,EACF;QACE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE;YACX,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;SACxB;QACD,YAAY,EAAE;YACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SAC/C;KACF,EACD,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE;QACxB,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,WAAW,EAAE,EAAE,CAAC;YAClE,iBAAiB,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;SAC9C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,yBAAyB;IACvC,OAAO,IAAI,SAAS,CAClB,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,OAAO,EAAE,EAChD,EAAE,CACH,CAAC,cAAc,CAKd,kBAAkB,EAClB,EAAE,EACF;QACE,WAAW,EAAE,oCAAoC;QACjD,WAAW,EAAE;YACX,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;SACf;KACF,EACD,KAAK,EAAE,EAAE,EAAE,EAAE,EAAgC,EAAE;QAC7C,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC/C,iBAAiB,EAAE;gBACjB,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,EAAE;aACb;YACD,KAAK,EAAE;gBACL,WAAW,EAAE,MAAM;gBACnB,OAAO,EAAE,CAAC;aACX;SACF,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO;QACL,WAAW,EAAE;YACX,OAAO,EAAE,EAAE,IAAI,EAAE;SAClB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU,CAAC,GAA2B;IACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9B,CAAC"}

package/dist/{src/test → test}/widget.test.js

@@ -5,15 +5,12 @@ const mockManifest = {
     "src/widgets/folder-widget/index.tsx": { file: "folder-widget.js" },
     "style.css": { file: "style.css" },
 };
-vi.mock("node:fs", async () => {
-    const actual = await vi.importActual("node:fs");
+const actual = vi.hoisted(() => require("node:fs"));
+vi.mock("node:fs", () => {
     const readFileSyncImpl = (path, ...args) => {
         if (typeof path === "string" && path.includes("manifest.json")) {
             return JSON.stringify(mockManifest);
         }
-        // Type assertion needed because readFileSync has overloads with different parameter types
-        // Using @ts-expect-error because the overloads are complex and we're forwarding args
-        // @ts-expect-error - readFileSync overloads require complex type handling
         return actual.readFileSync(path, ...args);
     };
     const readFileSync = vi.fn(readFileSyncImpl);
@@ -56,11 +53,23 @@ describe("McpServer.registerWidget", () => {
                     uri: "ui://widgets/apps-sdk/my-widget.html",
                     mimeType: "text/html+skybridge",
                     text: expect.stringContaining('<div id="root"></div>'),
+                    _meta: {
+                        "openai/widgetCSP": {
+                            resource_domains: [serverUrl],
+                            connect_domains: [
+                                serverUrl,
+                                "ws://localhost:3000",
+                                "ws://localhost:24678",
+                            ],
+                        },
+                        "openai/widgetDomain": serverUrl,
+                        "openai/widgetDescription": "Test tool",
+                    },
                 },
             ],
         });
         // Check development-specific content
-        expect(result.contents[0]?.text).toContain(`${serverUrl}/@react-refresh`);
+        expect(result.contents[0]?.text).toContain(`${serverUrl}/assets/@react-refresh`);
         expect(result.contents[0]?.text).toContain(`${serverUrl}/@vite/client`);
         expect(result.contents[0]?.text).toContain(`${serverUrl}/src/widgets/my-widget`);
         expect(result.contents[0]?.text).not.toContain(`${serverUrl}/src/widgets/my-widget.tsx`);
@@ -75,8 +84,9 @@ describe("McpServer.registerWidget", () => {
         const appsSdkResourceCallback = mockRegisterResource.mock
             .calls[0]?.[3];
         expect(appsSdkResourceCallback).toBeDefined();
-        const serverUrl = "https://myapp.com";
-        const mockExtra = createMockExtra(serverUrl);
+        const host = "myapp.com";
+        const serverUrl = `https://${host}`;
+        const mockExtra = createMockExtra(host);
         const result = await appsSdkResourceCallback(new URL("ui://widgets/apps-sdk/my-widget.html"), mockExtra);
         expect(result).toEqual({
             contents: [
@@ -84,11 +94,19 @@ describe("McpServer.registerWidget", () => {
                     uri: "ui://widgets/apps-sdk/my-widget.html",
                     mimeType: "text/html+skybridge",
                     text: expect.stringContaining('<div id="root"></div>'),
+                    _meta: {
+                        "openai/widgetCSP": {
+                            resource_domains: [serverUrl],
+                            connect_domains: [serverUrl, `wss://${host}`],
+                        },
+                        "openai/widgetDomain": serverUrl,
+                        "openai/widgetDescription": "Test tool",
+                    },
                 },
             ],
         });
         // Check production-specific content
-        expect(result.contents[0]?.text).not.toContain(`${serverUrl}@react-refresh`);
+        expect(result.contents[0]?.text).not.toContain(`${serverUrl}/assets/@react-refresh`);
         expect(result.contents[0]?.text).not.toContain(`${serverUrl}@vite/client`);
         expect(result.contents[0]?.text).toContain(`${serverUrl}/assets/my-widget.js`);
         expect(result.contents[0]?.text).toContain(`${serverUrl}/assets/style.css`);
@@ -102,15 +120,19 @@ describe("McpServer.registerWidget", () => {
         const appsSdkResourceCallback = mockRegisterResource.mock
             .calls[0]?.[3];
         expect(appsSdkResourceCallback).toBeDefined();
-        const serverUrl = "https://myapp.com";
-        const mockExtra = createMockExtra(serverUrl);
+        const host = "myapp.com";
+        const serverUrl = `https://${host}`;
+        const mockExtra = createMockExtra(host);
         const result = await appsSdkResourceCallback(new URL("ui://widgets/apps-sdk/folder-widget.html"), mockExtra);
         // Should resolve to folder-widget.js from the manifest entry "src/widgets/folder-widget/index.tsx"
         expect(result.contents[0]?.text).toContain(`${serverUrl}/assets/folder-widget.js`);
     });
     it("should register resources with correct hostType for both apps-sdk and ext-apps formats", async () => {
         const mockToolCallback = vi.fn();
-        const mockRegisterResourceConfig = { description: "Test widget" };
+        const mockRegisterResourceConfig = {
+            description: "Test widget",
+            _meta: { "openai/widgetPrefersBorder": true },
+        };
         const mockToolConfig = { description: "Test tool" };
         server.registerWidget("my-widget", mockRegisterResourceConfig, mockToolConfig, mockToolCallback);
         expect(mockRegisterResource).toHaveBeenCalledTimes(2);
@@ -123,6 +145,19 @@ describe("McpServer.registerWidget", () => {
                     uri: "ui://widgets/apps-sdk/my-widget.html",
                     mimeType: "text/html+skybridge",
                     text: expect.stringContaining('<div id="root"></div>'),
+                    _meta: {
+                        "openai/widgetCSP": {
+                            resource_domains: ["http://localhost:3000"],
+                            connect_domains: [
+                                "http://localhost:3000",
+                                "ws://localhost:3000",
+                                "ws://localhost:24678",
+                            ],
+                        },
+                        "openai/widgetDomain": "http://localhost:3000",
+                        "openai/widgetDescription": "Test tool",
+                        "openai/widgetPrefersBorder": true,
+                    },
                 },
             ],
         });
@@ -137,10 +172,79 @@ describe("McpServer.registerWidget", () => {
                     uri: "ui://widgets/ext-apps/my-widget.html",
                     mimeType: "text/html;profile=mcp-app",
                     text: expect.stringContaining('<div id="root"></div>'),
+                    _meta: {
+                        ui: {
+                            csp: {
+                                resourceDomains: ["http://localhost:3000"],
+                                connectDomains: [
+                                    "http://localhost:3000",
+                                    "ws://localhost:3000",
+                                    "ws://localhost:24678",
+                                ],
+                            },
+                            domain: "http://localhost:3000",
+                        },
+                    },
                 },
             ],
         });
         expect(extAppsResult.contents[0]?.text).toContain('window.skybridge = { hostType: "mcp-app" }');
     });
+    it("should register tool with ui.resourceUri metadata (not deprecated ui/resourceUri)", async () => {
+        const mockToolCallback = vi.fn();
+        const mockRegisterResourceConfig = { description: "Test widget" };
+        const mockToolConfig = { description: "Test tool" };
+        server.registerWidget("my-widget", mockRegisterResourceConfig, mockToolConfig, mockToolCallback);
+        expect(mockRegisterTool).toHaveBeenCalledTimes(1);
+        const toolCallArgs = mockRegisterTool.mock.calls[0];
+        const toolConfig = toolCallArgs?.[1];
+        expect(toolConfig._meta).toHaveProperty("ui");
+        expect(toolConfig._meta?.ui).toEqual({
+            resourceUri: "ui://widgets/ext-apps/my-widget.html",
+        });
+    });
+    it("should apply meta overrides in correct priority: defaults < ui.* < direct openai/* keys", async () => {
+        const mockToolCallback = vi.fn();
+        const mockRegisterResourceConfig = {
+            description: "Test widget",
+            _meta: {
+                // ui.csp overrides (middle priority)
+                ui: {
+                    csp: {
+                        resourceDomains: ["https://from-ui-csp.com"],
+                        connectDomains: ["https://from-ui-csp.com"],
+                    },
+                    domain: "https://from-ui-domain.com",
+                    prefersBorder: false,
+                },
+                // Direct openai/* keys (highest priority) - should override ui.*
+                "openai/widgetDomain": "https://direct-override.com",
+                "openai/widgetPrefersBorder": true,
+            },
+        };
+        const mockToolConfig = { description: "Test tool" };
+        server.registerWidget("override-test", mockRegisterResourceConfig, mockToolConfig, mockToolCallback);
+        const appsSdkCallback = mockRegisterResource.mock
+            .calls[0]?.[3];
+        const result = await appsSdkCallback(new URL("ui://widgets/apps-sdk/override-test.html"), createMockExtra("__not_used__"));
+        const meta = result.contents[0]?._meta;
+        // CSP arrays are merged by index - user value replaces at index 0, defaults remain at other indices
+        expect(meta["openai/widgetCSP"]).toEqual({
+            resource_domains: ["https://from-ui-csp.com"],
+            connect_domains: [
+                "https://from-ui-csp.com",
+                "ws://localhost:3000",
+                "ws://localhost:24678",
+            ],
+            frame_domains: undefined,
+            redirect_domains: undefined,
+        });
+        // Domain should be overridden by direct openai/* key (highest priority)
+        expect(meta["openai/widgetDomain"]).toBe("https://direct-override.com");
+        // PrefersBorder should be overridden by direct openai/* key (highest priority)
+        expect(meta["openai/widgetPrefersBorder"]).toBe(true);
+        // Description should be from defaults (toolConfig.description)
+        expect(meta["openai/widgetDescription"]).toBe("Test tool");
+    });
 });
 //# sourceMappingURL=widget.test.js.map

package/dist/test/widget.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget.test.js","sourceRoot":"","sources":["../../src/test/widget.test.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,SAAS,EACT,UAAU,EACV,QAAQ,EACR,MAAM,EACN,EAAE,EAEF,EAAE,GACH,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,UAAU,GACX,MAAM,YAAY,CAAC;AAEpB,MAAM,YAAY,GAAG;IACnB,2BAA2B,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE;IACrD,qCAAqC,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACnE,WAAW,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;CACnC,CAAC;AAEF,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;AAEpD,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;IACtB,MAAM,gBAAgB,GAAG,CACvB,IAA+C,EAC/C,GAAG,IAAe,EACsB,EAAE;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAEjC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,gBAAgB,CAA+B,CAAC;IAE3E,OAAO;QACL,YAAY;QACZ,OAAO,EAAE;YACP,YAAY;SACb;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,MAAiB,CAAC;IACtB,IAAI,oBAAiE,CAAC;IACtE,IAAI,gBAAyD,CAAC;IAE9D,UAAU,CAAC,GAAG,EAAE;QACd,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,gBAAgB,EAAE;YACjD,mBAAmB,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,aAAa,EAAE,CAAC;QACnB,YAAY,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,UAAU,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAExC,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,CAAC,cAAc,CACnB,WAAW,EACX,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,qCAAqC;QACrC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,IAAI;aACtD,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAKb,CAAC;QACH,MAAM,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,uBAAuB,CAAC;QAC1C,MAAM,SAAS,GAAG,eAAe,CAC/B,cAAc,CACsD,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,GAAG,CAAC,sCAAsC,CAAC,EAC/C,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,sCAAsC;oBAC3C,QAAQ,EAAE,qBAAqB;oBAC/B,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC;oBACtD,KAAK,EAAE;wBACL,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,CAAC,SAAS,CAAC;4BAC7B,eAAe,EAAE;gCACf,SAAS;gCACT,qBAAqB;gCACrB,sBAAsB;6BACvB;yBACF;wBACD,qBAAqB,EAAE,SAAS;wBAChC,0BAA0B,EAAE,WAAW;qBACxC;iBACF;aACF;SACF,CAAC,CAAC;QAEH,qCAAqC;QACrC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CACxC,GAAG,SAAS,wBAAwB,CACrC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,SAAS,eAAe,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CACxC,GAAG,SAAS,wBAAwB,CACrC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAC5C,GAAG,SAAS,4BAA4B,CACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,UAAU,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvC,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,CAAC,cAAc,CACnB,WAAW,EACX,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,qCAAqC;QACrC,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,IAAI;aACtD,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAKb,CAAC;QACH,MAAM,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,WAAW,CAAC;QACzB,MAAM,SAAS,GAAG,WAAW,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAGrC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,GAAG,CAAC,sCAAsC,CAAC,EAC/C,SAAS,CACV,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,sCAAsC;oBAC3C,QAAQ,EAAE,qBAAqB;oBAC/B,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC;oBACtD,KAAK,EAAE;wBACL,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,CAAC,SAAS,CAAC;4BAC7B,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC;yBAC9C;wBACD,qBAAqB,EAAE,SAAS;wBAChC,0BAA0B,EAAE,WAAW;qBACxC;iBACF;aACF;SACF,CAAC,CAAC;QAEH,oCAAoC;QACpC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAC5C,GAAG,SAAS,wBAAwB,CACrC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,cAAc,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CACxC,GAAG,SAAS,sBAAsB,CACnC,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,SAAS,mBAAmB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,UAAU,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAEvC,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;QACpE,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAEtD,MAAM,CAAC,cAAc,CACnB,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,IAAI;aACtD,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAKb,CAAC;QACH,MAAM,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,WAAW,CAAC;QACzB,MAAM,SAAS,GAAG,WAAW,IAAI,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAGrC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,GAAG,CAAC,0CAA0C,CAAC,EACnD,SAAS,CACV,CAAC;QAEF,mGAAmG;QACnG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CACxC,GAAG,SAAS,0BAA0B,CACvC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG;YACjC,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE;SAC9C,CAAC;QACF,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,CAAC,cAAc,CACnB,WAAW,EACX,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,MAAM,CAAC,oBAAoB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAEtD,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI;aAC9C,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAKb,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,eAAe,CACzC,IAAI,GAAG,CAAC,sCAAsC,CAAC,EAC/C,eAAe,CAAC,cAAc,CAG7B,CACF,CAAC;QAEF,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC;YAC5B,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,sCAAsC;oBAC3C,QAAQ,EAAE,qBAAqB;oBAC/B,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC;oBACtD,KAAK,EAAE;wBACL,kBAAkB,EAAE;4BAClB,gBAAgB,EAAE,CAAC,uBAAuB,CAAC;4BAC3C,eAAe,EAAE;gCACf,uBAAuB;gCACvB,qBAAqB;gCACrB,sBAAsB;6BACvB;yBACF;wBACD,qBAAqB,EAAE,uBAAuB;wBAC9C,0BAA0B,EAAE,WAAW;wBACvC,4BAA4B,EAAE,IAAI;qBACnC;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAC/C,6CAA6C,CAC9C,CAAC;QAEF,MAAM,uBAAuB,GAAG,oBAAoB,CAAC,IAAI;aACtD,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAUb,CAAC;QACH,MAAM,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,aAAa,GAAG,MAAM,uBAAuB,CACjD,IAAI,GAAG,CAAC,sCAAsC,CAAC,EAC/C,eAAe,CAAC,cAAc,CAG7B,CACF,CAAC;QAEF,MAAM,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC;YAC5B,QAAQ,EAAE;gBACR;oBACE,GAAG,EAAE,sCAAsC;oBAC3C,QAAQ,EAAE,2BAA2B;oBACrC,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC;oBACtD,KAAK,EAAE;wBACL,EAAE,EAAE;4BACF,GAAG,EAAE;gCACH,eAAe,EAAE,CAAC,uBAAuB,CAAC;gCAC1C,cAAc,EAAE;oCACd,uBAAuB;oCACvB,qBAAqB;oCACrB,sBAAsB;iCACvB;6BACF;4BACD,MAAM,EAAE,uBAAuB;yBAChC;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,CAC/C,4CAA4C,CAC7C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,CAAC,cAAc,CACnB,WAAW,EACX,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAElD,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,UAAU,GAAG,YAAY,EAAE,CAAC,CAAC,CAAwC,CAAC;QAE5E,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;YACnC,WAAW,EAAE,sCAAsC;SACpD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,0BAA0B,GAAG;YACjC,WAAW,EAAE,aAAa;YAC1B,KAAK,EAAE;gBACL,qCAAqC;gBACrC,EAAE,EAAE;oBACF,GAAG,EAAE;wBACH,eAAe,EAAE,CAAC,yBAAyB,CAAC;wBAC5C,cAAc,EAAE,CAAC,yBAAyB,CAAC;qBAC5C;oBACD,MAAM,EAAE,4BAA4B;oBACpC,aAAa,EAAE,KAAK;iBACrB;gBACD,iEAAiE;gBACjE,qBAAqB,EAAE,6BAA6B;gBACpD,4BAA4B,EAAE,IAAI;aACnC;SACF,CAAC;QACF,MAAM,cAAc,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;QAEpD,MAAM,CAAC,cAAc,CACnB,eAAe,EACf,0BAA0B,EAC1B,cAAc,EACd,gBAAgB,CACjB,CAAC;QAEF,MAAM,eAAe,GAAG,oBAAoB,CAAC,IAAI;aAC9C,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAUb,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,eAAe,CAClC,IAAI,GAAG,CAAC,0CAA0C,CAAC,EACnD,eAAe,CAAC,cAAc,CAG7B,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAgC,CAAC;QAElE,oGAAoG;QACpG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YACvC,gBAAgB,EAAE,CAAC,yBAAyB,CAAC;YAC7C,eAAe,EAAE;gBACf,yBAAyB;gBACzB,qBAAqB;gBACrB,sBAAsB;aACvB;YACD,aAAa,EAAE,SAAS;YACxB,gBAAgB,EAAE,SAAS;SAC5B,CAAC,CAAC;QAEH,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAExE,+EAA+E;QAC/E,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,+DAA+D;QAC/D,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/{src/web → web}/bridges/adaptors/apps-sdk-adaptor.d.ts

@@ -9,4 +9,5 @@ export declare class AppsSdkAdaptor implements Adaptor {
         mode: DisplayMode;
     }>;
     sendFollowUpMessage: (prompt: string) => Promise<void>;
+    openExternal(href: string): void;
 }

package/dist/{src/web → web}/bridges/adaptors/apps-sdk-adaptor.js

@@ -26,5 +26,8 @@ export class AppsSdkAdaptor {
     sendFollowUpMessage = (prompt) => {
         return window.openai.sendFollowUpMessage({ prompt });
     };
+    openExternal(href) {
+        window.openai.openExternal({ href });
+    }
 }
 //# sourceMappingURL=apps-sdk-adaptor.js.map

package/dist/web/bridges/adaptors/apps-sdk-adaptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-sdk-adaptor.js","sourceRoot":"","sources":["../../../../src/web/bridges/adaptors/apps-sdk-adaptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAStD,MAAM,OAAO,cAAc;IACjB,MAAM,CAAC,QAAQ,GAA0B,IAAI,CAAC;IAE/C,MAAM,CAAC,WAAW;QACvB,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC7B,cAAc,CAAC,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,cAAc,CAAC,QAAQ,CAAC;IACjC,CAAC;IAEM,MAAM,CAAC,aAAa;QACzB,cAAc,CAAC,QAAQ,GAAG,IAAI,CAAC;IACjC,CAAC;IAEM,gBAAgB,CACrB,GAAM;QAEN,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAC3C,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;YAChC,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC;SAC3C,CAAC;IACJ,CAAC;IAEM,QAAQ,GAAG,KAAK,EAIrB,IAAY,EACZ,IAAc,EACS,EAAE;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAyB,IAAI,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC,CAAC;IAEK,kBAAkB,GAAG,CAC1B,IAAiB,EACe,EAAE;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;IAEK,mBAAmB,GAAG,CAAC,MAAc,EAAiB,EAAE;QAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;IAEK,YAAY,CAAC,IAAY;QAC9B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC"}

package/dist/{src/web → web}/bridges/adaptors/mcp-app-adaptor.d.ts

@@ -10,6 +10,7 @@ export declare class McpAppAdaptor implements Adaptor {
     callTool: <ToolArgs extends Record<string, unknown> | null = null, ToolResponse extends CallToolResponse = CallToolResponse>(name: string, args: ToolArgs) => Promise<ToolResponse>;
     requestDisplayMode: (mode: DisplayMode) => Promise<McpUiRequestDisplayModeResult>;
     sendFollowUpMessage: (prompt: string) => Promise<void>;
+    openExternal(href: string): void;
     private initializeStores;
     private createExternalStore;
 }

package/dist/{src/web → web}/bridges/adaptors/mcp-app-adaptor.js

@@ -36,7 +36,7 @@ export class McpAppAdaptor {
             structuredContent: response.structuredContent ?? {},
             isError: response.isError ?? false,
             result,
-            meta: response._meta ?? {},
+            _meta: response._meta ?? {},
         };
     };
     requestDisplayMode = (mode) => {
@@ -64,6 +64,13 @@ export class McpAppAdaptor {
             },
         });
     };
+    openExternal(href) {
+        const bridge = McpAppBridge.getInstance();
+        bridge.request({
+            method: "ui/open-link",
+            params: { url: href },
+        });
+    }
     initializeStores() {
         return {
             theme: this.createExternalStore(["theme"], ({ theme }) => theme ?? "light"),