skybridge 0.0.0-dev.ecfdeac → 0.0.0-dev.ed29eee

package/dist/server/view-resource-resolution.test.js

@@ -1,7 +1,15 @@
+import http from "node:http";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { __setBuildManifest, McpServer } from "./index.js";
+vi.mock("@skybridge/devtools", () => ({
+    devtoolsStaticServer: () => ((_req, _res, next) => next()),
+}));
+vi.mock("./viewsDevServer.js", () => ({
+    viewsDevServer: (_httpServer) => ((_req, _res, next) => next()),
+}));
 // SKY-435: a view resource must resolve no matter the `?v=` query param value.
 // The version param is a content-derived cache key for external consumers
 // (it busts host/CDN caches when the bundle changes); it is not part of the
@@ -22,6 +30,30 @@ async function connect(register) {
         },
     };
 }
+let openHttpServer;
+afterEach(() => openHttpServer?.close());
+// Connect over real HTTP so forwarded proxy headers reach the resource handler.
+async function connectHttp(register, headers) {
+    const { createApp } = await import("./express.js");
+    const server = new McpServer({ name: "test", version: "1.0.0" });
+    register(server);
+    const httpServer = http.createServer();
+    await createApp({ mcpServer: server, httpServer });
+    const listening = http.createServer(server.express);
+    await new Promise((resolve) => listening.listen(0, resolve));
+    openHttpServer = listening;
+    const port = listening.address().port;
+    const client = new Client({ name: "test-client", version: "1.0.0" });
+    const transport = new StreamableHTTPClientTransport(new URL(`http://localhost:${port}/mcp`), { requestInit: { headers } });
+    await client.connect(transport);
+    return {
+        client,
+        teardown: async () => {
+            await client.close();
+            await server.close();
+        },
+    };
+}
 function registerWidget(server) {
     server.registerTool({ name: "show", description: "show", view: { component: "widget" } }, () => ({ content: [{ type: "text", text: "ok" }] }));
 }
@@ -36,15 +68,15 @@ describe("view resource resolution (cache key)", () => {
     it("resolves regardless of the ?v= param and echoes the requested URI", async () => {
         const { client, teardown } = await connect(registerWidget);
         const { resources } = await client.listResources();
-        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
         // Dev build advertises no cache key.
-        expect(listed?.uri).toBe("ui://views/apps-sdk/widget.html");
+        expect(listed?.uri).toBe("ui://views/ext-apps/widget.html");
         // A stale/arbitrary/absent param all resolve the same underlying asset,
         // and the response echoes the URI the consumer asked for (never rewritten).
         for (const uri of [
-            "ui://views/apps-sdk/widget.html?v=stale123",
-            "ui://views/apps-sdk/widget.html?v=whatever-else",
-            "ui://views/apps-sdk/widget.html",
+            "ui://views/ext-apps/widget.html?v=stale123",
+            "ui://views/ext-apps/widget.html?v=whatever-else",
+            "ui://views/ext-apps/widget.html",
         ]) {
             const { contents } = await client.readResource({ uri });
             expect(contents).toHaveLength(1);
@@ -67,11 +99,11 @@ describe("view resource resolution (cache key)", () => {
         });
         const { client, teardown } = await connect(registerWidget);
         const { resources } = await client.listResources();
-        const listed = resources.find((r) => r.uri.startsWith("ui://views/apps-sdk/widget.html"));
+        const listed = resources.find((r) => r.uri.startsWith("ui://views/ext-apps/widget.html"));
         // Production advertises a content-derived cache key.
-        expect(listed?.uri).toMatch(/^ui:\/\/views\/apps-sdk\/widget\.html\?v=[0-9a-f]{8}$/);
+        expect(listed?.uri).toMatch(/^ui:\/\/views\/ext-apps\/widget\.html\?v=[0-9a-f]{8}$/);
         // A consumer holding a stale key still resolves the current asset.
-        const staleUri = "ui://views/apps-sdk/widget.html?v=00000000";
+        const staleUri = "ui://views/ext-apps/widget.html?v=00000000";
         const { contents } = await client.readResource({ uri: staleUri });
         expect(contents).toHaveLength(1);
         const content = textContent(contents);
@@ -81,7 +113,58 @@ describe("view resource resolution (cache key)", () => {
     });
     it("still throws for an unknown view path", async () => {
         const { client, teardown } = await connect(registerWidget);
-        await expect(client.readResource({ uri: "ui://views/apps-sdk/nope.html?v=1" })).rejects.toThrow();
+        await expect(client.readResource({ uri: "ui://views/ext-apps/nope.html?v=1" })).rejects.toThrow();
+        await teardown();
+    });
+    // A proxy routing the request under a path prefix sends x-forwarded-prefix;
+    // the view's asset URLs must carry that prefix (and the forwarded origin) so
+    // they resolve back through the same routing. Per-request, so one process can
+    // serve many hosts/prefixes at once.
+    it("prefixes emitted asset URLs with x-forwarded-prefix (prod)", async () => {
+        process.env.NODE_ENV = "production";
+        __setBuildManifest({
+            "src/views/widget.tsx": {
+                isEntry: true,
+                name: "widget",
+                file: "assets/widget-ABC123.js",
+            },
+            "style.css": { file: "assets/style-XYZ.css" },
+        });
+        const { client, teardown } = await connectHttp(registerWidget, {
+            "x-forwarded-host": "foo.com",
+            "x-forwarded-proto": "https",
+            "x-forwarded-prefix": "/v1/canary",
+        });
+        try {
+            const { contents } = await client.readResource({
+                uri: "ui://views/ext-apps/widget.html",
+            });
+            const { text } = textContent(contents);
+            // Forwarded origin + prefix. (`assets/assets` is the existing layout: the
+            // manifest `file` already carries `assets/` and the template prepends
+            // `/assets/`; build.tsx's `_redirects` collapses it on the asset host.)
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/widget-ABC123.js");
+            expect(text).toContain("https://foo.com/v1/canary/assets/assets/style-XYZ.css");
+            // No unprefixed asset URL leaks through.
+            expect(text).not.toContain("foo.com/assets/");
+        }
+        finally {
+            await teardown();
+        }
+    });
+    // Back-compat: older Skybridge advertised the view at `ui://views/apps-sdk/...`
+    // via openai/outputTemplate. We no longer advertise it, but apps published then
+    // have it cached, so the read must still resolve to the ext-apps content.
+    it("resolves the legacy apps-sdk URL to the ext-apps content", async () => {
+        const { client, teardown } = await connect(registerWidget);
+        const legacyUri = "ui://views/apps-sdk/widget.html";
+        const { contents } = await client.readResource({ uri: legacyUri });
+        expect(contents).toHaveLength(1);
+        const content = contents[0];
+        expect(content.mimeType).toBe("text/html;profile=mcp-app");
+        expect(content.text.length).toBeGreaterThan(0);
+        // The response echoes the requested (legacy) URI, never the canonical one.
+        expect(content.uri).toBe(legacyUri);
         await teardown();
     });
 });

package/dist/server/view-resource-resolution.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"view-resource-resolution.test.js","sourceRoot":"","sources":["../../src/server/view-resource-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU3D,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,wBAAwB;AAExB,KAAK,UAAU,OAAO,CAAC,QAAqC;IAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EACpE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,QAAgC;IAInD,OAAO,QAAQ,CAAC,CAAC,CAAkC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qCAAqC;QACrC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE5D,wEAAwE;QACxE,4EAA4E;QAC5E,KAAK,MAAM,GAAG,IAAI;YAChB,4CAA4C;YAC5C,iDAAiD;YACjD,iCAAiC;SAClC,EAAE,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qDAAqD;QACrD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CACzB,uDAAuD,CACxD,CAAC;QAEF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,MAAM,CACV,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAClE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport { afterEach, describe, expect, it } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\n// Mirror what the Skybridge Vite plugin generates in `.skybridge/views.d.ts`:\n// narrow `ViewName` so `component: \"widget\"` typechecks against the registry.\ndeclare module \"./server.js\" {\n  interface ViewNameRegistry {\n    widget: true;\n  }\n}\n\n// SKY-435: a view resource must resolve no matter the `?v=` query param value.\n// The version param is a content-derived cache key for external consumers\n// (it busts host/CDN caches when the bundle changes); it is not part of the\n// resource's identity, so a stale, absent, or arbitrary param must still serve\n// the underlying asset.\n\nasync function connect(register: (server: McpServer) => void) {\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const [clientTransport, serverTransport] =\n    InMemoryTransport.createLinkedPair();\n  await server.connect(serverTransport);\n  await client.connect(clientTransport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nfunction registerWidget(server: McpServer) {\n  server.registerTool(\n    { name: \"show\", description: \"show\", view: { component: \"widget\" } },\n    () => ({ content: [{ type: \"text\" as const, text: \"ok\" }] }),\n  );\n}\n\n/** Narrow a read-resource content entry to its text variant. */\nfunction textContent(contents: Array<{ uri: string }>): {\n  uri: string;\n  text: string;\n} {\n  return contents[0] as { uri: string; text: string };\n}\n\ndescribe(\"view resource resolution (cache key)\", () => {\n  afterEach(() => {\n    delete process.env.NODE_ENV;\n  });\n\n  it(\"resolves regardless of the ?v= param and echoes the requested URI\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/apps-sdk/widget.html\"),\n    );\n    // Dev build advertises no cache key.\n    expect(listed?.uri).toBe(\"ui://views/apps-sdk/widget.html\");\n\n    // A stale/arbitrary/absent param all resolve the same underlying asset,\n    // and the response echoes the URI the consumer asked for (never rewritten).\n    for (const uri of [\n      \"ui://views/apps-sdk/widget.html?v=stale123\",\n      \"ui://views/apps-sdk/widget.html?v=whatever-else\",\n      \"ui://views/apps-sdk/widget.html\",\n    ]) {\n      const { contents } = await client.readResource({ uri });\n      expect(contents).toHaveLength(1);\n      const content = textContent(contents);\n      expect(typeof content.text).toBe(\"string\");\n      expect(content.text.length).toBeGreaterThan(0);\n      expect(content.uri).toBe(uri);\n    }\n\n    await teardown();\n  });\n\n  it(\"resolves a stale cache key when the canonical URI carries ?v= (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/apps-sdk/widget.html\"),\n    );\n    // Production advertises a content-derived cache key.\n    expect(listed?.uri).toMatch(\n      /^ui:\\/\\/views\\/apps-sdk\\/widget\\.html\\?v=[0-9a-f]{8}$/,\n    );\n\n    // A consumer holding a stale key still resolves the current asset.\n    const staleUri = \"ui://views/apps-sdk/widget.html?v=00000000\";\n    const { contents } = await client.readResource({ uri: staleUri });\n    expect(contents).toHaveLength(1);\n    const content = textContent(contents);\n    expect(typeof content.text).toBe(\"string\");\n    expect(content.uri).toBe(staleUri);\n\n    await teardown();\n  });\n\n  it(\"still throws for an unknown view path\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    await expect(\n      client.readResource({ uri: \"ui://views/apps-sdk/nope.html?v=1\" }),\n    ).rejects.toThrow();\n\n    await teardown();\n  });\n});\n"]}
+{"version":3,"file":"view-resource-resolution.test.js","sourceRoot":"","sources":["../../src/server/view-resource-resolution.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE3D,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,oBAAoB,EAAE,GAAG,EAAE,CACzB,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,cAAc,EAAE,CAAC,WAAoB,EAAE,EAAE,CACvC,CAAC,CAAC,IAAa,EAAE,IAAa,EAAE,IAAgB,EAAE,EAAE,CAClD,IAAI,EAAE,CAAmB;CAC9B,CAAC,CAAC,CAAC;AAUJ,+EAA+E;AAC/E,0EAA0E;AAC1E,4EAA4E;AAC5E,+EAA+E;AAC/E,wBAAwB;AAExB,KAAK,UAAU,OAAO,CAAC,QAAqC;IAC1D,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,GACtC,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IACvC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACtC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,cAAuC,CAAC;AAC5C,SAAS,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;AAEzC,gFAAgF;AAChF,KAAK,UAAU,WAAW,CACxB,QAAqC,EACrC,OAA+B;IAE/B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjB,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;IACvC,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnE,cAAc,GAAG,SAAS,CAAC;IAC3B,MAAM,IAAI,GAAI,SAAS,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;IAE5D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,6BAA6B,CACjD,IAAI,GAAG,CAAC,oBAAoB,IAAI,MAAM,CAAC,EACvC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAC7B,CAAC;IACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,CAAC,YAAY,CACjB,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EACpE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,WAAW,CAAC,QAAgC;IAInD,OAAO,QAAQ,CAAC,CAAC,CAAkC,CAAC;AACtD,CAAC;AAED,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qCAAqC;QACrC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAE5D,wEAAwE;QACxE,4EAA4E;QAC5E,KAAK,MAAM,GAAG,IAAI;YAChB,4CAA4C;YAC5C,iDAAiD;YACjD,iCAAiC;SAClC,EAAE,CAAC;YACF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,iCAAiC,CAAC,CACpD,CAAC;QACF,qDAAqD;QACrD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CACzB,uDAAuD,CACxD,CAAC;QAEF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,4CAA4C,CAAC;QAC9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,MAAM,CACV,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mCAAmC,EAAE,CAAC,CAClE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAEpB,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,qCAAqC;IACrC,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,GAAG,YAAY,CAAC;QACpC,kBAAkB,CAAC;YACjB,sBAAsB,EAAE;gBACtB,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,yBAAyB;aAChC;YACD,WAAW,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE;SACC,CAAC,CAAC;QAElD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,WAAW,CAAC,cAAc,EAAE;YAC7D,kBAAkB,EAAE,SAAS;YAC7B,mBAAmB,EAAE,OAAO;YAC5B,oBAAoB,EAAE,YAAY;SACnC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBAC7C,GAAG,EAAE,iCAAiC;aACvC,CAAC,CAAC;YACH,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;YACvC,0EAA0E;YAC1E,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CACpB,0DAA0D,CAC3D,CAAC;YACF,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CACpB,uDAAuD,CACxD,CAAC;YACF,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,EAAE,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,gFAAgF;IAChF,0EAA0E;IAC1E,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,iCAAiC,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;QAEnE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAIzB,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/C,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC","sourcesContent":["import http from \"node:http\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport { InMemoryTransport } from \"@modelcontextprotocol/sdk/inMemory.js\";\nimport type { RequestHandler } from \"express\";\nimport { afterEach, describe, expect, it, vi } from \"vitest\";\nimport { __setBuildManifest, McpServer } from \"./index.js\";\n\nvi.mock(\"@skybridge/devtools\", () => ({\n  devtoolsStaticServer: () =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\nvi.mock(\"./viewsDevServer.js\", () => ({\n  viewsDevServer: (_httpServer: unknown) =>\n    ((_req: unknown, _res: unknown, next: () => void) =>\n      next()) as RequestHandler,\n}));\n\n// Mirror what the Skybridge Vite plugin generates in `.skybridge/views.d.ts`:\n// narrow `ViewName` so `component: \"widget\"` typechecks against the registry.\ndeclare module \"./server.js\" {\n  interface ViewNameRegistry {\n    widget: true;\n  }\n}\n\n// SKY-435: a view resource must resolve no matter the `?v=` query param value.\n// The version param is a content-derived cache key for external consumers\n// (it busts host/CDN caches when the bundle changes); it is not part of the\n// resource's identity, so a stale, absent, or arbitrary param must still serve\n// the underlying asset.\n\nasync function connect(register: (server: McpServer) => void) {\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const [clientTransport, serverTransport] =\n    InMemoryTransport.createLinkedPair();\n  await server.connect(serverTransport);\n  await client.connect(clientTransport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nlet openHttpServer: http.Server | undefined;\nafterEach(() => openHttpServer?.close());\n\n// Connect over real HTTP so forwarded proxy headers reach the resource handler.\nasync function connectHttp(\n  register: (server: McpServer) => void,\n  headers: Record<string, string>,\n) {\n  const { createApp } = await import(\"./express.js\");\n  const server = new McpServer({ name: \"test\", version: \"1.0.0\" });\n  register(server);\n  const httpServer = http.createServer();\n  await createApp({ mcpServer: server, httpServer });\n  const listening = http.createServer(server.express);\n  await new Promise<void>((resolve) => listening.listen(0, resolve));\n  openHttpServer = listening;\n  const port = (listening.address() as { port: number }).port;\n\n  const client = new Client({ name: \"test-client\", version: \"1.0.0\" });\n  const transport = new StreamableHTTPClientTransport(\n    new URL(`http://localhost:${port}/mcp`),\n    { requestInit: { headers } },\n  );\n  await client.connect(transport);\n  return {\n    client,\n    teardown: async () => {\n      await client.close();\n      await server.close();\n    },\n  };\n}\n\nfunction registerWidget(server: McpServer) {\n  server.registerTool(\n    { name: \"show\", description: \"show\", view: { component: \"widget\" } },\n    () => ({ content: [{ type: \"text\" as const, text: \"ok\" }] }),\n  );\n}\n\n/** Narrow a read-resource content entry to its text variant. */\nfunction textContent(contents: Array<{ uri: string }>): {\n  uri: string;\n  text: string;\n} {\n  return contents[0] as { uri: string; text: string };\n}\n\ndescribe(\"view resource resolution (cache key)\", () => {\n  afterEach(() => {\n    delete process.env.NODE_ENV;\n  });\n\n  it(\"resolves regardless of the ?v= param and echoes the requested URI\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/ext-apps/widget.html\"),\n    );\n    // Dev build advertises no cache key.\n    expect(listed?.uri).toBe(\"ui://views/ext-apps/widget.html\");\n\n    // A stale/arbitrary/absent param all resolve the same underlying asset,\n    // and the response echoes the URI the consumer asked for (never rewritten).\n    for (const uri of [\n      \"ui://views/ext-apps/widget.html?v=stale123\",\n      \"ui://views/ext-apps/widget.html?v=whatever-else\",\n      \"ui://views/ext-apps/widget.html\",\n    ]) {\n      const { contents } = await client.readResource({ uri });\n      expect(contents).toHaveLength(1);\n      const content = textContent(contents);\n      expect(typeof content.text).toBe(\"string\");\n      expect(content.text.length).toBeGreaterThan(0);\n      expect(content.uri).toBe(uri);\n    }\n\n    await teardown();\n  });\n\n  it(\"resolves a stale cache key when the canonical URI carries ?v= (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connect(registerWidget);\n\n    const { resources } = await client.listResources();\n    const listed = resources.find((r) =>\n      r.uri.startsWith(\"ui://views/ext-apps/widget.html\"),\n    );\n    // Production advertises a content-derived cache key.\n    expect(listed?.uri).toMatch(\n      /^ui:\\/\\/views\\/ext-apps\\/widget\\.html\\?v=[0-9a-f]{8}$/,\n    );\n\n    // A consumer holding a stale key still resolves the current asset.\n    const staleUri = \"ui://views/ext-apps/widget.html?v=00000000\";\n    const { contents } = await client.readResource({ uri: staleUri });\n    expect(contents).toHaveLength(1);\n    const content = textContent(contents);\n    expect(typeof content.text).toBe(\"string\");\n    expect(content.uri).toBe(staleUri);\n\n    await teardown();\n  });\n\n  it(\"still throws for an unknown view path\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    await expect(\n      client.readResource({ uri: \"ui://views/ext-apps/nope.html?v=1\" }),\n    ).rejects.toThrow();\n\n    await teardown();\n  });\n\n  // A proxy routing the request under a path prefix sends x-forwarded-prefix;\n  // the view's asset URLs must carry that prefix (and the forwarded origin) so\n  // they resolve back through the same routing. Per-request, so one process can\n  // serve many hosts/prefixes at once.\n  it(\"prefixes emitted asset URLs with x-forwarded-prefix (prod)\", async () => {\n    process.env.NODE_ENV = \"production\";\n    __setBuildManifest({\n      \"src/views/widget.tsx\": {\n        isEntry: true,\n        name: \"widget\",\n        file: \"assets/widget-ABC123.js\",\n      },\n      \"style.css\": { file: \"assets/style-XYZ.css\" },\n    } as unknown as Record<string, { file: string }>);\n\n    const { client, teardown } = await connectHttp(registerWidget, {\n      \"x-forwarded-host\": \"foo.com\",\n      \"x-forwarded-proto\": \"https\",\n      \"x-forwarded-prefix\": \"/v1/canary\",\n    });\n    try {\n      const { contents } = await client.readResource({\n        uri: \"ui://views/ext-apps/widget.html\",\n      });\n      const { text } = textContent(contents);\n      // Forwarded origin + prefix. (`assets/assets` is the existing layout: the\n      // manifest `file` already carries `assets/` and the template prepends\n      // `/assets/`; build.tsx's `_redirects` collapses it on the asset host.)\n      expect(text).toContain(\n        \"https://foo.com/v1/canary/assets/assets/widget-ABC123.js\",\n      );\n      expect(text).toContain(\n        \"https://foo.com/v1/canary/assets/assets/style-XYZ.css\",\n      );\n      // No unprefixed asset URL leaks through.\n      expect(text).not.toContain(\"foo.com/assets/\");\n    } finally {\n      await teardown();\n    }\n  });\n\n  // Back-compat: older Skybridge advertised the view at `ui://views/apps-sdk/...`\n  // via openai/outputTemplate. We no longer advertise it, but apps published then\n  // have it cached, so the read must still resolve to the ext-apps content.\n  it(\"resolves the legacy apps-sdk URL to the ext-apps content\", async () => {\n    const { client, teardown } = await connect(registerWidget);\n\n    const legacyUri = \"ui://views/apps-sdk/widget.html\";\n    const { contents } = await client.readResource({ uri: legacyUri });\n\n    expect(contents).toHaveLength(1);\n    const content = contents[0] as {\n      uri: string;\n      text: string;\n      mimeType: string;\n    };\n    expect(content.mimeType).toBe(\"text/html;profile=mcp-app\");\n    expect(content.text.length).toBeGreaterThan(0);\n    // The response echoes the requested (legacy) URI, never the canonical one.\n    expect(content.uri).toBe(legacyUri);\n\n    await teardown();\n  });\n});\n"]}

package/dist/server/viewsDevServer.js

@@ -19,7 +19,7 @@ export const viewsDevServer = async (httpServer) => {
     const root = process.cwd();
     const configFile = path.join(root, "vite.config.ts");
     const configResult = await loadConfigFromFile({ command: "serve", mode: "development" }, configFile, root);
-    const { build, preview, plugins: userPlugins = [], ...devConfig } = configResult?.config || {};
+    const { build, preview, plugins: userPlugins = [], server: userServer, ...devConfig } = configResult?.config || {};
     const vite = await createServer({
         ...devConfig,
         // Pass `false` so Vite skips re-resolving a config file — we already
@@ -27,6 +27,9 @@ export const viewsDevServer = async (httpServer) => {
         configFile: false,
         appType: "custom",
         server: {
+            // Keep the user's server options (e.g. forwardConsole) but force the
+            // three settings skybridge's Express integration requires.
+            ...userServer,
             allowedHosts: true,
             middlewareMode: true,
             hmr: {

package/dist/server/viewsDevServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"viewsDevServer.js","sourceRoot":"","sources":["../../src/server/viewsDevServer.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAuB,EACN,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,UAAU,EACV,IAAI,CACL,CAAC;IAEF,MAAM,EACJ,KAAK,EACL,OAAO,EACP,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,GAAG,SAAS,EACb,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,qEAAqE;QACrE,6CAA6C;QAC7C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,GAAG,EAAE;gBACH,MAAM,EAAE,UAAU;aACnB;SACF;QACD,IAAI;QACJ,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport cors from \"cors\";\nimport express, { type Router } from \"express\";\nimport { assetBaseUrlTransformPlugin } from \"./asset-base-url-transform-plugin.js\";\n\n/**\n * Vite dev-server middleware for view assets.\n *\n * MUST be mounted at the Express app root so Vite can intercept\n * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:\n *\n *   const app = express();\n *   if (env.NODE_ENV !== \"production\") {\n *     app.use(await viewsDevServer(httpServer));\n *   }\n */\nexport const viewsDevServer = async (\n  httpServer: http.Server,\n): Promise<Router> => {\n  const router = express.Router();\n\n  const { createServer, loadConfigFromFile } = await import(\"vite\");\n\n  const root = process.cwd();\n  const configFile = path.join(root, \"vite.config.ts\");\n\n  const configResult = await loadConfigFromFile(\n    { command: \"serve\", mode: \"development\" },\n    configFile,\n    root,\n  );\n\n  const {\n    build,\n    preview,\n    plugins: userPlugins = [],\n    ...devConfig\n  } = configResult?.config || {};\n\n  const vite = await createServer({\n    ...devConfig,\n    // Pass `false` so Vite skips re-resolving a config file — we already\n    // loaded and spread the user's config above.\n    configFile: false,\n    appType: \"custom\",\n    server: {\n      allowedHosts: true,\n      middlewareMode: true,\n      hmr: {\n        server: httpServer,\n      },\n    },\n    root,\n    // optimizeDeps is set by the skybridge Vite plugin (entries + include)\n    // so it can derive the view glob from `viewsDir`.\n    plugins: [...userPlugins, assetBaseUrlTransformPlugin()],\n  });\n\n  router.use(cors());\n  router.use(\"/\", vite.middlewares);\n\n  return router;\n};\n"]}
+{"version":3,"file":"viewsDevServer.js","sourceRoot":"","sources":["../../src/server/viewsDevServer.ts"],"names":[],"mappings":"AACA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,EAAE,EAAe,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AAEnF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,UAAuB,EACN,EAAE;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAErD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAC3C,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EACzC,UAAU,EACV,IAAI,CACL,CAAC;IAEF,MAAM,EACJ,KAAK,EACL,OAAO,EACP,OAAO,EAAE,WAAW,GAAG,EAAE,EACzB,MAAM,EAAE,UAAU,EAClB,GAAG,SAAS,EACb,GAAG,YAAY,EAAE,MAAM,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC;QAC9B,GAAG,SAAS;QACZ,qEAAqE;QACrE,6CAA6C;QAC7C,UAAU,EAAE,KAAK;QACjB,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE;YACN,qEAAqE;YACrE,2DAA2D;YAC3D,GAAG,UAAU;YACb,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;YACpB,GAAG,EAAE;gBACH,MAAM,EAAE,UAAU;aACnB;SACF;QACD,IAAI;QACJ,uEAAuE;QACvE,kDAAkD;QAClD,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAElC,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC","sourcesContent":["import type http from \"node:http\";\nimport path from \"node:path\";\nimport cors from \"cors\";\nimport express, { type Router } from \"express\";\nimport { assetBaseUrlTransformPlugin } from \"./asset-base-url-transform-plugin.js\";\n\n/**\n * Vite dev-server middleware for view assets.\n *\n * MUST be mounted at the Express app root so Vite can intercept\n * `/@vite/client`, `/@react-refresh`, and `/_skybridge/view/...` imports:\n *\n *   const app = express();\n *   if (env.NODE_ENV !== \"production\") {\n *     app.use(await viewsDevServer(httpServer));\n *   }\n */\nexport const viewsDevServer = async (\n  httpServer: http.Server,\n): Promise<Router> => {\n  const router = express.Router();\n\n  const { createServer, loadConfigFromFile } = await import(\"vite\");\n\n  const root = process.cwd();\n  const configFile = path.join(root, \"vite.config.ts\");\n\n  const configResult = await loadConfigFromFile(\n    { command: \"serve\", mode: \"development\" },\n    configFile,\n    root,\n  );\n\n  const {\n    build,\n    preview,\n    plugins: userPlugins = [],\n    server: userServer,\n    ...devConfig\n  } = configResult?.config || {};\n\n  const vite = await createServer({\n    ...devConfig,\n    // Pass `false` so Vite skips re-resolving a config file — we already\n    // loaded and spread the user's config above.\n    configFile: false,\n    appType: \"custom\",\n    server: {\n      // Keep the user's server options (e.g. forwardConsole) but force the\n      // three settings skybridge's Express integration requires.\n      ...userServer,\n      allowedHosts: true,\n      middlewareMode: true,\n      hmr: {\n        server: httpServer,\n      },\n    },\n    root,\n    // optimizeDeps is set by the skybridge Vite plugin (entries + include)\n    // so it can derive the view glob from `viewsDir`.\n    plugins: [...userPlugins, assetBaseUrlTransformPlugin()],\n  });\n\n  router.use(cors());\n  router.use(\"/\", vite.middlewares);\n\n  return router;\n};\n"]}

package/dist/test/utils.d.ts

@@ -91,7 +91,7 @@ export declare function createTestServer(): McpServer<Record<never, import("../s
         processedAt: number;
         region: string;
     }>;
-}>;
+}, import("../server/auth.js").ExtraClaims>;
 export declare function createMinimalTestServer(): McpServer<Record<never, import("../server/server.js").ToolDef<unknown, unknown, unknown>> & {
     "search-trip": import("../server/server.js").ToolDef<{
         destination: string;
@@ -100,7 +100,7 @@ export declare function createMinimalTestServer(): McpServer<Record<never, impor
             id: string;
         }[];
     }, unknown>;
-}>;
+}, import("../server/auth.js").ExtraClaims>;
 export declare function createInterfaceTestServer(): McpServer<Record<never, import("../server/server.js").ToolDef<unknown, unknown, unknown>> & {
     "interface-view": import("../server/server.js").ToolDef<{
         id: string;
@@ -111,7 +111,7 @@ export declare function createInterfaceTestServer(): McpServer<Record<never, imp
         processedBy: string;
         version: number;
     }>;
-}>;
+}, import("../server/auth.js").ExtraClaims>;
 export declare function createMockExtra(host: string, options?: {
     headers?: Record<string, string | string[]>;
     url?: URL | string;

package/dist/test/view.test.js

@@ -2,6 +2,7 @@ import crypto from "node:crypto";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
 import { afterEach, beforeEach, describe, expect, it, vi, } from "vitest";
+import { TOOL_OUTPUT_WARNING_TOKENS } from "../context-warnings.js";
 import { McpServer as McpServerClass } from "../server/server.js";
 import { createMockExtra, createMockMcpServer, resetTestEnv, setTestEnv, } from "./utils.js";
 const mockManifest = {
@@ -74,20 +75,24 @@ describe("McpServer.registerTool (unified API)", () => {
         const serverUrl = `http://${host}`;
         const hmrUrl = `ws://${host}`;
         const mockExtra = createMockExtra(host);
-        const result = await appsSdkResourceCallback(new URL("ui://views/apps-sdk/my-view.html"), mockExtra);
+        const result = await appsSdkResourceCallback(new URL("ui://views/ext-apps/my-view.html"), mockExtra);
         expect(mockRegisterTool).toHaveBeenCalled();
         expect(result).toEqual({
             contents: [
                 {
-                    uri: "ui://views/apps-sdk/my-view.html",
-                    mimeType: "text/html+skybridge",
+                    uri: "ui://views/ext-apps/my-view.html",
+                    mimeType: "text/html;profile=mcp-app",
                     text: expect.stringContaining('<div id="root"></div>'),
                     _meta: {
-                        "openai/widgetCSP": {
-                            resource_domains: [serverUrl],
-                            connect_domains: [serverUrl, hmrUrl],
+                        ui: {
+                            csp: {
+                                resourceDomains: [serverUrl],
+                                connectDomains: [serverUrl, hmrUrl],
+                                baseUriDomains: [serverUrl],
+                            },
+                            domain: serverUrl,
+                            description: "Test view",
                         },
-                        "openai/widgetDomain": serverUrl,
                         "openai/widgetDescription": "Test view",
                     },
                 },
@@ -113,20 +118,24 @@ describe("McpServer.registerTool (unified API)", () => {
         const host = "myapp.com";
         const serverUrl = `https://${host}`;
         const mockExtra = createMockExtra(host);
-        const versionedUri = `ui://views/apps-sdk/my-view.html${expectedVersionParam("assets/my-view-abc123.js", "style.css")}`;
+        const versionedUri = `ui://views/ext-apps/my-view.html${expectedVersionParam("assets/my-view-abc123.js", "style.css")}`;
         const result = await appsSdkResourceCallback(new URL(versionedUri), mockExtra);
         expect(result).toEqual({
             contents: [
                 {
                     uri: versionedUri,
-                    mimeType: "text/html+skybridge",
+                    mimeType: "text/html;profile=mcp-app",
                     text: expect.stringContaining('<div id="root"></div>'),
                     _meta: {
-                        "openai/widgetCSP": {
-                            resource_domains: [serverUrl],
-                            connect_domains: [serverUrl],
+                        ui: {
+                            csp: {
+                                resourceDomains: [serverUrl],
+                                connectDomains: [serverUrl],
+                                baseUriDomains: [serverUrl],
+                            },
+                            domain: serverUrl,
+                            description: "Test view",
                         },
-                        "openai/widgetDomain": serverUrl,
                         "openai/widgetDescription": "Test view",
                     },
                 },
@@ -145,7 +154,7 @@ describe("McpServer.registerTool (unified API)", () => {
             view: { component: "my-view", description: "Test view" },
         }, vi.fn());
         const extAppsResourceCallback = mockRegisterResource.mock
-            .calls[1]?.[3];
+            .calls[0]?.[3];
         expect(extAppsResourceCallback).toBeDefined();
         const forwardedUrl = "https://everything-3a2c1264.staging.alpic.live/mcp?foo=bar";
         const expectedDomain = `${crypto
@@ -170,9 +179,10 @@ describe("McpServer.registerTool (unified API)", () => {
                 description: "Test view",
                 domain: expectedDomain,
             },
+            "openai/widgetDescription": "Test view",
         });
     });
-    it("should register resources with correct hostType for both apps-sdk and ext-apps", async () => {
+    it("should register a single ext-apps resource", async () => {
         server.registerTool({
             name: "my-view",
             description: "Test tool",
@@ -182,37 +192,14 @@ describe("McpServer.registerTool (unified API)", () => {
                 prefersBorder: true,
             },
         }, vi.fn());
-        expect(mockRegisterResource).toHaveBeenCalledTimes(2);
-        const appsSdkCallback = mockRegisterResource.mock
+        expect(mockRegisterResource).toHaveBeenCalledTimes(1);
+        const resourceCallback = mockRegisterResource.mock
             .calls[0]?.[3];
         const host = "localhost:3000";
         const serverUrl = `http://${host}`;
         const hmrUrl = `ws://${host}`;
-        const appsSdkResult = await appsSdkCallback(new URL("ui://views/apps-sdk/my-view.html"), createMockExtra(host));
-        expect(appsSdkResult).toEqual({
-            contents: [
-                {
-                    uri: "ui://views/apps-sdk/my-view.html",
-                    mimeType: "text/html+skybridge",
-                    text: expect.stringContaining('<div id="root"></div>'),
-                    _meta: {
-                        "openai/widgetCSP": {
-                            resource_domains: [serverUrl],
-                            connect_domains: [serverUrl, hmrUrl],
-                        },
-                        "openai/widgetDomain": serverUrl,
-                        "openai/widgetDescription": "Test view",
-                        "openai/widgetPrefersBorder": true,
-                    },
-                },
-            ],
-        });
-        expect(appsSdkResult.contents[0]?.text).toContain('window.skybridge = { hostType: "apps-sdk", serverUrl: "http://localhost:3000" };');
-        const extAppsResourceCallback = mockRegisterResource.mock
-            .calls[1]?.[3];
-        expect(extAppsResourceCallback).toBeDefined();
-        const extAppsResult = await extAppsResourceCallback(new URL("ui://views/ext-apps/my-view.html"), createMockExtra(host));
-        expect(extAppsResult).toEqual({
+        const result = await resourceCallback(new URL("ui://views/ext-apps/my-view.html"), createMockExtra(host));
+        expect(result).toEqual({
             contents: [
                 {
                     uri: "ui://views/ext-apps/my-view.html",
@@ -229,27 +216,26 @@ describe("McpServer.registerTool (unified API)", () => {
                             description: "Test view",
                             prefersBorder: true,
                         },
+                        "openai/widgetDescription": "Test view",
                     },
                 },
             ],
         });
-        expect(extAppsResult.contents[0]?.text).toContain('window.skybridge = { hostType: "mcp-app", serverUrl: "http://localhost:3000" };');
+        expect(result.contents[0]?.text).toContain('window.skybridge = { hostType: "mcp-app", serverUrl: "http://localhost:3000" };');
     });
-    it("should register tool with ui.resourceUri metadata", async () => {
+    it("should advertise the single resource via ui.resourceUri only (no openai/outputTemplate)", async () => {
         server.registerTool({
             name: "my-view",
             description: "Test tool",
             view: { component: "my-view", description: "Test view" },
         }, vi.fn());
-        expect(mockRegisterTool).toHaveBeenCalledTimes(1);
-        const toolCallArgs = mockRegisterTool.mock.calls[0];
-        const toolConfig = toolCallArgs?.[1];
-        expect(toolConfig._meta).toHaveProperty("ui");
-        expect(toolConfig._meta?.ui).toEqual({
-            resourceUri: "ui://views/ext-apps/my-view.html",
-        });
+        const toolConfig = mockRegisterTool.mock.calls[0]?.[1];
+        const uri = "ui://views/ext-apps/my-view.html";
+        expect(toolConfig._meta?.ui?.resourceUri).toBe(uri);
+        expect(toolConfig._meta?.["ui/resourceUri"]).toBe(uri);
+        expect(toolConfig._meta?.["openai/outputTemplate"]).toBeUndefined();
     });
-    it("should register tool with openai/outputTemplate when apps-sdk only", async () => {
+    it("treats the deprecated hosts option as a no-op (always the single resource)", async () => {
         server.registerTool({
             name: "my-view",
             description: "Test tool",
@@ -259,11 +245,10 @@ describe("McpServer.registerTool (unified API)", () => {
                 hosts: ["apps-sdk"],
             },
         }, vi.fn());
-        expect(mockRegisterTool).toHaveBeenCalledTimes(1);
-        const toolCallArgs = mockRegisterTool.mock.calls[0];
-        const toolConfig = toolCallArgs?.[1];
-        expect(toolConfig._meta).not.toHaveProperty("ui");
-        expect(toolConfig._meta?.["openai/outputTemplate"]).toBe("ui://views/apps-sdk/my-view.html");
+        expect(mockRegisterResource).toHaveBeenCalledTimes(1);
+        const toolConfig = mockRegisterTool.mock.calls[0]?.[1];
+        expect(toolConfig._meta?.ui?.resourceUri).toBe("ui://views/ext-apps/my-view.html");
+        expect(toolConfig._meta?.["openai/outputTemplate"]).toBeUndefined();
     });
     it("should not version view URIs in development", () => {
         server.registerTool({
@@ -272,12 +257,11 @@ describe("McpServer.registerTool (unified API)", () => {
             view: { component: "my-view", description: "Test view" },
         }, vi.fn());
         const toolConfig = mockRegisterTool.mock.calls[0]?.[1];
-        expect(toolConfig._meta?.["openai/outputTemplate"]).toBe("ui://views/apps-sdk/my-view.html");
+        expect(toolConfig._meta?.["openai/outputTemplate"]).toBeUndefined();
         expect(toolConfig._meta?.ui?.resourceUri).toBe("ui://views/ext-apps/my-view.html");
-        // The URI registered with the resource handler must match the URI in
-        // outputTemplate exactly so the SDK can resolve `resources/read` requests.
-        expect(mockRegisterResource.mock.calls[0]?.[1]).toBe("ui://views/apps-sdk/my-view.html");
-        expect(mockRegisterResource.mock.calls[1]?.[1]).toBe("ui://views/ext-apps/my-view.html");
+        // The URI registered with the resource handler must match ui.resourceUri
+        // exactly so the SDK can resolve `resources/read` requests.
+        expect(mockRegisterResource.mock.calls[0]?.[1]).toBe("ui://views/ext-apps/my-view.html");
     });
     it("should append a stable content hash to view URIs in production", () => {
         setTestEnv({ NODE_ENV: "production" });
@@ -288,10 +272,9 @@ describe("McpServer.registerTool (unified API)", () => {
         }, vi.fn());
         const expected = expectedVersionParam("assets/my-view-abc123.js", "style.css");
         const toolConfig = mockRegisterTool.mock.calls[0]?.[1];
-        expect(toolConfig._meta?.["openai/outputTemplate"]).toBe(`ui://views/apps-sdk/my-view.html${expected}`);
+        expect(toolConfig._meta?.["openai/outputTemplate"]).toBeUndefined();
         expect(toolConfig._meta?.ui?.resourceUri).toBe(`ui://views/ext-apps/my-view.html${expected}`);
-        expect(mockRegisterResource.mock.calls[0]?.[1]).toBe(`ui://views/apps-sdk/my-view.html${expected}`);
-        expect(mockRegisterResource.mock.calls[1]?.[1]).toBe(`ui://views/ext-apps/my-view.html${expected}`);
+        expect(mockRegisterResource.mock.calls[0]?.[1]).toBe(`ui://views/ext-apps/my-view.html${expected}`);
     });
     it("should produce different version params for views with different bundles", () => {
         setTestEnv({ NODE_ENV: "production" });
@@ -305,8 +288,8 @@ describe("McpServer.registerTool (unified API)", () => {
             description: "Second tool",
             view: { component: "folder-view" },
         }, vi.fn());
-        const myviewTemplate = (mockRegisterTool.mock.calls[0]?.[1])._meta?.["openai/outputTemplate"];
-        const folderviewTemplate = (mockRegisterTool.mock.calls[1]?.[1])._meta?.["openai/outputTemplate"];
+        const myviewTemplate = mockRegisterTool.mock.calls[0][1]._meta?.ui?.resourceUri;
+        const folderviewTemplate = mockRegisterTool.mock.calls[1][1]._meta?.ui?.resourceUri;
         expect(myviewTemplate).not.toEqual(folderviewTemplate);
         expect(myviewTemplate).toMatch(/\?v=[0-9a-f]{8}$/);
         expect(folderviewTemplate).toMatch(/\?v=[0-9a-f]{8}$/);
@@ -319,26 +302,7 @@ describe("McpServer.registerTool (unified API)", () => {
             view: { component: "unknown-view" },
         }, vi.fn());
         const toolConfig = mockRegisterTool.mock.calls[0]?.[1];
-        expect(toolConfig._meta?.["openai/outputTemplate"]).toBe("ui://views/apps-sdk/unknown-view.html");
-    });
-    it("should register tool with ui.resourceUri only when mcp-app only", async () => {
-        server.registerTool({
-            name: "my-view",
-            description: "Test tool",
-            view: {
-                component: "my-view",
-                description: "Test view",
-                hosts: ["mcp-app"],
-            },
-        }, vi.fn());
-        expect(mockRegisterTool).toHaveBeenCalledTimes(1);
-        const toolCallArgs = mockRegisterTool.mock.calls[0];
-        const toolConfig = toolCallArgs?.[1];
-        expect(toolConfig._meta).toHaveProperty("ui");
-        expect(toolConfig._meta?.ui).toEqual({
-            resourceUri: "ui://views/ext-apps/my-view.html",
-        });
-        expect(toolConfig._meta?.["openai/outputTemplate"]).toBeUndefined();
+        expect(toolConfig._meta?.ui?.resourceUri).toBe("ui://views/ext-apps/unknown-view.html");
     });
     it("should inject viewUUID into _meta of tool callback results", async () => {
         const mockToolCallback = vi.fn().mockResolvedValue({
@@ -358,6 +322,21 @@ describe("McpServer.registerTool (unified API)", () => {
         expect(typeof result._meta?.viewUUID).toBe("string");
         expect(result._meta?.viewUUID).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
     });
+    it("warns when a tool callback returns large model-visible output", async () => {
+        const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => { });
+        server.registerTool({ name: "large-output", description: "Test tool" }, vi.fn().mockResolvedValue({
+            content: [
+                {
+                    type: "text",
+                    text: "x".repeat(TOOL_OUTPUT_WARNING_TOKENS * 4),
+                },
+            ],
+        }));
+        const wrappedCallback = mockRegisterTool.mock.calls[0]?.[2];
+        await wrappedCallback({}, {});
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('Tool "large-output" returned'));
+        warnSpy.mockRestore();
+    });
     it("should preserve existing _meta when injecting viewUUID", async () => {
         const mockToolCallback = vi.fn().mockResolvedValue({
             content: [{ type: "text", text: "result" }],
@@ -476,11 +455,12 @@ describe("McpServer.registerTool (unified API)", () => {
         const host = "localhost:3000";
         const serverUrl = `http://${host}`;
         const hmrUrl = `ws://${host}`;
-        const result = await appsSdkCallback(new URL("ui://views/apps-sdk/csp-tool.html"), createMockExtra(host));
+        const result = await appsSdkCallback(new URL("ui://views/ext-apps/csp-tool.html"), createMockExtra(host));
         const meta = result.contents[0]?._meta;
-        expect(meta["openai/widgetCSP"]).toEqual({
-            resource_domains: [serverUrl, "https://cdn.example.com"],
-            connect_domains: [serverUrl, hmrUrl, "https://api.example.com"],
+        expect(meta.ui?.csp).toEqual({
+            resourceDomains: [serverUrl, "https://cdn.example.com"],
+            connectDomains: [serverUrl, hmrUrl, "https://api.example.com"],
+            baseUriDomains: [serverUrl],
         });
     });
     it("should let view._meta override framework-computed keys", async () => {
@@ -492,18 +472,20 @@ describe("McpServer.registerTool (unified API)", () => {
                 description: "Test view",
                 csp: { connectDomains: ["https://api.x.com"] },
                 _meta: {
-                    "openai/widgetCSP": {
-                        connect_domains: ["https://api.y.com"],
+                    ui: {
+                        csp: {
+                            connectDomains: ["https://api.y.com"],
+                        },
                     },
                 },
             },
         }, vi.fn());
         const appsSdkCallback = mockRegisterResource.mock
             .calls[0]?.[3];
-        const result = await appsSdkCallback(new URL("ui://views/apps-sdk/override-tool.html"), createMockExtra("localhost:3000"));
+        const result = await appsSdkCallback(new URL("ui://views/ext-apps/override-tool.html"), createMockExtra("localhost:3000"));
         const meta = result.contents[0]?._meta;
-        expect(meta["openai/widgetCSP"]).toEqual({
-            connect_domains: ["https://api.y.com"],
+        expect(meta.ui?.csp).toEqual({
+            connectDomains: ["https://api.y.com"],
         });
     });
     it("should pass user _meta keys through to tool config", () => {
@@ -553,16 +535,18 @@ describe("resources/list view _meta injection", () => {
         await server.close();
         const appsSdk = resources.find((r) => r.uri.includes("apps-sdk"));
         const extApps = resources.find((r) => r.uri.includes("ext-apps"));
-        expect(appsSdk?._meta).toBeDefined();
+        expect(appsSdk).toBeUndefined();
         expect(extApps?._meta).toBeDefined();
-        const appsSdkCsp = appsSdk?._meta?.["openai/widgetCSP"];
-        expect(appsSdkCsp.connect_domains?.length).toBeGreaterThan(0);
-        expect(appsSdkCsp.resource_domains).toContain("https://fonts.googleapis.com");
-        expect(appsSdk?._meta?.["openai/widgetDomain"]).toBe("skybridge.tech");
-        const extUi = (extApps?._meta).ui;
+        const extUi = extApps._meta?.ui;
         expect(extUi?.csp?.connectDomains?.length).toBeGreaterThan(0);
         expect(extUi?.csp?.resourceDomains).toContain("https://fonts.googleapis.com");
         expect(extUi?.domain).toBe("skybridge.tech");
+        const meta = extApps?._meta;
+        expect(meta["openai/widgetDescription"]).toBe("Onboarding deck");
+        expect(meta["openai/widgetCSP"]?.redirect_domains).toEqual([
+            "https://docs.skybridge.tech",
+        ]);
+        expect(meta.ui?.csp).not.toHaveProperty("redirectDomains");
     });
 });
 //# sourceMappingURL=view.test.js.map