agent-webui 2.8.2__tar.gz → 2.8.3__tar.gz

{agent_webui-2.8.2 → agent_webui-2.8.3}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: agent-webui
-Version: 2.8.2
-Summary: Agent Web Interface for Pydantic AI Agents
+Version: 2.8.3
+Summary: Overstory: the browser workspace for Arbora
 Author-email: Repository Maintainers <maintainers@knuckles.team>
 License: MIT
 Classifier: Development Status :: 4 - Beta
@@ -15,13 +15,13 @@ Classifier: Programming Language :: Python :: 3.14
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: agent-utilities<4.0.0,>=3.0.0
-Requires-Dist: agent-connector-sdk<1.0.0,>=0.2.0
+Requires-Dist: meristem<5,>=4.0.1
+Requires-Dist: scion-sdk<1.0.0,>=0.5.6
 Requires-Dist: httpx>=0.28.1
 Requires-Dist: msgpack>=1.1.0
 Requires-Dist: fastapi>=0.143.3
 Requires-Dist: langfuse>=5.0.2
-Requires-Dist: pydantic-ai-slim[ui]==2.57.0
+Requires-Dist: pydantic-ai-slim[ui]==2.63.0
 Requires-Dist: python-multipart>=0.0.32
 Requires-Dist: sse-starlette>=3.5.0
 Requires-Dist: starlette>=1.8.0
@@ -44,110 +44,117 @@ Requires-Dist: opentelemetry-instrumentation-fastapi>=0.65b0; extra == "test"
 Requires-Dist: opentelemetry-instrumentation-asgi>=0.65b0; extra == "test"
 Dynamic: license-file
 
-# Arbora web UI
+# Overstory
 
 <p align="center">
-  <img src="docs/assets/brands/agent-webui-logo-v1.png" alt="Arbora Agent Web UI logo" width="160" />
+  <img src="docs/assets/brands/agent-webui-logo-v1.png" alt="Overstory logo" width="160" />
 </p>
 
+Overstory is the browser workspace for Arbora. The repository is `overstory`;
+the package remains `agent-webui`. Existing gallery images retain their original capture provenance.
+
 <p align="center">
   <strong>The browser workspace for governed agents, workflows, and knowledge in Arbora.</strong><br>
-  <sub>Conversations · approvals · workflows · fleet activity · Atlas knowledge views</sub>
+  <sub>Conversations · approvals · workflows · fleet activity · Understory knowledge views</sub>
 </p>
 
 <p align="center">
 
 [![PyPI - Version](https://img.shields.io/pypi/v/agent-webui)](https://pypi.org/project/agent-webui/)
-[![Build](https://github.com/Knuckles-Team/agent-webui/actions/workflows/release.yml/badge.svg)](https://github.com/Knuckles-Team/agent-webui/actions/workflows/release.yml)
-[![Documentation](https://img.shields.io/badge/docs-GitHub%20Pages-526cfe)](https://knuckles-team.github.io/agent-webui/)
-[![GitHub license](https://img.shields.io/github/license/Knuckles-Team/agent-webui)](LICENSE)
-[![Docs build](https://github.com/Knuckles-Team/agent-webui/actions/workflows/pages.yml/badge.svg?branch=main)](https://github.com/Knuckles-Team/agent-webui/actions/workflows/pages.yml)
+[![Build](https://github.com/Knuckles-Team/overstory/actions/workflows/release.yml/badge.svg)](https://github.com/Knuckles-Team/overstory/actions/workflows/release.yml)
+[![Documentation](https://img.shields.io/badge/docs-GitHub%20Pages-526cfe)](https://knuckles-team.github.io/overstory/)
+[![GitHub license](https://img.shields.io/github/license/Knuckles-Team/overstory)](LICENSE)
+[![Docs build](https://github.com/Knuckles-Team/overstory/actions/workflows/pages.yml/badge.svg?branch=main)](https://github.com/Knuckles-Team/overstory/actions/workflows/pages.yml)
 [![PyPI - Downloads](https://img.shields.io/pypi/dd/agent-webui)](https://pypi.org/project/agent-webui/)
 [![PyPI - License](https://img.shields.io/pypi/l/agent-webui)](https://pypi.org/project/agent-webui/)
 [![PyPI - Wheel](https://img.shields.io/pypi/wheel/agent-webui)](https://pypi.org/project/agent-webui/)
 [![PyPI - Implementation](https://img.shields.io/pypi/implementation/agent-webui)](https://pypi.org/project/agent-webui/)
-[![GitHub Repo stars](https://img.shields.io/github/stars/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/stargazers)
-[![GitHub forks](https://img.shields.io/github/forks/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/forks)
-[![GitHub contributors](https://img.shields.io/github/contributors/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/graphs/contributors)
-[![GitHub last commit (by committer)](https://img.shields.io/github/last-commit/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/commits/main)
-[![GitHub pull requests](https://img.shields.io/github/issues-pr/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/pulls)
-[![GitHub closed pull requests](https://img.shields.io/github/issues-pr-closed/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/pulls?q=is%3Apr+is%3Aclosed)
-[![GitHub issues](https://img.shields.io/github/issues/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui/issues)
-[![GitHub top language](https://img.shields.io/github/languages/top/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui)
-[![GitHub language count](https://img.shields.io/github/languages/count/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui)
-[![GitHub repo size](https://img.shields.io/github/repo-size/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui)
-[![GitHub repo file count (file type)](https://img.shields.io/github/directory-file-count/Knuckles-Team/agent-webui)](https://github.com/Knuckles-Team/agent-webui)
+[![GitHub Repo stars](https://img.shields.io/github/stars/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/stargazers)
+[![GitHub forks](https://img.shields.io/github/forks/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/forks)
+[![GitHub contributors](https://img.shields.io/github/contributors/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/graphs/contributors)
+[![GitHub last commit (by committer)](https://img.shields.io/github/last-commit/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/commits/main)
+[![GitHub pull requests](https://img.shields.io/github/issues-pr/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/pulls)
+[![GitHub closed pull requests](https://img.shields.io/github/issues-pr-closed/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/pulls?q=is%3Apr+is%3Aclosed)
+[![GitHub issues](https://img.shields.io/github/issues/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/issues)
+[![GitHub top language](https://img.shields.io/github/languages/top/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub language count](https://img.shields.io/github/languages/count/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub repo size](https://img.shields.io/github/repo-size/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub repo file count (file type)](https://img.shields.io/github/directory-file-count/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
 
 </p>
 
 <p align="center">
-  <a href="https://knuckles-team.github.io/agent-webui/">Documentation</a> ·
-  <a href="https://knuckles-team.github.io/agent-webui/features/">Capabilities</a> ·
-  <a href="https://knuckles-team.github.io/agent-webui/architecture/">Interfaces</a> ·
-  <a href="https://knuckles-team.github.io/agent-webui/status/">Status</a>
+  <a href="https://knuckles-team.github.io/overstory/">Documentation</a> ·
+  <a href="https://knuckles-team.github.io/overstory/features/">Capabilities</a> ·
+  <a href="https://knuckles-team.github.io/overstory/architecture/">Interfaces</a> ·
+  <a href="https://knuckles-team.github.io/overstory/status/">Status</a>
 </p>
 
-![The Agent Web UI Atlas workspace presents graph, object, schema, data, document, and memory entry points in one browser surface.](docs/assets/screenshots/atlas-workspace.png)
+![Chat and tasks in the accepted green glass theme, with an unsent synthetic project draft.](docs/assets/screenshots/work-wide.png)
+
+The conversation-first workspace uses synthetic demo data, not a live account.
+Open **Settings** for theme, surface and privacy choices.
+See the [workspace gallery and screenshot refresh guide](docs/screenshots.md).
 
 ## Overview
 
-Arbora Agent Web UI is the browser workspace composed by Arbora. It brings agent
-conversations, approvals, workflows, fleet activity, and Epistemic Graph
+Overstory is the browser workspace composed by Arbora. It brings agent
+conversations, approvals, workflows, fleet activity, and Medulla
 exploration into one React application. Its FastAPI host keeps privileged
 credentials and gateway delegation on the server side.
 
-| Agent Web UI owns | Other components own |
+| Overstory owns | Other components own |
 |---|---|
-| Browser presentation, local interaction state, accessible route composition, and the FastAPI boundary | Arbora owns public routing, identity, policy, and fleet supervision; Agent Utilities owns agent behavior; Epistemic Graph owns durable knowledge; connector services own external-system effects |
+| Browser presentation, local interaction state, accessible route composition, and the FastAPI boundary | Arbora owns public routing, identity, policy, and fleet supervision; Meristem applies supplied plans; Medulla owns durable knowledge; connector services own external-system effects |
 
-Current package Version: 2.8.2.
+Current package Version: 2.8.3.
 
 ## Key capabilities
 
 - Stream agent responses with sources, governed tool activity, and approval prompts.
 - Build and run workflows while observing sessions, goals, schedules, and fleet health.
-- Explore property graphs, RDF, schemas, objects, tables, documents, code, and memories through Atlas and Epistemic Graph.
+- Explore property graphs, RDF, schemas, objects, tables, documents, code, and memories through Understory and Medulla.
 - Discover MCP Apps and connector capabilities without exposing service credentials to the browser.
 - Apply one role-aware navigation and server authorization model across the complete workspace.
 - Run as the Arbora-hosted browser co-service or as an independently deployed ASGI application.
 
 ## Documentation
 
-Start with the [Agent Web UI documentation](https://knuckles-team.github.io/agent-webui/),
+Start with the [Overstory documentation](https://knuckles-team.github.io/overstory/),
 then use the shared platform map to move between components:
 
 | Component | Role | Documentation |
 |---|---|---|
-| Agent Web UI | Browser operator workspace and Atlas knowledge views | [Docs](https://knuckles-team.github.io/agent-webui/) |
-| Agent Terminal UI | Terminal and headless client; REST operations are available, with no ACP conversational path | [Docs](https://knuckles-team.github.io/agent-terminal-ui/) |
-| Geniusbot | Desktop cockpit for chat, graph, fleet, health, and operator workflows | [Docs](https://knuckles-team.github.io/geniusbot/) |
-| Arbora messaging | Hosts chat and voice entrypoints; Agent Utilities supplies adapter and routing behavior | [Docs](https://knuckles-team.github.io/arbora/) |
+| Overstory | Browser operator workspace and Understory knowledge views | [Docs](https://knuckles-team.github.io/overstory/) |
+| Tuig | Terminal and headless client; central A2A/REST and experimental headless local ACP; full session parity remains unqualified | [Docs](https://knuckles-team.github.io/tuig/) |
+| Axil | Desktop cockpit for chat, graph, fleet, health, and operator workflows | [Docs](https://knuckles-team.github.io/axil/) |
+| Arbora messaging | Chat and voice entrypoints hosted by Arbora | [Docs](https://knuckles-team.github.io/arbora/) |
 | Arbora | Public MCP, REST, A2A, identity, policy, and runtime composition | [Docs](https://knuckles-team.github.io/arbora/) |
-| Agent Utilities | Agent decisions, workflows, evaluation, and skills | [Docs](https://knuckles-team.github.io/agent-utilities/) |
-| Epistemic Graph | Durable multimodal data, reasoning, provenance, and transactions | [Docs](https://knuckles-team.github.io/epistemic-graph/) |
-| Agent Connector SDK | Typed source adapters, connector serving, and write-back contracts | [Docs](https://knuckles-team.github.io/agent-connector-sdk/) |
+| Meristem | In-run harness that applies supplied plans | [Docs](https://knuckles-team.github.io/meristem/) |
+| Medulla | Durable multimodal data, reasoning, provenance, and transactions | [Docs](https://knuckles-team.github.io/medulla/) |
+| Scion SDK | Typed source adapters, connector serving, and write-back contracts | [Docs](https://knuckles-team.github.io/scion-sdk/) |
 
 ## Architecture
 
-[![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/epistemic-graph/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#webui)
+[![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/medulla/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#webui)
 
 [Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#webui)
 
-People also enter through Agent Terminal UI and Geniusbot or Arbora-hosted
-messaging; Agent Terminal UI exposes REST operations, with no ACP conversational
-path. External applications connect over MCP, REST, or A2A. The browser talks
-only to its same-origin FastAPI host. Arbora injects gateway routes and
-verified request context, then delegates agent behavior to Agent Utilities and
-durable knowledge to Epistemic Graph. Source systems connect through Agent
-Connector SDK directly to Epistemic Graph. Agent Web UI renders typed results
+People also enter through Tuig and Axil or Arbora-hosted
+messaging. Tuig retains central A2A/REST and experimental headless local ACP;
+full session parity remains unqualified. External applications connect over MCP,
+REST, or A2A. The browser talks only to its same-origin FastAPI host. Arbora injects gateway routes and
+verified request context. Meristem applies supplied plans; Medulla owns
+durable knowledge. Source systems connect through Scion SDK
+directly to Medulla. Overstory renders typed results
 and local presentation state while each service retains its own authority.
 
-See the [architecture guide](https://knuckles-team.github.io/agent-webui/architecture/)
+See the [architecture guide](https://knuckles-team.github.io/overstory/architecture/)
 for the request flow and trust boundaries.
 
 ## Quick start
 
-Generate a local profile and start Arbora with Agent Web UI enabled:
+Generate a local profile and start Arbora with Overstory enabled:
 
 ```bash
 uvx --from "arbora[webui]" setup-config generate --profile tiny
@@ -156,7 +163,7 @@ uvx --from "arbora[webui]" arbora --transport streamable-http --host 127.0.0.1 -
 ```
 
 Open <http://127.0.0.1:8080>. Arbora serves MCP on port `8000` and the Agent
-Web UI co-service on port `8080`. The [start guide](https://knuckles-team.github.io/agent-webui/start/)
+Web UI co-service on port `8080`. The [start guide](https://knuckles-team.github.io/overstory/start/)
 covers local source development and deployment profiles.
 
 ## Contributing
@@ -165,6 +172,10 @@ Issues and pull requests are welcome. Read [AGENTS.md](AGENTS.md), keep browser
 and server authority boundaries intact, and run the repository validation suite
 before opening a pull request.
 
+Refresh the documented workspace views with `pnpm screenshots:refresh`. See the
+[screenshot guide](docs/screenshots.md) for synthetic fixtures, hosted capture,
+provenance and review before committing refreshed images.
+
 ## License
 
-Arbora Agent Web UI is available under the [MIT License](LICENSE).
+Overstory is available under the [MIT License](LICENSE).

agent_webui-2.8.3/README.md

@@ -0,0 +1,135 @@
+# Overstory
+
+<p align="center">
+  <img src="docs/assets/brands/agent-webui-logo-v1.png" alt="Overstory logo" width="160" />
+</p>
+
+Overstory is the browser workspace for Arbora. The repository is `overstory`;
+the package remains `agent-webui`. Existing gallery images retain their original capture provenance.
+
+<p align="center">
+  <strong>The browser workspace for governed agents, workflows, and knowledge in Arbora.</strong><br>
+  <sub>Conversations · approvals · workflows · fleet activity · Understory knowledge views</sub>
+</p>
+
+<p align="center">
+
+[![PyPI - Version](https://img.shields.io/pypi/v/agent-webui)](https://pypi.org/project/agent-webui/)
+[![Build](https://github.com/Knuckles-Team/overstory/actions/workflows/release.yml/badge.svg)](https://github.com/Knuckles-Team/overstory/actions/workflows/release.yml)
+[![Documentation](https://img.shields.io/badge/docs-GitHub%20Pages-526cfe)](https://knuckles-team.github.io/overstory/)
+[![GitHub license](https://img.shields.io/github/license/Knuckles-Team/overstory)](LICENSE)
+[![Docs build](https://github.com/Knuckles-Team/overstory/actions/workflows/pages.yml/badge.svg?branch=main)](https://github.com/Knuckles-Team/overstory/actions/workflows/pages.yml)
+[![PyPI - Downloads](https://img.shields.io/pypi/dd/agent-webui)](https://pypi.org/project/agent-webui/)
+[![PyPI - License](https://img.shields.io/pypi/l/agent-webui)](https://pypi.org/project/agent-webui/)
+[![PyPI - Wheel](https://img.shields.io/pypi/wheel/agent-webui)](https://pypi.org/project/agent-webui/)
+[![PyPI - Implementation](https://img.shields.io/pypi/implementation/agent-webui)](https://pypi.org/project/agent-webui/)
+[![GitHub Repo stars](https://img.shields.io/github/stars/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/stargazers)
+[![GitHub forks](https://img.shields.io/github/forks/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/forks)
+[![GitHub contributors](https://img.shields.io/github/contributors/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/graphs/contributors)
+[![GitHub last commit (by committer)](https://img.shields.io/github/last-commit/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/commits/main)
+[![GitHub pull requests](https://img.shields.io/github/issues-pr/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/pulls)
+[![GitHub closed pull requests](https://img.shields.io/github/issues-pr-closed/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/pulls?q=is%3Apr+is%3Aclosed)
+[![GitHub issues](https://img.shields.io/github/issues/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory/issues)
+[![GitHub top language](https://img.shields.io/github/languages/top/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub language count](https://img.shields.io/github/languages/count/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub repo size](https://img.shields.io/github/repo-size/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+[![GitHub repo file count (file type)](https://img.shields.io/github/directory-file-count/Knuckles-Team/overstory)](https://github.com/Knuckles-Team/overstory)
+
+</p>
+
+<p align="center">
+  <a href="https://knuckles-team.github.io/overstory/">Documentation</a> ·
+  <a href="https://knuckles-team.github.io/overstory/features/">Capabilities</a> ·
+  <a href="https://knuckles-team.github.io/overstory/architecture/">Interfaces</a> ·
+  <a href="https://knuckles-team.github.io/overstory/status/">Status</a>
+</p>
+
+![Chat and tasks in the accepted green glass theme, with an unsent synthetic project draft.](docs/assets/screenshots/work-wide.png)
+
+The conversation-first workspace uses synthetic demo data, not a live account.
+Open **Settings** for theme, surface and privacy choices.
+See the [workspace gallery and screenshot refresh guide](docs/screenshots.md).
+
+## Overview
+
+Overstory is the browser workspace composed by Arbora. It brings agent
+conversations, approvals, workflows, fleet activity, and Medulla
+exploration into one React application. Its FastAPI host keeps privileged
+credentials and gateway delegation on the server side.
+
+| Overstory owns | Other components own |
+|---|---|
+| Browser presentation, local interaction state, accessible route composition, and the FastAPI boundary | Arbora owns public routing, identity, policy, and fleet supervision; Meristem applies supplied plans; Medulla owns durable knowledge; connector services own external-system effects |
+
+Current package Version: 2.8.3.
+
+## Key capabilities
+
+- Stream agent responses with sources, governed tool activity, and approval prompts.
+- Build and run workflows while observing sessions, goals, schedules, and fleet health.
+- Explore property graphs, RDF, schemas, objects, tables, documents, code, and memories through Understory and Medulla.
+- Discover MCP Apps and connector capabilities without exposing service credentials to the browser.
+- Apply one role-aware navigation and server authorization model across the complete workspace.
+- Run as the Arbora-hosted browser co-service or as an independently deployed ASGI application.
+
+## Documentation
+
+Start with the [Overstory documentation](https://knuckles-team.github.io/overstory/),
+then use the shared platform map to move between components:
+
+| Component | Role | Documentation |
+|---|---|---|
+| Overstory | Browser operator workspace and Understory knowledge views | [Docs](https://knuckles-team.github.io/overstory/) |
+| Tuig | Terminal and headless client; central A2A/REST and experimental headless local ACP; full session parity remains unqualified | [Docs](https://knuckles-team.github.io/tuig/) |
+| Axil | Desktop cockpit for chat, graph, fleet, health, and operator workflows | [Docs](https://knuckles-team.github.io/axil/) |
+| Arbora messaging | Chat and voice entrypoints hosted by Arbora | [Docs](https://knuckles-team.github.io/arbora/) |
+| Arbora | Public MCP, REST, A2A, identity, policy, and runtime composition | [Docs](https://knuckles-team.github.io/arbora/) |
+| Meristem | In-run harness that applies supplied plans | [Docs](https://knuckles-team.github.io/meristem/) |
+| Medulla | Durable multimodal data, reasoning, provenance, and transactions | [Docs](https://knuckles-team.github.io/medulla/) |
+| Scion SDK | Typed source adapters, connector serving, and write-back contracts | [Docs](https://knuckles-team.github.io/scion-sdk/) |
+
+## Architecture
+
+[![Runtime architecture: people use Agent Web UI, Agent Terminal UI, Geniusbot, and Arbora-hosted messaging. MCP, REST, and A2A clients enter through Arbora; source systems flow through Agent Connector SDK into Epistemic Graph.](https://raw.githubusercontent.com/Knuckles-Team/medulla/main/docs/assets/runtime-architecture.svg)](https://knuckles-team.github.io/.github/architecture/#webui)
+
+[Explore the live architecture](https://knuckles-team.github.io/.github/architecture/#webui)
+
+People also enter through Tuig and Axil or Arbora-hosted
+messaging. Tuig retains central A2A/REST and experimental headless local ACP;
+full session parity remains unqualified. External applications connect over MCP,
+REST, or A2A. The browser talks only to its same-origin FastAPI host. Arbora injects gateway routes and
+verified request context. Meristem applies supplied plans; Medulla owns
+durable knowledge. Source systems connect through Scion SDK
+directly to Medulla. Overstory renders typed results
+and local presentation state while each service retains its own authority.
+
+See the [architecture guide](https://knuckles-team.github.io/overstory/architecture/)
+for the request flow and trust boundaries.
+
+## Quick start
+
+Generate a local profile and start Arbora with Overstory enabled:
+
+```bash
+uvx --from "arbora[webui]" setup-config generate --profile tiny
+export ENABLE_WEB_UI=true
+uvx --from "arbora[webui]" arbora --transport streamable-http --host 127.0.0.1 --port 8000
+```
+
+Open <http://127.0.0.1:8080>. Arbora serves MCP on port `8000` and the Agent
+Web UI co-service on port `8080`. The [start guide](https://knuckles-team.github.io/overstory/start/)
+covers local source development and deployment profiles.
+
+## Contributing
+
+Issues and pull requests are welcome. Read [AGENTS.md](AGENTS.md), keep browser
+and server authority boundaries intact, and run the repository validation suite
+before opening a pull request.
+
+Refresh the documented workspace views with `pnpm screenshots:refresh`. See the
+[screenshot guide](docs/screenshots.md) for synthetic fixtures, hosted capture,
+provenance and review before committing refreshed images.
+
+## License
+
+Overstory is available under the [MIT License](LICENSE).

{agent_webui-2.8.2 → agent_webui-2.8.3}/agent/agent_webui/__tests__/test_browser_control.py

@@ -16,12 +16,13 @@ from agent_webui.browser_control import (
     BrowserControlBinding,
     BrowserMessage,
     ControlCancelled,
+    ServerMessage,
 )
 from agent_webui.browser_control_canonical import canonical_protocol_json
 from agent_webui.server import create_agent_web_app
 from cryptography.fernet import Fernet
 from fastapi.testclient import TestClient
-from pydantic import BaseModel, ConfigDict
+from pydantic import BaseModel, ConfigDict, TypeAdapter, ValidationError
 from starlette.websockets import WebSocketDisconnect
 
 pytestmark = pytest.mark.integration
@@ -108,7 +109,10 @@ class MismatchedCatalogReceiptConnection(RecordingConnection):
 class AcknowledgingConnection(RecordingConnection):
     async def receive(self, message: BrowserMessage) -> Any:
         receipt = await super().receive(message)
-        if message.type != 'catalog.register':
+        if (
+            message.type != 'catalog.register'
+            and message.type != 'control.proposal_response'
+        ):
             await self.outbound_send(
                 _AuCancel(
                     protocol='webmcp.control.v1',
@@ -277,7 +281,7 @@ def _browser_headers(*, origin: str = 'https://au.example') -> dict[str, str]:
     session = {
         'access_token': 'verified-human-access-token',
         'refresh_token': '',
-        'expires_at': time.time() + 300,
+        'expires_at': int(time.time()) + 300,
     }
     packed = zlib.compress(json.dumps(session).encode('utf-8'), 9)
     sealed = Fernet(_SESSION_KEY.encode('ascii')).encrypt(packed).decode('ascii')
@@ -1002,3 +1006,110 @@ def test_unicode_result_uses_the_same_utf8_json_budget_as_the_browser(
         )
 
     assert port.connection.messages[-1].type == 'control.result'
+
+
+def _proposal_request() -> dict[str, Any]:
+    return {
+        'protocol': 'webmcp.control.v1',
+        'type': 'control.proposal_request',
+        'proposal_id': 'proposal-1',
+        'proposal_digest': _DIGEST,
+        'registration_generation': 7,
+        'tool_id': 'webui.page.context',
+        'schema_digest': _DIGEST,
+        'arguments': {},
+        'requester_agent': 'web-agent',
+        'requester_run_ref': 'run-1',
+        'expires_at': int(time.time()) + 30,
+    }
+
+
+def test_proposal_wire_round_trip_uses_existing_authority_connection(
+    mock_agent: Any,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    _configure_identity(monkeypatch)
+    port = RecordingPort()
+    request = _proposal_request()
+    withdrawn = {
+        'protocol': 'webmcp.control.v1',
+        'type': 'control.proposal_withdrawn',
+        'proposal_id': 'proposal-1',
+        'reason': 'declined',
+    }
+
+    class ProposalConnection(RecordingConnection):
+        async def receive(self, message: BrowserMessage) -> Any:
+            receipt = await super().receive(message)
+            if message.type == 'control.cancelled':
+                await self.outbound_send(request)
+            if message.type == 'control.proposal_response':
+                await self.outbound_send(withdrawn)
+            return receipt
+
+    port.connection = ProposalConnection()
+    client = TestClient(_app(mock_agent, port))
+    with client.websocket_connect(
+        '/ws/browser-control', headers=_browser_headers()
+    ) as websocket:
+        websocket.send_json(_OPEN)
+        websocket.send_json(_CATALOG)
+        assert websocket.receive_json()['type'] == 'channel.ready'
+        websocket.send_json(
+            {
+                'protocol': 'webmcp.control.v1',
+                'type': 'control.cancelled',
+                'call_id': 'synthetic-trigger',
+                'effect': 'none',
+            }
+        )
+        assert websocket.receive_json() == request
+        websocket.send_json(
+            {
+                'protocol': 'webmcp.control.v1',
+                'type': 'control.proposal_response',
+                'proposal_id': 'proposal-1',
+                'proposal_digest': _DIGEST,
+                'accepted': False,
+            }
+        )
+        assert websocket.receive_json() == withdrawn
+    assert port.connection.messages[-1].type == 'control.proposal_response'
+    assert port.connection.messages[-1].accepted is False
+    assert len(port.bindings) == 1
+
+
+@pytest.mark.parametrize(
+    'field,value',
+    [
+        ('registration_generation', True),
+        ('registration_generation', 0),
+        ('schema_digest', 'wrong'),
+        ('requester_run_ref', '../run'),
+        ('requester_agent', 'a' * 513),
+        ('expires_at', float('inf')),
+        ('arguments', {'bad': float('nan')}),
+    ],
+)
+def test_proposal_server_wire_rejects_malformed_input(field: str, value: Any) -> None:
+
+    with pytest.raises((ValidationError, ValueError)):
+        TypeAdapter(ServerMessage).validate_python(
+            {**_proposal_request(), field: value}, strict=True
+        )
+
+
+@pytest.mark.parametrize('accepted', ['true', 1, None])
+def test_proposal_response_requires_a_boolean_decision(accepted: Any) -> None:
+
+    with pytest.raises(ValidationError):
+        TypeAdapter(BrowserMessage).validate_python(
+            {
+                'protocol': 'webmcp.control.v1',
+                'type': 'control.proposal_response',
+                'proposal_id': 'proposal-1',
+                'proposal_digest': _DIGEST,
+                'accepted': accepted,
+            },
+            strict=True,
+        )

{agent_webui-2.8.2 → agent_webui-2.8.3}/agent/agent_webui/__tests__/test_oidc_session.py

@@ -1714,3 +1714,81 @@ async def test_verify_browser_session_rejects_a_principal_mismatch(
         await verify_browser_session(
             scope, session, authority=authority, console_origin=_EVIDENCE_ORIGIN
         )
+
+
+@pytest.mark.anyio
+@pytest.mark.parametrize('path', [SESSION_PATH, '/api/fixture'])
+@pytest.mark.parametrize('refresh', ['', 'rejected-refresh'])
+async def test_expired_http_session_clears_cookies_and_status(
+    monkeypatch, path, refresh
+):
+    async def refuse_api(scope, receive, send):
+        assert not any(key == b'authorization' for key, _ in scope['headers'])
+        await OIDCBrowserSessionMiddleware._respond(send, 401)
+
+    middleware = OIDCBrowserSessionMiddleware(refuse_api, settings=_settings())
+
+    async def rejected(_form):
+        return None
+
+    monkeypatch.setattr(middleware, '_token_request', rejected)
+    sealed = middleware._seal(
+        {
+            'access_token': 'expired-fixture',
+            'refresh_token': refresh,
+            'expires_at': time.time() - 1,
+        }
+    )
+    cookie = '; '.join(
+        raw.decode().split(';', 1)[0]
+        for _, raw in _session_cookie_headers(sealed, secure=False)
+    )
+    send = _Recorder()
+    await middleware(_scope(path, headers=[(b'cookie', cookie.encode())]), None, send)
+    assert send.status == (200 if path == SESSION_PATH else 401)
+    if path == SESSION_PATH:
+        assert json.loads(send.body) == {'authenticated': False}
+    assert send.headers(b'set-cookie') == [
+        raw for _, raw in _clear_session_cookie_headers(secure=False)
+    ]
+
+
+@pytest.mark.anyio
+async def test_session_status_renews_and_persists_cookie(monkeypatch):
+    middleware = OIDCBrowserSessionMiddleware(_noop_app, settings=_settings())
+
+    async def renewed(form):
+        assert form['refresh_token'] == 'refresh-fixture'
+        return {
+            'access_token': 'new-fixture',
+            'expires_in': 300,
+            'refresh_token': 'renewed-refresh-fixture',
+        }
+
+    monkeypatch.setattr(middleware, '_token_request', renewed)
+    sealed = middleware._seal(
+        {
+            'access_token': 'expired-fixture',
+            'refresh_token': 'refresh-fixture',
+            'expires_at': time.time() - 1,
+        }
+    )
+    cookie = '; '.join(
+        raw.decode().split(';', 1)[0]
+        for _, raw in _session_cookie_headers(sealed, secure=False)
+    )
+    send = _Recorder()
+    await middleware(
+        _scope(SESSION_PATH, headers=[(b'cookie', cookie.encode())]), None, send
+    )
+    assert json.loads(send.body)['authenticated'] is True
+    cookies = {
+        raw.decode().split(';', 1)[0].split('=', 1)[0]: raw.decode()
+        .split(';', 1)[0]
+        .split('=', 1)[1]
+        for raw in send.headers(b'set-cookie')
+    }
+    renewed_session = middleware._unseal(_read_session_cookie(cookies))
+    assert renewed_session is not None
+    assert renewed_session['access_token'] == 'new-fixture'
+    assert renewed_session['refresh_token'] == 'renewed-refresh-fixture'