fix(webui): close Mini App review gaps

Author: Fectivnfy112357

packages/local-runtime-v2/src/service/miniapp/composition.ts

@@ -29,7 +29,6 @@ export interface RuntimeMiniAppServiceOptions {
 
 export function resolveRuntimeMiniAppOptions(
   input: RuntimeMiniAppServiceOptions & {
-    readonly runtimeOwnerKind?: string;
     /** The runtime owner policy's `wiring.miniAppService` cell for this host. */
     readonly miniAppService?: boolean;
   },

packages/local-runtime-v2/test/unit/miniapp/runtime-miniapp-options.test.ts

@@ -12,7 +12,7 @@ describe('resolveRuntimeMiniAppOptions', () => {
     expect(resolveRuntimeMiniAppOptions({ miniAppService: false })).toBeUndefined();
   });
 
-  it('keeps explicit options reachable, including with no declared owner kind', () => {
+  it('keeps explicit options reachable even when the policy cell is false', () => {
     const miniApp = { dataDir: '/tmp/miniapp' } as Parameters<
       typeof resolveRuntimeMiniAppOptions
     >[0]['miniApp'];
@@ -21,11 +21,4 @@ describe('resolveRuntimeMiniAppOptions', () => {
     expect(resolveRuntimeMiniAppOptions({ miniApp, miniAppService: false })).toBe(miniApp);
   });
 
-  it('no longer reads the owner kind directly, so a row cannot disagree with the cell', () => {
-    // The cell is the only owner-derived input: an electron runtime whose row does not carry it
-    // gets no service, which is what makes the capability flag and the service agree.
-    expect(
-      resolveRuntimeMiniAppOptions({ runtimeOwnerKind: 'electron', miniAppService: false }),
-    ).toBeUndefined();
-  });
 });

packages/webui/docs/adr/0020-webui-miniapp-view-and-runtime-seams.md

@@ -1,7 +1,6 @@
 # WebUI Mini App view and its runtime seams
 
-**Status:** Product direction accepted and the decisions below settled; implementation is pending and
-the questions at the end of this record remain open.
+**Status:** Product direction accepted and implemented in the Mini App hosting stack.
 **Date:** 2026-10-20, revised 2026-10-26.
 
 The WebUI will host Mini Apps. A Mini App's page is rendered as an iframe the client loads
@@ -449,11 +448,18 @@ page's own scripts run, so the proxy injects a script tag for it before `</head>
 `Content-Length` because the body it sends is not the body it received. Everything else — paths, methods,
 status codes, the page's own headers — passes through unchanged.
 
-## Open implementation questions
-
-1. **The bridge's method-level error mapping.** Which failure code each bridge call answers when the
-   host cannot serve it — an unsupported capability, a full queue, a runtime that stopped between two
-   calls — and how a page's request identifier survives the `postMessage` boundary.
+## Bridge request and error behavior
+
+The bridge preserves the page's `requestId` through the `postMessage` request, the host operation
+and the response or event, so concurrent calls settle only the promise that started them. The host
+validates the source frame and its origin before it accepts a request. Malformed payloads answer
+`invalid_request`; a duplicate in-flight request id answers `busy`; a page without a host session
+answers `not_permitted`; and a runtime without the Agent capability answers `runtime_unavailable`.
+For supported calls, the service's documented failure code is preserved. If transport fails after a
+turn or call may have taken effect, the bridge answers `result_unknown` rather than inviting an unsafe
+retry. The shared contract and runtime Agent contract define the accepted failure codes and the
+`busy` reasons (`packages/shared/src/miniapp-surface.ts` and
+`packages/local-runtime-v2/src/service/miniapp/agent/contracts.ts`).
 
 ## Research findings
 

packages/webui/docs/known-gaps.md

@@ -4,7 +4,8 @@ Capabilities the WebUI does not have, verified against the tree. Each entry says
 how, and what remains unverified. "Not implemented" and "not decided" are different states and are
 kept apart here; the undecided ones are also in `open-questions.md`.
 
-Last verified: 2026-10-26, against `webui` at `88c83655`. This list covers capabilities; open
+Last verified: 2026-10-27, against the Mini App hosting stack merged with `origin/webui` at
+`ba946c06`. This list covers capabilities; open
 decisions are in [`open-questions.md`](open-questions.md).
 
 ## 1. Connector and App tools depend on a beta feature, and on the model finding them
@@ -43,11 +44,12 @@ them. They are listed so a future reader does not rediscover them as wiring gaps
 
 | Site | Gate | What the WebUI does not get |
 | --- | --- | --- |
-| `local-runtime-v2/src/service/miniapp/composition.ts` | `runtimeOwnerKind !== 'electron'` → `undefined` | The miniapp service |
 | `local-runtime-v2/src/runtime.ts` (`greetingEnabled`) | `runtimeOwnerKind === 'electron'` | The startup greeting |
 | `local-runtime-v2/src/service/llm-context-inspector/initialize.ts` | `runtimeOwnerKind === 'tui'` plus `MAVIS_TUI_LLM_CONTEXT_INSPECTOR=1` | The context inspector (the terminal client can opt in; the WebUI cannot) |
 
-The miniapp and inspector gates are service-availability decisions, not client-policy bugs.
+The inspector gate is a service-availability decision, not a client-policy bug. Mini App service
+availability is driven by the runtime owner's `wiring.miniAppService` cell, including the WebUI row;
+the service composition no longer compares `runtimeOwnerKind` directly.
 
 ## 3. The data directory is displayed, not relocated
 
@@ -118,35 +120,7 @@ The bridge's **restricted action set is otherwise the same 28 actions** the isol
 executes, and both are executed by Browser Core — one implementation over two transports. See
 [`browser-use/10-browser-core-integration.md`](browser-use/10-browser-core-integration.md).
 
-## 9. The Mini App capability is not reachable from this client
-
-The runtime owns a Mini App service — a supervisor, a node runtime that spawns the Mini App's own
-process, a plugin package reader, and a session Mini App lifecycle. None of it is reachable from
-the WebUI:
-
-- `local-runtime-v2/src/service/miniapp/composition.ts` returns no options unless the runtime owner
-  kind is `electron`, so in the WebUI process the Mini App supervisor is never initialized and
-  `miniappAvailable` is false.
-- `CliService` has no Mini App method, so there is no client entry for the capability the runtime
-  already owns in `application/session/process-local-miniapp-application.ts`.
-- The client has no Mini App view, no proxy, and no page bridge.
-
-The Mini App contract in this repository is also one generation behind the implementation shipped
-in the desktop client: `packages/shared/src/miniapp-surface.ts` here is 54 lines against 1267
-there, and this repository's runtime has no credential guard on the Mini App's own HTTP server.
-The newer contract is in neither this repository nor the public upstream tree, so it does not
-arrive by synchronization. The accepted direction for this client — which generation of the contract
-is taken, what the bridge carries, where the view lives and how a standalone presentation is
-tracked — is in [ADR 0020](adr/0020-webui-miniapp-view-and-runtime-seams.md).
-
-The owner-kind gate is also decided in the wrong place. The runtime owner policy resolves once per
-host and drives the other owner-derived service gates — cron, channels, the scheduler — from its
-cells, while the Mini App gate compares the raw kind string inside its own service
-(`local-runtime-v2/src/service/miniapp/composition.ts`). That is why §2 lists it as a branch no
-change to this client's row can reach. The accepted shape moves the Mini App service into the
-policy as a wiring cell this client's row carries.
-
-## 10. A symlink out of the workspace is not detectable by the diff boundary
+## 9. A symlink out of the workspace is not detectable by the diff boundary
 
 **Implemented, with a stated limit.** A turn's diff can name a file outside the workspace, and the
 client now withholds that file's body: the entry keeps its name, its status and its line counts,

packages/webui/test/browser/miniapp-panel.spec.mjs

@@ -137,6 +137,38 @@ test("the launcher's 应用 tile opens the picker and the chosen Mini App is fra
   await expect(page.getByTestId("workspace-panel")).toHaveAttribute("data-active-tab", "miniapp");
 });
 
+test("a Mini App owned by another client reports the refusal and stays unopened here", async ({ page }) => {
+  await configureFixture(page, () => {
+    window.__WEBUI_FIXTURE_SETUP__ ??= [];
+    window.__WEBUI_FIXTURE_SETUP__.push(() => {
+      window.__fixture.setResponse("listMiniApps", { miniApps: [{
+        pluginId: "demo.miniapp",
+        displayName: "演示应用",
+        runtime: { kind: "process", status: "running" },
+      }] });
+      window.__fixture.refuseOperation(
+        "openMiniApp",
+        "OWNED_ELSEWHERE",
+        "Mini App is already running in Desktop",
+      );
+    });
+  });
+  await openApp(page);
+  await openWorkspacePanel(page);
+  await page.getByTestId("workspace-launcher-tile-miniapp").click();
+  await page.getByTestId("miniapp-picker").getByRole("button", { name: "打开" }).click();
+
+  await expect(page.getByTestId("miniapp-picker")).toContainText(
+    "已在其他客户端运行：Mini App is already running in Desktop",
+  );
+  await expect(page.getByTestId("miniapp-view-frame")).toHaveCount(0);
+  expect(
+    await page.evaluate(() =>
+      window.__fixture.requests.filter((request) => request.operation === "openMiniApp").length,
+    ),
+  ).toBe(1);
+});
+
 test("a stopped Mini App clears its view and reopens only when the person asks", async ({ page }) => {
   await configureFixture(page, () => {
     window.__WEBUI_FIXTURE_SETUP__ ??= [];