Brings the app-use feature (OPENSWARM_APP bridge, AppAgent delegation tool,
BrowserClickPoint, autopilot supervision) onto the linted eric/dev base.
- Resolved 9 conflicts favoring eric's refactored structure; renamed all of
pierre's _-prefixed names to p_/P_, kept eric's prior_messages resume guard.
- Made the 4 test-exercised bridge helpers public (p-private rule).
- Wired AppAgent into browser_delegation_tools + BuiltinTool registry and
threaded selected_app_output_ids -> OPENSWARM_SELECTED_APP_IDS (eric had
forward-ported the prompt but not the tool, so it was unreachable).
- Linter clean (underscore/p-private/ruff/cycles 0); 301 backend tests pass.
Without this the file was missing on first run, load_builtin_permissions()
returned {}, and the agent fell through to _DEFAULTS={Bash:'ask'} even
though the Settings UI showed green 'always_allow' checkmarks (because the
UI defaulted missing entries to always_allow for DISPLAY but the agent
defaults to ask for SAFETY). The mismatch meant users got prompted on
every ls/cd/pwd despite having flipped Bash to always_allow in the UI.
Lifespan now seeds the file with Bash=ask and everything else=always_allow,
matching agent_manager._DEFAULTS. Idempotent: only writes if a tool is
missing; never clobbers a policy the user already set.
google-workspace-mcp's gauth.py hardcodes token_uri to oauth2.googleapis.com
and uses local CLIENT_ID/SECRET on every refresh. OAuth runs through a
rotation pool on the cloud side, so the refresh_token is bound to the
pool slot that minted it, not the single client baked into the DMG, and
direct refreshes return unauthorized_client. Redirect spawn through a
shim that monkey-patches get_credentials to point token_uri at a local
proxy (/api/tools/google-oauth-token), which forwards the refresh to
api.openswarm.com/api/oauth/google/refresh (pool-aware). Unblocks every
Gmail/Drive/Calendar query for users on the cloud OAuth pool.
that dir and retry once — fixes Discord/YouTube failing with "MCP stdio process exited unexpectedly" after partial npx installs,
per-browser auto-close: spawned browser cards now disappear on their own sub-agent's completion instead of lingering until the parent agent
finishes, WebSocketManager agent:status matches by session.browser_id (spawned_by is the parent, so it never matched the finishing
sub-agent), user-created/pre-selected browsers untouched
- Bundle uv/uvx universal binaries in backend/uv-bin/ (downloaded during build)
- tools_lib: _extra_bin_dirs and _resolve_command check uv-bin/ for uvx
- build-app.sh: auto-download uv for both architectures, create universal binary
- run.sh: auto-download uv for dev mode on first run
- Removed google-workspace-mcp from requirements.txt (dependency conflict with langchain
- browser_agent.py: use get_anthropic_client instead of raw api_key, fix model map for 9Router
- credentials.py + agent_manager.py: subscription (9Router) checked before API key everywhere
- main.py: clean browser-agent endpoint, no credential params
- tools_lib.py: when uvx not found, fall back to pip-installed binary from venv
- requirements.txt: add google-workspace-mcp so it works without uvx
ciregenz