Peter Steinberger 3ccf2a0739 feat: render inline web chat widgets via capability-gated show_widget tool (#101840) ... Adds client-capability-gated tool availability: gateway clients declare capabilities at connect (new inline-widgets cap), chat.send stamps them into the run context, and every tool assembly path (embedded runner, queued followups, Codex app-server harness, plugin-only construction plans) drops tools whose requiredClientCaps the originating client did not declare. The Canvas plugin ships the first such tool, show_widget: agents pass SVG or an HTML fragment plus a title; the plugin hosts it as a bounded, retention-scoped Canvas document and returns the existing canvas preview handle, which web chat renders as a sandboxed iframe fitted to the widget's reported content height. Widget frames never get allow-same-origin (per-preview sandbox ceiling, including the sidebar path) and the Canvas host serves widget documents with a CSP sandbox header so direct navigation runs in an opaque origin. Verified live end-to-end on a Testbox with gpt-5.5 (screenshots on the PR). CLI-backed model backends do not carry client caps yet and stay fail-closed (#102577). Closes #101790		2026-07-09 12:29:50 +01:00
..
security	refactor: extract reusable AI runtime package (#99059)	2026-07-05 01:56:40 -04:00
authentication.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
background-process.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
bonjour.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
bridge-protocol.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
cli-backends.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
config-agents.md	docs(openai): refresh realtime 2.1 examples	2026-07-06 23:22:33 -07:00
config-channels.md	feat(slack): support Enterprise Grid org installs (#102372)	2026-07-08 23:53:19 -07:00
config-tools.md	feat: add follow-up task suggestions (#102422)	2026-07-09 06:30:01 +01:00
configuration-examples.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
configuration-reference.md	feat(update): notify extended-stable availability (#100438)	2026-07-06 19:57:03 -07:00
configuration.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
diagnostics.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
discovery.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
doctor.md	Doctor: audit lint default selection (#100361)	2026-07-08 14:34:57 -07:00
external-apps.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
gateway-lock.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
health.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
heartbeat.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
index.md	feat(gateway): add persisted crash-loop breaker and fatal-config exit contract	2026-07-06 06:45:55 +00:00
local-model-services.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
local-models.md	fix(agents): keep exec visible for lean local models (#101607)	2026-07-07 12:46:26 +01:00
logging.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
multiple-gateways.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
network-model.md	docs: consolidate moved docs pages	2026-05-05 17:38:21 +01:00
openai-http-api.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
openresponses-http-api.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
openshell.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
opentelemetry.md	fix: show exported tool results in trace viewers (#101371)	2026-07-07 17:14:30 +10:00
operator-scopes.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
pairing.md	fix: device pairing floods stacked approval alerts for a retrying device and stale approvals no-op (#100976)	2026-07-06 17:20:06 +01:00
prometheus.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
protocol.md	feat: render inline web chat widgets via capability-gated show_widget tool (#101840)	2026-07-09 12:29:50 +01:00
remote-gateway-readme.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
remote.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
sandbox-vs-tool-policy-vs-elevated.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
sandboxing.md	fix: land ten small reliability fixes (#100483)	2026-07-06 00:08:51 +01:00
secrets-plan-contract.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
secrets.md	Add Vault SecretRef plugin (#89255)	2026-07-09 05:30:12 -05:00
tailscale.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
tools-invoke-http-api.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
troubleshooting.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00
trusted-proxy-auth.md	docs: rewrite published docs grounded in current source (#100142)	2026-07-05 00:32:47 -04:00