feat(hub): host 'open in' app launchers on the box detail page

[madarco]

What

Adds the tray's Open In host-app launchers to the web hub. The box detail Access section now has an Apps row that opens the box in a host app — Codex, VS Code/Cursor, cmux, Herdr, iTerm2 — right-aligned next to the existing Open web / Open VNC.


Each app appears only when it's installed on the host AND eligible for the box's provider (e.g. Codex is Hetzner-only, so it's hidden on docker boxes).

How

• Reuse without extraction. The hub server already receives AGENTBOX_CLI_ENTRY (the same env the relay uses to re-shell cp/checkpoint host actions), so the backend re-shells agentbox open <id> --in <app> and agentbox open --targets --json. This reuses all the CLI's SSH-alias / codex:// deep-link / terminal-spawn / IDE-launch logic verbatim — no CLI-internal code moved into a shared package.
• Localhost + macOS only. Host-GUI launches only make sense on the user's own machine, so the backend gates on hubProfile() === 'localhost' && process.platform === 'darwin'. A remote (hetzner/vercel) or non-macOS hub reports supported: false and the Apps row hides.
• REST, not Server Actions (per the hub convention that new features go behind /api/v1 with client fetch):
  • GET /api/v1/open-targets — which apps are launchable (cached ~60s host probe).
  • POST /api/v1/boxes/:id/open — launch { app }.
• The Box view-model gains a provider field so the client can gate per-box.
• CLI error output (clack on stdout, with gutter glyphs) is cleaned so failures like the Codex Hetzner-only gate surface as a readable message, not execFile's "Command failed".

Verify

• GET /api/v1/open-targets on this Mac → supported: true with the five apps + provider eligibility.
• POST …/open {app:"iterm2"} on a docker box → {ok:true} and a real agentbox attach … --inline process spawned in a new iTerm2 window (verified via ps, not just the 200).
• POST …/open {app:"codex"} on a docker box → 409 with the clean "only Hetzner cloud boxes qualify" message; invalid app → 400.
• Browser: the detail page renders the Apps row (VS Code / cmux / Herdr / iTerm2; Codex correctly absent on docker), right-aligned in the Access card.
• pnpm --filter @agentbox/hub typecheck + eslint clean.

Docs

• OpenAPI spec (/api/v1/openapi.json) gains both endpoints.
• apps/web/content/docs/hub.mdx Box-detail bullet documents the Access Apps launchers + the localhost/macOS gate.

No CLI surface changed (reuses agentbox open --in), so no CLI-reference or tray changes.

---

Note

Low Risk
UI and localhost-only host app spawning via existing CLI; no auth or data-model changes beyond an informational provider field on boxes.

Overview
Brings the tray/CLI Open In flow to the web hub: the box detail Access card gains an Apps row (alongside web/VNC) with buttons for Codex, VS Code/Cursor, cmux, Herdr, and iTerm2 when the host reports them installed and eligible for the box’s provider (new provider field on the Box view model).

New GET /api/v1/open-targets (cached ~60s host probe) and POST /api/v1/boxes/:id/open with { app } validation; OpenAPI and hub docs updated. The Node backend implements openTargets / openIn by re-shelling agentbox open --targets --json and agentbox open <id> --in <app> via AGENTBOX_CLI_ENTRY, only when hubProfile() === 'localhost' and darwin; remote/Postgres hubs return supported: false and mutating open 503s like other host-only routes. Synthetic job: boxes get 409 on open; CLI clack stdout is cleaned for readable API errors.

^{Reviewed by Cursor Bugbot for commit 079afbb. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
agentbox-web	Skipped		Jul 8, 2026 8:57am

[madarco]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 079afbb. Configure here.}