Add Code Bridge app client and subscriber vertical slice #47

Current Status

Updated 2026-06-15 by Code after planning turn with agents.

State: Ready for implementation after #45 and #46. This is the first end-to-end app telemetry/control proof on top of the shared protocol and standalone local service.

Agreed implementation boundary:

• Go straight to authenticated SSE for service-to-client/subscriber delivery rather than building a likely throwaway long-poll transport.
• Keep the first client surface fixture/test-support grade. Do not create or publish a stable TypeScript SDK/package yet.
• Use the dedicated screenshot message family (ScreenshotRequest/ScreenshotResponse) for screenshots instead of routing screenshots through generic control.
• Treat JavaScript execution as an explicit privileged capability grant: powerful and useful for agents, but not ambient for every connected page. Tests should prove both denied-by-default and succeeds-when-granted behavior.
• Keep app-server, Launchplane, and discord-blue out of this slice.

Likely implementation order:

1. Extend codex-code-bridge-service into a minimal broker: retained bounded events, per-subscriber SSE delivery, subscription filters, nonblocking producer publish, request routing, response correlation, and request timeout cleanup.
2. Add a small browser/client fixture or test-support surface that discovers the descriptor, authenticates, publishes console/error/pageview, provides screenshot, and optionally grants executable control.
3. Add Rust integration tests for broker behavior and one browser/UI smoke for nonblank screenshot plus event/control round trip.

Acceptance Criteria

• A minimal client fixture/test-support surface discovers the local bridge descriptor, authenticates, and fails quietly when no bridge is running.
• Producer path publishes bounded console, error, and pageview events.
• Subscriber delivery uses authenticated SSE from the service, can filter by level/event family/client id, and cannot block producers.
• Screenshot request/response uses ScreenshotRequest/ScreenshotResponse, is capability-gated, bounded, correlated by request id, and times out cleanly.
• Control request/response is capability-gated and correlated by request id.
• JavaScript execution control is available only as an explicit privileged capability grant, not as an ambient default for every bridge-connected page.
• Browser/UI smoke proves nonblank screenshot and event/control round trip.
• Model-visible summaries remain bounded and do not inject raw high-volume logs/screenshots into context.

Target Surface

Code Bridge service/client package plus a small neutral example app or fixture. This should not require discord-blue, Launchplane, or app-server integration.

Validation Gate

Service integration tests with fake producer/subscriber; browser smoke for a sample client; any JS/package test command introduced by the chosen client package location.

Risks

The internal Code Bridge tooling can run JavaScript control, but the public client default should not create an unguarded local eval surface. Prefer named registered handlers first.

Finish Line

A sample app can connect to the Code Bridge service, publish bounded console/error/pageview events, respond to screenshot/control requests, and a subscriber can observe the round trip.

Open Questions

Resolved in 2026-06-15 planning turn:

• Use SSE for subscriber delivery in Add Code Bridge app client and subscriber vertical slice #47.
• Start with fixture/test-support rather than a published client package.
• Use screenshot-specific protocol messages for screenshots.
• Preserve agent power by supporting JavaScript execution as an explicit privileged grant, while keeping it disabled by default for ordinary bridge-connected pages.

Still to decide during implementation:

• Exact SSE event wrapper shape and whether it remains service-local or becomes protocol-level later.
• Where the browser fixture lives so it stays easy to test without implying a stable public SDK.
• Whether CI should run the browser smoke immediately or keep it as targeted/manual evidence until the fixture stabilizes.