[TigerYWang]

What changes

When a bot makes a new app on its computer while the owner's Mac is off, Your Apps now shows its Preview link right away:

• Admins and members with Your Apps at Write see the link and its password (Show password), as soon as the bot's computer sets it.
• Read members see the link and "asks for a password", never the password.
• None, the owner's own view, and workspaces whose owner isn't Orgo's team: no change.
• A site the owner's Mac read before its Preview existed (preview null) gets the link filled in. A site the Mac never read (a second site) is added after the app's own site.
• A link the owner's Mac read is never changed. Once the Mac reads the app, its row is used and the newest cloud password is shown beside it, as in 0.0.50.
• Members now see up to 100 apps (was 30), the same as the most a workspace's computers may make (MAX_APPS_FROM_COMPUTER). New apps come last in the list, so with the old cap of 30 the newest ones were the ones hidden.

This is a Bops Cloud change only (cloud/ws-slice.ts, new sitesFilled / previewLinkOf / recordSites next to withCloudPasswords). The rest of the diff is comments (cloud/preview-passwords.ts, the SharedApp.sites comment in cloud/protocol.ts) and tests.

Why

With the Mac off, Bops Cloud already has everything it needs. The runner writes the app's record with its sealed Preview label (computer-scope.ts HOSTING_NEW / RUN_SHAPE / sealedFor). It also shares the password together with its exact Orgo link (POST /v1/apps/preview-password, held to appHomeHere). But appsFor built members' sites only from the owner's Mac's copy (appsForMembers), so the app showed by name only until the Mac came back. Nothing members need should wait on the owner's Mac.

Which link is shown

• The link is the url of the cloud password entry (previewPasswords["<app>/<site>"]). Bops Cloud can't build it from the label alone, because orgo-web may put it under orgo.dev or another name inside orgo.dev.
• It is shown only when it is exactly https://<label>.<names>.orgo.dev (an optional / at the end is allowed) and <label> is the site's own label copy on the app's record. So: no port (not even :443), no path, query, hash or sign in, no capitals, no trailing dot, and nothing outside orgo.dev.
• A runner can keep a label copy only if it is sealed for that app and site, and can share passwords only for its own apps. So a runner can't put a link of its choosing in Your Apps.
• A stale entry (an app made again, a site given a new link) doesn't match the record's label, so it is never shown.
• The filled row never reads the entry's password. The password reaches Write viewers only through the existing withCloudPasswords, which matches the filled link exactly.
• No fill for an app with lost, or for a site with passwordOff (only the owner's Mac writes that).

How I checked it

• node --test cloud/test/core-members.test.ts: 83 pass. There are 5 new tests, red against main's ws-slice.ts and green with this change:
  • Admin, Write member and Read member views (with exact rows). Orgo's team capped to Read. None, no entry, a workspace not owned by Orgo's team, and the owner.
  • 23 lookalike or wrong links and records that must not show anything. Also checks that web.orgo.dev and staging.orgo.dev links do show.
  • The Mac's rows: a null preview gets filled, an existing link is kept, a Mac older than 0.0.35 with no preview field, a row with only acts. Second sites, ordering, and the cap of 5 sites.
  • Fingerprints. Read doesn't change on a new password; Write changes by the entry's at only, never by the password.
  • The cap of 100 apps.
• node --test cloud/test/core-preview-passwords.test.ts on a throwaway Postgres 18: 9 pass. The new end to end test (red before, green after):
  • The runner (computer identity) writes the new app's record with a sealed label, then shares the password.
  • Admin and Sam (Write) see the link and password. Rae (Read) sees the link only.
  • Another computer's share is refused and shows nothing. Every viewer's fingerprint changes. The runner's own read never has the password.
  • Then the owner's Mac reads the app, and its row stands with the cloud password beside it.
• Whole core suite: node --test --test-concurrency=1 "cloud/test/core-*.test.ts": 376 pass, 0 fail.
• Script suites, all passing: test-members (all passed), test-shared 70, test-preview-password 27, test-computer-scope 19, test-live 14, test-bot-groups 22, test-hosted-apps-ui 73, test-state-merge 41, test-keys 48, test-app-restore 22.
• npx tsc -p cloud/tsconfig.json --noEmit and npx next typegen && npx tsc --noEmit -p . are clean. eslint on the touched files is clean. check-public.sh is OK.

Versions

• No protocol field is added, so there is no new *_MIN_VERSION gate.
• Members' windows of any version already render sites[].preview, previewProtected and previewPassword. Older windows ignore previewPasswordAt.
• A runner older than 0.0.50 never shares a password, so nothing new is shown: the app shows by name, as today, until the owner's Mac reads it.
• An owner's Mac of any version: its read stands wherever it has a link.
• Until this Bops Cloud is deployed, behavior is today's.

Not done, limits

• A Preview whose password the owner turned off has no cloud entry, so its link waits for the owner's Mac (accepted for now).
• The card's status word: Bops Cloud doesn't know the Preview's deploy state, so on main the card reads "Preview · Not on the web yet · " until the Mac reads it. The copy tweak belongs on top of Your Apps: review changes before publishing #186, which rewrites SharedAppCard. I left the window alone to avoid conflicts.
• Your Apps' Deploy and Publish buttons for members and Admins are still carried out by the owner's Mac (lib/server/member-acts.ts); with the Mac off they wait. Chat with the bot on its computer works.
• A missed share (Bops Cloud away for longer than the runner's ~20 minutes of retries) shows nothing until the next password set or a Mac read.
• A stale Mac row: if an app moved to another computer and got a new label, the Mac's old link stays shown until it reads again (a Mac link always stands).
• "As of" is still the Mac's last read.
• Deploy: this needs a Bops Cloud deploy, which I didn't do.