feat(mini-apps): serve apps from ~/.rowboat/apps via app://miniapp

Apps are now user data on disk, not bundled in the repo.

- MiniAppManifest schema + mini-apps:list/get-data/seed IPC channels
- main: mini-apps-handler (list/get-data + seed install primitive) and an
  app://miniapp/<id>/ protocol host serving ~/.rowboat/apps/<id>/dist
- renderer lists installed apps from disk and loads each via app://miniapp
  (real origin: remote images/fetch work); data sourced from data.json
- removed the bundled sample apps from source (they live in ~/.rowboat/apps)

apps/x/packages/shared/src/index.ts

@@ -19,4 +19,5 @@ export * as browserControl from './browser-control.js';
 export * as billing from './billing.js';
 export * as notificationSettings from './notification-settings.js';
 export * as codeSessions from './code-sessions.js';
+export * as miniApp from './mini-app.js';
 export { PrefixLogger };

apps/x/packages/shared/src/ipc.ts

@@ -16,6 +16,7 @@ import {
 import { UserMessageContent } from './message.js';
 import { RowboatApiConfig } from './rowboat-account.js';
 import { ZListToolkitsResponse } from './composio.js';
+import { MiniAppManifest } from './mini-app.js';
 import { BrowserStateSchema } from './browser-control.js';
 import { BillingInfoSchema } from './billing.js';
 import { EmailBlockSchema, GmailThreadSchema } from './blocks.js';
@@ -1007,6 +1008,31 @@ const ipcSchemas = {
       shouldShow: z.boolean(),
     }),
   },
+  // Mini Apps: seed built-in apps to ~/.rowboat/apps/<id>/ (idempotent).
+  'mini-apps:seed': {
+    req: z.object({
+      apps: z.array(z.object({
+        manifest: MiniAppManifest,
+        html: z.string(),
+        data: z.unknown().optional(),
+      })),
+    }),
+    res: z.object({
+      seeded: z.array(z.string()),
+    }),
+  },
+  // Mini Apps: list installed app manifests from ~/.rowboat/apps/.
+  'mini-apps:list': {
+    req: z.null(),
+    res: z.object({
+      manifests: z.array(MiniAppManifest),
+    }),
+  },
+  // Mini Apps: read an app's latest data.json (agent output).
+  'mini-apps:get-data': {
+    req: z.object({ id: z.string() }),
+    res: z.object({ data: z.unknown().nullable() }),
+  },
   'composio:didConnect': {
     req: z.object({
       toolkitSlug: z.string(),

apps/x/packages/shared/src/mini-app.ts

@@ -0,0 +1,31 @@
+import { z } from 'zod';
+
+/**
+ * Manifest for a Mini App stored at ~/.rowboat/apps/<id>/manifest.json.
+ *
+ * Static assets are served from `<id>/dist/` via app://miniapp/<id>/. The
+ * optional `agent` links a background task (bg-tasks engine) that writes
+ * `<id>/data.json`, which the host reads and pushes to the app.
+ */
+export const MiniAppManifest = z.object({
+  /** Stable slug; also the on-disk folder name and the app:// host path. */
+  id: z.string(),
+  /** Display name shown on the card and in the open view. */
+  title: z.string(),
+  /** One-line description for the card. */
+  description: z.string().default(''),
+  /** Primary integration shown in the card footer pill (e.g. 'GitHub'). */
+  source: z.string().default(''),
+  /** Composio toolkits this app may use; enforced host-side on bridge calls. */
+  scope: z.array(z.string()).default([]),
+  /** Whether the app's agent is active (drives the status badge). */
+  active: z.boolean().default(true),
+  /** Human last-run label for the card footer (e.g. '2m ago'). */
+  lastRun: z.string().default(''),
+  /** Entry file within the app folder, served via app://miniapp/<id>/. */
+  entry: z.string().default('dist/index.html'),
+  /** Optional associated background-task slug that produces data.json. */
+  agent: z.string().optional(),
+});
+
+export type MiniAppManifest = z.infer<typeof MiniAppManifest>;