feat: add MCP Apps support for rich iframe UIs - #15926

Add MCP Apps protocol integration, allowing MCP servers to render interactive UIs in sandboxed iframes. No feature flag required — MCP Apps is enabled by default.

• AppMeta schema, tool metadata registry, and resource cache
• Visibility filtering (_meta.ui.visibility: ["app"]) hides tools from LLM
• structuredContent + resourceUri + server threaded into tool metadata
• 3 API routes at /mcp-app (apps list, resource fetch, tool-call proxy)
• __mcp_app__ renderer with AppBridge handshake and iframe auto-sizing
• Configurable maxHeight (default 640px) via _meta.ui.maxHeight
• FetchAppResourceFn wired through DataProvider
• SDK regenerated with /mcp-app routes
• 13 tests across 3 test files
• Demo fixture (server.py, app.html, README.md)

Issue for this PR

Closes #10884

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

This adds support for the MCP Apps protocol. MCP servers can declare tools with _meta.ui.resourceUri pointing to a ui:// resource, and opencode renders the tool result inside a sandboxed iframe with a full AppBridge handshake.

How it works end-to-end:

1. When MCP tools are listed, any tool with _meta.ui.resourceUri gets registered in a toolMetaRegistry. Tools with visibility: ["app"] are filtered out of the LLM's tool list (they're only callable by the iframe itself).
2. When a tool result comes back, structuredContent, resourceUri, server, and maxHeight are threaded into the tool part metadata so the frontend can pick them up.
3. On the frontend, any tool part with a resourceUri in its metadata renders as the __mcp_app__ tool instead of the generic tool renderer.
4. The renderer fetches the HTML resource via /mcp-app/resource, renders it in a sandboxed <iframe srcdoc>, and establishes an AppBridge connection over PostMessageTransport.
5. Once the bridge handshake completes (oninitialized), the host sends toolInput and toolResult (with structuredContent) to the iframe, which renders the data.
6. The iframe auto-sizes to its content height via onsizechange, capped at a configurable maxHeight (default 640px, overridable per-tool via _meta.ui.maxHeight).

Key implementation details:

• AppBridge and PostMessageTransport are statically imported (not dynamic import()) to avoid a race condition where the iframe sends ui/initialize before the host bridge is listening.
• structuredContent from SolidJS reactive state is deep-cloned via JSON.parse(JSON.stringify()) before passing to bridge.sendToolResult(), because SolidJS Proxy objects fail postMessage's structured clone algorithm (DataCloneError).
• The iframe height is managed via a SolidJS createSignal rather than direct DOM manipulation, so re-renders don't clobber the height set by onsizechange.
• A wrapper <div> with overflow: hidden constrains the layout box so the parent container doesn't grow to the iframe's scroll height.

Routes (promoted from /experimental/mcp-app to /mcp-app):

• GET /mcp-app — list all MCP tools with UI resources
• GET /mcp-app/resource — fetch and cache HTML for a ui:// URI
• POST /mcp-app/tool-call — proxy tool calls from iframe to MCP server

New/modified files:

• packages/opencode/src/server/routes/mcp-app.ts — dedicated route file for MCP App endpoints
• packages/opencode/src/mcp/index.ts — AppMeta, AppResource schemas, extractAppMeta(), apps(), appResource(), visibility filtering
• packages/opencode/src/session/prompt.ts — threads structuredContent + metadata into tool parts
• packages/ui/src/components/message-part.tsx — __mcp_app__ renderer (~100 lines)
• packages/ui/src/context/data.tsx — FetchAppResourceFn type + prop
• packages/app/src/pages/directory-layout.tsx — wires onFetchAppResource to /mcp-app/resource
• Demo fixture in packages/opencode/test/fixture/mcp-app-demo/ (Python MCP server + dashboard HTML app)

How did you verify your code works?

• 13 tests across 3 test files covering: extractAppMeta, visibility filtering, toolMeta registry, apps() list, appResource fetch/cache, structuredContent passthrough, route handlers, and maxHeight extraction
• Full test suite passes (1244 tests, 0 failures)
• Typecheck passes across all 13 packages (bun turbo typecheck)
• Manual end-to-end testing with the demo fixture server — verified the full flow from tool call through bridge handshake to rendered dashboard with live data in the iframe
• No DataCloneError in browser console after the structured clone fix

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR