feat(apps): Integrate AppRenderer from @mcp-ui/client SDK (#7013)

crates/goose-server/src/routes/templates/mcp_app_proxy.html

@@ -138,7 +138,7 @@
           .parent
           .postMessage({
             jsonrpc: '2.0',
-            method: 'ui/notifications/sandbox-ready',
+            method: 'ui/notifications/sandbox-proxy-ready',
             params: {}
           }, '*');
       })();

crates/goose/src/goose_apps/resource.rs

@@ -12,6 +12,12 @@ pub struct CspMetadata {
     /// Domains allowed for resource loading (scripts, styles, images, fonts, media)
     #[serde(skip_serializing_if = "Option::is_none")]
     pub resource_domains: Option<Vec<String>>,
+    /// Domains allowed for frame-src (nested iframes)
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub frame_domains: Option<Vec<String>>,
+    /// Domains allowed for base-uri
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub base_uri_domains: Option<Vec<String>>,
 }
 
 /// Sandbox permissions for MCP Apps