feat(workflows,hub,web): stream live workflow run events over SSE and render chat progress

Author: TheGreatAxios

apps/hub/src/server.ts

@@ -45,7 +45,7 @@ import {
   type SidecarProvisionerChooser,
   type WsHandle,
 } from "@intx/hub-sessions";
-import { withLazyRunCollector } from "@corbits/workflows";
+import { createWorkflowRunStreamRoutes, withLazyRunCollector } from "@corbits/workflows";
 import { generateKeyPair } from "@intx/crypto";
 import { timeWindowEvaluator } from "@intx/authz";
 import type { ConditionRegistry } from "@intx/types/authz";
@@ -512,6 +512,19 @@ export async function createHubServer({
     });
     app.route(TENANT_PREFIX, artifactsApi);
   }
+  {
+    app.route(
+      TENANT_PREFIX,
+      createWorkflowRunStreamRoutes({
+        db,
+        sidecarRouter,
+        requireGrant: createRequireGrant({
+          grantStore,
+          conditionRegistry: grantConditionRegistry,
+        }),
+      }),
+    );
+  }
   {
     // Minting an agent token is minting a credential, so it is gated by the
     // same stock grant the credential routes are, not by tenant membership.

apps/web/src/chat-path.ts

@@ -9,6 +9,8 @@ export const workbenchKeys = {
   participants: (tenantId: string) => ["workbench", tenantId, "participants"] as const,
   /** Client-only: {sentAt} from a send until the worker replies. */
   pendingTurn: (tenantId: string) => ["workbench", tenantId, "pendingTurn"] as const,
+  /** Client-only: live status observed from the worker run's SSE stream. */
+  runStatus: (tenantId: string) => ["workbench", tenantId, "runStatus"] as const,
   timeline: (tenantId: string) => ["workbench", tenantId, "timeline"] as const,
   /** The bench's own child tenants (its workbenches), read over the stock
    * tenant routes — previously `chatKeys.childTenants`, re-homed here when