agent_inapp

The same backend vtable as agent_mcp, in-process. No socket, no MCP loopback, no authorization policy: the binary already trusts itself. The UI exposure rules are the capability boundary.

import "agent_inapp/agent_inapp" as inapp;

let session: inapp::Session = inapp::open(surf, vt);
let tree = session.describe_ui();            // exposed view (default)
let full = session.describe_ui(full: true);  // whole walked tree
let acted = session.click("save");

open(surf: *u8, vt: backend::Backend) -> Session. describe_ui(full: bool = false) is the same split as MCP (exposed vs full). Also: click, set_text, scroll_to, hit_test, poll_event.

For a facet app, facet/agent::enable() before App::run, then facet/agent::in_app() -> Session. See Agent surface.