openui-rails 0.5.0 → 0.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a8e938067e723b80e9efc974e2a2bd19878499bdc459c6d675452fa919584fb
-  data.tar.gz: 1a0d9ffaa09afef3c185f21154c56bf78ef8141f15bf4bef8fe1562aa47eb68b
+  metadata.gz: 1d89e42577f933fcb68ce1740bbc51496998c91f4f2f529880566e568f66543d
+  data.tar.gz: 8ee1ecfbef87fb51c07d5a85dc461555901f8dfc20c45da27093eabab82b5416
 SHA512:
-  metadata.gz: 0161351030bb99e07eb7fa9c7fa968c4921ea436e76da253c6b1827ac3a55650e0dfc6903d737cd1ae94a71b9ae978ae20642e9ea9aec5dd5aa0bd550ff5eb2c
-  data.tar.gz: 6b583705522c3871e981289572701a5c0c62bb6c9a8cb7679c26a6af9cac185937d4401b960c4a653442f08ef08b8b552468e42deeaf7ba45bcca5d78e491005
+  metadata.gz: 36050c0b40b6bf4afac05329c4cf5e393156519922592a1486b0c95d76d9b995f2174317db863349795f6b1d7274267cc9040dfb74a39282683b4d7b1e8c336c
+  data.tar.gz: c4c5833187751750c71e999d6e6098139fb4e33bd12a56d146dcacd18df5ac06bc360f0b2b424ec03569123f2caa91a567440ca3c4caef28e2485362fac9c0f6

data/CHANGELOG.md

@@ -6,6 +6,59 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.9.1] - 2026-10-28
+
+### Added
+
+- `bin/demo` prepares a disposable Support Desk host, binds its foreground
+  server to loopback, and removes the host when the server stops.
+- Independent public-API host checks, an optional old-gem upgrade and rollback
+  rehearsal, and an explicitly authorized single-request live qualification.
+  Live failure and retry limits are tested offline and never run in CI.
+- Browser assertions for the reference's enforced script CSP and complete
+  keyboard navigation through its generated form and mutation.
+
+### Changed
+
+- The opt-in Support Desk example uses nonce-authorized scripts and a
+  self-hosted content policy. Inline styles remain necessary for the pinned
+  renderer. No gem API, runtime pin, database migration, or dependency changes.
+
+## [0.9.0] - 2026-10-21
+
+### Added
+
+- A Supported API reference page that names the Ruby methods, settings, tasks,
+  events, wire contracts, and runtime pin policy covered by 1.x compatibility.
+
+### Deprecated
+
+- `config.library_name` and `config.surface_id_param` have no effect and report
+  a deprecation through the new `OpenUI::Rails.deprecator`, registered in
+  `Rails.application.deprecators`. They will be removed in 1.0.
+
+### Changed
+
+- The action endpoint returns HTTP 500 with code `error` and the fixed message
+  `action failed` for server-side gem errors, such as an unserializable result.
+  It previously returned 422 with the internal message. Details go to the log.
+- `OpenUI::Rails::RuntimeAsset` is marked internal. Configure runtime assets
+  through `Configuration`.
+
+### Fixed
+
+- A response that exceeds `stream_byte_limit` no longer drains the provider.
+  `Bridge#envelopes`, `Broadcaster.broadcast`, and the RubyLLM adapter stop
+  reading after the `stream_too_large` frame. `Writer#terminated?` lets
+  callback-based providers do the same.
+- A surface that reconnects while paused for a snapshot, including a Turbo
+  cache restoration, emits `openui:snapshot-required` again. It previously
+  dropped every later delta without telling the host.
+- An exception raised by the `on_error` hook no longer suppresses the stream's
+  error frame or replaces the provider error, which left the surface busy.
+- A surface without a stored `library_version` now checks stream frames against
+  the configured library fingerprint instead of accepting any library.
+
 ## [0.5.0] - 2026-10-21
 
 ### Added
@@ -153,7 +206,9 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Gem-scoped RubyGems Trusted Publishing through GitHub OIDC, with a protected
   release environment and verified artifact handoff.
 
-[Unreleased]: https://github.com/yorzi/openui-rails/compare/v0.5.0...main
+[Unreleased]: https://github.com/yorzi/openui-rails/compare/v0.9.1...main
+[0.9.1]: https://github.com/yorzi/openui-rails/releases/tag/v0.9.1
+[0.9.0]: https://github.com/yorzi/openui-rails/releases/tag/v0.9.0
 [0.5.0]: https://github.com/yorzi/openui-rails/releases/tag/v0.5.0
 [0.4.0]: https://github.com/yorzi/openui-rails/releases/tag/v0.4.0
 [0.3.0]: https://github.com/yorzi/openui-rails/releases/tag/v0.3.0

data/CONTRIBUTING.md

@@ -25,7 +25,7 @@ bundle exec bin/rails test        # unit + integration tests
 bundle exec bin/rails test:system # browser (system) tests, needs Chrome
 bundle exec rubocop               # style (rubocop-rails-omakase)
 bundle exec gem build openui-rails.gemspec
-bundle exec ruby bin/smoke-package openui-rails-0.5.0.gem
+bundle exec ruby bin/smoke-package openui-rails-0.9.0.gem
 bundle exec bundler-audit check --update
 bundle exec ruby -Itest test/compatibility/ruby_llm_smoke.rb
 ```

data/DEVELOPMENT.md

@@ -1,5 +1,8 @@
 # Development and verification
 
+Select a Ruby version covered by the CI matrix before running `bundle install`.
+The qualification commands reuse that Ruby and its resolved Rails dependencies.
+
 Use `test/dummy` as the maintained local host. Temporary generated hosts verify
 the built gem. Keep examples synthetic and provider-free unless a task explicitly
 authorizes a live call. Follow this loop for each feature:
@@ -14,10 +17,23 @@ authorizes a live call. Follow this loop for each feature:
 
 ## Reference workflow
 
+For an interactive, provider-free demo:
+
+```sh
+bundle exec rake "app:openui:runtime:fetch[$PWD/tmp/real-runtime]"
+bin/demo --runtime tmp/real-runtime --port 3000
+```
+
+Open `http://127.0.0.1:3000/support`. The server runs in the foreground and binds
+loopback only. Ctrl-C stops it and removes the newly generated host and database.
+No browser suite or provider runs during startup. Use `bin/check-reference`
+for automated browser verification. Add `--prepare-only` with `--gem --host`
+when you want a retained review host without running the browser suite.
+
 ```sh
 bin/check-reference
 bin/check-reference --runtime tmp/real-runtime
-bin/check-reference --gem tmp/package/openui-rails-0.5.0.gem --runtime tmp/real-runtime
+bin/check-reference --gem tmp/package/openui-rails-0.9.0.gem --runtime tmp/real-runtime
 # Focus one browser scenario:
 bin/check-reference --runtime tmp/real-runtime --name test_a_lost_turbo_envelope_recovers_from_the_scoped_snapshot
 ```
@@ -60,6 +76,45 @@ a browser network sandbox. The stub suite exercises bridge failure cases; the
 real-runtime suite verifies the pinned renderer, library identity, actions,
 tools, and keyboard behavior. Neither proves live-provider compatibility.
 
+## Independent host and release qualification
+
+The independent host uses public gem APIs and its own SQLite record, view,
+authorization, and action. It loads no Support Desk or dummy application code.
+The default path runs in `bin/check --runtime` and CI. To rehearse an upgrade,
+provide a checksum-verified historical gem explicitly:
+
+```sh
+bin/check-host --gem tmp/package/openui-rails-0.9.1.gem --runtime tmp/real-runtime
+bin/check-host --gem tmp/package/openui-rails-0.9.1.gem --runtime tmp/real-runtime \
+  --upgrade-from tmp/qualification/openui-rails-0.1.0.gem
+```
+
+The optional rehearsal boots the old artifact, the candidate, and the old
+artifact again against the same database. It checks saved source, a draft,
+authorized effects, reload, library mismatch fallback, and rollback. Its
+synthetic fixed actor is a test boundary, not production authentication.
+
+Live qualification always requires explicit owner authorization and uses
+`OPENROUTER_API_KEY` from the existing environment. Never put a credential in
+a command argument. After authorization:
+
+The `drafts/` paths below are local, optional materials. The gem, `bin/check`,
+and CI do not depend on them and never commit them.
+
+```sh
+bin/check-live --authorized --output drafts/live-qualification
+bin/check-host --gem tmp/package/openui-rails-0.9.1.gem --runtime tmp/real-runtime \
+  --source drafts/live-qualification/source.openui
+```
+
+The live command uses one `openai/gpt-4.1-mini` request, a 1024-output-token
+limit, and a conservative US$0.25 token-cost preflight. SDK retries and provider
+fallbacks are disabled. An existing output directory is refused, including a
+failed attempt; do not automatically repeat it. Usage-based cost estimates do
+not prove the billed charge. Generated output becomes browser evidence only
+after `bin/check-host --source` passes. CI tests this command with mocked HTTP;
+it never reads a live key or calls a paid provider.
+
 ## Refresh the default library exports
 
 When changing the pinned runtime, regenerate from its checksum-verified bundle:

data/README.md

@@ -32,7 +32,7 @@ The runtime-fetch task also needs npm. RubyLLM is optional.
 
 ```ruby
 # Gemfile
-gem "openui-rails", "~> 0.5.0"
+gem "openui-rails", "~> 0.9.1"
 ```
 
 ```sh
@@ -65,15 +65,19 @@ The documentation site contains the full guides and API reference:
 - [RubyLLM](https://openui-rails.wangyaodi.com/ruby-llm/) and [production setup](https://openui-rails.wangyaodi.com/production/)
 - [Upgrading](https://openui-rails.wangyaodi.com/upgrading/) and [API reference](https://openui-rails.wangyaodi.com/api-reference/)
 
-Version `0.5.0` adds outcome diagnostics and host-owned recovery examples.
-See [What's New](https://openui-rails.wangyaodi.com/whats-new-in-0-5/) for the upgrade.
+Version `0.9.1` improves the demo, CSP, keyboard checks, and host qualification
+without changing the public gem API or pinned runtime.
+See [What's New](https://openui-rails.wangyaodi.com/whats-new-in-0-9/) for the upgrade and
+[Supported API](https://openui-rails.wangyaodi.com/supported-api/) for the compatibility boundary.
 The API may change during `0.x`; see the
 [changelog](CHANGELOG.md) and the proposed [path to 1.0](ROADMAP.md).
 The site's stable channel follows the latest release; [/next/](https://openui-rails.wangyaodi.com/next/)
 follows `main`.
 
 For repository work, use [Contributing](CONTRIBUTING.md),
-[Releasing](RELEASING.md), and the [0.4.0 release record](RELEASE_0_4.md).
+[Releasing](RELEASING.md), and the [0.9.0 release record](RELEASE_0_9.md).
+Run the disposable demo with `bin/demo --runtime tmp/real-runtime` after the
+runtime setup in [Development](DEVELOPMENT.md).
 Report vulnerabilities through the [security policy](SECURITY.md).
 
 ## License

data/RELEASING.md

@@ -32,6 +32,12 @@ The live smoke completed on 2026-10-18 through OpenRouter with RubyLLM 2.1.1
 and `openai/gpt-4.1-mini`. It used a synthetic prompt, `:complete` streaming,
 and a 16-token output cap. See [AUDIT.md](AUDIT.md) for the result and limits.
 
+The fuller, explicitly authorized qualification on 2026-10-28 generated complete
+UI through RubyLLM, rendered its persisted output, and executed an authorized
+action in an independent host. See [QUALIFICATION_1_0.md](QUALIFICATION_1_0.md)
+for its budget, upgrade rehearsal, and limits. Release CI remains provider-free;
+publishing does not require repeating a paid call.
+
 ## Prepare the candidate
 
 During development, keep `released: false`, document delivered work under

data/THIRD_PARTY_NOTICES.md

@@ -10,17 +10,17 @@ The Gem itself is licensed under the MIT License (see `LICENSE`).
 
 ## Referenced upstream packages
 
-The following `@openuidev/*` packages are published by Thesys under the MIT
-License and are loaded by the browser at runtime (self-hosted by the host app,
-or referenced at an exact pinned version):
+The integration references these official MIT-licensed packages. The browser
+bundle and the maintainer CLI have exact pins. The other rows describe the
+browser bundle's declared dependency ranges, not proven compiled versions.
+The CLI is a development tool and is not loaded in the browser.
 
-| Package | Pinned version | License |
+| Package | Version reference | License |
 | --- | --- | --- |
-| `@openuidev/browser-bundle` | 0.2.1 | MIT |
-| `@openuidev/react-lang` | 1.0.1 | MIT |
-| `@openuidev/lang-core` | 1.0.1 | MIT |
-| `@openuidev/react-ui` | 0.18.1 | MIT |
-| `@openuidev/cli` | 0.6.0 | MIT |
+| `@openuidev/browser-bundle` | 0.2.1 exact runtime pin | MIT |
+| `@openuidev/react-lang` | ^1.0.1 declared range | MIT |
+| `@openuidev/react-ui` | ^0.18.1 declared range | MIT |
+| `@openuidev/cli` | 0.6.0 exact guide pin | MIT |
 
 The OpenUI repository is licensed MIT: "Copyright (c) 2011-2024 Thesys Inc."
 
@@ -36,6 +36,25 @@ prompt instructions, not the browser renderer implementation.
 
 ## Transitive browser dependencies
 
+The 2026-10-28 review checks the exact checksum-locked 0.2.1 JavaScript, CSS,
+and upstream license used by the demo. Its JavaScript's final bundled-notices
+block names these package groups:
+
+| Embedded package group | Notice |
+| --- | --- |
+| `react`, `react-dom`, `scheduler`, `use-sync-external-store` | Meta copyright and MIT references. |
+| `lucide-react` | Version 0.562.0 and ISC references across its bundled icon modules. |
+| `@tanstack/table-core`, `@tanstack/react-table` | TanStack copyright and MIT references. |
+
+These are the groups named by the embedded notices, not a reconstructed lockfile
+or complete dependency inventory. The npm browser-bundle manifest declares
+ranges for React, React DOM, react-ui, and react-lang. Those ranges do not
+identify every resolved transitive version. Preserve the fetched files intact;
+do not strip their legal comments. A host that redistributes the bundle must
+still establish its complete dependency and license inventory.
+
+The reviewed manifest is the [immutable npm version record](https://registry.npmjs.org/@openuidev/browser-bundle/0.2.1).
+
 The official browser bundle inlines dependencies, including React 19. They do
 not all share one license. The pinned bundle's embedded notices identify
 `lucide-react` 0.562.0 as ISC-licensed. React and TanStack identify MIT licenses.

data/app/controllers/openui/rails/actions_controller.rb

@@ -48,9 +48,17 @@ module OpenUI
                status: :unprocessable_content
       end
 
+      # Request errors return their own message. Any other gem error is a
+      # server-side fault, possibly after the handler ran: log it and return a
+      # generic message so configuration details never reach the browser.
       def render_domain_error(error)
-        render json: { error: { code: error_code(error), message: error.message } },
-               status: error_status(error)
+        code = error_code(error)
+        if code == "error"
+          logger&.error("[openui-rails] action failed: #{error.class}: #{error.message}")
+          render json: { error: { code: code, message: "action failed" } }, status: :internal_server_error
+        else
+          render json: { error: { code: code, message: error.message } }, status: error_status(error)
+        end
       end
 
       def error_code(error)
@@ -62,7 +70,8 @@ module OpenUI
         when UnknownActionError then :not_found
         when UnauthorizedActionError then :forbidden
         when StaleSurfaceError, ReplayError then :conflict
-        else :unprocessable_content
+        when InvalidActionError then :unprocessable_content
+        else :internal_server_error
         end
       end
     end

data/app/javascript/openui/rails/openui_controller.js

@@ -73,6 +73,12 @@ export default class extends Controller {
 
     this.syncBusy()
     this.renderRuntime(connection)
+    // A surface restored from the Turbo cache or reattached while paused for a
+    // snapshot would otherwise wait forever: the host abandoned the earlier
+    // request on disconnect. Announce it again once sibling controllers connect.
+    if (this.state.needsSnapshot) {
+      queueMicrotask(() => { if (this.isCurrent(connection)) this.announceSnapshotRequired() })
+    }
   }
 
   disconnect() {
@@ -159,7 +165,10 @@ export default class extends Controller {
         (envelope.type === "openui.snapshot" && typeof envelope.response !== "string")) {
       return this.handleError(Object.assign(new Error("Malformed stream envelope"), { code: "invalid_envelope" }))
     }
-    if (envelope.library_version && this.libraryVersion && envelope.library_version !== this.libraryVersion) {
+    // Without a stored library version, the verified runtime fingerprint is
+    // still the only library this mount can render.
+    const library = this.libraryVersion || this.element.dataset.openuiLibraryFingerprint
+    if (envelope.library_version && library && envelope.library_version !== library) {
       return this.handleError(Object.assign(new Error("OpenUI library version mismatch"), { code: "library_version_mismatch" }))
     }
     if (envelope.type !== "openui.snapshot") {
@@ -215,6 +224,10 @@ export default class extends Controller {
   requestSnapshot() {
     if (this.state.needsSnapshot) return
     this.state.needsSnapshot = true
+    this.announceSnapshotRequired()
+  }
+
+  announceSnapshotRequired() {
     this.dispatch("snapshot-required", { surfaceId: this.surfaceId, sequence: this.state.nextSequence })
   }
 

data/examples/support_desk/README.md

@@ -15,10 +15,15 @@ From the repository:
 
 ```sh
 mkdir -p tmp/package
-bundle exec gem build openui-rails.gemspec --output tmp/package/openui-rails-0.5.0.gem
-bin/check-reference --gem tmp/package/openui-rails-0.5.0.gem --runtime tmp/real-runtime
+bundle exec gem build openui-rails.gemspec --output tmp/package/openui-rails-0.9.1.gem
+bin/check-reference --gem tmp/package/openui-rails-0.9.1.gem --runtime tmp/real-runtime
 ```
 
+For an interactive disposable demo, use `bin/demo --runtime tmp/real-runtime`.
+It starts a foreground server on `127.0.0.1:3000` and removes the new host and
+database when you stop it with Ctrl-C. No provider call is made. Its script CSP
+uses importmap nonces; inline styles remain enabled for the pinned renderer.
+
 Fetch the runtime first. See the [complete guide](https://openui-rails.wangyaodi.com/reference-workflow/)
 for setup, retained-host review, failure checks, and evidence limits. The
 reference is not enabled by requiring the gem. Keep the demo loopback-only;

data/examples/support_desk/app/controllers/support_desk/base_controller.rb

@@ -3,6 +3,17 @@
 module SupportDesk # :nodoc:
   class BaseController < ::ApplicationController
     protect_from_forgery with: :exception
+    content_security_policy do |policy|
+      policy.default_src :self
+      policy.script_src :self
+      # The pinned renderer inserts styles and uses style attributes.
+      policy.style_src :self, :unsafe_inline
+      policy.img_src :self, :data
+      policy.object_src :none
+      policy.base_uri :self
+      policy.form_action :self
+      policy.frame_ancestors :none
+    end
     layout "support_desk/application"
     before_action :local_demo_only
     before_action :authenticate

data/examples/support_desk/app/views/layouts/support_desk/application.html.erb

@@ -4,6 +4,7 @@
     <title>Support Desk · OpenUI Rails reference</title>
     <meta name="viewport" content="width=device-width,initial-scale=1">
     <%= csrf_meta_tags %>
+    <%= csp_meta_tag %>
     <%= openui_stylesheet_tag %>
     <%= javascript_importmap_tags "support_desk" %>
     <style>

data/examples/support_desk/app/views/support_desk/conversations/index.html.erb

@@ -1,6 +1,13 @@
 <h1>Support Desk reference host</h1>
 <p class="notice">Synthetic accounts and tickets. Local demo only. No model provider is called.</p>
 <p>Sign in to stream a ticket, save a private draft, continue the conversation, and close the ticket.</p>
+<h2>Try the workflow</h2>
+<ol>
+  <li>Choose Alice, enter a private note, and wait for “Draft saved”. Reload to check the saved note.</li>
+  <li>Continue the conversation, then close the ticket. Reload to review its persisted status.</li>
+  <li>Try Reader for read-only access, or Bob for a separate tenant.</li>
+</ol>
+<p>Alice and Reader belong to the north tenant. Bob belongs to the south tenant. These are local synthetic accounts.</p>
 <% %w[Alice Bob Reader].each do |name| %>
   <%= button_to "Sign in as #{name}", session_path, params: { name: name } %>
 <% end %>

data/examples/support_desk/boot.rb

@@ -11,6 +11,8 @@ module SupportDesk # :nodoc:
     # form tags and the shared action endpoint protected in that environment too.
     initializer "support_desk.csrf", before: "action_controller.set_configs" do |app|
       app.config.action_controller.allow_forgery_protection = true
+      app.config.content_security_policy_nonce_generator ||= ->(_request) { SecureRandom.base64(16) }
+      app.config.content_security_policy_nonce_directives ||= %w[script-src]
     end
 
     initializer "support_desk.assets", before: "importmap" do |app|

data/lib/openui/rails/adapters/ruby_llm.rb

@@ -17,6 +17,10 @@ module OpenUI
       module RubyLLM
         STRATEGIES = %i[complete ask].freeze
 
+        # Internal signal that aborts the provider stream after a terminal frame.
+        Halt = Class.new(StandardError)
+        private_constant :Halt
+
         class << self
           # Stream a RubyLLM completion, yielding ordered {Stream::Envelope}s.
           #
@@ -47,6 +51,7 @@ module OpenUI
 
             begin
               consumer_failed = false
+              halted = false
               deliver = lambda do |envelope|
                 begin
                   block.call(envelope)
@@ -60,10 +65,17 @@ module OpenUI
                 next if text.nil?
 
                 writer.push(text).each(&deliver)
+                # A terminal frame (the byte limit) has already been delivered.
+                # Raise out of the provider callback so it stops generating.
+                if writer.terminated?
+                  halted = true
+                  raise Halt
+                end
               end
               writer.finish.each(&deliver)
             rescue StandardError => e
               raise if consumer_failed
+              return writer if halted
 
               envelope = writer.error_for(e, code: error_code_for(e))
               block.call(envelope) if envelope

data/lib/openui/rails/configuration.rb

@@ -29,8 +29,8 @@ module OpenUI
       DEFAULT_ACTIONS_ENDPOINT = "/openui-rails/actions"
 
       attr_reader :transport, :runtime_assets
-      attr_accessor :library_spec_path, :prompt_path, :library_name,
-                    :actions_endpoint, :surface_id_param,
+      attr_accessor :library_spec_path, :prompt_path,
+                    :actions_endpoint,
                     :stream_byte_limit, :pending_byte_limit, :idempotency_ttl,
                     :authorize_action, :on_error, :action_registry, :surface_resolver, :actor_resolver,
                     :runtime_version, :runtime_url, :runtime_integrity, :local_runtime_path,
@@ -62,6 +62,32 @@ module OpenUI
         @local_runtime_path = "/openui"
       end
 
+      # @deprecated Has no effect: the runtime library comes from the loaded
+      #   bundle and its manifest. Removed in 1.0.
+      def library_name
+        deprecated_setting(:library_name)
+        @library_name
+      end
+
+      # @deprecated Has no effect. Removed in 1.0.
+      def library_name=(value)
+        deprecated_setting(:library_name)
+        @library_name = value
+      end
+
+      # @deprecated Has no effect: action requests always use the `surface_id`
+      #   key. Removed in 1.0.
+      def surface_id_param
+        deprecated_setting(:surface_id_param)
+        @surface_id_param
+      end
+
+      # @deprecated Has no effect. Removed in 1.0.
+      def surface_id_param=(value)
+        deprecated_setting(:surface_id_param)
+        @surface_id_param = value
+      end
+
       # Set the preferred host stream transport.
       #
       # @param value [Symbol] `:turbo`, `:action_cable`, or `:none`
@@ -243,6 +269,12 @@ module OpenUI
         PromptBuilder.load(self) if prompt_path
         true
       end
+
+      private
+
+      def deprecated_setting(name)
+        OpenUI::Rails.deprecator.warn("config.#{name} has no effect and will be removed; delete it from your initializer")
+      end
     end
 
     class << self

data/lib/openui/rails/engine.rb

@@ -27,6 +27,10 @@ module OpenUI
         ::Rails.autoloaders.main.inflector.inflect("openui" => "OpenUI")
       end
 
+      initializer "openui_rails.deprecator" do |app|
+        app.deprecators[:openui_rails] = OpenUI::Rails.deprecator
+      end
+
       # Expose the surface helper to every host view.
       initializer "openui_rails.view_helper" do
         ActiveSupport.on_load(:action_view) do

data/lib/openui/rails/runtime_asset.rb

@@ -2,14 +2,15 @@
 
 module OpenUI
   module Rails
-    # Resolves the pinned OpenUI browser runtime and the integrity metadata the
-    # mount element advertises.
+    # Internal: resolves the pinned OpenUI browser runtime and the integrity
+    # metadata the mount element advertises. Configure assets through
+    # {Configuration}; this module is not part of the supported API.
     #
     # The runtime is version-pinned. Self-hosted (the default) points at a file
     # the install generator vendored into the host app; the external strategy
     # requires an explicit, exact-version URL so no floating CDN range is used
     # in production.
-    module RuntimeAsset
+    module RuntimeAsset # :nodoc:
       PINNED_VERSION = "0.2.1"
       FILE_PREFIX = "openui-browser-bundle"
 

data/lib/openui/rails/stream/accumulator.rb

@@ -20,8 +20,12 @@ module OpenUI
           @needs_snapshot = false
         end
 
-        # @return [Symbol] one of :applied, :duplicate, :snapshot, :completed,
-        #   :error, :ignored
+        # Apply one envelope for this message.
+        #
+        # @param envelope [Envelope]
+        #
+        # @return [Symbol] one of :applied, :duplicate, :gap, :snapshot,
+        #   :completed, :error, :ignored. After :gap, only a snapshot applies.
         def apply(envelope)
           return :ignored unless envelope.message_id == message_id
           unless envelope.snapshot?

data/lib/openui/rails/stream/bridge.rb

@@ -39,7 +39,8 @@ module OpenUI
 
         # Yield ordered envelopes for every chunk from a pull-based source.
         # Provider errors become a structured error envelope. Exceptions raised
-        # by the consumer block propagate to the caller.
+        # by the consumer block propagate to the caller. Pulling stops once the
+        # writer terminates, so an oversized response does not drain the source.
         #
         # @param source [#each] yields String chunks
         # @yieldparam envelope [Envelope]
@@ -60,6 +61,7 @@ module OpenUI
             # Transport/consumer failures are not provider failures. Let the
             # host retry or report them without recursively broadcasting errors.
             envelopes.each { |envelope| yield envelope }
+            return if writer.terminated?
           end
           writer.finish.each { |envelope| yield envelope }
         end
@@ -112,6 +114,12 @@ module OpenUI
             @started = Instrumentation.now
           end
 
+          # Whether a completion or error envelope has ended this stream. Stop
+          # reading the provider once it is true; later pushes are ignored.
+          #
+          # @return [Boolean]
+          def terminated? = @terminated
+
           # Append a chunk and return a delta once the pending threshold is reached.
           # A chunk that exceeds the total stream limit returns an error envelope.
           #
@@ -153,6 +161,7 @@ module OpenUI
           end
 
           # Structured, PII-free error envelope for a provider/consumer failure.
+          # Calls `on_error` first; an exception raised by that hook is ignored.
           #
           # @param error [Exception]
           #
@@ -162,7 +171,7 @@ module OpenUI
           def error_for(error, code: "stream_failed")
             return nil if @terminated
 
-            @on_error&.call(error, message_id: @message_id)
+            notify_error(error)
 
             message = "stream failed (#{error.class})"
             message = "stream cancelled" if code == "stream_cancelled"
@@ -193,6 +202,14 @@ module OpenUI
             envelope
           end
 
+          # A failing host hook must not suppress the terminal frame or replace
+          # the provider error, matching notification subscriber isolation.
+          def notify_error(error)
+            @on_error&.call(error, message_id: @message_id)
+          rescue StandardError
+            nil
+          end
+
           def notify_termination(outcome, code = nil)
             Instrumentation.publish("stream", started: @started, outcome: outcome,
               code: code, sequence: @sequence - 1, bytes: @total_bytes)

data/lib/openui/rails/stream/broadcaster.rb

@@ -24,6 +24,7 @@ module OpenUI
         attr_reader :transport, :message_id, :library_version
 
         # Broadcast every envelope produced by an enumerable source of chunks.
+        # Iteration stops after a terminal envelope, such as a byte-limit error.
         #
         # @param source [#each] yields String chunks
         # @param options [Hash] arguments forwarded to the constructor
@@ -31,7 +32,10 @@ module OpenUI
         # @return [Broadcaster]
         def self.broadcast(source, **options)
           broadcaster = new(**options)
-          source.each { |chunk| broadcaster.push(chunk) }
+          source.each do |chunk|
+            broadcaster.push(chunk)
+            break if broadcaster.writer.terminated?
+          end
           broadcaster.finish
         end
 

data/lib/openui/rails/version.rb

@@ -1,5 +1,5 @@
 module OpenUI
   module Rails
-    VERSION = "0.5.0"
+    VERSION = "0.9.1"
   end
 end

data/lib/openui/rails.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "active_support/deprecation"
 require "openui/rails/version"
 
 module OpenUI
@@ -10,6 +11,13 @@ module OpenUI
   # into a Rails engine and keeps Rails authoritative for auth, tenancy and
   # persistence.
   module Rails
+    # Deprecator for APIs removed in openui-rails 1.0. The engine registers it
+    # in `Rails.application.deprecators`, so host deprecation settings apply.
+    #
+    # @return [ActiveSupport::Deprecation]
+    def self.deprecator
+      @deprecator ||= ActiveSupport::Deprecation.new("1.0", "openui-rails")
+    end
   end
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: openui-rails
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.9.1
 platform: ruby
 authors:
 - Andy Wang
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-21 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails