@feedmepos/mf-remy-panel 0.19.0-dev.7 → 0.19.0-dev.9

package/dist/app.js

@@ -1,5 +1,5 @@
 import "vue";
-import { C as m, A as o, R as p, c as n, i as u, d as A, r as C, u as R, b as l } from "./app-aea34550.js";
+import { C as m, A as o, R as p, c as n, i as u, d as A, r as C, u as R, b as l } from "./app-208a4bc0.js";
 import "pinia";
 import "@feedmepos/mf-common";
 import "vue-router";

package/dist/components/chatPanel/actionCards/McpAppCard.vue.d.ts

@@ -1,19 +1,11 @@
 /**
- * Renders a tool call's MCP Apps (SEP-1865) UI resource.
+ * Renders a tool call's MCP Apps (SEP-1865) UI resource in a sandboxed iframe.
  *
- * Sandbox tokens, both load-bearing and deliberately just these two:
+ * The card runs its own scripts, so an MCP server ships its own interactive UI
+ * and no client needs a component per tool.
  *
- * - `allow-downloads` — a card whose point is handing the user a file
- *   (menu-mcp's `buildMenuPortalImport` download card) is dead without it;
- *   Chrome blocks any download started from a sandboxed frame.
- * - `allow-same-origin` — lets THIS component read `contentDocument` to
- *   measure the card, so the frame fits its content instead of padding every
- *   card out to a fixed height.
- *
- * NEVER add `allow-scripts`. Together with `allow-same-origin` it lets the
- * framed document reach this origin's storage and script context — the two
- * tokens are safe only apart. Measuring from the parent is what buys us
- * auto-height without granting the card any script at all.
+ * NEVER add `allow-same-origin`: with `allow-scripts` it lets the card run as
+ * this origin. Apart, both are safe.
  */
 import type { ToolCall } from '@/types/chat';
 interface Props {