@floless/app 0.19.0 → 0.20.0

package/dist/floless-server.cjs

@@ -52683,7 +52683,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.19.0" : void 0,
+    define: true ? "0.20.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52693,7 +52693,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.19.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.20.0" : void 0 });
 }
 
 // oauth-presets.ts
@@ -57810,7 +57810,16 @@ async function startServer() {
       broadcast({ type: "run-started", id, dryRun: !!dryRun, simulate: !!simulate, runId: result.runId });
       for (const ev of events) broadcast({ type: "trace", id, event: ev });
       broadcast({ type: "run-ended", id, runId: result.runId });
-      const report = withBadge(extractReportHtml(events));
+      const extracted = extractReportHtml(events);
+      let report = null;
+      if (extracted) {
+        let interactive = false;
+        try {
+          interactive = readApp(id).nodes.find((n) => n.id === extracted.nodeId)?.agent === "viewer-3d";
+        } catch {
+        }
+        report = { ...interactive ? extracted : withBadge(extracted), interactive };
+      }
       const credentialIssue = !simulate && hasAuthFailure(events) ? await detectCredentialIssue(id) : null;
       return { ok: true, runId: result.runId, tracePath: result.tracePath, events, report, credentialIssue };
     }

package/dist/web/app.css

@@ -2209,7 +2209,9 @@ body {
 .report-actions button.report-stop:hover { background: color-mix(in srgb, var(--warn) 16%, transparent); border-color: var(--warn); color: var(--text); }
 #report-close { font-size: 18px; line-height: 1; padding: 4px 10px; }
 .report-stage { position: relative; flex: 1; background: #0f172a; }
-#report-frame { width: 100%; height: 100%; border: 0; display: block; background: #0f172a; }
+/* Only the SHOWN frame fills the stage — `:not([hidden])` so `display:block` never defeats the
+   `hidden` attribute on the inactive frame (else it keeps its height and pushes the other off-screen). */
+#report-frame:not([hidden]), #report-frame-3d:not([hidden]) { width: 100%; height: 100%; border: 0; display: block; background: #0f172a; }
 
 /* Live "On trigger" report: a pulsing pip in the viewer subtitle + a brief edge
    flash on the stage when a trigger routine (e.g. tekla-selection-report) pushes a

package/dist/web/aware.js

@@ -18,6 +18,7 @@
   const $notesStrip = document.getElementById('notes-strip');
   const $reportModal = document.getElementById('report-modal');
   const $reportFrame = document.getElementById('report-frame');
+  const $reportFrame3d = document.getElementById('report-frame-3d');
   const $reportOverlay = document.getElementById('report-overlay');
   const $reportTitle = document.getElementById('report-title');
   const $reportSub = document.getElementById('report-sub');
@@ -838,10 +839,10 @@
   function reportNodeId() {
     const app = currentId && apps.get(currentId);
     if (!app || !app.nodes.length) return null;
-    // An html-report agent node renders report HTML — its `render` command returns
-    // an `html` field, which is exactly what extractReportHtml keys on. So it's a
-    // report producer regardless of exec code; prefer it directly as the viewer node.
-    const htmlReportNode = app.nodes.find((n) => n.agent === 'html-report');
+    // An html-report (static) or viewer-3d (interactive 3D) agent node renders HTML — its
+    // `render` command returns an `html` field, exactly what extractReportHtml keys on. So
+    // it's a report producer regardless of exec code; prefer it directly as the viewer node.
+    const htmlReportNode = app.nodes.find((n) => n.agent === 'html-report' || n.agent === 'viewer-3d');
     if (htmlReportNode) return htmlReportNode.id;
     // Otherwise, qualify the app only if some node actually PRODUCES report HTML — its exec
     // code returns an `html` field (the `data.result.html` extractReportHtml keys
@@ -953,7 +954,11 @@
       // clear anything we injected last render, so re-renders never stack
       card.querySelectorAll('.node-action, .node-inputs').forEach((b) => b.remove());
       if (isInput) addNodeInputs(card); // current values, above the button
-      if (isReport) addNodeAction(card, 'View report ▸', () => showReport(id));
+      if (isReport) {
+        const rNode = app && app.nodes.find((n) => n.id === rid);
+        const viewLabel = rNode && rNode.agent === 'viewer-3d' ? 'View 3D ▸' : 'View report ▸';
+        addNodeAction(card, viewLabel, () => showReport(id));
+      }
       if (isInput) addNodeAction(card, 'Set inputs ▸', () => openInputsDialog());
       if (isRebake) addNodeAction(card, 'Re-read & re-bake ▸', () => openRebakeDialog());
     });
@@ -1245,7 +1250,37 @@
 
   // Share is visible exactly when the frame holds a report (the empty state HIDES it —
   // never a disabled affordance with no path forward).
-  function paintReport(html) { $reportFrame.srcdoc = html; $reportOverlay.hidden = true; $reportOverlay.replaceChildren(); $reportShare.hidden = false; }
+  // The last HTML painted (static or 3D) — so ↗ Open works for both surfaces.
+  let lastPaintedHtml = '';
+  // Paint a report into the viewer. A STATIC report uses the scriptless srcdoc frame; an
+  // INTERACTIVE 3D doc (viewer-3d) uses the script-enabled frame via a data: URL (opaque
+  // origin, cannot touch the app page) and keeps a "Loading 3D view…" overlay until the doc
+  // posts `viewer-ready`. Exactly one frame is shown at a time.
+  function paintReport(html, interactive) {
+    lastPaintedHtml = html || '';
+    if (interactive) {
+      $reportFrame.hidden = true; $reportFrame.srcdoc = '';
+      $reportFrame3d.hidden = false;
+      $reportFrame3d.src = 'data:text/html;charset=utf-8,' + encodeURIComponent(html);
+      $reportShare.hidden = true; // a script doc can't be statically hosted — hide, don't disable
+      $reportOverlay.hidden = false; $reportOverlay.replaceChildren();
+      $reportOverlay.append(mkEl('div', 'spinner'), mkEl('div', null, 'Loading 3D view…'));
+    } else {
+      $reportFrame3d.hidden = true; $reportFrame3d.removeAttribute('src');
+      $reportFrame.hidden = false; $reportFrame.srcdoc = html;
+      $reportOverlay.hidden = true; $reportOverlay.replaceChildren();
+      $reportShare.hidden = false;
+    }
+  }
+
+  // Reset the viewer to "no report shown": clear BOTH frames + the Open buffer, so a stale
+  // interactive 3D doc can't linger (its WebGL loop running) behind an overlay, and ↗ Open
+  // can't reopen a previous app's report. Used by every empty / transition state.
+  function clearReportFrames() {
+    $reportFrame.srcdoc = ''; $reportFrame.hidden = false;
+    $reportFrame3d.hidden = true; $reportFrame3d.removeAttribute('src');
+    lastPaintedHtml = '';
+  }
 
   // Double-click the HTML Viewer node → LOAD the last report (no run; running is
   // the header "▶ Run workflow" button's job). Shows a prompt if nothing has run yet.
@@ -1258,10 +1293,16 @@
     if (reportRunning) return; // a run is in flight — its overlay already shows progress
     const cached = lastReportByApp.get(currentId);
     if (cached && cached.html) {
-      $reportSub.innerHTML = `Last report${cached.label ? ' · ' + escapeHtml(cached.label) : ''} — rendered from the run's output, never composed by the UI.`;
-      paintReport(cached.html);
+      const sfx = cached.label ? ' · ' + cached.label : '';
+      if (cached.interactive) {
+        $reportTitle.textContent = `3D Viewer · ${app.displayName}`;
+        $reportSub.textContent = `Last 3D view${sfx} — drag to orbit, scroll to zoom, click an element to inspect.`;
+      } else {
+        $reportSub.textContent = `Last report${sfx} — rendered from the run's output, never composed by the UI.`;
+      }
+      paintReport(cached.html, cached.interactive);
     } else {
-      $reportFrame.srcdoc = '';
+      clearReportFrames();
       $reportShare.hidden = true; // nothing to share — hide, don't disable
       $reportOverlay.hidden = false;
       $reportOverlay.innerHTML = `<div>No report yet. Click <strong>▶ Run workflow</strong> (top right) to run it against the live model, then double-click to view it any time.</div>`;
@@ -1286,7 +1327,7 @@
     const inputBadge = Object.entries(inputs).map(([k, v]) => `${k}=${v}`).join(' · ');
     $reportTitle.textContent = `HTML Viewer · ${app.displayName}`;
     $reportSub.innerHTML = `Live run of <code>${escapeHtml(nodeId)}</code>${inputBadge ? ' · ' + escapeHtml(inputBadge) : ''} — rendered from the node's output, never composed by the UI.`;
-    $reportFrame.srcdoc = ''; // clear any previously rendered report while this run is in flight
+    clearReportFrames(); // clear any previous report (static or 3D) before this run paints a fresh one
     $reportShare.hidden = true; // the frame is blank — only a painted report is shareable
     $reportOverlay.hidden = false;
     $reportOverlay.innerHTML = opts.debug
@@ -1307,14 +1348,19 @@
       // body, not real data) — prompt reconnect instead of rendering the noise.
       if (res.credentialIssue) { surfaceCredentialIssue(res.credentialIssue); return; }
       const html = res.report && res.report.html;
+      const interactive = !!(res.report && res.report.interactive);
       if (!html) {
         $reportOverlay.innerHTML = `<div>Run completed but <code>${escapeHtml(nodeId)}</code> returned no <code>html</code>. Check the Execution tab.</div>`;
         return;
       }
-      paintReport(html);
-      lastReportByApp.set(currentId, { nodeId, label: inputBadge, html });
+      if (interactive) {
+        $reportTitle.textContent = `3D Viewer · ${app.displayName}`;
+        $reportSub.innerHTML = `Live 3D view from <code>${escapeHtml(nodeId)}</code>${inputBadge ? ' · ' + escapeHtml(inputBadge) : ''} — drag to orbit, scroll to zoom, click an element to inspect.`;
+      }
+      paintReport(html, interactive);
+      lastReportByApp.set(currentId, { nodeId, label: inputBadge, html, interactive });
       $reportModal.dataset.html = '1';
-      appendNarration(`Rendered the report from <strong>${escapeHtml(nodeId)}</strong>${inputBadge ? ' (' + escapeHtml(inputBadge) + ')' : ''} — live run against the model.`);
+      appendNarration(`Rendered the ${interactive ? '3D view' : 'report'} from <strong>${escapeHtml(nodeId)}</strong>${inputBadge ? ' (' + escapeHtml(inputBadge) + ')' : ''} — live run against the model.`);
     } catch (e) {
       const msg = e && e.message ? e.message : String(e);
       if (cancelRequested) {
@@ -1362,7 +1408,7 @@
   const CRED_BODY_IDLE = 'Sign in again and then run the workflow — it takes about 30 seconds.';
 
   function showCredentialReconnect(cred) {
-    $reportFrame.srcdoc = '';
+    clearReportFrames();
     $reportShare.hidden = true;
     $reportOverlay.hidden = false;
     $reportOverlay.replaceChildren();
@@ -1674,10 +1720,22 @@
   // The Stop button is rebuilt into the overlay each run — delegate so one
   // listener survives every innerHTML swap.
   $reportOverlay.addEventListener('click', (e) => { if (e.target.closest('.overlay-stop')) stopRun(); });
+  // The interactive 3D doc (viewer-3d) posts a load handshake from its opaque-origin frame:
+  // `viewer-ready` clears the loading overlay; `viewer-error` (CDN/script/timeout) shows a
+  // retry. Guard: only when the 3D frame is the active surface and the message is from it.
+  window.addEventListener('message', (e) => {
+    if ($reportFrame3d.hidden || e.source !== $reportFrame3d.contentWindow) return;
+    const t = e.data && e.data.type;
+    if (t === 'viewer-ready') { $reportOverlay.hidden = true; $reportOverlay.replaceChildren(); }
+    else if (t === 'viewer-error') {
+      $reportOverlay.hidden = false; $reportOverlay.replaceChildren();
+      $reportOverlay.append(mkEl('div', null, '3D view failed to load — check your connection, then click ▶ Run workflow to try again.'));
+    }
+  });
   // The header ■ Stop run — the always-reachable twin of the overlay Stop (#39).
   if ($stopRunBtn) $stopRunBtn.onclick = () => stopRun();
   $reportOpen.onclick = () => {
-    const html = $reportFrame.srcdoc;
+    const html = lastPaintedHtml || $reportFrame.srcdoc;
     if (!html) return;
     // Open via a blob: URL — an opaque origin, so the report can't script the
     // app origin (mirrors the iframe's sandbox intent).
@@ -4033,7 +4091,7 @@
     $reportModal.dataset.nodeId = reportNodeId() || '';
     const cached = lastReportByApp.get(id);
     if (cached && cached.html) paintReport(cached.html);
-    else { $reportFrame.srcdoc = ''; $reportShare.hidden = true; }
+    else { clearReportFrames(); $reportShare.hidden = true; }
     $reportOverlay.hidden = false;
     $reportOverlay.replaceChildren();
     $reportOverlay.append(mkEl('div', 'spinner'), mkEl('div', null, 'Starting live session…'));
@@ -4118,7 +4176,7 @@
       $reportShare.hidden = false; // the cached report is the primary content
       $reportSub.innerHTML = `<span class="live-pip" aria-hidden="true"></span>Live · waiting for the next change — change your selection in Tekla to refresh the report.`;
     } else {
-      $reportFrame.srcdoc = '';
+      clearReportFrames();
       $reportShare.hidden = true;
       $reportOverlay.hidden = false;
       $reportOverlay.replaceChildren();
@@ -4146,7 +4204,7 @@
         ? `Run complete · last report above — click <strong>▶ Run workflow</strong> to run again.`
         : `Live session stopped · last report above — click <strong>▶ Run workflow</strong> to start again.`;
     } else {
-      $reportFrame.srcdoc = '';
+      clearReportFrames();
       $reportShare.hidden = true;
       $reportOverlay.hidden = false;
       $reportOverlay.replaceChildren();

package/dist/web/index.html

@@ -319,6 +319,13 @@
              Scripts stay BLOCKED (no allow-scripts), so even though the report is now
              same-origin it has no JS to touch the app page — static reports only. -->
         <iframe id="report-frame" sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox" title="Report"></iframe>
+        <!-- Interactive output (the viewer-3d agent) needs scripts, so it cannot use the
+             scriptless static frame above. Loaded via a `data:text/html` URL → an opaque
+             origin (cannot reach the app page, cookies, or same-origin APIs). Minimal
+             sandbox: `allow-scripts` ONLY — the 3D doc has no links/popups of its own
+             (↗ Open is a parent-side action), and NO allow-same-origin. Shown only for
+             interactive reports; the static frame is used otherwise. -->
+        <iframe id="report-frame-3d" sandbox="allow-scripts" title="3D view" hidden></iframe>
         <div class="report-overlay" id="report-overlay" hidden></div>
       </div>
     </div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {