@ggui-ai/iframe-runtime 0.11.0 → 0.13.0

package/dist/ui-feedback-chrome.js

@@ -36,6 +36,44 @@
  * gate passes.
  */
 import { createElement } from 'react';
+/**
+ * Stacking contract between the two body-appended runtime layers
+ * (ggui#603): the feedback chrome must sit strictly ABOVE the action
+ * toast. The persistent `action_required` toast parks
+ * `pointer-events:auto` at fixed bottom-center — the same region this
+ * chrome occupies — and is re-armed per gesture; without this order an
+ * armed toast eats every tap aimed at the feedback controls. The toast
+ * remains dismissable on its own uncovered area (it accepts the click
+ * anywhere on itself), so partial occlusion costs it nothing.
+ *
+ * Single source: `runtime.ts`'s toast reads {@link ACTION_TOAST_Z_INDEX};
+ * this module applies {@link UI_FEEDBACK_CHROME_Z_INDEX} to the chrome
+ * container. The test suite pins the relationship, not the numbers.
+ */
+export const UI_FEEDBACK_CHROME_Z_INDEX = 2147483647;
+export const ACTION_TOAST_Z_INDEX = 2147483646;
+/**
+ * Pure mount decision the boot path consults before touching the DOM.
+ * Two independent gates compose:
+ *
+ *   1. **The #653 opt-in knob** — the founder's default-off ruling:
+ *      generated-component cards carry NO feedback chrome unless the
+ *      embedding deployment explicitly opts in (`uiFeedback: true` on
+ *      the boot options). Absent or `false` ⇒ never mount, regardless
+ *      of sink state.
+ *   2. **The #471 live-sink gate** — even opted in, only a parent that
+ *      actually consumes the `ggui:observe` envelope gets the
+ *      affordance: a bound `onObserve` emitter, or the first-party
+ *      embed host. Third-party MCP-Apps hosts drop the envelope, and a
+ *      feedback control that can never deliver feedback is worse than
+ *      none.
+ */
+export function shouldMountUiFeedbackChrome(input) {
+    if (input.uiFeedback !== true)
+        return false;
+    return (input.onObserveBound ||
+        input.hostName === 'ggui-iframe-runtime-embed-host');
+}
 /**
  * Mount the in-iframe UI-feedback affordance, or do nothing.
  *
@@ -69,6 +107,10 @@ export async function mountUiFeedbackChrome(doc, opts) {
     doc.querySelector('[data-ggui-ui-feedback-chrome]')?.remove();
     const container = doc.createElement('div');
     container.setAttribute('data-ggui-ui-feedback-chrome', '');
+    // Win the stacking race against the action toast (ggui#603 — see
+    // the constants' docblock above).
+    container.style.position = 'relative';
+    container.style.zIndex = String(UI_FEEDBACK_CHROME_Z_INDEX);
     doc.body.appendChild(container);
     const root = reactDomClient.createRoot(container);
     root.render(createElement(cardMod.UiFeedbackCard, {

package/dist/wire-config.d.ts

@@ -95,9 +95,13 @@ export interface BuildRootWireConfigOptions {
      *
      * The default WS-frame send reaches the agent only on servers whose
      * live channel bridges WS `data:submit` actions onto the same
-     * pending-events pipe (first-party `createGguiServer` does — see
-     * `GguiSessionChannelOptions.pendingEventConsumer`); it remains the
-     * seam tests and direct-WS callers exercise.
+     * pending-events pipe. First-party `createGguiServer` bridges it
+     * ONLY when composed with DEFAULT handlers (`opts.handlers`
+     * undefined); a custom `handlers` list drains its own pipe, so the
+     * channel deliberately does not bridge — the hosted pod is such a
+     * caller, and on it a WS gesture lands on the retained ledger only.
+     * See `GguiSessionChannelOptions.pendingEventConsumer`. The default
+     * send remains the seam tests and direct-WS callers exercise.
      *
      * Called AFTER outbound validation passes. Receives the validated
      * {@link ActionEnvelope}; caller extracts payload.action +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/iframe-runtime",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "The iframe-local ggui runtime: a self-contained ESM bundle that boots inside an MCP Apps host iframe, runs the protocol-version handshake, opens the live-channel WebSocket, and mounts the rendered UI. Bundles React, ReactDOM, and the ggui design system so generated component code has a single seam to read from.",
   "keywords": [
     "ggui",
@@ -36,12 +36,12 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/preview-a2ui": "0.11.0",
-    "@ggui-ai/live-channel": "0.11.0",
-    "@ggui-ai/gadgets": "0.11.0",
-    "@ggui-ai/design": "0.11.0",
-    "@ggui-ai/protocol": "0.11.0",
-    "@ggui-ai/wire": "0.11.0"
+    "@ggui-ai/design": "0.13.0",
+    "@ggui-ai/preview-a2ui": "0.13.0",
+    "@ggui-ai/gadgets": "0.13.0",
+    "@ggui-ai/protocol": "0.13.0",
+    "@ggui-ai/wire": "0.13.0",
+    "@ggui-ai/live-channel": "0.13.0"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.27.0"
@@ -75,7 +75,7 @@
   },
   "author": "ggui contributors <hello@ggui.ai>",
   "scripts": {
-    "build": "rm -rf dist && node esbuild.config.mjs && tsc -p tsconfig.types.json && pnpm run check:bundle-size",
+    "build": "rm -rf dist.staging && tsc -p tsconfig.types.json --outDir dist.staging && GGUI_ESBUILD_OUT_DIR=dist.staging node esbuild.config.mjs && node ../scripts/atomic-swap.mjs dist.staging dist && pnpm run check:bundle-size",
     "check:bundle-size": "tsx scripts/check-bundle-size.ts",
     "check:bundle-size:self-test": "tsx scripts/check-bundle-size.ts --self-test",
     "typecheck": "tsc --noEmit",