@ggui-ai/ui-gen 0.21.0 → 0.22.0

package/dist/patch.d.ts

@@ -2,7 +2,7 @@ import { PatchFn } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
 import './axes-CzLEMDeB.js';
-import './types-public-CzYqZclY.js';
+import './types-public-mM_-1Yk3.js';
 import './design-mode-DLufhrNp.js';
 import './types-BOvHNG7K.js';
 import './llm.js';

package/dist/{types-public-CzYqZclY.d.ts → types-public-mM_-1Yk3.d.ts}

@@ -120,6 +120,13 @@ declare const LLM_EVAL_STATIC_CRITERIA: ReadonlyArray<{
  * exit runs before the evaluator module is lazily loaded.
  */
 declare function notApplicableCoverage(reason: string): CriterionCoverage[];
+/** One contract-feedback round (ggui#1261): what bought it, and the source it was fed back on. */
+interface ContractFeedbackRecord {
+    /** The exit-probe issue subcategories that bought the round, e.g. `runtime:prop-sensitivity:currentUser`. */
+    readonly firedOn: readonly string[];
+    /** The component source as it stood when the model was told — the round's BEFORE. */
+    readonly sourceBefore: string;
+}
 interface EvalResult {
     issues: EvalIssue[];
     pass: string[];
@@ -139,6 +146,14 @@ interface EvalResult {
      * probe runner; absent on eval paths that never invoke the probe.
      */
     runtimeProbe?: RuntimeProbeMeta;
+    /**
+     * The contract-feedback round, when one fired this generation (ggui#1261):
+     * which exit-probe findings bought it and the source as it stood when the
+     * model was told. `runtimeProbe` and the `runtime:*` issues on this result
+     * are the probe's verdict AFTER that round; `sourceBefore` beside the final
+     * source is the round's before/after. Absent when no such round fired.
+     */
+    contractFeedback?: ContractFeedbackRecord;
     /**
      * Per-canvas visual verdicts. Stamped by the harness ONLY when the
      * visual leg ran with `visualEvaluation.canvases` set (arm-neutral —
@@ -344,4 +359,4 @@ declare function getLLMCriteria(designMode?: DesignMode): EvalCriterion[];
  */
 declare function buildCodingCriteriaSummary(designMode?: DesignMode): string;
 
-export { type AxisCheck as A, type CanvasJudgeRecord as C, DEFAULT_QUALITY_CONFIG as D, type EvalIssue as E, LLM_EVAL_STATIC_CRITERIA as L, type Priority as P, type QualityConfig as Q, type RuntimeProbeStatus as R, type VisualEvalSummary as V, type AxisCheckInput as a, type EvalResult as b, type EvalTier as c, type VisualCoverage as d, CRITERIA as e, type CanvasVisualSummary as f, type CriterionCoverage as g, type CriterionRunStatus as h, type EvalCategory as i, type EvalCriterion as j, type EvalOutcome as k, type QualityMode as l, matches as m, buildCodingCriteriaSummary as n, criteriaFor as o, getActionableIssues as p, getCriteriaByPriority as q, getCriterionById as r, getLLMCriteria as s, isBlocked as t, notApplicableCoverage as u, priorityForIssue as v };
+export { type AxisCheck as A, type CanvasJudgeRecord as C, DEFAULT_QUALITY_CONFIG as D, type EvalIssue as E, LLM_EVAL_STATIC_CRITERIA as L, type Priority as P, type QualityConfig as Q, type RuntimeProbeStatus as R, type VisualEvalSummary as V, type AxisCheckInput as a, type EvalResult as b, type EvalTier as c, type VisualCoverage as d, CRITERIA as e, type CanvasVisualSummary as f, type ContractFeedbackRecord as g, type CriterionCoverage as h, type CriterionRunStatus as i, type EvalCategory as j, type EvalCriterion as k, type EvalOutcome as l, matches as m, type QualityMode as n, buildCodingCriteriaSummary as o, criteriaFor as p, getActionableIssues as q, getCriteriaByPriority as r, getCriterionById as s, getLLMCriteria as t, isBlocked as u, notApplicableCoverage as v, priorityForIssue as w };

package/dist/workflows.d.ts

@@ -2,7 +2,7 @@ import { C as Classification } from './axes-CzLEMDeB.js';
 import { Workflow } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
-import './types-public-CzYqZclY.js';
+import './types-public-mM_-1Yk3.js';
 import './design-mode-DLufhrNp.js';
 import './types-BOvHNG7K.js';
 import './llm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/ui-gen",
-  "version": "0.21.0",
+  "version": "0.22.0",
   "description": "UI generation harness for ggui — the LLM system prompt, multi-turn coding loop, and evaluation engine that turn a DataContract into a React component. Implements the UiGenerator contract from @ggui-ai/mcp-server-core; consumed by @ggui-ai/mcp-server.",
   "license": "Apache-2.0",
   "keywords": [
@@ -189,9 +189,9 @@
     "puppeteer-core": "^24.40.0 || ^25.0.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@ggui-ai/protocol": "0.21.0",
-    "@ggui-ai/mcp-server-core": "0.21.0",
-    "@ggui-ai/project-config": "0.21.0"
+    "@ggui-ai/mcp-server-core": "0.22.0",
+    "@ggui-ai/project-config": "0.22.0",
+    "@ggui-ai/protocol": "0.22.0"
   },
   "peerDependenciesMeta": {
     "@google/adk": {
@@ -233,11 +233,11 @@
     "openai": "^7.9.0",
     "typescript": "^5.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/design": "0.21.0",
-    "@ggui-ai/gadgets": "0.21.0",
-    "@ggui-ai/sandbox": "0.21.0",
-    "@ggui-ai/ui-visual-tester": "0.21.0",
-    "@ggui-ai/wire": "0.21.0"
+    "@ggui-ai/design": "0.22.0",
+    "@ggui-ai/sandbox": "0.22.0",
+    "@ggui-ai/gadgets": "0.22.0",
+    "@ggui-ai/ui-visual-tester": "0.22.0",
+    "@ggui-ai/wire": "0.22.0"
   },
   "devDependencies": {
     "@google/adk": "^2.0.0",
@@ -252,9 +252,9 @@
     "react-dom": "^19.0.0",
     "tsup": "^8.5.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/mcp-server-core": "0.21.0",
-    "@ggui-ai/project-config": "0.21.0",
-    "@ggui-ai/protocol": "0.21.0"
+    "@ggui-ai/mcp-server-core": "0.22.0",
+    "@ggui-ai/project-config": "0.22.0",
+    "@ggui-ai/protocol": "0.22.0"
   },
   "engines": {
     "node": ">=22.0.0"

package/src/adapters/claude/claude-code-login.ts

@@ -9,9 +9,12 @@
  *   1. {@link CLAUDE_CODE_LOGIN_CREDENTIAL} — the sentinel a `ProviderKeyRef`
  *      carries in place of a key, the same shape `bedrock-iam` already uses
  *      for "authenticate with ambient credentials, not a key I hold".
- *   2. {@link stripProviderKeyEnv} — no provider key may reach the spawned
- *      process: the binary prefers an env key over its login, so a stale
- *      `ANTHROPIC_API_KEY` would silently take the run off the login path.
+ *   2. {@link loginChildEnv} — the spawned process sees an ALLOWLIST of the
+ *      parent's env, never the parent's env minus a few names: no provider
+ *      key (the binary prefers an env key over its login, so a stale
+ *      `ANTHROPIC_API_KEY` would silently take the run off the login path),
+ *      no other secret the parent merely holds, and no switch that would
+ *      change what the binary does (ggui#1278).
  *   3. {@link claudeCodeLoginQueryOptions} — the SDK options that keep the
  *      run bounded: no built-in tool (`tools: []`), no `~/.claude` settings,
  *      hooks or MCP servers leaking in (`settingSources: []`). Not
@@ -40,14 +43,66 @@ export const PROVIDER_KEY_ENV_NAMES = [
   "ANTHROPIC_BASE_URL",
 ] as const;
 
-/** A copy of `env` without any provider key or endpoint override. */
-export function stripProviderKeyEnv(
+/**
+ * The only env names the login child inherits (ggui#1278), plus every
+ * `LC_*` locale name. The spawned binary sees a property of this code, not
+ * whatever the parent happened to load: a parent that sourced a whole
+ * `.env` holds every provider's key, and a denylist would pass all of them
+ * on, together with switches such as `CLAUDE_CODE_USE_BEDROCK` that would
+ * silently re-route the run.
+ *
+ * - Process basics: `PATH` (the binary runs helpers, e.g. the macOS
+ *   keychain tool), `HOME`/`USER`/`LOGNAME` (where and whose the login
+ *   store is), `SHELL`, temp dirs, `TERM`, `TZ`, locale.
+ * - Where the login lives: `CLAUDE_CONFIG_DIR`, the XDG base dirs.
+ * - `CLAUDE_CODE_OAUTH_TOKEN`: the login ITSELF when a headless host
+ *   supplies it by env (`claude setup-token`). It is the one credential
+ *   this path may use; every provider key stays out
+ *   ({@link PROVIDER_KEY_ENV_NAMES} is never on this list).
+ * - Network reach: proxy variables in both spellings, and the extra-CA
+ *   and certificate paths a corporate network needs.
+ */
+export const LOGIN_CHILD_ENV_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TMPDIR",
+  "TMP",
+  "TEMP",
+  "TERM",
+  "TZ",
+  "LANG",
+  "CLAUDE_CONFIG_DIR",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_CACHE_HOME",
+  "XDG_STATE_HOME",
+  "XDG_RUNTIME_DIR",
+  "HTTPS_PROXY",
+  "https_proxy",
+  "HTTP_PROXY",
+  "http_proxy",
+  "NO_PROXY",
+  "no_proxy",
+  "ALL_PROXY",
+  "all_proxy",
+  "NODE_EXTRA_CA_CERTS",
+  "SSL_CERT_FILE",
+  "SSL_CERT_DIR",
+] as const;
+
+const LOGIN_CHILD_ENV: ReadonlySet<string> = new Set(LOGIN_CHILD_ENV_NAMES);
+
+/** The env the login child is spawned with: the allowlisted names present in `env`, nothing else. */
+export function loginChildEnv(
   env: Readonly<Record<string, string | undefined>>
 ): Record<string, string> {
   const out: Record<string, string> = {};
-  const drop: ReadonlySet<string> = new Set(PROVIDER_KEY_ENV_NAMES);
   for (const [k, v] of Object.entries(env)) {
-    if (v !== undefined && !drop.has(k)) out[k] = v;
+    if (v !== undefined && (LOGIN_CHILD_ENV.has(k) || k.startsWith("LC_"))) out[k] = v;
   }
   return out;
 }

package/src/adapters/claude/sdk.ts

@@ -13,7 +13,7 @@ import type { ClaudeSdkConfig, GenerateParams } from '../base';
 import type { AdapterResult, ProviderName, AdapterMode } from '../types';
 import { createArtifacts, processMessage } from './message-parser';
 import { createToolMcpServer } from './tool-bridge';
-import { claudeCodeLoginQueryOptions, stripProviderKeyEnv } from './claude-code-login';
+import { claudeCodeLoginQueryOptions, loginChildEnv } from './claude-code-login';
 
 export class ClaudeSdkAdapter extends GeneratorAdapter {
   readonly provider: ProviderName = 'claude';
@@ -41,11 +41,12 @@ export class ClaudeSdkAdapter extends GeneratorAdapter {
     const { query } = await import('@anthropic-ai/claude-agent-sdk');
 
     // Build environment from config or process.env
-    // ggui#1185 — on the login path no provider key may reach the binary:
-    // it prefers an env key over its login, so a stale one would take the
-    // run off this path without a word.
+    // ggui#1185/#1278 — on the login path the binary sees an allowlisted
+    // env: no provider key (it prefers an env key over its login, so a stale
+    // one would take the run off this path without a word), and nothing
+    // else the parent merely holds.
     const login = cfg.claudeCodeLogin === true;
-    const env = login ? stripProviderKeyEnv(buildEnv(cfg.env)) : buildEnv(cfg.env);
+    const env = login ? loginChildEnv(buildEnv(cfg.env)) : buildEnv(cfg.env);
 
     const artifacts = createArtifacts();
     const onProgress = cfg.onProgress;

package/src/boilerplate/templates/layouts/chat-mobile.tsx.tmpl

@@ -1,3 +1,7 @@
-    <Card padding="sm" shadow="sm">
-      {/* implement your UI here */}
-    </Card>
+    <Box padding="md">
+      {/* implement your UI here — an inline card: the chat bubble around it
+          provides the chrome, so add no shadow or outer radius of your own.
+          Compact and natural height; stack vertically. This root fills the
+          bubble — wrap PROSE in <Container maxWidth="sm"> to cap the reading
+          measure (inert at bubble width, composed on a wider frame). */}
+    </Box>

package/src/boilerplate/templates/layouts/chat-universal.tsx.tmpl

@@ -1,3 +1,7 @@
-    <Card padding="sm" shadow="sm">
-      {/* implement your UI here */}
-    </Card>
+    <Box padding="md">
+      {/* implement your UI here — an inline card: the chat bubble around it
+          provides the chrome, so add no shadow or outer radius of your own.
+          Compact and natural height; stack vertically. This root fills the
+          bubble — wrap PROSE in <Container maxWidth="sm"> to cap the reading
+          measure (inert at bubble width, composed on a wider frame). */}
+    </Box>

package/src/contract-context.ts

@@ -59,7 +59,7 @@ const SHELL_HINTS: Record<string, string> = {
 - Padding: use var(--ggui-spacing-2) for inner elements, var(--ggui-spacing-4) for sections. Tight.
 - Scrolling: parent scrolls (chat feed) — component should NOT have internal scroll
 - Layout: single column, compact. No sidebar. Stack everything vertically.
-- Width: width: 100% (fills parent bubble). Do NOT set max-width.`,
+- Width: the root is width: 100% (fills the bubble) — never cap the ROOT. A prose column inside it carries the reading cap (<Container maxWidth="sm">), which is inert at bubble width.`,
 
   fullscreen: `**Fullscreen Shell — Takes over entire viewport**
 - Container: the whole viewport, edge to edge — the frame stretches your root to its full height (you never set a viewport height yourself)

package/src/create-ui-generator.ts

@@ -56,6 +56,7 @@ import {
 } from '@ggui-ai/mcp-server-core';
 import { createGeneratorTools } from './adapters/index.js';
 import { dispatchGeneration } from './adapters/generation-dispatch.js';
+import { generatorBuild } from './generator-build.js';
 import { hasProfile } from './boilerplate/styling-profile.js';
 import { effortDials } from './effort.js';
 import type { ProviderName } from './adapters/types.js';
@@ -68,6 +69,7 @@ import {
 } from './contract-context.js';
 import type { RenderingContext } from './contract-context.js';
 import type { DesignMode } from './design-mode.js';
+import { DEFAULT_DESIGN_MODE } from './design-mode.js';
 import { resolveRoute, applyRouteToEnv } from './adapters/provider-router.js';
 import type { QualityConfig } from './evaluation/types-public.js';
 import type { EvaluationConfig } from './evaluation/types.js';
@@ -339,6 +341,7 @@ export function createUiGenerator(
         // Ignored by the constrained prompt (its shell/screen
         // descriptors stay byte-identical).
         const canvas = rendering ? canvasForRenderingContext(rendering) : undefined;
+        const shellType = harnessShellForRendering(rendering);
         const promptWithVariance = injectVariance(
           promptWithRendering,
           input.variance,
@@ -405,6 +408,8 @@ export function createUiGenerator(
           ...(onRetry !== undefined ? { onRetry } : {}),
           ...(designMode !== undefined ? { designMode } : {}),
           ...(canvas !== undefined ? { canvas } : {}),
+          // ggui#1279 — the shell the declared rendering composes for (chat only; see harnessShellForRendering).
+          ...(shellType !== undefined ? { shellType } : {}),
           ...(input.profile !== undefined ? { profile: input.profile } : {}),
           // Fixture props reach the in-loop probe + visual round only (never the prompt, never identity).
           ...(input.fixtureProps !== undefined ? { fixtureProps: input.fixtureProps } : {}),
@@ -421,6 +426,8 @@ export function createUiGenerator(
           latencyMs: Date.now() - startedAt,
           cacheHit: false,
           attempts: result.turnsUsed,
+          // ggui#1280 — the build that made this generation (template keys, never per-request).
+          build: generatorBuild(designMode ?? DEFAULT_DESIGN_MODE),
           // Prompt-cache counters are provider-specific (Claude reports
           // them; others omit). Pass through truthfully — absent on the
           // adapter result stays absent here, never defaulted to 0.
@@ -461,6 +468,8 @@ export function createUiGenerator(
             outputTokens: 0,
             latencyMs: Date.now() - startedAt,
             cacheHit: false,
+            // ggui#1280 — a failed generation still names the build that failed.
+            build: generatorBuild(designMode ?? DEFAULT_DESIGN_MODE),
           },
         };
       } finally {
@@ -523,6 +532,27 @@ function mapLlmProviderToDispatchProvider(provider: LlmProvider): ProviderName {
   }
 }
 
+/**
+ * ggui#1279 — the harness shell a declared rendering composes for. The canvas
+ * (`canvasForRenderingContext`) already follows the rendering; the WHAT leg's
+ * layout and the HOW leg's shell descriptor did not, so a declared chat card
+ * was scaffolded to "fill the frame" while the user prompt and the fit verdict
+ * treated it as an inline card. Only a declared CHAT shell changes anything.
+ * `fullscreen` IS the harness default, and `partial` has no layout of its own
+ * yet, so both pass no shell and those generations stay byte-identical — named
+ * here rather than guessed.
+ */
+function harnessShellForRendering(rendering: RenderingContext | undefined): 'chat' | undefined {
+  if (rendering === undefined) return undefined;
+  switch (rendering.shell) {
+    case 'chat':
+      return 'chat';
+    case 'fullscreen':
+    case 'partial':
+      return undefined;
+  }
+}
+
 function mapRendering(
   rendering: UiGenerateInput['rendering'],
 ): RenderingContext | undefined {

package/src/evaluation/index.ts

@@ -22,6 +22,7 @@ export type {
   EvalOutcome,
   EvalCategory,
   EvalResult,
+  ContractFeedbackRecord,
   VisualEvalSummary,
   CanvasJudgeRecord,
   CanvasVisualSummary,

package/src/evaluation/llm-evaluator.ts

@@ -25,7 +25,7 @@ import type {
 } from './types-public.js';
 import { LLM_EVAL_STATIC_CRITERIA } from './types-public.js';
 import { createAgent } from '../harness/llm-router';
-import type { AgentConfig, LLMToolDef, LLMAgent } from '../harness/llm-router';
+import type { AgentConfig, LLMToolDef, LLMAgent, LLMToolCallResponse } from '../harness/llm-router';
 import type { JsonObject } from '@ggui-ai/protocol';
 import { getCriterionById } from './types-public.js';
 import { DEFAULT_DESIGN_MODE, type DesignMode } from '../design-mode.js';
@@ -596,10 +596,36 @@ interface CriterionResult {
   coverage: CriterionRunStatus;
   /** Populated for `skipped` — why the criterion produced no verdict. */
   skipReason?: string;
-  tokens: { in: number; out: number };
+  /** This call's token accounting. The cache counts are present only when the
+   *  provider reported them — absent means unreported, never zero (ggui#1281). */
+  tokens: { in: number; out: number; cacheRead?: number; cacheCreation?: number };
   durationMs: number;
 }
 
+/** A call's token accounting, carrying the prompt-cache counts only when the
+ *  provider reported them (the router's rule: absent is "unreported"). */
+function callTokens(response: LLMToolCallResponse): CriterionResult['tokens'] {
+  return {
+    in: response.inputTokens,
+    out: response.outputTokens,
+    ...(response.cacheReadTokens !== undefined ? { cacheRead: response.cacheReadTokens } : {}),
+    ...(response.cacheCreationTokens !== undefined ? { cacheCreation: response.cacheCreationTokens } : {}),
+  };
+}
+
+/**
+ * The evaluation's summed token accounting. `inputTokens` is the NON-cached
+ * input (the router's convention); the cache counts are the sums of what the
+ * calls reported, and stay absent when no call reported one — so a caller can
+ * tell "no cache reads" from "the provider does not say" (ggui#1281).
+ */
+export interface LLMEvalTokenUsage {
+  inputTokens: number;
+  outputTokens: number;
+  cacheReadTokens?: number;
+  cacheCreationTokens?: number;
+}
+
 /**
  * All valid categories for LLM evaluation — derived from the ONE static
  * list in types-public so the coverage stamp here and the harness's
@@ -642,7 +668,7 @@ async function evalCriterion(
         pass: true,
         coverage: 'skipped',
         skipReason: 'no tool call returned',
-        tokens: { in: response.inputTokens, out: response.outputTokens },
+        tokens: callTokens(response),
         durationMs,
       };
     }
@@ -700,7 +726,7 @@ async function evalCriterion(
       issues,
       pass,
       coverage: 'ran',
-      tokens: { in: response.inputTokens, out: response.outputTokens },
+      tokens: callTokens(response),
       durationMs,
     };
   } catch (e) {
@@ -833,7 +859,7 @@ export async function runLLMEvaluation(
   context: LLMEvalContext,
   config: LLMEvalConfig,
   preWarmedContext?: PreWarmedEvalContext | null,
-): Promise<EvalResult & { inputTokens: number; outputTokens: number }> {
+): Promise<EvalResult & LLMEvalTokenUsage> {
   const providerName = config.provider;
   const model = config.model || getDefaultEvalModel(providerName);
   const routerProvider =
@@ -887,7 +913,10 @@ export async function runLLMEvaluation(
   const passCategories: string[] = [];
   let totalIn = 0;
   let totalOut = 0;
-  let cachedTokensEstimate = 0;
+  // Measured, not estimated: summed from what the calls reported; absent
+  // while no call has reported one (ggui#1281).
+  let cacheRead: number | undefined;
+  let cacheCreation: number | undefined;
 
   for (const r of results) {
     allIssues.push(...r.issues);
@@ -896,12 +925,8 @@ export async function runLLMEvaluation(
     }
     totalIn += r.tokens.in;
     totalOut += r.tokens.out;
-  }
-
-  // Estimate cached tokens (mother prompt sent N times, cached N-1 times)
-  const firstResult = results[0];
-  if (firstResult && firstResult.tokens.in > 0) {
-    cachedTokensEstimate = firstResult.tokens.in * (totalCriteriaCount - 1);
+    if (r.tokens.cacheRead !== undefined) cacheRead = (cacheRead ?? 0) + r.tokens.cacheRead;
+    if (r.tokens.cacheCreation !== undefined) cacheCreation = (cacheCreation ?? 0) + r.tokens.cacheCreation;
   }
 
   const wallMs = Date.now() - evalStart;
@@ -928,7 +953,7 @@ export async function runLLMEvaluation(
   }
   console.log(
     `[eval] total: ${(wallMs / 1000).toFixed(1)}s wall (${totalCriteriaCount} parallel) | ` +
-    `in=${totalIn} out=${totalOut} cached~=${cachedTokensEstimate} | ` +
+    `in=${totalIn} out=${totalOut} cacheRead=${cacheRead ?? 'unreported'} cacheWrite=${cacheCreation ?? 'unreported'} | ` +
     `issues=${allIssues.length} pass=${passCategories.length}` +
     (skippedCount > 0 ? ` skipped=${skippedCount}` : ''),
   );
@@ -939,5 +964,7 @@ export async function runLLMEvaluation(
     criteriaCoverage,
     inputTokens: totalIn,
     outputTokens: totalOut,
+    ...(cacheRead !== undefined ? { cacheReadTokens: cacheRead } : {}),
+    ...(cacheCreation !== undefined ? { cacheCreationTokens: cacheCreation } : {}),
   };
 }

package/src/evaluation/types-public.ts

@@ -175,6 +175,14 @@ export function notApplicableCoverage(reason: string): CriterionCoverage[] {
   }));
 }
 
+/** One contract-feedback round (ggui#1261): what bought it, and the source it was fed back on. */
+export interface ContractFeedbackRecord {
+  /** The exit-probe issue subcategories that bought the round, e.g. `runtime:prop-sensitivity:currentUser`. */
+  readonly firedOn: readonly string[];
+  /** The component source as it stood when the model was told — the round's BEFORE. */
+  readonly sourceBefore: string;
+}
+
 export interface EvalResult {
   issues: EvalIssue[];
   pass: string[];
@@ -194,6 +202,14 @@ export interface EvalResult {
    * probe runner; absent on eval paths that never invoke the probe.
    */
   runtimeProbe?: RuntimeProbeMeta;
+  /**
+   * The contract-feedback round, when one fired this generation (ggui#1261):
+   * which exit-probe findings bought it and the source as it stood when the
+   * model was told. `runtimeProbe` and the `runtime:*` issues on this result
+   * are the probe's verdict AFTER that round; `sourceBefore` beside the final
+   * source is the round's before/after. Absent when no such round fired.
+   */
+  contractFeedback?: ContractFeedbackRecord;
   /**
    * Per-canvas visual verdicts. Stamped by the harness ONLY when the
    * visual leg ran with `visualEvaluation.canvases` set (arm-neutral —

package/src/evaluation/visual-evaluator.ts

@@ -19,7 +19,7 @@ import { judgeDesignIdentity, type JudgeDesignIdentity } from './design-identity
 import { resolve, dirname } from 'path';
 import { fileURLToPath } from 'url';
 import { createRequire } from 'node:module';
-import { existsSync, writeFileSync, mkdirSync, unlinkSync } from 'fs';
+import { existsSync, writeFileSync, mkdtempSync, rmSync } from 'fs';
 import { createHash } from 'node:crypto';
 import { tmpdir } from 'os';
 import { createVisionAgent, type AgentConfig } from '../harness/llm-router';
@@ -346,9 +346,12 @@ async function bundleForRendering(
   sampleProps: Record<string, unknown>,
   designSrc: string = resolve(resolveDesignPackageDir(), 'src'),
 ): Promise<string> {
-  // Write component + entry to temp files for esbuild
-  const tmpDir = resolve(tmpdir(), 'ggui-visual-eval-' + Date.now());
-  mkdirSync(tmpDir, { recursive: true });
+  // Write component + entry to temp files for esbuild — in a directory of THIS
+  // call's own. `mkdtempSync` is atomic and unique: a timestamp-named directory
+  // was shared by two bundles started in the same millisecond, so the first
+  // build read the second's component (a judge scoring the wrong generation)
+  // and the first's cleanup deleted the files the second was building.
+  const tmpDir = mkdtempSync(resolve(tmpdir(), 'ggui-visual-eval-'));
   const componentFile = resolve(tmpDir, 'component.tsx');
   const entryFile = resolve(tmpDir, 'entry.tsx');
 
@@ -439,8 +442,8 @@ try {
 
     return result.outputFiles[0]?.text ?? '';
   } finally {
-    try { unlinkSync(entryFile); } catch { /* cleanup */ }
-    try { unlinkSync(componentFile); } catch { /* cleanup */ }
+    // The whole per-call directory; `force` makes an already-absent path a no-op.
+    rmSync(tmpDir, { recursive: true, force: true });
   }
 }