@ggui-ai/ui-gen 0.22.0 → 0.23.0

package/dist/workflows.d.ts

@@ -2,7 +2,7 @@ import { C as Classification } from './axes-CzLEMDeB.js';
 import { Workflow } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
-import './types-public-mM_-1Yk3.js';
+import './types-public-Ow-tNtFE.js';
 import './design-mode-DLufhrNp.js';
 import './types-BOvHNG7K.js';
 import './llm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/ui-gen",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "UI generation harness for ggui — the LLM system prompt, multi-turn coding loop, and evaluation engine that turn a DataContract into a React component. Implements the UiGenerator contract from @ggui-ai/mcp-server-core; consumed by @ggui-ai/mcp-server.",
   "license": "Apache-2.0",
   "keywords": [
@@ -189,9 +189,9 @@
     "puppeteer-core": "^24.40.0 || ^25.0.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@ggui-ai/mcp-server-core": "0.22.0",
-    "@ggui-ai/project-config": "0.22.0",
-    "@ggui-ai/protocol": "0.22.0"
+    "@ggui-ai/mcp-server-core": "0.23.0",
+    "@ggui-ai/protocol": "0.23.0",
+    "@ggui-ai/project-config": "0.23.0"
   },
   "peerDependenciesMeta": {
     "@google/adk": {
@@ -233,11 +233,11 @@
     "openai": "^7.9.0",
     "typescript": "^5.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/design": "0.22.0",
-    "@ggui-ai/sandbox": "0.22.0",
-    "@ggui-ai/gadgets": "0.22.0",
-    "@ggui-ai/ui-visual-tester": "0.22.0",
-    "@ggui-ai/wire": "0.22.0"
+    "@ggui-ai/design": "0.23.0",
+    "@ggui-ai/gadgets": "0.23.0",
+    "@ggui-ai/sandbox": "0.23.0",
+    "@ggui-ai/wire": "0.23.0",
+    "@ggui-ai/ui-visual-tester": "0.23.0"
   },
   "devDependencies": {
     "@google/adk": "^2.0.0",
@@ -252,9 +252,9 @@
     "react-dom": "^19.0.0",
     "tsup": "^8.5.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/mcp-server-core": "0.22.0",
-    "@ggui-ai/project-config": "0.22.0",
-    "@ggui-ai/protocol": "0.22.0"
+    "@ggui-ai/mcp-server-core": "0.23.0",
+    "@ggui-ai/project-config": "0.23.0",
+    "@ggui-ai/protocol": "0.23.0"
   },
   "engines": {
     "node": ">=22.0.0"

package/src/advanced/generator.ts

@@ -349,6 +349,18 @@ async function runFastStage(
     ...(input.contract ? { contract: input.contract } : {}),
   };
   const result = await runRenderCheck(checkInput);
+  if (result.incomplete !== undefined) {
+    // ggui#1299: the check ran out of wall-clock time, so there is no
+    // evidence either way — the same posture as an unverified check
+    // (non-failing, the unverified score). The slow stage still gates.
+    return {
+      stage: 'fast',
+      ok: true,
+      score: UNVERIFIED_FAST_SCORE,
+      diagnostics: [],
+      durationMs: Date.now() - start,
+    };
+  }
   const diagnostics: StageDiagnostic[] = buildFastStageComplaints(
     result.issues as readonly RenderCheckIssue[],
   );
@@ -405,11 +417,14 @@ async function runSlowStage(
  * job is just to land above or below it. Per-issue gradations matter
  * less than getting the pass/fail boundary right.
  */
+/** Fast-stage score when nothing failed but something went unverified. */
+const UNVERIFIED_FAST_SCORE = 0.85;
+
 function scoreFromRenderCheck(issues: readonly RenderCheckIssue[]): number {
   const failed = issues.filter((i) => i.outcome === 'failed').length;
   const unverified = issues.filter((i) => i.outcome === 'unverified').length;
   if (failed === 0 && unverified === 0) return 1.0;
-  if (failed === 0) return 0.85;
+  if (failed === 0) return UNVERIFIED_FAST_SCORE;
   if (failed === 1) return 0.4;
   if (failed === 2) return 0.3;
   return 0.2;

package/src/blueprint-validator.ts

@@ -23,7 +23,7 @@
 
 import type { DataContract, JsonObject } from '@ggui-ai/protocol';
 import { DEFAULT_RUNTIME_RENDER_CHECK } from './harness/check/runtime-render/index.js';
-import type { EvalIssue } from './evaluation/types-public.js';
+import type { EvalIssue, RuntimeProbeStatus } from './evaluation/types-public.js';
 
 /**
  * Caller-supplied blueprint payload. `contract` is `unknown` at the
@@ -74,6 +74,23 @@ export interface ValidateBlueprintInput {
  * the absence cleanly (selfCheck skips prop-coverage warnings; runtime
  * probe skip-warns).
  */
+/**
+ * The warning code for a probe that did not produce evidence. Exhaustive over
+ * the did-not-run statuses, so a new status is a compile error here instead of
+ * silently reading as whichever arm a ternary falls through to (ggui#1299:
+ * `timed-out` would otherwise have been labelled `probe-not-applicable`).
+ */
+function probeDidNotRunCode(status: Exclude<RuntimeProbeStatus, 'ran'>): string {
+  switch (status) {
+    case 'infra-skipped':
+      return 'runtime:probe-infra-failure';
+    case 'not-applicable':
+      return 'runtime:probe-not-applicable';
+    case 'timed-out':
+      return 'runtime:probe-timeout';
+  }
+}
+
 function asContract(x: RawContract): DataContract | undefined {
   if (typeof x !== 'object' || x === null) return undefined;
   return x as DataContract;
@@ -247,17 +264,15 @@ async function runtimeTier(input: RuntimeTierInput): Promise<RuntimeResult> {
       fixtureProps: asJsonObject(input.fixtureProps),
     });
     if (outcome.status !== 'ran') {
-      // Probe did not execute — infra failure or nothing to probe.
+      // Probe produced no evidence — infra failure, nothing to probe, or it
+      // ran out of wall-clock time before finishing.
       // Surface as a warning rather than a hard error so a flaky probe
       // doesn't permanently block legitimate blueprints — Claude can
       // retry, and host-level logs record the diagnostic for ops review.
       warnings.push({
         _kind: 'warning',
         tier: 'runtime',
-        code:
-          outcome.status === 'infra-skipped'
-            ? 'runtime:probe-infra-failure'
-            : 'runtime:probe-not-applicable',
+        code: probeDidNotRunCode(outcome.status),
         message: `Runtime probe did not run (${outcome.status}): ${outcome.reason ?? 'no reason recorded'}`,
       });
       return { errors, warnings };

package/src/boilerplate/hard-sections.ts

@@ -250,6 +250,7 @@ export const FRAME_SIZING = `## Sizing — the frame owns the height and the wid
 The host sizes the iframe; the component never sizes itself to the viewport. NEVER write \`100vh\` / \`100dvh\` / \`100svh\` (or an \`h-screen\` / \`min-h-screen\` class) as a height on any element:
 - An inline card takes its natural height. A content-sized frame is measured FROM the content, so a \`100vh\` root can never shrink and grows the frame on every re-measure.
 - Under fullscreen the frame already stretches your root to its full height. Centre inside it with flex (\`display: flex; flex-direction: column; justify-content: center\`), never with a viewport height.
+- Under fullscreen the frame also keeps a 16 px inset between your content and the panel's edge — leave it. A \`surface="hero"\` band that OPENS the card runs edge to edge on its own. Any other band that is MEANT to run edge to edge (a full-width strip of rows, a closing action bar) takes \`bleed\` (\`<Box surface="sunken" bleed>…</Box>\`); only such a band should, and \`bleed\` is ignored outside fullscreen.
 - To fill a parent that has a height use \`height: 100%\` or \`flex: 1\`; a viewport unit is only ever a \`max-height\` cap on a scroll region.
 
 The width works the same way, and the mistake is the mirror image: **your outermost element FILLS the frame; a width cap belongs INSIDE it, on the column that holds text.**

package/src/coding-agent/tools.ts

@@ -416,7 +416,12 @@ export async function executeTool(
         changes: normalizedChanges,
       });
       if (!patchResult.ok) {
-        return { result: `FAILED: ${patchResult.error}`, error: true };
+        // ggui#1261: the engine refused the patch (overlap, line bounds, missing range) before
+        // anything applied. Say so in the log, and call it what it is — PATCH_INVALID, like every
+        // other structural refusal in this tool — so the turn is never counted as a self-check
+        // failure that did not run.
+        console.log(`[coding-agent] apply_changes: REJECTED | ${patchResult.error}`);
+        return { result: `PATCH_INVALID: ${patchResult.error}`, error: true };
       }
       const candidate = patchResult.sourceAfter ?? currentFile;
 

package/src/evaluation/axis-checks/checks/state-payload.ts

@@ -79,16 +79,41 @@ function runStateCoversPayload(input: AxisCheckInput): EvalIssue[] {
   return issues;
 }
 
+/**
+ * Whether a `useState` initializer reads `props.<name>`: directly, or through a local bound from
+ * it (`const initial = normalize(props.initialProfile)` then `useState(initial.name)`, or a
+ * destructure `const { name } = props.initialProfile ?? {}` then `useState(name)`). The property
+ * this check guards is "form state is seeded from the prop", not a spelling: ggui#1261's Exp 011
+ * cell re-seeded correctly through a normalized local, was refused, and spent a turn restoring
+ * the literal form.
+ */
+function seedsFromProp(src: string, name: string): boolean {
+  const propRef = `props\\??\\.${name}\\b`;
+  const initializerReads = (ref: string): boolean =>
+    new RegExp(`useState(?:<[^>]*>)?\\s*\\([\\s\\S]{0,400}?${ref}`).test(src);
+  if (initializerReads(propRef)) return true;
+  const locals = new Set<string>();
+  for (const m of src.matchAll(new RegExp(`(?:const|let|var)\\s+(\\w+)\\s*(?::[^=]{1,80})?=\\s*[^;]{0,300}?${propRef}`, "g"))) {
+    const id = m[1];
+    if (id !== undefined) locals.add(id);
+  }
+  for (const m of src.matchAll(new RegExp(`(?:const|let|var)\\s*\\{([^}]{1,400})\\}\\s*=\\s*[^;]{0,300}?${propRef}`, "g"))) {
+    for (const part of (m[1] ?? "").split(",")) {
+      const id = part.split(":").pop()?.split("=")[0]?.trim();
+      if (id !== undefined && /^\w+$/.test(id)) locals.add(id);
+    }
+  }
+  for (const id of locals) if (initializerReads(`\\b${id}\\b`)) return true;
+  return false;
+}
+
 function runInitialValuesSeeded(input: AxisCheckInput): EvalIssue[] {
   if (input.compiledCode === null) return [];
   const src = input.sourceCode;
   const initialProps = getInitialValuePropNames(input.contract);
   const issues: EvalIssue[] = [];
   for (const name of initialProps) {
-    const re = new RegExp(
-      `useState(?:<[^>]*>)?\\s*\\([\\s\\S]{0,400}?props\\.${name}\\b`,
-    );
-    if (re.test(src)) continue;
+    if (seedsFromProp(src, name)) continue;
     issues.push(
       mkIssue(
         "state.payload.initial_values_seeded",

package/src/evaluation/types-public.ts

@@ -74,8 +74,28 @@ export interface EvalIssue {
  *                       consumers MUST NOT count it as a pass.
  *   - `not-applicable`— nothing to probe (no compiled code, no contract
  *                       surface, or no runtimeRender check configured).
+ *   - `timed-out`     — probe started but did not finish inside its
+ *                       wall-clock bound (ggui#1299). Carries ZERO
+ *                       evidence about the component: on a contended
+ *                       host an ordinary component crosses the bound.
+ *                       Consumers MUST NOT count it as a pass, and MUST
+ *                       NOT count it as a crash either. `elapsedMs` and
+ *                       `hostLoad` say how long it ran and how busy the
+ *                       host was, so a reader can tell the two cases apart.
  */
-export type RuntimeProbeStatus = "ran" | "infra-skipped" | "not-applicable";
+export type RuntimeProbeStatus = "ran" | "infra-skipped" | "not-applicable" | "timed-out";
+
+/**
+ * The host's 1-minute load average at a probe's start and end, beside the
+ * number of CPUs the process can use (ggui#1299). A load well above
+ * `cores` means the probe competed for CPU; a wall-clock bound crossed
+ * there says more about the host than about the component.
+ */
+export interface ProbeHostLoad {
+  readonly start: number;
+  readonly end: number;
+  readonly cores: number;
+}
 
 /**
  * Probe execution meta stamped onto an `EvalResult` at the exit-decision
@@ -85,8 +105,12 @@ export type RuntimeProbeStatus = "ran" | "infra-skipped" | "not-applicable";
  */
 export interface RuntimeProbeMeta {
   readonly status: RuntimeProbeStatus;
-  /** Populated for `infra-skipped` / `not-applicable` — why the probe didn't run. */
+  /** Populated for `infra-skipped` / `not-applicable` / `timed-out` — why the probe didn't finish. */
   readonly reason?: string;
+  /** `timed-out` only: how long the probe ran before it was stopped. */
+  readonly elapsedMs?: number;
+  /** Host load around the probe, when it ran isolated (absent for an in-process probe). */
+  readonly hostLoad?: ProbeHostLoad;
 }
 
 /**

package/src/harness/check/runtime-render/adapter.ts

@@ -54,11 +54,30 @@ export const DEFAULT_RUNTIME_RENDER_CHECK: RuntimeRenderCheck = {
       return { status: "infra-skipped", issues: [], reason: message };
     }
 
+    const hostLoad = result.stats.hostLoad;
+    const load = hostLoad !== undefined ? { hostLoad } : {};
+
+    // ggui#1299: a check that ran out of wall-clock time is not a verdict on
+    // the component. It becomes the `timed-out` status (did-not-run, never a
+    // pass, never a crash), never an eval issue — so the coding agent is never
+    // told to fix a crash that did not happen.
+    if (result.incomplete !== undefined) {
+      const { elapsedMs, boundMs } = result.incomplete;
+      const loadNote =
+        hostLoad !== undefined
+          ? `; host load ${hostLoad.start.toFixed(1)} → ${hostLoad.end.toFixed(1)} on ${hostLoad.cores} CPUs`
+          : "";
+      const reason = `render check did not finish within ${boundMs} ms (stopped at ${elapsedMs} ms)${loadNote}`;
+      console.warn(`[runtime-render] probe timed out — ${reason}`);
+      return { status: "timed-out", issues: [], reason, elapsedMs, ...load };
+    }
+
     return {
       status: "ran",
       issues: result.issues
         .map(toEvalIssue)
         .filter((x): x is EvalIssue => x !== null),
+      ...load,
     };
   },
 };

package/src/harness/check/runtime-render/render-check-host.ts

@@ -11,13 +11,24 @@
  * `unverified`, and nothing throws):
  *
  *   - worker exit 0 + parseable verdict → the verdict, verbatim.
- *   - timeout                    → `failed` (runaway component: the
- *     in-process check has no comparable wall-clock bound, the
- *     subprocess finally gives us one).
- *   - spawn-error / overflow / non-zero exit / unparseable stdout
+ *   - timeout                    → `incomplete` (ggui#1299): the check
+ *     did not finish, which is NOT a verdict on the component. The bound
+ *     is wall-clock, and on a contended host an ordinary component
+ *     crosses it; mapping it to `failed` reported crashes that never
+ *     happened. It carries its elapsed ms, and the host load (below)
+ *     says how busy the host was. React's own runaway guards ("Too many
+ *     re-renders", "Maximum update depth exceeded") throw, so they still
+ *     reach `render-no-throw` as `failed`; what now reads `incomplete`
+ *     is a check that ran out of wall-clock time, whatever the cause.
+ *   - overflow                   → `failed` (a pathological logging or
+ *     error loop; output volume does not depend on host load).
+ *   - spawn-error / non-zero exit / unparseable stdout
  *                                → `unverified` (the harness could not
  *     run the check; never blame the component for our plumbing).
  *
+ * Every isolated check records the host's 1-minute load average at its
+ * start and end, and the CPUs available, on `stats.hostLoad`.
+ *
  * Spawn resolution copies the proven `src/tools/render-check.ts`
  * pattern: prefer the built `dist/.../render-check-worker.js`; in
  * dev/test (vitest imports `src/`), fall back to `node --import tsx`
@@ -29,9 +40,11 @@
  */
 import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
+import { availableParallelism, loadavg } from 'node:os';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { runSandboxed } from '@ggui-ai/sandbox';
 import type { SandboxResult } from '@ggui-ai/sandbox';
+import type { ProbeHostLoad } from '../../../evaluation/types-public.js';
 import type { RenderCheckResult, RunRenderCheckInput } from './render-check.js';
 
 /**
@@ -121,10 +134,12 @@ export function mapSandboxResultToCheckResult(
   t0: number,
 ): RenderCheckResult {
   if (result.outcome === 'timeout') {
-    return failed(
-      `render check timed out after ${CHECK_TIMEOUT_MS}ms in the isolated worker (likely infinite loop or runaway effect in the component).`,
-      t0,
-    );
+    return {
+      ok: false,
+      issues: [],
+      incomplete: { kind: 'timeout', elapsedMs: result.durationMs, boundMs: CHECK_TIMEOUT_MS },
+      stats: { actionsChecked: 0, streamsChecked: 0, renderMs: Date.now() - t0 },
+    };
   }
   if (result.outcome === 'overflow-stdout' || result.outcome === 'overflow-stderr') {
     return failed(
@@ -184,6 +199,7 @@ export async function runRenderCheckViaWorker(
     return unverified(err instanceof Error ? err.message : String(err), t0);
   }
 
+  const loadAtStart = loadavg()[0] ?? 0;
   const result = await runSandboxed({
     command: spawn.command,
     args: spawn.args,
@@ -197,5 +213,11 @@ export async function runRenderCheckViaWorker(
     env: { NODE_ENV: process.env.NODE_ENV ?? 'production' },
   });
 
-  return mapSandboxResultToCheckResult(result, t0);
+  const hostLoad: ProbeHostLoad = {
+    start: loadAtStart,
+    end: loadavg()[0] ?? 0,
+    cores: availableParallelism(),
+  };
+  const mapped = mapSandboxResultToCheckResult(result, t0);
+  return { ...mapped, stats: { ...mapped.stats, hostLoad } };
 }

package/src/harness/check/runtime-render/render-check.ts

@@ -45,6 +45,7 @@ import {
   type ParentLink,
 } from "./host-boundary.js";
 import { hostGlobals, openRecord } from "../../../internal/open-record.js";
+import type { ProbeHostLoad } from "../../../evaluation/types-public.js";
 import { primeInputs } from "@ggui-ai/ui-visual-tester/prime-inputs";
 
 /**
@@ -118,13 +119,31 @@ export type InputPrimingDiagnostic =
   | { readonly primed: number }
   | { readonly error: string };
 
+/**
+ * The check started but did not finish (ggui#1299). The only kind is a
+ * wall-clock timeout in the isolated worker. It is not a verdict on the
+ * component: `issues` is empty and `ok` is false because nothing was
+ * verified, never because something failed.
+ */
+export interface RenderCheckIncomplete {
+  readonly kind: "timeout";
+  /** How long the worker ran before it was stopped. */
+  readonly elapsedMs: number;
+  /** The wall-clock bound it crossed. */
+  readonly boundMs: number;
+}
+
 export interface RenderCheckResult {
   readonly ok: boolean;
   readonly issues: readonly RenderCheckIssue[];
+  /** Present only when the check did not finish; see {@link RenderCheckIncomplete}. */
+  readonly incomplete?: RenderCheckIncomplete;
   readonly stats: {
     readonly actionsChecked: number;
     readonly streamsChecked: number;
     readonly renderMs: number;
+    /** Host load around an isolated check (absent in-process). */
+    readonly hostLoad?: ProbeHostLoad;
   };
 }
 

package/src/harness/coding/run-eval-round.ts

@@ -359,6 +359,8 @@ async function runProbeAtExit(input: {
   const meta: RuntimeProbeMeta = {
     status: outcome.status,
     ...(outcome.reason !== undefined ? { reason: outcome.reason } : {}),
+    ...(outcome.elapsedMs !== undefined ? { elapsedMs: outcome.elapsedMs } : {}),
+    ...(outcome.hostLoad !== undefined ? { hostLoad: outcome.hostLoad } : {}),
   };
   if (outcome.status !== "ran") {
     return { fired: false, recoverableFail: false, probeIssues: [], meta };

package/src/harness/llm-router.ts

@@ -875,8 +875,8 @@ export class AnthropicAgent extends LLMAgent {
           : toolChoice;
       if (appliedToolChoice !== toolChoice) {
         console.warn(
-          `[anthropic] callTools: ${normalizeAnthropicModelId(resolvedModel)} rejects forced tool_choice (HTTP 400); ` +
-            `caller's 'required' downgraded to 'auto'`,
+          `[anthropic] callTools: ${normalizeAnthropicModelId(resolvedModel)} would reject a forced tool_choice (the API answers 400); ` +
+            `caller's 'required' downgraded to 'auto' before sending`,
         );
       }
       const response = await this.apiCall(() =>
@@ -2128,7 +2128,7 @@ export class OpenRouterAgent extends LLMAgent {
       requested === 'required' && anthropicRejectsForcedToolChoice(resolved) ? 'auto' : requested;
     if (appliedToolChoice !== requested) {
       console.warn(
-        `[openrouter] callTools: ${resolved} rejects forced tool_choice (HTTP 400); caller's 'required' downgraded to 'auto'`,
+        `[openrouter] callTools: ${resolved} would reject a forced tool_choice (the API answers 400); caller's 'required' downgraded to 'auto' before sending`,
       );
     }
 

package/src/harness/types-public.ts

@@ -21,7 +21,7 @@
 import type { GenerationProfileInput } from "../boilerplate/styling-profile.js";
 import type { GadgetDescriptor, DataContract, JsonValue } from "@ggui-ai/protocol";
 import type { Classification } from "../classifier/axes.js";
-import type { EvalIssue, EvalTier, AxisCheck, RuntimeProbeStatus } from "../evaluation/types-public.js";
+import type { EvalIssue, EvalTier, AxisCheck, ProbeHostLoad, RuntimeProbeStatus } from "../evaluation/types-public.js";
 import type { LLMToolDef } from "../llm.js";
 import type { CacheTier, HarnessFragment } from "../fragments/index.js";
 import type { HarnessPolicy, ProcessMode } from "../policy.js";
@@ -140,14 +140,18 @@ export interface LLMEvaluator {
 export interface RuntimeRenderOutcome {
   /**
    * Whether the probe actually executed. `issues` is only probe
-   * evidence when `status === "ran"` — an `infra-skipped` or
-   * `not-applicable` outcome carries zero evidence and MUST NOT be
-   * scored as a pass by any consumer.
+   * evidence when `status === "ran"` — an `infra-skipped`,
+   * `not-applicable` or `timed-out` outcome carries zero evidence and
+   * MUST NOT be scored as a pass by any consumer.
    */
   readonly status: RuntimeProbeStatus;
   readonly issues: readonly EvalIssue[];
-  /** Populated for `infra-skipped` / `not-applicable` — why the probe didn't run. */
+  /** Populated for `infra-skipped` / `not-applicable` / `timed-out` — why the probe didn't finish. */
   readonly reason?: string;
+  /** `timed-out` only: how long the probe ran before it was stopped. */
+  readonly elapsedMs?: number;
+  /** Host load around the probe, when it ran isolated (absent for an in-process probe). */
+  readonly hostLoad?: ProbeHostLoad;
 }
 
 export interface RuntimeRenderCheck {