@ggui-ai/ui-gen 0.26.0 → 0.27.0

package/dist/patch.d.ts

@@ -2,7 +2,7 @@ import { PatchFn } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
 import './axes-CKVCzR_x.js';
-import './types-public-B7wn4ce5.js';
+import './types-public-h8IMnYuh.js';
 import './llm.js';
 import '@ggui-ai/mcp-server-core';
 import './design-mode-DGWN_Gkm.js';

package/dist/{types-public-B7wn4ce5.d.ts → types-public-h8IMnYuh.d.ts}

@@ -599,6 +599,10 @@ interface CanvasJudgeRecord {
     /**
      * ggui#1687 — the model asked for, and every model the provider said answered this canvas's calls (scoring and
      * criteria), deduplicated. `served` is empty when no provider named one: unknown, never "the requested model".
+     * When the request names an alias and the provider echoes the alias (measured on a hosted route, 125 of 125
+     * canvases), `served` confirms the alias was honoured but cannot tell two snapshots behind it apart. A judge that
+     * must is pinned to a dated snapshot id instead. With the alias, a snapshot change shows only as a step on a date in
+     * the judge's pooled within-call spread, read by week. That is a read someone runs, not a monitor.
      */
     readonly models?: {
         readonly requested: string;

package/dist/{visual-evaluator-C9L-o6ap.d.ts → visual-evaluator-C2strxqD.d.ts}

@@ -1,4 +1,4 @@
-import { h as CriteriaContext, i as CriteriaChroma, j as CanvasJudgeRecord, k as CriteriaBlock, l as CanvasPresentationOutcome, n as CanvasHostPresentation, b as AgentConfig, L as LLMResponse, J as JudgeSalvageCounts, E as EvalIssue, o as VisualEvalSummary, p as VisualCoverage } from './types-public-B7wn4ce5.js';
+import { h as CriteriaContext, i as CriteriaChroma, j as CanvasJudgeRecord, k as CriteriaBlock, l as CanvasPresentationOutcome, n as CanvasHostPresentation, b as AgentConfig, L as LLMResponse, J as JudgeSalvageCounts, E as EvalIssue, o as VisualEvalSummary, p as VisualCoverage } from './types-public-h8IMnYuh.js';
 import { G as GenerationProfileInput } from './styling-profile-CxfvV48g.js';
 import { C as CriteriaBank } from './bank-Ctdp3FUA.js';
 import { DataContract, JsonObject } from '@ggui-ai/protocol';

package/dist/workflows.d.ts

@@ -2,7 +2,7 @@ import { C as Classification } from './axes-CKVCzR_x.js';
 import { Workflow } from './harness/types-public.js';
 import '@ggui-ai/protocol';
 import './styling-profile-CxfvV48g.js';
-import './types-public-B7wn4ce5.js';
+import './types-public-h8IMnYuh.js';
 import './llm.js';
 import '@ggui-ai/mcp-server-core';
 import './design-mode-DGWN_Gkm.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ggui-ai/ui-gen",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "UI generation harness for ggui — the LLM system prompt, multi-turn coding loop, and evaluation engine that turn a DataContract into a React component. Implements the UiGenerator contract from @ggui-ai/mcp-server-core; consumed by @ggui-ai/mcp-server.",
   "license": "Apache-2.0",
   "keywords": [
@@ -189,9 +189,9 @@
     "puppeteer-core": "^24.40.0 || ^25.0.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
-    "@ggui-ai/mcp-server-core": "0.26.0",
-    "@ggui-ai/protocol": "0.26.0",
-    "@ggui-ai/project-config": "0.26.0"
+    "@ggui-ai/mcp-server-core": "0.27.0",
+    "@ggui-ai/project-config": "0.27.0",
+    "@ggui-ai/protocol": "0.27.0"
   },
   "peerDependenciesMeta": {
     "@google/adk": {
@@ -233,11 +233,11 @@
     "openai": "^7.9.0",
     "typescript": "^5.0.0",
     "zod": "^4.3.6",
-    "@ggui-ai/design": "0.26.0",
-    "@ggui-ai/gadgets": "0.26.0",
-    "@ggui-ai/ui-visual-tester": "0.26.0",
-    "@ggui-ai/sandbox": "0.26.0",
-    "@ggui-ai/wire": "0.26.0"
+    "@ggui-ai/design": "0.27.0",
+    "@ggui-ai/sandbox": "0.27.0",
+    "@ggui-ai/gadgets": "0.27.0",
+    "@ggui-ai/ui-visual-tester": "0.27.0",
+    "@ggui-ai/wire": "0.27.0"
   },
   "devDependencies": {
     "@google/adk": "^2.0.0",
@@ -252,9 +252,9 @@
     "react-dom": "^19.0.0",
     "tsup": "^8.5.0",
     "vitest": "^3.2.6",
-    "@ggui-ai/project-config": "0.26.0",
-    "@ggui-ai/mcp-server-core": "0.26.0",
-    "@ggui-ai/protocol": "0.26.0"
+    "@ggui-ai/mcp-server-core": "0.27.0",
+    "@ggui-ai/project-config": "0.27.0",
+    "@ggui-ai/protocol": "0.27.0"
   },
   "engines": {
     "node": ">=22.0.0"

package/src/adapters/base.ts

@@ -45,8 +45,13 @@ export interface ClaudeSdkConfig extends AdapterConfig {
   env?: Record<string, string>;
   /** MCP server configs for Claude Agent SDK (keyed by name) */
   mcpServers?: Record<string, McpServerConfig>;
-  /** Allowed tool names for Claude Agent SDK */
+  /** Tool names to approve. Absent → every tool of every server in `mcpServers` (ggui#1714). */
   allowedTools?: string[];
+  /**
+   * CLI built-in tools to offer the model (e.g. `['Write']`). Default: none.
+   * An explicit opt-in: a built-in that writes or executes acts on the host (ggui#1714).
+   */
+  builtinTools?: readonly string[];
   /** Subagent definitions for Claude Agent SDK */
   agents?: Record<string, AgentDefinition>;
   /** Custom CLI path for Docker deployments */

package/src/adapters/claude/message-parser.ts

@@ -13,6 +13,7 @@ import type {
   SDKUserMessage,
 } from '@anthropic-ai/claude-agent-sdk';
 import type { JsonObject } from '@ggui-ai/protocol';
+import { sourceCodeFromToolUse } from './source-capture';
 
 /**
  * Mutable accumulator for artifacts extracted from the SDK message stream.
@@ -197,12 +198,10 @@ function extractSourceCode(message: SDKMessage, artifacts: MessageArtifacts): vo
   if (!Array.isArray(content)) return;
 
   for (const block of content) {
-    if (block.type === 'tool_use' && block.name === 'Write') {
-      const input = block.input as { content?: string } | undefined;
-      if (input?.content) {
-        artifacts.sourceCode = input.content;
-      }
-    }
+    if (block.type !== 'tool_use') continue;
+    // ggui#1714 — the rule lives in source-capture.ts, shared with the evaluation loop.
+    const value = sourceCodeFromToolUse(block.name, block.input);
+    if (value !== undefined) artifacts.sourceCode = value;
   }
 }
 

package/src/adapters/claude/sdk-tool-pins.ts

@@ -0,0 +1,44 @@
+// packages/ui-gen/src/adapters/claude/sdk-tool-pins.ts
+//
+// ggui#1714 — the tool surface of every Agent SDK `query()` this package runs.
+//
+// Left to its defaults, a `query()` session offers the model the CLI's whole
+// built-in set (Bash, Edit, Read, Write, WebFetch, Task, …) and loads the host
+// user's own Claude configuration (plugins, MCP servers from `~/.claude`).
+// `allowedTools` does not narrow that: it only approves the names it lists.
+// Measured on SDK 0.3.229 from the session's `system`/`init` message:
+//
+//   as before this file           → every built-in + the caller's tools
+//   `tools: []` alone             → the caller's tools + a user-level plugin server
+//   `tools: []` + `settingSources: []` → the caller's tools only
+//
+// So the pins are both, on every path. With them in place no permission
+// bypass is needed: a tool named in `allowedTools` runs, and a server-level
+// entry (`mcp__<server>`) approves every tool of that server (both measured
+// on a live turn; with no entry the call is denied and the run reports it).
+
+import type { McpServerConfig, Options } from '@anthropic-ai/claude-agent-sdk';
+
+export type SdkToolPins = Required<Pick<Options, 'tools' | 'settingSources' | 'allowedTools'>>;
+
+export interface SdkToolPinInput {
+  /** The MCP servers the session gets, keyed by name. */
+  readonly mcpServers?: Record<string, McpServerConfig>;
+  /** Tool names to approve. Absent → every tool of every server in `mcpServers`. */
+  readonly allowedTools?: readonly string[];
+  /**
+   * The CLI built-ins to offer (e.g. `['Write']`) — an explicit opt-in.
+   * Each one is also approved, so it runs without a prompt; a built-in that
+   * writes or executes acts on the host with the session's permissions.
+   */
+  readonly builtinTools?: readonly string[];
+}
+
+export function sdkToolPins(input: SdkToolPinInput): SdkToolPins {
+  const builtins = [...(input.builtinTools ?? [])];
+  const approved =
+    input.allowedTools !== undefined
+      ? [...input.allowedTools]
+      : Object.keys(input.mcpServers ?? {}).map((name) => `mcp__${name}`);
+  return { tools: builtins, settingSources: [], allowedTools: [...approved, ...builtins] };
+}

package/src/adapters/claude/sdk.ts

@@ -14,6 +14,7 @@ import type { AdapterResult, ProviderName, AdapterMode } from '../types';
 import { createArtifacts, processMessage } from './message-parser';
 import { createToolMcpServer } from './tool-bridge';
 import { claudeCodeLoginQueryOptions, loginChildEnv } from './claude-code-login';
+import { sdkToolPins } from './sdk-tool-pins';
 
 export class ClaudeSdkAdapter extends GeneratorAdapter {
   readonly provider: ProviderName = 'claude';
@@ -73,9 +74,8 @@ export class ClaudeSdkAdapter extends GeneratorAdapter {
         systemPrompt: params.systemPrompt,
         ...(mcpServers && { mcpServers }),
         ...(cfg.agents && { agents: cfg.agents }),
-        ...(allowedTools && { allowedTools }),
-        permissionMode: 'bypassPermissions',
-        allowDangerouslySkipPermissions: true,
+        // ggui#1714 — no CLI built-ins unless asked for, no host settings, no permission bypass.
+        ...sdkToolPins({ mcpServers, allowedTools, builtinTools: cfg.builtinTools }),
         ...(cfg.cliPath && { pathToClaudeCodeExecutable: cfg.cliPath }),
         ...(cfg.stderr && { stderr: cfg.stderr }),
         // ggui#1185 — tool-less, config-less, non-bare; the model is pinned above.

package/src/adapters/claude/source-capture.ts

@@ -0,0 +1,20 @@
+// packages/ui-gen/src/adapters/claude/source-capture.ts
+//
+// ggui#1714 — which tool call carries a component's source, decided once.
+// Both Agent SDK paths (ClaudeSdkAdapter's message parser and the evaluation
+// loop's extractor) read source through this function, so the rule cannot be
+// fixed on one path and left stale on the other.
+//
+//   `*__compile_component` → `input.code`    (the bridged compile tool)
+//   `Write`                → `input.content` (a CLI built-in, offered only by opt-in)
+
+const COMPILE_TOOL_SUFFIX = '__compile_component';
+
+/** The source a tool_use block carries, or undefined when it carries none. */
+export function sourceCodeFromToolUse(name: unknown, input: unknown): string | undefined {
+  if (typeof name !== 'string') return undefined;
+  const field = name === 'Write' ? 'content' : name.endsWith(COMPILE_TOOL_SUFFIX) ? 'code' : undefined;
+  if (field === undefined || typeof input !== 'object' || input === null) return undefined;
+  const value: unknown = Reflect.get(input, field);
+  return typeof value === 'string' && value.length > 0 ? value : undefined;
+}

package/src/boilerplate/system-prompt.ts

@@ -481,13 +481,14 @@ MANDATORY:
 2. NEVER use CSS gradients with custom colors. If you need a gradient: \`linear-gradient(to bottom, var(--ggui-color-primary-500), var(--ggui-color-primary-700))\`.
 3. NEVER invent your own palette. The system provides primary, neutral, success, warning, error, and info — use ONLY these.
 4. NEVER include literal fallback values in ANY token reference — colors, spacing, typography, radius, shadows alike. Write \`var(--ggui-spacing-4)\` bare, never \`var(--ggui-spacing-4, 16px)\`; \`var(--ggui-color-primary-600)\` bare, never \`var(--ggui-color-primary-600, #0284c7)\`. The runtime injects every token; a literal fallback paints the wrong value exactly when the operator's theme matters most.
+5. NEVER set an inline \`border\`, \`borderColor\`, \`borderWidth\` or \`borderStyle\` on a kit control — \`Button\`, \`Input\`, \`Select\`, \`TextArea\`, \`Checkbox\`, \`RadioGroup\`, \`Toggle\`, \`SearchField\`. The control draws its own boundary, and it clears 3:1 on its surface in every theme: an outline chip is \`<Button variant="outline">\` exactly as it comes (its edge is \`controlAccentOutline\`). Where you draw a control-like edge on your own element, use \`var(--ggui-color-controlOutline)\`. A ramp step such as \`primary-200\` as a control's border is nearly invisible (about 1.1:1).
 
 Token categories:
 - Brand fills: \`var(--ggui-color-primary-600)\`, \`var(--ggui-color-primary-50)\`
 - Accent text: \`var(--ggui-color-link)\` — eyebrows, taglines, links, labels; readable per mode (never a bare \`primary-<stop>\` as a text color)
 - Text: \`var(--ggui-color-onContainer)\`, \`var(--ggui-color-onSunken)\`
 - Backgrounds: \`var(--ggui-color-container)\`, \`var(--ggui-color-sunken)\`
-- Borders: \`var(--ggui-color-outline)\`
+- Borders: \`var(--ggui-color-outline)\` — dividers and the edges of non-interactive boxes; a control's edge is the kit's (rule 5)
 - Spacing: \`var(--ggui-spacing-4)\`, \`var(--ggui-spacing-6)\`
 - Typography: \`var(--ggui-font-size-sm)\`, \`var(--ggui-font-weight-semibold)\`
 - Shadows: \`var(--ggui-shape-shadow-sm)\`, \`var(--ggui-shape-shadow-md)\`, \`var(--ggui-shape-shadow-lg)\`
@@ -502,7 +503,7 @@ Use the FULL primary palette throughout the component — NOT only on submit but
 | Element | Token | Purpose |
 |---------|-------|---------|
 | Section headers, hero areas, highlight strips | \`primary-50\` / \`primary-100\` | Subtle branded backgrounds |
-| Borders, dividers, focus rings, input focus | \`primary-200\` / \`primary-300\` | Branded structure |
+| Dividers, section rules, edges of non-interactive boxes | \`primary-200\` / \`primary-300\` | Branded structure — never a control's border (rule 5) |
 | Accent TEXT — eyebrows, taglines, links, labels, inline arrows | \`link\` (\`var(--ggui-color-link)\`) or \`<Text tone="emphasized">\` | The brand's READABLE ink, derived per mode to clear 4.5:1 — a bare \`primary-300…600\` as a text color fails tier-0 |
 | Icon fills, badges, active indicators | \`primary-500\` / \`primary-600\` | Core accent fill |
 | Buttons, CTAs, filled interactive elements | \`primary-600\` / \`primary-700\` | Primary actions |

package/src/check/run-tier0.ts

@@ -571,6 +571,50 @@ function detectComponentNeverReturns(
  * Wraps the same logic as runSelfChecks (adapters/tools.ts) but emits EvalIssue[].
  * Also runs contract validation when contract are provided.
  */
+/** The kit controls whose boundary the design system draws (ggui#1697). */
+const KIT_CONTROLS = ['Button', 'Input', 'Select', 'TextArea', 'Checkbox', 'RadioGroup', 'Toggle', 'SearchField'] as const;
+
+/**
+ * Opening tags of kit controls, read brace- and quote-aware: an attribute like `onClick={() => x}` holds a `>` that a
+ * plain `[^>]*` pattern stops at, which would hide every attribute after it.
+ */
+function kitControlTags(source: string): { name: string; attrs: string; line: number }[] {
+  const out: { name: string; attrs: string; line: number }[] = [];
+  const open = new RegExp(`<(${KIT_CONTROLS.join('|')})\\b`, 'g');
+  for (const m of source.matchAll(open)) {
+    const start = (m.index ?? 0) + m[0].length;
+    let depth = 0;
+    let quote: string | null = null;
+    let i = start;
+    for (; i < source.length; i += 1) {
+      const c = source[i];
+      if (quote !== null) {
+        if (c === quote && source[i - 1] !== '\\') quote = null;
+      } else if (c === '"' || c === "'" || c === '`') quote = c;
+      else if (c === '{') depth += 1;
+      else if (c === '}') depth -= 1;
+      else if (c === '>' && depth === 0) break;
+    }
+    out.push({ name: m[1] ?? '', attrs: source.slice(start, i), line: source.slice(0, m.index ?? 0).split('\n').length });
+  }
+  return out;
+}
+
+/** A border key (not a radius) in the tag's inline style, or in a same-file object its `style={name}` points at. */
+function inlineBorderKey(attrs: string, source: string): string | null {
+  const BORDER = /\b(border(?:Top|Right|Bottom|Left)?(?:Color|Width|Style)?)\s*:/;
+  const style = attrs.match(/\bstyle=\{\{([\s\S]*)\}\}/);
+  if (style !== null) {
+    const hit = (style[1] ?? '').match(BORDER);
+    if (hit !== null) return hit[1] ?? null;
+  }
+  const named = attrs.match(/\bstyle=\{\s*([A-Za-z_$][\w$]*)\s*\}/);
+  if (named === null) return null;
+  const decl = source.match(new RegExp(`\\b(?:const|let)\\s+${named[1]}\\b[^=]*=\\s*\\{([^{}]*)\\}`));
+  const hit = decl !== null ? (decl[1] ?? '').match(BORDER) : null;
+  return hit !== null ? hit[1] ?? null : null;
+}
+
 export async function runTier0Checks(
   sourceCode: string,
   contract?: DataContract,
@@ -1169,6 +1213,23 @@ export async function runTier0Checks(
     }
   }
 
+  // ── A kit control's boundary is the kit's (ggui#1697) ──────
+  // A control draws its own edge, derived to clear 3:1 on its surface (`controlOutline`, or
+  // `controlAccentOutline` on an outline Button); an inline border paints over it, and the ramp step
+  // the model reached for (`primary-200`) measured about 1.1:1. The prompt's rule 5 says the same, so
+  // this check enforces what the model was told. The description starts with the check's id so the
+  // generator's logged violation lines (`✗ …`) count its fires per generation, in-turn repairs included.
+  for (const tag of enforceDesignVocabulary ? kitControlTags(sourceCode) : []) {
+    const key = inlineBorderKey(tag.attrs, sourceCode);
+    if (key === null) continue;
+    issues.push({
+      tier: 0, result: 'fail', category: 'tokens', subcategory: 'control-inline-border', severity: 'critical',
+      description: `control-inline-border: <${tag.name}> sets an inline \`${key}\` — a kit control draws its own boundary, and an inline border paints over it`,
+      fix: `Remove the border from <${tag.name}>'s style (keep borderRadius if you need it). An outline chip is <Button variant="outline"> exactly as it comes; a control-like edge on your own element uses var(--ggui-color-controlOutline).`,
+      line: tag.line,
+    });
+  }
+
   // ── Missing Props interface ───────────────────────────────
   if (!sourceCode.includes('interface Props') && !sourceCode.includes('type Props')) {
     issues.push({

package/src/design-system-docs.ts

@@ -49,6 +49,7 @@ These tokens adapt automatically to any theme (light, dark, branded). **ALWAYS u
 | link | var(--ggui-color-link) | Accent TEXT — eyebrows, taglines, links, labels, inline arrows: the brand's readable ink, derived per mode to clear 4.5:1 on the container and the ground |
 | outline | var(--ggui-color-outline) | Borders, dividers |
 | outlineVariant | var(--ggui-color-outlineVariant) | Subtle borders |
+| controlOutline | var(--ggui-color-controlOutline) | A control's edge — clears 3:1 on its surface; kit controls draw it themselves |
 
 **Usage pattern:**
 - Page/section background → \`var(--ggui-color-ground)\`
@@ -173,7 +174,7 @@ Use \`var(--ggui-spacing-N)\` for all padding, gap, and margin values. **Never u
 ### Color usage guide
 - **Layering roles** (ground, container, elevated, sunken + their on* inks; outline): one kind of AREA each — use them for every background/text/border decision; they adapt to any theme
 - **primary-50/100**: Section backgrounds, highlight strips, card headers
-- **primary-200/300**: Borders, dividers, focus rings, input outlines
+- **primary-200/300**: Dividers and section rules — never a control's border: kit controls draw their own edge (\`controlOutline\` / \`controlAccentOutline\`), so set no inline border on them
 - **primary-500/600**: Filled buttons, CTAs, badges, icon fills, active indicators — fills and borders, NOT a text color
 - **link**: Accent TEXT — eyebrows, taglines, links, labels, inline arrows; the brand's readable ink per mode (a bare \`primary-300…600\` as a text color fails tier-0: \`universal.accent_text_ink\`)
 - **primary-700/800/900**: Headings and text on light primary backgrounds

package/src/evaluation/criteria/resolve.ts

@@ -30,6 +30,16 @@ export const INSTRUMENT_BESIDE_JUDGE: Readonly<Record<string, 'edge'>> = {
   'space.edge': 'edge',
 };
 
+/**
+ * ggui#1711 — judge rows a single pre-action frame cannot answer. Their own text makes them not-evaluated "when the
+ * capture has no post-action state", and every judged frame today is one capture taken before any action. Asked
+ * anyway, the judge answered `n/a` 94 of 94 times and left the row out 15 more times (a dropped row reads like a
+ * skip). So the absence is decided here, from the capture: such a row is never asked without a post-action capture,
+ * and it reads `n/a` with its reason, still in the tally. With one, the judge is asked as for any row.
+ */
+export const REQUIRES_POST_ACTION_CAPTURE: ReadonlySet<string> = new Set(['state.feedback']);
+const NO_POST_ACTION = 'not evaluated: no post-action capture';
+
 export interface CriteriaMeasurements {
   readonly overflow: boolean;
   readonly contentHeight: number | null;
@@ -40,6 +50,8 @@ export interface CriteriaMeasurements {
    * `null` when the probe ran and failed.
    */
   readonly edge?: EdgeVerdict | null;
+  /** ggui#1711 — the capture includes a state after an action ran. Absent = no (every capture today). */
+  readonly postActionCapture?: boolean;
 }
 
 function besideRead(kind: 'edge', m: CriteriaMeasurements): Read {
@@ -73,6 +85,7 @@ function instrumentRead(kind: 'fit' | 'fill', m: CriteriaMeasurements): Read {
 }
 
 function readRow(row: BankRow, answers: readonly CriteriaAnswer[][], m: CriteriaMeasurements, unansweredReason: string | undefined): Read {
+  if (row.evaluation === 'judge' && REQUIRES_POST_ACTION_CAPTURE.has(row.id) && m.postActionCapture !== true) return { verdict: 'n/a', evidence: NO_POST_ACTION };
   if (row.evaluation === 'judge') return majority(row.id, answers, unansweredReason);
   if (row.evaluation === 'human') return { verdict: 'n/a', evidence: `reader's column (status ${row.status})` };
   if (row.status !== 'live') return { verdict: 'n/a', evidence: `not implemented (status ${row.status})` };
@@ -147,6 +160,8 @@ export interface CriteriaJudgeInputs {
   readonly frame?: CriteriaJudgeFrame;
   /** JSON text of the props the card was rendered with; bounded by {@link CRITERIA_PROPS_MAX_CHARS}. */
   readonly propsJson?: string;
+  /** ggui#1711 — the capture includes a post-action state; absent = no, and rows needing one are not asked. */
+  readonly postActionCapture?: boolean;
 }
 
 /** Bound on the props text handed to the judge beside the frame, in characters. */
@@ -190,7 +205,10 @@ function criteriaPropsSection(propsJson: string): string {
 /** The judge's prompt block for the selected `judge` rows; empty when none is selected. */
 export function buildCriteriaJudgeBlock(bank: CriteriaBank, selected: CriteriaSelectionResult, inputs: CriteriaJudgeInputs = {}): string {
   const byId = new Map<string, BankRow>(bankRows(bank).map((r) => [r.id, r]));
-  const asked = selected.selection.map((s) => byId.get(s.id)).filter((r): r is BankRow => r !== undefined && r.evaluation === 'judge');
+  const asked = selected.selection
+    .map((s) => byId.get(s.id))
+    .filter((r): r is BankRow => r !== undefined && r.evaluation === 'judge')
+    .filter((r) => inputs.postActionCapture === true || !REQUIRES_POST_ACTION_CAPTURE.has(r.id));
   if (asked.length === 0) return '';
   const lines = asked.map((r) => `- ${r.id} (${r.severity}): ${r.text} Evidence must name: ${r.evidence}`);
   return (

package/src/evaluation/loop.ts

@@ -1,6 +1,7 @@
 // packages/ui-gen/src/evaluation/loop.ts
 
 import { query, type McpServerConfig } from '@anthropic-ai/claude-agent-sdk';
+import { sdkToolPins } from '../adapters/claude/sdk-tool-pins';
 import { runEvaluation } from './evaluator';
 import {
   extractCompiledCodeFromMessage,
@@ -39,8 +40,13 @@ export interface EvaluationLoopOptions {
     cwd?: string;
     /** MCP servers available to the fix agent */
     mcpServers?: Record<string, McpServerConfig>;
-    /** Tools the fix agent is allowed to call */
+    /** Tool names to approve. Absent → every tool of every server in `mcpServers` (ggui#1714). */
     allowedTools?: string[];
+    /**
+     * CLI built-in tools to offer the fix agent (e.g. `['Write']`). Default: none.
+     * An explicit opt-in: a built-in that writes or executes acts on the host (ggui#1714).
+     */
+    builtinTools?: readonly string[];
     /** LLM model for fix rounds */
     model?: string;
     /** Environment variables (includes BYOK credentials) */
@@ -90,6 +96,18 @@ export async function runEvaluationLoop(
   let round = 0;
   const maxRounds = Math.min(config.maxRounds ?? 3, MAX_EVAL_ROUNDS_HARD_LIMIT);
 
+  // ggui#1714 — a fix round runs with no CLI built-ins unless asked for. With no
+  // MCP server and no built-in either, the fix agent has nothing that can return
+  // code, and every fix round would silently hand back the original: refuse.
+  const offersATool =
+    Object.keys(generatorOptions?.mcpServers ?? {}).length > 0 || (generatorOptions?.builtinTools?.length ?? 0) > 0;
+  if (maxRounds > 1 && !offersATool) {
+    throw new Error(
+      'runEvaluationLoop: a fix round needs a tool that can return code — pass generatorOptions.mcpServers ' +
+        "(e.g. a server with compile_component) or opt into a built-in with generatorOptions.builtinTools (e.g. ['Write']).",
+    );
+  }
+
   while (round < maxRounds) {
     round++;
 
@@ -145,12 +163,15 @@ export async function runEvaluationLoop(
         maxTurns: 15,
         maxBudgetUsd: config.maxBudgetPerFix,
         env,
-        permissionMode: 'bypassPermissions',
-        allowDangerouslySkipPermissions: true,
         ...(cliPath && { pathToClaudeCodeExecutable: cliPath }),
         ...(generatorOptions?.cwd && { cwd: generatorOptions.cwd }),
         ...(generatorOptions?.mcpServers && { mcpServers: generatorOptions.mcpServers }),
-        ...(generatorOptions?.allowedTools && { allowedTools: generatorOptions.allowedTools }),
+        // ggui#1714 — no CLI built-ins unless asked for, no host settings, no permission bypass.
+        ...sdkToolPins({
+          mcpServers: generatorOptions?.mcpServers,
+          allowedTools: generatorOptions?.allowedTools,
+          builtinTools: generatorOptions?.builtinTools,
+        }),
         ...(generatorOptions?.model && { model: generatorOptions.model }),
         ...(generatorOptions?.stderr && { stderr: generatorOptions.stderr }),
       },

package/src/evaluation/message-parsing.ts

@@ -10,6 +10,7 @@
  */
 
 import type { EvaluationResult } from './types';
+import { sourceCodeFromToolUse } from '../adapters/claude/source-capture';
 
 // ── SDK message type aliases ────────────────────────────────────────
 
@@ -137,13 +138,14 @@ export function extractCompiledCodeFromMessage(message: SdkMessage): string | un
 // ── sourceCode extraction ───────────────────────────────────────────
 
 /**
- * Extract source code from an assistant's Write tool_use message.
+ * Extract source code from an assistant message's tool_use blocks.
  *
- * Looks for `tool_use` blocks with `name === 'Write'` and returns
- * the `input.content` string. If multiple Write calls exist, returns
- * the last one (the final version).
+ * Reads the bridged compile tool (`*__compile_component`, `input.code`)
+ * and the CLI's `Write` (`input.content`, offered only by opt-in), by the
+ * one rule in `adapters/claude/source-capture.ts` (ggui#1714). If several
+ * calls carry source, returns the last one (the final version).
  *
- * Used by: loop.ts, generator.ts
+ * Used by: loop.ts
  */
 export function extractSourceCodeFromMessage(message: SdkMessage): string | undefined {
   if ((message.type as string) !== 'assistant') return undefined;
@@ -155,12 +157,9 @@ export function extractSourceCodeFromMessage(message: SdkMessage): string | unde
   if (!Array.isArray(content)) return undefined;
 
   for (const block of content) {
-    if (block.type === 'tool_use' && block.name === 'Write') {
-      const input = block.input as { content?: string } | undefined;
-      if (input?.content) {
-        sourceCode = input.content;
-      }
-    }
+    if (block.type !== 'tool_use') continue;
+    const value = sourceCodeFromToolUse(block.name, block.input);
+    if (value !== undefined) sourceCode = value;
   }
 
   return sourceCode;
@@ -183,7 +182,7 @@ export function extractCompiledCode(messages: SdkMessage[]): string | undefined
 }
 
 /**
- * Scan all messages for the last sourceCode from Write tool_use.
+ * Scan all messages for the last sourceCode a tool_use carried.
  *
  * Convenience wrapper for tests and one-shot extraction.
  */

package/src/evaluation/types-public.ts

@@ -376,6 +376,10 @@ export interface CanvasJudgeRecord {
   /**
    * ggui#1687 — the model asked for, and every model the provider said answered this canvas's calls (scoring and
    * criteria), deduplicated. `served` is empty when no provider named one: unknown, never "the requested model".
+   * When the request names an alias and the provider echoes the alias (measured on a hosted route, 125 of 125
+   * canvases), `served` confirms the alias was honoured but cannot tell two snapshots behind it apart. A judge that
+   * must is pinned to a dated snapshot id instead. With the alias, a snapshot change shows only as a step on a date in
+   * the judge's pooled within-call spread, read by week. That is a read someone runs, not a monitor.
    */
   readonly models?: { readonly requested: string; readonly served: readonly string[] };
 }

package/src/taught-tokens.ts

@@ -18,13 +18,12 @@ import { consumedTokenManifest } from "@ggui-ai/design/themes";
  * closed-set check still admits them: a card that references one is valid wherever this release
  * renders it.
  *
- * - ggui#1494 — the control edges (`controlOutline`, `controlAccentOutline`): derived and completed
- *   from this release; taught from the next.
+ * Empty today. The control edges (`controlOutline`, `controlAccentOutline`, ggui#1494) were held here
+ * until every serving and rollback runtime declared them; the derivation (`10a0c00f2`) is in every
+ * release from tag 17 on, so they are taught from ggui#1697, in the same change as the prompt rule that
+ * teaches a control's edge.
  */
-export const NOT_YET_TAUGHT_TOKENS: ReadonlySet<string> = new Set([
-  "--ggui-color-controlAccentOutline",
-  "--ggui-color-controlOutline",
-]);
+export const NOT_YET_TAUGHT_TOKENS: ReadonlySet<string> = new Set<string>([]);
 
 /** The manifest as the model is taught it. */
 export const taughtTokenManifest: readonly string[] = consumedTokenManifest.filter(