@guuey/chat 0.16.7 → 0.16.9

package/dist/strings.js

@@ -77,6 +77,9 @@ export const defaultChatStrings = {
     oauthConnected: (serverName) => `Connected ${serverName}. The agent can use it from your next message.`,
     oauthFailed: (reason) => `Couldn't connect: ${reason}`,
     noticeLabel: "Note",
+    linkAskLabel: (host) => `This card wants to open ${host}`,
+    linkOpen: "Open",
+    linkDismiss: "Dismiss",
     composerPlaceholder: "Message the agent…",
     composerUnavailable: "Chat is unavailable.",
     composerLabel: "Message",

package/dist/theme.d.ts

@@ -246,6 +246,14 @@ export type GuueyChatTheme = z.infer<typeof GuueyChatTheme>;
  * The brand-neutral-but-polished package default — the theme a builder gets
  * before configuring anything, and the per-token fallback floor every other
  * theme resolves against.
+ *
+ * The accent is MONOCHROME (= ink) by founder ruling (guuey#521): an
+ * unthemed embed must never carry a foreign accent into a host's product —
+ * the old `#2f6bff` blue made every zero-config embed read "off-the-shelf
+ * chat vendor" inside someone else's brand (#414's lesson, mirrored). Ink
+ * as accent means the send button and user pill render as neutral
+ * ink-on-canvas and disappear into any host; a brand accent is a CHOICE
+ * (theme prop or one `--guuey-chat-accent` CSS variable), never a default.
  */
 export declare const DEFAULT_CHAT_THEME: GuueyChatTheme;
 /**
@@ -262,4 +270,20 @@ export declare const GUUEY_CHAT_THEME: GuueyChatTheme;
  * NEVER throws: unparseable input resolves to the base theme untouched.
  */
 export declare function resolveTheme(candidate: unknown, base?: GuueyChatTheme): GuueyChatTheme;
+/**
+ * Per-court theme resolution (guuey#519 — the #414 rule generalized).
+ *
+ * A theme document may carry `courts`: explicit per-court override
+ * documents keyed by serving court (`"guuey"`, `"ggui"`, …). A surface
+ * resolves ITS court: the court's override resolved per-token OVER the
+ * resolved base document when declared, else the base alone. **Brand is
+ * never a default** — an undeclared or unknown court gets the neutral
+ * base by construction, and readers that never heard of `courts`
+ * (lenient parsers projecting only known tokens) keep reading the base
+ * untouched, so no court can inherit another court's brand.
+ *
+ * Resolved themes are court-free: `courts` never survives resolution.
+ * NEVER throws; unparseable input degrades exactly as `resolveTheme`.
+ */
+export declare function resolveCourtTheme(candidate: unknown, court: string, base?: GuueyChatTheme): GuueyChatTheme;
 //# sourceMappingURL=theme.d.ts.map

package/dist/theme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;iBAWnB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAUtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;iBAMrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;iBAAqD,CAAC;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAQnB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKjB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BjB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,EAAE,cA0BhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA0B9B,CAAC;AA4CF;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,cAAmC,GACxC,cAAc,CAuBhB"}
+{"version":3,"file":"theme.d.ts","sourceRoot":"","sources":["../src/theme.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;iBAWnB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;iBAUtB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;iBAMrB,CAAC;AACX,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;iBAAqD,CAAC;AACpF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,+DAA+D;AAC/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;iBAQnB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKjB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8BjB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,EAAE,cA0BhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA0B9B,CAAC;AA4CF;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,OAAO,EAClB,IAAI,GAAE,cAAmC,GACxC,cAAc,CAuBhB;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,OAAO,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,GAAE,cAAmC,GACxC,cAAc,CAOhB"}

package/dist/theme.js

@@ -115,12 +115,20 @@ export const GuueyChatTheme = z
  * The brand-neutral-but-polished package default — the theme a builder gets
  * before configuring anything, and the per-token fallback floor every other
  * theme resolves against.
+ *
+ * The accent is MONOCHROME (= ink) by founder ruling (guuey#521): an
+ * unthemed embed must never carry a foreign accent into a host's product —
+ * the old `#2f6bff` blue made every zero-config embed read "off-the-shelf
+ * chat vendor" inside someone else's brand (#414's lesson, mirrored). Ink
+ * as accent means the send button and user pill render as neutral
+ * ink-on-canvas and disappear into any host; a brand accent is a CHOICE
+ * (theme prop or one `--guuey-chat-accent` CSS variable), never a default.
  */
 export const DEFAULT_CHAT_THEME = {
     name: "default",
     colors: {
         light: {
-            accent: "#2f6bff",
+            accent: "#111318",
             onAccent: "#ffffff",
             ink: "#111318",
             inkMuted: "#5b6270",
@@ -130,7 +138,7 @@ export const DEFAULT_CHAT_THEME = {
             error: "#d64545",
         },
         dark: {
-            accent: "#5c8dff",
+            accent: "#e8e9ee",
             onAccent: "#0b0d12",
             ink: "#e8e9ee",
             inkMuted: "#9aa0ac",
@@ -245,6 +253,40 @@ export function resolveTheme(candidate, base = DEFAULT_CHAT_THEME) {
         },
     };
 }
+/**
+ * The court-override member a theme DOCUMENT may carry (guuey#519).
+ * Values are theme documents themselves (validated by `resolveTheme`'s own
+ * lenient parse at resolution time, so a partial or future-schema court
+ * entry degrades per-token like any stored theme).
+ */
+const CourtOverrides = z
+    .object({ courts: z.record(z.string(), z.unknown()).optional() })
+    .loose();
+/**
+ * Per-court theme resolution (guuey#519 — the #414 rule generalized).
+ *
+ * A theme document may carry `courts`: explicit per-court override
+ * documents keyed by serving court (`"guuey"`, `"ggui"`, …). A surface
+ * resolves ITS court: the court's override resolved per-token OVER the
+ * resolved base document when declared, else the base alone. **Brand is
+ * never a default** — an undeclared or unknown court gets the neutral
+ * base by construction, and readers that never heard of `courts`
+ * (lenient parsers projecting only known tokens) keep reading the base
+ * untouched, so no court can inherit another court's brand.
+ *
+ * Resolved themes are court-free: `courts` never survives resolution.
+ * NEVER throws; unparseable input degrades exactly as `resolveTheme`.
+ */
+export function resolveCourtTheme(candidate, court, base = DEFAULT_CHAT_THEME) {
+    const resolvedBase = resolveTheme(candidate, base);
+    const parsed = CourtOverrides.safeParse(candidate);
+    if (!parsed.success)
+        return resolvedBase;
+    const override = parsed.data.courts?.[court];
+    if (override === undefined)
+        return resolvedBase;
+    return resolveTheme(override, resolvedBase);
+}
 /** Slot-level merge of two ramp statements (candidate slots win per slot). */
 function mergeRampSet(base, over) {
     if (base === undefined)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/chat",
-  "version": "0.16.7",
+  "version": "0.16.9",
   "description": "The default end-user transcript UI for guuey agents — the headless view-model (planTranscript), calm/debug presets, the GuueyChatTheme token schema, the ChatStrings i18n seam, and (at ./react) the component kit that renders it: per-category components, <Transcript>, the live + history input assemblers, and stick-to-bottom/windowed/accessible transcript behavior; at ./native, the React Native renderer over the same view-model.",
   "license": "MIT",
   "type": "module",
@@ -36,11 +36,11 @@
     "./styles.css": "./styles.css"
   },
   "dependencies": {
-    "@silverprotocol/core": "0.5.2",
-    "@silverprotocol/richtext": "0.5.2",
+    "@silverprotocol/core": "0.5.3",
+    "@silverprotocol/richtext": "0.5.3",
     "zod": "^4.3.6",
-    "@guuey/agent-client": "0.16.7",
-    "@guuey/mcp-apps-host": "0.16.7"
+    "@guuey/agent-client": "0.16.9",
+    "@guuey/mcp-apps-host": "0.16.9"
   },
   "peerDependencies": {
     "react": ">=18",

package/src/index.ts

@@ -55,6 +55,7 @@ export {
   GuueyChatTheme,
   GuueyChatToneRamp,
   resolveTheme,
+  resolveCourtTheme,
 } from "./theme.js";
 export type {
   ChatDebugEvent,

package/src/native/markdown.tsx

@@ -26,6 +26,7 @@ import {
   type RichTextInline,
 } from "@silverprotocol/richtext";
 import type { NativeChatTokens } from "./theme-native.js";
+import { normalizeTableRow, type RichTextTableBlock } from "../richtext-table.js";
 
 function InlineRuns({
   nodes,
@@ -120,6 +121,8 @@ function BlockView({
   trailing?: ReactNode;
 }): ReactNode {
   switch (block.type) {
+    case "table":
+      return <NativeTableBlock block={block} color={color} tokens={tokens} trailing={trailing} />;
     case "paragraph":
       return (
         <Text style={{ fontSize: tokens.fontSize, lineHeight: Math.round(tokens.fontSize * 1.45) }}>
@@ -175,6 +178,60 @@ function BlockView({
   }
 }
 
+/**
+ * The native table projection (guuey#370): header row bold with a
+ * separator, body rows as flex rows, per-column alignment mapped to RN
+ * textAlign. Exported for tests; not part of the package surface.
+ */
+export function NativeTableBlock({
+  block,
+  color,
+  tokens,
+  trailing,
+}: {
+  block: RichTextTableBlock;
+  color: string;
+  tokens: NativeChatTokens;
+  trailing?: ReactNode;
+}): ReactNode {
+  const columnCount = block.header.cells.length;
+  const cellStyle = (i: number) => ({
+    flex: 1,
+    ...(block.align[i] !== undefined ? { textAlign: block.align[i] } : {}),
+  });
+  return (
+    <View style={{ gap: 2 }}>
+      <View
+        style={{
+          flexDirection: "row",
+          borderBottomWidth: 1,
+          borderBottomColor: tokens.palette.canvasMuted,
+          paddingBottom: 2,
+        }}
+      >
+        {normalizeTableRow(block.header, columnCount).map((cell, i) => (
+          <Text
+            key={i}
+            style={{ ...cellStyle(i), color, fontSize: tokens.fontSize, fontWeight: "700" }}
+          >
+            <InlineRuns nodes={cell.children} color={color} tokens={tokens} bold />
+          </Text>
+        ))}
+      </View>
+      {block.rows.map((row, r) => (
+        <View key={r} style={{ flexDirection: "row" }}>
+          {normalizeTableRow(row, columnCount).map((cell, i) => (
+            <Text key={i} style={{ ...cellStyle(i), fontSize: tokens.fontSize }}>
+              <InlineRuns nodes={cell.children} color={color} tokens={tokens} />
+            </Text>
+          ))}
+        </View>
+      ))}
+      {trailing}
+    </View>
+  );
+}
+
 /** Sanitized markdown → themed RN elements (see the module docblock). */
 export function NativeMarkdown({
   text,

package/src/react/components.tsx

@@ -108,6 +108,7 @@ export type ViewSlotProps = Pick<
   | "onCallTool"
   | "onUpdateModelContext"
   | "onUserMessage"
+  | "onOpenLink"
   | "onReadResource"
   | "onSizeChanged"
   | "negotiationTimeoutMs"

package/src/react/guuey-chat.tsx

@@ -93,7 +93,10 @@ import { oauthPromptAction, useOAuthReturn } from "./oauth-return.js";
 export function viewPropsWithThemeAnnounce(
   viewProps: TranscriptItemContext["viewProps"],
   mode: ThemeMode,
-  defaults: Pick<ViewSlotProps, "onCallTool" | "onUpdateModelContext" | "onUserMessage"> = {},
+  defaults: Pick<
+    ViewSlotProps,
+    "onCallTool" | "onUpdateModelContext" | "onUserMessage" | "onOpenLink"
+  > = {},
 ): TranscriptItemContext["viewProps"] {
   const themed = (base: ViewSlotProps | undefined): ViewSlotProps => ({
     // Kit-default host wires (guuey#335): the ACTION RELAY (Confirm inside
@@ -214,6 +217,19 @@ export interface GuueyChatProps {
   strings?: Partial<ChatStrings>;
   theme?: GuueyChatTheme;
   mode?: ThemeMode;
+  /**
+   * Message-surface presentation (guuey#521). `"card"` (default) keeps
+   * assistant text on its own card; `"bare"` sits the transcript directly
+   * on the host's background so the embed reads native to the page.
+   */
+  surface?: "card" | "bare";
+  /**
+   * Render the built-in composer (default `true`). `false` hides it for
+   * hosts that drive the conversation through the imperative handle
+   * (guuey#210 `ask`/`compose`) or their own input — pairs with the
+   * handle instead of forcing a CSS hide (guuey#521).
+   */
+  composer?: boolean;
   /** DOM windowing (§3.2). `false` renders everything. */
   window?: TranscriptWindowing | false;
   /**
@@ -323,6 +339,8 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
     strings: stringOverrides,
     theme = DEFAULT_CHAT_THEME,
     mode = "light",
+    surface = "card",
+    composer = true,
     window: windowing,
     reader,
     onDebugEvent,
@@ -546,8 +564,9 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
   // REAL result envelope and its #440 classifier grades honestly; the
   // post-turn agent turn then starts through the ui/message doorbell
   // (the sink below). The #356 staging seam remains a PUBLIC export
-  // (withActionStaging) for hosts that choose the composer-staging UX —
-  // the widget's own mountCallTool still applies it by its own choice.
+  // (withActionStaging) for hosts that choose the composer-staging UX;
+  // no first-party surface applies it any more (the widget converged on
+  // this relay+doorbell path in guuey#404).
   const stagedDefaultOnCallTool = defaultOnCallTool;
 
   // The ui/message sink (guuey#422): the view hands the host role-user
@@ -620,14 +639,33 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
     void live.invoke.send(next).catch(() => {});
   }, [busy]);
 
+  // guuey#522: the kit default for `ui/open-link` NEVER navigates
+  // sight-unseen — the ask surfaces as a disclosure affordance (host +
+  // full URL + Open/Dismiss) and the OPEN is the human's own anchor
+  // click, so the browser's activation gate and the review posture agree
+  // by construction. ONE pending ask at a time, newest replaces (a
+  // card spamming asks can never grow an unbounded stack).
+  const [pendingLink, setPendingLink] = useState<string | null>(null);
+  const defaultOnOpenLink = useCallback((url: string) => {
+    setPendingLink(url);
+  }, []);
+
   const effectiveViewProps = useMemo<TranscriptItemContext["viewProps"]>(
     () =>
       viewPropsWithThemeAnnounce(viewProps, mode, {
         ...(stagedDefaultOnCallTool !== undefined ? { onCallTool: stagedDefaultOnCallTool } : {}),
         onUpdateModelContext: defaultOnUpdateModelContext,
         onUserMessage: defaultOnUserMessage,
+        onOpenLink: defaultOnOpenLink,
       }),
-    [viewProps, mode, stagedDefaultOnCallTool, defaultOnUpdateModelContext, defaultOnUserMessage],
+    [
+      viewProps,
+      mode,
+      stagedDefaultOnCallTool,
+      defaultOnUpdateModelContext,
+      defaultOnUserMessage,
+      defaultOnOpenLink,
+    ],
   );
 
   // The canvas-host door (guuey#335): a host mounting views DIRECTLY from
@@ -643,6 +681,7 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
           ...(stagedDefaultOnCallTool !== undefined ? { onCallTool: stagedDefaultOnCallTool } : {}),
           onUpdateModelContext: defaultOnUpdateModelContext,
           onUserMessage: defaultOnUserMessage,
+          onOpenLink: defaultOnOpenLink,
           hostContext: { theme: mode },
         }
       : (effectiveViewProps ?? {});
@@ -776,6 +815,7 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
         strings={strings}
         theme={theme}
         mode={mode}
+        surface={surface}
         {...(windowing !== undefined ? { window: windowing } : {})}
         {...(components !== undefined ? { components } : {})}
         onToggle={toggle}
@@ -788,6 +828,30 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
         {...(onViewRef !== undefined ? { onViewRef } : {})}
         viewProps={effectiveViewProps}
       />
+      {pendingLink !== null && (
+        <div role="status" className="guuey-chat-link-ask">
+          <span className="guuey-chat-link-ask-label">
+            {strings.linkAskLabel(new URL(pendingLink).host)}
+          </span>
+          <span className="guuey-chat-link-ask-url">{pendingLink}</span>
+          <a
+            className="guuey-chat-link-ask-open"
+            href={pendingLink}
+            target="_blank"
+            rel="noopener noreferrer"
+            onClick={() => setPendingLink(null)}
+          >
+            {strings.linkOpen}
+          </a>
+          <button
+            type="button"
+            className="guuey-chat-link-ask-dismiss"
+            onClick={() => setPendingLink(null)}
+          >
+            {strings.linkDismiss}
+          </button>
+        </div>
+      )}
       {oauthReturn.notice !== null && (
         <p
           role="status"
@@ -801,6 +865,7 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
           </button>
         </p>
       )}
+      {composer && (
       <form
         className="guuey-chat-composer"
         onSubmit={(e) => {
@@ -842,6 +907,7 @@ export const GuueyChat = forwardRef<GuueyChatHandle, GuueyChatProps>(function Gu
           </button>
         )}
       </form>
+      )}
     </div>
   );
 });

package/src/react/markdown.tsx

@@ -30,12 +30,77 @@ import {
   type RichTextBlock,
   type RichTextInline,
 } from "@silverprotocol/richtext";
+import { normalizeTableRow, type RichTextTableBlock } from "../richtext-table.js";
+
+/**
+ * Bare-URL autolink (guuey#515): richtext mints `link` nodes only from
+ * explicit `[text](url)` markdown, so a plain "https://…" in agent prose
+ * parses as a text node and rendered as untappable static text — on a
+ * phone that means retyping a URL out of a chat bubble. Linkify at the
+ * render boundary, conservatively:
+ *  - the scheme is part of the match (http/https only), so no
+ *    `javascript:`/`data:` target can ever qualify — the SAFE_HREF
+ *    property holds by construction;
+ *  - built as React elements (no HTML string exists to inject into),
+ *    same `rel`/`target` contract as explicit links;
+ *  - trailing punctuation stays prose ("see https://guuey.com." must not
+ *    link the dot), while a balanced closing paren/bracket stays in the
+ *    URL (wiki-style paths);
+ *  - schemeless "www.foo.com" is deliberately NOT linkified — guessing
+ *    schemes is how autolinkers start lying;
+ *  - code spans are untouched (they render `node.code`, not this path).
+ */
+const BARE_URL = /https?:\/\/[^\s<>]+/g;
+
+function trimTrailingPunctuation(url: string): string {
+  for (;;) {
+    const last = url[url.length - 1];
+    if (last === undefined) return url;
+    if (last === ")" || last === "]") {
+      const open = last === ")" ? "(" : "[";
+      const opens = url.split(open).length - 1;
+      const closes = url.split(last).length - 1;
+      if (closes > opens) {
+        url = url.slice(0, -1);
+        continue;
+      }
+      return url;
+    }
+    if (".,;:!?'\"»›".includes(last)) {
+      url = url.slice(0, -1);
+      continue;
+    }
+    return url;
+  }
+}
+
+function linkify(text: string): ReactNode {
+  if (!text.includes("http")) return text;
+  const out: ReactNode[] = [];
+  let consumed = 0;
+  for (const match of text.matchAll(BARE_URL)) {
+    const start = match.index;
+    if (start === undefined) continue;
+    const url = trimTrailingPunctuation(match[0]);
+    if (url.length === 0) continue;
+    if (start > consumed) out.push(text.slice(consumed, start));
+    out.push(
+      <a key={`url-${start}`} href={url} target="_blank" rel="noopener noreferrer">
+        {url}
+      </a>,
+    );
+    consumed = start + url.length;
+  }
+  if (out.length === 0) return text;
+  if (consumed < text.length) out.push(text.slice(consumed));
+  return out;
+}
 
 function Inline({ nodes }: { nodes: RichTextInline[] }): ReactNode {
   return nodes.map((node, i) => {
     switch (node.type) {
       case "text":
-        return <span key={i}>{node.text}</span>;
+        return <span key={i}>{linkify(node.text)}</span>;
       case "break":
         return <br key={i} />;
       case "strong":
@@ -71,8 +136,45 @@ function Inline({ nodes }: { nodes: RichTextInline[] }): ReactNode {
   });
 }
 
+/**
+ * The table arm (guuey#370 — sdk#23's node). Cells render through the
+ * SAME `<Inline>` sanitizer path as every other run. Exported for tests;
+ * not part of the package surface.
+ */
+export function TableBlock({ block }: { block: RichTextTableBlock }): ReactNode {
+  const columnCount = block.header.cells.length;
+  return (
+    <div className="guuey-chat-table-wrap">
+      <table className="guuey-chat-table">
+        <thead>
+          <tr>
+            {normalizeTableRow(block.header, columnCount).map((cell, i) => (
+              <th key={i} {...(block.align[i] !== undefined ? { style: { textAlign: block.align[i] } } : {})}>
+                <Inline nodes={cell.children} />
+              </th>
+            ))}
+          </tr>
+        </thead>
+        <tbody>
+          {block.rows.map((row, r) => (
+            <tr key={r}>
+              {normalizeTableRow(row, columnCount).map((cell, i) => (
+                <td key={i} {...(block.align[i] !== undefined ? { style: { textAlign: block.align[i] } } : {})}>
+                  <Inline nodes={cell.children} />
+                </td>
+              ))}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  );
+}
+
 function Block({ block }: { block: RichTextBlock }): ReactNode {
   switch (block.type) {
+    case "table":
+      return <TableBlock block={block} />;
     case "paragraph":
       return (
         <p>

package/src/react/theme-css.ts

@@ -24,27 +24,35 @@ const DENSITY_GAP: Record<GuueyChatTheme["shape"]["density"], string> = {
  * One mode's tokens as inline custom properties for the transcript root.
  * Returned as a plain record so callers can spread it into `style` or emit
  * a stylesheet from it.
+ *
+ * Stamped under INTERNAL names (`--_guuey-chat-*`), never the documented
+ * `--guuey-chat-*` channel (guuey#521): the stylesheet reads every token
+ * as `var(--guuey-chat-<t>, var(--_guuey-chat-<t>))`, so a host CSS
+ * variable — set on any ancestor — wins per-token over the resolved
+ * theme, and the two theming channels COMPOSE instead of the inline
+ * stamp silently shadowing the documented one (the trap the landing
+ * home-hero embed hit four rounds of).
  */
 export function themeCssVars(theme: GuueyChatTheme, mode: ThemeMode): Record<string, string> {
   const palette = theme.colors[mode];
   const vars: Record<string, string> = {
-    "--guuey-chat-accent": palette.accent,
-    "--guuey-chat-on-accent": palette.onAccent,
-    "--guuey-chat-ink": palette.ink,
-    "--guuey-chat-ink-muted": palette.inkMuted,
-    "--guuey-chat-surface": palette.surface,
-    "--guuey-chat-canvas": palette.canvas,
-    "--guuey-chat-canvas-muted": palette.canvasMuted,
-    "--guuey-chat-error": palette.error,
-    "--guuey-chat-radius": RADIUS_PX[theme.shape.radius],
-    "--guuey-chat-gap": DENSITY_GAP[theme.shape.density],
-    "--guuey-chat-scale": String(theme.typography.scale ?? 1),
+    "--_guuey-chat-accent": palette.accent,
+    "--_guuey-chat-on-accent": palette.onAccent,
+    "--_guuey-chat-ink": palette.ink,
+    "--_guuey-chat-ink-muted": palette.inkMuted,
+    "--_guuey-chat-surface": palette.surface,
+    "--_guuey-chat-canvas": palette.canvas,
+    "--_guuey-chat-canvas-muted": palette.canvasMuted,
+    "--_guuey-chat-error": palette.error,
+    "--_guuey-chat-radius": RADIUS_PX[theme.shape.radius],
+    "--_guuey-chat-gap": DENSITY_GAP[theme.shape.density],
+    "--_guuey-chat-scale": String(theme.typography.scale ?? 1),
   };
   if (theme.typography.fontFamily !== undefined) {
-    vars["--guuey-chat-font"] = theme.typography.fontFamily;
+    vars["--_guuey-chat-font"] = theme.typography.fontFamily;
   }
   if (theme.typography.monoFontFamily !== undefined) {
-    vars["--guuey-chat-mono-font"] = theme.typography.monoFontFamily;
+    vars["--_guuey-chat-mono-font"] = theme.typography.monoFontFamily;
   }
   return vars;
 }

package/src/react/transcript.tsx

@@ -63,6 +63,14 @@ export interface TranscriptProps
   strings?: ChatStrings;
   theme?: GuueyChatTheme;
   mode?: ThemeMode;
+  /**
+   * Message-surface presentation (guuey#521). `"card"` (default) renders
+   * assistant text on its own surface-tinted, hairline-bordered card;
+   * `"bare"` sits the transcript directly on the host's background — the
+   * embed disappears into the page it lives on. The user pill stays a
+   * bubble in both.
+   */
+  surface?: "card" | "bare";
   /** DOM windowing (§3.2). `false` renders everything. Default tail 80. */
   window?: TranscriptWindowing | false;
   className?: string;
@@ -76,6 +84,7 @@ export function Transcript(props: TranscriptProps): ReactNode {
     strings = defaultChatStrings,
     theme = DEFAULT_CHAT_THEME,
     mode = "light",
+    surface = "card",
     window: windowing = { tail: 80 },
     className,
     style,
@@ -169,7 +178,7 @@ export function Transcript(props: TranscriptProps): ReactNode {
 
   return (
     <div
-      className={`guuey-chat${className !== undefined ? ` ${className}` : ""}`}
+      className={`guuey-chat${surface === "bare" ? " guuey-chat--bare" : ""}${className !== undefined ? ` ${className}` : ""}`}
       style={rootStyle}
       data-guuey-chat-mode={mode}
     >

package/src/richtext-table.ts

@@ -0,0 +1,30 @@
+/**
+ * Table rendering support (guuey#370 — sdk#23's vocabulary, live since
+ * `@silverprotocol/richtext@0.5.3`).
+ *
+ * The block type DERIVES from the upstream union (strict-typing rule:
+ * the parser's types are the source of truth). History note: this module
+ * was born one cut earlier as a structural MIRROR + narrowing guard so
+ * both renderer arms could land BEFORE the bump (the renderers switch
+ * default-less on `block.type` — a bump without an arm would have
+ * rendered tables as NOTHING); with 0.5.3 pinned, the mirror and guard
+ * are deleted per the pre-launch one-contract rule and the arms moved
+ * into the switches proper.
+ */
+import type { RichTextBlock, RichTextTableCell } from "@silverprotocol/richtext";
+
+export type RichTextTableBlock = Extract<RichTextBlock, { type: "table" }>;
+
+/**
+ * Renderer-side GFM normalization (defense in depth — the parser already
+ * pads/drops): every row exactly `columnCount` cells, short rows padded
+ * with empty-inline cells, excess dropped.
+ */
+export function normalizeTableRow(
+  row: { cells: RichTextTableCell[] },
+  columnCount: number,
+): RichTextTableCell[] {
+  const cells = row.cells.slice(0, columnCount);
+  while (cells.length < columnCount) cells.push({ children: [] });
+  return cells;
+}

package/src/strings.ts

@@ -128,6 +128,15 @@ export interface ChatStrings {
   /** R16 — the notice row's label (provenance shows only under debug). */
   noticeLabel: string;
 
+  /**
+   * The `ui/open-link` disclosure affordance (guuey#522): a card asked to
+   * open a URL — the kit shows WHERE before anything navigates, and the
+   * human's own click on `linkOpen` is the only door out.
+   */
+  linkAskLabel: (host: string) => string;
+  linkOpen: string;
+  linkDismiss: string;
+
   /** The 3c composer (`<GuueyChat>`). */
   composerPlaceholder: string;
   composerUnavailable: string;
@@ -233,6 +242,10 @@ export const defaultChatStrings: ChatStrings = {
 
   noticeLabel: "Note",
 
+  linkAskLabel: (host) => `This card wants to open ${host}`,
+  linkOpen: "Open",
+  linkDismiss: "Dismiss",
+
   composerPlaceholder: "Message the agent…",
   composerUnavailable: "Chat is unavailable.",
   composerLabel: "Message",