@guuey/chat 0.7.1 → 0.8.0

package/src/react/use-transcript.ts

@@ -18,6 +18,7 @@ import {
   resolveViewMount,
   type ResolvedViewMount,
   type UiResourceReader,
+  type ViewCspDiagnosis,
   type ViewHostPhase,
 } from "@guuey/mcp-apps-host";
 import { buildHitlAnswer, hitlPromptsFromFold, type HitlAnswerRecord, type HitlPromptAction } from "../hitl.js";
@@ -62,6 +63,12 @@ export interface UseTranscriptResult {
   overrides: TranscriptOverrides;
   /** Wire to `<GuueyView onPhaseChange>` (the default kit already does). */
   onViewPhase: (key: ItemKey, phase: ViewHostPhase) => void;
+  /**
+   * Wire to `<GuueyView onCspDiagnosis>` (the default kit already does):
+   * the host's CSP tripwire caught the embedding page blocking this view
+   * (guuey#235). Feeds `viewDiagnoses` so the R6 label names the cause.
+   */
+  onViewDiagnosis: (key: ItemKey, diagnosis: ViewCspDiagnosis) => void;
   /** Locator resolutions: mount material, or `"expired"` for a miss. */
   resolvedMounts: ReadonlyMap<ItemKey, ResolvedViewMount | "expired">;
 }
@@ -74,6 +81,7 @@ export function useTranscript({
 }: UseTranscriptArgs): UseTranscriptResult {
   const [overrides, setOverrides] = useState<TranscriptOverrides>({});
   const [phases, setPhases] = useState<Readonly<Record<string, ViewHostPhase>>>({});
+  const [diagnoses, setDiagnoses] = useState<Readonly<Record<string, ViewCspDiagnosis>>>({});
   const [resolvedMounts, setResolvedMounts] = useState<
     ReadonlyMap<ItemKey, ResolvedViewMount | "expired">
   >(new Map());
@@ -83,8 +91,12 @@ export function useTranscript({
   debugSink.current = policy.debugDetail && onDebugEvent !== undefined ? onDebugEvent : null;
 
   const merged = useMemo<TranscriptInputs>(
-    () => ({ ...inputs, viewPhases: { ...inputs.viewPhases, ...phases } }),
-    [inputs, phases],
+    () => ({
+      ...inputs,
+      viewPhases: { ...inputs.viewPhases, ...phases },
+      viewDiagnoses: { ...inputs.viewDiagnoses, ...diagnoses },
+    }),
+    [inputs, phases, diagnoses],
   );
   const plan = useMemo(() => planTranscript(merged, policy, overrides), [merged, policy, overrides]);
 
@@ -114,13 +126,32 @@ export function useTranscript({
   // Mirror of `phases` for the change check OUTSIDE the state updater — a
   // sink call inside an updater would double-fire under StrictMode.
   const phasesRef = useRef<Readonly<Record<string, ViewHostPhase>>>({});
+  const diagnosesRef = useRef<Readonly<Record<string, ViewCspDiagnosis>>>({});
   const onViewPhase = useCallback((key: ItemKey, phase: ViewHostPhase) => {
     if (phasesRef.current[key] !== phase) {
       phasesRef.current = { ...phasesRef.current, [key]: phase };
-      debugSink.current?.({ type: "view-phase", key, phase });
+      const diagnosis = diagnosesRef.current[key];
+      debugSink.current?.({
+        type: "view-phase",
+        key,
+        phase,
+        ...(diagnosis !== undefined ? { diagnosis } : {}),
+      });
     }
     setPhases((prev) => (prev[key] === phase ? prev : { ...prev, [key]: phase }));
   }, []);
+  // The tripwire fires BEFORE the negotiation window lapses (a blocked
+  // runtime never negotiates), so the diagnosis is usually known by the
+  // time `no-handshake` arrives — the phase event above carries it. If it
+  // lands after, re-emit the current phase with the verdict so a debug
+  // sink still sees the pairing.
+  const onViewDiagnosis = useCallback((key: ItemKey, diagnosis: ViewCspDiagnosis) => {
+    if (diagnosesRef.current[key] === diagnosis) return;
+    diagnosesRef.current = { ...diagnosesRef.current, [key]: diagnosis };
+    const phase = phasesRef.current[key];
+    if (phase !== undefined) debugSink.current?.({ type: "view-phase", key, phase, diagnosis });
+    setDiagnoses((prev) => (prev[key] === diagnosis ? prev : { ...prev, [key]: diagnosis }));
+  }, []);
 
   // Plan-derived debug events, emitted once per sighting (post-render — the
   // plan itself stays pure data).
@@ -177,7 +208,7 @@ export function useTranscript({
     }
   }, [plan, resolvedMounts]);
 
-  return { plan, toggle, overrides, onViewPhase, resolvedMounts };
+  return { plan, toggle, overrides, onViewPhase, onViewDiagnosis, resolvedMounts };
 }
 
 // ─── useTranscriptInputs (the live assembler) ──────────────────────────────
@@ -196,9 +227,9 @@ export interface UseTranscriptInputsResult {
    * VALIDATES it against the ask's persisted record (`validateHitlAnswer`
    * — required-iff-declared, echo-must-be-declared, requestState byte-echo)
    * BEFORE anything dispatches, records it in the ledger, and returns it
-   * for the HOST to deliver — the kit renders and validates; the answer
-   * transport is the host's (no client→pod hitl-answer channel exists on
-   * the guuey wire today; see the #16 producer flag).
+   * for the HOST to deliver — the kit renders and validates; the transport
+   * is the host's (`@guuey/agent-client`'s `createHitlAnswerRelay` posts it
+   * to `<pod>/agent/hitl-answer`, guuey#207).
    */
   answerHitlPrompt: (ask: AgPausedAsk, action: HitlPromptAction) => AgHitlAnswer;
 }
@@ -219,36 +250,12 @@ export function useTranscriptInputs(invoke: UseAgentInvokeReturn): UseTranscript
     return () => clearInterval(timer);
   }, [invoke.status]);
 
-  // R10 ledger: the hook exposes only the LATEST pending ask; the
-  // transcript keeps the record of every ask and its resolution.
+  // R10 ledger (the LINK invite): the hook exposes only the LATEST pending
+  // invite; the transcript keeps the record of every ask and its resolution.
+  // Consent is NOT ledgered here — it is an AgJSON paused turn in the fold
+  // (`hitlPromptsFromFold` below, guuey#207).
   const [prompts, setPrompts] = useState<ProfilePromptInput[]>([]);
   const promptSeq = useRef(0);
-  useEffect(() => {
-    const request = invoke.profileConsentRequest;
-    if (request === null) {
-      setPrompts((prev) =>
-        prev.some((p) => p.kind === "consent" && p.state === "pending")
-          ? prev.map((p) =>
-              p.kind === "consent" && p.state === "pending" ? { ...p, state: "dismissed" } : p,
-            )
-          : prev,
-      );
-      return;
-    }
-    setPrompts((prev) => {
-      if (prev.some((p) => p.kind === "consent" && p.state === "pending")) return prev;
-      return [
-        ...prev,
-        {
-          id: `consent.${promptSeq.current++}`,
-          kind: "consent",
-          appId: request.appId,
-          requested: request.requested,
-          state: "pending",
-        },
-      ];
-    });
-  }, [invoke.profileConsentRequest]);
   useEffect(() => {
     const request = invoke.profileLinkRequest;
     if (request === null) {
@@ -282,7 +289,6 @@ export function useTranscriptInputs(invoke: UseAgentInvokeReturn): UseTranscript
       // Clearing the hook's pending request AFTER the ledger moved keeps the
       // dismissal effect above from double-transitioning it.
       const pending = prompts.find((p) => p.id === id);
-      if (pending?.kind === "consent") invoke.clearProfileConsentRequest();
       if (pending?.kind === "link") invoke.clearProfileLinkRequest();
     },
     [invoke, prompts],

package/src/strings.ts

@@ -55,6 +55,17 @@ export interface ChatStrings {
   viewInlineFallback: string;
   viewExpired: string;
   viewSandboxUnavailable: string;
+  /**
+   * R6 no-handshake with a CSP diagnosis (guuey#235): the embedding page's
+   * own policy blocked the view. Receives the structured verdict so a
+   * locale can shape the sentence; the en default names the blocked URI
+   * and the exact allowance to add.
+   */
+  viewCspBlocked: (diagnosis: {
+    blockedUri: string;
+    violatedDirective: string;
+    suggestedEntry: string;
+  }) => string;
   /** guuey#204: the chip text for a mount promoted to a host stage/canvas. */
   viewPromoted: (title: string) => string;
   /** Chip title when the mount has no producing-call title (history cards). */
@@ -136,6 +147,8 @@ export const defaultChatStrings: ChatStrings = {
   viewInlineFallback: "Showing plain content",
   viewExpired: "This view expired",
   viewSandboxUnavailable: "Interactive view unavailable",
+  viewCspBlocked: (d) =>
+    `This page's Content-Security-Policy blocks ${d.blockedUri} — add "${d.violatedDirective} ${d.suggestedEntry}" to the policy so the view can start`,
   viewPromoted: (title) => `${title} — on canvas`,
   viewRefFallbackTitle: "Card",
 

package/src/types.ts

@@ -20,7 +20,12 @@ import type {
   JsonValue,
 } from "@silverprotocol/core";
 import type { AgentInvokeStatus, HistoryCard } from "@guuey/agent-client";
-import type { ViewHostPhase, ViewMount, ViewMountChannel } from "@guuey/mcp-apps-host";
+import type {
+  ViewCspDiagnosis,
+  ViewHostPhase,
+  ViewMount,
+  ViewMountChannel,
+} from "@guuey/mcp-apps-host";
 
 /**
  * One settled entry of the flat conversation transcript — structurally
@@ -42,14 +47,17 @@ export interface TranscriptMessage {
 }
 
 /**
- * A pending/resolved consent or link ask (R10) — the turn-level
- * `profile-consent` / `profile-link` events lifted into renderable state.
- * The assembler (3b) accumulates these from `invokeTurn` events; `id` is
- * assembler-chosen and stable for the ask's lifetime.
+ * A pending/resolved account-LINK invite (R10) — the turn-level
+ * `profile-link` event lifted into renderable state. The assembler (3b)
+ * accumulates these from `invokeTurn` events; `id` is assembler-chosen and
+ * stable for the ask's lifetime. (Consent is NOT a profile arm any more:
+ * since guuey#207 the pod asks over AgJSON `hitl.ask` + `turn.done
+ * outcome:"paused"` with declared `grantModes`, and it renders through
+ * {@link HitlPromptInput}.)
  */
 export interface ProfilePromptInput {
   id: string;
-  kind: "consent" | "link";
+  kind: "link";
   appId: string;
   requested: "read" | "read-write";
   state: "pending" | "answered" | "declined" | "dismissed";
@@ -78,9 +86,9 @@ export interface HitlPromptInput {
 
 /**
  * R10 prompt inputs — a discriminated union (narrow on `kind`). The
- * profile arm is the original guuey-wire shape unchanged; `hitl` arrived
- * with spec draft.2. (Direct un-narrowed reads of profile-only fields are
- * the one shape this union retired — narrow first.)
+ * profile arm is the guuey-wire LINK invite; `hitl` (spec draft.2) carries
+ * every AgJSON ask, consent included. (Direct un-narrowed reads of
+ * profile-only fields are the one shape this union retired — narrow first.)
  */
 export type PromptItemInput = ProfilePromptInput | HitlPromptInput;
 
@@ -112,7 +120,7 @@ export interface TranscriptInputs {
   statusElapsedMs: number;
   activeTool: string | null;
   error: { message: string; code: string | null } | null;
-  /** Pending/answered consent + link asks (R10). */
+  /** Pending/answered asks (R10): the link invite + AgJSON hitl asks (consent). */
   prompts: PromptItemInput[];
   /**
    * The settled conversation, both roles, in order. Assistant entries are
@@ -128,6 +136,14 @@ export interface TranscriptInputs {
   sendStates?: Readonly<Record<string, "sending" | "failed">>;
   /** mountKey → live phase (R6 states). Keys match `ViewMountItem.key`. */
   viewPhases?: Readonly<Record<string, ViewHostPhase>>;
+  /**
+   * mountKey → the host's CSP tripwire verdict (guuey#235): the embedding
+   * page's own policy blocked the view. Renderer-supplied like
+   * `viewPhases` (`<GuueyView onCspDiagnosis>` → `useTranscript`); a
+   * `no-handshake` mount with a diagnosis labels the actionable cause
+   * instead of the channel heuristic.
+   */
+  viewDiagnoses?: Readonly<Record<string, ViewCspDiagnosis>>;
   /**
    * The mount key a host-owned stage/canvas surface currently shows
    * (guuey#204 "promote and reference") — renderer-supplied state, like
@@ -247,6 +263,12 @@ export interface ViewMountItem extends BaseItem {
   phase: ViewHostPhase | "expired";
   /** The channel-aware state label the renderer shows for non-connected phases. */
   label: string | null;
+  /**
+   * The CSP tripwire's verdict when the embedding page blocked this view
+   * (guuey#235) — WHY a `no-handshake`; `label` already carries its
+   * message, this is the structured form for renderers/debug sinks.
+   */
+  diagnosis: ViewCspDiagnosis | null;
   /** Calm chrome: "via {tool}" when this mount broke an R4 group. */
   attribution: string | null;
   /** The producing call's humanized title (live mounts); null for history cards. */
@@ -301,12 +323,12 @@ export interface CitationsItem extends BaseItem {
   style: "chips" | "list";
 }
 
-/** R10 — the guuey-wire consent/link prompt card (the original arm). */
+/** R10 — the guuey-wire account-LINK prompt card (the original arm). */
 export interface ProfilePromptItem extends BaseItem {
   kind: "prompt";
   /** The `PromptItemInput.id` this row records — the host's resolution key. */
   promptId: string;
-  promptKind: "consent" | "link";
+  promptKind: "link";
   appId: string;
   requested: "read" | "read-write";
   state: "pending" | "answered" | "declined" | "dismissed";
@@ -448,7 +470,13 @@ export interface StatusLineItem {
  * ignores it by design (spec §5's per-preset row).
  */
 export type ChatDebugEvent =
-  | { type: "view-phase"; key: ItemKey; phase: ViewHostPhase | "expired" }
+  | {
+      type: "view-phase";
+      key: ItemKey;
+      phase: ViewHostPhase | "expired";
+      /** Present when the host's CSP tripwire diagnosed the failure (guuey#235). */
+      diagnosis?: ViewCspDiagnosis;
+    }
   | { type: "unknown-block"; key: ItemKey; typeName: string; byteSize: number }
   | { type: "turn-recovered"; marker: string };