@guuey/mcp-apps-host 0.7.1 → 0.7.2

package/dist/index.d.ts

@@ -8,7 +8,7 @@ export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResourc
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, type LocatorViewMount, type ResolvedViewMount, type UiResourceReader, type ViewMount, type ViewMountChannel, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, type CreateMcpUiResourceReaderDeps, type McpResourceReadResult, } from "./reader.js";
 export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, type CreateMcpUiActionRelayDeps, type McpToolCallContent, type McpToolCallResult, type McpToolStructuredContent, type UiActionRequest, } from "./action.js";
-export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
-export { attachViewHost, viewDocumentHtml, type AttachViewHostConfig, type ViewFrameLike, type ViewHostEvents, } from "./view-host.js";
+export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, diagnoseCspViolation, type CspViolationLike, type ViewCspDiagnosis, type ViewCspOrigins, type ViewHostBehavior, type ViewHostEffect, type ViewHostOutbound, type ViewHostPhase, type ViewHostInfo, type ViewHostState, type ViewHostTransition, type ViewRequestId, } from "./view-host-protocol.js";
+export { attachViewHost, viewDocumentHtml, type AttachViewHostConfig, type ViewCspEvents, type ViewFrameLike, type ViewHostEvents, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAMvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,4BAA4B,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC;AAMvB,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -13,6 +13,6 @@ export { asGguiRender, asGguiRenderBootstrap, blockGguiRender, gguiRenderResourc
 export { resolveViewMount, snapshotViewMount, toolResultViewMount, } from "./card-mount.js";
 export { createMcpUiResourceReader, uiResourceChannel, } from "./reader.js";
 export { asToolCallResult, createMcpUiActionRelay, unavailableToolCallResult, UI_ACTION_TOOLS, UI_ACTION_UNAVAILABLE_TEXT, UI_SEMANTIC_ACTION_TOOLS, } from "./action.js";
-export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
+export { initializeResult, initialViewHostState, resourceReadResponse, RESOURCES_READ_METHOD, teardownMessage, toolCallResponse, TOOLS_CALL_METHOD, viewHostElapsed, viewHostReceive, diagnoseCspViolation, } from "./view-host-protocol.js";
 export { attachViewHost, viewDocumentHtml, } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, } from "./sandbox-page.js";

package/dist/react.d.ts

@@ -34,14 +34,14 @@
  */
 import { type CSSProperties, type ReactNode } from "react";
 import { type AttachViewHostConfig } from "./view-host.js";
-import type { ViewHostPhase } from "./view-host-protocol.js";
+import type { ViewCspDiagnosis, ViewHostPhase } from "./view-host-protocol.js";
 import type { ResolvedViewMount } from "./card-mount.js";
 export { attachViewHost, viewDocumentHtml } from "./view-host.js";
-export type { AttachViewHostConfig, ViewFrameLike, ViewHostEvents } from "./view-host.js";
+export type { AttachViewHostConfig, ViewCspEvents, ViewFrameLike, ViewHostEvents } from "./view-host.js";
 export { attachSandboxPageDelivery, isSandboxProxyReady, SANDBOX_PROXY_READY_METHOD, SANDBOX_RESOURCE_READY_METHOD, type SandboxPageDeliveryConfig, } from "./sandbox-page.js";
-export type { ViewHostPhase } from "./view-host-protocol.js";
+export type { ViewCspDiagnosis, ViewCspOrigins, ViewHostPhase } from "./view-host-protocol.js";
 export type { ResolvedViewMount, ViewMount, ViewMountChannel } from "./card-mount.js";
-export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "onReadResource" | "onSizeChanged" | "negotiationTimeoutMs"> {
+export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabilities" | "hostInfo" | "hostContext" | "onCallTool" | "onReadResource" | "onSizeChanged" | "negotiationTimeoutMs" | "cspOrigins" | "onCspDiagnosis"> {
     /** The resolved card to mount (see `toolResultViewMount`/`resolveViewMount`). */
     mount: ResolvedViewMount;
     /**
@@ -97,9 +97,12 @@ export interface GuueyViewProps extends Pick<AttachViewHostConfig, "hostCapabili
      * "render nothing". The default: a quiet "Negotiating with view…" line
      * while `"negotiating"`; a labeled failure for `"no-handshake"` on the
      * `"ggui"` channel; nothing once `"connected"` (the view owns its
-     * pixels) and nothing for a silent `"inline"` card.
+     * pixels) and nothing for a silent `"inline"` card. The second argument
+     * is the CSP diagnosis when the tripwire caught one (see
+     * {@link AttachViewHostConfig.cspOrigins}) — the default label folds it
+     * in; a custom renderer decides how to show it.
      */
-    renderStatus?: (phase: ViewHostPhase) => ReactNode;
+    renderStatus?: (phase: ViewHostPhase, diagnosis?: ViewCspDiagnosis) => ReactNode;
 }
 /**
  * Mount a resolved view and play the MCP Apps Host for it. See the module

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1F,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EAClB,kBAAkB,GAClB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,sBAAsB,CACzB;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,SAAS,CAAC;CACpD;AA+BD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CA0J1D"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACjG,OAAO,EAAoC,KAAK,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE7F,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,aAAa,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC/F,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAKtF,MAAM,WAAW,cACf,SAAQ,IAAI,CACV,oBAAoB,EAClB,kBAAkB,GAClB,UAAU,GACV,aAAa,GACb,YAAY,GACZ,gBAAgB,GAChB,eAAe,GACf,sBAAsB,GACtB,YAAY,GACZ,gBAAgB,CACnB;IACD,iFAAiF;IACjF,KAAK,EAAE,iBAAiB,CAAC;IACzB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,0BAA0B,CAAC,EAAE,MAAM,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAClF;AA8CD;;;GAGG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,CAmK1D"}

package/dist/react.js

@@ -51,10 +51,17 @@ const statusLineStyle = {
     opacity: 0.65,
     pointerEvents: "none",
 };
-function defaultStatus(phase, channel) {
+function defaultStatus(phase, channel, diagnosis) {
     if (phase === "negotiating") {
         return _jsx("p", { style: statusLineStyle, children: "Negotiating with view\u2026" });
     }
+    // A CSP diagnosis (guuey#235) is the WHY behind a silent frame — on any
+    // channel: a blocked runtime bundle never gets to negotiate, so the
+    // tripwire's verdict outranks the channel heuristic below. Actionable
+    // over accurate-but-mute: name the blocked URI and the allowance.
+    if (phase === "no-handshake" && diagnosis !== undefined) {
+        return (_jsx("p", { role: "alert", style: { ...statusLineStyle, opacity: 1, pointerEvents: "auto" }, children: diagnosis.message }));
+    }
     if (phase === "no-handshake" && channel === "ggui") {
         // A ggui shell negotiates unconditionally before painting, so silence
         // here is a boot failure with no other author — label it (role=alert
@@ -71,6 +78,8 @@ export function GuueyView(props) {
     const { mount, sandboxPageUrl, autoResize, dangerouslyAddSandboxFlags, allow, title, className, style, onPhaseChange, renderStatus, ...hostConfig } = props;
     const frameRef = useRef(null);
     const [phase, setPhase] = useState("negotiating");
+    // The CSP tripwire's verdict for THIS document, if any (guuey#235).
+    const [diagnosis, setDiagnosis] = useState(undefined);
     // The view's own size report, applied only under `autoResize`.
     const [reportedHeight, setReportedHeight] = useState(undefined);
     const html = viewDocumentHtml(mount.resource);
@@ -107,6 +116,7 @@ export function GuueyView(props) {
         // document boots fresh, and the previous negotiation's phase must not
         // paper over it — nor must the previous document's reported size.
         setPhase("negotiating");
+        setDiagnosis(undefined);
         setReportedHeight(undefined);
         const frame = frameRef.current;
         if (frame === null || html === undefined)
@@ -121,6 +131,10 @@ export function GuueyView(props) {
                 setPhase(next);
                 latest.current.onPhaseChange?.(next);
             },
+            onCspDiagnosis: (found) => {
+                setDiagnosis(found);
+                latest.current.hostConfig.onCspDiagnosis?.(found);
+            },
             onSizeChanged: (size) => {
                 if (latest.current.autoResize === true && size.height !== undefined) {
                     setReportedHeight(size.height);
@@ -180,5 +194,7 @@ export function GuueyView(props) {
                     width: "100%",
                     height: autoResize === true && reportedHeight !== undefined ? reportedHeight : "100%",
                     border: 0,
-                } }, `${page?.href ?? "srcdoc"}::${mount.resource.uri}`), renderStatus !== undefined ? renderStatus(phase) : defaultStatus(phase, mount.channel)] }));
+                } }, `${page?.href ?? "srcdoc"}::${mount.resource.uri}`), renderStatus !== undefined
+                ? renderStatus(phase, diagnosis)
+                : defaultStatus(phase, mount.channel, diagnosis)] }));
 }

package/dist/view-host-protocol.d.ts

@@ -31,7 +31,7 @@
  * `ggui-render.ts` retired 2026-08-16 — guuey#209; that module is now
  * deprecated re-exports only.)
  */
-import { type McpUiHostCapabilities, type McpUiHostContext, type McpUiInitializeResult } from "@modelcontextprotocol/ext-apps";
+import { type McpUiHostCapabilities, type McpUiHostContext, type McpUiInitializeResult, type McpUiResourceCsp } from "@modelcontextprotocol/ext-apps";
 import type { McpToolStructuredContent } from "./action.js";
 import type { McpResourceReadResult } from "./reader.js";
 /**
@@ -209,4 +209,52 @@ export declare function viewHostReceive(state: ViewHostState, behavior: ViewHost
  * one stays lapsed. The caller owns the clock — this machine has none.
  */
 export declare function viewHostElapsed(state: ViewHostState): ViewHostState;
+/**
+ * The origins a view needs the EMBEDDER's page to allow — the spec's own
+ * per-resource CSP declaration (`McpUiResourceCsp`: `connectDomains` →
+ * `connect-src`, `resourceDomains` → `script-src`/`style-src`/…,
+ * `frameDomains` → `frame-src`). This is the honest filter for the CSP
+ * tripwire: a `securitypolicyviolation` whose `blockedURI` lands on one of
+ * these hosts is a violation ABOUT the view, not about anything else the
+ * page loads. Empty/absent → nothing to match, tripwire inert.
+ */
+export type ViewCspOrigins = McpUiResourceCsp;
+/**
+ * What the embedder can act on when its own CSP blocked the view: the
+ * URI the browser refused, the directive that refused it, and the entry
+ * that would allow it (the blocked URI's origin — the smallest allowance
+ * that fixes exactly this). Rides beside `"no-handshake"` — the phase
+ * stays honest ("it never negotiated"); this is WHY.
+ */
+export interface ViewCspDiagnosis {
+    blockedUri: string;
+    violatedDirective: string;
+    /** The origin to add under `violatedDirective` — e.g. `https://assets.mcp.example`. */
+    suggestedEntry: string;
+    /** Operator-facing sentence, ready to label. */
+    message: string;
+}
+/**
+ * The slice of a `SecurityPolicyViolationEvent` the tripwire reads —
+ * structural, so Node tests hand in plain objects (lib.dom's class is not
+ * constructible outside a browser).
+ */
+export interface CspViolationLike {
+    blockedURI: string;
+    /** e.g. `script-src-elem`, `connect-src`. */
+    violatedDirective: string;
+    /** The directive as the policy spelled it (`script-src` may govern `script-src-elem`). */
+    effectiveDirective?: string;
+}
+/**
+ * Pure: is this violation ABOUT the view (its blocked URI lands on a
+ * declared origin), and if so, what should the embedder add?
+ *
+ * `blockedURI` is a full URL for network/script blocks; the browser sends
+ * bare tokens (`eval`, `inline`, `data`) for policy-class blocks — those
+ * carry no host and never match a declared origin, which is right: a
+ * `script-src eval` report is not the view's (see guuey#236 for the zod
+ * probe that produces exactly one such report at boot).
+ */
+export declare function diagnoseCspViolation(violation: CspViolationLike, origins: ViewCspOrigins | undefined): ViewCspDiagnosis | undefined;
 //# sourceMappingURL=view-host-protocol.d.ts.map

package/dist/view-host-protocol.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC3B,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE"}
+{"version":3,"file":"view-host-protocol.d.ts","sourceRoot":"","sources":["../src/view-host-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,mBAAmB,CAAC;AAStD,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,MAAM,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IACpC,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,WAAW,GAAG,cAAc,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,aAAa,CAAC;IACrB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAEpD;AAED;;;GAGG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAC9C;IACE;;;;;;OAMG;IACH,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,aAAa,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,wBAAwB,CAAC;CACtC,GACD;IACE;;;;;;;OAOG;IACH,IAAI,EAAE,qBAAqB,CAAC;IAC5B,EAAE,EAAE,aAAa,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACb,GACD;IACE;;;;;;;;OAQG;IACH,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEN;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,+DAA+D;IAC/D,WAAW,EAAE,gBAAgB,CAAC;IAC9B,uEAAuE;IACvE,SAAS,EAAE,OAAO,CAAC;IACnB,2EAA2E;IAC3E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAiCD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,gBAAgB,EAC1B,wBAAwB,EAAE,OAAO,GAChC,qBAAqB,CAcvB;AAED,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,GACjC,gBAAgB,CAElB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,aAAa,EACjB,KAAK,EAAE,qBAAqB,GAAG,SAAS,GACvC,gBAAgB,CASlB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAElD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,aAAa,EACpB,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE,OAAO,GACZ,kBAAkB,CAuFpB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,aAAa,CAEnE;AAID;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc,GAAG,SAAS,GAClC,gBAAgB,GAAG,SAAS,CAqB9B"}

package/dist/view-host-protocol.js

@@ -229,3 +229,59 @@ export function viewHostReceive(state, behavior, data) {
 export function viewHostElapsed(state) {
     return state.phase === "negotiating" ? { ...state, phase: "no-handshake" } : state;
 }
+/** Every declared origin's HOST, wildcards (`https://*.x`) reduced to their suffix. */
+function declaredHosts(origins) {
+    const out = [];
+    for (const list of [origins.connectDomains, origins.resourceDomains, origins.frameDomains]) {
+        for (const entry of list ?? []) {
+            // `https://*.example.com` → wildcard suffix `.example.com`
+            const wildcard = /^[a-z]+:\/\/\*\./i.exec(entry);
+            if (wildcard) {
+                out.push({ host: entry.slice(wildcard[0].length - 1).toLowerCase(), wildcard: true });
+                continue;
+            }
+            try {
+                out.push({ host: new URL(entry).hostname.toLowerCase(), wildcard: false });
+            }
+            catch {
+                // A malformed declaration is producer-side wire data; it simply
+                // never matches. The tripwire only ever ADDS a diagnosis, never
+                // blocks, so there is nothing to guard.
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Pure: is this violation ABOUT the view (its blocked URI lands on a
+ * declared origin), and if so, what should the embedder add?
+ *
+ * `blockedURI` is a full URL for network/script blocks; the browser sends
+ * bare tokens (`eval`, `inline`, `data`) for policy-class blocks — those
+ * carry no host and never match a declared origin, which is right: a
+ * `script-src eval` report is not the view's (see guuey#236 for the zod
+ * probe that produces exactly one such report at boot).
+ */
+export function diagnoseCspViolation(violation, origins) {
+    if (origins === undefined)
+        return undefined;
+    let blocked;
+    try {
+        blocked = new URL(violation.blockedURI);
+    }
+    catch {
+        return undefined; // bare token (eval/inline/data/…) — not a host, not the view's
+    }
+    const host = blocked.hostname.toLowerCase();
+    const hit = declaredHosts(origins).some((d) => d.wildcard ? host.endsWith(d.host) : host === d.host);
+    if (!hit)
+        return undefined;
+    const directive = violation.effectiveDirective || violation.violatedDirective;
+    const suggestedEntry = blocked.origin;
+    return {
+        blockedUri: violation.blockedURI,
+        violatedDirective: directive,
+        suggestedEntry,
+        message: `This page's Content-Security-Policy blocks ${violation.blockedURI} (${directive}) — the view cannot start. Add \`${directive} ${suggestedEntry}\` to the page's policy.`,
+    };
+}

package/dist/view-host.d.ts

@@ -27,7 +27,7 @@
  * Seeded from ggui's console `surface-host.ts` (donated, guuey#186 audit);
  * re-derived here against the pure machine + our own tests.
  */
-import { type ViewHostPhase } from "./view-host-protocol.js";
+import { type CspViolationLike, type ViewCspDiagnosis, type ViewCspOrigins, type ViewHostPhase } from "./view-host-protocol.js";
 import type { McpResourceReadResult } from "./reader.js";
 import { type McpToolCallResult, type UiActionRequest } from "./action.js";
 import type { McpUiResourcePayload } from "./block-ui.js";
@@ -57,6 +57,15 @@ export interface ViewHostEvents {
         source: unknown;
     }) => void): void;
 }
+/**
+ * Where CSP violations are observed — the EMBEDDING document (the frame's
+ * blocked loads report there, not inside the opaque frame). Structural like
+ * {@link ViewHostEvents}, injectable for tests. Default: `document`.
+ */
+export interface ViewCspEvents {
+    addEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+    removeEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+}
 export interface AttachViewHostConfig {
     /**
      * Capabilities to advertise in the initialize result. Default: `{}` —
@@ -116,6 +125,41 @@ export interface AttachViewHostConfig {
     }) => void;
     /** Observe phase transitions (see {@link ViewHostPhase}). */
     onPhaseChange?: (phase: ViewHostPhase) => void;
+    /**
+     * The origins this view needs the embedding PAGE's CSP to allow — the
+     * spec's per-resource declaration (`McpUiResourceCsp`). Given, the host
+     * arms a CSP tripwire for the attachment's lifetime: a
+     * `securitypolicyviolation` on the EMBEDDING document whose blocked URI
+     * lands on one of these hosts is upgraded from a silent "never
+     * negotiated" into an actionable {@link ViewCspDiagnosis} (guuey#235).
+     * The phase itself stays `"no-handshake"` — honest about WHAT happened;
+     * the diagnosis says WHY. Absent → tripwire not installed, zero behavior
+     * change (the default for every existing caller).
+     *
+     * REACH (pinned by the browser leg, `e2e/tests/sdk/view-host.spec.ts`):
+     * the listener lives on the embedding document, so it sees violations
+     * the PAGE incurs on the view's origins — a runtime bundle the page
+     * loads at page level, a live channel the page opens on the view's
+     * behalf (the shape ggui's landing tripwire exercised). It does NOT see
+     * a `srcdoc` view's own blocked loads: the frame inherits the page's
+     * policy, but the browser enforces that copy in — and dispatches the
+     * violation on — the FRAME's document, which is opaque-origin and cannot
+     * be listened to from outside. A frame-side reporter would need host
+     * script injected into untrusted view HTML, a trust-boundary change this
+     * primitive deliberately does not make; the `sandboxPageUrl` mount owns
+     * its own policy and reports nothing here by construction.
+     */
+    cspOrigins?: ViewCspOrigins;
+    /**
+     * A CSP violation ABOUT this view was observed (see {@link cspOrigins}).
+     * Fires at most once per attachment, as soon as the violation lands —
+     * typically BEFORE the negotiation window lapses, since a blocked runtime
+     * never gets to negotiate. `<GuueyView>` folds it into the no-handshake
+     * label; a custom renderer shows/logs it as it likes.
+     */
+    onCspDiagnosis?: (diagnosis: ViewCspDiagnosis) => void;
+    /** CSP-violation event source, injectable for tests. Default: `document`. */
+    cspEvents?: ViewCspEvents;
     /**
      * How long to wait for `ui/initialize` before declaring
      * `"no-handshake"` (ms). `0` disables the timer. Default 8000 — a view

package/dist/view-host.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host.d.ts","sourceRoot":"","sources":["../src/view-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EASL,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE;QAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;CACT;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6DAA6D;IAC7D,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAoDD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,GAAE,oBAAyB,GAAG,MAAM,IAAI,CAkFlG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAcnF"}
+{"version":3,"file":"view-host.d.ts","sourceRoot":"","sources":["../src/view-host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAQL,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAGnB,KAAK,aAAa,EAEnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAEL,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,aAAa,EAAE;QAAE,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CACd,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;IACR,mBAAmB,CACjB,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,GAC5D,IAAI,CAAC;CACT;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;IACrG,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI,CAAC;CACzG;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACpE,6DAA6D;IAC7D,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;IAC/C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACvD,6EAA6E;IAC7E,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qEAAqE;IACrE,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAoDD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,EAAE,MAAM,GAAE,oBAAyB,GAAG,MAAM,IAAI,CA8GlG;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAcnF"}

package/dist/view-host.js

@@ -27,7 +27,7 @@
  * Seeded from ggui's console `surface-host.ts` (donated, guuey#186 audit);
  * re-derived here against the pure machine + our own tests.
  */
-import { initialViewHostState, resourceReadResponse, teardownMessage, toolCallResponse, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
+import { diagnoseCspViolation, initialViewHostState, resourceReadResponse, teardownMessage, toolCallResponse, viewHostElapsed, viewHostReceive, } from "./view-host-protocol.js";
 import { unavailableToolCallResult, } from "./action.js";
 const DEFAULT_HOST_INFO = { name: "guuey-view-host", version: "1" };
 const DEFAULT_NEGOTIATION_TIMEOUT_MS = 8000;
@@ -151,12 +151,43 @@ export function attachViewHost(frame, config = {}) {
         return () => window.removeEventListener("message", domListener);
     };
     const unsubscribe = subscribe();
+    // The CSP tripwire (guuey#235): armed only when the caller declared the
+    // view's origins — with none, there is nothing to match and nothing is
+    // installed. It only ever ADDS a diagnosis; it never changes what the
+    // machine does. Once per attachment: the first violation about the view
+    // is the diagnosis (later ones are the same failure repeating).
+    const unsubscribeCsp = (() => {
+        const { cspOrigins, onCspDiagnosis } = config;
+        if (cspOrigins === undefined)
+            return () => { };
+        let reported = false;
+        const onViolation = (event) => {
+            if (reported)
+                return;
+            const diagnosis = diagnoseCspViolation(event, cspOrigins);
+            if (diagnosis === undefined)
+                return;
+            reported = true;
+            onCspDiagnosis?.(diagnosis);
+        };
+        const { cspEvents } = config;
+        if (cspEvents !== undefined) {
+            cspEvents.addEventListener("securitypolicyviolation", onViolation);
+            return () => cspEvents.removeEventListener("securitypolicyviolation", onViolation);
+        }
+        if (typeof document === "undefined")
+            return () => { }; // no embedding document — nothing reports there
+        const domListener = (event) => onViolation(event);
+        document.addEventListener("securitypolicyviolation", domListener);
+        return () => document.removeEventListener("securitypolicyviolation", domListener);
+    })();
     const timeoutMs = config.negotiationTimeoutMs ?? DEFAULT_NEGOTIATION_TIMEOUT_MS;
     const timer = timeoutMs > 0 ? setTimeout(() => setState(viewHostElapsed(state)), timeoutMs) : undefined;
     return () => {
         if (timer !== undefined)
             clearTimeout(timer);
         unsubscribe();
+        unsubscribeCsp();
         cachedWindow?.postMessage(teardownMessage(), "*");
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/mcp-apps-host",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "The MCP Apps (SEP-1865) Host role for guuey's chat surfaces — view-mount narrowing across UI channels, ui:// locator rehydration by resources/read, and the sandbox-trust channel contract. Vendor-neutral: any spec-following MCP App mounts through it.",
   "license": "MIT",
   "type": "module",

package/src/index.ts

@@ -72,6 +72,10 @@ export {
   TOOLS_CALL_METHOD,
   viewHostElapsed,
   viewHostReceive,
+  diagnoseCspViolation,
+  type CspViolationLike,
+  type ViewCspDiagnosis,
+  type ViewCspOrigins,
   type ViewHostBehavior,
   type ViewHostEffect,
   type ViewHostOutbound,
@@ -85,6 +89,7 @@ export {
   attachViewHost,
   viewDocumentHtml,
   type AttachViewHostConfig,
+  type ViewCspEvents,
   type ViewFrameLike,
   type ViewHostEvents,
 } from "./view-host.js";

package/src/react.tsx

@@ -35,11 +35,11 @@
 import { useEffect, useMemo, useRef, useState, type CSSProperties, type ReactNode } from "react";
 import { attachViewHost, viewDocumentHtml, type AttachViewHostConfig } from "./view-host.js";
 import { attachSandboxPageDelivery } from "./sandbox-page.js";
-import type { ViewHostPhase } from "./view-host-protocol.js";
+import type { ViewCspDiagnosis, ViewHostPhase } from "./view-host-protocol.js";
 import type { ResolvedViewMount } from "./card-mount.js";
 
 export { attachViewHost, viewDocumentHtml } from "./view-host.js";
-export type { AttachViewHostConfig, ViewFrameLike, ViewHostEvents } from "./view-host.js";
+export type { AttachViewHostConfig, ViewCspEvents, ViewFrameLike, ViewHostEvents } from "./view-host.js";
 export {
   attachSandboxPageDelivery,
   isSandboxProxyReady,
@@ -47,7 +47,7 @@ export {
   SANDBOX_RESOURCE_READY_METHOD,
   type SandboxPageDeliveryConfig,
 } from "./sandbox-page.js";
-export type { ViewHostPhase } from "./view-host-protocol.js";
+export type { ViewCspDiagnosis, ViewCspOrigins, ViewHostPhase } from "./view-host-protocol.js";
 export type { ResolvedViewMount, ViewMount, ViewMountChannel } from "./card-mount.js";
 
 /** Accessible name for a mounted view when the caller has nothing better. */
@@ -63,6 +63,8 @@ export interface GuueyViewProps
     | "onReadResource"
     | "onSizeChanged"
     | "negotiationTimeoutMs"
+    | "cspOrigins"
+    | "onCspDiagnosis"
   > {
   /** The resolved card to mount (see `toolResultViewMount`/`resolveViewMount`). */
   mount: ResolvedViewMount;
@@ -119,9 +121,12 @@ export interface GuueyViewProps
    * "render nothing". The default: a quiet "Negotiating with view…" line
    * while `"negotiating"`; a labeled failure for `"no-handshake"` on the
    * `"ggui"` channel; nothing once `"connected"` (the view owns its
-   * pixels) and nothing for a silent `"inline"` card.
+   * pixels) and nothing for a silent `"inline"` card. The second argument
+   * is the CSP diagnosis when the tripwire caught one (see
+   * {@link AttachViewHostConfig.cspOrigins}) — the default label folds it
+   * in; a custom renderer decides how to show it.
    */
-  renderStatus?: (phase: ViewHostPhase) => ReactNode;
+  renderStatus?: (phase: ViewHostPhase, diagnosis?: ViewCspDiagnosis) => ReactNode;
 }
 
 const statusLineStyle: CSSProperties = {
@@ -136,10 +141,25 @@ const statusLineStyle: CSSProperties = {
   pointerEvents: "none",
 };
 
-function defaultStatus(phase: ViewHostPhase, channel: ResolvedViewMount["channel"]): ReactNode {
+function defaultStatus(
+  phase: ViewHostPhase,
+  channel: ResolvedViewMount["channel"],
+  diagnosis: ViewCspDiagnosis | undefined,
+): ReactNode {
   if (phase === "negotiating") {
     return <p style={statusLineStyle}>Negotiating with view…</p>;
   }
+  // A CSP diagnosis (guuey#235) is the WHY behind a silent frame — on any
+  // channel: a blocked runtime bundle never gets to negotiate, so the
+  // tripwire's verdict outranks the channel heuristic below. Actionable
+  // over accurate-but-mute: name the blocked URI and the allowance.
+  if (phase === "no-handshake" && diagnosis !== undefined) {
+    return (
+      <p role="alert" style={{ ...statusLineStyle, opacity: 1, pointerEvents: "auto" }}>
+        {diagnosis.message}
+      </p>
+    );
+  }
   if (phase === "no-handshake" && channel === "ggui") {
     // A ggui shell negotiates unconditionally before painting, so silence
     // here is a boot failure with no other author — label it (role=alert
@@ -173,6 +193,8 @@ export function GuueyView(props: GuueyViewProps): ReactNode {
   } = props;
   const frameRef = useRef<HTMLIFrameElement>(null);
   const [phase, setPhase] = useState<ViewHostPhase>("negotiating");
+  // The CSP tripwire's verdict for THIS document, if any (guuey#235).
+  const [diagnosis, setDiagnosis] = useState<ViewCspDiagnosis | undefined>(undefined);
   // The view's own size report, applied only under `autoResize`.
   const [reportedHeight, setReportedHeight] = useState<number | undefined>(undefined);
   const html = viewDocumentHtml(mount.resource);
@@ -208,6 +230,7 @@ export function GuueyView(props: GuueyViewProps): ReactNode {
     // document boots fresh, and the previous negotiation's phase must not
     // paper over it — nor must the previous document's reported size.
     setPhase("negotiating");
+    setDiagnosis(undefined);
     setReportedHeight(undefined);
     const frame = frameRef.current;
     if (frame === null || html === undefined) return;
@@ -220,6 +243,10 @@ export function GuueyView(props: GuueyViewProps): ReactNode {
         setPhase(next);
         latest.current.onPhaseChange?.(next);
       },
+      onCspDiagnosis: (found) => {
+        setDiagnosis(found);
+        latest.current.hostConfig.onCspDiagnosis?.(found);
+      },
       onSizeChanged: (size) => {
         if (latest.current.autoResize === true && size.height !== undefined) {
           setReportedHeight(size.height);
@@ -308,7 +335,9 @@ export function GuueyView(props: GuueyViewProps): ReactNode {
           border: 0,
         }}
       />
-      {renderStatus !== undefined ? renderStatus(phase) : defaultStatus(phase, mount.channel)}
+      {renderStatus !== undefined
+        ? renderStatus(phase, diagnosis)
+        : defaultStatus(phase, mount.channel, diagnosis)}
     </div>
   );
 }

package/src/view-host-protocol.ts

@@ -39,6 +39,7 @@ import {
   type McpUiHostCapabilities,
   type McpUiHostContext,
   type McpUiInitializeResult,
+  type McpUiResourceCsp,
 } from "@modelcontextprotocol/ext-apps";
 import type { McpToolStructuredContent } from "./action.js";
 import type { McpResourceReadResult } from "./reader.js";
@@ -398,3 +399,104 @@ export function viewHostReceive(
 export function viewHostElapsed(state: ViewHostState): ViewHostState {
   return state.phase === "negotiating" ? { ...state, phase: "no-handshake" } : state;
 }
+
+// ─── CSP diagnosis (guuey#235) ────────────────────────────────────────────
+
+/**
+ * The origins a view needs the EMBEDDER's page to allow — the spec's own
+ * per-resource CSP declaration (`McpUiResourceCsp`: `connectDomains` →
+ * `connect-src`, `resourceDomains` → `script-src`/`style-src`/…,
+ * `frameDomains` → `frame-src`). This is the honest filter for the CSP
+ * tripwire: a `securitypolicyviolation` whose `blockedURI` lands on one of
+ * these hosts is a violation ABOUT the view, not about anything else the
+ * page loads. Empty/absent → nothing to match, tripwire inert.
+ */
+export type ViewCspOrigins = McpUiResourceCsp;
+
+/**
+ * What the embedder can act on when its own CSP blocked the view: the
+ * URI the browser refused, the directive that refused it, and the entry
+ * that would allow it (the blocked URI's origin — the smallest allowance
+ * that fixes exactly this). Rides beside `"no-handshake"` — the phase
+ * stays honest ("it never negotiated"); this is WHY.
+ */
+export interface ViewCspDiagnosis {
+  blockedUri: string;
+  violatedDirective: string;
+  /** The origin to add under `violatedDirective` — e.g. `https://assets.mcp.example`. */
+  suggestedEntry: string;
+  /** Operator-facing sentence, ready to label. */
+  message: string;
+}
+
+/**
+ * The slice of a `SecurityPolicyViolationEvent` the tripwire reads —
+ * structural, so Node tests hand in plain objects (lib.dom's class is not
+ * constructible outside a browser).
+ */
+export interface CspViolationLike {
+  blockedURI: string;
+  /** e.g. `script-src-elem`, `connect-src`. */
+  violatedDirective: string;
+  /** The directive as the policy spelled it (`script-src` may govern `script-src-elem`). */
+  effectiveDirective?: string;
+}
+
+/** Every declared origin's HOST, wildcards (`https://*.x`) reduced to their suffix. */
+function declaredHosts(origins: ViewCspOrigins): { host: string; wildcard: boolean }[] {
+  const out: { host: string; wildcard: boolean }[] = [];
+  for (const list of [origins.connectDomains, origins.resourceDomains, origins.frameDomains]) {
+    for (const entry of list ?? []) {
+      // `https://*.example.com` → wildcard suffix `.example.com`
+      const wildcard = /^[a-z]+:\/\/\*\./i.exec(entry);
+      if (wildcard) {
+        out.push({ host: entry.slice(wildcard[0].length - 1).toLowerCase(), wildcard: true });
+        continue;
+      }
+      try {
+        out.push({ host: new URL(entry).hostname.toLowerCase(), wildcard: false });
+      } catch {
+        // A malformed declaration is producer-side wire data; it simply
+        // never matches. The tripwire only ever ADDS a diagnosis, never
+        // blocks, so there is nothing to guard.
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Pure: is this violation ABOUT the view (its blocked URI lands on a
+ * declared origin), and if so, what should the embedder add?
+ *
+ * `blockedURI` is a full URL for network/script blocks; the browser sends
+ * bare tokens (`eval`, `inline`, `data`) for policy-class blocks — those
+ * carry no host and never match a declared origin, which is right: a
+ * `script-src eval` report is not the view's (see guuey#236 for the zod
+ * probe that produces exactly one such report at boot).
+ */
+export function diagnoseCspViolation(
+  violation: CspViolationLike,
+  origins: ViewCspOrigins | undefined,
+): ViewCspDiagnosis | undefined {
+  if (origins === undefined) return undefined;
+  let blocked: URL;
+  try {
+    blocked = new URL(violation.blockedURI);
+  } catch {
+    return undefined; // bare token (eval/inline/data/…) — not a host, not the view's
+  }
+  const host = blocked.hostname.toLowerCase();
+  const hit = declaredHosts(origins).some((d) =>
+    d.wildcard ? host.endsWith(d.host) : host === d.host,
+  );
+  if (!hit) return undefined;
+  const directive = violation.effectiveDirective || violation.violatedDirective;
+  const suggestedEntry = blocked.origin;
+  return {
+    blockedUri: violation.blockedURI,
+    violatedDirective: directive,
+    suggestedEntry,
+    message: `This page's Content-Security-Policy blocks ${violation.blockedURI} (${directive}) — the view cannot start. Add \`${directive} ${suggestedEntry}\` to the page's policy.`,
+  };
+}

package/src/view-host.ts

@@ -28,12 +28,16 @@
  * re-derived here against the pure machine + our own tests.
  */
 import {
+  diagnoseCspViolation,
   initialViewHostState,
   resourceReadResponse,
   teardownMessage,
   toolCallResponse,
   viewHostElapsed,
   viewHostReceive,
+  type CspViolationLike,
+  type ViewCspDiagnosis,
+  type ViewCspOrigins,
   type ViewHostBehavior,
   type ViewHostOutbound,
   type ViewHostPhase,
@@ -74,6 +78,16 @@ export interface ViewHostEvents {
   ): void;
 }
 
+/**
+ * Where CSP violations are observed — the EMBEDDING document (the frame's
+ * blocked loads report there, not inside the opaque frame). Structural like
+ * {@link ViewHostEvents}, injectable for tests. Default: `document`.
+ */
+export interface ViewCspEvents {
+  addEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+  removeEventListener(type: "securitypolicyviolation", listener: (event: CspViolationLike) => void): void;
+}
+
 export interface AttachViewHostConfig {
   /**
    * Capabilities to advertise in the initialize result. Default: `{}` —
@@ -130,6 +144,41 @@ export interface AttachViewHostConfig {
   onSizeChanged?: (size: { width?: number; height?: number }) => void;
   /** Observe phase transitions (see {@link ViewHostPhase}). */
   onPhaseChange?: (phase: ViewHostPhase) => void;
+  /**
+   * The origins this view needs the embedding PAGE's CSP to allow — the
+   * spec's per-resource declaration (`McpUiResourceCsp`). Given, the host
+   * arms a CSP tripwire for the attachment's lifetime: a
+   * `securitypolicyviolation` on the EMBEDDING document whose blocked URI
+   * lands on one of these hosts is upgraded from a silent "never
+   * negotiated" into an actionable {@link ViewCspDiagnosis} (guuey#235).
+   * The phase itself stays `"no-handshake"` — honest about WHAT happened;
+   * the diagnosis says WHY. Absent → tripwire not installed, zero behavior
+   * change (the default for every existing caller).
+   *
+   * REACH (pinned by the browser leg, `e2e/tests/sdk/view-host.spec.ts`):
+   * the listener lives on the embedding document, so it sees violations
+   * the PAGE incurs on the view's origins — a runtime bundle the page
+   * loads at page level, a live channel the page opens on the view's
+   * behalf (the shape ggui's landing tripwire exercised). It does NOT see
+   * a `srcdoc` view's own blocked loads: the frame inherits the page's
+   * policy, but the browser enforces that copy in — and dispatches the
+   * violation on — the FRAME's document, which is opaque-origin and cannot
+   * be listened to from outside. A frame-side reporter would need host
+   * script injected into untrusted view HTML, a trust-boundary change this
+   * primitive deliberately does not make; the `sandboxPageUrl` mount owns
+   * its own policy and reports nothing here by construction.
+   */
+  cspOrigins?: ViewCspOrigins;
+  /**
+   * A CSP violation ABOUT this view was observed (see {@link cspOrigins}).
+   * Fires at most once per attachment, as soon as the violation lands —
+   * typically BEFORE the negotiation window lapses, since a blocked runtime
+   * never gets to negotiate. `<GuueyView>` folds it into the no-handshake
+   * label; a custom renderer shows/logs it as it likes.
+   */
+  onCspDiagnosis?: (diagnosis: ViewCspDiagnosis) => void;
+  /** CSP-violation event source, injectable for tests. Default: `document`. */
+  cspEvents?: ViewCspEvents;
   /**
    * How long to wait for `ui/initialize` before declaring
    * `"no-handshake"` (ms). `0` disables the timer. Default 8000 — a view
@@ -270,6 +319,33 @@ export function attachViewHost(frame: ViewFrameLike, config: AttachViewHostConfi
   };
   const unsubscribe = subscribe();
 
+  // The CSP tripwire (guuey#235): armed only when the caller declared the
+  // view's origins — with none, there is nothing to match and nothing is
+  // installed. It only ever ADDS a diagnosis; it never changes what the
+  // machine does. Once per attachment: the first violation about the view
+  // is the diagnosis (later ones are the same failure repeating).
+  const unsubscribeCsp = ((): (() => void) => {
+    const { cspOrigins, onCspDiagnosis } = config;
+    if (cspOrigins === undefined) return () => {};
+    let reported = false;
+    const onViolation = (event: CspViolationLike): void => {
+      if (reported) return;
+      const diagnosis = diagnoseCspViolation(event, cspOrigins);
+      if (diagnosis === undefined) return;
+      reported = true;
+      onCspDiagnosis?.(diagnosis);
+    };
+    const { cspEvents } = config;
+    if (cspEvents !== undefined) {
+      cspEvents.addEventListener("securitypolicyviolation", onViolation);
+      return () => cspEvents.removeEventListener("securitypolicyviolation", onViolation);
+    }
+    if (typeof document === "undefined") return () => {}; // no embedding document — nothing reports there
+    const domListener = (event: SecurityPolicyViolationEvent): void => onViolation(event);
+    document.addEventListener("securitypolicyviolation", domListener);
+    return () => document.removeEventListener("securitypolicyviolation", domListener);
+  })();
+
   const timeoutMs = config.negotiationTimeoutMs ?? DEFAULT_NEGOTIATION_TIMEOUT_MS;
   const timer =
     timeoutMs > 0 ? setTimeout(() => setState(viewHostElapsed(state)), timeoutMs) : undefined;
@@ -277,6 +353,7 @@ export function attachViewHost(frame: ViewFrameLike, config: AttachViewHostConfi
   return () => {
     if (timer !== undefined) clearTimeout(timer);
     unsubscribe();
+    unsubscribeCsp();
     cachedWindow?.postMessage(teardownMessage(), "*");
   };
 }