@jini-ai/ui 0.6.22 → 0.6.23

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.6.23
+
+- Security hardening.
+
 # @jini-ai/ui
 
 ## 0.6.22

package/dist/features/mcp-ui/secret-card.js

@@ -15,7 +15,7 @@ import { buildOutcomeSurface } from './surfaces/outcome.js';
 /** Reject ambiguous or protocol-reserved names and runtime attempts to prefill secrets.
  * @complexity O(n) time/space in the field count. Throws fixed ToolInputError text only. */
 function checkedFields(form) {
-    const names = new Set([SURFACE_EXCHANGE_ID_PARAM, SURFACE_DISMISSED_PARAM, SURFACE_TYPED_ANSWER_PARAM]);
+    const names = new Set([SURFACE_EXCHANGE_ID_PARAM, SURFACE_DISMISSED_PARAM, SURFACE_TYPED_ANSWER_PARAM, 'freeText']);
     for (const field of form.fields) {
         if (!field.name || names.has(field.name))
             throw new ToolInputError({ message: 'Secret card field names must be unique and cannot use exchange parameters.' });
@@ -36,6 +36,9 @@ function answerStep(required) {
         return { run: { status: answer.status } };
     if (answer.params[SURFACE_DISMISSED_PARAM] === true)
         return { run: { status: 'cancelled' } };
+    // Composer answers are displayed as chat text, never accepted as secret form submissions.
+    if (Object.hasOwn(answer.params, SURFACE_TYPED_ANSWER_PARAM))
+        return { run: { status: 'cancelled' } };
     return { params: answer.params };
 }
 /** The exact submitted secret, or undefined when it is blank or malformed.

package/dist/features/mcp-ui/surfaces/confirmation.js

@@ -137,7 +137,7 @@ function confirmationBodyHtml(spec, required) {
         renderChoices(spec.choices ?? []),
         warning,
         // Confirm starts disabled; the script enables it once the dwell has run out.
-        renderActions(confirmationActions(spec).map((action) => (affirmative.has(action.id) ? { ...action, disabled: true } : action))),
+        renderActions(confirmationActions(spec).map((action) => (affirmative.has(action.id) ? { ...action, disabled: true } : action)), { humanOnly: true }),
         renderStatusRegion(),
     ]
         .filter((fragment) => fragment !== '')

package/dist/features/mcp-ui/surfaces/document.d.ts

@@ -179,16 +179,26 @@ export interface SurfaceAction {
  * `script-src 'unsafe-inline'`-equivalent allowance for attributes specifically, and a host is free
  * to apply a stricter CSP to the frame than this package can see.
  *
- * Each button also carries the `@jini-ai/agentic` `data-agent-*` markup convention
+ * Ordinary buttons also carry the `@jini-ai/agentic` `data-agent-*` markup convention
  * ({@link AGENT_ELEMENT_ATTRIBUTE} et al.) — but this tagging is advisory, not the thing that makes
  * a surface's actions reachable by `page.find_elements`/`page.click`. Those capabilities resolve a
  * handle by scanning `document`/`contentDocument`, and this document renders inside a `srcdoc`
  * iframe sandboxed to `allow-scripts` alone (`MCP_UI_VIEW_SANDBOX` — no `allow-same-origin`,
  * deliberately), which gives it an opaque origin no ancestor document can read into. So this tagging
  * is real for a driver that reaches INTO the frame directly — `frameLocator` in Playwright, proven
- * end to end against exactly this markup — and inert for anything scanning the parent page. Making a
- * surface's actions visible to `page.find_elements` needs a second, parent-DOM-side echo of this
- * same action list; see `McpUiSurfaceCard` in `@jini-ai/chat` for that half.
+ * end to end against exactly this markup — and inert for anything scanning the parent page. Making an
+ * ordinary surface's actions visible to `page.find_elements` needs a second, parent-DOM-side echo
+ * of that action list. Human-only decisions are intentionally excluded from addressing even
+ * inside the frame: confirmation buttons are private and their runtime still requires trusted clicks.
+ *
+ * @param actions - Action descriptions; the legacy array argument is retained for caller compatibility.
+ * @param options - Human-only rows omit agent addressing and mark every decision private.
+ * @returns Escaped HTML without executing actions or changing their runtime click gates.
+ * @complexity O(n) time and space in the emitted markup length.
+ * @overallScore 98/100
+ * @qualityFindings Low: The legacy array-first signature remains a compatibility exception to object arguments.
  */
-export declare function renderActions(actions: readonly SurfaceAction[]): string;
+export declare function renderActions(actions: readonly SurfaceAction[], { humanOnly }?: {
+    humanOnly?: boolean;
+}): string;
 //# sourceMappingURL=document.d.ts.map

package/dist/features/mcp-ui/surfaces/document.js

@@ -11,7 +11,7 @@
  * builders because the CSS that styles them lives here — splitting the markup from the only
  * stylesheet that can reach it is how a "generic" fragment quietly becomes unstyled in one caller.
  */
-import { AGENT_ELEMENT_ATTRIBUTE, AGENT_LABEL_ATTRIBUTE, AGENT_ROLE_ATTRIBUTE } from '@jini-ai/agentic';
+import { AGENT_ELEMENT_ATTRIBUTE, AGENT_LABEL_ATTRIBUTE, AGENT_PRIVATE_ATTRIBUTE, AGENT_ROLE_ATTRIBUTE } from '@jini-ai/agentic';
 import { escapeHtml } from '../escape.js';
 import { SURFACE_BRIDGE_GLOBAL, renderBridgeScript } from './bridge.js';
 import { renderTokenBlock } from './tokens.js';
@@ -429,18 +429,26 @@ export function fieldDescribedBy(spec) {
  * `script-src 'unsafe-inline'`-equivalent allowance for attributes specifically, and a host is free
  * to apply a stricter CSP to the frame than this package can see.
  *
- * Each button also carries the `@jini-ai/agentic` `data-agent-*` markup convention
+ * Ordinary buttons also carry the `@jini-ai/agentic` `data-agent-*` markup convention
  * ({@link AGENT_ELEMENT_ATTRIBUTE} et al.) — but this tagging is advisory, not the thing that makes
  * a surface's actions reachable by `page.find_elements`/`page.click`. Those capabilities resolve a
  * handle by scanning `document`/`contentDocument`, and this document renders inside a `srcdoc`
  * iframe sandboxed to `allow-scripts` alone (`MCP_UI_VIEW_SANDBOX` — no `allow-same-origin`,
  * deliberately), which gives it an opaque origin no ancestor document can read into. So this tagging
  * is real for a driver that reaches INTO the frame directly — `frameLocator` in Playwright, proven
- * end to end against exactly this markup — and inert for anything scanning the parent page. Making a
- * surface's actions visible to `page.find_elements` needs a second, parent-DOM-side echo of this
- * same action list; see `McpUiSurfaceCard` in `@jini-ai/chat` for that half.
+ * end to end against exactly this markup — and inert for anything scanning the parent page. Making an
+ * ordinary surface's actions visible to `page.find_elements` needs a second, parent-DOM-side echo
+ * of that action list. Human-only decisions are intentionally excluded from addressing even
+ * inside the frame: confirmation buttons are private and their runtime still requires trusted clicks.
+ *
+ * @param actions - Action descriptions; the legacy array argument is retained for caller compatibility.
+ * @param options - Human-only rows omit agent addressing and mark every decision private.
+ * @returns Escaped HTML without executing actions or changing their runtime click gates.
+ * @complexity O(n) time and space in the emitted markup length.
+ * @overallScore 98/100
+ * @qualityFindings Low: The legacy array-first signature remains a compatibility exception to object arguments.
  */
-export function renderActions(actions) {
+export function renderActions(actions, { humanOnly = false } = {}) {
     const buttons = actions
         .map((action) => {
         const variant = action.variant ?? 'neutral';
@@ -454,7 +462,9 @@ export function renderActions(actions) {
         // would accept. That is unenforced on purpose (see the function doc above: `page.find_elements`
         // can never reach this document to resolve it either way), so failing loudly here would refuse
         // markup for a reason that can never matter to the one consumer that can actually query it.
-        return `  <button type="${action.type ?? 'button'}" class="mcpui-button${variantClass}" data-mcpui-action="${escapeHtml(action.id)}" ${AGENT_ELEMENT_ATTRIBUTE}="mcpui-action-${escapeHtml(action.id)}" ${AGENT_ROLE_ATTRIBUTE}="button" ${AGENT_LABEL_ATTRIBUTE}="${label}"${action.disabled === true ? ' disabled' : ''}>${label}</button>`;
+        const addressing = humanOnly ? AGENT_PRIVATE_ATTRIBUTE
+            : `${AGENT_ELEMENT_ATTRIBUTE}="mcpui-action-${escapeHtml(action.id)}" ${AGENT_ROLE_ATTRIBUTE}="button" ${AGENT_LABEL_ATTRIBUTE}="${label}"`;
+        return `  <button type="${action.type ?? 'button'}" class="mcpui-button${variantClass}" data-mcpui-action="${escapeHtml(action.id)}" ${addressing}${action.disabled === true ? ' disabled' : ''}>${label}</button>`;
     })
         .join('\n');
     return `<div class="mcpui-actions">\n${buttons}\n</div>`;

package/dist/react/components/SecretInput.d.ts

@@ -1,7 +1,8 @@
 import type { InputHTMLAttributes, TextareaHTMLAttributes } from 'react';
 /**
  * @file The shared masked input: a password/token/key `<input>` with an eye toggle inside its right
- * edge. Drop-in for `<input type="password">` — every other input prop passes straight through.
+ * edge. Drop-in for `<input type="password">` — ordinary input props pass through; agent
+ * addressing is excluded and privacy remains enforced after reveal.
  *
  * Same markup and classes as `@jini-ai/ui-kit`'s password `TextField` and the mcp-ui secret fields
  * (`.jini-secret` / `.jini-secret-toggle`), so one host stylesheet styles all of them; hosts own
@@ -25,7 +26,7 @@ interface SecretToggleProps {
         readonly show: string;
         readonly hide: string;
     };
-    /** Extra attributes for the toggle button, e.g. an agent handle. */
+    /** Extra ordinary attributes for the toggle button; agent addressing is always excluded. */
     readonly toggleAttrs?: Readonly<Record<string, string | boolean | undefined>>;
     /** Controlled mode: the host owns the shown/hidden state. */
     readonly revealed?: boolean;

package/dist/react/components/SecretInput.js

@@ -1,16 +1,19 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { forwardRef } from 'react';
 import { SecretInput as KitSecretInput } from '@jini-ai/ui-kit/react';
+import { secretControlAttrs } from '@jini-ai/ui-kit';
 import { useT } from '../../features/i18n/index.js';
 import { Icon } from './Icon.js';
 import { useSecretReveal } from './SecretInput.hooks.js';
-/** Reveal state + the eye button, shared by `SecretInput` and `SecretTextarea`. */
+/** Reveal state + the private eye button, shared by `SecretInput` and `SecretTextarea`.
+ * @complexity O(p) time and space in toggle props; no I/O.
+ * @overallScore 100 */
 function useSecretToggle({ label, toggleLabels, toggleAttrs, revealed, onRevealedChange }, { value, disabled } = {}) {
     const t = useT();
     const reveal = useSecretReveal({ value, labels: toggleLabels ?? { show: `${t('Show')} ${label}`, hide: `${t('Hide')} ${label}` } }, { ...(revealed === undefined ? {} : { revealed }), ...(onRevealedChange ? { onRevealedChange } : {}) });
     // One signal only: the name flips Show/Hide, so no `aria-pressed` — both together made screen
     // readers announce "Hide API key, toggle button, pressed" (Opus UI review 2026-10-26).
-    const button = (_jsx("button", { ...toggleAttrs, type: "button", className: "jini-secret-toggle", "aria-label": reveal.toggleLabel, title: reveal.toggleLabel, disabled: disabled, onClick: reveal.toggle, children: _jsx(Icon, { name: reveal.revealed ? 'eye-off' : 'eye', size: 18 }) }));
+    const button = (_jsx("button", { ...secretControlAttrs({ attrs: toggleAttrs ?? {} }), type: "button", className: "jini-secret-toggle", "aria-label": reveal.toggleLabel, title: reveal.toggleLabel, disabled: disabled, onClick: reveal.toggle, children: _jsx(Icon, { name: reveal.revealed ? 'eye-off' : 'eye', size: 18 }) }));
     return { reveal, button };
 }
 export const SecretInput = forwardRef(function SecretInput(props, ref) {
@@ -26,6 +29,6 @@ export const SecretTextarea = forwardRef(function SecretTextarea(props, ref) {
     /* Not a standard CSS property, so it is set here rather than left to a host stylesheet: a host
        that forgot it would show the secret in clear text. pre-wrap keeps line breaks while masked. */
     const masked = { ...style, ...{ WebkitTextSecurity: reveal.revealed || replacementShown ? 'none' : 'disc' }, whiteSpace: 'pre-wrap' };
-    return (_jsxs("span", { className: "jini-secret jini-secret--multiline", children: [_jsx("textarea", { ...textareaProps, ...(replacementShown ? { value: maskedValue, readOnly: true } : {}), spellCheck: false, ref: ref, style: masked }), button] }));
+    return (_jsxs("span", { className: "jini-secret jini-secret--multiline", children: [_jsx("textarea", { ...secretControlAttrs({ attrs: textareaProps }), ...(replacementShown ? { value: maskedValue, readOnly: true } : {}), spellCheck: false, ref: ref, style: masked }), button] }));
 });
 //# sourceMappingURL=SecretInput.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jini-ai/ui",
-  "version": "0.6.22",
+  "version": "0.6.23",
   "description": "Generic, product-neutral React UI primitives and feature domains. Framework-free types, decision rules, catalogs, and host port contracts live behind ./core (no React, no DOM). The Excalidraw and Lexical editors live behind ./sketch-editor and ./lexical-rich-text-editor; the GrapesJS-backed inline HTML editor lives behind ./html-editor.",
   "license": "Apache-2.0",
   "repository": {
@@ -263,19 +263,19 @@
     "shiki": "^1.24.4",
     "tailwind-merge": "^2.6.0",
     "zod": "^3.25.76",
-    "@jini-ai/platform": "^0.6.22",
-    "@jini-ai/agent-runtime": "^0.6.22",
+    "@jini-ai/agent-runtime": "^0.6.23",
+    "@jini-ai/agentic": "^0.6.23",
     "@jini-ai/integrations": "^0.6.19",
-    "@jini-ai/agentic": "^0.6.19",
-    "@jini-ai/core": "^0.6.22"
+    "@jini-ai/core": "^0.6.23",
+    "@jini-ai/platform": "^0.6.23"
   },
   "dependencies": {
     "micromark": "^4.0.0",
     "micromark-extension-gfm": "^3.0.0",
-    "@jini-ai/core": "^0.6.22",
-    "@jini-ai/ui-kit": "^0.6.19",
-    "@jini-ai/agentic": "^0.6.19",
-    "@jini-ai/platform": "^0.6.22"
+    "@jini-ai/ui-kit": "^0.6.23",
+    "@jini-ai/core": "^0.6.23",
+    "@jini-ai/platform": "^0.6.23",
+    "@jini-ai/agentic": "^0.6.23"
   },
   "peerDependencies": {
     "@tanstack/react-query": "^5.0.0",