@m6d/cortex-angular 1.3.0 → 1.4.1

package/README.md

@@ -27,16 +27,17 @@ No root-level providers needed — each widget instance is fully self-contained.
 
 ### Configuration
 
-| Property               | Type                            | Description                                             |
-| ---------------------- | ------------------------------- | ------------------------------------------------------- |
-| `locale`               | `Signal<string>`                | Active locale (`"en"`, `"ar"`)                          |
-| `transport.baseUrl`    | `string \| Signal<string>`      | Agent API base URL                                      |
-| `transport.getHeaders` | `() => Record<string, string>`  | Request headers provider                                |
-| `wsUrl`                | `string`                        | WebSocket URL for real-time events (optional)           |
-| `theme`                | `CortexClientTheme`             | `'light' \| 'dark' \| 'system'` (default: `'light'`)    |
-| `showDebugButton`      | `boolean`                       | Show/hide the debug toggle button (default: `false`)    |
-| `toolComponents`       | `Record<string, Type<unknown>>` | Custom Angular components for tool rendering (optional) |
-| `onToolCall`           | `(toolCall) => unknown`         | Client-side tool call handler (optional)                |
+| Property                | Type                            | Description                                                                     |
+| ----------------------- | ------------------------------- | ------------------------------------------------------------------------------- |
+| `locale`                | `Signal<string>`                | Active locale (`"en"`, `"ar"`)                                                  |
+| `transport.baseUrl`     | `string \| Signal<string>`      | Agent API base URL                                                              |
+| `transport.getHeaders`  | `() => Record<string, string>`  | Request headers provider                                                        |
+| `wsUrl`                 | `string`                        | WebSocket URL for real-time events (optional)                                   |
+| `theme`                 | `CortexClientTheme`             | `'light' \| 'dark' \| 'system'` (default: `'light'`)                            |
+| `showDebugButton`       | `boolean`                       | Show/hide the debug toggle button (default: `false`)                            |
+| `toolComponents`        | `Record<string, Type<unknown>>` | Custom Angular components for tool rendering (optional)                         |
+| `onToolCall`            | `(toolCall) => unknown`         | Client-side tool call handler (optional)                                        |
+| `trustSameOriginEmbeds` | `boolean`                       | Allow embedded tool pages served from this page's own origin (default: `false`) |
 
 `transport.getHeaders` can return any request headers needed by the host app. WebSocket auth continues to derive the `token` query param from a bearer `Authorization` header when present.
 
@@ -48,7 +49,13 @@ initiate, shows the returned page in a sandboxed iframe (inline card or
 modal, per tool config), and submits the page's `cortex:client-tool`
 postMessage outcome back to the run as-is — anything that must actually be
 true lives in the integrating backend's own records. No widget configuration
-is needed; other pending tool calls keep the existing `toolComponents` /
+is needed. One caveat: an embed served from the host page's **own origin** is
+refused by default, because a same-origin iframe cannot be sandboxed — it
+could reach into the host page, and embed URLs come from Control Center tool
+config, whose administrator is not necessarily the site owner. When both are
+the same party and the embeds are the site's own pages, set
+`trustSameOriginEmbeds: true` to render them anyway (with full access, as any
+of the site's own pages has). Other pending tool calls keep the existing `toolComponents` /
 `hooks.onToolCall` behavior. That hook is also how static client tools work:
 declare an executor-less tool in the server config and answer it here by
 returning its output from `hooks.onToolCall` for that tool name. Consumer `hooks.onToolCall` implementations must

package/fesm2022/m6d-cortex-angular.mjs

@@ -483,14 +483,22 @@ function parseClientToolHandshake(data, origin, embedOrigin) {
 }
 
 // src/internal/client/src/client-tools.ts
-function embedSandbox(embedUrl, pageOrigin) {
+function embedSandbox(embedUrl, pageOrigin, trustSameOrigin) {
   const base = "allow-scripts allow-forms allow-popups";
   try {
-    return new URL(embedUrl).origin === pageOrigin ? base : `${base} allow-same-origin`;
+    const sameOrigin = new URL(embedUrl).origin === pageOrigin;
+    return sameOrigin && !trustSameOrigin ? base : `${base} allow-same-origin`;
   } catch {
     return base;
   }
 }
+function embedTrustedOnHostOrigin(embedUrl, pageOrigin, trustSameOrigin) {
+  try {
+    return trustSameOrigin === true && new URL(embedUrl).origin === pageOrigin;
+  } catch {
+    return false;
+  }
+}
 function frameBreachedHostOrigin(frame, pageOrigin) {
   try {
     return frame.contentWindow?.location.origin === pageOrigin;
@@ -1468,9 +1476,11 @@ class CortexChatService {
     return this.threadService.delete(threadId);
   }
   mountChat(thread, mode) {
+    const initialMessages = mode === "reload" ? this.chat()?.messages() : undefined;
     this.chatInjector?.destroy();
     this.dispatchedToolCalls.clear();
-    this.messageMetadata.set(new Map);
+    if (mode !== "reload")
+      this.messageMetadata.set(new Map);
     this.ownsRun = false;
     this.serverAnswered = false;
     this.wasAborted = false;
@@ -1481,6 +1491,7 @@ class CortexChatService {
       const chat = injectChat({
         threadId: thread.id,
         persistence: true,
+        initialMessages,
         connection: this.createConnection(thread, mode, injector),
         onChunk: () => {
           this.serverAnswered = true;
@@ -3464,8 +3475,10 @@ class ClientToolEmbedComponent {
   }, ...ngDevMode ? [{ debugName: "isModal" }] : []);
   sandbox = computed(() => {
     const state = this.state();
-    return state.phase === "embedded" ? embedSandbox(state.embedUrl, window.location.origin) : "";
+    return state.phase === "embedded" ? embedSandbox(state.embedUrl, window.location.origin, this.trustSameOriginEmbeds) : "";
   }, ...ngDevMode ? [{ debugName: "sandbox" }] : []);
+  config = inject(CORTEX_CLIENT_CONFIG);
+  trustSameOriginEmbeds;
   api = inject(CortexApiClient);
   chatService = inject(CortexChatService);
   sanitizer = inject(DomSanitizer);
@@ -3486,6 +3499,7 @@ class ClientToolEmbedComponent {
     });
   }
   ngOnInit() {
+    this.trustSameOriginEmbeds = this.config().trustSameOriginEmbeds;
     const threadId = this.chatService.selectedThread()?.id;
     const part = this.toolCallPart();
     if (!threadId) {
@@ -3516,7 +3530,11 @@ class ClientToolEmbedComponent {
     const frame = event.target;
     if (!(frame instanceof HTMLIFrameElement))
       return;
-    if (frameBreachedHostOrigin(frame, window.location.origin)) {
+    const state = this.state();
+    if (state.phase !== "embedded")
+      return;
+    const trusted = embedTrustedOnHostOrigin(state.embedUrl, window.location.origin, this.trustSameOriginEmbeds);
+    if (!trusted && frameBreachedHostOrigin(frame, window.location.origin)) {
       this.embed?.terminate();
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@m6d/cortex-angular",
-  "version": "1.3.0",
+  "version": "1.4.1",
   "description": "Reusable AI agent chat UI library for Angular",
   "license": "MIT",
   "sideEffects": false,

package/types/m6d-cortex-angular.d.ts

@@ -106,6 +106,16 @@ export type CortexConfig = {
 	/** Color scheme; `'system'` follows the OS preference. Defaults to `'light'`. */
 	theme?: CortexTheme;
 	showDebugButton?: boolean;
+	/**
+	 * Render embedded tool pages served from this page's own origin with their
+	 * full identity — which, same-origin, means no effective sandbox at all: such
+	 * an embed can reach into the host page. By default they are refused
+	 * (rendered inert), because embed URLs come from Control Center tool config,
+	 * and whoever administers that is not necessarily whoever owns this site.
+	 * Enable only when both are the same party and the embeds are this site's
+	 * own pages — then a second origin just for embeds is no longer needed.
+	 */
+	trustSameOriginEmbeds?: boolean;
 	hooks?: CortexHooks;
 };
 export type QueuedAttachment = {