@noodleseed/assistant 1.25.0 → 1.25.1

package/README.md

@@ -35,8 +35,8 @@ troubleshooting) lives at <https://docs.noodleseed.dev/guides/embedded-assistant
 the server itself is `@noodleseed/one` (`npm install -g @noodleseed/one`).
 
 If your page sends a `Content-Security-Policy`, allow the Noodle service origin in `connect-src` (turns and
-event streams) and the exact session-advertised `endpoints.sandbox` origin in `frame-src` (it may be a
-dedicated sandbox origin, so your `script-src` can stay strict). Details are in the guide's
+event streams) **and** `frame-src` (app widgets render inside a hosted sandbox document served from the
+service origin, `endpoints.sandbox`, so your `script-src` can stay strict). Details are in the guide's
 "Content-Security-Policy on your page" section.
 
 ## Quick start
@@ -410,8 +410,13 @@ import "@noodleseed/assistant/app-view";
 </template>
 ```
 
-Framework setup, lifecycle ownership, sandbox/CSP behavior, and staged diagnostics are owned by the
-[Bring your own UI guide](https://docs.noodleseed.dev/docs/guides/bring-your-own-ui).
+Configure Vue's `isCustomElement` for `noodle-app-view`. Angular uses the same element with `[client]`,
+`[view]`, and `[theme]` property bindings. Do not serialize `client` or `view` into attributes.
+
+`<noodle-app-view>` is the canonical host; `NoodleAppView` delegates to it. Both use the
+service-advertised sandbox URL, route App calls through the supplied client, publish theme changes without
+replacing the iframe, and request standard teardown on semantic replacement, disconnect, or an App teardown
+request.
 
 The App document owns its action intent: it calls standard `tools/call` after connecting and never relies on
 native form navigation. If that call needs input or confirmation, the same `client` publishes the normal

package/dist/{app-view-element-BM4lral-.d.ts → app-view-element-BNkQab1B.d.ts}

@@ -2,9 +2,8 @@ import { A as AssistantClient, a as AssistantViewAvailableDetail, e as Assistant
 
 declare const APP_VIEW_TAG_NAME = "noodle-app-view";
 interface AssistantAppViewErrorDetail {
-    readonly code: 'view_render_timeout' | 'view_bridge_error';
+    readonly code: 'view_render_timeout';
     readonly retryable: false;
-    readonly stage: 'sandbox_load' | 'sandbox_proxy' | 'app_initialize';
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/{app-view-element-9ojWWYov.d.cts → app-view-element-DhuiNW_x.d.cts}

@@ -2,9 +2,8 @@ import { A as AssistantClient, a as AssistantViewAvailableDetail, e as Assistant
 
 declare const APP_VIEW_TAG_NAME = "noodle-app-view";
 interface AssistantAppViewErrorDetail {
-    readonly code: 'view_render_timeout' | 'view_bridge_error';
+    readonly code: 'view_render_timeout';
     readonly retryable: false;
-    readonly stage: 'sandbox_load' | 'sandbox_proxy' | 'app_initialize';
 }
 declare global {
     interface HTMLElementTagNameMap {

package/dist/app-view.cjs

@@ -17922,15 +17922,6 @@ var E = class {
   sessionId;
   setProtocolVersion;
 };
-function AZ(X) {
-  if (!X) return "";
-  let Y = [];
-  if (X.camera) Y.push("camera");
-  if (X.microphone) Y.push("microphone");
-  if (X.geolocation) Y.push("geolocation");
-  if (X.clipboardWrite) Y.push("clipboard-write");
-  return Y.join("; ");
-}
 var KX = [j];
 var DX = class extends _ {
   _client;
@@ -18201,131 +18192,34 @@ function GX(X, Y) {
   return JSON.stringify(X) === JSON.stringify(Y);
 }
 
-// src/app-sandbox-policy.ts
-var MAX_DOMAINS_PER_DIRECTIVE = 32;
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isLoopback(hostname3) {
-  return hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "[::1]";
-}
-function normalizeDomain(value, connect) {
-  if (value.length > 512 || /[;\r\n'"\s]/u.test(value)) return void 0;
-  try {
-    const parsed = new URL(value);
-    const secure = parsed.protocol === "https:" || connect && parsed.protocol === "wss:";
-    const local = isLoopback(parsed.hostname) && (parsed.protocol === "http:" || connect && parsed.protocol === "ws:");
-    if (!secure && !local) return void 0;
-    if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      return void 0;
-    }
-    return parsed.origin;
-  } catch {
-    return void 0;
-  }
-}
-function normalizeDomains(values, connect) {
-  const normalized = [
-    ...new Set(
-      values.slice(0, MAX_DOMAINS_PER_DIRECTIVE).map((value) => typeof value === "string" ? normalizeDomain(value, connect) : void 0).filter((value) => value !== void 0)
-    )
-  ];
-  return normalized;
-}
-function resolveAssistantAppSandboxPolicy(resourceMeta) {
-  if (!isRecord(resourceMeta)) return {};
-  const rawCsp = resourceMeta.csp;
-  const csp = isRecord(rawCsp) ? {
-    ...Array.isArray(rawCsp.connectDomains) ? { connectDomains: normalizeDomains(rawCsp.connectDomains, true) } : {},
-    ...Array.isArray(rawCsp.resourceDomains) ? { resourceDomains: normalizeDomains(rawCsp.resourceDomains, false) } : {},
-    ...Array.isArray(rawCsp.frameDomains) ? { frameDomains: normalizeDomains(rawCsp.frameDomains, false) } : {},
-    ...Array.isArray(rawCsp.baseUriDomains) ? { baseUriDomains: normalizeDomains(rawCsp.baseUriDomains, false) } : {}
-  } : void 0;
-  const rawPermissions = resourceMeta.permissions;
-  const permissions = isRecord(rawPermissions) ? {
-    ...isRecord(rawPermissions.camera) ? { camera: {} } : {},
-    ...isRecord(rawPermissions.microphone) ? { microphone: {} } : {},
-    ...isRecord(rawPermissions.geolocation) ? { geolocation: {} } : {},
-    ...isRecord(rawPermissions.clipboardWrite) ? { clipboardWrite: {} } : {}
-  } : void 0;
-  const allowAttribute = AZ(permissions);
-  return {
-    ...csp === void 0 ? {} : { csp },
-    ...permissions === void 0 ? {} : { permissions },
-    ...allowAttribute ? { allowAttribute } : {}
-  };
-}
-function assistantAppSandboxUrl(sandboxUrl, policy) {
-  const parsed = new URL(sandboxUrl);
-  if (policy.csp) parsed.searchParams.set("csp", JSON.stringify(policy.csp));
-  const parentOrigin = globalThis.location?.origin;
-  if (parentOrigin && parentOrigin !== "null") {
-    parsed.hash = new URLSearchParams({ parentOrigin }).toString();
-  }
-  return parsed.href;
-}
-
 // src/app-host.ts
-var PROXY_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><body><script>
-let inner,loaded=false;
-if(self===top)throw new Error('The assistant sandbox relay must be embedded');
-const standardSandbox='allow-scripts allow-same-origin allow-forms';
-const rawParentOrigin=new URLSearchParams(location.hash.slice(1)).get('parentOrigin');
-let expectedParentOrigin;
-try{const parsed=new URL(rawParentOrigin||'');if(parsed.origin===rawParentOrigin&&/^https?:$/.test(parsed.protocol))expectedParentOrigin=parsed.origin}catch{}
-const parentTarget=expectedParentOrigin||'*';
-const ownOrigin=self.origin;
+var PROXY_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
+let inner;
 const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
 // Re-announce until the host acknowledges with the resource: when this document is hosted
 // cross-origin, the first announcement can arrive before the host's load handler is listening.
-const announce=setInterval(()=>parent.postMessage(ready,parentTarget),120);
+const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
 setTimeout(()=>clearInterval(announce),15000);
 addEventListener('message',(event)=>{
   if(event.source===parent){
-    if(expectedParentOrigin&&event.origin!==expectedParentOrigin)return;
     const message=event.data;
     if(message?.method==='ui/notifications/sandbox-resource-ready'){
       clearInterval(announce);
-      if(loaded)return;
-      loaded=true;
-      const requestedSandbox=message.params?.sandbox;
+      if(inner)return;
       inner=document.createElement('iframe');
-      inner.setAttribute('sandbox',requestedSandbox===standardSandbox?standardSandbox:'allow-scripts');
+      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
       inner.setAttribute('referrerpolicy','no-referrer');
-      const permissions=message.params?.permissions;
-      const allow=[];
-      if(permissions?.camera)allow.push('camera');
-      if(permissions?.microphone)allow.push('microphone');
-      if(permissions?.geolocation)allow.push('geolocation');
-      if(permissions?.clipboardWrite)allow.push('clipboard-write');
-      if(allow.length)inner.setAttribute('allow',allow.join('; '));
-      document.body.append(inner);
-      let html=String(message.params?.html||'');
-      const csp=message.params?.csp;
-      if(csp&&typeof csp==='object'){
-        const list=(value,fallback)=>Array.isArray(value)&&value.length?value.join(' '):fallback;
-        const resources=Array.isArray(csp.resourceDomains)?csp.resourceDomains:[];
-        const suffix=resources.length?' '+resources.join(' '):'';
-        const policy=["default-src 'none'","script-src 'unsafe-inline'"+suffix,"style-src 'unsafe-inline'"+suffix,'img-src data: blob:'+suffix,'font-src data: blob:'+suffix,'media-src data: blob:'+suffix,'worker-src blob:'+suffix,'connect-src '+list(csp.connectDomains,"'none'"),'frame-src '+list(csp.frameDomains,"'none'"),"object-src 'none'","form-action 'none'",'base-uri '+list(csp.baseUriDomains,"'none'")].join('; ');
-        const meta='<meta http-equiv="Content-Security-Policy" content="'+policy.replace(/&/g,'&amp;').replace(/"/g,'&quot;')+'">';
-        const doctype=html.match(/^\\s*<!doctype[^>]*>/i);
-        html=doctype?html.slice(0,doctype[0].length)+meta+html.slice(doctype[0].length):meta+html;
-      }
-      try{
-        const doc=inner.contentDocument||inner.contentWindow?.document;
-        if(!doc)throw new Error('document unavailable');
-        doc.open();doc.write(html);doc.close();
-      }catch{inner.srcdoc=html}
+      inner.srcdoc=String(message.params?.html||'');
+      document.body.replaceChildren(inner);
       return;
     }
     inner?.contentWindow?.postMessage(message,'*');
   } else if(inner && event.source===inner.contentWindow) {
-    if(event.origin!==ownOrigin)return;
-    parent.postMessage(event.data,parentTarget);
+    parent.postMessage(event.data,'*');
   }
 });
-parent.postMessage(ready,parentTarget);
-</script></body>`;
+parent.postMessage(ready,'*');
+</script>`;
 function isAllowedAppLink(value, allowedDomains, baseUrl) {
   try {
     const parsed = new URL(value, baseUrl);
@@ -18352,42 +18246,16 @@ function createAssistantAppHostContext(theme, allowFullscreen = false, displayMo
 }
 var APP_RENDER_TIMEOUT_MS = 1e4;
 var APP_TEARDOWN_TIMEOUT_MS = 1e3;
-var STANDARD_SANDBOX = "allow-scripts allow-same-origin allow-forms";
 var mountedApps = /* @__PURE__ */ new WeakMap();
 function resolveSandboxUrl(value) {
   if (!value) return void 0;
   try {
     const parsed = new URL(value);
-    const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
-    const permittedProtocol = parsed.protocol === "https:" || parsed.protocol === "http:" && loopback;
-    const embedderOrigin = globalThis.location?.origin;
-    if (!permittedProtocol || embedderOrigin && embedderOrigin !== "null" && parsed.origin === embedderOrigin) {
-      return void 0;
-    }
-    return parsed.href;
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.href : void 0;
   } catch {
     return void 0;
   }
 }
-function copyAppJson(value, depth = 0) {
-  if (depth > 64) throw new Error("App payload nesting exceeds the host limit");
-  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error("App payload numbers must be finite");
-    return value;
-  }
-  if (Array.isArray(value)) return value.map((entry) => copyAppJson(entry, depth + 1));
-  const copied = {};
-  for (const [key, entry] of Object.entries(value)) {
-    Object.defineProperty(copied, key, {
-      value: copyAppJson(entry, depth + 1),
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  }
-  return copied;
-}
 function mountAssistantApp(detail, actions, options = {}) {
   if (!detail.html) return void 0;
   const card = document.createElement("section");
@@ -18408,25 +18276,16 @@ function mountAssistantApp(detail, actions, options = {}) {
   const frame = document.createElement("iframe");
   frame.className = "noodle-app-frame";
   frame.title = detail.title ?? detail.tool;
-  const policy = resolveAssistantAppSandboxPolicy(detail.resourceMeta);
+  frame.setAttribute("sandbox", "allow-scripts");
   frame.setAttribute("referrerpolicy", "no-referrer");
   const sandboxUrl = resolveSandboxUrl(options.sandboxUrl);
-  const appliedPolicy = sandboxUrl ? policy : { csp: policy.csp ?? {} };
-  if (sandboxUrl) {
-    frame.setAttribute("sandbox", STANDARD_SANDBOX);
-    if (policy.allowAttribute) frame.setAttribute("allow", policy.allowAttribute);
-    frame.src = assistantAppSandboxUrl(sandboxUrl, policy);
-  } else {
-    frame.setAttribute("sandbox", "allow-scripts");
-    frame.srcdoc = PROXY_DOCUMENT;
-  }
+  if (sandboxUrl) frame.src = sandboxUrl;
+  else frame.srcdoc = PROXY_DOCUMENT;
   card.append(frame);
   let mountedBridge;
   let mountedTransport;
   let destroyed = false;
   let initialized = false;
-  let renderFailed = false;
-  let renderStage = "sandbox_load";
   let currentTheme = actions.theme;
   let displayMode = "inline";
   let hostContext = createAssistantAppHostContext(
@@ -18435,15 +18294,6 @@ function mountAssistantApp(detail, actions, options = {}) {
     displayMode
   );
   let destroyPromise;
-  let transportClosePromise;
-  let renderTimer;
-  const closeTransport = () => {
-    if (transportClosePromise) return transportClosePromise;
-    const closing = mountedTransport?.close().catch(() => {
-    }) ?? Promise.resolve();
-    transportClosePromise = closing;
-    return closing;
-  };
   const applyDisplayMode = (requestedMode) => {
     displayMode = requestedMode === "fullscreen" && options.allowFullscreen === true ? "fullscreen" : "inline";
     card.toggleAttribute("data-fullscreen", displayMode === "fullscreen");
@@ -18461,26 +18311,18 @@ function mountAssistantApp(detail, actions, options = {}) {
     applyDisplayMode("inline");
     frame.focus();
   });
-  const showRenderFailure = (code) => {
-    if (code === "view_render_timeout" && initialized || destroyed || renderFailed || !frame.isConnected)
-      return;
-    renderFailed = true;
-    clearTimeout(renderTimer);
+  const renderTimer = setTimeout(() => {
+    if (initialized || !frame.isConnected) return;
     const note = document.createElement("div");
     note.className = "noodle-app-fallback";
     note.textContent = "This app view could not be displayed.";
     frame.replaceWith(note);
-    options.onRenderFailure?.({ code, retryable: false, stage: renderStage });
-    void closeTransport();
-  };
-  renderTimer = setTimeout(() => {
-    showRenderFailure("view_render_timeout");
+    options.onRenderFailure?.({ code: "view_render_timeout", retryable: false });
   }, APP_RENDER_TIMEOUT_MS);
   frame.addEventListener(
     "load",
     () => {
-      if (destroyed || renderFailed) return;
-      renderStage = "sandbox_proxy";
+      if (destroyed) return;
       const target = frame.contentWindow;
       if (!target) return;
       const bridge = new DX(
@@ -18491,11 +18333,7 @@ function mountAssistantApp(detail, actions, options = {}) {
           serverTools: {},
           serverResources: {},
           updateModelContext: { text: {}, structuredContent: {} },
-          message: { text: {} },
-          sandbox: {
-            ...appliedPolicy.csp === void 0 ? {} : { csp: appliedPolicy.csp },
-            ...appliedPolicy.permissions === void 0 ? {} : { permissions: appliedPolicy.permissions }
-          }
+          message: { text: {} }
         },
         {
           hostContext
@@ -18503,15 +18341,13 @@ function mountAssistantApp(detail, actions, options = {}) {
       );
       mountedBridge = bridge;
       bridge.onsandboxready = () => {
-        if (destroyed || renderFailed) return;
-        renderStage = "app_initialize";
+        if (destroyed) return;
         const current = options.getDetail?.() ?? detail;
         void bridge.sendSandboxResourceReady({
           html: current.html,
-          sandbox: sandboxUrl ? STANDARD_SANDBOX : "allow-scripts",
-          ...appliedPolicy.csp === void 0 ? {} : { csp: appliedPolicy.csp },
-          ...appliedPolicy.permissions === void 0 ? {} : { permissions: appliedPolicy.permissions }
-        }).catch(() => showRenderFailure("view_bridge_error"));
+          sandbox: "allow-scripts",
+          ...current.resourceMeta ?? {}
+        });
       };
       bridge.onsizechange = ({ height }) => {
         if (destroyed) return;
@@ -18575,30 +18411,21 @@ function mountAssistantApp(detail, actions, options = {}) {
         return await actions.client.requestApp("resources/read", params);
       };
       bridge.oninitialized = () => {
-        if (destroyed || renderFailed) return;
-        try {
-          const current = options.getDetail?.() ?? detail;
-          const copiedArguments = copyAppJson(current.arguments ?? {});
-          const copiedResult = copyAppJson(current.result);
-          const argumentsRecord = typeof copiedArguments === "object" && copiedArguments !== null && !Array.isArray(copiedArguments) ? copiedArguments : {};
-          initialized = true;
-          clearTimeout(renderTimer);
-          bridge.setHostContext(hostContext);
-          void Promise.all([
-            bridge.sendToolInput({ arguments: argumentsRecord }),
-            bridge.sendToolResult({
-              content: [{ type: "text", text: JSON.stringify(copiedResult) }],
-              ...typeof copiedResult === "object" && copiedResult !== null && !Array.isArray(copiedResult) ? { structuredContent: copiedResult } : {}
-            })
-          ]).catch(() => showRenderFailure("view_bridge_error"));
-        } catch {
-          showRenderFailure("view_bridge_error");
-        }
+        if (destroyed) return;
+        initialized = true;
+        clearTimeout(renderTimer);
+        bridge.setHostContext(hostContext);
+        const current = options.getDetail?.() ?? detail;
+        void bridge.sendToolInput({ arguments: current.arguments ?? {} });
+        void bridge.sendToolResult({
+          content: [{ type: "text", text: JSON.stringify(current.result) }],
+          ...typeof current.result === "object" && current.result !== null && !Array.isArray(current.result) ? { structuredContent: current.result } : {}
+        });
       };
       const transport = new E(target, target);
       mountedTransport = transport;
       void bridge.connect(transport).catch(() => {
-        showRenderFailure("view_bridge_error");
+        void destroy();
       });
     },
     { once: true }
@@ -18624,7 +18451,8 @@ function mountAssistantApp(detail, actions, options = {}) {
         }
       } catch {
       }
-      await closeTransport();
+      await mountedTransport?.close().catch(() => {
+      });
       card.remove();
       mountedApps.delete(card);
     })();