@noodleseed/assistant 1.25.0 → 1.25.1

package/dist/app-view.d.cts

@@ -1,4 +1,4 @@
-export { A as APP_VIEW_TAG_NAME, a as AssistantAppViewErrorDetail, N as NoodleAppViewElement } from './app-view-element-9ojWWYov.cjs';
+export { A as APP_VIEW_TAG_NAME, a as AssistantAppViewErrorDetail, N as NoodleAppViewElement } from './app-view-element-DhuiNW_x.cjs';
 export { A as AssistantClient, a as AssistantViewAvailableDetail } from './client-C07ppTU_.cjs';
 import './appearance-B6vSg8Ub.cjs';
 import 'ai';

package/dist/app-view.d.ts

@@ -1,4 +1,4 @@
-export { A as APP_VIEW_TAG_NAME, a as AssistantAppViewErrorDetail, N as NoodleAppViewElement } from './app-view-element-BM4lral-.js';
+export { A as APP_VIEW_TAG_NAME, a as AssistantAppViewErrorDetail, N as NoodleAppViewElement } from './app-view-element-BNkQab1B.js';
 export { A as AssistantClient, a as AssistantViewAvailableDetail } from './client-BkogON2A.js';
 import './appearance-B6vSg8Ub.js';
 import 'ai';

package/dist/app-view.js

@@ -2,8 +2,8 @@ import {
   APP_VIEW_TAG_NAME,
   NoodleAppViewElement,
   registerNoodleAppView
-} from "./chunk-LNBUYHL7.js";
-import "./chunk-P32MAR4K.js";
+} from "./chunk-5TYS2Q6S.js";
+import "./chunk-CF2SCDLF.js";
 import "./chunk-P223CYPO.js";
 import "./chunk-3YYTUJPJ.js";
 import "./chunk-5FUTL2UF.js";

package/dist/{chunk-LNBUYHL7.js → chunk-5TYS2Q6S.js}

@@ -3,7 +3,7 @@ import {
   mountAssistantApp,
   unmountAssistantApp,
   updateAssistantAppTheme
-} from "./chunk-P32MAR4K.js";
+} from "./chunk-CF2SCDLF.js";
 
 // src/app-view-element.ts
 var APP_VIEW_TAG_NAME = "noodle-app-view";
@@ -177,4 +177,4 @@ export {
   NoodleAppViewElement,
   registerNoodleAppView
 };
-//# sourceMappingURL=chunk-LNBUYHL7.js.map
+//# sourceMappingURL=chunk-5TYS2Q6S.js.map

package/dist/chunk-5TYS2Q6S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/app-view-element.ts","../src/app-view.ts"],"sourcesContent":["import { mountAssistantApp, unmountAssistantApp, updateAssistantAppTheme } from './app-host.js';\nimport { ASSISTANT_APP_VIEW_STYLES } from './app-view-styles.js';\nimport type { AssistantClient, AssistantViewAvailableDetail } from './client.js';\nimport type { AssistantErrorDetail } from './transport.js';\n\nexport const APP_VIEW_TAG_NAME = 'noodle-app-view';\n\nexport interface AssistantAppViewErrorDetail {\n  readonly code: 'view_render_timeout';\n  readonly retryable: false;\n}\n\ndeclare global {\n  interface HTMLElementTagNameMap {\n    'noodle-app-view': NoodleAppViewElement;\n  }\n\n  interface HTMLElementEventMap {\n    'assistant-error': CustomEvent<AssistantErrorDetail>;\n  }\n}\n\nconst HTMLElementBase: typeof HTMLElement =\n  globalThis.HTMLElement ?? (class {} as unknown as typeof HTMLElement);\n\nfunction viewIdentity(view: AssistantViewAvailableDetail): string {\n  return `${view.id}\\u0000${view.resourceUri}`;\n}\n\n/**\n * Framework-neutral host for one service-resolved MCP App view.\n *\n * `client` and `view` are object properties, not serialized attributes. Vue, Angular, and plain DOM\n * renderers can therefore pass the same `data-view` payload without taking a React dependency.\n */\nexport class NoodleAppViewElement extends HTMLElementBase {\n  static readonly observedAttributes = ['allow-fullscreen', 'theme'];\n\n  #allowFullscreen = false;\n  #client: AssistantClient | undefined;\n  #view: AssistantViewAvailableDetail | undefined;\n  #theme: 'light' | 'dark' = 'light';\n  #container: HTMLElement | undefined;\n  #mounted: HTMLElement | undefined;\n  #mountedClient: AssistantClient | undefined;\n  #mountedAllowFullscreen = false;\n  #mountedIdentity: string | undefined;\n  #requestedTeardown: { readonly client: AssistantClient; readonly identity: string } | undefined;\n\n  get client(): AssistantClient | undefined {\n    return this.#client;\n  }\n\n  /** Allow the hosted App to request fullscreen. Disabled by default. */\n  get allowFullscreen(): boolean {\n    return this.#allowFullscreen;\n  }\n\n  set allowFullscreen(value: boolean) {\n    const next = value === true;\n    if (next === this.#allowFullscreen) return;\n    this.#allowFullscreen = next;\n    this.toggleAttribute('allow-fullscreen', next);\n    this.#reconcile();\n  }\n\n  set client(value: AssistantClient | undefined) {\n    if (value === this.#client) return;\n    this.#client = value;\n    this.#reconcile();\n  }\n\n  get view(): AssistantViewAvailableDetail | undefined {\n    return this.#view;\n  }\n\n  set view(value: AssistantViewAvailableDetail | undefined) {\n    this.#view = value;\n    this.#reconcile();\n  }\n\n  get theme(): 'light' | 'dark' {\n    return this.#theme;\n  }\n\n  set theme(value: 'light' | 'dark') {\n    const next = value === 'dark' ? 'dark' : 'light';\n    const changed = next !== this.#theme;\n    this.#theme = next;\n    if (this.getAttribute('data-theme') !== next) this.setAttribute('data-theme', next);\n    if (changed && this.#mounted) updateAssistantAppTheme(this.#mounted, next);\n  }\n\n  connectedCallback(): void {\n    this.#ensureContainer();\n    this.#upgradeProperty('allowFullscreen');\n    this.#upgradeProperty('client');\n    this.#upgradeProperty('theme');\n    this.#upgradeProperty('view');\n    this.#reconcile();\n  }\n\n  disconnectedCallback(): void {\n    this.#requestedTeardown = undefined;\n    this.#releaseMount();\n  }\n\n  attributeChangedCallback(name: string, _previous: string | null, value: string | null): void {\n    if (name === 'allow-fullscreen') this.allowFullscreen = value !== null;\n    if (name === 'theme') this.theme = value === 'dark' ? 'dark' : 'light';\n  }\n\n  #ensureContainer(): HTMLElement {\n    if (this.#container) return this.#container;\n    const root = this.shadowRoot ?? this.attachShadow({ mode: 'open' });\n    root.innerHTML = ASSISTANT_APP_VIEW_STYLES;\n    const container = document.createElement('div');\n    container.className = 'noodle-app-mount';\n    container.setAttribute('part', 'mount');\n    root.append(container);\n    this.#container = container;\n    return container;\n  }\n\n  #upgradeProperty(name: 'allowFullscreen' | 'client' | 'theme' | 'view'): void {\n    const property = Object.getOwnPropertyDescriptor(this, name);\n    if (!property) return;\n    Reflect.deleteProperty(this, name);\n    Reflect.set(this, name, property.value);\n  }\n\n  #releaseMount(): void {\n    const mounted = this.#mounted;\n    this.#mounted = undefined;\n    this.#mountedClient = undefined;\n    this.#mountedAllowFullscreen = false;\n    this.#mountedIdentity = undefined;\n    this.#container?.replaceChildren();\n    if (mounted) void unmountAssistantApp(mounted);\n  }\n\n  #reconcile(): void {\n    if (!this.isConnected) return;\n    const client = this.#client;\n    const detail = this.#view;\n    const identity = detail ? viewIdentity(detail) : undefined;\n\n    if (this.#mounted) {\n      if (\n        client === this.#mountedClient &&\n        identity === this.#mountedIdentity &&\n        this.#allowFullscreen === this.#mountedAllowFullscreen\n      ) {\n        return;\n      }\n      this.#releaseMount();\n    }\n\n    if (\n      this.#requestedTeardown &&\n      (client !== this.#requestedTeardown.client || identity !== this.#requestedTeardown.identity)\n    ) {\n      this.#requestedTeardown = undefined;\n    }\n    if (!client || !detail?.html || !identity || this.#requestedTeardown) return;\n\n    const initialHtml = detail.html;\n    const sandboxUrl = client.appSandboxUrl?.();\n    let card: HTMLElement | undefined;\n    card = mountAssistantApp(\n      detail,\n      {\n        client,\n        sendMessage: (message) => client.sendMessage(message),\n        updateModelContext: (update) => client.updateModelContext(update),\n        theme: this.#theme,\n      },\n      {\n        allowFullscreen: this.#allowFullscreen,\n        ...(sandboxUrl ? { sandboxUrl } : {}),\n        getDetail: () => {\n          const latest = this.#view;\n          if (this.#client !== client || !latest || viewIdentity(latest) !== identity)\n            return detail;\n          return latest.html ? latest : { ...latest, html: initialHtml };\n        },\n        onRenderFailure: (failure) => {\n          this.dispatchEvent(\n            new CustomEvent<AssistantAppViewErrorDetail>('assistant-error', {\n              detail: failure,\n              bubbles: true,\n              composed: true,\n            }),\n          );\n        },\n        onTeardownRequest: () => {\n          if (this.#mounted !== card) return;\n          this.#mounted = undefined;\n          this.#mountedClient = undefined;\n          this.#mountedIdentity = undefined;\n          this.#requestedTeardown = { client, identity };\n        },\n      },\n    );\n    if (!card) return;\n    this.#mounted = card;\n    this.#mountedClient = client;\n    this.#mountedAllowFullscreen = this.#allowFullscreen;\n    this.#mountedIdentity = identity;\n    this.#ensureContainer().replaceChildren(card);\n  }\n}\n","import { APP_VIEW_TAG_NAME, NoodleAppViewElement } from './app-view-element.js';\n\nexport {\n  APP_VIEW_TAG_NAME,\n  type AssistantAppViewErrorDetail,\n  NoodleAppViewElement,\n} from './app-view-element.js';\nexport type { AssistantClient, AssistantViewAvailableDetail } from './client.js';\n\n/** Register the framework-neutral MCP App host. Safe to call more than once or during SSR. */\nexport function registerNoodleAppView(): void {\n  if (!globalThis.customElements?.get(APP_VIEW_TAG_NAME)) {\n    globalThis.customElements?.define(APP_VIEW_TAG_NAME, NoodleAppViewElement);\n  }\n}\n\nregisterNoodleAppView();\n"],"mappings":";;;;;;;;AAKO,IAAM,oBAAoB;AAiBjC,IAAM,kBACJ,WAAW,eAAgB,MAAM;AAAC;AAEpC,SAAS,aAAa,MAA4C;AAChE,SAAO,GAAG,KAAK,EAAE,KAAS,KAAK,WAAW;AAC5C;AAQO,IAAM,uBAAN,cAAmC,gBAAgB;AAAA,EACxD,OAAgB,qBAAqB,CAAC,oBAAoB,OAAO;AAAA,EAEjE,mBAAmB;AAAA,EACnB;AAAA,EACA;AAAA,EACA,SAA2B;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA,0BAA0B;AAAA,EAC1B;AAAA,EACA;AAAA,EAEA,IAAI,SAAsC;AACxC,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAGA,IAAI,kBAA2B;AAC7B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,gBAAgB,OAAgB;AAClC,UAAM,OAAO,UAAU;AACvB,QAAI,SAAS,KAAK,iBAAkB;AACpC,SAAK,mBAAmB;AACxB,SAAK,gBAAgB,oBAAoB,IAAI;AAC7C,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAAO,OAAoC;AAC7C,QAAI,UAAU,KAAK,QAAS;AAC5B,SAAK,UAAU;AACf,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAAiD;AACnD,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,KAAK,OAAiD;AACxD,SAAK,QAAQ;AACb,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,QAA0B;AAC5B,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,MAAM,OAAyB;AACjC,UAAM,OAAO,UAAU,SAAS,SAAS;AACzC,UAAM,UAAU,SAAS,KAAK;AAC9B,SAAK,SAAS;AACd,QAAI,KAAK,aAAa,YAAY,MAAM,KAAM,MAAK,aAAa,cAAc,IAAI;AAClF,QAAI,WAAW,KAAK,SAAU,yBAAwB,KAAK,UAAU,IAAI;AAAA,EAC3E;AAAA,EAEA,oBAA0B;AACxB,SAAK,iBAAiB;AACtB,SAAK,iBAAiB,iBAAiB;AACvC,SAAK,iBAAiB,QAAQ;AAC9B,SAAK,iBAAiB,OAAO;AAC7B,SAAK,iBAAiB,MAAM;AAC5B,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,uBAA6B;AAC3B,SAAK,qBAAqB;AAC1B,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,yBAAyB,MAAc,WAA0B,OAA4B;AAC3F,QAAI,SAAS,mBAAoB,MAAK,kBAAkB,UAAU;AAClE,QAAI,SAAS,QAAS,MAAK,QAAQ,UAAU,SAAS,SAAS;AAAA,EACjE;AAAA,EAEA,mBAAgC;AAC9B,QAAI,KAAK,WAAY,QAAO,KAAK;AACjC,UAAM,OAAO,KAAK,cAAc,KAAK,aAAa,EAAE,MAAM,OAAO,CAAC;AAClE,SAAK,YAAY;AACjB,UAAM,YAAY,SAAS,cAAc,KAAK;AAC9C,cAAU,YAAY;AACtB,cAAU,aAAa,QAAQ,OAAO;AACtC,SAAK,OAAO,SAAS;AACrB,SAAK,aAAa;AAClB,WAAO;AAAA,EACT;AAAA,EAEA,iBAAiB,MAA6D;AAC5E,UAAM,WAAW,OAAO,yBAAyB,MAAM,IAAI;AAC3D,QAAI,CAAC,SAAU;AACf,YAAQ,eAAe,MAAM,IAAI;AACjC,YAAQ,IAAI,MAAM,MAAM,SAAS,KAAK;AAAA,EACxC;AAAA,EAEA,gBAAsB;AACpB,UAAM,UAAU,KAAK;AACrB,SAAK,WAAW;AAChB,SAAK,iBAAiB;AACtB,SAAK,0BAA0B;AAC/B,SAAK,mBAAmB;AACxB,SAAK,YAAY,gBAAgB;AACjC,QAAI,QAAS,MAAK,oBAAoB,OAAO;AAAA,EAC/C;AAAA,EAEA,aAAmB;AACjB,QAAI,CAAC,KAAK,YAAa;AACvB,UAAM,SAAS,KAAK;AACpB,UAAM,SAAS,KAAK;AACpB,UAAM,WAAW,SAAS,aAAa,MAAM,IAAI;AAEjD,QAAI,KAAK,UAAU;AACjB,UACE,WAAW,KAAK,kBAChB,aAAa,KAAK,oBAClB,KAAK,qBAAqB,KAAK,yBAC/B;AACA;AAAA,MACF;AACA,WAAK,cAAc;AAAA,IACrB;AAEA,QACE,KAAK,uBACJ,WAAW,KAAK,mBAAmB,UAAU,aAAa,KAAK,mBAAmB,WACnF;AACA,WAAK,qBAAqB;AAAA,IAC5B;AACA,QAAI,CAAC,UAAU,CAAC,QAAQ,QAAQ,CAAC,YAAY,KAAK,mBAAoB;AAEtE,UAAM,cAAc,OAAO;AAC3B,UAAM,aAAa,OAAO,gBAAgB;AAC1C,QAAI;AACJ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,aAAa,CAAC,YAAY,OAAO,YAAY,OAAO;AAAA,QACpD,oBAAoB,CAAC,WAAW,OAAO,mBAAmB,MAAM;AAAA,QAChE,OAAO,KAAK;AAAA,MACd;AAAA,MACA;AAAA,QACE,iBAAiB,KAAK;AAAA,QACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,QACnC,WAAW,MAAM;AACf,gBAAM,SAAS,KAAK;AACpB,cAAI,KAAK,YAAY,UAAU,CAAC,UAAU,aAAa,MAAM,MAAM;AACjE,mBAAO;AACT,iBAAO,OAAO,OAAO,SAAS,EAAE,GAAG,QAAQ,MAAM,YAAY;AAAA,QAC/D;AAAA,QACA,iBAAiB,CAAC,YAAY;AAC5B,eAAK;AAAA,YACH,IAAI,YAAyC,mBAAmB;AAAA,cAC9D,QAAQ;AAAA,cACR,SAAS;AAAA,cACT,UAAU;AAAA,YACZ,CAAC;AAAA,UACH;AAAA,QACF;AAAA,QACA,mBAAmB,MAAM;AACvB,cAAI,KAAK,aAAa,KAAM;AAC5B,eAAK,WAAW;AAChB,eAAK,iBAAiB;AACtB,eAAK,mBAAmB;AACxB,eAAK,qBAAqB,EAAE,QAAQ,SAAS;AAAA,QAC/C;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,KAAM;AACX,SAAK,WAAW;AAChB,SAAK,iBAAiB;AACtB,SAAK,0BAA0B,KAAK;AACpC,SAAK,mBAAmB;AACxB,SAAK,iBAAiB,EAAE,gBAAgB,IAAI;AAAA,EAC9C;AACF;;;ACzMO,SAAS,wBAA8B;AAC5C,MAAI,CAAC,WAAW,gBAAgB,IAAI,iBAAiB,GAAG;AACtD,eAAW,gBAAgB,OAAO,mBAAmB,oBAAoB;AAAA,EAC3E;AACF;AAEA,sBAAsB;","names":[]}

package/dist/{chunk-P32MAR4K.js → chunk-CF2SCDLF.js}

@@ -2744,15 +2744,6 @@ var E = class {
   sessionId;
   setProtocolVersion;
 };
-function AZ(X) {
-  if (!X) return "";
-  let Y = [];
-  if (X.camera) Y.push("camera");
-  if (X.microphone) Y.push("microphone");
-  if (X.geolocation) Y.push("geolocation");
-  if (X.clipboardWrite) Y.push("clipboard-write");
-  return Y.join("; ");
-}
 var KX = [j];
 var DX = class extends _ {
   _client;
@@ -3023,131 +3014,34 @@ function GX(X, Y) {
   return JSON.stringify(X) === JSON.stringify(Y);
 }
 
-// src/app-sandbox-policy.ts
-var MAX_DOMAINS_PER_DIRECTIVE = 32;
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function normalizeDomain(value, connect) {
-  if (value.length > 512 || /[;\r\n'"\s]/u.test(value)) return void 0;
-  try {
-    const parsed = new URL(value);
-    const secure = parsed.protocol === "https:" || connect && parsed.protocol === "wss:";
-    const local = isLoopback(parsed.hostname) && (parsed.protocol === "http:" || connect && parsed.protocol === "ws:");
-    if (!secure && !local) return void 0;
-    if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) {
-      return void 0;
-    }
-    return parsed.origin;
-  } catch {
-    return void 0;
-  }
-}
-function normalizeDomains(values, connect) {
-  const normalized = [
-    ...new Set(
-      values.slice(0, MAX_DOMAINS_PER_DIRECTIVE).map((value) => typeof value === "string" ? normalizeDomain(value, connect) : void 0).filter((value) => value !== void 0)
-    )
-  ];
-  return normalized;
-}
-function resolveAssistantAppSandboxPolicy(resourceMeta) {
-  if (!isRecord(resourceMeta)) return {};
-  const rawCsp = resourceMeta.csp;
-  const csp = isRecord(rawCsp) ? {
-    ...Array.isArray(rawCsp.connectDomains) ? { connectDomains: normalizeDomains(rawCsp.connectDomains, true) } : {},
-    ...Array.isArray(rawCsp.resourceDomains) ? { resourceDomains: normalizeDomains(rawCsp.resourceDomains, false) } : {},
-    ...Array.isArray(rawCsp.frameDomains) ? { frameDomains: normalizeDomains(rawCsp.frameDomains, false) } : {},
-    ...Array.isArray(rawCsp.baseUriDomains) ? { baseUriDomains: normalizeDomains(rawCsp.baseUriDomains, false) } : {}
-  } : void 0;
-  const rawPermissions = resourceMeta.permissions;
-  const permissions = isRecord(rawPermissions) ? {
-    ...isRecord(rawPermissions.camera) ? { camera: {} } : {},
-    ...isRecord(rawPermissions.microphone) ? { microphone: {} } : {},
-    ...isRecord(rawPermissions.geolocation) ? { geolocation: {} } : {},
-    ...isRecord(rawPermissions.clipboardWrite) ? { clipboardWrite: {} } : {}
-  } : void 0;
-  const allowAttribute = AZ(permissions);
-  return {
-    ...csp === void 0 ? {} : { csp },
-    ...permissions === void 0 ? {} : { permissions },
-    ...allowAttribute ? { allowAttribute } : {}
-  };
-}
-function assistantAppSandboxUrl(sandboxUrl, policy) {
-  const parsed = new URL(sandboxUrl);
-  if (policy.csp) parsed.searchParams.set("csp", JSON.stringify(policy.csp));
-  const parentOrigin = globalThis.location?.origin;
-  if (parentOrigin && parentOrigin !== "null") {
-    parsed.hash = new URLSearchParams({ parentOrigin }).toString();
-  }
-  return parsed.href;
-}
-
 // src/app-host.ts
-var PROXY_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><body><script>
-let inner,loaded=false;
-if(self===top)throw new Error('The assistant sandbox relay must be embedded');
-const standardSandbox='allow-scripts allow-same-origin allow-forms';
-const rawParentOrigin=new URLSearchParams(location.hash.slice(1)).get('parentOrigin');
-let expectedParentOrigin;
-try{const parsed=new URL(rawParentOrigin||'');if(parsed.origin===rawParentOrigin&&/^https?:$/.test(parsed.protocol))expectedParentOrigin=parsed.origin}catch{}
-const parentTarget=expectedParentOrigin||'*';
-const ownOrigin=self.origin;
+var PROXY_DOCUMENT = `<!doctype html><meta charset="utf-8"><style>html,body,iframe{border:0;margin:0;width:100%;height:100%;overflow:hidden}body{background:transparent}</style><script>
+let inner;
 const ready={jsonrpc:'2.0',method:'ui/notifications/sandbox-proxy-ready',params:{}};
 // Re-announce until the host acknowledges with the resource: when this document is hosted
 // cross-origin, the first announcement can arrive before the host's load handler is listening.
-const announce=setInterval(()=>parent.postMessage(ready,parentTarget),120);
+const announce=setInterval(()=>parent.postMessage(ready,'*'),120);
 setTimeout(()=>clearInterval(announce),15000);
 addEventListener('message',(event)=>{
   if(event.source===parent){
-    if(expectedParentOrigin&&event.origin!==expectedParentOrigin)return;
     const message=event.data;
     if(message?.method==='ui/notifications/sandbox-resource-ready'){
       clearInterval(announce);
-      if(loaded)return;
-      loaded=true;
-      const requestedSandbox=message.params?.sandbox;
+      if(inner)return;
       inner=document.createElement('iframe');
-      inner.setAttribute('sandbox',requestedSandbox===standardSandbox?standardSandbox:'allow-scripts');
+      inner.setAttribute('sandbox',message.params?.sandbox||'allow-scripts');
       inner.setAttribute('referrerpolicy','no-referrer');
-      const permissions=message.params?.permissions;
-      const allow=[];
-      if(permissions?.camera)allow.push('camera');
-      if(permissions?.microphone)allow.push('microphone');
-      if(permissions?.geolocation)allow.push('geolocation');
-      if(permissions?.clipboardWrite)allow.push('clipboard-write');
-      if(allow.length)inner.setAttribute('allow',allow.join('; '));
-      document.body.append(inner);
-      let html=String(message.params?.html||'');
-      const csp=message.params?.csp;
-      if(csp&&typeof csp==='object'){
-        const list=(value,fallback)=>Array.isArray(value)&&value.length?value.join(' '):fallback;
-        const resources=Array.isArray(csp.resourceDomains)?csp.resourceDomains:[];
-        const suffix=resources.length?' '+resources.join(' '):'';
-        const policy=["default-src 'none'","script-src 'unsafe-inline'"+suffix,"style-src 'unsafe-inline'"+suffix,'img-src data: blob:'+suffix,'font-src data: blob:'+suffix,'media-src data: blob:'+suffix,'worker-src blob:'+suffix,'connect-src '+list(csp.connectDomains,"'none'"),'frame-src '+list(csp.frameDomains,"'none'"),"object-src 'none'","form-action 'none'",'base-uri '+list(csp.baseUriDomains,"'none'")].join('; ');
-        const meta='<meta http-equiv="Content-Security-Policy" content="'+policy.replace(/&/g,'&amp;').replace(/"/g,'&quot;')+'">';
-        const doctype=html.match(/^\\s*<!doctype[^>]*>/i);
-        html=doctype?html.slice(0,doctype[0].length)+meta+html.slice(doctype[0].length):meta+html;
-      }
-      try{
-        const doc=inner.contentDocument||inner.contentWindow?.document;
-        if(!doc)throw new Error('document unavailable');
-        doc.open();doc.write(html);doc.close();
-      }catch{inner.srcdoc=html}
+      inner.srcdoc=String(message.params?.html||'');
+      document.body.replaceChildren(inner);
       return;
     }
     inner?.contentWindow?.postMessage(message,'*');
   } else if(inner && event.source===inner.contentWindow) {
-    if(event.origin!==ownOrigin)return;
-    parent.postMessage(event.data,parentTarget);
+    parent.postMessage(event.data,'*');
   }
 });
-parent.postMessage(ready,parentTarget);
-</script></body>`;
+parent.postMessage(ready,'*');
+</script>`;
 function isAllowedAppLink(value, allowedDomains, baseUrl) {
   try {
     const parsed = new URL(value, baseUrl);
@@ -3174,42 +3068,16 @@ function createAssistantAppHostContext(theme, allowFullscreen = false, displayMo
 }
 var APP_RENDER_TIMEOUT_MS = 1e4;
 var APP_TEARDOWN_TIMEOUT_MS = 1e3;
-var STANDARD_SANDBOX = "allow-scripts allow-same-origin allow-forms";
 var mountedApps = /* @__PURE__ */ new WeakMap();
 function resolveSandboxUrl(value) {
   if (!value) return void 0;
   try {
     const parsed = new URL(value);
-    const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]";
-    const permittedProtocol = parsed.protocol === "https:" || parsed.protocol === "http:" && loopback;
-    const embedderOrigin = globalThis.location?.origin;
-    if (!permittedProtocol || embedderOrigin && embedderOrigin !== "null" && parsed.origin === embedderOrigin) {
-      return void 0;
-    }
-    return parsed.href;
+    return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.href : void 0;
   } catch {
     return void 0;
   }
 }
-function copyAppJson(value, depth = 0) {
-  if (depth > 64) throw new Error("App payload nesting exceeds the host limit");
-  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error("App payload numbers must be finite");
-    return value;
-  }
-  if (Array.isArray(value)) return value.map((entry) => copyAppJson(entry, depth + 1));
-  const copied = {};
-  for (const [key, entry] of Object.entries(value)) {
-    Object.defineProperty(copied, key, {
-      value: copyAppJson(entry, depth + 1),
-      enumerable: true,
-      configurable: true,
-      writable: true
-    });
-  }
-  return copied;
-}
 function mountAssistantApp(detail, actions, options = {}) {
   if (!detail.html) return void 0;
   const card = document.createElement("section");
@@ -3230,25 +3098,16 @@ function mountAssistantApp(detail, actions, options = {}) {
   const frame = document.createElement("iframe");
   frame.className = "noodle-app-frame";
   frame.title = detail.title ?? detail.tool;
-  const policy = resolveAssistantAppSandboxPolicy(detail.resourceMeta);
+  frame.setAttribute("sandbox", "allow-scripts");
   frame.setAttribute("referrerpolicy", "no-referrer");
   const sandboxUrl = resolveSandboxUrl(options.sandboxUrl);
-  const appliedPolicy = sandboxUrl ? policy : { csp: policy.csp ?? {} };
-  if (sandboxUrl) {
-    frame.setAttribute("sandbox", STANDARD_SANDBOX);
-    if (policy.allowAttribute) frame.setAttribute("allow", policy.allowAttribute);
-    frame.src = assistantAppSandboxUrl(sandboxUrl, policy);
-  } else {
-    frame.setAttribute("sandbox", "allow-scripts");
-    frame.srcdoc = PROXY_DOCUMENT;
-  }
+  if (sandboxUrl) frame.src = sandboxUrl;
+  else frame.srcdoc = PROXY_DOCUMENT;
   card.append(frame);
   let mountedBridge;
   let mountedTransport;
   let destroyed = false;
   let initialized = false;
-  let renderFailed = false;
-  let renderStage = "sandbox_load";
   let currentTheme = actions.theme;
   let displayMode = "inline";
   let hostContext = createAssistantAppHostContext(
@@ -3257,15 +3116,6 @@ function mountAssistantApp(detail, actions, options = {}) {
     displayMode
   );
   let destroyPromise;
-  let transportClosePromise;
-  let renderTimer;
-  const closeTransport = () => {
-    if (transportClosePromise) return transportClosePromise;
-    const closing = mountedTransport?.close().catch(() => {
-    }) ?? Promise.resolve();
-    transportClosePromise = closing;
-    return closing;
-  };
   const applyDisplayMode = (requestedMode) => {
     displayMode = requestedMode === "fullscreen" && options.allowFullscreen === true ? "fullscreen" : "inline";
     card.toggleAttribute("data-fullscreen", displayMode === "fullscreen");
@@ -3283,26 +3133,18 @@ function mountAssistantApp(detail, actions, options = {}) {
     applyDisplayMode("inline");
     frame.focus();
   });
-  const showRenderFailure = (code) => {
-    if (code === "view_render_timeout" && initialized || destroyed || renderFailed || !frame.isConnected)
-      return;
-    renderFailed = true;
-    clearTimeout(renderTimer);
+  const renderTimer = setTimeout(() => {
+    if (initialized || !frame.isConnected) return;
     const note = document.createElement("div");
     note.className = "noodle-app-fallback";
     note.textContent = "This app view could not be displayed.";
     frame.replaceWith(note);
-    options.onRenderFailure?.({ code, retryable: false, stage: renderStage });
-    void closeTransport();
-  };
-  renderTimer = setTimeout(() => {
-    showRenderFailure("view_render_timeout");
+    options.onRenderFailure?.({ code: "view_render_timeout", retryable: false });
   }, APP_RENDER_TIMEOUT_MS);
   frame.addEventListener(
     "load",
     () => {
-      if (destroyed || renderFailed) return;
-      renderStage = "sandbox_proxy";
+      if (destroyed) return;
       const target = frame.contentWindow;
       if (!target) return;
       const bridge = new DX(
@@ -3313,11 +3155,7 @@ function mountAssistantApp(detail, actions, options = {}) {
           serverTools: {},
           serverResources: {},
           updateModelContext: { text: {}, structuredContent: {} },
-          message: { text: {} },
-          sandbox: {
-            ...appliedPolicy.csp === void 0 ? {} : { csp: appliedPolicy.csp },
-            ...appliedPolicy.permissions === void 0 ? {} : { permissions: appliedPolicy.permissions }
-          }
+          message: { text: {} }
         },
         {
           hostContext
@@ -3325,15 +3163,13 @@ function mountAssistantApp(detail, actions, options = {}) {
       );
       mountedBridge = bridge;
       bridge.onsandboxready = () => {
-        if (destroyed || renderFailed) return;
-        renderStage = "app_initialize";
+        if (destroyed) return;
         const current = options.getDetail?.() ?? detail;
         void bridge.sendSandboxResourceReady({
           html: current.html,
-          sandbox: sandboxUrl ? STANDARD_SANDBOX : "allow-scripts",
-          ...appliedPolicy.csp === void 0 ? {} : { csp: appliedPolicy.csp },
-          ...appliedPolicy.permissions === void 0 ? {} : { permissions: appliedPolicy.permissions }
-        }).catch(() => showRenderFailure("view_bridge_error"));
+          sandbox: "allow-scripts",
+          ...current.resourceMeta ?? {}
+        });
       };
       bridge.onsizechange = ({ height }) => {
         if (destroyed) return;
@@ -3397,30 +3233,21 @@ function mountAssistantApp(detail, actions, options = {}) {
         return await actions.client.requestApp("resources/read", params);
       };
       bridge.oninitialized = () => {
-        if (destroyed || renderFailed) return;
-        try {
-          const current = options.getDetail?.() ?? detail;
-          const copiedArguments = copyAppJson(current.arguments ?? {});
-          const copiedResult = copyAppJson(current.result);
-          const argumentsRecord = typeof copiedArguments === "object" && copiedArguments !== null && !Array.isArray(copiedArguments) ? copiedArguments : {};
-          initialized = true;
-          clearTimeout(renderTimer);
-          bridge.setHostContext(hostContext);
-          void Promise.all([
-            bridge.sendToolInput({ arguments: argumentsRecord }),
-            bridge.sendToolResult({
-              content: [{ type: "text", text: JSON.stringify(copiedResult) }],
-              ...typeof copiedResult === "object" && copiedResult !== null && !Array.isArray(copiedResult) ? { structuredContent: copiedResult } : {}
-            })
-          ]).catch(() => showRenderFailure("view_bridge_error"));
-        } catch {
-          showRenderFailure("view_bridge_error");
-        }
+        if (destroyed) return;
+        initialized = true;
+        clearTimeout(renderTimer);
+        bridge.setHostContext(hostContext);
+        const current = options.getDetail?.() ?? detail;
+        void bridge.sendToolInput({ arguments: current.arguments ?? {} });
+        void bridge.sendToolResult({
+          content: [{ type: "text", text: JSON.stringify(current.result) }],
+          ...typeof current.result === "object" && current.result !== null && !Array.isArray(current.result) ? { structuredContent: current.result } : {}
+        });
       };
       const transport = new E(target, target);
       mountedTransport = transport;
       void bridge.connect(transport).catch(() => {
-        showRenderFailure("view_bridge_error");
+        void destroy();
       });
     },
     { once: true }
@@ -3446,7 +3273,8 @@ function mountAssistantApp(detail, actions, options = {}) {
         }
       } catch {
       }
-      await closeTransport();
+      await mountedTransport?.close().catch(() => {
+      });
       card.remove();
       mountedApps.delete(card);
     })();
@@ -3492,4 +3320,4 @@ export {
   ASSISTANT_APP_VIEW_CSS,
   ASSISTANT_APP_VIEW_STYLES
 };
-//# sourceMappingURL=chunk-P32MAR4K.js.map
+//# sourceMappingURL=chunk-CF2SCDLF.js.map