@runtypelabs/persona 4.16.0 → 4.17.1

package/src/generated/runtype-openapi-contract.ts

@@ -35,6 +35,7 @@ export type RuntypeExecutionStreamEvent = ({
   iterations?: number;
   kind: "agent" | "flow";
   seq: number;
+  stepErrorCount?: number;
   stopReason?: string;
   success: boolean;
   successfulSteps?: number;
@@ -364,10 +365,21 @@ export type RuntypeExecutionStreamEvent = ({
   mode: "form" | "url";
   pauseCount?: number;
   requestedSchema?: Record<string, unknown>;
+  requests?: Array<{
+  message: string;
+  mode: "form" | "url";
+  name: string;
+  requestedSchema?: Record<string, unknown>;
+  url?: string;
+}>;
   serverName?: string;
   url?: string;
 };
   executionId: string;
+  externalAgent?: {
+  contextId?: string;
+  taskId?: string;
+};
   origin?: "webmcp" | "sdk";
   pageOrigin?: string;
   parameters?: Record<string, unknown>;
@@ -418,23 +430,59 @@ export type RuntypeStopReasonKind = NonNullable<
 
 export type RuntypeClientInitRequest = {
   flowId?: string;
-  sessionId?: string;
+  identityProof?: string;
+  token: string;
+  visitorHistory?: boolean;
+  visitorToken?: string;
+} | {
+  flowId?: string;
+  identityProof?: string;
+  sessionId: string;
+  token: string;
+  visitorHistory?: boolean;
+  visitorToken?: string;
+} | {
+  conversationId: string;
+  flowId?: string;
+  identityProof?: string;
+  token: string;
+  visitorHistory?: boolean;
+  visitorToken: string;
+} | {
+  conversationId: string;
+  flowId?: string;
+  identityProof: string;
   token: string;
+  visitorHistory?: boolean;
+  visitorToken?: string;
 };
 
 export type RuntypeClientInitResponse = {
+  app?: {
+  id: string;
+};
   config: {
-  placeholder?: string;
+  placeholder: string;
   theme?: unknown;
-  welcomeMessage?: string | null;
+  welcomeMessage: string | null;
 };
+  conversationId: string;
+  conversationRevision: string;
   expiresAt: string;
   flow?: {
   description?: string | null;
   id: string;
-  name?: string | null;
+  name?: string;
 };
   sessionId: string;
+  targetId?: string;
+  visitor?: {
+  endUserId: string | null;
+  expiresAt: string;
+  id: string;
+  identityStatus: "not_provided" | "admitted" | "ignored";
+  token?: string;
+};
 };
 
 export type RuntypeClientChatRequest = {
@@ -474,6 +522,7 @@ export type RuntypeClientChatRequest = {
   text: string;
   type: "reasoning";
 }>);
+  displayContent?: string;
   id?: string;
   role: "user" | "assistant" | "system";
 }>;

package/src/install.test.ts

@@ -404,12 +404,46 @@ describe("install.ts: CDN base derivation", () => {
     expect(cssHref).toBe("https://cdn.jsdelivr.net/npm/@runtypelabs/persona@latest/dist/widget.css");
   });
 
-  it("an explicit `version` opts back into npm-CDN URLs even when the src is derivable", async () => {
+  it("an explicit `version` on the first-party CDN stays first-party (versioned path)", async () => {
     setCurrentScript("https://cdn.runtype.com/persona/latest/install.global.js");
+    const { cssHref, scripts } = await installedUrls({ version: "1.2.3" });
+    expect(cssHref).toBe("https://cdn.runtype.com/persona/1.2.3/widget.css");
+    expect(scripts).toContain("https://cdn.runtype.com/persona/1.2.3/launcher.global.js");
+  });
+
+  it("an explicit `version` on a non-first-party src opts into npm-CDN URLs", async () => {
+    setCurrentScript("https://assets.example.com/vendor/persona/install.global.js");
     const { cssHref } = await installedUrls({ version: "1.2.3" });
     expect(cssHref).toBe("https://cdn.jsdelivr.net/npm/@runtypelabs/persona@1.2.3/dist/widget.css");
   });
 
+  it("warns when resolved assets leave the installer's origin (silent-CSP guard)", async () => {
+    setCurrentScript("https://cdn.runtype.com/persona/latest/install.global.js");
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    await installedUrls({ cdn: "jsdelivr" });
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("strict CSP may silently block"));
+    warn.mockRestore();
+  });
+
+  it("does not warn when assets resolve to the installer's own origin", async () => {
+    setCurrentScript("https://cdn.runtype.com/persona/latest/install.global.js");
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    await installedUrls({ version: "1.2.3" });
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
+  it("does not warn for explicit cssUrl + jsUrl overrides on another origin", async () => {
+    setCurrentScript("https://cdn.runtype.com/persona/latest/install.global.js");
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    await installedUrls({
+      cssUrl: "https://assets.example.com/persona/widget.css",
+      jsUrl: "https://assets.example.com/persona/index.global.js",
+    });
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
   it("an explicit `cdn` opts back into npm-CDN URLs even when the src is derivable", async () => {
     setCurrentScript("https://cdn.runtype.com/persona/latest/install.global.js");
     const { cssHref } = await installedUrls({ cdn: "unpkg" });

package/src/install.ts

@@ -7,9 +7,12 @@
 export {};
 
 interface SiteAgentInstallConfig {
-  // Setting `version` or `cdn` explicitly opts into npm-CDN asset URLs
-  // (jsDelivr/unpkg). When neither is set, assets load from the directory the
-  // installer script itself was served from — see getCdnBase().
+  // Setting `cdn` explicitly opts into npm-CDN asset URLs (jsDelivr/unpkg),
+  // and `version` pins the asset version. When neither is set, assets load
+  // from the directory the installer script itself was served from. On the
+  // first-party CDN (cdn.runtype.com) a `version` stays first-party
+  // (…/persona/<version>/); elsewhere it opts into npm-CDN URLs. Prefer
+  // pinning via the installer script URL itself — see getCdnBase().
   version?: string;
   cdn?: "unpkg" | "jsdelivr";
   cssUrl?: string;
@@ -239,16 +242,30 @@ declare global {
 
     // Default: load assets from wherever the installer was served, so a page
     // whose CSP allows only its own CDN (e.g. cdn.runtype.com) never has
-    // sibling requests fan out to a third-party host. An explicit `cdn` or
-    // `version` keeps the documented npm-CDN behavior.
-    if (!config.cdn && !config.version) {
+    // sibling requests fan out to a third-party host. An explicit `cdn`
+    // keeps the documented npm-CDN behavior.
+    if (!config.cdn) {
       const selfBase = getInstallerBase();
       if (selfBase) {
-        return {
-          cssUrl: `${selfBase}/widget.css`,
-          jsUrl: `${selfBase}/index.global.js`,
-          launcherUrl: `${selfBase}/launcher.global.js` as string | null,
-        };
+        if (!config.version) {
+          return {
+            cssUrl: `${selfBase}/widget.css`,
+            jsUrl: `${selfBase}/index.global.js`,
+            launcherUrl: `${selfBase}/launcher.global.js` as string | null,
+          };
+        }
+        // A `version` on the first-party CDN stays first-party: the bucket
+        // mirrors every release at /persona/<version>/, and rerouting to a
+        // npm CDN would be blocked by the CSP that allowed the installer.
+        const selfOrigin = new URL(selfBase).origin;
+        if (selfOrigin === "https://cdn.runtype.com") {
+          const base = `${selfOrigin}/persona/${config.version}`;
+          return {
+            cssUrl: `${base}/widget.css`,
+            jsUrl: `${base}/index.global.js`,
+            launcherUrl: `${base}/launcher.global.js` as string | null,
+          };
+        }
       }
     }
 
@@ -268,6 +285,25 @@ declare global {
 
   const { cssUrl, jsUrl, launcherUrl } = getCdnBase();
 
+  // Surface silent CSP breakage: when `cdn`/`version` reroutes assets to a
+  // different origin than the one that served the installer, a strict CSP
+  // (e.g. Runtype-hosted apps) blocks them with no visible error. Explicit
+  // cssUrl/jsUrl overrides are a deliberate choice, so they don't warn.
+  if (!(config.cssUrl && config.jsUrl)) {
+    const selfBase = getInstallerBase();
+    try {
+      if (selfBase && new URL(selfBase).origin !== new URL(jsUrl, document.baseURI).origin) {
+        console.warn(
+          `[persona] Widget assets resolve to ${new URL(jsUrl, document.baseURI).origin}, but the installer loaded from ${new URL(selfBase).origin}. ` +
+          "A strict CSP may silently block them. To pin a version, put it in the installer script URL " +
+          "(e.g. https://cdn.runtype.com/persona/<version>/install.global.js) instead of the `version`/`cdn` config keys.",
+        );
+      }
+    } catch {
+      // URL parsing is best-effort; never let diagnostics break installation.
+    }
+  }
+
   // Check if CSS is already loaded
   const isCssLoaded = () => {
     return !!document.head.querySelector('link[data-persona]') ||