@womp/mcp-ui 0.1.13 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@womp/mcp-ui",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "MCP Apps widgets for Womp's MCP server — interactive cards rendered inline in Claude and other MCP hosts.",
   "license": "MIT",
   "type": "commonjs",

package/src/openai-camera/main.ts

@@ -204,8 +204,17 @@ function flatten(scripts: unknown): Record<string, number> {
   return out;
 }
 
+/**
+ * Where the viewer's messages come from. A host that frames the card on an
+ * opaque origin (a sandbox without allow-same-origin) passes that sandbox down
+ * to the viewer's frame, which then speaks as "null" — still our frame, as
+ * `event.source` proves.
+ */
+const fromViewer = (event: MessageEvent, d: Design) =>
+  event.source === viewer.contentWindow && (event.origin === d.viewerOrigin || event.origin === "null");
+
 window.addEventListener("message", (event) => {
-  if (!design || event.source !== viewer.contentWindow || event.origin !== design.viewerOrigin) return;
+  if (!design || !fromViewer(event, design)) return;
   const msg = event.data as { type?: string; scripts?: unknown };
   if (msg?.type === "kakapo:ready") {
     viewerReady = true;
@@ -225,7 +234,8 @@ window.addEventListener("message", (event) => {
 // The viewer has no change event, so read its knobs on an interval while visible.
 window.setInterval(() => {
   if (!design || !viewerReady || document.visibilityState !== "visible") return;
-  viewer.contentWindow?.postMessage({ type: "kakapo:getParams" }, design.viewerOrigin);
+  // "*": under an opaque host the viewer's origin is "null", which no target origin can name. The request carries nothing.
+  viewer.contentWindow?.postMessage({ type: "kakapo:getParams" }, "*");
 }, 1_500);
 
 function onViewerParams(params: Record<string, number>) {