@zackbart/connecta 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to this package are documented here.
 
+## 0.12.0 — 2026-08-01
+
+Programs gained a *view*. `execute_code` code can now call `connecta.ui(html)`
+to hand the client one rendered MCP Apps view of the run — the thing
+`connecta.emit` could not do, which is give a human something to look at while
+the model keeps its cheap textual summary. Programs supply HTML content and
+nothing else: the only `ui://` URI in the system is connecta's build-time shell,
+so nothing a client could dereference is derived from anything a program said,
+and the shell forwards no channel from the program's markup back to the host.
+The channel is additive — a program that never calls `connecta.ui` produces the
+byte-for-byte prior response, no executor changed to carry it, and there is no
+new budget knob. Deployments do gain a `resources` capability and one extension
+declaration, both of which the design requires before any host will render.
+The design record is `documentation/mcp-ui-design.md` (#266); the contract is
+`code-mode.md`'s "Rendered output" clauses (#277).
+
+### Added
+
+- **`connecta.ui(html)` inside `execute_code`.** One non-empty HTML string, at
+  most one payload per run, delivered on success only in the tool result's
+  `_meta["connecta/ui"]` with `ui: true` on the JSON envelope. A failed program
+  discards it visibly (`uiDiscarded: true`), alongside `emittedDiscarded` when
+  one failure loses both. The payload spends the existing
+  `execute.maxEmittedBytes` aggregate, no block count, and no host calls.
+- **The MCP Apps shell.** A static connecta-authored HTML5 template at
+  `ui://connecta/program-ui/v1` (`text/html;profile=mcp-app`), served by a
+  `resources/read` handler that answers exactly that URI; `resources/list` is
+  served and returns an empty list. `execute_code` declares it through
+  `_meta.ui.resourceUri` with `_meta.ui.visibility: ["model"]`, and the server
+  declares the `io.modelcontextprotocol/ui` extension — the one extension
+  connecta advertises, without which no host renders anything.
+- **`diagnostics.ui`.** With `diagnostics: true`, the accepted payload's
+  serialized byte size, distinct from the `emitted` aggregate.
+
+### Fixed
+
+- **Visible output discarded during QuickJS shutdown.** Closing the executor
+  after a program starts now reports accepted blocks and UI as discarded on
+  both error paths; admission failures before execution remain unchanged. (#279)
+
 ## 0.11.0 — 2026-07-31
 
 **This is a breaking deployment release.** Connecta no longer carries the old

package/dist/apps-shell.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The one MCP Apps template connecta serves (`U5`, `U6`).
+ *
+ * A build-time string constant, not a file read at startup: the core is
+ * Web-API-only so it runs unchanged on Workers, and the same bytes have to
+ * serve everywhere. The shell is display-only — it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
+ *
+ * The address carries a version segment because hosts are permitted to
+ * prefetch and cache templates by URI: change these bytes, bump `v1`.
+ */
+/** The only `ui://` URI in the system. No program input reaches it. */
+export declare const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v1";
+/** The mimeType the Apps spec requires of an HTML template. */
+export declare const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
+/**
+ * The result `_meta` key carrying the payload (`U3`). A plain single-label
+ * prefix rather than the reverse-DNS form MCP's SHOULD prefers: connecta has
+ * no domain to reverse, and fabricating one to satisfy a SHOULD is a worse
+ * answer than the shape the key format's MUST already permits.
+ */
+export declare const PROGRAM_UI_META_KEY = "connecta/ui";
+/** The one extension identifier connecta advertises (`U11`). */
+export declare const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
+/**
+ * The shell document. Dependency-free and deliberately small: it speaks the
+ * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
+ * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
+ * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'` — the payload gets scripts and local interactivity,
+ * and no network.
+ */
+export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The host frame is the only peer this shell speaks to, in either\n        // direction. The payload frame below is sandboxed to scripts alone,\n        // with no same-origin escape, and is never handed a reply path:\n        // anything it posts fails the source check and is dropped. There is\n        // no bridge from program HTML to the host, by construction rather\n        // than by validation.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // bridge to the payload frame \u2014 that is the security posture, not an\n        // omission \u2014 so it can never learn the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payloadHtml(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var payload = meta[\"connecta/ui\"];\n          if (!payload || typeof payload !== \"object\") return null;\n          var html = payload.html;\n          return typeof html === \"string\" && html.length > 0 ? html : null;\n        }\n\n        function render(params) {\n          var html =\n            payloadHtml(params) ||\n            payloadHtml(params && params.result) ||\n            payloadHtml(params && params.toolResult);\n          if (html === null) return;\n          view.srcdoc = html;\n          reportSize();\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          if (event.source !== host) return;\n          var message = event.data;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";
+//# sourceMappingURL=apps-shell.d.ts.map

package/dist/apps-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-shell.d.ts","sourceRoot":"","sources":["../src/apps-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,ssKAyIjC,CAAC"}

package/dist/apps-shell.js

@@ -0,0 +1,175 @@
+/**
+ * The one MCP Apps template connecta serves (`U5`, `U6`).
+ *
+ * A build-time string constant, not a file read at startup: the core is
+ * Web-API-only so it runs unchanged on Workers, and the same bytes have to
+ * serve everywhere. The shell is display-only — it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
+ *
+ * The address carries a version segment because hosts are permitted to
+ * prefetch and cache templates by URI: change these bytes, bump `v1`.
+ */
+/** The only `ui://` URI in the system. No program input reaches it. */
+export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v1";
+/** The mimeType the Apps spec requires of an HTML template. */
+export const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
+/**
+ * The result `_meta` key carrying the payload (`U3`). A plain single-label
+ * prefix rather than the reverse-DNS form MCP's SHOULD prefers: connecta has
+ * no domain to reverse, and fabricating one to satisfy a SHOULD is a worse
+ * answer than the shape the key format's MUST already permits.
+ */
+export const PROGRAM_UI_META_KEY = "connecta/ui";
+/** The one extension identifier connecta advertises (`U11`). */
+export const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
+/**
+ * The shell document. Dependency-free and deliberately small: it speaks the
+ * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
+ * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
+ * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'` — the payload gets scripts and local interactivity,
+ * and no network.
+ */
+export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>connecta program view</title>
+    <style>
+      html,
+      body {
+        margin: 0;
+        padding: 0;
+        background: transparent;
+      }
+      #program-view {
+        display: block;
+        width: 100%;
+        min-height: 480px;
+        border: 0;
+      }
+    </style>
+  </head>
+  <body>
+    <iframe
+      id="program-view"
+      title="Program-rendered view"
+      sandbox="allow-scripts"
+      srcdoc=""
+    ></iframe>
+    <script>
+      (function () {
+        "use strict";
+        // The host frame is the only peer this shell speaks to, in either
+        // direction. The payload frame below is sandboxed to scripts alone,
+        // with no same-origin escape, and is never handed a reply path:
+        // anything it posts fails the source check and is dropped. There is
+        // no bridge from program HTML to the host, by construction rather
+        // than by validation.
+        var host = window.parent;
+        var view = document.getElementById("program-view");
+        var initializeId = "connecta-ui-initialize";
+        var lastWidth = 0;
+        var lastHeight = 0;
+
+        function send(message) {
+          if (!host || host === window) return;
+          host.postMessage(message, "*");
+        }
+
+        function notify(method, params) {
+          send({ jsonrpc: "2.0", method: method, params: params });
+        }
+
+        // Program views are fixed-height by construction. The shell has no
+        // bridge to the payload frame — that is the security posture, not an
+        // omission — so it can never learn the payload's content height, and
+        // what it reports here is its own box: the min-height above, unless
+        // the host has given it more. Taller content scrolls inside the inner
+        // frame rather than growing the view. Raising the min-height is the
+        // only lever; a content-height signal would cost the isolation.
+        function reportSize() {
+          var width = Math.ceil(document.documentElement.clientWidth);
+          var height = Math.ceil(document.documentElement.scrollHeight);
+          if (width === lastWidth && height === lastHeight) return;
+          lastWidth = width;
+          lastHeight = height;
+          notify("ui/notifications/size-changed", {
+            width: width,
+            height: height
+          });
+        }
+
+        function payloadHtml(result) {
+          if (!result || typeof result !== "object") return null;
+          var meta = result._meta;
+          if (!meta || typeof meta !== "object") return null;
+          var payload = meta["connecta/ui"];
+          if (!payload || typeof payload !== "object") return null;
+          var html = payload.html;
+          return typeof html === "string" && html.length > 0 ? html : null;
+        }
+
+        function render(params) {
+          var html =
+            payloadHtml(params) ||
+            payloadHtml(params && params.result) ||
+            payloadHtml(params && params.toolResult);
+          if (html === null) return;
+          view.srcdoc = html;
+          reportSize();
+        }
+
+        window.addEventListener("message", function (event) {
+          if (event.source !== host) return;
+          var message = event.data;
+          if (!message || message.jsonrpc !== "2.0") return;
+          if (message.method === "ui/notifications/tool-result") {
+            render(message.params);
+            return;
+          }
+          if (message.method === "ui/resource-teardown") {
+            // A host->view request, not a notification: the host waits for
+            // this reply before it tears the view down. There is nothing to
+            // release, so answer immediately rather than make it time out.
+            if (message.id !== undefined && message.id !== null) {
+              send({ jsonrpc: "2.0", id: message.id, result: {} });
+            }
+            return;
+          }
+          // Only a completed handshake earns "initialized". A JSON-RPC error
+          // response carries the same id, and announcing initialization on one
+          // would assert a handshake that never happened.
+          if (message.id === initializeId && message.result !== undefined) {
+            notify("ui/notifications/initialized", {});
+          }
+        });
+
+        window.addEventListener("resize", reportSize);
+        view.addEventListener("load", reportSize);
+
+        // Every field here is required by the Apps initialize schema, and a
+        // conforming host rejects the request outright when one is missing —
+        // which would strand the shell before any tool result arrives.
+        send({
+          jsonrpc: "2.0",
+          id: initializeId,
+          method: "ui/initialize",
+          params: {
+            appInfo: { name: "connecta program view", version: "1" },
+            appCapabilities: {},
+            protocolVersion: "2026-01-26"
+          }
+        });
+        reportSize();
+      })();
+    </script>
+  </body>
+</html>
+`;
+//# sourceMappingURL=apps-shell.js.map

package/dist/apps-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps-shell.js","sourceRoot":"","sources":["../src/apps-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAErE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAEjD,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyIpC,CAAC"}

package/dist/execute.d.ts

@@ -32,9 +32,16 @@ declare class ExecuteDiagnostics {
     setupMs: number;
     executorWallMs: number;
     private emitted?;
+    private ui?;
     /** Numbers only, per R8 — and only once something was emitted, so a
      * non-emitting run's diagnostics stay byte-for-byte what they were. */
     recordEmitted(count: number, bytes: number): void;
+    /**
+     * U9: the UI payload gets its own aggregate — one number, the payload's
+     * serialized size. Folding it into `emitted` would desync that aggregate's
+     * pair, which reports the bytes a specific block count cost.
+     */
+    recordUi(bytes: number): void;
     private stats;
     recordCatalog(operation: "search" | "describe", durationMs: number, ok: boolean, result?: unknown): void;
     recordCall(operation: "call" | "batch", outcome: {
@@ -61,6 +68,7 @@ declare class ExecuteDiagnostics {
             count: number;
             bytes: number;
         };
+        ui?: number;
     };
 }
 /**
@@ -81,20 +89,43 @@ export type EmittedBlock = {
     mimeType: string;
 };
 /**
- * Request-local collection for `connecta.emit`. Budgets fail loudly at the
- * crossing call — the block is not partially accepted and prior blocks are
- * unaffected — so a program learns it is over budget while it can still
- * choose differently (M5). Accepted blocks never ride `ExecuteResult`; the
- * handler that owns this collector appends them to the final tool result.
+ * Request-local collection for `connecta.emit` and `connecta.ui`. Budgets fail
+ * loudly at the crossing call — nothing is partially accepted and prior blocks
+ * are unaffected — so a program learns it is over budget while it can still
+ * choose differently (M5, U4). Accepted output never rides `ExecuteResult`; the
+ * handler that owns this collector delivers it on the final tool result.
+ *
+ * The two channels share the byte aggregate and nothing else: a UI payload is
+ * not a block, so it spends no block count, and at most one is ever accepted.
  */
 export declare class EmitCollector {
     private readonly maxBytes;
     private readonly maxBlocks;
     private readonly diagnostics?;
     readonly blocks: EmittedBlock[];
+    /** The shared transport aggregate: emitted blocks plus the UI payload. */
     bytes: number;
+    /** The one accepted UI payload (U2), delivered in result `_meta` on success. */
+    ui?: {
+        html: string;
+    };
+    /** What the blocks alone cost, so the `emitted` aggregate stays a true pair. */
+    private blockBytes;
     constructor(maxBytes: number, maxBlocks: number, diagnostics?: ExecuteDiagnostics | undefined);
     accept(raw: unknown): void;
+    /**
+     * U2 and U4: one payload per run, measured as the serialized bytes of
+     * `{ html }` against the same aggregate emit spends. A second call throws
+     * naming the constraint rather than replacing the first — one tool result
+     * renders one view, and last-wins would silently discard a payload the
+     * program deliberately supplied.
+     *
+     * Multiplicity is checked before shape, so the second call is told what it
+     * actually broke. A program whose second payload is also malformed has one
+     * problem worth naming — that there is a second payload at all — and a
+     * complaint about its type would send the author to fix the wrong thing.
+     */
+    acceptUi(raw: unknown): void;
 }
 /** Convert a connector/tool name into a valid JS identifier. */
 export declare function sanitizeIdentifier(name: string): string;

package/dist/execute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../src/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAO5D,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAW3E,OAAO,EACL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,QAAQ,EACR,gBAAgB,EAChB,MAAM,EACP,MAAM,YAAY,CAAC;AAIpB,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,UAAY,CAAC;AACnD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAG7C,KAAK,0BAA0B,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3E,UAAU,2BAA2B;IACnC,SAAS,EAAE,0BAA0B,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,cAAM,kBAAkB;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGvB;IACJ,WAAW,SAAK;IAChB,OAAO,SAAK;IACZ,cAAc,SAAK;IACnB,OAAO,CAAC,OAAO,CAAC,CAAmC;IAEnD;2EACuE;IACvE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjD,OAAO,CAAC,KAAK;IAiBb,aAAa,CACX,SAAS,EAAE,QAAQ,GAAG,UAAU,EAChC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,OAAO,GACf,IAAI;IASP,UAAU,CACR,SAAS,EAAE,MAAM,GAAG,OAAO,EAC3B,OAAO,EAAE;QACP,EAAE,EAAE,OAAO,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,IAAI;IAgBP,WAAW,CACT,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI;IAWP,MAAM,IAAI;QACR,MAAM,EAAE;YACN,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,EAAE,MAAM,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC;YAClB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,UAAU,EAAE,2BAA2B,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;KAC5C;CAkBF;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AA6CtD;;;;;;GAMG;AACH,qBAAa,aAAa;IAItB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAL/B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAM;IACrC,KAAK,SAAK;gBAES,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAGnD,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;CAiB3B;AAsED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAoDD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC3D,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC1B,GACL,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuR7B;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,IAGJ,6CAA6C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,EACD,UAAS;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,KACrC,OAAO,CAAC,UAAU,CAAC,CAsOvB;AAkCD,uFAAuF;AACvF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACA,IAAI,CAwEN"}
+{"version":3,"file":"execute.d.ts","sourceRoot":"","sources":["../src/execute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAW5D,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAY3E,OAAO,EACL,iBAAiB,EAElB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,KAAK,EACV,QAAQ,EACR,gBAAgB,EAChB,MAAM,EACP,MAAM,YAAY,CAAC;AAIpB,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,UAAY,CAAC;AACnD,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAG7C,KAAK,0BAA0B,GAAG,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3E,UAAU,2BAA2B;IACnC,SAAS,EAAE,0BAA0B,CAAC;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,cAAM,kBAAkB;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAGvB;IACJ,WAAW,SAAK;IAChB,OAAO,SAAK;IACZ,cAAc,SAAK;IACnB,OAAO,CAAC,OAAO,CAAC,CAAmC;IACnD,OAAO,CAAC,EAAE,CAAC,CAAS;IAEpB;2EACuE;IACvE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAIjD;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI7B,OAAO,CAAC,KAAK;IAiBb,aAAa,CACX,SAAS,EAAE,QAAQ,GAAG,UAAU,EAChC,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE,OAAO,GACf,IAAI;IASP,UAAU,CACR,SAAS,EAAE,MAAM,GAAG,OAAO,EAC3B,OAAO,EAAE;QACP,EAAE,EAAE,OAAO,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QACnD,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,GACA,IAAI;IAgBP,WAAW,CACT,UAAU,EAAE,MAAM,EAClB,EAAE,EAAE,OAAO,EACX,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,OAAO,GACf,IAAI;IAWP,MAAM,IAAI;QACR,MAAM,EAAE;YACN,OAAO,EAAE,MAAM,CAAC;YAChB,WAAW,EAAE,MAAM,CAAC;YACpB,OAAO,EAAE,MAAM,CAAC;YAChB,cAAc,EAAE,MAAM,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC;YAClB,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,UAAU,EAAE,2BAA2B,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAC3C,EAAE,CAAC,EAAE,MAAM,CAAC;KACb;CAmBF;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAsEtD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IAStB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;IAV/B,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,CAAM;IACrC,0EAA0E;IAC1E,KAAK,SAAK;IACV,gFAAgF;IAChF,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACtB,gFAAgF;IAChF,OAAO,CAAC,UAAU,CAAK;gBAEJ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,WAAW,CAAC,EAAE,kBAAkB,YAAA;IAGnD,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAmB1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;CAiB7B;AAsED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKvD;AAoDD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC3D,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;OAIG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC1B,GACL,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAmS7B;AAED,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,sBAAsB,EACjC,MAAM,GAAE;IACN,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACtB,IAGJ,6CAA6C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,EACD,UAAS;IAAE,MAAM,CAAC,EAAE,WAAW,CAAA;CAAO,KACrC,OAAO,CAAC,UAAU,CAAC,CAmPvB;AA8CD,uFAAuF;AACvF,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,YAAY,EACtB,GAAG,EAAE;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GACA,IAAI,CAoFN"}

package/dist/execute.js

@@ -1,8 +1,9 @@
 import { z } from "zod";
+import { PROGRAM_UI_META_KEY, PROGRAM_UI_RESOURCE_URI, } from "./apps-shell.js";
 import { boundedDiscoveryText, CatalogService, DiscoveryPolicyError, flatSearchResult, } from "./catalog-service.js";
 import { errorResult, jsonResult } from "./meta-tools.js";
 import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, } from "./executor-result.js";
-import { ExecutorAdmissionError, isAdmittingExecutor, } from "./executor-admission.js";
+import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
 import { classifyCallError } from "./errors.js";
 import { InvocationFailure, InvocationService, } from "./invocation.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
@@ -26,12 +27,21 @@ class ExecuteDiagnostics {
     setupMs = 0;
     executorWallMs = 0;
     emitted;
+    ui;
     /** Numbers only, per R8 — and only once something was emitted, so a
      * non-emitting run's diagnostics stay byte-for-byte what they were. */
     recordEmitted(count, bytes) {
         if (count > 0)
             this.emitted = { count, bytes };
     }
+    /**
+     * U9: the UI payload gets its own aggregate — one number, the payload's
+     * serialized size. Folding it into `emitted` would desync that aggregate's
+     * pair, which reports the bytes a specific block count cost.
+     */
+    recordUi(bytes) {
+        this.ui = bytes;
+    }
     stats(operation) {
         let stats = this.operations.get(operation);
         if (!stats) {
@@ -100,6 +110,7 @@ class ExecuteDiagnostics {
             },
             operations,
             ...(this.emitted ? { emitted: this.emitted } : {}),
+            ...(this.ui !== undefined ? { ui: this.ui } : {}),
         };
     }
 }
@@ -134,19 +145,52 @@ function requireEmittedBlock(raw) {
     }
     return raw;
 }
+const UI_SHAPE_HINT = "connecta.ui accepts exactly one argument: a non-empty string of HTML";
+/** What the argument was, named the way the emit validator names a bad field. */
+function describeUiArgument(raw) {
+    if (raw === null)
+        return "null";
+    if (raw === undefined)
+        return "undefined";
+    if (Array.isArray(raw))
+        return "an array";
+    if (typeof raw === "string")
+        return "an empty string";
+    const kind = typeof raw;
+    return `${/^[aeiou]/.test(kind) ? "an" : "a"} ${kind}`;
+}
+/**
+ * Strict U1 validation. There is no options parameter and no sugar form, for
+ * M1's reason: sugar is how a one-shape contract grows hair. An options bag or
+ * an MCP block object is just a non-string, and fails as one.
+ */
+function requireUiHtml(raw) {
+    if (typeof raw !== "string" || raw.length === 0) {
+        throw new Error(`${UI_SHAPE_HINT}; got ${describeUiArgument(raw)}`);
+    }
+    return raw;
+}
 /**
- * Request-local collection for `connecta.emit`. Budgets fail loudly at the
- * crossing call — the block is not partially accepted and prior blocks are
- * unaffected — so a program learns it is over budget while it can still
- * choose differently (M5). Accepted blocks never ride `ExecuteResult`; the
- * handler that owns this collector appends them to the final tool result.
+ * Request-local collection for `connecta.emit` and `connecta.ui`. Budgets fail
+ * loudly at the crossing call — nothing is partially accepted and prior blocks
+ * are unaffected — so a program learns it is over budget while it can still
+ * choose differently (M5, U4). Accepted output never rides `ExecuteResult`; the
+ * handler that owns this collector delivers it on the final tool result.
+ *
+ * The two channels share the byte aggregate and nothing else: a UI payload is
+ * not a block, so it spends no block count, and at most one is ever accepted.
  */
 export class EmitCollector {
     maxBytes;
     maxBlocks;
     diagnostics;
     blocks = [];
+    /** The shared transport aggregate: emitted blocks plus the UI payload. */
     bytes = 0;
+    /** The one accepted UI payload (U2), delivered in result `_meta` on success. */
+    ui;
+    /** What the blocks alone cost, so the `emitted` aggregate stays a true pair. */
+    blockBytes = 0;
     constructor(maxBytes, maxBlocks, diagnostics) {
         this.maxBytes = maxBytes;
         this.maxBlocks = maxBlocks;
@@ -163,7 +207,33 @@ export class EmitCollector {
         }
         this.blocks.push(block);
         this.bytes += size;
-        this.diagnostics?.recordEmitted(this.blocks.length, this.bytes);
+        this.blockBytes += size;
+        this.diagnostics?.recordEmitted(this.blocks.length, this.blockBytes);
+    }
+    /**
+     * U2 and U4: one payload per run, measured as the serialized bytes of
+     * `{ html }` against the same aggregate emit spends. A second call throws
+     * naming the constraint rather than replacing the first — one tool result
+     * renders one view, and last-wins would silently discard a payload the
+     * program deliberately supplied.
+     *
+     * Multiplicity is checked before shape, so the second call is told what it
+     * actually broke. A program whose second payload is also malformed has one
+     * problem worth naming — that there is a second payload at all — and a
+     * complaint about its type would send the author to fix the wrong thing.
+     */
+    acceptUi(raw) {
+        if (this.ui) {
+            throw new Error("connecta.ui accepts at most one payload per run: a view was already accepted and stands");
+        }
+        const payload = { html: requireUiHtml(raw) };
+        const size = diagnosticsEncoder.encode(JSON.stringify(payload)).byteLength;
+        if (this.bytes + size > this.maxBytes) {
+            throw new Error(`connecta.ui byte budget exceeded: payload is ${size} serialized bytes with ${this.maxBytes - this.bytes} of ${this.maxBytes} remaining`);
+        }
+        this.ui = payload;
+        this.bytes += size;
+        this.diagnostics?.recordUi(size);
     }
 }
 /** A configured emit budget must be a finite number >= 1; anything else falls back. */
@@ -393,6 +463,16 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
                     }
                     limits.emitCollector.accept(block);
                 },
+                // The rendered-output channel rides the same bridge for the same
+                // reason (U7): one more provider fn, no change to ExecuteResult or
+                // the Executor contract. Delivery is the handler's job, not the
+                // guest's — nothing here becomes addressable.
+                ui: async (html) => {
+                    if (!limits.emitCollector) {
+                        throw new Error("connecta.ui is unavailable: no emission collector was configured for this execution");
+                    }
+                    limits.emitCollector.acceptUi(html);
+                },
                 batch: async (calls) => {
                     const started = Date.now();
                     const callCount = Array.isArray(calls) ? calls.length : 0;
@@ -568,6 +648,9 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                             ? { retryAfterMs: err.retryAfterMs }
                             : {}),
                     },
+                    ...(err instanceof ExecutorExecutionError
+                        ? discardedEmits(emitted)
+                        : {}),
                     ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
                 });
                 result.isError = true;
@@ -684,9 +767,19 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         const response = jsonResult({
             result,
             ...(emitted.blocks.length > 0 ? { emitted: emitted.blocks.length } : {}),
+            // U3: the model learns a view rendered without seeing its bytes. Spread
+            // conditionally so a program that never called connecta.ui produces
+            // today's byte-for-byte response.
+            ...(emitted.ui ? { ui: true } : {}),
             ...(logs ? { logs } : {}),
             ...(diagnostics ? { diagnostics: diagnostics.finish() } : {}),
         });
+        if (emitted.ui) {
+            // _meta is where the Apps spec's best practices put data "not intended
+            // for model context", and how shipped hosts behave. The shell reads
+            // exactly this key out of the tool result the host delivers to it.
+            response._meta = { [PROGRAM_UI_META_KEY]: { html: emitted.ui.html } };
+        }
         if (emitted.blocks.length > 0) {
             // Emitted image/audio blocks are valid MCP content that ToolResult's
             // text-only typing does not model — the same acknowledged gap
@@ -696,17 +789,27 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
         return response;
     };
 }
-/** M4: a failed program delivers no blocks, but the discard is visible. */
+/**
+ * M4 and U3: a failed program delivers no blocks and no view, but each
+ * discard is visible — and one failure can discard both.
+ */
 function discardedEmits(emitted) {
-    return emitted.blocks.length > 0
-        ? { emittedDiscarded: emitted.blocks.length }
-        : {};
+    return {
+        ...(emitted.blocks.length > 0
+            ? { emittedDiscarded: emitted.blocks.length }
+            : {}),
+        ...(emitted.ui ? { uiDiscarded: true } : {}),
+    };
 }
 /** The same visibility for the plain-text error paths. */
 function discardedEmitsText(emitted) {
-    return emitted.blocks.length > 0
-        ? `\n\nemittedDiscarded: ${emitted.blocks.length}`
-        : "";
+    const lines = [
+        ...(emitted.blocks.length > 0
+            ? [`emittedDiscarded: ${emitted.blocks.length}`]
+            : []),
+        ...(emitted.ui ? ["uiDiscarded: true"] : []),
+    ];
+    return lines.length > 0 ? `\n\n${lines.join("\n")}` : "";
 }
 const executeDescription = (emitBudgets) => `The primary surface. Use for discovery beyond one lookup, two or more calls, dependent steps, loops, joins, branching, or reducing large results before they reach the model — connecta.search and connecta.describe browse and expand catalogs in the run, and connecta.batch handles independent calls. The exception is a single call at an address already in hand: search_tools then one call_tool is cheaper than a program. Only tools explicitly annotated readOnlyHint: true are available. Each run is limited to ${EXECUTE_MAX_HOST_CALLS} host calls; connecta.batch accepts at most ${EXECUTE_MAX_BATCH_CALLS}; each host call has a ${EXECUTE_HOST_CALL_TIMEOUT_MS / 1_000}-second deadline.
 
@@ -715,6 +818,7 @@ Write an async arrow function. It runs with NO network, filesystem, timers, or i
 - connecta.call(address, args) and connecta.batch(calls) — call raw addresses.
 - connecta.search(args), connecta.describe({ address: "<connectorId>.<toolName>" }), and connecta.describe({ addresses: [...] }) — load and inspect request-local catalogs on demand. Use safety: "readOnly" to avoid advertising calls this sandbox cannot execute; the filter changes results, not authority. Matches carrying schemas also list inputKeys, requiredInputKeys, and outputKeys — the same names the schema shows, ready to check against before building args. They are absent when a schema is not a plain object shape, so read the schema itself rather than assuming a missing list means no fields.
 - connecta.emit(block) — deliver rich MCP content alongside the JSON return: exactly { type: "text", text } or { type: "image" | "audio", data (base64), mimeType }, no other fields. Blocks are appended to the result on success only, spend no host calls, and are budgeted per run (${emitBudgets.maxBlocks} blocks, ${emitBudgets.maxBytes} serialized bytes); an over-budget or invalid emit throws catchably and accepts nothing.
+- connecta.ui(html) — hand the client one rendered view of this run: exactly one argument, a non-empty HTML string, no options and no block object. At most one per run, delivered on success only, out of model context (the envelope just reports ui: true), and spending no host calls. It draws on the same ${emitBudgets.maxBytes}-byte budget as connecta.emit; a second, over-budget, or invalid call throws catchably and accepts nothing. The view is display-only — no network, no tool calls, no links.
 - console.log(...) — captured and returned alongside the result.
 
 Tool calls return plain values (MCP text content is JSON-parsed when possible) and throw on downstream errors — use try/catch to handle them. A thrown error carries only a message; connecta.batch reports each call as { address, ok: true, data } or { address, ok: false, error, errorDetails: { code, retryable } }, so use it when the program must tell a policy refusal from a transient failure. Never retry a failure whose retryable is false, and never retry a rate_limited one immediately — the sandbox has no timers. Return a JSON-serializable value; large results are truncated, so reduce data in code instead of returning raw payloads.
@@ -757,6 +861,18 @@ export function registerExecuteTool(server, registry, ctx) {
             destructiveHint: false,
             openWorldHint: true,
         },
+        // U5 and U10: declared unconditionally. A host without the Apps
+        // extension ignores unknown _meta and sees the ordinary envelope, which
+        // is the text fallback the spec mandates — and a stateless aggregator
+        // has nowhere dependable to hold a negotiation check anyway. The
+        // explicit visibility keeps hosts from being told the view may call
+        // execute_code; the default ["model","app"] would say exactly that.
+        _meta: {
+            ui: {
+                resourceUri: PROGRAM_UI_RESOURCE_URI,
+                visibility: ["model"],
+            },
+        },
     }, async (args, extra) => {
         const controller = new AbortController();
         const signals = [extra.mcpReq.signal, ctx.requestSignal].filter((signal) => signal !== undefined);