sunpeak 0.20.53 → 0.20.56

package/dist/sandbox-proxy.html

@@ -23,6 +23,15 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   var platformScript = platform === 'chatgpt'
     ? "window.openai={uploadFile:function(f){console.log(\"[Inspector] uploadFile:\",f.name);return Promise.resolve({fileId:\"sim_file_\"+Date.now()})},getFileDownloadUrl:function(p){console.log(\"[Inspector] getFileDownloadUrl:\",p.fileId);return Promise.resolve({downloadUrl:\"https://inspector.local/files/\"+p.fileId})},requestModal:function(p){console.log(\"[Inspector] requestModal:\",JSON.stringify(p));return Promise.resolve()},requestCheckout:function(s){console.log(\"[Inspector] requestCheckout:\",JSON.stringify(s));return Promise.resolve({id:\"sim_order_\"+Date.now(),checkout_session_id:s.id||\"sim_session\",status:\"completed\"})},requestClose:function(){console.log(\"[Inspector] requestClose\")},requestDisplayMode:function(p){console.log(\"[Inspector] requestDisplayMode:\",p.mode);return Promise.resolve()},sendFollowUpMessage:function(p){console.log(\"[Inspector] sendFollowUpMessage:\",p.prompt)},openExternal:function(p){console.log(\"[Inspector] openExternal:\",p.href);try{var u=new URL(p.href);if(u.protocol!==\"http:\"&&u.protocol!==\"https:\"){console.warn(\"[Inspector] openExternal blocked non-http(s) URL:\",p.href);return}window.open(p.href,\"_blank\",\"noopener,noreferrer\")}catch(e){console.warn(\"[Inspector] openExternal blocked invalid URL:\",p.href)}}};"
     : null;
+  var DEFAULT_INNER_SANDBOX =
+    'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+  var ALLOWED_INNER_SANDBOX_TOKENS = {
+    'allow-scripts': true,
+    'allow-same-origin': true,
+    'allow-forms': true,
+    'allow-popups': true,
+    'allow-popups-to-escape-sandbox': true
+  };
 
   window.addEventListener('message', function(event) {
     var data = event.data;
@@ -80,8 +89,7 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     clearInterval(readyInterval);
     if (innerFrame) innerFrame.remove();
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox = p.sandbox ||
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = sanitizeInnerSandbox(p.sandbox);
     if (p.allow) innerFrame.allow = p.allow;
     document.body.appendChild(innerFrame);
     innerWindow = innerFrame.contentWindow;
@@ -94,13 +102,14 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
   }
 
   function createInnerFrameWithSrc(p) {
+    var safeSrc = normalizeInnerSrc(p && p.src);
+    if (!safeSrc) return;
     clearInterval(readyInterval);
     if (innerFrame) innerFrame.remove();
     innerFrame = document.createElement('iframe');
-    innerFrame.sandbox =
-      'allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox';
+    innerFrame.sandbox = DEFAULT_INNER_SANDBOX;
     if (p.allow) innerFrame.allow = p.allow;
-    innerFrame.src = p.src;
+    innerFrame.src = safeSrc;
     innerFrame.style.height = '100%';
     if (p.theme) innerFrame.style.colorScheme = p.theme;
 
@@ -145,6 +154,26 @@ iframe { border: none; width: 100%; height: 100%; display: block; }
     innerWindow = innerFrame.contentWindow;
   }
 
+  function sanitizeInnerSandbox(value) {
+    if (typeof value !== 'string' || !value.trim()) return DEFAULT_INNER_SANDBOX;
+    var tokens = value.trim().split(/\s+/);
+    for (var i = 0; i < tokens.length; i++) {
+      if (!ALLOWED_INNER_SANDBOX_TOKENS[tokens[i]]) return DEFAULT_INNER_SANDBOX;
+    }
+    return tokens.join(' ');
+  }
+
+  function normalizeInnerSrc(value) {
+    if (typeof value !== 'string') return null;
+    try {
+      var url = new URL(value, window.location.href);
+      if (url.protocol !== 'http:' && url.protocol !== 'https:') return null;
+      return url.toString();
+    } catch(e) {
+      return null;
+    }
+  }
+
   var PAINT_FENCE_SCRIPT = 'window.addEventListener("message",function(e){' +
     'if(e.data&&e.data.method==="sunpeak/fence"){' +
     'var fid=e.data.params&&e.data.params.fenceId;' +

package/dist/style.css

@@ -1,4 +1,4 @@
-/*! tailwindcss v4.3.0 | MIT License | https://tailwindcss.com */
+/*! tailwindcss v4.3.1 | MIT License | https://tailwindcss.com */
 @layer properties {
   @supports (((-webkit-hyphens: none)) and (not (margin-trim: inline))) or ((-moz-orient: inline) and (not (color: rgb(from red r g b)))) {
     *, :before, :after, ::backdrop {
@@ -418,15 +418,15 @@
   }
 
   .inset-0 {
-    inset: calc(var(--spacing) * 0);
+    inset: 0;
   }
 
   .inset-x-0 {
-    inset-inline: calc(var(--spacing) * 0);
+    inset-inline: 0;
   }
 
   .inset-y-0 {
-    inset-block: calc(var(--spacing) * 0);
+    inset-block: 0;
   }
 
   .-start-2 {
@@ -454,7 +454,7 @@
   }
 
   .top-0 {
-    top: calc(var(--spacing) * 0);
+    top: 0;
   }
 
   .top-1\/2 {
@@ -490,7 +490,7 @@
   }
 
   .right-0 {
-    right: calc(var(--spacing) * 0);
+    right: 0;
   }
 
   .right-2 {
@@ -506,7 +506,7 @@
   }
 
   .bottom-0 {
-    bottom: calc(var(--spacing) * 0);
+    bottom: 0;
   }
 
   .bottom-2 {
@@ -522,7 +522,7 @@
   }
 
   .left-0 {
-    left: calc(var(--spacing) * 0);
+    left: 0;
   }
 
   .left-2 {
@@ -616,7 +616,7 @@
   }
 
   .mx-0 {
-    margin-inline: calc(var(--spacing) * 0);
+    margin-inline: 0;
   }
 
   .mx-auto {
@@ -636,7 +636,7 @@
   }
 
   .mt-1 {
-    margin-top: calc(var(--spacing) * 1);
+    margin-top: var(--spacing);
   }
 
   .mt-2 {
@@ -656,7 +656,7 @@
   }
 
   .mb-1 {
-    margin-bottom: calc(var(--spacing) * 1);
+    margin-bottom: var(--spacing);
   }
 
   .mb-2 {
@@ -668,7 +668,7 @@
   }
 
   .ml-1 {
-    margin-left: calc(var(--spacing) * 1);
+    margin-left: var(--spacing);
   }
 
   .line-clamp-2 {
@@ -816,7 +816,7 @@
   }
 
   .min-h-0 {
-    min-height: calc(var(--spacing) * 0);
+    min-height: 0;
   }
 
   .min-h-8 {
@@ -824,7 +824,7 @@
   }
 
   .w-1 {
-    width: calc(var(--spacing) * 1);
+    width: var(--spacing);
   }
 
   .w-2 {
@@ -920,7 +920,7 @@
   }
 
   .min-w-0 {
-    min-width: calc(var(--spacing) * 0);
+    min-width: 0;
   }
 
   .min-w-8 {
@@ -1055,7 +1055,7 @@
   }
 
   .gap-1 {
-    gap: calc(var(--spacing) * 1);
+    gap: var(--spacing);
   }
 
   .gap-1\.5 {
@@ -1082,8 +1082,8 @@
 
   :where(.space-y-1 > :not(:last-child)) {
     --tw-space-y-reverse: 0;
-    margin-block-start: calc(calc(var(--spacing) * 1) * var(--tw-space-y-reverse));
-    margin-block-end: calc(calc(var(--spacing) * 1) * calc(1 - var(--tw-space-y-reverse)));
+    margin-block-start: calc(var(--spacing) * var(--tw-space-y-reverse));
+    margin-block-end: calc(var(--spacing) * calc(1 - var(--tw-space-y-reverse)));
   }
 
   :where(.space-y-2 > :not(:last-child)) {
@@ -1422,11 +1422,11 @@
   }
 
   .p-0 {
-    padding: calc(var(--spacing) * 0);
+    padding: 0;
   }
 
   .p-1 {
-    padding: calc(var(--spacing) * 1);
+    padding: var(--spacing);
   }
 
   .p-1\.5 {
@@ -1502,7 +1502,7 @@
   }
 
   .py-1 {
-    padding-block: calc(var(--spacing) * 1);
+    padding-block: var(--spacing);
   }
 
   .py-1\.5 {
@@ -1526,7 +1526,7 @@
   }
 
   .pt-0 {
-    padding-top: calc(var(--spacing) * 0);
+    padding-top: 0;
   }
 
   .pt-2 {
@@ -2032,11 +2032,11 @@
     }
 
     .max-md\:inset-y-0 {
-      inset-block: calc(var(--spacing) * 0);
+      inset-block: 0;
     }
 
     .max-md\:left-0 {
-      left: calc(var(--spacing) * 0);
+      left: 0;
     }
 
     .max-md\:z-\[100\] {
@@ -2053,7 +2053,7 @@
     }
 
     .max-md\:translate-x-0 {
-      --tw-translate-x: calc(var(--spacing) * 0);
+      --tw-translate-x: 0;
       translate: var(--tw-translate-x) var(--tw-translate-y);
     }
 
@@ -2197,7 +2197,7 @@
     }
 
     .xl\:mt-0 {
-      margin-top: calc(var(--spacing) * 0);
+      margin-top: 0;
     }
 
     .xl\:w-\[360px\] {
@@ -2218,7 +2218,7 @@
     }
 
     .xl\:px-0 {
-      padding-inline: calc(var(--spacing) * 0);
+      padding-inline: 0;
     }
 
     .xl\:shadow-xl {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sunpeak",
-  "version": "0.20.53",
+  "version": "0.20.56",
   "description": "App framework, testing framework, and inspector for MCP Apps.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -159,45 +159,45 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/anthropic": "^3.0.81",
-    "@ai-sdk/openai": "^3.0.68",
-    "@clack/prompts": "^1.5.1",
+    "@ai-sdk/anthropic": "^3.0.85",
+    "@ai-sdk/openai": "^3.0.73",
+    "@clack/prompts": "^1.6.0",
     "@modelcontextprotocol/ext-apps": "^1.7.4",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@vitejs/plugin-react": "^6.0.2",
-    "ai": "^6.0.197",
+    "ai": "^6.0.208",
     "clsx": "^2.1.1",
-    "esbuild": "^0.28.0",
+    "esbuild": "^0.28.1",
     "tailwind-merge": "^3.6.0",
     "vite": "8.0.16",
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@playwright/test": "^1.60.0",
-    "@tailwindcss/cli": "^4.3.0",
-    "@tailwindcss/vite": "^4.3.0",
+    "@playwright/test": "1.60.0",
+    "@tailwindcss/cli": "^4.3.1",
+    "@tailwindcss/vite": "^4.3.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "^25.9.2",
+    "@types/node": "^26.0.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
-    "@typescript-eslint/eslint-plugin": "^8.60.1",
-    "@typescript-eslint/parser": "^8.60.1",
+    "@typescript-eslint/eslint-plugin": "^8.61.1",
+    "@typescript-eslint/parser": "^8.61.1",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-react-hooks": "^7.1.1",
-    "happy-dom": "^20.10.1",
-    "prettier": "^3.8.3",
+    "happy-dom": "^20.10.6",
+    "prettier": "^3.8.4",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",
-    "tailwindcss": "^4.3.0",
+    "tailwindcss": "^4.3.1",
     "ts-node": "^10.9.2",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vite-plugin-dts": "^5.0.1",
-    "vitest": "^4.1.8"
+    "vite-plugin-dts": "5.0.1",
+    "vitest": "^4.1.9"
   },
   "repository": {
     "type": "git",