Reduce program UI to display-only output

[zackbart]

Summary

• restore connecta.ui(html) as a one-string, display-only output channel
• remove read-manifest validation, declaration-time catalog lookup, the nested-frame read bridge, and app-visible meta-tool metadata
• preserve success-only delivery, shared byte bounds, mirrored return guidance, executor parity, and the byte-identical no-call path
• record the product reversal in ethos.md and retain the former decision as a clearly superseded historical record
• replace the read fixture with browser coverage proving local payload JavaScript works while forged payload messages never become host tool calls

Compatibility

This is a breaking guest API reduction. Programs passing a second argument to connecta.ui now receive invalid_args. The static Apps resource moves from ui://connecta/program-ui/v2 to ui://connecta/program-ui/v3 so hosts do not reuse the cached read-capable shell. The seven MCP tools and one-string UI result shape are unchanged.

Version, upgrade guide, and changelog changes are intentionally left to the aggregate 0.20 release PR.

Verification

• targeted Node and Workers suites: 381 passed, 40 skipped
• npm run check: 114 files passed, 2,721 tests passed, 40 skipped; build and both deployment-shape typechecks passed
• npm run test:browser: 15 passed
• git diff --check

Closes #484
Part of #489

[zackbart]

REQUEST CHANGES

Blocking: keep explicit model-only visibility on every non-app tool.

src/meta-tools.ts now omits _meta.ui.visibility from skills, search_tools, call_tool, call_destructive_tool, authorize_connector, and get_result, and the new server test asserts that omission. In MCP Apps, omitted visibility defaults to ["model", "app"]: https://apps.extensions.modelcontextprotocol.io/api/interfaces/app.McpUiToolMeta.html#visibility. This therefore makes all six tools app-callable. In particular, it does not revoke call_tool from a cached v2 read-capable shell, and it newly exposes the destructive, authorization, discovery, and result tools to Apps. That contradicts the display-only boundary and the project design record, which already explains why visibility must be explicit.

The v3 URI correctly keeps new results from selecting cached v2 shell bytes, but URI versioning cannot replace the server-side tool visibility restriction. Please retain _meta: { ui: { visibility: ["model"] } } on these six tools, removing only "app" from call_tool, and change the wire test to assert the explicit model-only metadata.

I otherwise confirmed that the read manifest/bridge are gone outside the intentionally superseded historical record, the v3 URI is used consistently and v2 is rejected, the one-string connecta.ui break is covered on both executors, local UI delivery remains success-only and sandboxed, and the seven-tool surface is unchanged.

Checks run on commit 19d058d: focused Node + Workers + QuickJS/server/UI suites, 241 passed and 40 skipped; browser suite, 15 passed; npm run check, 114 files passed with 2,721 tests passed and 40 skipped.

GitHub does not permit the PR author account to submit a formal request-changes review, so this is posted as a comment review with the requested verdict.

[zackbart]

Visibility finding fixed in fdf34c6.

All six non-execute tools again send exact _meta: { ui: { visibility: ["model"] } }. call_tool loses only its former "app" visibility. execute_code remains model-only and alone carries the v3 resource URI. This avoids the Apps default of ["model", "app"], so the display-only shell cannot call any MCP tool.

The server test now asserts the complete wire _meta object for every tool, not only the execute declaration. The code-mode contract, design record, and operations test map state the same boundary.

Checks after the fix:

• focused Node server/UI/surface/guest suites: 92 passed, 37 skipped
• focused Workers server/UI/surface/guest suites: 126 passed, 3 skipped
• npm run test:browser: 15 passed
• npm run check: 114 files passed, 2,721 passed, 40 skipped
• git diff --check: passed

Ready for re-review.

[zackbart]

APPROVE

The prior Apps visibility blocker is resolved at fdf34c6.

The wire contract now gives each of the six non-execute_code tools exact _meta.ui.visibility: ["model"]. call_tool has lost only its former "app" access. execute_code is the sole tool with resourceUri: "ui://connecta/program-ui/v3", paired with the same model-only visibility. The end-to-end tools/list test asserts the complete _meta object for all seven tools, so omission, extra metadata, or a resource URI on another tool will fail.

The normative code-mode guide and design record now state why the metadata cannot be omitted: MCP Apps defaults omission to model plus app visibility. This also completes the cached-shell story. The v3 URI keeps new results off cached v2 bytes, while explicit model-only metadata revokes the old shell route at the current catalog boundary.

Verification on the fixed head:

• Focused server.test.ts on Node and Workers: 107 passed, 3 skipped.
• Browser suite: 15 passed.
• npm run check: 114 files passed, 2,721 tests passed, 40 skipped.
• Detached review worktree remained clean.

GitHub does not permit the PR author account to submit a formal approval, so this is posted as a comment review with the requested verdict.