From a44c0d5a4bb3877291b8957a54ef2f457860438b Mon Sep 17 00:00:00 2001
From: jerelvelarde <Jereljohnvelarde@gmail.com>
Date: Tue, 24 Mar 2026 13:50:38 -0700
Subject: [PATCH 1/3] fix: pass DOM node instead of innerHTML string to
 Idiomorph.morph

Idiomorph's innerHTML morphStyle expects a node reference, not a raw
HTML string. Passing tmp (the wrapper element) instead of tmp.innerHTML
fixes SVG rendering issues where nodes were being incorrectly diffed.
---
 apps/app/src/components/generative-ui/widget-renderer.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/app/src/components/generative-ui/widget-renderer.tsx b/apps/app/src/components/generative-ui/widget-renderer.tsx
index 1e45b51..3b7ef48 100644
--- a/apps/app/src/components/generative-ui/widget-renderer.tsx
+++ b/apps/app/src/components/generative-ui/widget-renderer.tsx
@@ -388,7 +388,7 @@ window.addEventListener('message', function(e) {
     // Use idiomorph to diff/patch DOM (preserves existing nodes, no flicker)
     if (window.Idiomorph) {
       try {
-        Idiomorph.morph(content, tmp.innerHTML, {
+        Idiomorph.morph(content, tmp, {
           morphStyle: 'innerHTML',
           callbacks: {
             beforeNodeAdded: function(node) {

From a5890e228642f11b786e130c64cda33e32e10c67 Mon Sep 17 00:00:00 2001
From: jerelvelarde <Jereljohnvelarde@gmail.com>
Date: Tue, 24 Mar 2026 20:17:01 -0700
Subject: [PATCH 2/3] fix: prevent broken script execution during streaming in
 widget iframe

Three bugs in the script execution code caused interactive widgets
(BFS/DFS graphs, animations) to fail:

- btoa() output contains =, +, / which are invalid in HTML attribute
  names, causing setAttribute to throw and abort the entire forEach
- Incomplete <script> tags during streaming produced broken fragments
  that failed on execution
- No error isolation meant one bad script blocked all others

Fix: defer script execution until all <script> tags are fully closed,
sanitize base64 hashes for attribute names, skip empty scripts, and
wrap individual executions in try/catch.
---
 .../generative-ui/widget-renderer.tsx         | 38 ++++++++++++-------
 1 file changed, 24 insertions(+), 14 deletions(-)

diff --git a/apps/app/src/components/generative-ui/widget-renderer.tsx b/apps/app/src/components/generative-ui/widget-renderer.tsx
index 3b7ef48..896874f 100644
--- a/apps/app/src/components/generative-ui/widget-renderer.tsx
+++ b/apps/app/src/components/generative-ui/widget-renderer.tsx
@@ -361,9 +361,13 @@ window.addEventListener('message', function(e) {
     if (!content) return;
 
     // Strip script tags from HTML before inserting — scripts are handled separately below
+    var rawHtml = e.data.html;
     var tmp = document.createElement('div');
-    tmp.innerHTML = e.data.html;
+    tmp.innerHTML = rawHtml;
     var incomingScripts = [];
+    var scriptOpens = (rawHtml.match(/<script[\\s>]/gi) || []).length;
+    var scriptCloses = (rawHtml.match(/<\\/script>/gi) || []).length;
+    var allScriptsClosed = scriptOpens <= scriptCloses;
     tmp.querySelectorAll('script').forEach(function(s) {
       incomingScripts.push({ src: s.src, text: s.textContent });
       s.remove();
@@ -410,19 +414,25 @@ window.addEventListener('message', function(e) {
       content.innerHTML = tmp.innerHTML;
     }
 
-    // Execute only new scripts (not previously executed)
-    incomingScripts.forEach(function(scriptInfo) {
-      var key = scriptInfo.src || scriptInfo.text;
-      if (content.getAttribute('data-exec-' + btoa(key).slice(0, 16))) return;
-      content.setAttribute('data-exec-' + btoa(key).slice(0, 16), '1');
-      var newScript = document.createElement('script');
-      if (scriptInfo.src) {
-        newScript.src = scriptInfo.src;
-      } else {
-        newScript.textContent = scriptInfo.text;
-      }
-      content.appendChild(newScript);
-    });
+    // Execute only new scripts — skip entirely while a <script> tag is still streaming
+    if (allScriptsClosed) {
+      incomingScripts.forEach(function(scriptInfo) {
+        var key = scriptInfo.src || scriptInfo.text;
+        if (!key || !key.trim()) return;
+        var hash = btoa(unescape(encodeURIComponent(key))).slice(0, 16).replace(/[^a-zA-Z0-9]/g, '');
+        if (!hash || content.getAttribute('data-exec-' + hash)) return;
+        content.setAttribute('data-exec-' + hash, '1');
+        try {
+          var newScript = document.createElement('script');
+          if (scriptInfo.src) {
+            newScript.src = scriptInfo.src;
+          } else {
+            newScript.textContent = scriptInfo.text;
+          }
+          content.appendChild(newScript);
+        } catch(e) {}
+      });
+    }
     reportHeight();
   }
 });

From 67d5753d3bb4a89abca54b7614288b861eb4a343 Mon Sep 17 00:00:00 2001
From: jerelvelarde <Jereljohnvelarde@gmail.com>
Date: Wed, 25 Mar 2026 00:26:13 -0700
Subject: [PATCH 3/3] fix: log script execution errors instead of silently
 swallowing them

---
 apps/app/src/components/generative-ui/widget-renderer.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/app/src/components/generative-ui/widget-renderer.tsx b/apps/app/src/components/generative-ui/widget-renderer.tsx
index 896874f..44ed82e 100644
--- a/apps/app/src/components/generative-ui/widget-renderer.tsx
+++ b/apps/app/src/components/generative-ui/widget-renderer.tsx
@@ -430,7 +430,7 @@ window.addEventListener('message', function(e) {
             newScript.textContent = scriptInfo.text;
           }
           content.appendChild(newScript);
-        } catch(e) {}
+        } catch(e) { console.warn('[widget] script exec failed:', e); }
       });
     }
     reportHeight();