GGUI 0.29 tightens cross-user sessions, embed messages and tool-input boundaries
Released October 25, GGUI 0.29 limits callers carrying an end-user identity to their own sessions, accepts pre-handshake iframe messages only from the parent window, requires a per-mount nonce on the React Native bridge, and can reject oversized tool inputs before handlers run.
Why it matters
Generative UI connects model output, user actions and tool side effects through a shared session. App-only checks without subject isolation let a user holding someone else's session id read events, modify cards, dispatch gestures or overwrite context; embed messages and oversized tool payloads belong to the same runtime trust boundary.
A closer look
The security fix applies app-plus-subject checks to ggui_update, ggui_amend, ggui_emit, runtime pull, action submission, context sync and bearer live-channel subscription. Cross-subject calls become session-not-found before any effect and leave refusal logs without user ids; wsToken remains a bearer capability bound to one session. The release also accepts iframe pre-handshake messages only from window.parent, adds a per-mount nonce to the React Native injected bridge, and introduces a default 10,000-element/member tools/call ceiling with refusal audit events. Advertised tool output schemas are open for future optional members while the server still strips fields outside its own shape. OAuth storage now fails before issuing a code, and multi-replica deployments require shared storage.
Who this is for
Teams operating multi-user GGUI or MCP generative interfaces, React Native hosts, replicated OAuth services or custom tool handlers
Original sources
- GGUI official release and security fix commit ↗github.com
- Cross-subject session isolation fix and tests ↗github.com
Revisions & corrections (1)
— Official 0.29.0 release and linked security commit confirm a new multi-user session isolation boundary plus embed, tool-input, OAuth and compatibility changes; date and limitations are explicit.