frontend-runtime-skills-contract

To securely render frontend components from streamed tool calls, aggregate fragmented args by toolCallId, parse JSON at TOOL_CALL_END, and validate against parametersSchema before executing behavior-specific components.

Schema validation prevents XSS in frontend runtime rendering by gating component execution until args match parametersSchema, enforcing sandboxing rules like iframe for web_preview, and disabling reserved capabilities to isolate untrusted content.

The best way to handle tool call parsing errors and avoid white screens is applying consistent fallback behavior using error cards, placeholders, or text fallback when JSON parsing or schema validation fails during streaming tool call consumption.

You cannot bind frontend runtime capabilities to a specific agent name; the Runtime Capability Registry requires strict lookup by toolName to centralize mapping from toolName to component, behavior, risk level, and failure mode.

ToolResult should be returned after executing frontend runtime capabilities based on defined boundary guidance, which dictates when to safely return results or error cards without exposing unsafe execution states.

Reserved or disabled capabilities are not executing in your frontend runtime because safety rules enforce non-execution of these capabilities, preventing the frontend from rendering unsafe, mismatched, or unregistered behaviors.