fix: enable bidirectional message relay in rawhtml proxy mode

[antonpk1]

Summary

This PR adds true bidirectional message relay to the rawhtml proxy mode, enabling full two-way communication between the parent window and the inner iframe.

Problem

Currently, the proxy only relays messages in one direction:

• ✅ Inner iframe → Parent: Working
• ❌ Parent → Inner iframe: Only ui-html-content is handled

This limitation prevents parent windows from sending custom messages to the inner iframe, restricting interactive capabilities.

Solution

Modified the message event listener in index.html to relay all messages from parent to inner iframe (not just ui-html-content):

// Before: Only ui-html-content was handled
if (event.source === window.parent && event.data && event.data.type === 'ui-html-content') {
  // handle HTML content
}

// After: All parent messages are relayed
if (event.source === window.parent) {
  if (event.data && event.data.type === 'ui-html-content') {
    // handle HTML content
  } else {
    // relay other messages to inner iframe
    inner.contentWindow.postMessage(event.data, '*');
  }
}

Benefits

This enables MCP-UI applications to implement:

• ✨ Parent-initiated UI updates
• ✨ Action acknowledgments
• ✨ State synchronization
• ✨ Custom event handling
• ✨ Bidirectional protocols

Backward Compatibility

✅ Fully backward compatible - existing ui-html-content flow is unchanged

Testing

Tested with:

• Serving the proxy via Python HTTP server
• Custom messages from parent to inner iframe
• Verified message relay in both directions using console logging

---

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR enables bidirectional message relay in the rawhtml proxy mode by allowing the parent window to send custom messages to the inner iframe, complementing the existing iframe-to-parent communication.

• Modified the message event listener to relay all parent messages to the inner iframe
• Preserved the existing ui-html-content handling logic
• Added a conditional relay for non-content messages

[Copilot]

Using wildcard origin '*' in postMessage allows any origin to receive messages. Consider restricting to specific origins or validating event.origin before relaying messages to prevent potential security vulnerabilities.

[Copilot]

The message is relayed without any validation of event.origin or event.data structure. Consider adding origin validation (checking event.origin against expected parent origins) before relaying messages to improve security.

[idosal]

Great catch, thanks @antonpk1 !