layered-assistant-rails 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9419d936b5247ec519e481b02b7ead93a0e85bd6720a7b4298d145810c1405be
-  data.tar.gz: 5f9058cdae99fa50b3bf704853b74205f9a544e8c8430611ceb6ba1a509356bf
+  metadata.gz: e20ccd66f325c50ccfa813d277572f2d6c4a4460145fa21697adfef42c2a4e25
+  data.tar.gz: 109f84519abfcc651e7b0b2c89386cddb6a6c92ee51dddca8b2b43b3ebd1ecae
 SHA512:
-  metadata.gz: d5111d8c91517082ac5ab5eea935df4fbf73f0952c7455fcf6ac98f1fadab19f842aa0bf2483c60cdf1d8aaf2cfdb2cb812f488e7352195586038337f3e2314a
-  data.tar.gz: 3776256743b2734f9ae369508770e8cdc327e17299de34d01af376ba594485b4e55d2b160ce4b4820968c657fedcca2ede227067810a7dcb6f134e29dc5dd7ca
+  metadata.gz: e68add80616b9619fc97bad66081be5f40013c5354360c06247a9ea05e44985b639ed683e8794edbbe0abf791d7f53cb0887c442483b28b0b2b617586ea80dd3
+  data.tar.gz: 1f22e1f958687aa943a0623316fde162afc517c3c3ca6f299ee1c30e72a36c4b676c00bf7f0af977200489612eaaa009662c332fbd000abf8bd6e587dc051b4e

data/NOTICE

@@ -5,3 +5,23 @@ Copyright 2026 LAYERED AI LIMITED (UK company number: 17056830).
 This product includes software developed by LAYERED AI LIMITED and contributors.
 
 Licensed under the Apache License, Version 2.0.
+
+------------------------------------------------------------------------
+Third-party software
+------------------------------------------------------------------------
+
+This product bundles the following third-party JavaScript libraries
+under app/javascript/layered_assistant/vendor/. Their full license
+texts are included alongside the source files.
+
+  marked (https://github.com/markedjs/marked)
+    Copyright (c) 2018+ MarkedJS
+    Copyright (c) 2011-2018 Christopher Jeffrey
+    Licensed under the MIT License.
+    See: app/javascript/layered_assistant/vendor/marked.LICENSE
+
+  DOMPurify (https://github.com/cure53/DOMPurify)
+    Copyright Dr.-Ing. Mario Heiderich, Cure53
+    Dual-licensed under the Apache License 2.0 or the
+    Mozilla Public License 2.0; used here under Apache-2.0.
+    See: app/javascript/layered_assistant/vendor/dompurify.LICENSE

data/app/controllers/layered/assistant/assistants_controller.rb

@@ -1,10 +1,10 @@
 module Layered
   module Assistant
     class AssistantsController < ApplicationController
-      before_action :set_assistant, only: [:edit, :update, :destroy]
-      before_action :set_models, only: [:new, :create, :edit, :update]
-      before_action :set_personas, only: [:new, :create, :edit, :update]
-      before_action :set_skills, only: [:new, :create, :edit, :update]
+      before_action :set_assistant, only: [ :edit, :update, :destroy ]
+      before_action :set_models, only: [ :new, :create, :edit, :update ]
+      before_action :set_personas, only: [ :new, :create, :edit, :update ]
+      before_action :set_skills, only: [ :new, :create, :edit, :update ]
 
       def index
         @page_title = "Assistants"

data/app/controllers/layered/assistant/conversations_controller.rb

@@ -3,8 +3,8 @@ module Layered
     class ConversationsController < ApplicationController
       include StoppableResponse
 
-      before_action :set_conversation, only: [:show, :edit, :update, :destroy, :stop]
-      before_action :set_assistants, only: [:new, :create]
+      before_action :set_conversation, only: [ :show, :edit, :update, :destroy, :stop ]
+      before_action :set_assistants, only: [ :new, :create ]
 
       def index
         if params[:assistant_id]
@@ -26,7 +26,7 @@ module Layered
 
       def new
         @page_title = "New conversation"
-        @conversation = Conversation.new(params.permit(conversation: [:assistant_id])[:conversation])
+        @conversation = Conversation.new(params.permit(conversation: [ :assistant_id ])[:conversation])
       end
 
       def create
@@ -35,7 +35,7 @@ module Layered
         @conversation.assistant = scoped(Assistant).find(conversation_params[:assistant_id]) if conversation_params[:assistant_id].present?
         @conversation.name = Conversation.default_name if @conversation.name.blank?
         if @conversation.save
-          redirect_to layered_assistant.conversation_path(@conversation), notice: "Conversation was successfully created."
+          redirect_to layered_assistant.conversation_path(@conversation)
         else
           render :new, status: :unprocessable_entity
         end

data/app/controllers/layered/assistant/messages_controller.rb

@@ -4,7 +4,7 @@ module Layered
       include MessageCreation
 
       before_action :set_conversation
-      before_action :set_message, only: [:destroy]
+      before_action :set_message, only: [ :destroy ]
 
       def index
         @page_title = "Messages"

data/app/controllers/layered/assistant/models_controller.rb

@@ -2,7 +2,7 @@ module Layered
   module Assistant
     class ModelsController < ApplicationController
       before_action :set_provider
-      before_action :set_model, only: [:edit, :update, :destroy]
+      before_action :set_model, only: [ :edit, :update, :destroy ]
 
       def index
         @pagy, @models = pagy(@provider.models.sorted)

data/app/controllers/layered/assistant/panel/conversations_controller.rb

@@ -5,9 +5,9 @@ module Layered
         include StoppableResponse
         layout false
 
-        before_action :set_conversation, only: [:show, :destroy, :stop]
-        before_action :set_conversations, only: [:index, :show]
-        before_action :set_assistants, only: [:index, :show, :new, :create]
+        before_action :set_conversation, only: [ :show, :destroy, :stop ]
+        before_action :set_conversations, only: [ :index, :show ]
+        before_action :set_assistants, only: [ :index, :show, :new, :create ]
 
         def index
         end

data/app/controllers/layered/assistant/personas_controller.rb

@@ -1,7 +1,7 @@
 module Layered
   module Assistant
     class PersonasController < ApplicationController
-      before_action :set_persona, only: [:edit, :update, :destroy]
+      before_action :set_persona, only: [ :edit, :update, :destroy ]
 
       def index
         @page_title = "Personas"

data/app/controllers/layered/assistant/providers_controller.rb

@@ -1,7 +1,7 @@
 module Layered
   module Assistant
     class ProvidersController < ApplicationController
-      before_action :set_provider, only: [:edit, :update, :destroy]
+      before_action :set_provider, only: [ :edit, :update, :destroy ]
 
       def index
         @page_title = "Providers"

data/app/controllers/layered/assistant/public/assistants_controller.rb

@@ -2,7 +2,7 @@ module Layered
   module Assistant
     module Public
       class AssistantsController < ApplicationController
-        before_action :set_public_assistant, only: [:show]
+        before_action :set_public_assistant, only: [ :show ]
 
         def index
           @pagy, @assistants = pagy(Assistant.publicly_available.by_name)

data/app/controllers/layered/assistant/public/conversations_controller.rb

@@ -4,8 +4,8 @@ module Layered
       class ConversationsController < ApplicationController
         include StoppableResponse
 
-        before_action :set_public_assistant, only: [:create]
-        before_action :set_conversation, only: [:show, :stop]
+        before_action :set_public_assistant, only: [ :create ]
+        before_action :set_conversation, only: [ :show, :stop ]
 
         def create
           @conversation = @assistant.conversations.new(name: Conversation.default_name)

data/app/controllers/layered/assistant/public/panel/conversations_controller.rb

@@ -6,9 +6,9 @@ module Layered
           include StoppableResponse
           layout false
 
-          before_action :set_public_assistant, only: [:index, :new, :create]
-          before_action :set_conversation, only: [:show, :stop]
-          before_action :set_session_conversations, only: [:index, :show]
+          before_action :set_public_assistant, only: [ :index, :new, :create ]
+          before_action :set_conversation, only: [ :show, :stop ]
+          before_action :set_session_conversations, only: [ :index, :show ]
 
           def index
           end

data/app/controllers/layered/assistant/skills_controller.rb

@@ -1,7 +1,7 @@
 module Layered
   module Assistant
     class SkillsController < ApplicationController
-      before_action :set_skill, only: [:edit, :update, :destroy]
+      before_action :set_skill, only: [ :edit, :update, :destroy ]
 
       def index
         @page_title = "Skills"

data/app/helpers/layered/assistant/messages_helper.rb

@@ -1,20 +1,6 @@
 module Layered
   module Assistant
     module MessagesHelper
-      ALLOWED_TAGS = %w[
-        p br
-        h1 h2 h3 h4 h5 h6
-        strong em s del
-        ul ol li
-        pre code
-        a
-        blockquote
-        table thead tbody tr th td
-        hr
-      ].freeze
-
-      ALLOWED_ATTRIBUTES = %w[href title class].freeze
-
       MIN_RESPONSE_MS_FOR_TPS = 100
 
       def message_metadata_title(message)
@@ -31,80 +17,6 @@ module Layered
         parts << "#{message.ttft_ms}ms TTFT" if message.ttft_ms
         parts.join(" · ")
       end
-
-      def render_message_content(message)
-        return if message.content.blank?
-
-        render_markdown(message.content)
-      end
-
-      # Renders accumulated content for streaming, holding back any
-      # trailing unclosed code fence that Kramdown can't parse correctly.
-      # Returns { html:, has_unclosed_fence: } so the caller can decide
-      # whether to show a typing indicator.
-      def render_streaming_markdown(content)
-        return { html: "", has_unclosed_fence: false } if content.blank?
-
-        safe = strip_unclosed_fence(content)
-        {
-          html: safe.present? ? render_markdown(safe) : "",
-          has_unclosed_fence: safe.length < content.length
-        }
-      end
-
-      private
-
-      def render_markdown(content)
-        markdown = unwrap_markdown_fence(content)
-        markdown = ensure_blank_line_before_tables(markdown)
-
-        html = Kramdown::Document.new(
-          markdown,
-          input: "GFM",
-          syntax_highlighter: nil
-        ).to_html
-
-        sanitize(html, tags: ALLOWED_TAGS, attributes: ALLOWED_ATTRIBUTES)
-      end
-
-      # Some LLMs wrap their entire response in a ```markdown fence.
-      # Strip it so Kramdown processes the inner content directly.
-      def unwrap_markdown_fence(content)
-        if content.start_with?("```markdown\n") && content.end_with?("\n```")
-          content.delete_prefix("```markdown\n").delete_suffix("\n```")
-        else
-          content
-        end
-      end
-
-      # Kramdown GFM requires a blank line before a table, but LLMs often
-      # place tables directly after headings or paragraphs. Insert one
-      # where missing so that Kramdown recognises the table syntax.
-      def ensure_blank_line_before_tables(text)
-        text.gsub(/([^\n])\n(\|[^\n]+\|\s*\n\|[\s:|-]+\|\s*\n)/, "\\1\n\n\\2")
-      end
-
-      # Returns text up to (but not including) any trailing unclosed code
-      # fence. Kramdown can't produce valid output for a half-open fence,
-      # so we hold it back until the closing marker arrives.
-      def strip_unclosed_fence(text)
-        fence_marker = nil
-        fence_start = 0
-        pos = 0
-
-        text.each_line do |line|
-          trimmed = line.lstrip
-          if fence_marker.nil? && (match = trimmed.match(/\A(`{3,}|~{3,})/))
-            fence_marker = match[1]
-            fence_start = pos
-          elsif fence_marker && trimmed.match?(/\A#{Regexp.escape(fence_marker[0])}{#{fence_marker.length},}\s*\z/)
-            fence_marker = nil
-          end
-          pos += line.length
-        end
-
-        fence_marker ? text[0, fence_start] : text
-      end
     end
   end
 end

data/app/javascript/layered_assistant/composer_controller.js

@@ -78,7 +78,6 @@ export default class extends Controller {
 
     const empty = this.inputTarget.value.trim() === ""
     this.sendButtonTarget.disabled = empty
-    this.sendButtonTarget.classList.toggle("l-ui-button--disabled", empty)
   }
 
   // Toggle visibility of the Send and Stop buttons. While responding a

data/app/javascript/layered_assistant/index.js

@@ -1,6 +1,7 @@
 import { application } from "controllers/application"
 import ComposerController from "layered_assistant/composer_controller"
 import ConversationSelectController from "layered_assistant/conversation_select_controller"
+import MarkdownController from "layered_assistant/markdown_controller"
 import MessagesController from "layered_assistant/messages_controller"
 import PanelController from "layered_assistant/panel_controller"
 import PanelNavController from "layered_assistant/panel_nav_controller"
@@ -8,6 +9,7 @@ import ProviderTemplateController from "layered_assistant/provider_template_cont
 
 application.register("composer", ComposerController)
 application.register("conversation-select", ConversationSelectController)
+application.register("markdown", MarkdownController)
 application.register("messages", MessagesController)
 application.register("panel", PanelController)
 application.register("panel-nav", PanelNavController)

data/app/javascript/layered_assistant/markdown_controller.js

@@ -0,0 +1,19 @@
+import { Controller } from "@hotwired/stimulus"
+import { renderMarkdown } from "layered_assistant/marked_setup"
+
+// Renders raw markdown (placed in the element by the server) as HTML
+// on connect. Streaming chunks bypass this and write innerHTML
+// directly via Turbo stream actions.
+
+export default class extends Controller {
+  connect() {
+    // Skip if the element already contains rendered HTML - e.g. Turbo
+    // Drive cache restore, or streaming output appended by the message
+    // stream actions. textContent would flatten rendered HTML back to
+    // plain text and marked would silently drop all formatting.
+    if (this.element.firstElementChild) return
+    const text = this.element.textContent.trim()
+    if (!text) return
+    this.element.innerHTML = renderMarkdown(text)
+  }
+}

data/app/javascript/layered_assistant/marked_setup.js

@@ -0,0 +1,20 @@
+// Markdown rendering pipeline.
+//
+// Marked parses LLM output (including any raw HTML it emits), then
+// DOMPurify sanitises the result: it strips <script> and other unsafe
+// tags, validates URL schemes (blocking javascript:, data:, vbscript:
+// in href/src), and removes unsafe attributes. DOMPurify is the sole
+// security boundary here.
+
+import { marked } from "marked"
+import DOMPurify from "dompurify"
+
+marked.use({
+  gfm: true,
+  breaks: false
+})
+
+export function renderMarkdown(text) {
+  if (!text) return ""
+  return DOMPurify.sanitize(marked.parse(text))
+}

data/app/javascript/layered_assistant/message_streaming.js

@@ -1,74 +1,56 @@
-// Incremental markdown rendering for streamed assistant messages.
+// Streaming render for assistant messages.
 //
-// The server broadcasts pre-rendered HTML via a custom Turbo Stream action
-// (render_content). This module reconciles the DOM block by block -
-// patching unchanged blocks in place so fade-in animations aren't
-// interrupted. Both streaming preview and final output use the same
-// server-side Kramdown pipeline, eliminating parser drift.
+// The server broadcasts the raw markdown content as it grows; the
+// client parses it with marked and appends newly-closed top-level
+// blocks to the message content element with a fade. The trailing
+// block is always held back - even when it's already complete - so
+// we don't fade-restart it on every chunk; the typing indicator
+// sibling covers for it visually. Trade-off: single-block responses
+// stay hidden until broadcast_response_complete swaps in the final
+// partial. Acceptable because the swap is near-instant and the
+// indicator masks the gap.
 
 import "@hotwired/turbo-rails"
+import { renderMarkdown } from "layered_assistant/marked_setup"
 
-const pendingHtml = new WeakMap()
+const pendingMarkdown = new WeakMap()
 const pendingRender = new WeakMap()
 
-function reconcile(target, html) {
-  const temp = document.createElement("div")
-  temp.innerHTML = html
-
-  // Snapshot temp.children since moves will mutate the live HTMLCollection
-  const newBlocks = [...temp.children]
-
-  // Trim excess blocks from previous render
-  while (target.children.length > newBlocks.length) {
-    target.lastElementChild.remove()
-  }
-
-  // Reconcile block by block - preserves existing DOM nodes (and their
-  // running fade-in animations) wherever possible
-  for (let i = 0; i < newBlocks.length; i++) {
-    if (i < target.children.length && target.children[i].tagName === newBlocks[i].tagName) {
-      // Same tag - patch content in place
-      if (target.children[i].innerHTML !== newBlocks[i].innerHTML) {
-        target.children[i].innerHTML = newBlocks[i].innerHTML
-      }
-    } else if (i < target.children.length) {
-      // Tag changed (e.g. <p> became <table>) - replace node
-      target.children[i].replaceWith(newBlocks[i])
-    } else {
-      // New block - append with fade
-      newBlocks[i].classList.add("l-ui-token-fade")
-      target.appendChild(newBlocks[i])
-    }
-  }
-}
-
 Turbo.StreamActions.enable_composer = function () {
   this.targetElements.forEach((form) => {
     form.setAttribute("data-composer-responding-value", "false")
   })
 }
 
-Turbo.StreamActions.render_content = function () {
-  this.targetElements.forEach((target) => {
-    if (!target.classList.contains("l-ui-markdown")) {
-      target.classList.add("l-ui-markdown")
-    }
+function syncStreamingContent(target, markdown) {
+  const tmp = document.createElement("div")
+  tmp.innerHTML = renderMarkdown(markdown)
+  const incoming = [...tmp.children]
+  // Hold back the trailing in-progress block; only append new closed ones.
+  const closedCount = Math.max(0, incoming.length - 1)
+  for (let i = target.children.length; i < closedCount; i++) {
+    incoming[i].classList.add("l-ui-stream-fade")
+    target.appendChild(incoming[i])
+  }
+  if (target.children.length > 0) {
+    const indicator = target.parentElement?.querySelector(".l-ui-typing-indicator")
+    indicator?.classList.add("l-ui-mt-4")
+  }
+}
 
-    const html = this.templateContent
+Turbo.StreamActions.render_content = function () {
+  const markdown = this.templateContent.textContent
 
-    // Always store the latest HTML so the requestAnimationFrame callback
-    // uses the newest version - convert DocumentFragment to HTML string
-    const div = document.createElement("div")
-    div.append(html.cloneNode(true))
-    pendingHtml.set(target, div.innerHTML)
+  this.targetElements.forEach((target) => {
+    pendingMarkdown.set(target, markdown)
 
     if (!pendingRender.has(target)) {
       pendingRender.set(target, requestAnimationFrame(() => {
         pendingRender.delete(target)
-        const latestHtml = pendingHtml.get(target)
-        if (latestHtml != null) {
-          reconcile(target, latestHtml)
-          pendingHtml.delete(target)
+        const md = pendingMarkdown.get(target)
+        if (md != null) {
+          syncStreamingContent(target, md)
+          pendingMarkdown.delete(target)
         }
       }))
     }

data/app/javascript/layered_assistant/messages_controller.js

@@ -14,7 +14,7 @@ export default class extends Controller {
         const body = el.closest(".l-ui-message__body")
         el.remove()
         if (body && body.children.length === 0) {
-          body.insertAdjacentHTML("beforeend", '<div class="l-ui-notice--error" role="status">The response could not be completed.</div>')
+          body.insertAdjacentHTML("beforeend", '<div class="l-ui-notice l-ui-notice--error" role="status">The response could not be completed.</div>')
         }
       })
     }