@assemblyline-agents/openui 5.0.9 → 6.0.0

package/README.md

@@ -1,72 +1,74 @@
 # @assemblyline-agents/openui
 
-Reusable Assembly Line lifecycle tools backed by the official OpenUI runtime.
+Official OpenUI artifact plugin. It contributes a reviewed operating Skill and
+three tools: `openui_create`, `openui_update`, and `openui_publish`.
 
-The default component pack is the complete 54-component \`@openuidev/react-ui\` standard library. Developers can allow every component, restrict it by name, or register an independently versioned component pack. The model supplies only OpenUI Lang and a title. It never supplies publication HTML, CSS, or JavaScript.
+## Add the plugin
 
-## Add the pack
-
-\`\`\`sh
+```sh
 assembly-line add openui agent
-\`\`\`
-
-This creates \`tool-config/openui.ts\`, three tool wrappers, and the OpenUI operating skill. Configure \`R2_PUBLIC_BASE_URL\` or \`S3_PUBLIC_BASE_URL\` with an HTTPS origin before publishing.
-
-The generated configuration uses the official standard pack with every component enabled. Restrict and theme it explicitly when needed:
-
-\`\`\`ts
-import { defineOpenUiConfig } from "@assemblyline-agents/openui";
-
-export default defineOpenUiConfig({
-  allowedComponents: ["Stack", "Card", "CardHeader", "TextContent", "Table", "Col"],
-  brand: {
-    name: "Example",
-    theme: {
-      background: "#F7F7F5",
-      textBrand: "#1F2937",
-      fontHeading: "Georgia, serif",
-      fontBody: "Arial, sans-serif"
-    }
-  }
-});
-\`\`\`
-
-The tool's \`document\` schema is generated from the selected pack and allowlist, so agents see the permitted component signatures rather than a framework-owned report vocabulary. Artifact titles are lifecycle metadata and do not force a particular root component.
-
-The standard renderer keeps desktop row compositions intact and automatically wraps row \`Stack\` layouts on narrow screens. Metric cards and callouts use a readable minimum width, yielding two columns when the container can support them and one column when it cannot. The document itself cannot scroll sideways; wide tables and Cartesian charts retain component-local scrolling, while pie, radial, and radar compositions wrap within the viewport. Mobile table text stays at the reviewed size instead of being enlarged by browser text autosizing.
+```
+
+The command selects `openui` in `agent.md` and updates `plugins.lock`. It does
+not create root tool wrappers or a `tool-config/` directory.
+
+Publishing requires `R2_PUBLIC_BASE_URL` or `S3_PUBLIC_BASE_URL` to be an HTTPS
+origin. The official plugin always exposes the complete standard OpenUI
+component library. Configure its brand and theme declaratively in `agent.md`:
+
+```yaml
+capabilities:
+  openui:
+    config:
+      brand:
+        name: Example
+        legalName: Example, Inc.
+        theme:
+          background: "#F7F7F5"
+          foreground: "#FFFFFF"
+          textBrand: "#1F2937"
+          textAccentPrimary: "#2563EB"
+          borderDefault: "#E5E7EB"
+          borderAccent: "#2563EB"
+          fontHeading: '"Cormorant Garamond", Georgia, serif'
+          fontBody: '"Outfit", Arial, sans-serif'
+        footer: Example | Confidential
+```
+
+`brand` accepts `name`, `legalName`, OpenUI `theme` tokens, an optional data-URI
+`logo`, and `footer`. The package owns the component library and trusted
+renderer; agent configuration cannot provide executable rendering code.
+
+Change only supported authority exceptions. For example, keep creation and
+editing but remove publication:
+
+```yaml
+capabilities:
+  openui:
+    tools:
+      disable: [openui_publish]
+```
+
+To change the component pack or trusted renderer, publish a reviewed plugin
+implementation that uses this package's TypeScript APIs. Those changes are
+executable plugin policy, not agent configuration.
 
-## Component packs
-
-A component pack combines an OpenUI library, an immutable identity and version, and trusted publication code:
-
-\`\`\`ts
-import {
-  createOpenUiLibrary,
-  defineOpenUiConfig,
-  type OpenUiComponentPack
-} from "@assemblyline-agents/openui";
-
-const pack: OpenUiComponentPack = {
-  id: "@example/product-ui",
-  version: "3.1.0",
-  library: createOpenUiLibrary({
-    root: "ProductPage",
-    components: [ProductPage, Metric, Chart]
-  }),
-  render({ source, title, config }) {
-    return renderReviewedProductUi({ source, title, theme: config.brand.theme });
-  }
-};
-
-export default defineOpenUiConfig({ componentPack: pack });
-\`\`\`
+## Lifecycle and security
 
-Pack renderers execute as trusted application code. Review and version them like any other plugin. Project content may select installed packs, but it must not load arbitrary repository code into the runtime.
+Artifacts use immutable revisions. Publication renders the selected revision,
+verifies the stored bytes, and gives the channel the exact HTTPS URL. The
+model never supplies HTML, CSS, JavaScript, or the final delivery URL.
 
-## Lifecycle and security
+`openui_create.document` and `openui_update.document` accept either inline
+OpenUI Lang or an exact `@/workspace/<file>` reference. Workspace references
+are resolved through the current run's sandbox, remain confined below
+`/workspace`, and are subject to the same document-size and parser policy as
+inline input. This keeps large generated reports out of tool-call payloads.
 
-\`openui_create\` and \`openui_update\` store private immutable revisions with the exact pack version, allowlist, theme, and provenance. \`openui_publish\` renders the selected revision without an approval pause, verifies the bytes served by storage, and selects that exact HTTPS URL for runtime delivery. Its model-facing result omits the URL, so the channel does not depend on the model copying a link.
+The official renderer runs with a network-disabled content security policy.
+Published links are unlisted bearer links; use channel file delivery when an
+artifact must remain private.
 
-The official renderer embeds OpenUI's reviewed browser runtime and styles in a network-disabled CSP. Agent content cannot add scripts, styles, external requests, queries, or mutations. Local OpenUI state and actions are disabled by default and can be enabled by the developer. Tightening the current allowlist or interactivity policy also blocks publication of older revisions that exceed it.
+## License
 
-Published links are unlisted bearer links. Use the built-in \`deliver_artifact\` tool instead when the artifact must remain a private channel file.
+MIT

package/ai.assemblyline/index.ts

@@ -0,0 +1,127 @@
+/** Static Agent Plugins v1 descriptor. Runtime factories use the package's public export. */
+export const configSchema = {
+  type: "object",
+  properties: {
+    brand: {
+      type: "object",
+      properties: {
+        name: { type: "string", minLength: 1, maxLength: 120 },
+        legalName: { type: "string", minLength: 1, maxLength: 160 },
+        theme: {
+          type: "object",
+          maxProperties: 200,
+          additionalProperties: {
+            anyOf: [
+              { type: "string", minLength: 1, maxLength: 1000 },
+              {
+                type: "array",
+                maxItems: 32,
+                items: { type: "string", minLength: 1, maxLength: 1000 }
+              }
+            ]
+          }
+        },
+        logo: {
+          type: "object",
+          properties: {
+            dataUri: { type: "string", pattern: "^data:image/" },
+            alt: { type: "string", minLength: 1, maxLength: 200 }
+          },
+          required: ["dataUri", "alt"],
+          additionalProperties: false
+        },
+        footer: { type: "string", minLength: 1, maxLength: 240 }
+      },
+      additionalProperties: false
+    }
+  },
+  additionalProperties: false
+};
+
+export const tools = {
+  openui_create: {
+    definition: "@assemblyline-agents/openui",
+    factory: "defineOpenUiCreateTool",
+    description: "Create an immutable artifact revision from developer-approved OpenUI components. Raw HTML is not accepted.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", minLength: 1, maxLength: 240 },
+        document: { type: "string" }
+      },
+      required: ["title", "document"],
+      additionalProperties: false
+    },
+    outputSchema: {
+      type: "object",
+      properties: {
+        artifactId: { type: "string" },
+        revision: { type: "string" },
+        parentRevision: { type: "string" },
+        title: { type: "string" },
+        status: { type: "string", enum: ["draft"] }
+      },
+      required: ["artifactId", "revision", "title", "status"]
+    },
+    needsApproval: false,
+    capability: { visibility: "always", execution: "direct", namespace: "openui", tags: ["artifacts", "ui"] }
+  },
+  openui_update: {
+    definition: "@assemblyline-agents/openui",
+    factory: "defineOpenUiUpdateTool",
+    description: "Create a new immutable revision of an existing OpenUI artifact. Raw HTML is not accepted.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        artifactId: { type: "string", pattern: "^oui_[a-f0-9]{24}$" },
+        revision: { type: "string", pattern: "^[a-f0-9]{64}$", description: "The immutable parent revision to update." },
+        title: { type: "string", minLength: 1, maxLength: 240 },
+        document: { type: "string" }
+      },
+      required: ["artifactId", "revision", "title", "document"],
+      additionalProperties: false
+    },
+    outputSchema: {
+      type: "object",
+      properties: {
+        artifactId: { type: "string" },
+        revision: { type: "string" },
+        parentRevision: { type: "string" },
+        title: { type: "string" },
+        status: { type: "string", enum: ["draft"] }
+      },
+      required: ["artifactId", "revision", "title", "status"]
+    },
+    needsApproval: false,
+    capability: { visibility: "always", execution: "direct", namespace: "openui", tags: ["artifacts", "ui"] }
+  },
+  openui_publish: {
+    definition: "@assemblyline-agents/openui",
+    factory: "defineOpenUiPublishTool",
+    description: "Publish one OpenUI artifact revision to an unlisted, storage-issued HTTPS link.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        artifactId: { type: "string", pattern: "^oui_[a-f0-9]{24}$" },
+        revision: { type: "string", pattern: "^[a-f0-9]{64}$" }
+      },
+      required: ["artifactId", "revision"],
+      additionalProperties: false
+    },
+    outputSchema: {
+      type: "object",
+      properties: {
+        artifactId: { type: "string" },
+        revision: { type: "string" },
+        title: { type: "string" },
+        url: { type: "string", format: "uri" },
+        visibility: { type: "string", enum: ["unlisted"] }
+      },
+      required: ["artifactId", "revision", "title", "url", "visibility"]
+    },
+    needsApproval: false,
+    capability: { visibility: "always", execution: "direct", namespace: "openui", tags: ["artifacts", "ui", "publish"] }
+  }
+};
+
+export default { configSchema, tools };

package/dist/index.d.ts

@@ -6,5 +6,4 @@ export { openUiGenerationPrompt, parseOpenUiDocument, type ParsedOpenUiDocument
 export { renderOpenUiArtifact } from "./render.js";
 export { OPENUI_COMPONENT_NAMES, openUiStandardComponentPack } from "./standard-pack.js";
 export { defineOpenUiCreateTool, defineOpenUiPublishTool, defineOpenUiUpdateTool } from "./tools.js";
-export declare const assemblyLinePlugin: import("@assemblyline-agents/core").PluginModule;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,aAAa,IAAI,mBAAmB,EACpC,eAAe,IAAI,qBAAqB,EACzC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,IAAI,oBAAoB,EACtC,gBAAgB,IAAI,sBAAsB,EAC1C,OAAO,IAAI,aAAa,EACxB,iBAAiB,IAAI,uBAAuB,EAC7C,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAIpB,eAAO,MAAM,kBAAkB,kDAAwC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,IAAI,mBAAmB,EACpC,eAAe,IAAI,qBAAqB,EACzC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,IAAI,oBAAoB,EACtC,gBAAgB,IAAI,sBAAsB,EAC1C,OAAO,IAAI,aAAa,EACxB,iBAAiB,IAAI,uBAAuB,EAC7C,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,oBAAoB,EAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACvB,MAAM,YAAY,CAAC"}