@eshal-bot/chat-widget 0.2.16 → 0.2.18

package/dist/chat-widget-markdown-chunk.js

@@ -88402,6 +88402,52 @@
     return typeof u === 'string' && /^https?:\/\//i.test(u) ? u : undefined;
   }
 
+  /**
+   * The same rule for images a card draws itself (A2UI card, list item,
+   * avatar, gallery), which never pass through markdown. Returns `src`
+   * unchanged while the policy is off (the default) or in report mode, and
+   * undefined when enforce blocks the host, so the caller skips the <img>.
+   */
+  function policedImageSrc(src) {
+    return src;
+  }
+  function rehypeImagePolicy() {
+    return tree => {
+      return;
+    };
+  }
+
+  const LINK_RE = /\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)|(https?:\/\/[^\s<>()]+[^\s<>().,;:!?'"])/g;
+  const LINK_STYLE = {
+    color: '#1d4ed8',
+    textDecoration: 'underline',
+    overflowWrap: 'anywhere'
+  };
+  function linkifyText(text) {
+    if (!text) return text;
+    const out = [];
+    let last = 0;
+    let key = 0;
+    for (const m of String(text).matchAll(LINK_RE)) {
+      const idx = m.index ?? 0;
+      const label = m[1] ?? m[3];
+      const url = safeUrl(m[2] ?? m[3]);
+      if (!url) continue;
+      if (idx > last) out.push(text.slice(last, idx));
+      out.push(/*#__PURE__*/jsxRuntimeExports.jsx("a", {
+        href: url,
+        target: "_blank",
+        rel: "noopener noreferrer",
+        style: LINK_STYLE,
+        children: label
+      }, key++));
+      last = idx + m[0].length;
+    }
+    if (out.length === 0) return text;
+    if (last < text.length) out.push(text.slice(last));
+    return out;
+  }
+
   // Kept in its own tiny module (not A2uiBlock.jsx): MessageList imports it
   // eagerly, and A2uiBlock/MarkdownRenderer are lazy-loaded to keep charts and
   // react-markdown out of the widget's initial bundle.
@@ -88448,6 +88494,12 @@
    * bug this file fixes (12-06-2026).
    */
 
+
+  // Card images (banner, list item, avatar, gallery) go through the chat image
+  // policy too. Unchanged while it is off, which is the default.
+  const cardImageSrc = u => policedImageSrc(safeUrl(u));
+  // True only when the policy itself drops a URL that would otherwise render.
+  const cardImageBlocked = u => safeUrl(u) !== undefined && cardImageSrc(u) === undefined;
   function A2uiBlock({
     spec,
     isDark = false,
@@ -88821,7 +88873,7 @@
           whiteSpace: 'pre-wrap',
           wordBreak: 'break-word'
         },
-        children: String(spec.body)
+        children: linkifyText(String(spec.body))
       })]
     });
   }
@@ -88882,7 +88934,7 @@
     const summary = String(spec.body || '').trim();
     const full = String(spec.details || '').trim();
     const hasMore = summary.length > 0 && full.length > summary.length + 2;
-    const imageUrl = safeUrl(spec.image);
+    const imageUrl = cardImageSrc(spec.image);
     const pill = status && status.label ? _STATUS_PILL(isDark)[status.variant || 'success'] : null;
     return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
       style: {
@@ -88961,7 +89013,7 @@
             whiteSpace: 'pre-wrap',
             wordBreak: 'break-word'
           },
-          children: showFull ? full || summary : summary || full
+          children: linkifyText(showFull ? full || summary : summary || full)
         }), hasMore && /*#__PURE__*/jsxRuntimeExports.jsx("button", {
           type: "button",
           onClick: () => setShowFull(v => !v),
@@ -89000,7 +89052,7 @@
               minWidth: 0,
               wordBreak: 'break-word'
             },
-            children: f.value
+            children: typeof f.value === 'string' ? linkifyText(f.value) : f.value
           })]
         }, i))
       }), actions.length > 0 && /*#__PURE__*/jsxRuntimeExports.jsx("div", {
@@ -89541,7 +89593,7 @@
           whiteSpace: 'pre-wrap',
           wordBreak: 'break-word'
         },
-        children: String(spec.body)
+        children: linkifyText(String(spec.body))
       }), /*#__PURE__*/jsxRuntimeExports.jsx(ButtonGroup, {
         spec: {
           buttons: lockedButtons
@@ -89696,8 +89748,8 @@
             display: 'flex',
             flexDirection: 'column'
           },
-          children: [safeUrl(item.image) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(item.image),
+          children: [cardImageSrc(item.image) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(item.image),
             alt: item.name || '',
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -89811,8 +89863,8 @@
             fontWeight: 700,
             fontSize: 16
           },
-          children: safeUrl(spec.avatar) ? /*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(spec.avatar),
+          children: cardImageSrc(spec.avatar) ? /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(spec.avatar),
             alt: spec.name || '',
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -90250,8 +90302,8 @@
             border: '1px solid ' + (isDark ? '#374151' : '#e5e7eb'),
             background: isDark ? '#111827' : '#f9fafb'
           },
-          children: [/*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(img.url),
+          children: [!cardImageBlocked(img.url) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(img.url),
             alt: img.caption || `Image ${i + 1}`,
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -92232,8 +92284,9 @@
       // Skip the rehypeCitations plugin when the org opted out -
       // markers then render as plain text so nothing squeaks
       // through as a placeholder pill.
+      // rehypeImagePolicy is a no-op unless the backend sends chatImagePolicy.
       ,
-      rehypePlugins: provideCitations ? [rehypeCitations] : [],
+      rehypePlugins: provideCitations ? [rehypeCitations, rehypeImagePolicy] : [rehypeImagePolicy],
       components: {
         // Citation-marker → pill swap. Every `<span>` normally passes
         // through unchanged; when the HAST plugin has tagged it as a