@filigran/chatbot 3.12.1 → 3.13.0

package/CHANGELOG.md

@@ -0,0 +1,108 @@
+# Changelog
+
+Notable changes to `@filigran/chatbot`, so a host can see what an upgrade brings
+before taking it.
+
+The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
+the versions follow [semantic versioning](https://semver.org/spec/v2.0.0.html).
+This file starts at 3.10.0; earlier releases are on the
+[releases page](https://github.com/FiligranHQ/filigran-ui/releases).
+
+## 3.13.0 — unreleased
+
+### Added
+
+- The assistant can act on the page the panel is mounted in (#441). The agent
+  asks for one step at a time — take a snapshot, click, open a menu, type, or
+  navigate — and the panel answers each with a fresh reading of the page.
+- The reading lists one line per control a user could act on, with its role,
+  accessible name, state and in-app destination, so the agent can name the one
+  it means.
+- `Acting on the page…` shows on the status line while a step runs.
+
+### Host opt-in
+
+- The panel offers the capability only when the host sets `apiEndpoints.approve`
+  **and** passes `onRelativeLinkClick`, because its proxy has to forward the
+  answer whole. A host that offers neither is unaffected, and a step arriving
+  without that opt-in is refused without the page being read or touched.
+
+### Security
+
+- A reading never carries a secret: a password, a one-time code or a card field
+  is masked by `type` and by `autocomplete`, and its contents cannot surface
+  through an enclosing control's name or value, nor through a heading above it.
+  Hidden, `aria-hidden`, `inert` and closed `<details>` content stays out, as
+  does the panel's own.
+- A step that would leave the page is refused rather than performed: another
+  origin, a link that opens a tab, a path that resolves off-site. A click or a
+  form submission that would load a page is cancelled while the host's own
+  handlers still run.
+- A step is refused on a control the user could not use either: disabled,
+  read-only, a masked field, a file chooser, or one no longer visible when the
+  step runs.
+- A step ends with the turn that asked for it. Stop, New chat, switching
+  conversation and closing the panel all end it, and one arriving afterwards is
+  answered rather than left to time out.
+
+## 3.12.2 — 2026-10-02
+
+### Fixed
+
+- The panel keeps its own styles inside a host that ships its Tailwind utilities
+  outside any cascade layer: the message action icons were invisible and the
+  header hover backgrounds round instead of square (#431).
+
+## 3.12.1 — 2026-10-01
+
+### Fixed
+
+- The reader can scroll up while the agent reasons or streams. The transcript
+  follows the end only while the reader is there; scrolling up stops the follow,
+  and returning to the bottom or sending a message resumes it (#429).
+
+## 3.12.0 — 2026-09-30
+
+### Added
+
+- Every message ends with a footer: an answer shows its time, reasoning details,
+  Copy response, thumbs up / down and Read aloud; a user message shows Copy and
+  its time.
+- Message times follow the new `locale` prop, and an answer is dated when it
+  completes, so the live time matches the time after a reload.
+- Persisted feedback through the new `apiEndpoints.feedback`, optimistic and
+  rolled back on error; a rating restored with the conversation is locked (#419).
+
+## 3.11.1 — 2026-09-29
+
+### Changed
+
+- The dictation button sits inside the composer, before Send, so its toolbar row
+  no longer appears alone in hosts with nothing else to put there.
+- Listening is visible on the field itself, and the composer height no longer
+  shifts.
+- Every send cancels dictation and drops the phrase still being recognised, so
+  no words land in a composer that was just emptied.
+
+## 3.11.0 — 2026-09-29
+
+### Changed
+
+- A streamed answer is rendered block by block: a chunk re-parses only the blocks
+  it can still change.
+- Streamed text and reasoning are applied once per animation frame rather than
+  once per network read.
+- The markdown renderers keep their identity, so the live answer's DOM, a
+  selection in it and its images are no longer rebuilt per chunk.
+
+## 3.10.0 — 2026-09-26
+
+### Changed
+
+- The waiting game is a link to the XTM One arcade rather than an embedded game
+  (#411).
+
+### Fixed
+
+- The agent's reasoning stays on screen instead of being replaced by the waiting
+  game (#409).

package/README.md

@@ -507,6 +507,58 @@ chat must forward the request body whole (a proxy rebuilding it from a fixed
 field list silently drops `supports_tool_approval`), never time out the
 streaming turn, and pass SSE keepalives through untouched.
 
+#### Acting on the host page
+
+The same path answers `act_on_page` (XTM One #5559): with `apiEndpoints.approve`
+set **and** `onRelativeLinkClick` passed — the host's opt-in, since it hands the
+panel its navigation — the panel also sends `supports_page_actions: true`, and the
+agent may act on the page the panel is mounted in. The host's proxy must forward
+the approve route's body whole (a `page_action` answer carries no `decisions`).
+Without that opt-in a frame is answered `page_actions_not_supported`, with the
+page neither read nor acted on. Each step arrives on the stream as a
+`status` frame with `event: "page_action_required"`; the panel performs it
+(`click`, `open` — a hover, or a click when hovering opens nothing —, `type`, then
+Enter only in a field that says it is a search - `type="search"`,
+`role="searchbox"`, inside `role="search"`, or named like one (a `name`, `id`,
+`placeholder`, `aria-label` or `title` whose whole words include "search",
+"query", "filter" or "find", and only when it is the form's sole field) - never
+in a form of one unnamed field, which is as likely a create or
+rename dialog,
+or `navigate` through `onRelativeLinkClick` — never
+a page load, which would end the turn) and POSTs
+`{ conversation_id, page_action: { action_id, ok, error, url, title, snapshot } }`.
+`ok` is the action's own outcome, so a step is never retried because reading the
+page back failed; when that read throws, `ok` stands and `error` carries
+`snapshot_failed: …` with an empty snapshot. A stopped turn (Stop, New chat,
+switching conversation) abandons the action instead of acting on the page.
+
+The snapshot (`utils/pageSnapshot.ts`) lists one line per element a user could
+act on — `[e1] link "Reports" -> /dashboard/analyses/reports`, with states such as
+`(selected)`, `(pressed)`, `(menu)` for a closed menu or `(collapsed)` for a closed
+group
+— and leaves out the panel itself, hidden and inert content, and every secret
+value: a `type="password"` field, and anything whose `autocomplete` marks it as a
+password, a one-time code or a card field, so a revealed password is masked too.
+A list cut off at the size cap ends with `[truncated]`. A state the host shows by
+styling alone is invisible to it: mark toggles
+with `aria-pressed`, the current item with `aria-current`, and a clickable card
+with `role="button"`. A `409` means the
+turn no longer waits for that action, and the panel drops it.
+
+Actions that would leave the page are refused rather than performed, each
+answered with `ok: false` and a reason: a `navigate` off-site, a `click` on a
+link to another origin or one opening a new tab, a `type` on anything that is
+not a text field, a read-only field, a masked one (a password, one-time code
+or card field), a file input (whose chooser is an operating-system window), a
+target that is disabled - including one disabled by its `<fieldset>` - and one
+no longer visible when the action runs. A click never completes a native default that
+would leave the page: an anchor's navigation and a form's submission are
+cancelled while the host's own handlers still run. Clicking an in-host link is
+routed through `onRelativeLinkClick` rather than clicked, for the same reason a
+`navigate` is. An action this version does not know is answered as
+`unsupported_action` instead of being dropped, so a backend running ahead of the
+panel is not left waiting out its timeout.
+
 #### Recovering a prompt after a page reload
 
 `approval_required` is a single event on a stream, so a reload loses it —
@@ -900,6 +952,15 @@ import '@filigran/chatbot/styles.css';
 
 The component uses Tailwind CSS classes and CSS custom properties for theming. The accent color is applied via `--chat-accent` CSS variable.
 
+The stylesheet is isolated from the host page in both directions. Every utility
+is scoped to the panel (`.filigran-chatbot` and its descendants) and declared
+outside any cascade layer, and the theme variables (`--radius-*`, `--spacing`,
+...) are declared on the panel root. The host's own utilities and `:root`
+tokens - a Tailwind build shipped without layers, such as the Filigran design
+system's - therefore never restyle the panel, and the panel's utilities never
+style the host page. Panel overlays (menus, dialogs, tooltips) render inside
+the panel root, so they keep its styles.
+
 ### Composer toolbar
 
 Two toolbar items are **data-driven rather than mode-driven**: they appear only