@flamingo-stack/openframe-frontend-core 0.0.215 → 0.0.216

package/src/components/ui/simple-markdown-renderer.tsx

@@ -222,7 +222,30 @@ const SAFE_HTML_TAGS = new Set([
  *   3 — everything between the name and the closing `>` (attrs etc.)
  *   4 — optional `/` for void-element self-close
  */
-const TAG_LIKE_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9-]*)([^>]*?)(\/?)>/g
+// ReDoS-safe shape (CodeQL polynomial-regex hardening):
+//
+// Every quantifier is hard-bounded so the engine has no possible
+// polynomial path. The original `[a-zA-Z0-9-]*` + `[^>]*?` admitted
+// O(n²) backtracking on `<A-----…` because both classes include `-`;
+// CodeQL flagged that as a polynomial regex. Bounding the tag-name
+// at 63 chars (covers every real HTML tag — `animateTransform` at 16
+// is the longest in practice) and the rest at 4096 chars (sane upper
+// bound for `<a href="…">` attribute strings) means matching is
+// constant-time per tag, NOT proportional to input length.
+//
+// Lazy `{0,4096}?` is deliberately lazy (not greedy) so the trailing
+// `(\/?)>` still captures the self-close `/` — greedy would swallow
+// the slash into the rest. Bounded lazy backtracking is constant-time
+// per match (capped at 4096 expansions), so the laziness is safe.
+//
+// Anything longer than 4159 chars per tag simply doesn't match —
+// falls through as plain text, the safe-degrade behavior for
+// HTML-in-markdown.
+//
+// Tag shapes still covered: `<a>`, `<a/>`, `<a class="x">`,
+// `<a class="x" />`, `</a>`, `<input type="text" />`,
+// `<custom-element data-foo="bar">`, `<animateTransform>`, etc.
+const TAG_LIKE_REGEX = /<(\/?)([a-zA-Z][a-zA-Z0-9-]{0,63})((?:\s[^>]{0,4096}?)?)(\/?)>/g
 
 function escapeUnknownHtmlTags(text: string): string {
   if (!text || text.indexOf('<') === -1) return text

package/src/components/ui/toaster.tsx

@@ -16,15 +16,15 @@ export const dotColorByVariant: Record<ToastVariant, string> = {
   success: 'bg-ods-success',
   warning: 'bg-ods-warning',
   error: 'bg-ods-error',
-  info: 'bg-ods-info',
+  info: 'bg-ods-text-secondary',
 }
 
 export const progressColorByVariant: Record<ToastVariant, string> = {
   default: 'bg-ods-text-secondary',
   success: 'bg-ods-success',
-  warning: 'bg-ods-accent',
+  warning: 'bg-ods-warning',
   error: 'bg-ods-error',
-  info: 'bg-ods-info',
+  info: 'bg-ods-text-secondary',
 }
 
 interface ToastHeaderProps {

package/src/contexts/chat-runtime-context.tsx

@@ -82,6 +82,13 @@ export interface ChatRuntime {
      *  leave it unset. Matches the `skipDomains` parameter of
      *  `getProxiedImageUrl`. */
     imageProxySkipDomains?: string[]
+    /** Supabase storage origin (e.g. `https://xyz.supabase.co`) — used
+     *  by `useVideoWarmup` to scope the `<link rel="preload" as="video">`
+     *  hint to MP4s the deployment actually hosts. Hub wires it via
+     *  `getSupabaseStorageOrigin()`; embedders without a Supabase
+     *  storage origin leave it unset (preload is then skipped; Mux/
+     *  YouTube preconnect still fires). */
+    supabaseStorageOrigin?: string
   }
   navigation: {
     /** ONE knob, two behaviors:
@@ -116,6 +123,40 @@ export interface ChatRuntime {
      *  same-origin/same-platform → same tab, else new tab. */
     decideNewTab?: (args: { href: string; targetPlatform?: string | null }) => boolean
   }
+  /** Optional OG placeholder URL builder. Returns a branded
+   *  `/api/og-placeholder?...` URL for the given title. Hub wires this
+   *  to its `buildOgPlaceholderUrl` (resolves CSS-var ODS colors to
+   *  hex via the static map). Embedders can wire any equivalent that
+   *  hits their own placeholder route — or omit, in which case entity
+   *  cards fall back to no placeholder.
+   *
+   *  Pure synchronous function — NOT a hook. Callers wrap with
+   *  `useMemo`/`useOgPlaceholder` for memoization. */
+  resolvePlaceholderUrl?: (
+    title: string,
+    options?: { site?: string; aspect?: 'wide' | 'square' },
+  ) => string
+  /** Optional content-URL composer. Returns the platform-aware href +
+   *  target-platform tuple for a content entity. Hub wires this to its
+   *  `buildContentURL(type, slug, extractPrimaryPlatform(platforms))`
+   *  pipeline so the lib catalog/detail views can derive cross-
+   *  platform hrefs without knowing the hub's platform topology
+   *  (openmsp.ai / openframe.app / flamingo.run / tmcg).
+   *
+   *  Embedders that don't host multi-platform content can wire this to
+   *  a simple `(type, slug) => ({ href: '/' + type + '/' + slug,
+   *  targetPlatform: null })` — or omit, in which case lib views fall
+   *  back to a same-origin relative path with `targetPlatform: null`.
+   *
+   *  `platforms` is the entity's flattened junction array (e.g.
+   *  `guide.onboarding_guide_platforms`) — the callback runs
+   *  `extractPrimaryPlatform` internally before dispatching to its
+   *  composer. */
+  composeContentUrl?: (
+    type: string,
+    slug: string,
+    platforms?: Array<{ name?: string }>,
+  ) => { href: string; targetPlatform: string | null }
   /** Chat source identifier — REQUIRED. Used for localStorage
    *  namespacing (`mingo-chat-<source>-v1`). Hub sets via
    *  `currentPlatform()`; embedders set explicitly.

package/src/stories/NotificationDrawer.stories.tsx

@@ -3,6 +3,7 @@ import * as React from 'react';
 import { Button } from '../components/ui/button';
 import {
   NotificationDrawer,
+  NotificationPopups,
   NotificationTile,
   NotificationsProvider,
   useNotifications,
@@ -218,13 +219,16 @@ export const DrawerWithSeedData: Story = {
 
 /**
  * Live playground — fire notifications from outside the drawer the same way a
- * NATS subscription would. The drawer reflects every change in real time.
+ * NATS subscription would. New notifications surface as top-right pop-ups
+ * (toast-style) via `<NotificationPopups>`; opening the drawer hides them so
+ * the same tile isn't shown twice. Toggle "Show Notifications" inside the
+ * drawer to disable pop-ups entirely.
  */
 export const LivePlayground: Story = {
   render: () => (
     <NotificationsProvider onHistoryClick={() => alert('Navigate to /notifications')}>
-      <AutoOpen />
       <NotificationDrawer />
+      <NotificationPopups />
       <PlaygroundControls />
       <Toaster />
     </NotificationsProvider>
@@ -239,6 +243,15 @@ function PlaygroundControls() {
     addNotification({ variant, title, description });
   };
 
+  const fireWithDeepLink = () => {
+    addNotification({
+      variant: 'success',
+      title: 'Script Execution Complete',
+      description: 'Click to view run details for SRV-DB01',
+      onClick: () => alert('Navigate to /scripts/runs/abc-123'),
+    });
+  };
+
   return (
     <div className="flex max-w-2xl flex-col gap-4">
       <div className="rounded-md border border-ods-border bg-ods-card p-3">
@@ -284,6 +297,9 @@ function PlaygroundControls() {
         >
           Fire default
         </Button>
+        <Button variant="outline" onClick={fireWithDeepLink}>
+          Fire with deep-link
+        </Button>
       </div>
 
       <div className="flex flex-wrap gap-2">

package/src/utils/dev-sections/openframe-dev-sections.ts

@@ -145,11 +145,18 @@ export const OPENFRAME_DEV_SECTIONS = {
       title: 'Onboarding Guides',
       description: 'Step-by-step product walkthroughs.',
     },
-    // `hero` / `search` / `filter` are intentionally inert here —
-    // /onboarding-guides is owned by OnboardingGuidesCatalogView, not
-    // DevSectionView. This entry exists ONLY to drive the homepage
-    // navigator card so all 4 cards stay in one registry.
-    hero: { title: '', description: '' },
+    hero: {
+      title: 'Getting Started',
+      description:
+        'Step-by-step walkthroughs for getting up and running with OpenFrame — from your first device deployment to advanced integrations.',
+    },
+    // `search` / `filter` are intentionally null — onboarding-guides
+    // uses a custom RAG-backed search dropdown (`useDocSearch`, not the
+    // local text filter `DevSectionView` ships) and dynamic section
+    // pills (counts vary with content, vs the static status options
+    // every other dev-center surface uses). Both controls are injected
+    // by the host via `DevSectionPage`'s `preControls` slot — same
+    // mechanism tickets uses for its "Open a new ticket" form.
     search: null,
     filter: null,
   },