@icen.ai/ui 0.10.0 → 0.11.0

package/dist/behaviors/kb-explain.mjs

@@ -1,3 +1,12 @@
+// src/behaviors/url-safety.ts
+function safeUrl(uri) {
+  const s = uri.replace(/[\t\n\r\0-\x1f\x7f]/g, "").trim().toLowerCase();
+  if (!s) return void 0;
+  if (s.startsWith("javascript:") || s.startsWith("vbscript:")) return void 0;
+  if (/^data:\s*text\/html/.test(s)) return void 0;
+  return uri;
+}
+
 // src/behaviors/events.ts
 function emitIcen(source, type, detail) {
   return source.dispatchEvent(
@@ -21,6 +30,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1136,9 +1146,10 @@ function renderKbExplain(el, fact) {
       const row = h("div", "icen-kb-explain-metric");
       row.appendChild(h("span", "icen-kb-explain-metric-name", m.name));
       if (m.ref) {
-        if (!/^\s*(javascript|data|vbscript)\s*:/i.test(m.ref)) {
+        const href = safeUrl(m.ref);
+        if (href) {
           const a = h("a", "icen-kb-explain-metric-ref", t("kbExplain.viewDefinition"));
-          a.href = m.ref;
+          a.href = href;
           a.rel = "noopener";
           row.appendChild(a);
         }

package/dist/behaviors/kb-filter.d.mts

@@ -1,5 +1,5 @@
-import { KbFilterNode } from './kb-core.js';
-import './ai-core.js';
+import { KbFilterNode } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** createKbFilter 配置项 */
 interface KbFilterOpts {

package/dist/behaviors/kb-filter.mjs

@@ -122,6 +122,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1434,8 +1435,13 @@ function setup(container) {
   el.__icenSelectInit = true;
   const trigger = triggerEl;
   const panel = panelEl;
-  const arrow = trigger.querySelector(".icen-select-chevron");
-  arrow?.remove();
+  if (!trigger.querySelector(".icen-select-chevron")) {
+    const chevron = createIcon("chevron-down", { size: 12, className: "icen-select-chevron" });
+    if (chevron) {
+      chevron.setAttribute("aria-hidden", "true");
+      trigger.append(chevron);
+    }
+  }
   const isMultiple = container.hasAttribute("data-icen-select-multiple");
   const isSearchable = container.hasAttribute("data-icen-select-search");
   if (isMultiple && !trigger.hasAttribute("aria-label") && !trigger.hasAttribute("aria-labelledby")) trigger.setAttribute("aria-label", container.getAttribute("data-icen-select-label") ?? t("select.fieldLabel"));

package/dist/behaviors/kb-gap.d.mts

@@ -1,5 +1,5 @@
-import { KbGapQuery } from './kb-core.js';
-import './ai-core.js';
+import { KbGapQuery } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** 趋势单点（label 如 '10-01'，value 为当日未命中次数） */
 interface KbGapTrendPoint {

package/dist/behaviors/kb-gap.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-hittest.d.mts

@@ -1,5 +1,5 @@
-import { KbHitTestCase, KbHitStats } from './kb-core.js';
-import './ai-core.js';
+import { KbHitTestCase, KbHitStats } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** createKbHitTest 配置项 */
 interface KbHitTestOpts {

package/dist/behaviors/kb-hittest.mjs

@@ -122,6 +122,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1204,7 +1205,7 @@ function createKbHitTest(el, opts = {}) {
     return stub;
   }
   const marked = el;
-  if (marked.__icenKbHitTest) return marked.__icenKbHitTest;
+  marked.__icenKbHitTest?.destroy();
   const ctrl = new AbortController();
   const listen = (target, type, fn) => {
     target.addEventListener(type, fn, { signal: ctrl.signal });

package/dist/behaviors/kb-metadata.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1209,6 +1210,11 @@ function initKbMetadata(root) {
         keyInput.setAttribute("aria-invalid", "true");
         return;
       }
+      if (root2.querySelector(`.icen-kb-metadata-row[data-icen-key="${CSS.escape(key)}"]`)) {
+        keyInput.setAttribute("aria-invalid", "true");
+        keyInput.select();
+        return;
+      }
       keyInput.removeAttribute("aria-invalid");
       const active = root2.querySelector(".kb-metadata-type-item.is-active");
       const type = TYPES.includes(active?.dataset.icenValue ?? "") ? active?.dataset.icenValue : "string";

package/dist/behaviors/kb-passage.d.mts

@@ -1,5 +1,5 @@
-import { KbLocation, KbCitation } from './kb-core.js';
-import './ai-core.js';
+import { KbLocation, KbCitation } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** getDocument 的返回契约：原文 + 定位 + 上下文（受限来源可只给 content 空串并依赖 citedText 回落） */
 interface KbPassageDoc {

package/dist/behaviors/kb-passage.mjs

@@ -122,6 +122,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-pipeline.d.mts

@@ -1,5 +1,5 @@
-import { KbPipelineRun } from './kb-core.js';
-import './ai-core.js';
+import { KbPipelineRun } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /**
  * 渲染解析管线时间线（快照：整树重建后返回挂载容器 el）。

package/dist/behaviors/kb-pipeline.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-qa.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-rerank.d.mts

@@ -1,5 +1,5 @@
-import { KbRetrievalHit } from './kb-core.js';
-import './ai-core.js';
+import { KbRetrievalHit } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** renderKbRerankCompare 输入 */
 interface KbRerankCompareOpts {

package/dist/behaviors/kb-rerank.mjs

@@ -122,6 +122,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-retrieval.d.mts

@@ -1,5 +1,5 @@
-import { KbRetrievalParams, KbRetrievalHit, KbRetrievalQuery, KbIdentity, KbVisibility } from './kb-core.js';
-import './ai-core.js';
+import { KbRetrievalParams, KbRetrievalHit, KbRetrievalQuery, KbIdentity, KbVisibility } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** createKbRetrieval 配置项 */
 interface KbRetrievalOpts {

package/dist/behaviors/kb-retrieval.mjs

@@ -122,6 +122,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1443,8 +1444,13 @@ function setup(container) {
   el.__icenSelectInit = true;
   const trigger = triggerEl;
   const panel = panelEl;
-  const arrow = trigger.querySelector(".icen-select-chevron");
-  arrow?.remove();
+  if (!trigger.querySelector(".icen-select-chevron")) {
+    const chevron = createIcon("chevron-down", { size: 12, className: "icen-select-chevron" });
+    if (chevron) {
+      chevron.setAttribute("aria-hidden", "true");
+      trigger.append(chevron);
+    }
+  }
   const isMultiple = container.hasAttribute("data-icen-select-multiple");
   const isSearchable = container.hasAttribute("data-icen-select-search");
   if (isMultiple && !trigger.hasAttribute("aria-label") && !trigger.hasAttribute("aria-labelledby")) trigger.setAttribute("aria-label", container.getAttribute("data-icen-select-label") ?? t("select.fieldLabel"));
@@ -2189,6 +2195,14 @@ function createKbRetrieval(el, opts = {}) {
   let params = normalizeRetrievalParams(opts.params);
   const thresholdMax = typeof opts.thresholdMax === "number" && opts.thresholdMax > 0 ? opts.thresholdMax : 1;
   let hits = [];
+  const scoreListMax = () => {
+    let m = thresholdMax;
+    for (const hit of hits) {
+      const v = Math.abs(hit.score ?? 0);
+      if (Number.isFinite(v) && v > m) m = v;
+    }
+    return m > 0 ? m : 1;
+  };
   let busy = false;
   let destroyed = false;
   let thresholdValue = params.threshold ?? 0;
@@ -2356,7 +2370,7 @@ function createKbRetrieval(el, opts = {}) {
     }
     let alive = 0;
     for (const hit of hits) {
-      const pct = scorePercent(hit.score, hit.scoreKind, thresholdMax);
+      const pct = scorePercent(hit.score, hit.scoreKind, scoreListMax());
       if (pct != null && pct >= t2 * 100 - 1e-9) alive++;
     }
     thresholdCount.textContent = t("kbRetrieval.rerankThresholdOn", { p0: t2.toFixed(2), p1: alive });
@@ -2372,7 +2386,7 @@ function createKbRetrieval(el, opts = {}) {
   }
   function renderScoreSide(hit, side) {
     const score = h("span", "icen-kb-score");
-    const pct = scorePercent(hit.score, hit.scoreKind, thresholdMax);
+    const pct = scorePercent(hit.score, hit.scoreKind, scoreListMax());
     if (pct != null) {
       const barEl = h("span", "icen-kb-score-bar");
       const fill = h("i");

package/dist/behaviors/kb-review.d.mts

@@ -1,5 +1,5 @@
-import { KbReviewTask, KbScoreConfig } from './kb-core.js';
-import './ai-core.js';
+import { KbReviewTask, KbScoreConfig } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** onAction 回调的动作信封（与 icen:kb-review-* 事件双通道；select 无对应事件，仅回调） */
 interface KbReviewActionDetail {

package/dist/behaviors/kb-review.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1353,8 +1354,13 @@ function setup(container) {
   el.__icenSelectInit = true;
   const trigger = triggerEl;
   const panel = panelEl;
-  const arrow = trigger.querySelector(".icen-select-chevron");
-  arrow?.remove();
+  if (!trigger.querySelector(".icen-select-chevron")) {
+    const chevron = createIcon("chevron-down", { size: 12, className: "icen-select-chevron" });
+    if (chevron) {
+      chevron.setAttribute("aria-hidden", "true");
+      trigger.append(chevron);
+    }
+  }
   const isMultiple = container.hasAttribute("data-icen-select-multiple");
   const isSearchable = container.hasAttribute("data-icen-select-search");
   if (isMultiple && !trigger.hasAttribute("aria-label") && !trigger.hasAttribute("aria-labelledby")) trigger.setAttribute("aria-label", container.getAttribute("data-icen-select-label") ?? t("select.fieldLabel"));

package/dist/behaviors/kb-sandbox.d.mts

@@ -1,5 +1,5 @@
-import { KbSandboxMessage } from './kb-core.js';
-import './ai-core.js';
+import { KbSandboxMessage } from './kb-core.mjs';
+import './ai-core.mjs';
 
 interface KbSandboxOptions {
     /** 通信观测双通道（与 icen:kb-sandbox-message 事件同 payload） */

package/dist/behaviors/kb-sandbox.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1089,6 +1090,9 @@ function isSandboxMessage(data) {
 function createKbSandbox(el, opts = {}) {
   const stub = { load: () => void 0, call: () => Promise.reject(new Error("icen-kb-sandbox: SSR")), destroy: () => void 0 };
   if (typeof document === "undefined" || !el) return stub;
+  const host = el;
+  host.__icenKbSandbox?.destroy();
+  host.__icenKbSandbox = stub;
   const timeoutMs = typeof opts.timeoutMs === "number" && opts.timeoutMs > 0 ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
   const allowedOrigins = Array.isArray(opts.allowedOrigins) ? opts.allowedOrigins.filter((o) => typeof o === "string") : null;
   el.classList.add("icen-kb-sandbox");
@@ -1240,7 +1244,9 @@ function createKbSandbox(el, opts = {}) {
     delete el.dataset.icenState;
     el.textContent = "";
   };
-  return { load, call, destroy };
+  const handle = { load, call, destroy };
+  host.__icenKbSandbox = handle;
+  return handle;
 }
 export {
   createKbSandbox

package/dist/behaviors/kb-segment.d.mts

@@ -1,5 +1,5 @@
-import { KbSegmentConfig } from './kb-core.js';
-import './ai-core.js';
+import { KbSegmentConfig } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** createKbSegment 选项 */
 interface KbSegmentOpts {

package/dist/behaviors/kb-segment.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1316,7 +1317,7 @@ function createKbSegment(el, opts) {
     delimInput.value = cfg.delimiter ?? "";
     maxInput.value = String(cfg.maxLength);
     overlapInput.value = String(cfg.overlap);
-    modeSeg.querySelectorAll("[data-icen-kb-segment-clean]").forEach((cb) => {
+    form.querySelectorAll("[data-icen-kb-segment-clean]").forEach((cb) => {
       cb.setAttribute("aria-checked", String(cfg.clean.includes(cb.dataset.icenKbSegmentClean)));
     });
     pcNotice.hidden = cfg.mode !== "parent-child";

package/dist/behaviors/kb-select.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1353,8 +1354,13 @@ function setup(container) {
   el.__icenSelectInit = true;
   const trigger = triggerEl;
   const panel = panelEl;
-  const arrow = trigger.querySelector(".icen-select-chevron");
-  arrow?.remove();
+  if (!trigger.querySelector(".icen-select-chevron")) {
+    const chevron = createIcon("chevron-down", { size: 12, className: "icen-select-chevron" });
+    if (chevron) {
+      chevron.setAttribute("aria-hidden", "true");
+      trigger.append(chevron);
+    }
+  }
   const isMultiple = container.hasAttribute("data-icen-select-multiple");
   const isSearchable = container.hasAttribute("data-icen-select-search");
   if (isMultiple && !trigger.hasAttribute("aria-label") && !trigger.hasAttribute("aria-labelledby")) trigger.setAttribute("aria-label", container.getAttribute("data-icen-select-label") ?? t("select.fieldLabel"));

package/dist/behaviors/kb-sources.d.mts

@@ -1,5 +1,5 @@
-import { KbCitation } from './kb-core.js';
-import './ai-core.js';
+import { KbCitation } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** renderKbSources 的配置项：布局变体 / onlyCited 过滤 / 基准时钟 / 点击回调 */
 interface KbSourcesOptions {

package/dist/behaviors/kb-sources.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-sql.d.mts

@@ -1,5 +1,5 @@
-import { KbSqlQuery } from './kb-core.js';
-import './ai-core.js';
+import { KbSqlQuery } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /**
  * 零依赖 SQL 着色：关键词（大小写不敏感）/ 单引号字符串 / 行注释与块注释 / 数字 /

package/dist/behaviors/kb-sql.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-trace.d.mts

@@ -1,5 +1,5 @@
-import { KbSpan } from './kb-core.js';
-import './ai-core.js';
+import { KbSpan } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /**
  * 渲染 trace span 树（快照：整体替换 el 内容）。返回挂载容器 el。

package/dist/behaviors/kb-trace.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1163,12 +1164,12 @@ function depthOfSpan(span, byId, guard = 0) {
   const parent = byId.get(span.parentId);
   return parent ? depthOfSpan(parent, byId, guard + 1) + 1 : 0;
 }
-function buildHitRow(hit, rank) {
+function buildHitRow(hit, rank, listMax) {
   const row = h("div", "icen-kb-trace-hit");
   row.append(h("span", "icen-kb-trace-hit-rank icen-kb-num", String(rank)));
   row.append(h("span", "icen-kb-trace-hit-title", hit.title || hit.snippet || hit.chunkId));
   const score = h("span", "icen-kb-score");
-  const pct = scorePercent(hit.score, hit.scoreKind);
+  const pct = scorePercent(hit.score, hit.scoreKind, listMax);
   if (pct != null) {
     const bar = h("span", "icen-kb-score-bar");
     const fill = h("i");
@@ -1197,7 +1198,12 @@ function buildSpanBody(span) {
   if (hasHits && span.hits) {
     const wrap = h("div", "icen-kb-trace-hits");
     wrap.append(h("div", "kb-trace-hits-label icen-kb-meta", t("kbTrace.hits", { p0: span.hits.length })));
-    span.hits.forEach((hit, i) => wrap.append(buildHitRow(hit, i + 1)));
+    let listMax = 1;
+    for (const hit of span.hits) {
+      const v = Math.abs(hit.score ?? 0);
+      if (Number.isFinite(v) && v > listMax) listMax = v;
+    }
+    span.hits.forEach((hit, i) => wrap.append(buildHitRow(hit, i + 1, listMax)));
     body.append(wrap);
   }
   if (span.error) body.append(h("div", "icen-kb-trace-error", span.error));

package/dist/behaviors/kb-visibility.d.mts

@@ -1,5 +1,5 @@
-import { KbVisibility, KbIdentity } from './kb-core.js';
-import './ai-core.js';
+import { KbVisibility, KbIdentity } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** 对照命中的最小数据单元（标题必有；snippet=原文摘录 / summary=AI 摘要，二者权限语义不同） */
 interface KbVisibilityHit {

package/dist/behaviors/kb-visibility.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/kb-who-can.d.mts

@@ -1,5 +1,5 @@
-import { KbAclDecision, KbIdentity, KbAclEntry } from './kb-core.js';
-import './ai-core.js';
+import { KbAclDecision, KbIdentity, KbAclEntry } from './kb-core.mjs';
+import './ai-core.mjs';
 
 /** renderKbWhoCan 配置项 */
 interface KbWhoCanOpts {

package/dist/behaviors/kb-who-can.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1434,8 +1435,13 @@ function setup(container) {
   el.__icenSelectInit = true;
   const trigger = triggerEl;
   const panel = panelEl;
-  const arrow = trigger.querySelector(".icen-select-chevron");
-  arrow?.remove();
+  if (!trigger.querySelector(".icen-select-chevron")) {
+    const chevron = createIcon("chevron-down", { size: 12, className: "icen-select-chevron" });
+    if (chevron) {
+      chevron.setAttribute("aria-hidden", "true");
+      trigger.append(chevron);
+    }
+  }
   const isMultiple = container.hasAttribute("data-icen-select-multiple");
   const isSearchable = container.hasAttribute("data-icen-select-search");
   if (isMultiple && !trigger.hasAttribute("aria-label") && !trigger.hasAttribute("aria-labelledby")) trigger.setAttribute("aria-label", container.getAttribute("data-icen-select-label") ?? t("select.fieldLabel"));

package/dist/behaviors/mentions.d.mts

@@ -1,4 +1,4 @@
-import { SuggestionSourceContext } from './suggestions.js';
+import { SuggestionSourceContext } from './suggestions.mjs';
 
 /** Mention input with object-level mention entities. createMentions accepts a
  * host containing a native `<textarea class="icen-input">` (declarative markup

package/dist/behaviors/mentions.mjs

@@ -21,6 +21,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/modal.d.mts

@@ -1,4 +1,4 @@
-export { FOCUSABLE, focusableWithin } from './focus.js';
+export { FOCUSABLE, focusableWithin } from './focus.mjs';
 
 /** 焦点陷阱的可聚焦元素选择器（modal / command-palette 焦点陷阱全库共用）。 */
 /** openModal 可选项。 */

package/dist/behaviors/modal.mjs

@@ -157,6 +157,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",

package/dist/behaviors/notification.d.mts

@@ -1,5 +1,5 @@
-import { FeedbackAction } from './feedback.js';
-import { IconName } from './icons.js';
+import { FeedbackAction } from './feedback.mjs';
+import { IconName } from './icons.mjs';
 
 type NotificationKind = 'success' | 'warning' | 'error' | 'info';
 interface NotificationAction {

package/dist/behaviors/notification.mjs

@@ -302,6 +302,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",
@@ -1164,6 +1165,15 @@ function parseSvg(source) {
   return document.importNode(root, true);
 }
 
+// src/behaviors/url-safety.ts
+function safeUrl(uri) {
+  const s = uri.replace(/[\t\n\r\0-\x1f\x7f]/g, "").trim().toLowerCase();
+  if (!s) return void 0;
+  if (s.startsWith("javascript:") || s.startsWith("vbscript:")) return void 0;
+  if (/^data:\s*text\/html/.test(s)) return void 0;
+  return uri;
+}
+
 // src/behaviors/notification.ts
 var clocks = /* @__PURE__ */ new WeakMap();
 var KIND_SYMBOL = { success: "circle-check", warning: "triangle-alert", error: "circle-error", info: "circle-info" };
@@ -1378,7 +1388,7 @@ function buildIcon(record) {
   wrap.className = "icen-notification-icon";
   wrap.setAttribute("aria-hidden", "true");
   const { icon, avatar } = record.opts;
-  if (avatar) {
+  if (avatar && safeUrl(avatar)) {
     const img = document.createElement("img");
     img.className = "icen-notification-avatar";
     img.src = avatar;
@@ -1481,12 +1491,13 @@ function buildActions(record) {
 }
 function buildLink(record) {
   const { link, linkLabel } = record.opts;
-  if (!link) return null;
+  const href = link ? safeUrl(link) : void 0;
+  if (!href) return null;
   const wrap = document.createElement("div");
   wrap.className = "icen-notification-link-wrap";
   const a = document.createElement("a");
   a.className = "icen-notification-link";
-  a.href = link;
+  a.href = href;
   a.textContent = linkLabel ?? t("notification.viewDetails");
   a.addEventListener("click", (ev) => ev.stopPropagation());
   wrap.appendChild(a);

package/dist/behaviors/panel.mjs

@@ -116,6 +116,7 @@ var ICEN_LOCALE_ZH_CN = {
   "aiChat.roleTool": "\u5DE5",
   "aiChat.roleUser": "\u6211",
   "aiChat.thinking": "\u601D\u8003 {p0}",
+  "aiChat.thinkingNow": "\u6B63\u5728\u601D\u8003\u2026",
   /* ── aiComposer ── */
   "aiComposer.attachAgent": "\u4EE3\u7406",
   "aiComposer.library": "\u6DFB\u52A0\u4E0A\u4E0B\u6587\u4E0E\u547D\u4EE4",