@iyulab/chat-components 0.13.0 → 0.14.0

package/skills/iyulab-chat-components/references/components/images-block.md

@@ -71,3 +71,4 @@ interface ImageSlide {
 | Carousel | Up to 3 slides visible; draggable |
 | Lightbox | Full-screen modal on image click |
 | Keyboard | `←` `→` to navigate, `Esc` to close |
+| Image origin policy | `setAllowedImagePrefixes()` applies — a blocked item shows its alt text and is not requested (see [../security.md](../security.md)) |

package/skills/iyulab-chat-components/references/components/marked-block.md

@@ -65,6 +65,18 @@ Vendored from GitHub's markdown theme — light values shown, dark auto-applies
 | `--base-size-4` / `-8` / `-16` / `-24` / `-40` | Spacing scale used throughout (margins, padding, gaps) |
 | `--base-text-weight-normal` / `-medium` / `-semibold` | Font-weight scale (body / table header / heading) |
 
+## CSS Parts
+
+| Part | Description |
+|------|-------------|
+| `image-blocked` | Alt text shown in place of an image the image origin policy blocked (see Images) |
+
+## Images
+
+Markdown images (table cells included) follow the page-wide image origin policy set with
+`setAllowedImagePrefixes()`. A blocked image is not requested; its alt text is shown in a
+`part="image-blocked"` span (`Image blocked: …`, localized). See [../security.md](../security.md).
+
 ## ReferenceCitation Type
 
 ```ts

package/skills/iyulab-chat-components/references/extra-system.md

@@ -76,20 +76,20 @@ const def: ElementSchema = {
 ElementPromptBuilder.instance.add(def);
 ```
 
-The element just needs to accept standard property assignments — `u-element-block` binds `properties` keys directly to element properties.
+The element just needs to accept standard property assignments. `add()` also registers the schema as a renderable block — `u-element-block` assigns only the names in the schema's `properties`. If you write your own prompt instead, call `registerElementBlock(def)` (exported from `@iyulab/chat-components`).
 
 ## Error Handling
 
-If the LLM outputs a `tag` that isn't registered (e.g. missing `@iyulab/chat-components/extra` import, or a custom extra's element isn't defined yet), `u-element-block` does **not** show an error card — it renders nothing and logs to the console instead. Genuine data errors (invalid `properties`, assignment failures) are also console-only.
+If the LLM outputs a `tag` that isn't a registered block (e.g. missing `@iyulab/chat-components/extra` import, or a custom extra's schema was never registered or its element isn't defined yet), `u-element-block` does **not** show an error card — it renders nothing and logs to the console instead. Genuine data errors (invalid `properties`, assignment failures) are also console-only.
 
 ## Security
 
-`u-element-block` maintains a `blacklist` of dangerous property names that are never bound: `innerHTML`, `outerHTML`, `textContent`, `innerText`, `outerText`, `srcdoc`. Custom elements registered as extras should only accept well-typed, data-only properties.
+`block-json` is model output and is treated as untrusted. `u-element-block` creates only registered blocks (`ElementPromptBuilder.add()` or `registerElementBlock()`; built-in extras register on import) and assigns only the property names in the block's schema `properties` — other keys, including `style`, are dropped and logged. Custom extras should accept data only; if a property is rendered as HTML, sanitize it inside the element.
 
 ## `ElementPromptBuilder` API
 
 | Method | Description |
 |--------|-------------|
 | `ElementPromptBuilder.instance` | Singleton accessor |
-| `.add(definition: ElementSchema)` | Register a custom extra (throws on tag conflict) |
+| `.add(definition: ElementSchema)` | Register a custom extra (throws on tag conflict). Also registers it as a renderable block |
 | `.build(): string` | Generate system prompt instruction string |

package/skills/iyulab-chat-components/references/security.md

@@ -0,0 +1,23 @@
+# Security model
+
+Model output is **untrusted** (prompt injection can put third-party text in any response). What each input
+is trusted to contain:
+
+| Input | Treated as | Handling |
+|---|---|---|
+| `u-marked-block` `value` | untrusted | Raw HTML shown as text · link/image URLs protocol-checked (`javascript:`/`data:`/`vbscript:`/`//host` → `#`) · code fences escaped · table cells same rules |
+| `block-json` fences | untrusted | Only registered blocks; only the schema's property names are assigned |
+| `refs` | untrusted | Text rendered as text · URLs protocol-checked in `u-ref-tag` and `u-ref-card` |
+| `u-table-block` cell `text` bound directly | **trusted HTML** | Sanitize before binding. `block-json` cannot reach it |
+| Your custom block | your element's contract | The schema allows names, not content — sanitize HTML-rendered properties inside the element |
+
+Requests: markdown images and `u-images-block` load the `http:`/`https:` URL the model writes as soon as they
+render (an image URL can carry data out). When the model reads content you do not control, call
+`setAllowedImagePrefixes([location.origin + '/', 'https://cdn.example.com/images/'])` before rendering —
+images outside the list are not requested and show their alt text (`Image blocked: …`). Prefixes match the
+resolved absolute URL; prefer paths to whole domains (open redirects). `data:image/…` is always shown (no
+request). Default: all allowed. Add CSP `img-src` as a second layer.
+`u-map-block` (OpenStreetMap iframe) and `u-video-block` (YouTube/Vimeo/direct) embed external content.
+`u-ref-card` requests no favicon by default.
+
+Do not insert model output with `innerHTML` yourself; route it through `u-marked-block`.