@kingsoftcloud/ksadk-web 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,7 +1,145 @@
 # Changelog
 
+## 0.3.2 - 2026-08-21
+
+Release candidate for the durable Interaction/v1 web experience. This is the
+reviewed source that replaces the internal beta sequence. Publication remains
+blocked on the current-digest cross-repository preproduction gate and uses the
+protected release workflow only after that gate is green.
+
+- Unify the Hosted UI composer with Studio's compact attachment, approval,
+  model, Goal, and Plan controls. The runtime's ordinary agent loop remains
+  internal rather than appearing as a third user-selectable mode; a future
+  eval-driven improvement loop must advertise its own honest capability.
+- Simplify the session list: completed runs no longer expose raw status text;
+  active sessions use a small activity ring and subtle background, while failed
+  sessions use a restrained error dot.
+- Keep RuntimeCapabilityMatrix decoding executable before the TypeScript build,
+  so the same fail-closed contract projection is covered by both browser tests
+  and the npm publication workflow's Node compatibility gate.
+
+## 0.3.2-beta.5 - 2026-08-21
+
+When the composer Interaction tray owns a pending approval, its tool-history
+row is now strictly read-only. This removes the second legacy approve/reject
+entry point while preserving the command arguments and terminal audit result.
+
+## 0.3.2-beta.4 - 2026-08-21
+
+Fixes the legacy Responses approval bridge: a pending approval is retained in
+the read-only tool history and also normalized into the unified Interaction
+tray immediately above the composer.  The submit still uses the compatible
+Responses approval transport when Interaction/v1 is unavailable.
+
+## 0.3.2-beta.3 - 2026-08-20
+
+Adds package-internal release provenance. Hosted UI and the preproduction gate
+can verify the resolved tarball's source basis and Interaction/v1 contract
+digest instead of trusting an external evidence label.
+
+## 0.3.2-beta.2 - 2026-08-20
+
+Rebuilt the immutable beta artifact from the complete Interaction/v1 source.
+This supersedes `0.3.2-beta.1`, whose vendored Hosted UI tarball predated the
+two fixes below.
+
+- Treat a successful `SubmitInteraction` receipt as durable acceptance, not as
+  proof that the framework execution has already completed its resolution.
+- Add the queue tray and read-only historical interaction anchors to the
+  published artifact, rather than leaving them only on the Web source branch.
+
+## 0.3.2-beta.1 - 2026-08-19
+
+> Unifies durable human-in-the-loop decisions behind one `Interaction/v1`
+> client. Counterpart of the agent-kernel Interaction/v1 contract: pending
+> approvals, structured inputs, and AG-UI interrupts normalize to a single
+> Interaction shape with one submit path (`SubmitInteraction`) with
+> revision CAS, idempotency keys, and first-wins terminal semantics.
+
+### Interaction/v1 (headless core)
+
+- New `src/core/interaction/` module: `InteractionClientImpl` + shared
+  `InteractionStore` with strict first-wins semantics (a terminal record
+  never regresses to pending), revision-based optimistic concurrency, and
+  an idempotency-key double-submit guard.
+- Transport adapters normalize three sources into the same Interaction:
+  Interaction/v1 SessionEvents (`interaction.requested` / `.resolved`,
+  rejection is `resolved.outcome="rejected"`, not a fifth event type),
+  Responses `mcp_approval_request`, and AG-UI interrupts. Components never
+  branch on the approval protocol.
+- New public API: `POST /agentengine/api/v1/SubmitInteraction`
+  (`submitInteraction` on `ApiFacade`), receipt decoded with the canonical
+  agent-kernel/v1 strict decoder. Pure `/v1/responses` clients keep the
+  official `mcp_approval_response` path.
+- Refresh/replay: session load replays recent durable SessionEvents into
+  the store so a pending Interaction is restored without creating a second
+  request; a double click, a stale tab, or a replayed history can never
+  duplicate a decision.
+
+### UI
+
+- `InteractionTray` renders above the composer with the current pending
+  item, pending count, and queue navigation; the composer input is
+  visually subordinated while a decision is pending.
+- `InteractionHistoryAnchor` replaces interactive historical approval
+  buttons with a read-only status retaining actor, decision time,
+  outcome, and a redacted response summary.
+- A2UI production wire locked to `0.9.1` with catalog digest validation
+  (`validateA2uiPresentation`). Unknown wire versions or catalog
+  mismatches fall back to the canonical JSON schema form, then to plain
+  approve/reject controls. A validation failure is never mapped to an
+  approval.
+- Expiry: interactions with a past `expires_at` disable submission
+  client-side and surface an expired notice.
+
+### Compatibility
+
+- Old servers without the `interaction_v1` capability keep the 0.3.1
+  Responses (`mcp_approval_response`) and AG-UI (`resumeAguiInterrupt`)
+  callbacks; the fallback is isolated in the adapters and the shared UI is
+  unchanged.
+- Public runtime bundle exports `InteractionClientImpl`, `Interaction`,
+  adapters, and `interactionIdempotencyKey`.
+
+### Supply chain
+
+- Refresh the lockfile's production transitive dependencies for the `0.3.2`
+  candidate: Mermaid/DOMPurify and PostCSS/nanoid now resolve to the patched
+  releases verified by `npm audit --omit=dev`.
+
+## 0.3.1 - 2026-08-12
+
+> Identity-aware runtime item reducer. Counterpart of the KsADK `0.8.1`
+> canonical RuntimeEvent(schema_version=2) release. Hosted UI and Studio must
+> ship this version (or later) to keep stream/replay output consistent with the
+> Python canonical pipeline.
+
+### Stream / session reducer
+
+- Introduce `RuntimeItemReducer` (`src/core/stream/runtime-items.ts`) as the
+  single canonical store for streaming output. It reduces identity-addressed
+  item operations into a per-run projection keyed by
+  `runId / scopeId / itemId / partId`, replacing the legacy v1 heuristic dedup
+  (`lastText` / per-agent accumulator / `startswith` / suffix overlap /
+  text hash).
+- Ingress adapters normalize three sources into the same item operations:
+  Responses SSE output item ids, session events `Metadata.RuntimeItem`, and
+  legacy server events (no identity) via synthesized
+  `${invocationId}:legacy-assistant`. `assistant_stream_snapshot` maps to
+  replace, `assistant_message` maps to complete. Nothing inspects body text
+  to decide identity.
+
+### Compatibility
+
+- Consumers tracking the KsADK `0.8.1` canonical RuntimeEvent must use this
+  identity-aware version. `0.3.0` used the v1 heuristic reducer and will
+  duplicate or drop output when paired with canonical v2 producers.
+
 ## 0.3.0 - 2026-07-29
 
+> Published baseline for Hosted runtime transport and the KsADK `0.8.0`
+> web integration.
+
 ### Hosted runtime transport
 
 - Add the official `@ag-ui/client` transport and capability-driven runtime

package/RELEASE_PROVENANCE.json

@@ -0,0 +1,7 @@
+{
+  "schema_version": 1,
+  "package": "@kingsoftcloud/ksadk-web",
+  "version": "0.3.2",
+  "source_commit": "2136448e038b4d8c475fa20e4722252b1ddb2ebc",
+  "interaction_contract_digest": "47e1003e03d97abeba232cc3e03a14b9cbcf78b1109870ccd2ce371f073b6211"
+}

package/dist-ksadk/assets/{ArtifactsPanel-Cjnqt-8W.js → ArtifactsPanel-DSU1sWD_.js}

@@ -1 +1 @@
-import{bt as e,ht as t,lt as n,n as r,t as i,ut as a,wt as o,xt as s,yt as c}from"./index-QSwCHuB8.js";var l=o(s(),1),u=c();function d(){let o=e(e=>e.visible),s=e(e=>e.content),c=e(e=>e.type),d=e(e=>e.hide),f=(0,l.useRef)(null);if(r(f),!o||!s)return null;let p=i(s);return(0,u.jsxs)(`aside`,{className:n(`flex h-full flex-shrink-0 flex-col border-l border-slate-200/30 bg-white dark:border-slate-800/40 dark:bg-slate-950`,`w-[min(42rem,50vw)]`),children:[(0,u.jsxs)(`div`,{className:`flex h-14 flex-shrink-0 items-center justify-between border-b border-slate-200/30 px-4 dark:border-slate-800/40`,children:[(0,u.jsxs)(`div`,{className:`flex min-w-0 items-center gap-2`,children:[(0,u.jsx)(`span`,{className:`text-sm font-semibold text-slate-900 dark:text-slate-100`,children:`Artifact`}),(0,u.jsx)(`span`,{className:`rounded-md bg-slate-100 px-1.5 py-0.5 font-mono text-[11px] text-slate-500 dark:bg-slate-900 dark:text-slate-400`,children:c})]}),(0,u.jsxs)(`div`,{className:`flex items-center gap-1.5`,children:[(0,u.jsxs)(`button`,{type:`button`,onClick:()=>{let e=new Blob([s],{type:`text/html;charset=utf-8`}),t=URL.createObjectURL(e),n=document.createElement(`a`);n.href=t,n.download=`artifact.${c===`svg`?`svg`:`html`}`,document.body.appendChild(n),n.click(),document.body.removeChild(n),URL.revokeObjectURL(t)},className:`inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-slate-600 transition hover:bg-slate-100 dark:text-slate-300 dark:hover:bg-slate-900`,title:`Download`,children:[(0,u.jsx)(t,{className:`h-3.5 w-3.5`}),`Download`]}),(0,u.jsx)(`button`,{type:`button`,onClick:d,className:`rounded-lg p-1.5 text-slate-500 transition hover:bg-slate-100 hover:text-slate-900 dark:text-slate-400 dark:hover:bg-slate-900 dark:hover:text-slate-100`,"aria-label":`Close Artifact`,title:`Close`,children:(0,u.jsx)(a,{className:`h-4 w-4`})})]})]}),(0,u.jsx)(`div`,{className:`min-h-0 flex-1`,children:(0,u.jsx)(`iframe`,{ref:f,srcDoc:p,sandbox:`allow-scripts allow-downloads`,title:`Artifact Preview`,className:`h-full w-full border-0 bg-white`})})]})}export{d as ArtifactsPanel};
+import{St as e,Tt as t,bt as n,gt as r,lt as i,n as a,t as o,ut as s,xt as c}from"./index-8ipRcQ-M.js";var l=t(e(),1),u=n();function d(){let e=c(e=>e.visible),t=c(e=>e.content),n=c(e=>e.type),d=c(e=>e.hide),f=(0,l.useRef)(null);if(a(f),!e||!t)return null;let p=o(t);return(0,u.jsxs)(`aside`,{className:i(`flex h-full flex-shrink-0 flex-col border-l border-slate-200/30 bg-white dark:border-slate-800/40 dark:bg-slate-950`,`w-[min(42rem,50vw)]`),children:[(0,u.jsxs)(`div`,{className:`flex h-14 flex-shrink-0 items-center justify-between border-b border-slate-200/30 px-4 dark:border-slate-800/40`,children:[(0,u.jsxs)(`div`,{className:`flex min-w-0 items-center gap-2`,children:[(0,u.jsx)(`span`,{className:`text-sm font-semibold text-slate-900 dark:text-slate-100`,children:`Artifact`}),(0,u.jsx)(`span`,{className:`rounded-md bg-slate-100 px-1.5 py-0.5 font-mono text-[11px] text-slate-500 dark:bg-slate-900 dark:text-slate-400`,children:n})]}),(0,u.jsxs)(`div`,{className:`flex items-center gap-1.5`,children:[(0,u.jsxs)(`button`,{type:`button`,onClick:()=>{let e=new Blob([t],{type:`text/html;charset=utf-8`}),r=URL.createObjectURL(e),i=document.createElement(`a`);i.href=r,i.download=`artifact.${n===`svg`?`svg`:`html`}`,document.body.appendChild(i),i.click(),document.body.removeChild(i),URL.revokeObjectURL(r)},className:`inline-flex items-center gap-1.5 rounded-lg px-2.5 py-1.5 text-xs font-medium text-slate-600 transition hover:bg-slate-100 dark:text-slate-300 dark:hover:bg-slate-900`,title:`Download`,children:[(0,u.jsx)(r,{className:`h-3.5 w-3.5`}),`Download`]}),(0,u.jsx)(`button`,{type:`button`,onClick:d,className:`rounded-lg p-1.5 text-slate-500 transition hover:bg-slate-100 hover:text-slate-900 dark:text-slate-400 dark:hover:bg-slate-900 dark:hover:text-slate-100`,"aria-label":`Close Artifact`,title:`Close`,children:(0,u.jsx)(s,{className:`h-4 w-4`})})]})]}),(0,u.jsx)(`div`,{className:`min-h-0 flex-1`,children:(0,u.jsx)(`iframe`,{ref:f,srcDoc:p,sandbox:`allow-scripts allow-downloads`,title:`Artifact Preview`,className:`h-full w-full border-0 bg-white`})})]})}export{d as ArtifactsPanel};