@kodaris/krubble-app-components 1.0.107 → 1.0.109

package/dist/krubble-app.bundled.js

@@ -1,4 +1,4 @@
-import { KRContextMenu, KRDialog, KRFilePreview } from '@kodaris/krubble-components';
+import { KRContextMenu, KRDialog, KRSnackbar, KRFilePreview } from '@kodaris/krubble-components';
 import { KRHttp } from '@kodaris/krubble-http';
 
 /**
@@ -6356,76 +6356,30 @@ let KRChatbot = class KRChatbot extends i$3 {
     }
     // --- Skills ---
     /**
-     * Search the Kodaris AI skills index and store the results in `_orgSkills` — the
-     * browse dialog's "Your Org" tab. Mirrors the backend's own skill search (BM25
-     * over name^3/description^2/instructions, active-only). An empty query uses
-     * match_all — multi_match with an empty string matches nothing, so the "show
-     * everything" case needs it.
+     * Load the browse dialog's "Your Org" tab into `_orgSkills` from
+     * `/conversation/localSkillList` — this instance's own active skills, already
+     * role-filtered to what the caller may run and ranked by the server.
      *
-     * Follows the kr-combo-box `_fetch` pattern: a request-id guard drops responses
-     * that arrive out of order. `/aiskills/search` returns a raw OpenSearch response,
-     * so we lift each hit's `_source` (already in KRChatbotSkill shape) out.
+     * Not the `aiskills` search endpoint: that requires a skill-authoring role
+     * (`skillView`/`skillEdit`), so an ordinary chat user got a 403 and an empty
+     * tab. This one only needs a logged-in employee. It also means the query
+     * matching, active-only filter and "exclude globally-published" rule all live
+     * server-side instead of being rebuilt as OpenSearch DSL here.
+     *
+     * EXCEPTION — on kodaris.com this list also carries that instance's own
+     * globally-published skills (flagged `global: true`), because there is no
+     * Kodaris tab there for them to appear on.
+     *
+     * Request-id guard drops responses that arrive out of order (kr-combo-box
+     * `_fetch` pattern).
      */
     _searchOrgSkills(query) {
         this._orgSkillRequestId++;
         const requestId = this._orgSkillRequestId;
-        const trimmed = query.trim();
-        // An empty query matches everything; otherwise substring-match the query
-        // against name/code/description. We use case-insensitive wildcard queries on
-        // the `.raw` keyword subfields so "ord" matches anywhere in "Create Order"
-        // (a plain match/multi_match only matches whole tokens). Escape the wildcard
-        // specials so user input is treated literally, then wrap with `*...*`.
-        let must = { match_all: {} };
-        if (trimmed) {
-            must = {
-                bool: {
-                    should: [
-                        {
-                            wildcard: {
-                                'name.raw': {
-                                    value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                    case_insensitive: true,
-                                }
-                            }
-                        },
-                        {
-                            wildcard: {
-                                'code.raw': {
-                                    value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                    case_insensitive: true,
-                                }
-                            }
-                        },
-                        {
-                            wildcard: {
-                                'description.raw': {
-                                    value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                    case_insensitive: true,
-                                }
-                            }
-                        },
-                    ],
-                    minimum_should_match: 1,
-                },
-            };
-        }
         KRHttp.fetch({
-            url: '/api/system/opensearch/aiskills/search',
+            url: '/api/system/conversation/localSkillList',
             method: 'POST',
-            body: {
-                size: 100,
-                query: {
-                    bool: {
-                        must: [must],
-                        filter: [{ term: { active: true } }],
-                        // The "Your Org" tab lists only this instance's own skills. Globally-
-                        // published skills belong to the "Kodaris" tab (fed by the registry),
-                        // so exclude them here. Documents without the field aren't matched by
-                        // the term, so ordinary org skills are kept.
-                        must_not: [{ term: { globalPublished: true } }],
-                    },
-                },
-            },
+            body: { query: query.trim() },
         })
             .then((r) => r.json())
             .then((res) => {
@@ -6433,7 +6387,7 @@ let KRChatbot = class KRChatbot extends i$3 {
             if (requestId !== this._orgSkillRequestId) {
                 return;
             }
-            this._orgSkills = (res?.data?.hits?.hits || []).map((hit) => hit._source);
+            this._orgSkills = (res?.data || []);
         })
             .catch((error) => {
             console.error('kr-chatbot: skill search failed', error);
@@ -6473,19 +6427,23 @@ let KRChatbot = class KRChatbot extends i$3 {
         });
     }
     /**
-     * Load the browse dialog's "Kodaris" tab into `_globalSkills` — the full Kodaris
-     * catalog, installed or not, each row carrying `enabled` = installed here.
+     * Load the browse dialog's "Kodaris" tab into `_globalSkills` — the whole
+     * published Kodaris catalog for discovery, installed or not, runnable by this
+     * user or not. Each row carries `enabled` (installed here), `canEnable` (may
+     * install it) and `canRun` (roles allow invoking it).
      *
-     * Uses `/conversation/globalSkillCatalog` rather than the `/aiskills/global/search`
+     * Uses `/conversation/globalSkillList` rather than the `/aiskills/global/search`
      * twin, which requires a skill-authoring role an ordinary chat user doesn't have.
-     * Both return the same catalog in `KRChatbotSkill` shape
-     * (`data: [{ code, name, description, enabled }]`), so no `_source` lifting is needed.
+     *
+     * Returns `[]` — not an error — when there's no reachable registry, and always
+     * on kodaris.com, which IS the catalog source and so has no remote to pull. The
+     * tab itself is hidden there (see `_renderSkillBrowse`).
      */
     _searchGlobalSkills(query) {
         this._globalSkillRequestId++;
         const requestId = this._globalSkillRequestId;
         KRHttp.fetch({
-            url: '/api/system/conversation/globalSkillCatalog',
+            url: '/api/system/conversation/globalSkillList',
             method: 'POST',
             body: { query: query.trim() },
         })
@@ -6509,6 +6467,17 @@ let KRChatbot = class KRChatbot extends i$3 {
     _handleGlobalSkillEnable(skill, e) {
         // The card body inserts the skill; the install button must not also do that.
         e.stopPropagation();
+        // The button is shown to everyone so the catalog reads the same for all users,
+        // but the enable endpoint requires administrator/superuser/skillEdit. Without
+        // it, say who to ask instead of firing a request that comes back 403.
+        if (!skill.canEnable) {
+            KRSnackbar.show({
+                title: 'Permission Required',
+                message: 'You do not have permission to install skills. Please contact your site administrator.',
+                type: 'error',
+            });
+            return;
+        }
         if (this._globalSkillPending.has(skill.code)) {
             return;
         }
@@ -6635,13 +6604,33 @@ let KRChatbot = class KRChatbot extends i$3 {
         recognition.start();
         this._inputEl?.focus();
     }
+    /**
     /** Insert `/code ` into the composer and focus it, ready for the message. */
     _handleSkillSelect(skill) {
-        // A global skill must be installed before it can be chosen — inserting /code
-        // for one not enabled on this instance would just fail. `enabled` is only set
-        // on global skills (false = not installed); org skills leave it undefined and
-        // are always selectable. So an uninstalled global card click does nothing.
-        if (skill.enabled === false) {
+        // The user's roles don't allow this skill — inserting /code would just fail in the
+        // chat. Name the roles that would grant it, so the user knows what to ask for and
+        // whoever grants it knows what to give.
+        if (skill.canRun === false) {
+            let message = `You do not have access to "${skill.name}". Ask your site administrator to grant it.`;
+            if (skill.allowedRoles?.length) {
+                message = `"${skill.name}" requires the ${skill.allowedRoles.join(' or ')} role. Ask your site administrator to grant it.`;
+            }
+            KRSnackbar.show({
+                title: 'Access Required',
+                message: message,
+                type: 'error',
+            });
+            return;
+        }
+        // A global skill nobody has installed here yet isn't runnable either — point at the
+        // Install button rather than appearing to ignore the click. Local skills carry no
+        // install state, so this only applies to global ones.
+        if (skill.global && !skill.enabled) {
+            KRSnackbar.show({
+                title: 'Not Installed',
+                message: `"${skill.name}" has to be installed on this site before you can use it — use the Install button on the card.`,
+                type: 'info',
+            });
             return;
         }
         this._inputValue = `/${skill.code} `;
@@ -6673,8 +6662,11 @@ let KRChatbot = class KRChatbot extends i$3 {
         this._skillBrowseQuery = '';
         this._skillBrowseOpened = true;
         // Fill both tabs up front so switching between them is instant, not stale.
+        // The Kodaris tab isn't rendered on the registry server, so skip its fetch there.
         this._searchOrgSkills('');
-        this._searchGlobalSkills('');
+        if (this._aiFrameworkConfig.registryServer !== true) {
+            this._searchGlobalSkills('');
+        }
     }
     _handleSkillBrowseClose() {
         this._skillBrowseOpened = false;
@@ -6683,7 +6675,9 @@ let KRChatbot = class KRChatbot extends i$3 {
         this._skillBrowseQuery = e.target.value;
         // Filter both catalogs so whichever tab the user switches to is already current.
         this._searchOrgSkills(this._skillBrowseQuery);
-        this._searchGlobalSkills(this._skillBrowseQuery);
+        if (this._aiFrameworkConfig.registryServer !== true) {
+            this._searchGlobalSkills(this._skillBrowseQuery);
+        }
     }
     _handleSkillBrowseTabChange(e) {
         // Both buffers are kept current by open/search, so switching just swaps which
@@ -7025,6 +7019,15 @@ let KRChatbot = class KRChatbot extends i$3 {
                         userText: params.message,
                         fileIds: files.map((f) => f.conversationFileID),
                     };
+                    // Ground the model in where the user is and what they've highlighted.
+                    // Only sent when present so an empty selection / failed capture doesn't
+                    // add noise to the request.
+                    if (params.pageContext) {
+                        body.pageContext = params.pageContext;
+                    }
+                    if (params.selectionContext) {
+                        body.selectionContext = params.selectionContext;
+                    }
                     if (this.conversationId != null) {
                         body.conversationID = this.conversationId;
                     }
@@ -7069,10 +7072,16 @@ let KRChatbot = class KRChatbot extends i$3 {
                 });
             };
         }
+        // Capture where the user is and what they've highlighted at send time (not
+        // earlier — selection is transient and the route may have changed since the
+        // panel opened), so every turn grounds the model in the user's current spot.
+        const context = this._captureContext();
         this.send({
             message: params.message,
             messages: this.messages.slice(0, -1),
             conversationFiles: params.conversationFiles,
+            pageContext: context.pageContext,
+            selectionContext: context.selectionContext,
         }).then((response) => {
             if (!response.ok) {
                 this._handleStreamError('Request failed: ' + response.status);
@@ -7092,6 +7101,56 @@ let KRChatbot = class KRChatbot extends i$3 {
             }
         });
     }
+    /**
+     * Capture ambient "where is the user / what are they looking at" context at
+     * send time, so the AI is grounded without the host passing anything in.
+     *
+     * Two universal sources that exist on every page the chatbot mounts in:
+     * - `pageContext` — the location (full url, which already carries the path and
+     *   query) and title, plus, when the page renders the server-side
+     *   `#kodaris-page` JSON island (storefront content pages do), its parsed
+     *   contents (page name/type/ids). A page without the island still yields url
+     *   + title, so context is never empty on a real page.
+     * - `selectionContext` — the text the user currently has highlighted, read
+     *   live here because a selection is transient (it may be gone a moment later).
+     *
+     * Both are returned as strings because that's what the backend `ModelForText`
+     * fields (`pageContext` / `selectionContext`) accept. Capture is best-effort:
+     * any failure yields an empty string for that field rather than blocking send.
+     */
+    _captureContext() {
+        let pageContext = '';
+        try {
+            const page = {
+                url: window.location.href,
+                title: document.title,
+            };
+            // Structured page context is opt-in by convention: a page that renders the
+            // `#kodaris-page` island gets its name/type/ids folded in for free. The
+            // island's text is JSON; a malformed/absent island just leaves it out.
+            const island = document.getElementById('kodaris-page');
+            if (island && island.textContent) {
+                try {
+                    page.page = JSON.parse(island.textContent);
+                }
+                catch { /* island present but not valid JSON — location context still stands */ }
+            }
+            pageContext = JSON.stringify(page);
+        }
+        catch { /* leave pageContext empty — never block a send on context capture */ }
+        let selectionContext = '';
+        try {
+            const selection = window.getSelection();
+            if (selection) {
+                selectionContext = selection.toString().trim();
+            }
+        }
+        catch { /* leave selectionContext empty */ }
+        return {
+            pageContext,
+            selectionContext,
+        };
+    }
     _handleStop() {
         if (this._reader) {
             this._reader.cancel();
@@ -7365,7 +7424,14 @@ let KRChatbot = class KRChatbot extends i$3 {
       </div>
     `;
     }
-    /** The "Browse all skills" dialog — a searchable grid of Org / Kodaris cards. */
+    /**
+     * The "Browse all skills" dialog — a searchable grid of Org / Kodaris cards.
+     *
+     * The Kodaris tab is omitted on the registry server (kodaris.com): that instance
+     * IS the catalog source, so `globalSkillList` has no remote to pull and always
+     * returns `[]`. Its own published skills appear on the Your Org tab instead,
+     * carrying a "Global" badge.
+     */
     _renderSkillBrowse() {
         return b `
       <kr-dialog
@@ -7387,9 +7453,11 @@ let KRChatbot = class KRChatbot extends i$3 {
             <kr-tab id="org" label="Your Org">
               ${this._renderSkillGrid()}
             </kr-tab>
-            <kr-tab id="kodaris" label="Kodaris">
-              ${this._renderSkillGrid(true)}
-            </kr-tab>
+            ${this._aiFrameworkConfig.registryServer === true ? A : b `
+              <kr-tab id="kodaris" label="Kodaris">
+                ${this._renderSkillGrid(true)}
+              </kr-tab>
+            `}
           </kr-tab-group>
         </div>
       </kr-dialog>
@@ -7398,8 +7466,13 @@ let KRChatbot = class KRChatbot extends i$3 {
     /**
      * The card grid of skill search results for the browse dialog. Clicking a card
      * inserts `/code ` into the composer. In the shared-Kodaris (`global`) tab each
-     * card also gets a footer row with an Enabled toggle that installs/removes the
-     * skill on this instance.
+     * card also gets a footer row with an Install/Uninstall button.
+     *
+     * The Kodaris tab is the whole published catalog, deliberately NOT role-filtered so
+     * users can discover skills they don't have yet. So a card there can be in one of two
+     * non-runnable states — the user's roles don't allow it (`canRun: false`), or it isn't
+     * installed here (not `enabled`). Neither looks clickable; clicking either explains
+     * why via `_handleSkillSelect`.
      */
     _renderSkillGrid(global = false) {
         let skills = this._orgSkills;
@@ -7413,7 +7486,10 @@ let KRChatbot = class KRChatbot extends i$3 {
       <div class="skill-browse__grid">
         ${skills.map((skill) => b `
           <div
-            class="skill-card"
+            class=${e({
+            'skill-card': true,
+            'skill-card--unavailable': skill.canRun === false || (!!skill.global && !skill.enabled),
+        })}
             role="button"
             tabindex="0"
             @click=${() => this._handleSkillSelect(skill)}
@@ -7423,6 +7499,9 @@ let KRChatbot = class KRChatbot extends i$3 {
             ${skill.description ? b `
               <span class="skill-card__desc">${skill.description}</span>
             ` : A}
+            ${!global && skill.global ? b `
+              <span class="skill-card__badge">Global</span>
+            ` : A}
             ${global ? b `
               <div class="skill-card__footer">
                 <span class="skill-card__price">Free</span>
@@ -9292,6 +9371,30 @@ KRChatbot.styles = i$6 `
       box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
     }
 
+    /* A Kodaris-tab card the user can't invoke — not in their roles, or not installed
+       here yet. Clicking it does nothing, so it drops the pointer cursor and the hover
+       highlight. The Install button inside keeps its own pointer cursor. */
+    .skill-card--unavailable {
+      cursor: default;
+    }
+
+    .skill-card--unavailable:hover {
+      border-color: #e5e7eb;
+      box-shadow: none;
+    }
+
+    /* Marks a globally-published skill listed on the Your Org tab — only happens on
+       kodaris.com, which has no Kodaris tab for its own published skills. */
+    .skill-card__badge {
+      align-self: flex-start;
+      padding: 2px 8px;
+      border-radius: 10px;
+      background: #f3f4f6;
+      font-size: 11px;
+      font-weight: 600;
+      color: #000000;
+    }
+
     /* Footer row on global skill cards: install button on the left, price on the
        right. margin-top:auto pins it to the bottom so cards in a row align their
        footers regardless of description length. Negative horizontal margins