@kodaris/krubble-app-components 1.0.107 → 1.0.109

package/dist/krubble-app.umd.js

@@ -6359,76 +6359,30 @@
       }
       // --- Skills ---
       /**
-       * Search the Kodaris AI skills index and store the results in `_orgSkills` — the
-       * browse dialog's "Your Org" tab. Mirrors the backend's own skill search (BM25
-       * over name^3/description^2/instructions, active-only). An empty query uses
-       * match_all — multi_match with an empty string matches nothing, so the "show
-       * everything" case needs it.
+       * Load the browse dialog's "Your Org" tab into `_orgSkills` from
+       * `/conversation/localSkillList` — this instance's own active skills, already
+       * role-filtered to what the caller may run and ranked by the server.
        *
-       * Follows the kr-combo-box `_fetch` pattern: a request-id guard drops responses
-       * that arrive out of order. `/aiskills/search` returns a raw OpenSearch response,
-       * so we lift each hit's `_source` (already in KRChatbotSkill shape) out.
+       * Not the `aiskills` search endpoint: that requires a skill-authoring role
+       * (`skillView`/`skillEdit`), so an ordinary chat user got a 403 and an empty
+       * tab. This one only needs a logged-in employee. It also means the query
+       * matching, active-only filter and "exclude globally-published" rule all live
+       * server-side instead of being rebuilt as OpenSearch DSL here.
+       *
+       * EXCEPTION — on kodaris.com this list also carries that instance's own
+       * globally-published skills (flagged `global: true`), because there is no
+       * Kodaris tab there for them to appear on.
+       *
+       * Request-id guard drops responses that arrive out of order (kr-combo-box
+       * `_fetch` pattern).
        */
       _searchOrgSkills(query) {
           this._orgSkillRequestId++;
           const requestId = this._orgSkillRequestId;
-          const trimmed = query.trim();
-          // An empty query matches everything; otherwise substring-match the query
-          // against name/code/description. We use case-insensitive wildcard queries on
-          // the `.raw` keyword subfields so "ord" matches anywhere in "Create Order"
-          // (a plain match/multi_match only matches whole tokens). Escape the wildcard
-          // specials so user input is treated literally, then wrap with `*...*`.
-          let must = { match_all: {} };
-          if (trimmed) {
-              must = {
-                  bool: {
-                      should: [
-                          {
-                              wildcard: {
-                                  'name.raw': {
-                                      value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                      case_insensitive: true,
-                                  }
-                              }
-                          },
-                          {
-                              wildcard: {
-                                  'code.raw': {
-                                      value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                      case_insensitive: true,
-                                  }
-                              }
-                          },
-                          {
-                              wildcard: {
-                                  'description.raw': {
-                                      value: `*${trimmed.replace(/([*?\\])/g, '\\$1')}*`,
-                                      case_insensitive: true,
-                                  }
-                              }
-                          },
-                      ],
-                      minimum_should_match: 1,
-                  },
-              };
-          }
           krubbleHttp.Http.fetch({
-              url: '/api/system/opensearch/aiskills/search',
+              url: '/api/system/conversation/localSkillList',
               method: 'POST',
-              body: {
-                  size: 100,
-                  query: {
-                      bool: {
-                          must: [must],
-                          filter: [{ term: { active: true } }],
-                          // The "Your Org" tab lists only this instance's own skills. Globally-
-                          // published skills belong to the "Kodaris" tab (fed by the registry),
-                          // so exclude them here. Documents without the field aren't matched by
-                          // the term, so ordinary org skills are kept.
-                          must_not: [{ term: { globalPublished: true } }],
-                      },
-                  },
-              },
+              body: { query: query.trim() },
           })
               .then((r) => r.json())
               .then((res) => {
@@ -6436,7 +6390,7 @@
               if (requestId !== this._orgSkillRequestId) {
                   return;
               }
-              this._orgSkills = (res?.data?.hits?.hits || []).map((hit) => hit._source);
+              this._orgSkills = (res?.data || []);
           })
               .catch((error) => {
               console.error('kr-chatbot: skill search failed', error);
@@ -6476,19 +6430,23 @@
           });
       }
       /**
-       * Load the browse dialog's "Kodaris" tab into `_globalSkills` — the full Kodaris
-       * catalog, installed or not, each row carrying `enabled` = installed here.
+       * Load the browse dialog's "Kodaris" tab into `_globalSkills` — the whole
+       * published Kodaris catalog for discovery, installed or not, runnable by this
+       * user or not. Each row carries `enabled` (installed here), `canEnable` (may
+       * install it) and `canRun` (roles allow invoking it).
        *
-       * Uses `/conversation/globalSkillCatalog` rather than the `/aiskills/global/search`
+       * Uses `/conversation/globalSkillList` rather than the `/aiskills/global/search`
        * twin, which requires a skill-authoring role an ordinary chat user doesn't have.
-       * Both return the same catalog in `KRChatbotSkill` shape
-       * (`data: [{ code, name, description, enabled }]`), so no `_source` lifting is needed.
+       *
+       * Returns `[]` — not an error — when there's no reachable registry, and always
+       * on kodaris.com, which IS the catalog source and so has no remote to pull. The
+       * tab itself is hidden there (see `_renderSkillBrowse`).
        */
       _searchGlobalSkills(query) {
           this._globalSkillRequestId++;
           const requestId = this._globalSkillRequestId;
           krubbleHttp.Http.fetch({
-              url: '/api/system/conversation/globalSkillCatalog',
+              url: '/api/system/conversation/globalSkillList',
               method: 'POST',
               body: { query: query.trim() },
           })
@@ -6512,6 +6470,17 @@
       _handleGlobalSkillEnable(skill, e) {
           // The card body inserts the skill; the install button must not also do that.
           e.stopPropagation();
+          // The button is shown to everyone so the catalog reads the same for all users,
+          // but the enable endpoint requires administrator/superuser/skillEdit. Without
+          // it, say who to ask instead of firing a request that comes back 403.
+          if (!skill.canEnable) {
+              krubbleComponents.Snackbar.show({
+                  title: 'Permission Required',
+                  message: 'You do not have permission to install skills. Please contact your site administrator.',
+                  type: 'error',
+              });
+              return;
+          }
           if (this._globalSkillPending.has(skill.code)) {
               return;
           }
@@ -6638,13 +6607,33 @@
           recognition.start();
           this._inputEl?.focus();
       }
+      /**
       /** Insert `/code ` into the composer and focus it, ready for the message. */
       _handleSkillSelect(skill) {
-          // A global skill must be installed before it can be chosen — inserting /code
-          // for one not enabled on this instance would just fail. `enabled` is only set
-          // on global skills (false = not installed); org skills leave it undefined and
-          // are always selectable. So an uninstalled global card click does nothing.
-          if (skill.enabled === false) {
+          // The user's roles don't allow this skill — inserting /code would just fail in the
+          // chat. Name the roles that would grant it, so the user knows what to ask for and
+          // whoever grants it knows what to give.
+          if (skill.canRun === false) {
+              let message = `You do not have access to "${skill.name}". Ask your site administrator to grant it.`;
+              if (skill.allowedRoles?.length) {
+                  message = `"${skill.name}" requires the ${skill.allowedRoles.join(' or ')} role. Ask your site administrator to grant it.`;
+              }
+              krubbleComponents.Snackbar.show({
+                  title: 'Access Required',
+                  message: message,
+                  type: 'error',
+              });
+              return;
+          }
+          // A global skill nobody has installed here yet isn't runnable either — point at the
+          // Install button rather than appearing to ignore the click. Local skills carry no
+          // install state, so this only applies to global ones.
+          if (skill.global && !skill.enabled) {
+              krubbleComponents.Snackbar.show({
+                  title: 'Not Installed',
+                  message: `"${skill.name}" has to be installed on this site before you can use it — use the Install button on the card.`,
+                  type: 'info',
+              });
               return;
           }
           this._inputValue = `/${skill.code} `;
@@ -6676,8 +6665,11 @@
           this._skillBrowseQuery = '';
           this._skillBrowseOpened = true;
           // Fill both tabs up front so switching between them is instant, not stale.
+          // The Kodaris tab isn't rendered on the registry server, so skip its fetch there.
           this._searchOrgSkills('');
-          this._searchGlobalSkills('');
+          if (this._aiFrameworkConfig.registryServer !== true) {
+              this._searchGlobalSkills('');
+          }
       }
       _handleSkillBrowseClose() {
           this._skillBrowseOpened = false;
@@ -6686,7 +6678,9 @@
           this._skillBrowseQuery = e.target.value;
           // Filter both catalogs so whichever tab the user switches to is already current.
           this._searchOrgSkills(this._skillBrowseQuery);
-          this._searchGlobalSkills(this._skillBrowseQuery);
+          if (this._aiFrameworkConfig.registryServer !== true) {
+              this._searchGlobalSkills(this._skillBrowseQuery);
+          }
       }
       _handleSkillBrowseTabChange(e) {
           // Both buffers are kept current by open/search, so switching just swaps which
@@ -7028,6 +7022,15 @@
                           userText: params.message,
                           fileIds: files.map((f) => f.conversationFileID),
                       };
+                      // Ground the model in where the user is and what they've highlighted.
+                      // Only sent when present so an empty selection / failed capture doesn't
+                      // add noise to the request.
+                      if (params.pageContext) {
+                          body.pageContext = params.pageContext;
+                      }
+                      if (params.selectionContext) {
+                          body.selectionContext = params.selectionContext;
+                      }
                       if (this.conversationId != null) {
                           body.conversationID = this.conversationId;
                       }
@@ -7072,10 +7075,16 @@
                   });
               };
           }
+          // Capture where the user is and what they've highlighted at send time (not
+          // earlier — selection is transient and the route may have changed since the
+          // panel opened), so every turn grounds the model in the user's current spot.
+          const context = this._captureContext();
           this.send({
               message: params.message,
               messages: this.messages.slice(0, -1),
               conversationFiles: params.conversationFiles,
+              pageContext: context.pageContext,
+              selectionContext: context.selectionContext,
           }).then((response) => {
               if (!response.ok) {
                   this._handleStreamError('Request failed: ' + response.status);
@@ -7095,6 +7104,56 @@
               }
           });
       }
+      /**
+       * Capture ambient "where is the user / what are they looking at" context at
+       * send time, so the AI is grounded without the host passing anything in.
+       *
+       * Two universal sources that exist on every page the chatbot mounts in:
+       * - `pageContext` — the location (full url, which already carries the path and
+       *   query) and title, plus, when the page renders the server-side
+       *   `#kodaris-page` JSON island (storefront content pages do), its parsed
+       *   contents (page name/type/ids). A page without the island still yields url
+       *   + title, so context is never empty on a real page.
+       * - `selectionContext` — the text the user currently has highlighted, read
+       *   live here because a selection is transient (it may be gone a moment later).
+       *
+       * Both are returned as strings because that's what the backend `ModelForText`
+       * fields (`pageContext` / `selectionContext`) accept. Capture is best-effort:
+       * any failure yields an empty string for that field rather than blocking send.
+       */
+      _captureContext() {
+          let pageContext = '';
+          try {
+              const page = {
+                  url: window.location.href,
+                  title: document.title,
+              };
+              // Structured page context is opt-in by convention: a page that renders the
+              // `#kodaris-page` island gets its name/type/ids folded in for free. The
+              // island's text is JSON; a malformed/absent island just leaves it out.
+              const island = document.getElementById('kodaris-page');
+              if (island && island.textContent) {
+                  try {
+                      page.page = JSON.parse(island.textContent);
+                  }
+                  catch { /* island present but not valid JSON — location context still stands */ }
+              }
+              pageContext = JSON.stringify(page);
+          }
+          catch { /* leave pageContext empty — never block a send on context capture */ }
+          let selectionContext = '';
+          try {
+              const selection = window.getSelection();
+              if (selection) {
+                  selectionContext = selection.toString().trim();
+              }
+          }
+          catch { /* leave selectionContext empty */ }
+          return {
+              pageContext,
+              selectionContext,
+          };
+      }
       _handleStop() {
           if (this._reader) {
               this._reader.cancel();
@@ -7368,7 +7427,14 @@
       </div>
     `;
       }
-      /** The "Browse all skills" dialog — a searchable grid of Org / Kodaris cards. */
+      /**
+       * The "Browse all skills" dialog — a searchable grid of Org / Kodaris cards.
+       *
+       * The Kodaris tab is omitted on the registry server (kodaris.com): that instance
+       * IS the catalog source, so `globalSkillList` has no remote to pull and always
+       * returns `[]`. Its own published skills appear on the Your Org tab instead,
+       * carrying a "Global" badge.
+       */
       _renderSkillBrowse() {
           return b `
       <kr-dialog
@@ -7390,9 +7456,11 @@
             <kr-tab id="org" label="Your Org">
               ${this._renderSkillGrid()}
             </kr-tab>
-            <kr-tab id="kodaris" label="Kodaris">
-              ${this._renderSkillGrid(true)}
-            </kr-tab>
+            ${this._aiFrameworkConfig.registryServer === true ? A : b `
+              <kr-tab id="kodaris" label="Kodaris">
+                ${this._renderSkillGrid(true)}
+              </kr-tab>
+            `}
           </kr-tab-group>
         </div>
       </kr-dialog>
@@ -7401,8 +7469,13 @@
       /**
        * The card grid of skill search results for the browse dialog. Clicking a card
        * inserts `/code ` into the composer. In the shared-Kodaris (`global`) tab each
-       * card also gets a footer row with an Enabled toggle that installs/removes the
-       * skill on this instance.
+       * card also gets a footer row with an Install/Uninstall button.
+       *
+       * The Kodaris tab is the whole published catalog, deliberately NOT role-filtered so
+       * users can discover skills they don't have yet. So a card there can be in one of two
+       * non-runnable states — the user's roles don't allow it (`canRun: false`), or it isn't
+       * installed here (not `enabled`). Neither looks clickable; clicking either explains
+       * why via `_handleSkillSelect`.
        */
       _renderSkillGrid(global = false) {
           let skills = this._orgSkills;
@@ -7416,7 +7489,10 @@
       <div class="skill-browse__grid">
         ${skills.map((skill) => b `
           <div
-            class="skill-card"
+            class=${e({
+            'skill-card': true,
+            'skill-card--unavailable': skill.canRun === false || (!!skill.global && !skill.enabled),
+        })}
             role="button"
             tabindex="0"
             @click=${() => this._handleSkillSelect(skill)}
@@ -7426,6 +7502,9 @@
             ${skill.description ? b `
               <span class="skill-card__desc">${skill.description}</span>
             ` : A}
+            ${!global && skill.global ? b `
+              <span class="skill-card__badge">Global</span>
+            ` : A}
             ${global ? b `
               <div class="skill-card__footer">
                 <span class="skill-card__price">Free</span>
@@ -9295,6 +9374,30 @@
       box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
     }
 
+    /* A Kodaris-tab card the user can't invoke — not in their roles, or not installed
+       here yet. Clicking it does nothing, so it drops the pointer cursor and the hover
+       highlight. The Install button inside keeps its own pointer cursor. */
+    .skill-card--unavailable {
+      cursor: default;
+    }
+
+    .skill-card--unavailable:hover {
+      border-color: #e5e7eb;
+      box-shadow: none;
+    }
+
+    /* Marks a globally-published skill listed on the Your Org tab — only happens on
+       kodaris.com, which has no Kodaris tab for its own published skills. */
+    .skill-card__badge {
+      align-self: flex-start;
+      padding: 2px 8px;
+      border-radius: 10px;
+      background: #f3f4f6;
+      font-size: 11px;
+      font-weight: 600;
+      color: #000000;
+    }
+
     /* Footer row on global skill cards: install button on the left, price on the
        right. margin-top:auto pins it to the bottom so cards in a row align their
        footers regardless of description length. Negative horizontal margins