@oyehello/chat 0.5.1 → 0.5.2

package/dist/index.global.js

@@ -308,6 +308,29 @@ var OyehelloChat = (function (exports) {
   // src/client.ts
   var seq = 0;
   var uid = (p) => `${p}_${Date.now().toString(36)}_${(seq++).toString(36)}`;
+  var isSafeRelativePath = (p) => p.startsWith("/") && !p.startsWith("//");
+  var isSafeHttpUrl = (u3) => {
+    try {
+      const parsed = new URL(u3, window.location.origin);
+      return parsed.protocol === "http:" || parsed.protocol === "https:";
+    } catch {
+      return false;
+    }
+  };
+  var BUILTIN_TOOL_HANDLERS = {
+    navigate: (args) => {
+      const path = String(args.path ?? "");
+      if (!isSafeRelativePath(path)) return { ok: false, error: "unsafe navigate path" };
+      window.location.assign(path);
+      return { ok: true };
+    },
+    openUrl: (args) => {
+      const url = String(args.url ?? "");
+      if (!isSafeHttpUrl(url)) return { ok: false, error: "unsafe url" };
+      window.open(url, args.newTab === false ? "_self" : "_blank", "noopener,noreferrer");
+      return { ok: true };
+    }
+  };
   function createChatClient(options) {
     const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
     const ES = options.eventSource ?? globalThis.EventSource;
@@ -466,7 +489,7 @@ var OyehelloChat = (function (exports) {
       } else if (ev.type === "tool_call") {
         if (seenCallIds.has(ev.callId)) return;
         seenCallIds.add(ev.callId);
-        const handler = toolHandlers.get(ev.name);
+        const handler = toolHandlers.get(ev.name) ?? BUILTIN_TOOL_HANDLERS[ev.name];
         void (async () => {
           if (!session) return;
           const base = { baseUrl: options.baseUrl, sessionId: session.sessionId, sessionToken: session.sessionToken, callId: ev.callId, fetchImpl };
@@ -564,7 +587,8 @@ var OyehelloChat = (function (exports) {
         return;
       }
       if (deviceFingerprint === void 0) deviceFingerprint = await computeDeviceFingerprint().catch(() => null);
-      session = await openSession({ baseUrl: options.baseUrl, apiKey: options.apiKey, agentId: options.agentId, user: options.user, clientTools: Array.from(toolHandlers.keys()), fingerprint: deviceFingerprint ?? void 0, fetchImpl });
+      const advertisedTools = /* @__PURE__ */ new Set([...toolHandlers.keys(), ...Object.keys(BUILTIN_TOOL_HANDLERS)]);
+      session = await openSession({ baseUrl: options.baseUrl, apiKey: options.apiKey, agentId: options.agentId, user: options.user, clientTools: Array.from(advertisedTools), fingerprint: deviceFingerprint ?? void 0, fetchImpl });
       persistSession(session);
       if (!warnedProtocol && typeof session.protocol === "number" && session.protocol !== CHAT_PROTOCOL_VERSION) {
         warnedProtocol = true;