@plmbr/notebook-intelligence 5.0.0 → 5.1.0-a.1

package/lib/components/safe-anchor.js

@@ -0,0 +1,33 @@
+// Copyright (c) Mehmet Bektas <mbektasgh@outlook.com>
+import React from 'react';
+import { hasDangerousTextCodepoints, safeAnchorUri } from '../utils';
+/**
+ * The single render path for anchor elements driven by LLM / tool output.
+ *
+ * Runs `href` through `safeAnchorUri`, which mirrors the server-side
+ * `safe_anchor_uri` allowlist (`http` / `https` / `mailto`) and rejects
+ * dangerous codepoints. On accept it renders a `_blank` anchor with
+ * `rel="noopener noreferrer"` and an SR-only "(opens in new tab)" suffix;
+ * on reject it falls through to plain text plus an SR-only "(link
+ * blocked)" note so screen readers can tell why the link disappeared.
+ *
+ * The `title` attribute is scrubbed for the same dangerous codepoints
+ * the URI check rejects, since react-markdown forwards CommonMark
+ * `[text](url "title")` titles to the rendered anchor and an LLM can
+ * smuggle bidi-override or zero-width characters there to visually
+ * impersonate the link target on hover.
+ */
+export function SafeAnchor({ href, children, title, className }) {
+    const safeUri = safeAnchorUri(href !== null && href !== void 0 ? href : '');
+    if (!safeUri) {
+        return (React.createElement("span", { className: className },
+            children,
+            React.createElement("span", { className: "nbi-sr-only" }, " (link blocked)")));
+    }
+    const safeTitle = typeof title === 'string' && !hasDangerousTextCodepoints(title)
+        ? title
+        : undefined;
+    return (React.createElement("a", { href: safeUri, target: "_blank", rel: "noopener noreferrer", title: safeTitle, className: className },
+        children,
+        React.createElement("span", { className: "nbi-sr-only" }, " (opens in new tab)")));
+}

package/lib/components/tool-call-card.d.ts

@@ -0,0 +1,26 @@
+/// <reference types="react" />
+export interface IToolCallDiffLine {
+    type: 'add' | 'remove' | 'context' | string;
+    content: string;
+}
+export interface IToolCallDiff {
+    path: string;
+    lines: IToolCallDiffLine[];
+    truncated?: boolean;
+}
+/**
+ * A single agent tool call surfaced as a persistent chat card. Mirrors the
+ * `ToolCallData` payload emitted by the server: it stays in the transcript
+ * after the turn ends and carries its final status, unlike the transient
+ * single progress line it replaces. File-edit tools also carry inline diffs.
+ */
+export interface IToolCall {
+    id: string;
+    title: string;
+    kind: 'read' | 'edit' | 'execute' | 'other' | string;
+    status: 'in_progress' | 'completed' | 'failed' | 'cancelled' | string;
+    diffs?: IToolCallDiff[];
+}
+export declare function ToolCallCard(props: {
+    toolCall: IToolCall;
+}): JSX.Element;

package/lib/components/tool-call-card.js

@@ -0,0 +1,54 @@
+import React, { useState } from 'react';
+import { VscChevronDown, VscChevronRight, VscClose, VscEdit, VscError, VscEye, VscPassFilled, VscSync, VscTerminal, VscTools } from '../icons';
+const KIND_ICONS = {
+    read: VscEye,
+    edit: VscEdit,
+    execute: VscTerminal,
+    other: VscTools
+};
+const STATUS_LABELS = {
+    in_progress: 'in progress',
+    completed: 'completed',
+    failed: 'failed',
+    cancelled: 'cancelled'
+};
+const GUTTER = { add: '+', remove: '-' };
+function ToolCallDiffView(props) {
+    return (React.createElement("div", { className: "nbi-tool-call-diffs" }, props.diffs.map((diff, i) => (React.createElement("div", { className: "nbi-tool-call-diff", key: i },
+        diff.path ? (React.createElement("div", { className: "nbi-tool-call-diff-path", title: diff.path }, diff.path)) : null,
+        React.createElement("div", { className: "nbi-tool-call-diff-body" }, diff.lines.map((line, j) => {
+            var _a;
+            return (React.createElement("div", { className: `nbi-tool-call-diff-line nbi-diff-${line.type}`, key: j },
+                React.createElement("span", { className: "nbi-diff-gutter", "aria-hidden": "true" }, (_a = GUTTER[line.type]) !== null && _a !== void 0 ? _a : ' '),
+                line.type === 'add' || line.type === 'remove' ? (React.createElement("span", { className: "nbi-sr-only" }, line.type === 'add' ? 'added ' : 'removed ')) : null,
+                React.createElement("span", { className: "nbi-diff-text" }, line.content)));
+        })),
+        diff.truncated ? (React.createElement("div", { className: "nbi-tool-call-diff-truncated" }, "diff truncated")) : null)))));
+}
+export function ToolCallCard(props) {
+    var _a, _b;
+    const { title, kind, status, diffs } = props.toolCall;
+    const [expanded, setExpanded] = useState(true);
+    const KindIcon = (_a = KIND_ICONS[kind]) !== null && _a !== void 0 ? _a : VscTools;
+    let StatusIcon = VscSync;
+    if (status === 'completed') {
+        StatusIcon = VscPassFilled;
+    }
+    else if (status === 'failed') {
+        StatusIcon = VscError;
+    }
+    else if (status === 'cancelled') {
+        StatusIcon = VscClose;
+    }
+    const statusLabel = (_b = STATUS_LABELS[status]) !== null && _b !== void 0 ? _b : status;
+    const statusModifier = status.replace(/_/g, '-');
+    const hasDiffs = Array.isArray(diffs) && diffs.length > 0;
+    return (React.createElement("div", { className: "nbi-tool-call-wrapper" },
+        React.createElement("div", { className: `nbi-tool-call nbi-tool-call-${statusModifier}` },
+            React.createElement(KindIcon, { className: "nbi-tool-call-kind-icon", "aria-hidden": "true" }),
+            React.createElement("span", { className: "nbi-tool-call-title", title: title }, title),
+            hasDiffs ? (React.createElement("button", { type: "button", className: "nbi-tool-call-diff-toggle", onClick: () => setExpanded(e => !e), "aria-expanded": expanded, "aria-label": expanded ? 'Hide diff' : 'Show diff' }, expanded ? (React.createElement(VscChevronDown, { "aria-hidden": "true" })) : (React.createElement(VscChevronRight, { "aria-hidden": "true" })))) : null,
+            React.createElement(StatusIcon, { className: "nbi-tool-call-status-icon", "aria-hidden": "true" }),
+            React.createElement("span", { className: "nbi-sr-only" }, statusLabel)),
+        hasDiffs && expanded ? React.createElement(ToolCallDiffView, { diffs: diffs }) : null));
+}

package/lib/components/tool-call-group.d.ts

@@ -0,0 +1,11 @@
+/// <reference types="react" />
+import { IToolCall } from './tool-call-card';
+/**
+ * Renders a run of consecutive tool calls. A single call is shown as a bare
+ * card; multiple calls are wrapped in one collapsible group with a summary
+ * header, so consecutive agent activity reads as one unit instead of a wall
+ * of rows.
+ */
+export declare function ToolCallGroup(props: {
+    toolCalls: IToolCall[];
+}): JSX.Element;

package/lib/components/tool-call-group.js

@@ -0,0 +1,33 @@
+import React, { useState } from 'react';
+import { VscChevronDown, VscChevronRight } from '../icons';
+import { ToolCallCard } from './tool-call-card';
+// Groups with more calls than this start collapsed so a tool-heavy turn (or a
+// reloaded transcript) doesn't flood the chat. A live turn mounts the group at
+// length 1, so it starts expanded and stays visible as calls stream in.
+const GROUP_COLLAPSE_THRESHOLD = 3;
+/**
+ * Renders a run of consecutive tool calls. A single call is shown as a bare
+ * card; multiple calls are wrapped in one collapsible group with a summary
+ * header, so consecutive agent activity reads as one unit instead of a wall
+ * of rows.
+ */
+export function ToolCallGroup(props) {
+    const { toolCalls } = props;
+    // Hooks must run unconditionally and in a stable order: the group's length
+    // grows as calls stream in, so call useState before any length branch.
+    // Start collapsed only for a large group whose calls are all settled --
+    // never hide a still-running or failed call (matters on transcript reload,
+    // where a group can mount already large).
+    const [expanded, setExpanded] = useState(() => toolCalls.length <= GROUP_COLLAPSE_THRESHOLD ||
+        toolCalls.some(t => t.status === 'in_progress' || t.status === 'failed'));
+    if (toolCalls.length <= 1) {
+        return toolCalls.length === 1 ? (React.createElement(ToolCallCard, { toolCall: toolCalls[0] })) : (React.createElement(React.Fragment, null));
+    }
+    const failed = toolCalls.filter(t => t.status === 'failed').length;
+    const summary = `${toolCalls.length} tool calls` + (failed ? ` (${failed} failed)` : '');
+    return (React.createElement("div", { className: "nbi-tool-call-group" },
+        React.createElement("button", { type: "button", className: "nbi-tool-call-group-header", onClick: () => setExpanded(e => !e), "aria-expanded": expanded },
+            expanded ? (React.createElement(VscChevronDown, { "aria-hidden": "true" })) : (React.createElement(VscChevronRight, { "aria-hidden": "true" })),
+            React.createElement("span", { className: "nbi-tool-call-group-summary" }, summary)),
+        expanded ? (React.createElement("div", { className: "nbi-tool-call-group-body" }, toolCalls.map(toolCall => (React.createElement(ToolCallCard, { key: toolCall.id, toolCall: toolCall }))))) : null));
+}

package/lib/icons.d.ts

@@ -17,6 +17,7 @@ export declare const VscClose: IconLike;
 export declare const VscCloudUpload: IconLike;
 export declare const VscCopy: IconLike;
 export declare const VscEdit: IconLike;
+export declare const VscError: IconLike;
 export declare const VscEye: IconLike;
 export declare const VscEyeClosed: IconLike;
 export declare const VscFile: IconLike;
@@ -31,6 +32,8 @@ export declare const VscSend: IconLike;
 export declare const VscSettingsGear: IconLike;
 export declare const VscSparkle: IconLike;
 export declare const VscStopCircle: IconLike;
+export declare const VscSync: IconLike;
+export declare const VscTerminal: IconLike;
 export declare const VscThumbsdown: IconLike;
 export declare const VscThumbsdownFilled: IconLike;
 export declare const VscThumbsup: IconLike;

package/lib/icons.js

@@ -27,6 +27,7 @@ export const VscClose = asIcon(Vsc.VscClose);
 export const VscCloudUpload = asIcon(Vsc.VscCloudUpload);
 export const VscCopy = asIcon(Vsc.VscCopy);
 export const VscEdit = asIcon(Vsc.VscEdit);
+export const VscError = asIcon(Vsc.VscError);
 export const VscEye = asIcon(Vsc.VscEye);
 export const VscEyeClosed = asIcon(Vsc.VscEyeClosed);
 export const VscFile = asIcon(Vsc.VscFile);
@@ -41,6 +42,8 @@ export const VscSend = asIcon(Vsc.VscSend);
 export const VscSettingsGear = asIcon(Vsc.VscSettingsGear);
 export const VscSparkle = asIcon(Vsc.VscSparkle);
 export const VscStopCircle = asIcon(Vsc.VscStopCircle);
+export const VscSync = asIcon(Vsc.VscSync);
+export const VscTerminal = asIcon(Vsc.VscTerminal);
 export const VscThumbsdown = asIcon(Vsc.VscThumbsdown);
 export const VscThumbsdownFilled = asIcon(Vsc.VscThumbsdownFilled);
 export const VscThumbsup = asIcon(Vsc.VscThumbsup);

package/lib/index.js

@@ -36,7 +36,7 @@ import sparklesWarningSvgstr from '../style/icons/sparkles-warning.svg';
 import claudeSvgstr from '../style/icons/claude.svg';
 import openaiSvgstr from '../style/icons/openai.svg';
 import opencodeSvgstr from '../style/icons/opencode.svg';
-import { applyCodeToSelectionInEditor, cellOutputAsText, cellOutputHasError, chooseWorkspaceDirectory, compareSelections, extractLLMGeneratedCode, getSelectionInEditor, getTokenCount, getWholeNotebookContent, isSelectionEmpty, markdownToComment, waitForDuration } from './utils';
+import { applyCodeToSelectionInEditor, cellOutputAsText, cellOutputHasError, chooseWorkspaceDirectory, compareSelections, buildResumeCommand, extractLLMGeneratedCode, getSelectionInEditor, getTokenCount, getWholeNotebookContent, isSelectionEmpty, markdownToComment, waitForDuration } from './utils';
 import { cellOutputAsContextBundle } from './cell-output-bundle';
 import { UUID } from '@lumino/coreutils';
 import * as path from 'path';
@@ -1108,11 +1108,9 @@ const plugin = {
                     render() {
                         return React.createElement(LauncherPicker, {
                             onSessionSelected: (session) => {
+                                var _a;
                                 dialog.close();
-                                const cmd = session.cwd
-                                    ? `cd ${session.cwd} && claude --resume ${session.session_id}`
-                                    : `claude --resume ${session.session_id}`;
-                                launchCliInTerminal(cmd);
+                                launchCliInTerminal(buildResumeCommand((_a = session.cwd) !== null && _a !== void 0 ? _a : '', session.session_id));
                             }
                         });
                     }
@@ -1360,7 +1358,7 @@ const plugin = {
                     metadata: { trusted: true },
                     source: args.source
                 });
-                return true;
+                return { cellIndex: newCellIndex };
             }
         });
         app.commands.addCommand(CommandIDs.addCodeCellToActiveNotebook, {
@@ -1378,7 +1376,7 @@ const plugin = {
                     metadata: { trusted: true },
                     source: args.source
                 });
-                return true;
+                return { cellIndex: newCellIndex };
             }
         });
         app.commands.addCommand(CommandIDs.getCellTypeAndSource, {

package/lib/markdown-renderer.js

@@ -6,12 +6,34 @@ import { Prism as SyntaxHighlighterBase } from 'react-syntax-highlighter';
 const SyntaxHighlighter = SyntaxHighlighterBase;
 import { oneLight, oneDark } from 'react-syntax-highlighter/dist/cjs/styles/prism';
 import { VscNewFile, VscInsert, VscCopy, VscNotebook, VscAdd } from './icons';
+import { PathExt } from '@jupyterlab/coreutils';
+import { MarkdownLink } from './components/markdown-link';
 import { isDarkTheme, writeTextToClipboard } from './utils';
 export function MarkdownRenderer({ children: markdown, getApp, getActiveDocumentInfo }) {
     const app = getApp();
     const activeDocumentInfo = getActiveDocumentInfo();
     const isNotebook = activeDocumentInfo.filename.endsWith('.ipynb');
-    return (React.createElement(Markdown, { remarkPlugins: [remarkGfm], components: {
+    // Resolve workspace-relative LLM links against the active document's
+    // directory so `[file](README.md)` from a chat scoped to
+    // `notebooks/proj/work.ipynb` lands at `notebooks/proj/README.md` (the
+    // user's mental model) rather than the server-root README.
+    const linkBaseDir = activeDocumentInfo.filePath
+        ? PathExt.dirname(activeDocumentInfo.filePath)
+        : '';
+    return (
+    // No `rehype-raw` plugin: raw HTML in chat markdown (e.g. an LLM
+    // emitting `<a href="javascript:...">`) renders as literal text, not
+    // a DOM anchor, so the only anchor sink is the CommonMark/GFM `a`
+    // node handled by `SafeAnchor` below. Any future change that enables
+    // raw HTML needs to add a rehype-sanitize pass alongside.
+    React.createElement(Markdown, { remarkPlugins: [remarkGfm], components: {
+            // CommonMark `<https://...>` autolinks, `[text](url)`, and
+            // reference-style links all normalize to the same `a` node.
+            // `MarkdownLink` routes fragment-only and workspace-relative
+            // hrefs through Lab's docmanager so an LLM-emitted link can't
+            // replace the JupyterLab shell, and hands everything else to
+            // SafeAnchor for the `_blank` + scheme-allowlist treatment.
+            a: ({ href, title, children }) => (React.createElement(MarkdownLink, { app: app, baseDir: linkBaseDir, href: href, title: title }, children)),
             code({ node, inline, className, children, getApp, ...props }) {
                 const match = /language-(\w+)/.exec(className || '');
                 const codeString = String(children).replace(/\n$/, '');

package/lib/tokens.d.ts

@@ -41,6 +41,7 @@ export declare enum ResponseStreamDataType {
     Button = "button",
     Anchor = "anchor",
     Progress = "progress",
+    ToolCall = "tool-call",
     Confirmation = "confirmation",
     AskUserQuestion = "ask-user-question"
 }

package/lib/tokens.js

@@ -32,6 +32,7 @@ export var ResponseStreamDataType;
     ResponseStreamDataType["Button"] = "button";
     ResponseStreamDataType["Anchor"] = "anchor";
     ResponseStreamDataType["Progress"] = "progress";
+    ResponseStreamDataType["ToolCall"] = "tool-call";
     ResponseStreamDataType["Confirmation"] = "confirmation";
     ResponseStreamDataType["AskUserQuestion"] = "ask-user-question";
 })(ResponseStreamDataType || (ResponseStreamDataType = {}));

package/lib/tool-call-stream.d.ts

@@ -0,0 +1,24 @@
+import { ResponseStreamDataType } from './tokens';
+/**
+ * The subset of a chat message's stream-content item this helper needs. A
+ * structural subset of `IChatMessageContent` (defined in chat-sidebar) so it
+ * can be unit-tested without importing the sidebar (and creating a cycle).
+ */
+export interface IToolCallStreamItem {
+    id: string;
+    type: ResponseStreamDataType;
+    content: any;
+    created: Date;
+}
+/**
+ * Merge a streamed tool-call payload into `contents` by its tool-call id.
+ *
+ * A tool call streams twice under one id (once when it starts, once when it
+ * finishes). The first emission pushes a new card; the second updates that
+ * card's content (its status) in place, so the call stays a single persistent
+ * row rather than appending a duplicate. Mutates `contents`.
+ */
+export declare function upsertToolCallContent(contents: IToolCallStreamItem[], content: {
+    id: string;
+    [key: string]: any;
+}, created: Date): void;

package/lib/tool-call-stream.js

@@ -0,0 +1,28 @@
+import { UUID } from '@lumino/coreutils';
+import { ResponseStreamDataType } from './tokens';
+/**
+ * Merge a streamed tool-call payload into `contents` by its tool-call id.
+ *
+ * A tool call streams twice under one id (once when it starts, once when it
+ * finishes). The first emission pushes a new card; the second updates that
+ * card's content (its status) in place, so the call stays a single persistent
+ * row rather than appending a duplicate. Mutates `contents`.
+ */
+export function upsertToolCallContent(contents, content, created) {
+    const existing = contents.find(c => {
+        var _a;
+        return c.type === ResponseStreamDataType.ToolCall &&
+            ((_a = c.content) === null || _a === void 0 ? void 0 : _a.id) === (content === null || content === void 0 ? void 0 : content.id);
+    });
+    if (existing) {
+        existing.content = content;
+    }
+    else {
+        contents.push({
+            id: UUID.uuid4(),
+            type: ResponseStreamDataType.ToolCall,
+            content,
+            created
+        });
+    }
+}

package/lib/utils.d.ts

@@ -26,6 +26,15 @@ export declare function getSelectionInEditor(editor: CodeEditor.IEditor): string
 export declare function getWholeNotebookContent(np: NotebookPanel): string;
 export declare function applyCodeToSelectionInEditor(editor: CodeEditor.IEditor, code: string): void;
 export { shellSingleQuote };
+/**
+ * True when `s` contains any codepoint in the same set `safeAnchorUri`
+ * rejects (C0/DEL/C1, NEL/NBSP/LS/PS/BOM, ZWSP, bidi-override controls).
+ * Mirrors the Python `has_dangerous_text_codepoints`. Used to scrub the
+ * `title` attribute on rendered anchors so an LLM-emitted hover tooltip
+ * can't visually impersonate the link via bidi-reorder or zero-width
+ * tricks.
+ */
+export declare function hasDangerousTextCodepoints(s: string | undefined | null): boolean;
 /**
  * Return `uri` if its scheme is in the chat-anchor allowlist, else null.
  * Mirrors the server-side `safe_anchor_uri` check so that anchor parts

package/lib/utils.js

@@ -277,6 +277,25 @@ function isDisallowedUriCodepoint(code) {
     }
     return false;
 }
+/**
+ * True when `s` contains any codepoint in the same set `safeAnchorUri`
+ * rejects (C0/DEL/C1, NEL/NBSP/LS/PS/BOM, ZWSP, bidi-override controls).
+ * Mirrors the Python `has_dangerous_text_codepoints`. Used to scrub the
+ * `title` attribute on rendered anchors so an LLM-emitted hover tooltip
+ * can't visually impersonate the link via bidi-reorder or zero-width
+ * tricks.
+ */
+export function hasDangerousTextCodepoints(s) {
+    if (typeof s !== 'string') {
+        return false;
+    }
+    for (let i = 0; i < s.length; i++) {
+        if (isDisallowedUriCodepoint(s.charCodeAt(i))) {
+            return true;
+        }
+    }
+    return false;
+}
 /**
  * Return `uri` if its scheme is in the chat-anchor allowlist, else null.
  * Mirrors the server-side `safe_anchor_uri` check so that anchor parts
@@ -322,10 +341,11 @@ export function safeAnchorUri(uri) {
  * user happens to be in the JupyterLab working directory.
  */
 export function buildResumeCommand(cwd, sessionId) {
+    const quotedSessionId = shellSingleQuote(sessionId);
     if (!cwd) {
-        return `claude --resume ${sessionId}`;
+        return `claude --resume ${quotedSessionId}`;
     }
-    return `cd ${shellSingleQuote(cwd)} && claude --resume ${sessionId}`;
+    return `cd ${shellSingleQuote(cwd)} && claude --resume ${quotedSessionId}`;
 }
 /**
  * Write `text` to the system clipboard. Falls back to a hidden textarea +

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@plmbr/notebook-intelligence",
-    "version": "5.0.0",
+    "version": "5.1.0-a.1",
     "description": "AI coding assistant for JupyterLab",
     "keywords": [
         "AI",
@@ -49,6 +49,7 @@
         "install:extension": "jlpm build",
         "lint": "jlpm stylelint && jlpm prettier && jlpm eslint",
         "lint:check": "jlpm stylelint:check && jlpm prettier:check && jlpm eslint:check",
+        "postinstall": "husky || exit 0",
         "prettier": "jlpm prettier:base --write --list-different",
         "prettier:base": "prettier \"**/*{.ts,.tsx,.js,.jsx,.css,.json,.md}\"",
         "prettier:check": "jlpm prettier:base --check",
@@ -98,8 +99,10 @@
         "eslint": "^8.36.0",
         "eslint-config-prettier": "^8.8.0",
         "eslint-plugin-prettier": "^5.0.0",
+        "husky": "^9.1.7",
         "jest": "^29.7.0",
         "jest-environment-jsdom": "^29.7.0",
+        "lint-staged": "^15.2.10",
         "mkdirp": "^1.0.3",
         "monaco-editor-webpack-plugin": "^2.0.0",
         "npm-run-all": "^4.1.5",
@@ -238,6 +241,9 @@
             }
         ]
     },
+    "lint-staged": {
+        "*": "prettier --write --ignore-unknown"
+    },
     "stylelint": {
         "extends": [
             "stylelint-config-recommended",

package/src/api.ts

@@ -388,6 +388,10 @@ export class NBIConfig {
     return this.capabilities.claude_settings;
   }
 
+  get spinnerVerbs(): { mode: string; verbs: string[] } | null {
+    return this.capabilities.spinner_verbs ?? null;
+  }
+
   get claudeModels(): IClaudeModelInfo[] {
     return (this.capabilities.claude_models ?? []).map(claudeModelFromWire);
   }
@@ -435,6 +439,10 @@ export class NBIConfig {
     return this.capabilities.chat_feedback_enabled === true;
   }
 
+  get chatFeedbackAlwaysVisible(): boolean {
+    return this.capabilities.chat_feedback_always_visible === true;
+  }
+
   // Admin-supplied tour-copy overrides, served from the capabilities
   // response after server-side validation. Returns the raw dict; the
   // tour module decides how to apply it. Defaults to a shared frozen