@trops/dash-core 0.1.645 → 0.1.646

package/dist/index.esm.js

@@ -32,6 +32,7 @@ import * as ReactDOM from 'react-dom';
 import { createPortal } from 'react-dom';
 import { Link } from 'react-router-dom';
 import { marked } from 'marked';
+import DOMPurify from 'dompurify';
 import PropTypes from 'prop-types';
 
 function ownKeys$1d(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
@@ -69036,6 +69037,58 @@ var ToolCallBlock = function ToolCallBlock(_ref) {
   });
 };
 
+/**
+ * safeMarkdown.js
+ *
+ * Markdown → HTML that is safe to insert with dangerouslySetInnerHTML.
+ *
+ * AI replies are Markdown, and they can quote untrusted content (emails, web
+ * pages, tool results). `marked` passes raw HTML through untouched, so a reply
+ * containing `<img onerror=…>` or `<script>` would run in the app window —
+ * which can reach window.mainApi. Every Markdown render of model or tool text
+ * goes through here: `marked`, then DOMPurify.
+ *
+ * Kept: normal formatting (headings, emphasis, lists, code, tables, links).
+ * Removed: scripts, event-handler attributes, javascript:/data: URLs,
+ * iframes/objects/embeds/forms/styles, and inline style. Links get
+ * rel="noopener noreferrer" (the app also blocks in-window navigation).
+ */
+var FORBID_TAGS = ["style", "iframe", "object", "embed", "form", "input", "button", "textarea", "select", "link", "meta", "base"];
+var FORBID_ATTR = ["style"];
+// http(s), mailto, and in-page anchors only.
+var ALLOWED_URI_REGEXP = /^(?:(?:https?|mailto):|#)/i;
+var hooked = false;
+function ensureLinkHook() {
+  if (hooked || typeof DOMPurify.addHook !== "function") return;
+  DOMPurify.addHook("afterSanitizeAttributes", function (node) {
+    if (node.tagName === "A" && node.hasAttribute("href")) {
+      node.setAttribute("rel", "noopener noreferrer");
+      node.setAttribute("target", "_blank");
+    }
+  });
+  hooked = true;
+}
+
+/**
+ * @param {string} text Markdown (from a model, a tool, or a user)
+ * @returns {string} sanitized HTML
+ */
+function renderSafeMarkdown(text) {
+  if (!text) return "";
+  ensureLinkHook();
+  var html = marked(String(text), {
+    breaks: true
+  });
+  return DOMPurify.sanitize(html, {
+    USE_PROFILES: {
+      html: true
+    },
+    FORBID_TAGS: FORBID_TAGS,
+    FORBID_ATTR: FORBID_ATTR,
+    ALLOWED_URI_REGEXP: ALLOWED_URI_REGEXP
+  });
+}
+
 function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _createForOfIteratorHelper$4(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$4(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
@@ -69044,9 +69097,10 @@ function _arrayLikeToArray$4(r, a) { (null == a || a > r.length) && (a = r.lengt
 function AssistantTextContent(_ref) {
   var text = _ref.text;
   if (!text) return null;
-  var html = marked(text, {
-    breaks: true
-  });
+
+  // Sanitized: replies can quote untrusted content (emails, web pages), and
+  // this HTML is inserted into the app window.
+  var html = renderSafeMarkdown(text);
   return /*#__PURE__*/jsx("div", {
     className: "prose prose-invert prose-sm max-w-none prose-p:my-2 prose-headings:my-3 prose-ul:my-2 prose-ol:my-2 prose-li:my-0.5 prose-pre:bg-black/40 prose-pre:text-gray-300 prose-code:text-indigo-300 prose-a:text-indigo-400 leading-relaxed",
     dangerouslySetInnerHTML: {
@@ -71701,5 +71755,5 @@ function computeDashboardPreflight(_ref) {
 
 ComponentManager.registerContainerTypes(LayoutContainer, LayoutGridContainer);
 
-export { ALGOLIA_ANALYTICS_FOR_QUERY, ALGOLIA_ANALYTICS_FOR_QUERY_COMPLETE, ALGOLIA_ANALYTICS_FOR_QUERY_ERROR, ALGOLIA_LIST_INDICES, ALGOLIA_LIST_INDICES_COMPLETE, ALGOLIA_LIST_INDICES_ERROR, AVAILABLE_COLORS, AddMenuItemModal, AdvancedMcpConfig, AppContext, AppSettingsModal, AppThemeScope, AppWrapper, AskLead, BotEditorModal, CHOOSE_FILE, CHOOSE_FILE_COMPLETE, CHOOSE_FILE_ERROR, ChatCore, ChatInput, ChatMessages, ColorModel, ComponentConfigModel, ComponentManager, ContextModel, DATA_JSON_TO_CSV_FILE, DATA_JSON_TO_CSV_FILE_COMPLETE, DATA_JSON_TO_CSV_FILE_ERROR, DATA_JSON_TO_CSV_STRING, DATA_JSON_TO_CSV_STRING_COMPLETE, DATA_JSON_TO_CSV_STRING_ERROR, DATA_READ_FROM_FILE, DATA_READ_FROM_FILE_COMPLETE, DATA_READ_FROM_FILE_ERROR, DATA_SAVE_TO_FILE, DATA_SAVE_TO_FILE_COMPLETE, DATA_SAVE_TO_FILE_ERROR, DashCommandPalette, DashNavbar, DashSidebar, DashTabBar, DashboardStage as Dashboard, DashboardActionsApi, DashboardApi, DashboardContext, DashboardFooter, DashboardHeader, DashboardMenuItem, DashboardModel, DashboardMonitor, DashboardPublisher, DashboardStage, DashboardThemeProvider, DashboardWizardModal, DashboardWrapper, ElectronDashboardApi, ErrorBoundary, ExternalWidget, GRID_CELL_WIDGET_TYPE, HARMONY_STRATEGIES, LAYOUT_LIST, LAYOUT_LIST_COMPLETE, LAYOUT_LIST_ERROR, Layout, LayoutBuilder, LayoutBuilderAddItemModal, LayoutBuilderConfigContainerMenuItem, LayoutBuilderConfigMenuItem, LayoutBuilderConfigModal, LayoutBuilderEditItemModal, LayoutBuilderEventModal, LayoutBuilderGridItem, LayoutContainer, LayoutDragBuilder, LayoutDragBuilderEdit, LayoutGridContainer, LayoutManagerModal, LayoutModel, LayoutQuickAddMenu, MCP_AUTHORIZE_COMPLETE, MCP_AUTHORIZE_ERROR, MCP_CALL_TOOL_COMPLETE, MCP_CALL_TOOL_ERROR, MCP_GET_CATALOG_COMPLETE, MCP_GET_CATALOG_ERROR, MCP_LIST_RESOURCES_COMPLETE, MCP_LIST_RESOURCES_ERROR, MCP_LIST_TOOLS_COMPLETE, MCP_LIST_TOOLS_ERROR, MCP_READ_RESOURCE_COMPLETE, MCP_READ_RESOURCE_ERROR, MCP_RUN_AUTH_COMPLETE, MCP_RUN_AUTH_ERROR, MCP_SERVER_STATUS_COMPLETE, MCP_SERVER_STATUS_ERROR, MCP_START_SERVER_COMPLETE, MCP_START_SERVER_ERROR, MCP_STOP_SERVER_COMPLETE, MCP_STOP_SERVER_ERROR, MENU_ITEMS_DELETE, MENU_ITEMS_DELETE_COMPLETE, MENU_ITEMS_DELETE_ERROR, MENU_ITEMS_LIST, MENU_ITEMS_LIST_COMPLETE, MENU_ITEMS_LIST_ERROR, MENU_ITEMS_SAVE, MENU_ITEMS_SAVE_COMPLETE, MENU_ITEMS_SAVE_ERROR, MainMenu, MainMenuItem, MainMenuSection, MarkdownFormEditor, McpServerPicker, MenuItemModel, MenuSlideOverlay, MergeCellsModal, MessageBubble, MissingProviderPrompt, MockDashboardApi, PROVIDER_DELETE_COMPLETE, PROVIDER_DELETE_ERROR, PROVIDER_GET_COMPLETE, PROVIDER_GET_ERROR, PROVIDER_LIST_COMPLETE, PROVIDER_LIST_ERROR, PROVIDER_SAVE_COMPLETE, PROVIDER_SAVE_ERROR, PageTabBar, PanelCode, PanelEditItem, PanelEditItemHandlers, PanelEditItemNotifications, PanelEditItemProviders, PinnedSidebar, ProviderContext, ProviderErrorBoundary, ProviderForm, ProviderSelector, SECURE_STORAGE_ENCRYPT_STRING, SECURE_STORAGE_ENCRYPT_STRING_COMPLETE, SECURE_STORAGE_ENCRYPT_STRING_ERROR, SECURE_STORE_ENCRYPTION_CHECK, SECURE_STORE_ENCRYPTION_CHECK_COMPLETE, SECURE_STORE_ENCRYPTION_CHECK_ERROR, SECURE_STORE_GET_DATA, SECURE_STORE_GET_DATA_COMPLETE, SECURE_STORE_GET_DATA_ERROR, SECURE_STORE_SET_DATA, SECURE_STORE_SET_DATA_COMPLETE, SECURE_STORE_SET_DATA_ERROR, SETTINGS_GET, SETTINGS_GET_COMPLETE, SETTINGS_GET_ERROR, SETTINGS_SAVE, SETTINGS_SAVE_COMPLETE, SETTINGS_SAVE_ERROR, SIDEBAR_WIDGET_TYPE, SettingsModel, SideMenu, SplitCellModal, StreamingText, THEME_DELETE, THEME_DELETE_COMPLETE, THEME_DELETE_ERROR, THEME_EXTRACT_FROM_URL, THEME_EXTRACT_FROM_URL_COMPLETE, THEME_EXTRACT_FROM_URL_ERROR, THEME_LIST, THEME_LIST_COMPLETE, THEME_LIST_ERROR, THEME_MAP_PALETTE, THEME_MAP_PALETTE_COMPLETE, THEME_MAP_PALETTE_ERROR, THEME_SAVE, THEME_SAVE_COMPLETE, THEME_SAVE_ERROR, TeamLeadSection, ThemeApi, ThemeColorDots, ThemeManagerModal, ThemeModel, ThemeWrapper, ToolCallBlock, ToolSelector, WELCOME_STORAGE_KEY, WORKSPACE_DELETE, WORKSPACE_DELETE_COMPLETE, WORKSPACE_DELETE_ERROR, WORKSPACE_LIST, WORKSPACE_LIST_COMPLETE, WORKSPACE_LIST_ERROR, WORKSPACE_SAVE, WORKSPACE_SAVE_COMPLETE, WORKSPACE_SAVE_ERROR, WebDashboardApi, WelcomePrompt, Widget, WidgetApi, WidgetConfigPanel, WidgetContext, WidgetFactory, WidgetNotFound, WidgetPopoutStage, WidgetProviderWrapper, WidgetSidebar, WizardCustomizeStep, WizardDiscoverStep, Workspace, WorkspaceContext, WorkspaceFooter, WorkspaceMenu, WorkspaceModel, WorkspaceScopeContext, addChildToLayoutItem, addItemToItemLayout, bareComponentName, buildMcpConfigFromOverrides, canHaveChildren, changeDirectionForLayoutItem, computeDashboardPreflight, createProviderRegistry, dashboardOptions, deriveFormFields, envMappingToRows, evaluateBundle, extractWidgetConfigs, formStateToMcpJson, formatFieldName, generateCustomTheme, generateHarmonyTheme, generateRandomHexTheme, generateRandomTheme, generateThemeName, getBorderStyle, getBrandPresets, getChildrenForLayoutItem, getComponentInLayout, getContainerBorderColor, getContainerColor, getIndexOfLayoutChildrenForItem, getIndexOfLayoutItem, getLayoutItemById, getLayoutItemForWorkspace, getNearestParentWorkspace, getNextHighestId, getNextHighestItemInLayout, getNextHighestOrder, getNextHighestParentId, getNextLowestItemInLayout, getParentForLayoutItem, getParentWorkspaceForItem, getThemePresets, getUserConfigurableProviders, getWidgetsForWorkspace, getWorkspacesForWorkspace, groupBotsByTeam, headerTemplateToRows, humanizeAction, isContainer, isLikelySecret, isMaxOrderForItem, isMinOrderForItem, isScopedComponentId, isWidget, isWidgetResolvable, isWorkspace, layoutItemHasWorkspaceAsChild, loadWidgetBundle, makeScopedComponentId, mcpJsonToFormState, moveWidgetAcrossContainers, numChildrenForLayout, offTeamSubscriptions, parse, parseScopedComponentId, removeItemFromLayout, renderComponent, renderGridLayout, renderGridLayoutFlow, _renderLayout as renderLayout, renderLayoutMenu, replaceItemInLayout, resolveGateWidgetId, resolveIcon, sameWorkspace, serialize, setHostModules, traverseParentTree, triggerSummary, updateLayoutItem, updateParentForItem, useDashboard, useMcpDashServer, useMcpProvider, useNotifications, useProvider, useProviderClient, useScheduler, useWebSocketProvider, useWidgetEvents, useWidgetProviders, useWidgetRegistryVersion, useWidgetSchedulerStatus, useWizardState, validateCellMerge, validateGridCell, validateGridPlacement, validateWidgetPlacement, widgetCountToTemplate, withProviderDetection };
+export { ALGOLIA_ANALYTICS_FOR_QUERY, ALGOLIA_ANALYTICS_FOR_QUERY_COMPLETE, ALGOLIA_ANALYTICS_FOR_QUERY_ERROR, ALGOLIA_LIST_INDICES, ALGOLIA_LIST_INDICES_COMPLETE, ALGOLIA_LIST_INDICES_ERROR, AVAILABLE_COLORS, AddMenuItemModal, AdvancedMcpConfig, AppContext, AppSettingsModal, AppThemeScope, AppWrapper, AskLead, BotEditorModal, CHOOSE_FILE, CHOOSE_FILE_COMPLETE, CHOOSE_FILE_ERROR, ChatCore, ChatInput, ChatMessages, ColorModel, ComponentConfigModel, ComponentManager, ContextModel, DATA_JSON_TO_CSV_FILE, DATA_JSON_TO_CSV_FILE_COMPLETE, DATA_JSON_TO_CSV_FILE_ERROR, DATA_JSON_TO_CSV_STRING, DATA_JSON_TO_CSV_STRING_COMPLETE, DATA_JSON_TO_CSV_STRING_ERROR, DATA_READ_FROM_FILE, DATA_READ_FROM_FILE_COMPLETE, DATA_READ_FROM_FILE_ERROR, DATA_SAVE_TO_FILE, DATA_SAVE_TO_FILE_COMPLETE, DATA_SAVE_TO_FILE_ERROR, DashCommandPalette, DashNavbar, DashSidebar, DashTabBar, DashboardStage as Dashboard, DashboardActionsApi, DashboardApi, DashboardContext, DashboardFooter, DashboardHeader, DashboardMenuItem, DashboardModel, DashboardMonitor, DashboardPublisher, DashboardStage, DashboardThemeProvider, DashboardWizardModal, DashboardWrapper, ElectronDashboardApi, ErrorBoundary, ExternalWidget, GRID_CELL_WIDGET_TYPE, HARMONY_STRATEGIES, LAYOUT_LIST, LAYOUT_LIST_COMPLETE, LAYOUT_LIST_ERROR, Layout, LayoutBuilder, LayoutBuilderAddItemModal, LayoutBuilderConfigContainerMenuItem, LayoutBuilderConfigMenuItem, LayoutBuilderConfigModal, LayoutBuilderEditItemModal, LayoutBuilderEventModal, LayoutBuilderGridItem, LayoutContainer, LayoutDragBuilder, LayoutDragBuilderEdit, LayoutGridContainer, LayoutManagerModal, LayoutModel, LayoutQuickAddMenu, MCP_AUTHORIZE_COMPLETE, MCP_AUTHORIZE_ERROR, MCP_CALL_TOOL_COMPLETE, MCP_CALL_TOOL_ERROR, MCP_GET_CATALOG_COMPLETE, MCP_GET_CATALOG_ERROR, MCP_LIST_RESOURCES_COMPLETE, MCP_LIST_RESOURCES_ERROR, MCP_LIST_TOOLS_COMPLETE, MCP_LIST_TOOLS_ERROR, MCP_READ_RESOURCE_COMPLETE, MCP_READ_RESOURCE_ERROR, MCP_RUN_AUTH_COMPLETE, MCP_RUN_AUTH_ERROR, MCP_SERVER_STATUS_COMPLETE, MCP_SERVER_STATUS_ERROR, MCP_START_SERVER_COMPLETE, MCP_START_SERVER_ERROR, MCP_STOP_SERVER_COMPLETE, MCP_STOP_SERVER_ERROR, MENU_ITEMS_DELETE, MENU_ITEMS_DELETE_COMPLETE, MENU_ITEMS_DELETE_ERROR, MENU_ITEMS_LIST, MENU_ITEMS_LIST_COMPLETE, MENU_ITEMS_LIST_ERROR, MENU_ITEMS_SAVE, MENU_ITEMS_SAVE_COMPLETE, MENU_ITEMS_SAVE_ERROR, MainMenu, MainMenuItem, MainMenuSection, MarkdownFormEditor, McpServerPicker, MenuItemModel, MenuSlideOverlay, MergeCellsModal, MessageBubble, MissingProviderPrompt, MockDashboardApi, PROVIDER_DELETE_COMPLETE, PROVIDER_DELETE_ERROR, PROVIDER_GET_COMPLETE, PROVIDER_GET_ERROR, PROVIDER_LIST_COMPLETE, PROVIDER_LIST_ERROR, PROVIDER_SAVE_COMPLETE, PROVIDER_SAVE_ERROR, PageTabBar, PanelCode, PanelEditItem, PanelEditItemHandlers, PanelEditItemNotifications, PanelEditItemProviders, PinnedSidebar, ProviderContext, ProviderErrorBoundary, ProviderForm, ProviderSelector, SECURE_STORAGE_ENCRYPT_STRING, SECURE_STORAGE_ENCRYPT_STRING_COMPLETE, SECURE_STORAGE_ENCRYPT_STRING_ERROR, SECURE_STORE_ENCRYPTION_CHECK, SECURE_STORE_ENCRYPTION_CHECK_COMPLETE, SECURE_STORE_ENCRYPTION_CHECK_ERROR, SECURE_STORE_GET_DATA, SECURE_STORE_GET_DATA_COMPLETE, SECURE_STORE_GET_DATA_ERROR, SECURE_STORE_SET_DATA, SECURE_STORE_SET_DATA_COMPLETE, SECURE_STORE_SET_DATA_ERROR, SETTINGS_GET, SETTINGS_GET_COMPLETE, SETTINGS_GET_ERROR, SETTINGS_SAVE, SETTINGS_SAVE_COMPLETE, SETTINGS_SAVE_ERROR, SIDEBAR_WIDGET_TYPE, SettingsModel, SideMenu, SplitCellModal, StreamingText, THEME_DELETE, THEME_DELETE_COMPLETE, THEME_DELETE_ERROR, THEME_EXTRACT_FROM_URL, THEME_EXTRACT_FROM_URL_COMPLETE, THEME_EXTRACT_FROM_URL_ERROR, THEME_LIST, THEME_LIST_COMPLETE, THEME_LIST_ERROR, THEME_MAP_PALETTE, THEME_MAP_PALETTE_COMPLETE, THEME_MAP_PALETTE_ERROR, THEME_SAVE, THEME_SAVE_COMPLETE, THEME_SAVE_ERROR, TeamLeadSection, ThemeApi, ThemeColorDots, ThemeManagerModal, ThemeModel, ThemeWrapper, ToolCallBlock, ToolSelector, WELCOME_STORAGE_KEY, WORKSPACE_DELETE, WORKSPACE_DELETE_COMPLETE, WORKSPACE_DELETE_ERROR, WORKSPACE_LIST, WORKSPACE_LIST_COMPLETE, WORKSPACE_LIST_ERROR, WORKSPACE_SAVE, WORKSPACE_SAVE_COMPLETE, WORKSPACE_SAVE_ERROR, WebDashboardApi, WelcomePrompt, Widget, WidgetApi, WidgetConfigPanel, WidgetContext, WidgetFactory, WidgetNotFound, WidgetPopoutStage, WidgetProviderWrapper, WidgetSidebar, WizardCustomizeStep, WizardDiscoverStep, Workspace, WorkspaceContext, WorkspaceFooter, WorkspaceMenu, WorkspaceModel, WorkspaceScopeContext, addChildToLayoutItem, addItemToItemLayout, bareComponentName, buildMcpConfigFromOverrides, canHaveChildren, changeDirectionForLayoutItem, computeDashboardPreflight, createProviderRegistry, dashboardOptions, deriveFormFields, envMappingToRows, evaluateBundle, extractWidgetConfigs, formStateToMcpJson, formatFieldName, generateCustomTheme, generateHarmonyTheme, generateRandomHexTheme, generateRandomTheme, generateThemeName, getBorderStyle, getBrandPresets, getChildrenForLayoutItem, getComponentInLayout, getContainerBorderColor, getContainerColor, getIndexOfLayoutChildrenForItem, getIndexOfLayoutItem, getLayoutItemById, getLayoutItemForWorkspace, getNearestParentWorkspace, getNextHighestId, getNextHighestItemInLayout, getNextHighestOrder, getNextHighestParentId, getNextLowestItemInLayout, getParentForLayoutItem, getParentWorkspaceForItem, getThemePresets, getUserConfigurableProviders, getWidgetsForWorkspace, getWorkspacesForWorkspace, groupBotsByTeam, headerTemplateToRows, humanizeAction, isContainer, isLikelySecret, isMaxOrderForItem, isMinOrderForItem, isScopedComponentId, isWidget, isWidgetResolvable, isWorkspace, layoutItemHasWorkspaceAsChild, loadWidgetBundle, makeScopedComponentId, mcpJsonToFormState, moveWidgetAcrossContainers, numChildrenForLayout, offTeamSubscriptions, parse, parseScopedComponentId, removeItemFromLayout, renderComponent, renderGridLayout, renderGridLayoutFlow, _renderLayout as renderLayout, renderLayoutMenu, renderSafeMarkdown, replaceItemInLayout, resolveGateWidgetId, resolveIcon, sameWorkspace, serialize, setHostModules, traverseParentTree, triggerSummary, updateLayoutItem, updateParentForItem, useDashboard, useMcpDashServer, useMcpProvider, useNotifications, useProvider, useProviderClient, useScheduler, useWebSocketProvider, useWidgetEvents, useWidgetProviders, useWidgetRegistryVersion, useWidgetSchedulerStatus, useWizardState, validateCellMerge, validateGridCell, validateGridPlacement, validateWidgetPlacement, widgetCountToTemplate, withProviderDetection };
 //# sourceMappingURL=index.esm.js.map