@trops/dash-core 0.1.645 → 0.1.647

package/dist/index.js

@@ -28,6 +28,7 @@ var reactInstantsearchHooksWeb = require('react-instantsearch-hooks-web');
 var ReactDOM = require('react-dom');
 var reactRouterDom = require('react-router-dom');
 var marked = require('marked');
+var DOMPurify = require('dompurify');
 var PropTypes = require('prop-types');
 
 function _interopNamespaceDefault(e) {
@@ -69054,6 +69055,58 @@ var ToolCallBlock = function ToolCallBlock(_ref) {
   });
 };
 
+/**
+ * safeMarkdown.js
+ *
+ * Markdown → HTML that is safe to insert with dangerouslySetInnerHTML.
+ *
+ * AI replies are Markdown, and they can quote untrusted content (emails, web
+ * pages, tool results). `marked` passes raw HTML through untouched, so a reply
+ * containing `<img onerror=…>` or `<script>` would run in the app window —
+ * which can reach window.mainApi. Every Markdown render of model or tool text
+ * goes through here: `marked`, then DOMPurify.
+ *
+ * Kept: normal formatting (headings, emphasis, lists, code, tables, links).
+ * Removed: scripts, event-handler attributes, javascript:/data: URLs,
+ * iframes/objects/embeds/forms/styles, and inline style. Links get
+ * rel="noopener noreferrer" (the app also blocks in-window navigation).
+ */
+var FORBID_TAGS = ["style", "iframe", "object", "embed", "form", "input", "button", "textarea", "select", "link", "meta", "base"];
+var FORBID_ATTR = ["style"];
+// http(s), mailto, and in-page anchors only.
+var ALLOWED_URI_REGEXP = /^(?:(?:https?|mailto):|#)/i;
+var hooked = false;
+function ensureLinkHook() {
+  if (hooked || typeof DOMPurify.addHook !== "function") return;
+  DOMPurify.addHook("afterSanitizeAttributes", function (node) {
+    if (node.tagName === "A" && node.hasAttribute("href")) {
+      node.setAttribute("rel", "noopener noreferrer");
+      node.setAttribute("target", "_blank");
+    }
+  });
+  hooked = true;
+}
+
+/**
+ * @param {string} text Markdown (from a model, a tool, or a user)
+ * @returns {string} sanitized HTML
+ */
+function renderSafeMarkdown(text) {
+  if (!text) return "";
+  ensureLinkHook();
+  var html = marked.marked(String(text), {
+    breaks: true
+  });
+  return DOMPurify.sanitize(html, {
+    USE_PROFILES: {
+      html: true
+    },
+    FORBID_TAGS: FORBID_TAGS,
+    FORBID_ATTR: FORBID_ATTR,
+    ALLOWED_URI_REGEXP: ALLOWED_URI_REGEXP
+  });
+}
+
 function ownKeys$3(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread$3(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys$3(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys$3(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _createForOfIteratorHelper$4(r, e) { var t = "undefined" != typeof Symbol && r[Symbol.iterator] || r["@@iterator"]; if (!t) { if (Array.isArray(r) || (t = _unsupportedIterableToArray$4(r)) || e && r && "number" == typeof r.length) { t && (r = t); var _n = 0, F = function F() {}; return { s: F, n: function n() { return _n >= r.length ? { done: !0 } : { done: !1, value: r[_n++] }; }, e: function e(r) { throw r; }, f: F }; } throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method."); } var o, a = !0, u = !1; return { s: function s() { t = t.call(r); }, n: function n() { var r = t.next(); return a = r.done, r; }, e: function e(r) { u = !0, o = r; }, f: function f() { try { a || null == t["return"] || t["return"](); } finally { if (u) throw o; } } }; }
@@ -69062,9 +69115,10 @@ function _arrayLikeToArray$4(r, a) { (null == a || a > r.length) && (a = r.lengt
 function AssistantTextContent(_ref) {
   var text = _ref.text;
   if (!text) return null;
-  var html = marked.marked(text, {
-    breaks: true
-  });
+
+  // Sanitized: replies can quote untrusted content (emails, web pages), and
+  // this HTML is inserted into the app window.
+  var html = renderSafeMarkdown(text);
   return /*#__PURE__*/jsxRuntime.jsx("div", {
     className: "prose prose-invert prose-sm max-w-none prose-p:my-2 prose-headings:my-3 prose-ul:my-2 prose-ol:my-2 prose-li:my-0.5 prose-pre:bg-black/40 prose-pre:text-gray-300 prose-code:text-indigo-300 prose-a:text-indigo-400 leading-relaxed",
     dangerouslySetInnerHTML: {
@@ -70943,6 +70997,165 @@ function MarkdownFormEditor(_ref8) {
   });
 }
 
+/**
+ * botConversation.js
+ *
+ * Pure helpers for the Bots view (bot-teams PRD TEAM-011): turn a bot's run
+ * records into chat turns, and work out each bot's status and how many things
+ * on a team need the user.
+ *
+ * A run record (BotRunner) carries: trigger, status, startedAt/endedAt,
+ * prompt, output (the answer), toolCalls [{ tool, provider, ok }], continued
+ * (a reply in the same session), error, outputUnavailable.
+ *
+ * Turn kinds: "user" (what was asked), "system" (what started a run that
+ * nobody typed), "tools" (tool-call rows), "bot" (the answer), "error",
+ * "divider" (a new conversation started).
+ */
+
+function startedBy(r) {
+  if (r.trigger === "schedule") return "Scheduled run";
+  if (r.trigger === "event") return "Triggered by an event";
+  return null;
+}
+function turnsForRun(r) {
+  var _ref = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {},
+    _ref$pending = _ref.pending,
+    pending = _ref$pending === void 0 ? false : _ref$pending;
+  var turns = [];
+  var at = r.startedAt || r.at || null;
+  var label = startedBy(r);
+  if (label) {
+    // Event prompts are machine-written (and fence untrusted payloads) — show
+    // what started the run, not the raw prompt.
+    turns.push({
+      kind: "system",
+      text: label,
+      at: at
+    });
+  } else if (r.prompt) {
+    // Typed by the user: a manual run, a reply, or a question to the lead.
+    turns.push({
+      kind: "user",
+      text: r.prompt,
+      at: at
+    });
+  }
+  if (Array.isArray(r.toolCalls) && r.toolCalls.length) {
+    turns.push({
+      kind: "tools",
+      calls: r.toolCalls,
+      at: at
+    });
+  }
+  if (r.status === "failed" && r.error) {
+    turns.push({
+      kind: "error",
+      text: r.error,
+      at: r.endedAt || at
+    });
+  }
+  if (r.outputUnavailable) {
+    turns.push({
+      kind: "bot",
+      unavailable: true,
+      text: "",
+      at: r.endedAt || at
+    });
+  } else if (r.output || pending) {
+    turns.push({
+      kind: "bot",
+      text: r.output || r.text || "",
+      pending: pending,
+      at: r.endedAt || at
+    });
+  }
+  return turns;
+}
+
+/**
+ * @param {object[]} runs  oldest first
+ * @param {{ live?: { prompt?, text?, toolCalls?, continued? } }} [opts]
+ *        the run in progress, if any
+ * @returns {object[]} turns
+ */
+function buildConversation(runs) {
+  var _ref2 = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {},
+    _ref2$live = _ref2.live,
+    live = _ref2$live === void 0 ? null : _ref2$live;
+  var list = Array.isArray(runs) ? runs.filter(Boolean) : [];
+  var turns = [];
+  list.forEach(function (r, i) {
+    if (i > 0 && !r.continued) {
+      turns.push({
+        kind: "divider",
+        text: "New conversation",
+        at: r.startedAt || r.at || null
+      });
+    }
+    turns.push.apply(turns, _toConsumableArray(turnsForRun(r)));
+  });
+  if (live) {
+    if (list.length && !live.continued) {
+      turns.push({
+        kind: "divider",
+        text: "New conversation",
+        at: null
+      });
+    }
+    turns.push.apply(turns, _toConsumableArray(turnsForRun({
+      trigger: live.trigger || "manual",
+      prompt: live.prompt || "",
+      toolCalls: live.toolCalls || [],
+      text: live.text || ""
+    }, {
+      pending: true
+    })));
+  }
+  return turns;
+}
+
+/**
+ * One bot's status. Needs approval > Running > Paused > Failed (its last run)
+ * > Idle.
+ */
+function botStatus(_ref3) {
+  var botId = _ref3.botId,
+    running = _ref3.running,
+    paused = _ref3.paused,
+    approvals = _ref3.approvals,
+    lastRun = _ref3.lastRun;
+  if ((approvals || []).some(function (a) {
+    return a && a.request && a.request.botId === botId;
+  })) {
+    return "Needs approval";
+  }
+  if ((running || []).includes(botId)) return "Running";
+  if (paused && (paused.global || (paused.bots || []).includes(botId))) {
+    return "Paused";
+  }
+  if (lastRun && lastRun.status === "failed") return "Failed";
+  return "Idle";
+}
+
+/**
+ * The Bots switch badge: the team's pending approvals plus bots whose last
+ * run failed.
+ */
+function attentionCount(_ref4) {
+  var botIds = _ref4.botIds,
+    approvals = _ref4.approvals,
+    lastRunByBot = _ref4.lastRunByBot;
+  var ids = new Set(botIds || []);
+  var pending = (approvals || []).filter(function (a) {
+    return a && a.request && ids.has(a.request.botId);
+  }).length;
+  var failed = _toConsumableArray(ids).filter(function (id) {
+    return lastRunByBot && lastRunByBot[id] && lastRunByBot[id].status === "failed";
+  }).length;
+  return pending + failed;
+}
+
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 
@@ -71942,7 +72155,10 @@ exports.WorkspaceModel = WorkspaceModel;
 exports.WorkspaceScopeContext = WorkspaceScopeContext;
 exports.addChildToLayoutItem = addChildToLayoutItem;
 exports.addItemToItemLayout = addItemToItemLayout;
+exports.attentionCount = attentionCount;
 exports.bareComponentName = bareComponentName;
+exports.botStatus = botStatus;
+exports.buildConversation = buildConversation;
 exports.buildMcpConfigFromOverrides = buildMcpConfigFromOverrides;
 exports.canHaveChildren = canHaveChildren;
 exports.changeDirectionForLayoutItem = changeDirectionForLayoutItem;
@@ -72008,6 +72224,7 @@ exports.renderGridLayout = renderGridLayout;
 exports.renderGridLayoutFlow = renderGridLayoutFlow;
 exports.renderLayout = _renderLayout;
 exports.renderLayoutMenu = renderLayoutMenu;
+exports.renderSafeMarkdown = renderSafeMarkdown;
 exports.replaceItemInLayout = replaceItemInLayout;
 exports.resolveGateWidgetId = resolveGateWidgetId;
 exports.resolveIcon = resolveIcon;