anentrypoint-design 0.0.215 → 0.0.217

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anentrypoint-design",
-  "version": "0.0.215",
+  "version": "0.0.217",
   "description": "247420 design system SDK — webjsx + modified ripple-ui, single-file ESM bundle for reproducible use of the AnEntrypoint design.",
   "type": "module",
   "main": "./dist/247420.js",

package/src/components/agent-chat.js

@@ -182,7 +182,9 @@ export function AgentChat(props = {}) {
   // string OR at least one part. Used for the empty-shell skip + working tail
   // so an interleaved turn (parts-only, no m.content) is not treated as empty.
   const msgHasBody = (m) => !!(m.content || (Array.isArray(m.parts) && m.parts.length));
-  const showWorkingTail = busy && lastMsg && lastMsg.role === 'assistant' && msgHasBody(lastMsg);
+  const lastMsgLastPart = lastMsg && Array.isArray(lastMsg.parts) && lastMsg.parts.length ? lastMsg.parts[lastMsg.parts.length - 1] : null;
+  const showWorkingTail = busy && lastMsg && lastMsg.role === 'assistant' && msgHasBody(lastMsg)
+    && lastMsgLastPart && lastMsgLastPart.kind === 'tool' && lastMsgLastPart.status === 'running';
   const rows = messages.slice(msgStart).map((m, wi) => {
     const i = wi + msgStart; // absolute index — streaming/caret/actions logic keys off the real lastIdx
     const isAssistant = m.role === 'assistant';

package/src/components/shell.js

@@ -411,6 +411,7 @@ function toggleWsDrawer(which, open) {
         const focusable = drawer && drawer.querySelector('button, a, input, [tabindex]');
         if (focusable) try { focusable.focus(); } catch (_) {}
         const onKey = (e) => { if (e.key === 'Escape') { toggleWsDrawer(which, false); document.removeEventListener('keydown', onKey); if (btn) try { btn.focus(); } catch (_) {} } };
+        shell._wsEscHandler = onKey;
         document.addEventListener('keydown', onKey);
     }
 }
@@ -419,6 +420,8 @@ function closeWsDrawers() {
     if (!shell) return;
     shell.classList.remove('ws-sessions-open', 'ws-pane-open');
     document.querySelectorAll('.ws-sessions-drawer-toggle, .ws-pane-drawer-toggle').forEach((b) => b.setAttribute('aria-expanded', 'false'));
+    // Remove Esc handler armed by toggleWsDrawer to prevent ghost close on next Esc.
+    if (shell._wsEscHandler) { document.removeEventListener('keydown', shell._wsEscHandler); shell._wsEscHandler = null; }
 }
 
 // Read persisted collapse state for a WorkspaceShell column so the layout is
@@ -464,6 +467,7 @@ export function WorkspaceShell({ rail, sessions, main, pane, crumb, status, narr
     const keepPaneTrack = stableFrame && !hasPane;
     const railIsCollapsed = wsCollapsed('rail', railCollapsed);
     const paneIsCollapsed = hasPane ? wsCollapsed('pane', paneCollapsed) : true;
+    const sessionsIsCollapsed = wsCollapsed('sessions', false);
     const shellCls = 'ws-shell'
         + (railIsCollapsed ? ' ws-rail-collapsed' : '')
         + ((hasPane || keepPaneTrack) ? '' : ' ws-no-pane')
@@ -492,7 +496,7 @@ export function WorkspaceShell({ rail, sessions, main, pane, crumb, status, narr
         // (any button click inside) auto-closes it, mirroring AppShell.
         hasSessions
             ? h('div', { class: 'ws-sessions', role: 'complementary', 'aria-label': 'conversations',
-                onclick: (e) => { if (narrow && e.target.closest('button, a, [role="button"]')) closeWsDrawers(); } }, sessions)
+                onclick: (e) => { if (window.innerWidth <= 1100 && e.target.closest('button, a, [role="button"]')) closeWsDrawers(); } }, sessions)
             : null,
         // Primary content column, with an optional thin crumb bar on top. On
         // mobile the crumb hosts the drawer toggles (sessions on the left, pane
@@ -510,8 +514,9 @@ export function WorkspaceShell({ rail, sessions, main, pane, crumb, status, narr
                     // full-width thread/grid). Hidden on mobile via CSS.
                     hasSessions ? h('button', {
                         class: 'ws-desktop-toggle ws-sessions-toggle', type: 'button',
-                        'aria-label': 'collapse conversations', title: 'collapse conversations',
-                        'aria-expanded': 'true', onclick: () => toggleWs('sessions'),
+                        'aria-label': sessionsIsCollapsed ? 'expand conversations' : 'collapse conversations',
+                        title: sessionsIsCollapsed ? 'expand conversations' : 'collapse conversations',
+                        'aria-expanded': sessionsIsCollapsed ? 'false' : 'true', onclick: () => toggleWs('sessions'),
                     }, Icon('chevron-left')) : null,
                     h('div', { class: 'ws-crumb-main' }, crumb),
                     // Desktop-only context-pane collapse, on the same crumb-level

package/src/highlight.js

@@ -1,40 +1,35 @@
 // Syntax highlighting — lazy-loads Prism + common language grammars on first call. No-op safe.
+// Grammars are injected as <script src="..."> so the browser's CSP allowlist
+// (cdn.jsdelivr.net) covers them without needing 'unsafe-eval'. Prism core
+// must finish before grammars; grammars within each tier are parallel.
 
 let _prism = null;
 let _ready = null;
 
 const PRISM_BASE = 'https://cdn.jsdelivr.net/npm/prismjs@1.30.0/components/';
 const PRISM_CORE = PRISM_BASE + 'prism-core.min.js';
-const PRISM_LANGS = [
-    'prism-markup.min.js',
-    'prism-css.min.js',
-    'prism-clike.min.js',
-    'prism-javascript.min.js',
-    'prism-typescript.min.js',
-    'prism-json.min.js',
-    'prism-bash.min.js',
-    'prism-yaml.min.js',
-    'prism-markdown.min.js',
-    'prism-python.min.js',
-    'prism-rust.min.js',
-    'prism-go.min.js',
-    'prism-jsx.min.js',
-    'prism-tsx.min.js',
-    'prism-diff.min.js',
-    'prism-sql.min.js',
-    'prism-toml.min.js',
+// Dependency tiers: each tier loads in parallel; the next tier waits for the previous.
+// (clike must precede javascript; javascript must precede typescript/jsx/tsx.)
+const PRISM_TIERS = [
+    ['prism-markup.min.js', 'prism-css.min.js', 'prism-clike.min.js'],
+    ['prism-javascript.min.js', 'prism-json.min.js', 'prism-bash.min.js', 'prism-yaml.min.js',
+     'prism-markdown.min.js', 'prism-python.min.js', 'prism-rust.min.js', 'prism-go.min.js',
+     'prism-diff.min.js', 'prism-sql.min.js', 'prism-toml.min.js'],
+    ['prism-typescript.min.js', 'prism-jsx.min.js'],
+    ['prism-tsx.min.js'],
 ];
 
-async function loadIntoGlobal(url) {
-    try {
-        const res = await fetch(url);
-        if (!res.ok) throw new Error('http ' + res.status);
-        const code = await res.text();
-        // eslint-disable-next-line no-new-func
-        new Function('window', code)(window);
-    } catch (err) {
-        console.warn('[247420] prism part failed:', url, err.message);
-    }
+function loadScript(url) {
+    return new Promise((resolve) => {
+        const existing = document.querySelector('script[src="' + url + '"]');
+        if (existing) { resolve(); return; }
+        const s = document.createElement('script');
+        s.src = url;
+        s.crossOrigin = 'anonymous';
+        s.onload = resolve;
+        s.onerror = () => { console.warn('[247420] prism part failed:', url); resolve(); };
+        document.head.appendChild(s);
+    });
 }
 
 export async function ensurePrism() {
@@ -42,11 +37,11 @@ export async function ensurePrism() {
     if (_ready) return _ready;
     _ready = (async () => {
         try {
-            await loadIntoGlobal(PRISM_CORE);
+            await loadScript(PRISM_CORE);
             _prism = window.Prism || null;
             if (_prism) {
-                for (const f of PRISM_LANGS) {
-                    await loadIntoGlobal(PRISM_BASE + f);
+                for (const tier of PRISM_TIERS) {
+                    await Promise.all(tier.map(f => loadScript(PRISM_BASE + f)));
                 }
             }
             return _prism;

package/src/markdown.js

@@ -10,8 +10,12 @@ let _purify = null;
 let _failedAt = 0;
 const RETRY_BACKOFF_MS = 30000;
 
-const MARKED_URL = 'https://cdn.jsdelivr.net/npm/marked@15/+esm';
-const PURIFY_URL = 'https://cdn.jsdelivr.net/npm/dompurify@3/+esm';
+// Pin to exact semver so the CDN cannot silently swap code under us.
+// SRI cannot be applied to dynamic ESM imports in browsers (no importmap
+// integrity support at design time); pinning the version is the best available
+// mitigation for CDN-supply-chain risk on these two dependencies.
+const MARKED_URL = 'https://cdn.jsdelivr.net/npm/marked@15.0.12/+esm';
+const PURIFY_URL = 'https://cdn.jsdelivr.net/npm/dompurify@3.2.6/+esm';
 
 // True while the markdown stack is unavailable (escaped-fallback rendering).
 // Consumers (markdown-cache) use this to avoid caching degraded output.
@@ -50,7 +54,7 @@ export async function renderMarkdown(src) {
     const ok = await ensureReady();
     if (!ok) return escapeHtml(src).replace(/\n/g, '<br>');
     const raw = _marked.parse(String(src));
-    return _purify.sanitize(raw);
+    return _purify.sanitize(raw, { FORCE_BODY: true });
 }
 
 // Sanitize already-rendered HTML before it touches innerHTML. For any surface
@@ -60,5 +64,5 @@ export async function renderMarkdown(src) {
 export async function sanitizeHtml(html) {
     const ok = await ensureReady();
     if (!ok) return escapeHtml(html);
-    return _purify.sanitize(String(html));
+    return _purify.sanitize(String(html), { FORCE_BODY: true });
 }