anentrypoint-design 0.0.216 → 0.0.218

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anentrypoint-design",
-  "version": "0.0.216",
+  "version": "0.0.218",
   "description": "247420 design system SDK — webjsx + modified ripple-ui, single-file ESM bundle for reproducible use of the AnEntrypoint design.",
   "type": "module",
   "main": "./dist/247420.js",

package/src/components/agent-chat.js

@@ -184,7 +184,7 @@ export function AgentChat(props = {}) {
   const msgHasBody = (m) => !!(m.content || (Array.isArray(m.parts) && m.parts.length));
   const lastMsgLastPart = lastMsg && Array.isArray(lastMsg.parts) && lastMsg.parts.length ? lastMsg.parts[lastMsg.parts.length - 1] : null;
   const showWorkingTail = busy && lastMsg && lastMsg.role === 'assistant' && msgHasBody(lastMsg)
-    && lastMsgLastPart && lastMsgLastPart.kind === 'tool' && (lastMsgLastPart.status === 'done' || lastMsgLastPart.status === 'error');
+    && lastMsgLastPart && lastMsgLastPart.kind === 'tool' && lastMsgLastPart.status === 'running';
   const rows = messages.slice(msgStart).map((m, wi) => {
     const i = wi + msgStart; // absolute index — streaming/caret/actions logic keys off the real lastIdx
     const isAssistant = m.role === 'assistant';

package/src/components/shell.js

@@ -164,27 +164,38 @@ const ICON_PATHS = {
 // rather than an h() vnode. Same path table, same viewBox/stroke contract as
 // Icon(); use innerHTML = iconMarkup(name). Keeps the icon paths upstream so
 // raw-DOM call sites never reintroduce decorative glyph literals.
-export function iconMarkup(name, { size = 16 } = {}) {
-    // Accept the props-object shape too - every sibling component takes a
-    // single object, so Icon({name}) is what the barrel trains consumers to try.
+// The single SVG attribute contract (viewBox/stroke/linecap…) shared by both
+// the markup-string and the vnode renderers below, so the icon shape is defined
+// once. Insertion order is the serialized attribute order iconMarkup emits.
+function iconAttrs(name, size) {
+    return {
+        class: 'ds-icon ds-icon-' + name,
+        width: String(size), height: String(size), viewBox: '0 0 24 24',
+        fill: 'none', stroke: 'currentColor', 'stroke-width': 'var(--ds-icon-stroke, 1.6)',
+        'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'aria-hidden': 'true',
+    };
+}
+// Normalize the (name) | ({name,size}) call shapes both renderers accept.
+function iconArgs(name, size) {
     if (name && typeof name === 'object') ({ name, size = 16 } = name);
+    return { name, size };
+}
+// Raw-DOM consumers (no webjsx render in scope) need the SVG as a markup string
+// rather than an h() vnode. Same path table + attr contract as Icon(); use
+// innerHTML = iconMarkup(name). Keeps the icon paths upstream so raw-DOM call
+// sites never reintroduce decorative glyph literals.
+export function iconMarkup(name, { size = 16 } = {}) {
+    ({ name, size } = iconArgs(name, size));
     const inner = ICON_PATHS[name];
     if (!inner) return '';
-    return '<svg class="ds-icon ds-icon-' + name + '" width="' + size + '" height="' + size +
-        '" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="var(--ds-icon-stroke, 1.6)"' +
-        ' stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">' + inner + '</svg>';
+    const attrs = Object.entries(iconAttrs(name, size)).map(([k, v]) => `${k}="${v}"`).join(' ');
+    return `<svg ${attrs}>${inner}</svg>`;
 }
 export function Icon(name, { size = 16 } = {}) {
-    if (name && typeof name === 'object') ({ name, size = 16 } = name);
+    ({ name, size } = iconArgs(name, size));
     const inner = ICON_PATHS[name];
     if (!inner) return h('span', { class: 'glyph', 'aria-hidden': 'true' }, '');
-    return h('svg', {
-        class: 'ds-icon ds-icon-' + name,
-        width: String(size), height: String(size), viewBox: '0 0 24 24',
-        fill: 'none', stroke: 'currentColor', 'stroke-width': 'var(--ds-icon-stroke, 1.6)',
-        'stroke-linecap': 'round', 'stroke-linejoin': 'round', 'aria-hidden': 'true',
-        dangerouslySetInnerHTML: { __html: inner }
-    });
+    return h('svg', { ...iconAttrs(name, size), dangerouslySetInnerHTML: { __html: inner } });
 }
 
 export function Topbar({ brand = '247420', leaf = '', items = [], active = '', onNav, search } = {}) {
@@ -467,6 +478,7 @@ export function WorkspaceShell({ rail, sessions, main, pane, crumb, status, narr
     const keepPaneTrack = stableFrame && !hasPane;
     const railIsCollapsed = wsCollapsed('rail', railCollapsed);
     const paneIsCollapsed = hasPane ? wsCollapsed('pane', paneCollapsed) : true;
+    const sessionsIsCollapsed = wsCollapsed('sessions', false);
     const shellCls = 'ws-shell'
         + (railIsCollapsed ? ' ws-rail-collapsed' : '')
         + ((hasPane || keepPaneTrack) ? '' : ' ws-no-pane')
@@ -513,8 +525,9 @@ export function WorkspaceShell({ rail, sessions, main, pane, crumb, status, narr
                     // full-width thread/grid). Hidden on mobile via CSS.
                     hasSessions ? h('button', {
                         class: 'ws-desktop-toggle ws-sessions-toggle', type: 'button',
-                        'aria-label': 'collapse conversations', title: 'collapse conversations',
-                        'aria-expanded': 'true', onclick: () => toggleWs('sessions'),
+                        'aria-label': sessionsIsCollapsed ? 'expand conversations' : 'collapse conversations',
+                        title: sessionsIsCollapsed ? 'expand conversations' : 'collapse conversations',
+                        'aria-expanded': sessionsIsCollapsed ? 'false' : 'true', onclick: () => toggleWs('sessions'),
                     }, Icon('chevron-left')) : null,
                     h('div', { class: 'ws-crumb-main' }, crumb),
                     // Desktop-only context-pane collapse, on the same crumb-level

package/src/markdown.js

@@ -10,8 +10,12 @@ let _purify = null;
 let _failedAt = 0;
 const RETRY_BACKOFF_MS = 30000;
 
-const MARKED_URL = 'https://cdn.jsdelivr.net/npm/marked@15/+esm';
-const PURIFY_URL = 'https://cdn.jsdelivr.net/npm/dompurify@3/+esm';
+// Pin to exact semver so the CDN cannot silently swap code under us.
+// SRI cannot be applied to dynamic ESM imports in browsers (no importmap
+// integrity support at design time); pinning the version is the best available
+// mitigation for CDN-supply-chain risk on these two dependencies.
+const MARKED_URL = 'https://cdn.jsdelivr.net/npm/marked@15.0.12/+esm';
+const PURIFY_URL = 'https://cdn.jsdelivr.net/npm/dompurify@3.2.6/+esm';
 
 // True while the markdown stack is unavailable (escaped-fallback rendering).
 // Consumers (markdown-cache) use this to avoid caching degraded output.
@@ -40,7 +44,9 @@ export async function ensureReady() {
     return _ready;
 }
 
-function escapeHtml(s) {
+// The single HTML-entity escape for the whole SDK (full set incl. quotes, so it
+// is safe in attribute contexts too). page-html.js re-exports this as `escape`.
+export function escapeHtml(s) {
     return String(s).replace(/[&<>"']/g, (c) => ({
         '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
     })[c]);
@@ -50,7 +56,7 @@ export async function renderMarkdown(src) {
     const ok = await ensureReady();
     if (!ok) return escapeHtml(src).replace(/\n/g, '<br>');
     const raw = _marked.parse(String(src));
-    return _purify.sanitize(raw);
+    return _purify.sanitize(raw, { FORCE_BODY: true });
 }
 
 // Sanitize already-rendered HTML before it touches innerHTML. For any surface
@@ -60,5 +66,5 @@ export async function renderMarkdown(src) {
 export async function sanitizeHtml(html) {
     const ok = await ensureReady();
     if (!ok) return escapeHtml(html);
-    return _purify.sanitize(String(html));
+    return _purify.sanitize(String(html), { FORCE_BODY: true });
 }

package/src/page-html.js

@@ -16,9 +16,10 @@
 //     cssHref, headExtra,
 //   })
 
-export function escape(s) {
-    return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
+// Single source of HTML escaping lives in markdown.js (full entity set). Kept
+// the `escape` export name for backward compatibility with any consumer.
+import { escapeHtml } from './markdown.js';
+export const escape = escapeHtml;
 
 export function inlineMd(s) {
     return s