cordisx 0.1.0-beta.0 → 0.1.0-beta.1

package/README.md

@@ -13,17 +13,26 @@ npx cordisx@beta codex
 ```
 
 `setup` creates `~/.cordisx/config.json` with `plugins: []`. The default profile
-shares the existing host account and conversations. Use a named isolated
-profile when separate host data is wanted:
+starts an independent Host window and persistent CordisX-scoped Chromium
+profile while sharing the existing account and conversations. Use
+`host-isolated` only when a separate Host root is wanted:
 
 ```bash
-npx cordisx@beta codex work --data isolated
+npx cordisx@beta codex work --data host-isolated
 ```
 
 CordisX starts a separate process and does not modify the installed Codex
 application. Plugins are trusted local renderer code; this beta is not a
 security sandbox.
 
+## React plugins
+
+Plugins write controlled page bodies with the React singleton supplied by the
+Host. Import React and Hooks from `cordisx/react`, and reusable Host components
+from `cordisx/ui`. Plugin projects install only `cordisx`; they must not install
+or bundle `react`, `react-dom`, or a private React component library. The Host
+owns the React root, page chrome, theme, error boundary, and lifecycle cleanup.
+
 ## License
 
 The CordisX host, runtime, CLI, manager, launcher, and adapters are licensed
@@ -40,3 +49,6 @@ and should receive legal review before stable.
 
 See the [user getting-started guide](https://github.com/cordisx/cordisx/blob/main/.agents/docs/getting-started.md)
 and [CLI/distribution contract](https://github.com/cordisx/cordisx/blob/main/.agents/docs/distribution-and-cli.md).
+The scoped Host form architecture and the reproducible official TDesign Web
+Components subset are documented in the
+[Host-owned form system](https://github.com/cordisx/cordisx/blob/main/.agents/docs/host-form-system.md).

package/THIRD_PARTY_NOTICES.md

@@ -6,15 +6,58 @@ licenses remain with their respective copyright holders:
 | Package | Version used by this beta | Registry license |
 | --- | --- | --- |
 | `@deepseek-ai/cordis` | `4.0.1` | MIT |
+| `@deepseek-ai/schemastery` | `3.18.1` | MIT |
 | `@material-symbols/svg-400` | `0.46.0` | Apache-2.0 |
 | `esbuild` | `^0.25.9` | MIT |
 | `intl-messageformat` | `11.2.14` | BSD-3-Clause |
+| `luna-console` | `1.3.6` | MIT |
+| `luna-data-grid` | `1.6.5` | MIT |
+| `luna-dom-viewer` | `1.8.4` | MIT |
+| `luna-object-viewer` | `0.3.2` | MIT |
+| `tar` | `7.5.22` | BlueOak-1.0.0 |
 | `ws` | `^8.18.3` | MIT |
 
+CordisX also bundles a generated, production-controlled subset of these
+packages inside the renderer rather than installing their full npm graphs:
+
+| Bundled package | Exact version | License |
+| --- | --- | --- |
+| `tdesign-web-components` | `1.2.10` | MIT |
+| `omi` | `7.7.13` | MIT |
+| `reactive-signal` | `2.0.1` | MIT |
+| `weakmap-polyfill` | `2.0.4` | MIT |
+| `clsx` | `2.1.1` | MIT |
+| `tailwind-merge` | `2.6.1` | MIT |
+| `lodash-es` | `4.18.1` | MIT |
+| `omi-transition` | `0.1.11` | MIT |
+| `@popperjs/core` | `2.11.8` | MIT |
+
+The TDesign subset is generated from npm tarball SHA-256
+`e1929f06eda5c3d2ee194da0d6bc9f81e187184fe1054627afeabad2ae71db0e`.
+Only Input, Textarea, InputNumber, Select/Option, DatePicker, TagInput,
+Checkbox, Switch, Radio, Slider, Button, Alert, and Loading are imported.
+Embedded CSS source maps and Omi's
+legacy replacement of the native `HTMLElement` constructor are removed; no
+component behavior is reimplemented or represented as a different library.
+The retained notices and MIT terms are at
+`third_party/tdesign-web-components-subset-MIT.txt`.
+
 CordisX copies selected Material Symbols SVG assets into its built output. The
 complete Apache License 2.0 text distributed by that package is included at
 `third_party/material-symbols-APACHE-2.0.txt`.
 
-The exact dependency graph in `package-lock.json` contains only MIT,
-Apache-2.0, and BSD-3-Clause license identifiers for production dependencies in
-this beta. This inventory is evidence for release review, not legal advice.
+The exact dependency graph in `package-lock.json` contains MIT, Apache-2.0,
+BSD-3-Clause, BlueOak-1.0.0, and ISC license identifiers for production
+dependencies in this beta. This inventory is evidence for release review, not
+legal advice.
+
+The plugin DevTools Console pins and locally bundles Luna Console with its
+official Luna Object Viewer, Data Grid, and DOM Viewer peers. Their upstream
+project is liriliri/luna; all four packages are MIT licensed (copyright
+liriliri contributors). CordisX inserts each safe structured `method + args[]`
+record independently into Luna Console. The separate Host Inspector contains
+metadata only. There is no runtime CDN dependency.
+
+The package-size, dependency, component-coverage, style-isolation, and
+reproducible-generation evidence for the TDesign subset is recorded in
+`.agents/docs/host-form-system.md`.

package/dist/assets/apps/feishu.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">
+  <metadata>Feishu iOS application icon, bundle com.bytedance.ee.lark, retrieved from Apple App Store artwork on 2026-08-27.</metadata>
+  <image width="128" height="128" href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAASABIAAD/4QB6RXhpZgAATU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAABJKGAAcAAAAiAAAAUKABAAMAAAABAAEAAKACAAQAAAABAAAAgKADAAQAAAABAAAAgAAAAABBU0NJSQAAAEVMRUg2TlNGR1hLUElNQ0RGWExRMktWRlZV/+0AOFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAAAAOEJJTQQlAAAAAAAQ1B2M2Y8AsgTpgAmY7PhCfv/AABEIAIAAgAMBIgACEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2wBDAAICAgICAgMCAgMEAwMDBAUEBAQEBQcFBQUFBQcIBwcHBwcHCAgICAgICAgKCgoKCgoLCwsLCw0NDQ0NDQ0NDQ3/2wBDAQICAgMDAwYDAwYNCQcJDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ3/3QAEAAj/2gAMAwEAAhEDEQA/AP38ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP/0P38ooooAKKKoapplnrOm3Ok6ihktbyJ4ZkDFCUcYIDKQRx3BzTVr6mdVzUG6avK2ibsm+l3Z29bP0ZfyKMivzf+L/wQ8SfD9pdc0K4udR0AnJfcxmtAe0oHVfSQDHqBxn54+23n/PxL/wB9tX0eHyCFeCqUqt16f8E/lfij6SeP4ex8stzbJZQqR/6faNdJRfsrNPuvTe6P2nyKMivxY+23n/PxL/321H228/5+Jf8Avtq3/wBWH/z8/D/gnz3/ABN5T/6FT/8AB3/3I/afIor8WPtt5/z8S/8AfbVastb1nTbqO90++uba4iYMksUrKykdwQRSfDD6VPw/4JdP6XlBySnlbS62rJ/h7Nfmj9naK8Q+B3xUT4keG/K1BlXW9NCx3qDA81T9ydR6Pj5gOjA9iK9vr5uvQnRqOnNao/q/hziDBZ5ltHNcunzUqiun180+zTumujQUUUVie2FFFFAH/9H9/KKKKACiiigBkkcc0bRSqHRwVZWGVZTwQQeCCK+Cvjp8ADoAuPGPgiAtpvMl5YoMm27mSMd4vVeqdR8v3fvikIDAqwBBGCD0IrtwOOqYWpzw26rufBeIXh3lfF+WvA5hG0ldwmvihLuu6f2o7NdnZr8UKK+q/wBoL4Jf8ItNL418KQf8Sed83lsg4s5HP3lHaJif+AHjoRj5Ur9CwmKp4imqtPY/zC4z4OzHhjNamU5nG046praUXtKL6p/g7p2aaCiiiuk+VO9+Gnje7+H3jGx8RW5Ywo3lXcS/8tbaQgSLjuQPmX/aAr9bLW6t721hvbRxLBcRrLG68hkcAqR7EHNfitX6T/szeLG8Q/DpNLuX33OhzGzOepgI3wn6AEoP92vl+JMInBYiO60Z/X/0VONZ0sbX4YxEvcqJ1KflKPxJf4o6/wDbr7n0TRVW4vrG0IF1cRQk9BI6r/MipYpobhPMgkWRT/EhDD8xXyHK7XP7kuiWiiikM//S/fyvnv8Aam1fVdC+BviHVNEvJ7C8gayMVxbSNFKhN3CDtZSCMjg+o4r6Er5r/a7/AOTf/E31sf8A0rhr6jgiEZ8RYCE1dOtTuv8At9Hl55Jxy6u1vyS/JnK/s1ftM6f8UrKHwl4tljtPFttHgZwkeoog5kiHQSgcvGP95flyF+vq/nDtbq6sLqG+sZpLe5t3WWGaJikkbocqysMEEHkEV+o37O/7Xlj4lS18F/FS4jstY+WK11Z8R294eirN0WKY/wB7hHP908H9n8U/Bqpg5TzfIIXpbypreHdxXWPlvHp7u3xXCnGkayWDzCVp7KT6+T8/Pr67/e1FHXkUV/OB+kle6tba+tpbK8iWaCdGjljcbldGGCpB4II61+X3xr+Fk/w08SEWis+i6gWksZTzsxy0LH+8meD3XB65x+pNcV8QfBGm/EHwtd+G9RAUyrvt5sZME652SD6HgjupI716mVZg8LVu/he/+Z+Q+MnhlR4wyWVOkksVSvKlLz6wb/llt5Oz6NP8hKK1Nb0bUfD2r3eh6rEYbyymaGVD2ZT1HqCOQe4INfHfxk+NBQz+EfB1xzzHe38R6dmihYfkzj6Dua/U8ry6rj6qpUPm+iXc/wA5eG+DMzzrM3lmHg4yi/fbVlCzs+b0elt29DvfiD8c9A8Iyy6VoyLq2qJlXVWxbwt6O4zuYd1X8SK+br74+fF66iu7Wy8T6hpFnfbfPtdKmeyikCZ2hvKIdgNx+8x614/RX6pl/DuCwsUuRSl3av8Ad2P7L4O8Ocn4dUauFhzV1vUl8Wqs7dIpq6sumjb62rq+vr6Uz31zNcyscl5pGkYn3LEk1q6J4r8U+GblLzw3rOo6VOhysljdy2zAj3jZTWBXXeAfBOufEjxrovgPw3H5mpa7exWcHGVQyH5pG9EjTLseyqa9it7ONNurblS1vtY/QIczklHc/Yf/AIJ9fE79qP4o395deL9aXV/AOlBoJr3VoPNvZbwqCsNrcIUdygIaVpfMCggD5m4/V+uC+GHw68O/CbwHo3w+8LRCLT9GtlgVsYeaTrJNJ6ySuS7H1PpXe1/JPEeZ0Mfj54jDU1CGySVtO7t1e7P17LcLPD4eNOrJyl1u7/JeR//T/fyvmv8Aa7/5N/8AE31sf/SuGvpSvmv9rv8A5N/8TfWx/wDSuGvquBf+SkwH/X6n/wClo8rPv+RbiP8ABL/0ln4n0EAjBoor/R4/mw+wPgb+1v4q+Gq2/hzxgJdf8OJhEy2b2zQcfunY/vEA/wCWbnj+FgOK/VHwP8QfB/xH0ZNd8G6nDqNq2A4Q4lhY/wAEsZw8bD0YD2yK/nuro/C3i7xP4I1ePXfCWpXGl30fAlt327l/uuvKup7qwIPpX4px54LZZnbljMvao4h6uy9yT/vJbN/zL1abPt8g42xOBSo4j36f4r0fX0fyaP6IajlligieaZ1jjjUs7sQqqqjJJJ4AA6mvzg+Hn7eUcOntafFHRpZrmGJil7pCqfPZRwrwSOgRmPG5X25PRRX56ftQfto/Fn4zSXPhKK3m8HeE3JU6XC5+0XqZ4N3OMeYp/wCeaYj9d+Aa/nP/AIhDxDSxjw2Np8kF9u94tf3bbvy087H6P/rjl06PtaEuaX8uz+f9elz0T9uj9pfwX408ZPoHwgnM5ghNnrOuQMBBdMhwI7YjlggyrzA4YYCcDcfzVoor9xyXJsPlmFjhcPsur3fm/wCtD80+rYeOJrYqjSjCVWXNKyteXd93/wAP1YUUUV6xqFfsJ/wTB+B++XV/j1rtvwnmaPoO8d+Ptlwv6Qqf+ugr8v8A4UfDHxL8YvH2kfD3wpEXvdVnCNKQTHbQDmWeTHRIkyx9cYHJFf1PfD3wNoPwz8EaL4C8MxeVpuh2cdpAD95tg+aR/V5GJdz3Zia/L/FDP/qmBWX0n79Xfyh1+96elz6rhbL/AG1f6xNe7D8/+Bv9x2VFFFfzufox/9T9/K+a/wBrv/k3/wATfWx/9K4a+lK+e/2qNKv9Y+A3iq206Fp5o4YLkogy3l29xFLIQB/dRSx9hX1HBE4w4iwE5uyVan/6Wjy88i3l2IS/kl+TPw/ooBzyKK/0gP5rCiiigAqvdWdpfQm3vYY54j1SRQw/WrFFKUVJWktBptao801X4X6HeEyac8li5/hH7yPP+6xyPwavPtQ+GPiW0JNqIrxB0Mb7W/75fH6E19GUV4eK4cwNZ35eV+Wn4bfgd1LMq8NL39T5W/4QvxVu2f2ZPn6DH55xXU6J8KfEWqXMUN0ot/NdUSNP307sxwFREzliTgDPXtX0jpOkarr+pW+jaJaTX9/duI4Le3QySyMeyqOfqegHJ4r9YP2bf2V7T4bmDxt48SK88Tld1tbjEkGm7h2PR58cFxwvRf7x/POMsfkfC+F+sY2bnUfwU7pOT+Wqj3l913ZH0WS4fHZrV9nQioxW8raL/N9l+mql/Y8/Zh0z4D+FG1rVLVR4q1qNftTPhpLW3+8sG7+8ThpMcbsKOFyfs6iiv4tzvOcTmuNnjsU/el0WyXRJdElovx1P2zA4KlhKEaFLZfe/N+bCiiivJOs//9X9/KRlV1KsAQRgg8gg0tFAHxP8X/2L/B/jOWfXPAEyeGtWkJd7bYW06dzz9xfmhJPdMr/sd6/Onx/8Efif8M5XHivQriO1Q4F9bj7RZsPXzY8hc+j7T7V+91Iyq6lHAZWGCDyCDX7Jwl4257k8I4fE2r0l0k3zJdlPf/wJS8rHxeb8D4DGN1KX7ub7bfNf5WP5uwQRkHIpa/eLxR+z/wDBrxjI8+ueFNPad/vT2yG0lJPcvAYyT9c143qH7DnwVvGL2kms2Geiw3iuo/7/AEch/Wv2rL/pC8PVo/7VSqU5eikvvUk//JUfFYjw7zGD/dTjJerT/L9T8gaK/WiP9g74TK+ZNW191/u+fbj9Rb12mi/safAjSHElxpV3qjL/AM/17Kyn6rEY1P5V24jx+4XpxvD2kn2UF+skYU/D7NZO0uVer/yTPxqtbW6vrlLOxhkubiQ4SGFDJIxPYKoJP4Cvq74Z/sc/FLxvJFe+I4h4V0piC0l6u68df9i2BDA/9dCn0NfrH4Y8B+CvBcPkeE9DsNJXGCbS3SJ2H+04G5vxJrrK/NOI/pEY6vF0smoKl/ek+aXyXwp+vMfTZb4dUKbU8bU5vJaL793+B4/8Kvgb8P8A4P2Ji8L2W+/lQLcaldYku5vUb8AImf4ECr6gnmvYKKK/n3McyxWPxEsVjajnUlu27v8Arsuh+h4bDUsPTVKhFRiuiCiiiuE3CiiigD//1v38ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP/2Q=="/>
+</svg>