cordisx 0.1.0-beta.0 → 0.1.0-beta.2

package/README.md

@@ -13,17 +13,26 @@ npx cordisx@beta codex
 ```
 
 `setup` creates `~/.cordisx/config.json` with `plugins: []`. The default profile
-shares the existing host account and conversations. Use a named isolated
-profile when separate host data is wanted:
+starts an independent Host window and persistent CordisX-scoped Chromium
+profile while sharing the existing account and conversations. Use
+`host-isolated` only when a separate Host root is wanted:
 
 ```bash
-npx cordisx@beta codex work --data isolated
+npx cordisx@beta codex work --data host-isolated
 ```
 
 CordisX starts a separate process and does not modify the installed Codex
 application. Plugins are trusted local renderer code; this beta is not a
 security sandbox.
 
+## React plugins
+
+Plugins write controlled page bodies with the React singleton supplied by the
+Host. Import React and Hooks from `cordisx/react`, and reusable Host components
+from `cordisx/ui`. Plugin projects install only `cordisx`; they must not install
+or bundle `react`, `react-dom`, or a private React component library. The Host
+owns the React root, page chrome, theme, error boundary, and lifecycle cleanup.
+
 ## License
 
 The CordisX host, runtime, CLI, manager, launcher, and adapters are licensed
@@ -40,3 +49,6 @@ and should receive legal review before stable.
 
 See the [user getting-started guide](https://github.com/cordisx/cordisx/blob/main/.agents/docs/getting-started.md)
 and [CLI/distribution contract](https://github.com/cordisx/cordisx/blob/main/.agents/docs/distribution-and-cli.md).
+The scoped Host form architecture and the reproducible official TDesign Web
+Components subset are documented in the
+[Host-owned form system](https://github.com/cordisx/cordisx/blob/main/.agents/docs/host-form-system.md).

package/THIRD_PARTY_NOTICES.md

@@ -3,18 +3,43 @@
 The CordisX CLI depends on packages distributed separately by npm. Their
 licenses remain with their respective copyright holders:
 
-| Package | Version used by this beta | Registry license |
-| --- | --- | --- |
-| `@deepseek-ai/cordis` | `4.0.1` | MIT |
-| `@material-symbols/svg-400` | `0.46.0` | Apache-2.0 |
-| `esbuild` | `^0.25.9` | MIT |
-| `intl-messageformat` | `11.2.14` | BSD-3-Clause |
-| `ws` | `^8.18.3` | MIT |
+| Package                    | Version used by this beta | Registry license |
+| -------------------------- | ------------------------- | ---------------- |
+| `@deepseek-ai/cordis`      | `4.0.1`                   | MIT              |
+| `@deepseek-ai/schemastery` | `3.18.1`                  | MIT              |
+| `@oneworks/avatar`         | `1.0.0-rc.8`              | MIT              |
+| `@oneworks/avatar-react`   | `1.0.0-rc.8`              | MIT              |
+| `@shikitor/core`           | `1.0.2`                   | MIT              |
+| `es-module-lexer`          | `1.7.0`                   | MIT              |
+| `esbuild`                  | `^0.25.9`                 | MIT              |
+| `intl-messageformat`       | `11.2.14`                 | BSD-3-Clause     |
+| `lightningcss`             | `1.33.0`                  | MPL-2.0          |
+| `luna-console`             | `1.3.6`                   | MIT              |
+| `luna-data-grid`           | `1.6.5`                   | MIT              |
+| `luna-dom-viewer`          | `1.8.4`                   | MIT              |
+| `luna-object-viewer`       | `0.3.2`                   | MIT              |
+| `reicon`                   | `1.2.1`                   | MIT              |
+| `tdesign-react`            | `1.18.2`                  | MIT              |
+| `tar`                      | `7.5.22`                  | BlueOak-1.0.0    |
+| `ws`                       | `^8.18.3`                 | MIT              |
 
-CordisX copies selected Material Symbols SVG assets into its built output. The
-complete Apache License 2.0 text distributed by that package is included at
-`third_party/material-symbols-APACHE-2.0.txt`.
+CordisX bundles only the selected Reicon glyph modules referenced by its
+Host-private semantic icon catalog. Reicon credits Solar Icons, designed by
+480 Design, under CC BY 4.0 and Zappicon under the Zappicon License as base-icon
+sources. Reicon, Zappicon, and Solar Icons remain upstream assets; CordisX does
+not represent them as CordisX-owned MIT icon assets, export their raw SVG/icon
+dataset, or provide an icon-library redistribution channel. The retained Reicon
+MIT terms and upstream credits are at `third_party/reicon-MIT.txt` and
+`third_party/reicon-icon-credits.txt`.
 
-The exact dependency graph in `package-lock.json` contains only MIT,
-Apache-2.0, and BSD-3-Clause license identifiers for production dependencies in
-this beta. This inventory is evidence for release review, not legal advice.
+The exact dependency graph in `package-lock.json` contains MIT, Apache-2.0,
+BSD-3-Clause, BlueOak-1.0.0, ISC, and MPL-2.0 license identifiers for production
+dependencies in this beta. This inventory is evidence for release review, not
+legal advice.
+
+The plugin DevTools Console pins and locally bundles Luna Console with its
+official Luna Object Viewer, Data Grid, and DOM Viewer peers. Their upstream
+project is liriliri/luna; all four packages are MIT licensed (copyright
+liriliri contributors). CordisX inserts each safe structured `method + args[]`
+record independently into Luna Console. The separate Host Inspector contains
+metadata only. There is no runtime CDN dependency.

package/dist/assets/apps/feishu.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128">
+  <metadata>Feishu iOS application icon, bundle com.bytedance.ee.lark, retrieved from Apple App Store artwork on 2026-08-27.</metadata>
+  <image width="128" height="128" href="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAASABIAAD/4QB6RXhpZgAATU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAABJKGAAcAAAAiAAAAUKABAAMAAAABAAEAAKACAAQAAAABAAAAgKADAAQAAAABAAAAgAAAAABBU0NJSQAAAEVMRUg2TlNGR1hLUElNQ0RGWExRMktWRlZV/+0AOFBob3Rvc2hvcCAzLjAAOEJJTQQEAAAAAAAAOEJJTQQlAAAAAAAQ1B2M2Y8AsgTpgAmY7PhCfv/AABEIAIAAgAMBIgACEQEDEQH/xAAfAAABBQEBAQEBAQAAAAAAAAAAAQIDBAUGBwgJCgv/xAC1EAACAQMDAgQDBQUEBAAAAX0BAgMABBEFEiExQQYTUWEHInEUMoGRoQgjQrHBFVLR8CQzYnKCCQoWFxgZGiUmJygpKjQ1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4eLj5OXm5+jp6vHy8/T19vf4+fr/xAAfAQADAQEBAQEBAQEBAAAAAAAAAQIDBAUGBwgJCgv/xAC1EQACAQIEBAMEBwUEBAABAncAAQIDEQQFITEGEkFRB2FxEyIygQgUQpGhscEJIzNS8BVictEKFiQ04SXxFxgZGiYnKCkqNTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqCg4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2dri4+Tl5ufo6ery8/T19vf4+fr/2wBDAAICAgICAgMCAgMEAwMDBAUEBAQEBQcFBQUFBQcIBwcHBwcHCAgICAgICAgKCgoKCgoLCwsLCw0NDQ0NDQ0NDQ3/2wBDAQICAgMDAwYDAwYNCQcJDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ0NDQ3/3QAEAAj/2gAMAwEAAhEDEQA/AP38ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP/0P38ooooAKKKoapplnrOm3Ok6ihktbyJ4ZkDFCUcYIDKQRx3BzTVr6mdVzUG6avK2ibsm+l3Z29bP0ZfyKMivzf+L/wQ8SfD9pdc0K4udR0AnJfcxmtAe0oHVfSQDHqBxn54+23n/PxL/wB9tX0eHyCFeCqUqt16f8E/lfij6SeP4ex8stzbJZQqR/6faNdJRfsrNPuvTe6P2nyKMivxY+23n/PxL/321H228/5+Jf8Avtq3/wBWH/z8/D/gnz3/ABN5T/6FT/8AB3/3I/afIor8WPtt5/z8S/8AfbVastb1nTbqO90++uba4iYMksUrKykdwQRSfDD6VPw/4JdP6XlBySnlbS62rJ/h7Nfmj9naK8Q+B3xUT4keG/K1BlXW9NCx3qDA81T9ydR6Pj5gOjA9iK9vr5uvQnRqOnNao/q/hziDBZ5ltHNcunzUqiun180+zTumujQUUUVie2FFFFAH/9H9/KKKKACiiigBkkcc0bRSqHRwVZWGVZTwQQeCCK+Cvjp8ADoAuPGPgiAtpvMl5YoMm27mSMd4vVeqdR8v3fvikIDAqwBBGCD0IrtwOOqYWpzw26rufBeIXh3lfF+WvA5hG0ldwmvihLuu6f2o7NdnZr8UKK+q/wBoL4Jf8ItNL418KQf8Sed83lsg4s5HP3lHaJif+AHjoRj5Ur9CwmKp4imqtPY/zC4z4OzHhjNamU5nG046praUXtKL6p/g7p2aaCiiiuk+VO9+Gnje7+H3jGx8RW5Ywo3lXcS/8tbaQgSLjuQPmX/aAr9bLW6t721hvbRxLBcRrLG68hkcAqR7EHNfitX6T/szeLG8Q/DpNLuX33OhzGzOepgI3wn6AEoP92vl+JMInBYiO60Z/X/0VONZ0sbX4YxEvcqJ1KflKPxJf4o6/wDbr7n0TRVW4vrG0IF1cRQk9BI6r/MipYpobhPMgkWRT/EhDD8xXyHK7XP7kuiWiiikM//S/fyvnv8Aam1fVdC+BviHVNEvJ7C8gayMVxbSNFKhN3CDtZSCMjg+o4r6Er5r/a7/AOTf/E31sf8A0rhr6jgiEZ8RYCE1dOtTuv8At9Hl55Jxy6u1vyS/JnK/s1ftM6f8UrKHwl4tljtPFttHgZwkeoog5kiHQSgcvGP95flyF+vq/nDtbq6sLqG+sZpLe5t3WWGaJikkbocqysMEEHkEV+o37O/7Xlj4lS18F/FS4jstY+WK11Z8R294eirN0WKY/wB7hHP908H9n8U/Bqpg5TzfIIXpbypreHdxXWPlvHp7u3xXCnGkayWDzCVp7KT6+T8/Pr67/e1FHXkUV/OB+kle6tba+tpbK8iWaCdGjljcbldGGCpB4II61+X3xr+Fk/w08SEWis+i6gWksZTzsxy0LH+8meD3XB65x+pNcV8QfBGm/EHwtd+G9RAUyrvt5sZME652SD6HgjupI716mVZg8LVu/he/+Z+Q+MnhlR4wyWVOkksVSvKlLz6wb/llt5Oz6NP8hKK1Nb0bUfD2r3eh6rEYbyymaGVD2ZT1HqCOQe4INfHfxk+NBQz+EfB1xzzHe38R6dmihYfkzj6Dua/U8ry6rj6qpUPm+iXc/wA5eG+DMzzrM3lmHg4yi/fbVlCzs+b0elt29DvfiD8c9A8Iyy6VoyLq2qJlXVWxbwt6O4zuYd1X8SK+br74+fF66iu7Wy8T6hpFnfbfPtdKmeyikCZ2hvKIdgNx+8x614/RX6pl/DuCwsUuRSl3av8Ad2P7L4O8Ocn4dUauFhzV1vUl8Wqs7dIpq6sumjb62rq+vr6Uz31zNcyscl5pGkYn3LEk1q6J4r8U+GblLzw3rOo6VOhysljdy2zAj3jZTWBXXeAfBOufEjxrovgPw3H5mpa7exWcHGVQyH5pG9EjTLseyqa9it7ONNurblS1vtY/QIczklHc/Yf/AIJ9fE79qP4o395deL9aXV/AOlBoJr3VoPNvZbwqCsNrcIUdygIaVpfMCggD5m4/V+uC+GHw68O/CbwHo3w+8LRCLT9GtlgVsYeaTrJNJ6ySuS7H1PpXe1/JPEeZ0Mfj54jDU1CGySVtO7t1e7P17LcLPD4eNOrJyl1u7/JeR//T/fyvmv8Aa7/5N/8AE31sf/SuGvpSvmv9rv8A5N/8TfWx/wDSuGvquBf+SkwH/X6n/wClo8rPv+RbiP8ABL/0ln4n0EAjBoor/R4/mw+wPgb+1v4q+Gq2/hzxgJdf8OJhEy2b2zQcfunY/vEA/wCWbnj+FgOK/VHwP8QfB/xH0ZNd8G6nDqNq2A4Q4lhY/wAEsZw8bD0YD2yK/nuro/C3i7xP4I1ePXfCWpXGl30fAlt327l/uuvKup7qwIPpX4px54LZZnbljMvao4h6uy9yT/vJbN/zL1abPt8g42xOBSo4j36f4r0fX0fyaP6IajlligieaZ1jjjUs7sQqqqjJJJ4AA6mvzg+Hn7eUcOntafFHRpZrmGJil7pCqfPZRwrwSOgRmPG5X25PRRX56ftQfto/Fn4zSXPhKK3m8HeE3JU6XC5+0XqZ4N3OMeYp/wCeaYj9d+Aa/nP/AIhDxDSxjw2Np8kF9u94tf3bbvy087H6P/rjl06PtaEuaX8uz+f9elz0T9uj9pfwX408ZPoHwgnM5ghNnrOuQMBBdMhwI7YjlggyrzA4YYCcDcfzVoor9xyXJsPlmFjhcPsur3fm/wCtD80+rYeOJrYqjSjCVWXNKyteXd93/wAP1YUUUV6xqFfsJ/wTB+B++XV/j1rtvwnmaPoO8d+Ptlwv6Qqf+ugr8v8A4UfDHxL8YvH2kfD3wpEXvdVnCNKQTHbQDmWeTHRIkyx9cYHJFf1PfD3wNoPwz8EaL4C8MxeVpuh2cdpAD95tg+aR/V5GJdz3Zia/L/FDP/qmBWX0n79Xfyh1+96elz6rhbL/AG1f6xNe7D8/+Bv9x2VFFFfzufox/9T9/K+a/wBrv/k3/wATfWx/9K4a+lK+e/2qNKv9Y+A3iq206Fp5o4YLkogy3l29xFLIQB/dRSx9hX1HBE4w4iwE5uyVan/6Wjy88i3l2IS/kl+TPw/ooBzyKK/0gP5rCiiigAqvdWdpfQm3vYY54j1SRQw/WrFFKUVJWktBptao801X4X6HeEyac8li5/hH7yPP+6xyPwavPtQ+GPiW0JNqIrxB0Mb7W/75fH6E19GUV4eK4cwNZ35eV+Wn4bfgd1LMq8NL39T5W/4QvxVu2f2ZPn6DH55xXU6J8KfEWqXMUN0ot/NdUSNP307sxwFREzliTgDPXtX0jpOkarr+pW+jaJaTX9/duI4Le3QySyMeyqOfqegHJ4r9YP2bf2V7T4bmDxt48SK88Tld1tbjEkGm7h2PR58cFxwvRf7x/POMsfkfC+F+sY2bnUfwU7pOT+Wqj3l913ZH0WS4fHZrV9nQioxW8raL/N9l+mql/Y8/Zh0z4D+FG1rVLVR4q1qNftTPhpLW3+8sG7+8ThpMcbsKOFyfs6iiv4tzvOcTmuNnjsU/el0WyXRJdElovx1P2zA4KlhKEaFLZfe/N+bCiiivJOs//9X9/KRlV1KsAQRgg8gg0tFAHxP8X/2L/B/jOWfXPAEyeGtWkJd7bYW06dzz9xfmhJPdMr/sd6/Onx/8Efif8M5XHivQriO1Q4F9bj7RZsPXzY8hc+j7T7V+91Iyq6lHAZWGCDyCDX7Jwl4257k8I4fE2r0l0k3zJdlPf/wJS8rHxeb8D4DGN1KX7ub7bfNf5WP5uwQRkHIpa/eLxR+z/wDBrxjI8+ueFNPad/vT2yG0lJPcvAYyT9c143qH7DnwVvGL2kms2Geiw3iuo/7/AEch/Wv2rL/pC8PVo/7VSqU5eikvvUk//JUfFYjw7zGD/dTjJerT/L9T8gaK/WiP9g74TK+ZNW191/u+fbj9Rb12mi/safAjSHElxpV3qjL/AM/17Kyn6rEY1P5V24jx+4XpxvD2kn2UF+skYU/D7NZO0uVer/yTPxqtbW6vrlLOxhkubiQ4SGFDJIxPYKoJP4Cvq74Z/sc/FLxvJFe+I4h4V0piC0l6u68df9i2BDA/9dCn0NfrH4Y8B+CvBcPkeE9DsNJXGCbS3SJ2H+04G5vxJrrK/NOI/pEY6vF0smoKl/ek+aXyXwp+vMfTZb4dUKbU8bU5vJaL793+B4/8Kvgb8P8A4P2Ji8L2W+/lQLcaldYku5vUb8AImf4ECr6gnmvYKKK/n3McyxWPxEsVjajnUlu27v8Arsuh+h4bDUsPTVKhFRiuiCiiiuE3CiiigD//1v38ooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKAP/2Q=="/>
+</svg>