deepseek-harness-intelligent-ui 0.2.10 → 0.2.12

package/CHANGELOG.md

@@ -6,6 +6,22 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.12]
+
+### Added
+
+- `Video`: a YouTube (`watch`, `youtu.be`, `shorts`), Bilibili (`BV…`, with `?p=`) or Vimeo page link plays in the platform's official embed player (YouTube via `youtube-nocookie.com`), which is loaded only after the user presses play; the player URL is rebuilt from a validated id, never copied from model input, and the frame is sandboxed without top navigation. A direct https `.mp4`/`.webm` file plays with native controls and `preload="metadata"`. Optional `title`, `poster`, `caption`, `credit`/`creditUrl`, `start` (seconds) and `aspectRatio`. An "Open on …" / "Open original video" link is always shown, and a file that fails to load is replaced by an explanation. The Host rejects non-https sources and platform links without a playable id. Follows `mediaAllowedOrigins` and the offline package's no-remote-media rule.
+
+- `Image` and `Gallery` (1–24 photos): absolute https sources only (no `http:`, `data:`, relative or credentialed URLs, checked by the Host), loaded lazily with `referrerpolicy="no-referrer"`; required `alt` text, optional `caption` and `credit`/`creditUrl`. Tapping opens a modal full-size viewer (`<dialog>`, focus starts on Close, arrow keys and buttons step through, Escape closes). A photo that fails to load is replaced by its description, the reason and an "Open original" link; the rest of the gallery is unaffected. New live setting `mediaAllowedOrigins` restricts sources to listed origins; the offline package never loads remote media, even for replayed results.
+
+- `Map`: places on a Web Mercator map with markers (WGS84 `lat`/`lon`, optional `group` colours with a toggleable legend and a `note` per place), routes as `[lat, lon]` point lists (straight segments, `dashed` for itinerary sketches; drawn the short way across the antimeridian), drag/keyboard panning, zoom buttons, `+`/`−`, double-click and Ctrl+wheel (the page scroll is never captured), a scale bar, and a place list with a details panel. View and selection survive remounts and reloads. Works offline with a built-in Natural Earth world outline; set `mapTileUrl`, `mapTileAttribution` and `mapTileMaxZoom` to use a raster tile basemap, which falls back to the outline when tiles cannot load. The Host rejects out-of-range or swapped coordinates, duplicate ids and oversized data (500 markers, 50 routes, 5,000 route points).
+
+## [0.2.11]
+
+### Changed
+
+- Supports DeepSeek Harness 0.2.1-rc.3, 0.2.1-rc.4 (`next`) and 0.2.2-alpha.2 (`alpha`). The `@deepseek-ai/dsh` and `@deepseek-ai/dsh-llm` peer ranges now list the 0.2.2 prereleases, and the `@deepseek-ai/cordis` peer range the 4.0.6 prereleases, so ordinary npm co-installation agrees with DSH's own compatibility gate. Install smoke test, the full browser E2E (43 checks) and the DSH extension E2E pass on all three; no runtime changes were needed.
+
 ## [0.2.10]
 
 ### Changed

package/README.md

@@ -189,11 +189,13 @@ Why these rules were kept after a real-model A/B against a rewritten decision or
 | Text & callouts | `Text` (markdown subset), `Code`, `Alert`, `Badge`, `Divider` |
 | Data | `Stat`, `Progress`, `List`, `Timeline`, **`Table`** as a data grid: typed sorting (numbers, ISO dates, booleans), search, per-column filters, paging, CSV/Markdown export |
 | Charts | **`Chart`** (bar / line / area / pie, stacked, legend toggles, hover/tap/keyboard tooltips, data export), **`Scatter`** (continuous x/y), **`Heatmap`** (sequential or diverging scale, explicit missing cells) |
+| Maps | **`Map`** (markers, routes, groups; drag/keyboard pan and zoom; a built-in offline world outline, or the tile basemap you configure) |
+| Media | **`Image`** and **`Gallery`** (photos from https URLs, lazy and without a Referer, captions and linked credits, a modal full-size viewer with arrow keys; a broken photo shows its description); **`Video`** (YouTube / Bilibili / Vimeo links in the official player, loaded only after the user presses play, or a direct https .mp4/.webm with native controls; always a link to the original) |
 | Math & diagrams | **`Plot`** (y = f(x) with sliders that redraw instantly; a safe expression compiler, never `eval`), **`Math`** (KaTeX), **`Mermaid`** |
 | Code & structure | **`CodeDiff`** (multi-file before/after or unified patch), **`FileTree`** (status badges), **`JsonView`** (JSONPath, copy) |
 | Interaction | `Button`, **`Choice`** (single-choice card), `Form` (text, number, range slider, select, checkbox, date, textarea) |
 
-- **Validated before it renders.** A UI travels as a flat node list with id references (DSH's tool schema has no recursion). The Host rejects unknown types or props, dangling or duplicate ids, cycles, shape mismatches (chart series, heatmap rows), non-finite numbers, uncompilable `Plot` expressions and oversized data, returning `ok:false` with paths so the model fixes and retries.
+- **Validated before it renders.** A UI travels as a flat node list with id references (DSH's tool schema has no recursion). The Host rejects unknown types or props, dangling or duplicate ids, cycles, shape mismatches (chart series, heatmap rows), non-finite numbers, uncompilable `Plot` expressions, out-of-range map coordinates and oversized data, returning `ok:false` with paths so the model fixes and retries.
 - **Text, never HTML.** Cells, code, JSON and labels render as React text. CSV export neutralises spreadsheet formula injection and is RFC 4180 with a UTF-8 BOM.
 - **Accessible and responsive.** Charts are focusable and keyboard-inspectable, trees use `role=tree`, touch targets grow on coarse pointers, and charts lay out at the card's real width so axis text stays legible on phones.
 - **`Math` and `Mermaid`** render in the same sandbox as widgets from the CDN allowlist, with a static fallback when the CDN is unreachable, or fully offline with the [offline resource package](docs/offline-resources.md).
@@ -286,6 +288,10 @@ The bundle patch inserts the plugin row automatically. To change settings, add t
 | `maxWidgetBytes` | `400000` | Reject larger widgets |
 | `sendPromptMaxChars` | `4000` | Longest message a widget, button, form or choice may send |
 | `openLinkAllowedOrigins` | `[]` | If non-empty, the only origins `openLink` may open |
+| `mapTileUrl` | `''` | Raster tile template for `Map`, e.g. `https://tile.openstreetmap.org/{z}/{x}/{y}.png` (https with `{z}`/`{x}`/`{y}`). Empty: the offline outline. Follow the provider's tile usage policy |
+| `mapTileAttribution` | `''` | Attribution always shown on tiled maps, e.g. `© OpenStreetMap contributors` |
+| `mapTileMaxZoom` | `19` | Highest zoom the tile provider serves |
+| `mediaAllowedOrigins` | `[]` | If non-empty, the only https origins `Image`/`Gallery`/`Video` may load from (for platform videos, the player origin, e.g. `https://www.youtube-nocookie.com`, `https://player.bilibili.com`); others show a placeholder. Empty: any https source |
 
 ## 📊 Real-model quality baseline
 

package/README.zh-CN.md

@@ -189,11 +189,13 @@ npx deepseek-harness-intelligent-ui doctor      # 只诊断，不做修改
 | 文本与提示 | `Text`（markdown 子集）、`Code`、`Alert`、`Badge`、`Divider` |
 | 数据 | `Stat`、`Progress`、`List`、`Timeline`；**`Table`** 数据表格：按类型排序（数值、ISO 日期、布尔）、搜索、按列筛选、分页、CSV/Markdown 导出 |
 | 图表 | **`Chart`**（柱状、折线、面积、饼图；可堆叠，图例显隐，悬停/点按/键盘提示，数据导出）、**`Scatter`**（连续坐标散点图）、**`Heatmap`**（顺序或发散色标，缺失值单独标识） |
+| 地图 | **`Map`**（地点标记、路线、分组；拖动/键盘平移缩放；内置离线世界轮廓，或使用你配置的瓦片底图） |
+| 媒体 | **`Image`** 与 **`Gallery`**（https 图片，懒加载且不发送 Referer，说明文字与可点击署名，模态大图查看器支持方向键；加载失败时显示图片描述）；**`Video`**（YouTube / Bilibili / Vimeo 链接用官方播放器，用户点击播放后才加载；或 https 直链 .mp4/.webm 原生播放；始终附原视频链接） |
 | 数学与图示 | **`Plot`**（y = f(x)，拖动滑块即时重绘；安全表达式编译器，不用 `eval`）、**`Math`**（KaTeX）、**`Mermaid`** |
 | 代码与结构 | **`CodeDiff`**（多文件新旧对比或 unified patch）、**`FileTree`**（状态徽标）、**`JsonView`**（JSONPath、复制） |
 | 交互 | `Button`、**`Choice`**（选择题卡片）、`Form`（文本、数字、范围滑块、下拉、勾选、日期、多行文本） |
 
-- **先校验再渲染。** DSH 的工具 schema 不支持递归，所以界面以扁平节点列表加 id 引用传输。Host 会拒绝未知类型或属性、悬空或重复的 id、环、形状不一致（图表系列、热力图行列）、非有限数值、无法编译的 `Plot` 表达式和超限数据，返回 `ok:false` 并附出错路径，模型据此修正后重试。
+- **先校验再渲染。** DSH 的工具 schema 不支持递归，所以界面以扁平节点列表加 id 引用传输。Host 会拒绝未知类型或属性、悬空或重复的 id、环、形状不一致（图表系列、热力图行列）、非有限数值、无法编译的 `Plot` 表达式、越界的地图坐标和超限数据，返回 `ok:false` 并附出错路径，模型据此修正后重试。
 - **只渲染文本。** 单元格、代码、JSON 和标签都作为 React 文本渲染，不作为 HTML。CSV 导出遵循 RFC 4180，带 UTF-8 BOM，并防止表格公式注入。
 - **可访问、自适应。** 图表可获得焦点并用键盘查看，树形组件使用 `role=tree`，触屏上控件更大；图表按卡片实际宽度布局，手机上坐标轴文字依然清晰。
 - **`Math` 与 `Mermaid`** 在与组件相同的沙箱中从 CDN 白名单加载，CDN 不可达时显示静态降级；使用[离线资源包](docs/offline-resources.md)可完全离线。
@@ -286,6 +288,10 @@ npx deepseek-harness-intelligent-ui doctor      # 只诊断，不做修改
 | `maxWidgetBytes` | `400000` | 超过此大小的组件会被拒绝 |
 | `sendPromptMaxChars` | `4000` | 组件、按钮、表单、选择题单条消息的最大长度 |
 | `openLinkAllowedOrigins` | `[]` | 非空时，`openLink` 只能打开这些来源 |
+| `mapTileUrl` | `''` | `Map` 的栅格瓦片模板，例如 `https://tile.openstreetmap.org/{z}/{x}/{y}.png`（https，含 `{z}`/`{x}`/`{y}`）。留空则显示离线轮廓。请遵守瓦片服务商的使用政策 |
+| `mapTileAttribution` | `''` | 瓦片地图上始终显示的署名，例如 `© OpenStreetMap contributors` |
+| `mapTileMaxZoom` | `19` | 瓦片服务商提供的最大缩放级别 |
+| `mediaAllowedOrigins` | `[]` | 非空时，`Image`/`Gallery`/`Video` 只从这些 https 来源加载（平台视频按播放器来源，如 `https://www.youtube-nocookie.com`、`https://player.bilibili.com`），其他来源显示占位提示。留空：允许任意 https 来源 |
 
 ## 📊 真实模型质量基线
 

package/THIRD_PARTY_NOTICES.md

@@ -26,6 +26,12 @@ https://github.com/bigskysoftware/idiomorph (v0.7.4). Its minified build is embe
 
 Copyright (c) Big Sky Software. Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.
 
+## world-atlas — ISC License; Natural Earth — public domain
+
+https://github.com/topojson/world-atlas (2.0.2). `scripts/map/build-land.mjs` converts its `land-110m.json` (derived from [Natural Earth](https://www.naturalearthdata.com/) 1:110m land, public domain) into the rounded outline in `client-src/catalog/map-land.ts`, bundled into `client/client.js` and `renderer/renderer.js` as the `Map` component's offline base map.
+
+Copyright 2013-2019 Michael Bostock. Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies. THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES.
+
 ## React — MIT License
 
 React is provided at runtime by the DSH Web shell. It is not bundled.