deepseek-harness-intelligent-ui 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -6,6 +6,40 @@ All notable changes to this project are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.6]
+
+### Added
+
+- Catalog API v1 for trusted third-party components: namespaced manifests, strict shared props schemas, version checks, React renderers, disable/uninstall lifecycle, and safe fallback in streamed, patched and portable UIs. See `docs/component-extensions.md`.
+- Public schema-inferred TypeScript declarations and a runnable GitDiffViewer extension template.
+- README npm download badges.
+
+### Fixed
+
+- Extension validation and offline package verification now agree on what an extension package must contain.
+
+### Changed
+
+- Bundled React and React DOM 19.3.1; dev tooling bumps (puppeteer-core 25.14.0, vitest, pnpm/action-setup 6.1.0). CDN-pinned widget libraries (KaTeX, Mermaid, Three.js, D3, Chart.js, canvas-confetti) are excluded from Dependabot so online and offline versions stay in lockstep.
+
+## [0.2.5]
+
+### Added
+
+- Controlled data binding and action bridge for trusted hosts ([#15](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/issues/15)): Table/Chart `dataRef` share one host-registered dataset with local search, filter, sort and paging; action Buttons and `Bridge.invokeAction` call allowlisted, schema-checked host actions only after a native click, with host authorization and write confirmation. Exported as `deepseek-harness-intelligent-ui/controlled`. See `docs/controlled-data-actions.md`.
+- Optional offline browser-resource tarball (`npm run build:offline`) for Math/KaTeX fonts, Mermaid, Three.js/OrbitControls, D3, Chart.js and canvas-confetti ([#18](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/issues/18)). Exact locked versions, upstream licenses, checksums, size budgets, Host capability guidance and network-isolated Chromium regressions. Default online installation stays compatible.
+- Explicit static fallback status for unavailable Math/Mermaid libraries.
+
+### Fixed
+
+- Action Buttons no longer fail when DSH Web is served over plain HTTP (e.g. a LAN address), where `crypto.randomUUID` is unavailable.
+- A widget rebuilt while an action was running no longer loses its newly staged action request.
+- CI: the plain-answer E2E check waits for the answer itself; the release workflow waits up to 5 minutes for registry, tarball and attestation propagation.
+
+### Compatibility
+
+- Tested with DSH 0.2.1-rc.2 (`next`) and 0.2.1-alpha.5 (`alpha`) on cordis 4.0.5; CI adds a non-gating `next` column.
+
 ## [0.2.4]
 
 ### Added
@@ -97,7 +131,9 @@ All notable changes to this project are documented here. The format follows
   - The declarative component catalog (`ui_render`) and sandboxed streaming HTML widgets (`ui_render_widget`).
   - The `/ui` command and the guidance system-prompt section.
 
-[Unreleased]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.4...HEAD
+[Unreleased]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.6...HEAD
+[0.2.6]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.5...v0.2.6
+[0.2.5]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/compare/v0.2.1...v0.2.2

package/README.md

@@ -6,6 +6,7 @@
 
 [![CI](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/actions/workflows/ci.yml/badge.svg)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/deepseek-harness-intelligent-ui?color=4d6bfe&label=npm)](https://www.npmjs.com/package/deepseek-harness-intelligent-ui)
+[![npm downloads (last 18 months)](https://img.shields.io/npm/dt/deepseek-harness-intelligent-ui?color=22d3ee&label=npm%20downloads)](https://www.npmjs.com/package/deepseek-harness-intelligent-ui)
 [![DSH](https://img.shields.io/badge/DeepSeek%20Harness-0.1.7%20%E2%80%93%200.2.x-22d3ee)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md)
 [![Node](https://img.shields.io/badge/node-%E2%89%A5%2022.13-34d399)](https://nodejs.org)
 [![OS](https://img.shields.io/badge/OS-Windows%20%7C%20Linux%20%7C%20macOS-a78bfa)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md)
@@ -19,6 +20,10 @@ Generative, interactive UI for [DeepSeek Harness](https://github.com/deepseek-ai
 
 It ports the ideas of CopilotKit's [OpenIntelligentUI](https://github.com/CopilotKit/OpenIntelligentUI) (Open Generative UI + A2UI-style declarative components) onto DSH's own extension points. It needs no CopilotKit, LangGraph, or external router.
 
+### Third-party declarative components
+
+Trusted companion plugins can register versioned, namespaced components with shared Host/browser props validation, local React renderers and lifecycle controls. See the [extension API and runnable GitDiffViewer template](docs/component-extensions.md). Run `node examples/component-extension/serve.mjs` after building to try it.
+
 ## ✨ Highlights
 
 <table>
@@ -143,7 +148,7 @@ npx deepseek-harness-intelligent-ui doctor             # diagnose only
 |---|---|
 | Upgrade | `dsh plugin --profile web add deepseek-harness-intelligent-ui@latest` |
 | Try a prerelease (only when the `next` dist-tag exists) | `dsh plugin --profile web add deepseek-harness-intelligent-ui@next` |
-| Pin a version | `dsh plugin --profile web add deepseek-harness-intelligent-ui@0.2.4` |
+| Pin a version | `dsh plugin --profile web add deepseek-harness-intelligent-ui@0.2.6` |
 | Uninstall | `dsh plugin --profile web remove deepseek-harness-intelligent-ui` (or `npx deepseek-harness-intelligent-ui uninstall`) |
 | From a checkout | `dsh plugin --profile web add file:/path/to/deepseek-harness-intelligent-ui` |
 
@@ -166,7 +171,9 @@ npx deepseek-harness-intelligent-ui doctor             # diagnose only
 | `0.2.0-rc.1` | ✅ | ✅ |
 | `0.2.0-rc.2` (`latest`) | ✅ | ✅ |
 | `0.2.1-alpha.2` | ✅ | ✅ |
-| `0.2.1-alpha.4` (`alpha`) | ✅ | ✅ |
+| `0.2.1-alpha.4` | ✅ | ✅ |
+| `0.2.1-alpha.5` (`alpha`) | ✅ | ✅ |
+| `0.2.1-rc.2` (`next`) | ✅ | ✅ |
 
 CI runs the matrix on Windows, Linux and macOS, nightly too, so new DSH releases are caught early. Details: [docs/compatibility.md](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md).
 
@@ -202,7 +209,7 @@ The plugin injects a system-prompt section (`src/guidance.js`) that makes the mo
 
 A UI travels as a **flat node list with id references**, because DSH's tool-schema subset has no recursion. The Host validates it before acknowledging: unknown types or props, dangling or duplicate ids, cycles, two parents, chart length mismatches, `Plot` expressions that do not compile, slider defaults out of range, and so on. Problems come back as `ok:false` with paths, so the model can fix them and retry.
 
-`Math` and `Mermaid` render inside the same sandbox as widgets, loading KaTeX or Mermaid from the CDN allowlist. No third-party code runs in the DSH page and the host bundle stays small (~127 KB). If the CDN is unreachable, the source text is shown instead.
+`Math` and `Mermaid` render inside the same sandbox as widgets, loading KaTeX or Mermaid from the CDN allowlist. No third-party code runs in the DSH page. If the CDN is unreachable, the source text and a static fallback status are shown. An [optional offline resource package](docs/offline-resources.md) embeds locked KaTeX/fonts, Mermaid, Three.js/OrbitControls, D3, Chart.js and canvas-confetti without opening the sandbox network.
 
 ## 🔁 Updating a UI in place (`ui_patch`)
 
@@ -442,7 +449,7 @@ Automated checks cannot judge visual quality, so the report also carries a **sam
 
 ## Limitations
 
-- Widgets, Math and Mermaid need the CDN allowlist to be reachable. Offline, Math/Mermaid fall back to source text and `UI.three` reports a script error.
+- The default online package needs reachable CDN resources for Math/Mermaid and imported widget libraries. An [optional offline package](docs/offline-resources.md) supports Math, Mermaid and standard Three.js scenes; other addons, GSAP and external media remain unsupported offline. Library failures show an explicit static fallback or widget script error.
 - Persisted interaction state is per browser (`localStorage`), not synced across devices.
 - Matching a dropped (stopped-while-streaming) call to its turn uses the turn's start/end times. A large clock offset between a remote DSH host and the browser could hide that card. Calls that reached the session log are unaffected.
 
@@ -451,3 +458,7 @@ Automated checks cannot judge visual quality, so the report also carries a **sam
 Concepts, the streaming widget contract, and parts of the prompt guidance come from [CopilotKit/OpenIntelligentUI](https://github.com/CopilotKit/OpenIntelligentUI) (MIT). See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). Licensed under MIT.
 
 **Whale girl in the demo video.** The DeepSeek whale girl (鲸鱼娘) who narrates the demo, in 26 poses, is by [Sutera-Diffusus/dsh-whale-musume](https://github.com/Sutera-Diffusus/dsh-whale-musume) (MIT © Sutera-Diffusus; illustrations by [@SuteraWu](https://github.com/SuteraWu)). The unmodified files and their licence are in [`scripts/eval/demo/assets/whale/`](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/tree/main/scripts/eval/demo/assets/whale). They are not part of the npm package.
+
+## Controlled data and actions
+
+Table and Chart can share a scoped, read-only `dataRef` with local search/filter/sort/paging. Trusted host adapters can register schema-validated actions, with explicit user clicks, permission checks, write approval, and idempotent receipts. See [the integration guide and runnable example](docs/controlled-data-actions.md).

package/README.zh-CN.md

@@ -6,6 +6,7 @@
 
 [![CI](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/actions/workflows/ci.yml/badge.svg)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/deepseek-harness-intelligent-ui?color=4d6bfe&label=npm)](https://www.npmjs.com/package/deepseek-harness-intelligent-ui)
+[![npm 下载量（近 18 个月）](https://img.shields.io/npm/dt/deepseek-harness-intelligent-ui?color=22d3ee&label=npm%20downloads)](https://www.npmjs.com/package/deepseek-harness-intelligent-ui)
 [![DSH](https://img.shields.io/badge/DeepSeek%20Harness-0.1.7%20%E2%80%93%200.2.x-22d3ee)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md)
 [![Node](https://img.shields.io/badge/node-%E2%89%A5%2022.13-34d399)](https://nodejs.org)
 [![OS](https://img.shields.io/badge/OS-Windows%20%7C%20Linux%20%7C%20macOS-a78bfa)](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md)
@@ -25,6 +26,10 @@
 
 本插件把 CopilotKit [OpenIntelligentUI](https://github.com/CopilotKit/OpenIntelligentUI) 的思路（Open Generative UI + A2UI 风格声明式组件）移植到 DSH 自带的扩展点上，不依赖 CopilotKit、LangGraph 或外部路由服务。
 
+### 第三方声明式组件
+
+可信伴随插件可注册带版本和命名空间的组件，Host 与浏览器共用 props Schema，并支持本地 React 渲染、禁用和卸载。详见[扩展接口与可运行的 GitDiffViewer 模板](docs/component-extensions.md)。构建后运行 `node examples/component-extension/serve.mjs` 即可体验。模型输出不能注册或加载代码。
+
 ## ✨ 亮点
 
 <table>
@@ -149,7 +154,7 @@ npx deepseek-harness-intelligent-ui doctor             # 只诊断，不做修
 |---|---|
 | 升级 | `dsh plugin --profile web add deepseek-harness-intelligent-ui@latest` |
 | 试用预发布版（仅在存在 `next` 标签时） | `dsh plugin --profile web add deepseek-harness-intelligent-ui@next` |
-| 固定版本 | `dsh plugin --profile web add deepseek-harness-intelligent-ui@0.2.4` |
+| 固定版本 | `dsh plugin --profile web add deepseek-harness-intelligent-ui@0.2.6` |
 | 卸载 | `dsh plugin --profile web remove deepseek-harness-intelligent-ui`（或 `npx deepseek-harness-intelligent-ui uninstall`） |
 | 从源码目录安装 | `dsh plugin --profile web add file:/path/to/deepseek-harness-intelligent-ui` |
 
@@ -172,7 +177,9 @@ npx deepseek-harness-intelligent-ui doctor             # 只诊断，不做修
 | `0.2.0-rc.1` | ✅ | ✅ |
 | `0.2.0-rc.2`（`latest`） | ✅ | ✅ |
 | `0.2.1-alpha.2` | ✅ | ✅ |
-| `0.2.1-alpha.4`（`alpha`） | ✅ | ✅ |
+| `0.2.1-alpha.4` | ✅ | ✅ |
+| `0.2.1-alpha.5`（`alpha`） | ✅ | ✅ |
+| `0.2.1-rc.2`（`next`） | ✅ | ✅ |
 
 CI 每天定时在 Windows、Linux、macOS 上跑完整矩阵，DSH 一发新版就能发现问题。详见 [docs/compatibility.md](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/blob/main/docs/compatibility.md)。
 
@@ -212,7 +219,7 @@ CI 每天定时在 Windows、Linux、macOS 上跑完整矩阵，DSH 一发新版
 
 **传输与校验：** DSH 的工具 schema 不支持递归，所以界面以**扁平节点列表加 id 引用**的形式传输。Host 先校验再确认，检查项包括未知类型或属性；id 悬空、重复或成环；一个节点有多个父节点；图表数据长度不一致；`Plot` 表达式无法编译、参数默认值越界等。发现问题时返回 `ok:false` 并附带出错路径，模型据此修正后重试。
 
-**`Math` 与 `Mermaid` 的渲染：** 两者在与组件相同的沙箱中，从 CDN 白名单加载 KaTeX 或 Mermaid。第三方代码不在 DSH 页面中运行，宿主包体积保持在约 127 KB。CDN 不可用时，显示源码文本。
+**`Math` 与 `Mermaid` 的渲染：** 两者在与组件相同的沙箱中，从 CDN 白名单加载 KaTeX 或 Mermaid。第三方代码不在 DSH 页面中运行。CDN 不可用时，显示源码与明确的静态降级提示。[可选离线资源包](docs/offline-resources.md) 内置锁定版本的 KaTeX/字体、Mermaid、Three.js/OrbitControls、D3、Chart.js 和 canvas-confetti，无需开放沙箱网络。
 
 ## 🔁 原位增量更新（`ui_patch`）
 
@@ -432,7 +439,7 @@ GitHub 上的 **Real-model eval** 工作流可按需手动触发，使用仓库
 
 ## 已知限制
 
-- 沙箱组件、`Math` 和 `Mermaid` 需要能访问 CDN 白名单。离线时，`Math` 和 `Mermaid` 退回显示源码，`UI.three` 会报告脚本错误。
+- 默认在线包的公式、Mermaid 与组件导入库依赖可达 CDN。[可选离线资源包](docs/offline-resources.md) 支持公式、Mermaid 和标准 Three.js 场景；其他 Three.js 插件、GSAP、外部媒体不包含在内。资源失败会显示明确的静态降级或脚本错误。
 - 交互状态保存在当前浏览器的 `localStorage` 中，不跨设备同步。
 - 对“流式中途被丢弃的调用”，插件按回合的起止时间归属。如果远程 DSH 主机与浏览器的时钟偏差较大，这张卡片可能不显示。已进入会话日志的调用不受影响。
 
@@ -441,3 +448,7 @@ GitHub 上的 **Real-model eval** 工作流可按需手动触发，使用仓库
 概念、流式组件协议和部分提示词来自 [CopilotKit/OpenIntelligentUI](https://github.com/CopilotKit/OpenIntelligentUI)（MIT 许可）。本项目采用 MIT 许可。
 
 **演示视频中的鲸鱼娘。** 担任视频解说的 DeepSeek 鲸鱼娘（共 26 个姿态）来自 [Sutera-Diffusus/dsh-whale-musume](https://github.com/Sutera-Diffusus/dsh-whale-musume)（MIT © Sutera-Diffusus，立绘作者 [@SuteraWu](https://github.com/SuteraWu)）。原始文件及其许可证见 [`scripts/eval/demo/assets/whale/`](https://github.com/dreamfarer-space/deepseek-harness-intelligent-ui/tree/main/scripts/eval/demo/assets/whale)，不包含在 npm 包中。
+
+## 受控数据与结构化动作
+
+Table 与 Chart 可通过按会话/UI 隔离的只读 `dataRef` 共享数据，在本地完成搜索、筛选、排序和分页。可信宿主可注册经 Schema 验证的动作；执行要求用户明确点击、权限检查，写操作另需宿主确认，并提供幂等回执。详见[接入文档及可运行示例](docs/controlled-data-actions.md)。

package/THIRD_PARTY_NOTICES.md

@@ -31,3 +31,14 @@ https://github.com/Sutera-Diffusus/dsh-whale-musume
 26 unmodified illustrations in `scripts/eval/demo/assets/whale/` narrate the demo video and GIF in `docs/assets/real-model/`. They are not included in the npm package. The full licence text is in `scripts/eval/demo/assets/whale/LICENSE`.
 
 Copyright (c) 2026 Sutera-Diffusus. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, subject to the condition that the above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND.
+
+## Optional offline resource tarball
+
+The default online package does not embed the CDN libraries. The opt-in offline
+tarball includes KaTeX (0.16.11, MIT), Mermaid (11.4.1, MIT), Three.js (0.169.0,
+MIT), D3 (7.9.0, ISC), Chart.js (4.4.4, MIT), canvas-confetti (1.9.3, ISC), and
+locked transitive dependencies. Their complete upstream licenses, notices and
+package declarations ship under `offline-resources/licenses/`; the inventory,
+versions, integrity and file checksums are in `offline-resources/manifest.json`.
+GSAP is not embedded in the optional pack. See `docs/offline-resources.md` in the
+source repository for build and refresh instructions.

package/client/client.d.ts

@@ -0,0 +1,5 @@
+export * from '../src/catalog/browser.js';
+export const inject: string[];
+export function apply(ctx: any): void;
+export function promptSession(sessions: any, sessionId: string, text: string): Promise<void>;
+export function createControlledRuntime(sessionId: string): any;