workpeg 0.94.3__tar.gz → 0.95.0__tar.gz

{workpeg-0.94.3/src/workpeg.egg-info → workpeg-0.95.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workpeg
-Version: 0.94.3
+Version: 0.95.0
 Summary: Workpeg function runtime and SDK
 Author-email: Workpeg <support@workpeg.com>
 License: MIT

{workpeg-0.94.3 → workpeg-0.95.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "workpeg"
-version = "0.94.3"
+version = "0.95.0"
 description = "Workpeg function runtime and SDK"
 readme = "README.md"
 requires-python = ">=3.10"

{workpeg-0.94.3 → workpeg-0.95.0}/src/workpeg/ui/runtime/scaffold.js

@@ -308,8 +308,8 @@
 
   // A built-in rail row (Search / Workpeg AI) — the same look as a host
   // NavItem: icon + fading label, the collapse re-centre via the padding var.
-  function navRow(iconName, label, href) {
-    return el("a", "wps-nav-row", {
+  function navRow(iconName, label, href, extraClass) {
+    return el("a", "wps-nav-row" + (extraClass ? " " + extraClass : ""), {
       attrs: { href: href, title: label },
       children: [
         icon(iconName, 18),
@@ -564,6 +564,16 @@
       "display:var(--wp-topnav-chat, none);align-items:center;"
       + "font-size:16px;font-weight:600;color:var(--color-text-primary)";
 
+    // "New chat" — only on an open conversation (/chats/<id>), a fresh-compose
+    // shortcut that starts a new chat without hunting for the sidebar row.
+    // Gated by STYLES on .pg-chat-route.wpai-chat-open (the same classes the
+    // runtime + ai.js already flip), so a scaffold.js CDN update delivers it
+    // out of band — no pegment var, no rebuild.
+    var newChat = el("div", "wps-newchat", { children: [
+      topAction("edit", "New chat", function () {
+        navigate(bizHref("/chats/new"));
+      })] });
+
     var history = el("div", "", { children: [
       topAction("history", "Chat history", function () {
         try { WP().toggleAIHistory(); } catch (e) { /* no runtime */ }
@@ -590,7 +600,7 @@
         el("div", "wps-topnav-row", { children: [
           el("div", "wps-topnav-left", { children: [hostWrap, chatTitle] }),
           el("div", "wps-topnav-actions", { children: [
-            history, spy, appsBtn, ai] })
+            newChat, history, spy, appsBtn, ai] })
         ] })
       ] });
     // Inline padding (not stylesheet) so pegment's .wpai-* !important
@@ -625,7 +635,19 @@
     // screens.
     var mid = el("div", "wps-side-mid", { children: [slots.nav] });
     var foot = el("div", "wps-foot");
-    var aiRow = navRow("sparkles", "Workpeg AI", bizHref("/chats/new"));
+    var aiRow = navRow("sparkles", "Workpeg AI", bizHref("/chats/new"),
+                       "wps-ai-row");
+    // On any /chats/* route this row IS the active surface (styled via
+    // .pg-chat-route in STYLES). A click must not reset an open conversation
+    // back to /chats/new — preventDefault so the runtime's link router skips
+    // navigating (it bails on defaultPrevented). Off the chat route the row
+    // navigates normally, opening a fresh chat.
+    aiRow.addEventListener("click", function (e) {
+      var de = document.documentElement;
+      if (de && de.classList && de.classList.contains("pg-chat-route")) {
+        e.preventDefault();
+      }
+    });
     var rail = el("div", "pg-container pg-container-sidebar wps-sidebar", {
       children: [
         el("div", "wps-side-col", { children: [
@@ -778,6 +800,10 @@
     "transition:padding-left 0.18s " + EASE + ";flex-shrink:0}",
     ".wps-nav-row:hover{background:var(--color-bg-active)}",
     ".wps-nav-row[aria-current=\"page\"]{background:var(--color-bg-active)}",
+    /* Workpeg AI stays active across the whole /chats/* surface, not just the
+       exact /chats/new href aria-current marks — driven by .pg-chat-route on
+       <html>, which the runtime flips on the reserved route. */
+    ":root.pg-chat-route .wps-ai-row{background:var(--color-bg-active)}",
     ".wps-nav-row .ti{color:var(--color-icon-primary);flex-shrink:0}",
     ".wps-nav-label{flex:1;min-width:0;overflow:hidden;white-space:nowrap;",
     "margin-left:8px;opacity:var(--pg-collapse-op);",
@@ -893,6 +919,9 @@
     ".wps-topnav-left{min-width:0;overflow:hidden;display:flex;",
     "align-items:center}",
     ".wps-topnav-actions{display:flex;align-items:center;gap:8px}",
+    /* New chat only shows on an open conversation (same state as History) */
+    ".wps-newchat{display:none}",
+    ":root.pg-chat-route.wpai-chat-open .wps-newchat{display:flex}",
     ".wps-chrome-btn{display:flex;align-items:center;justify-content:center;",
     "width:32px;height:32px;border-radius:var(--radius);cursor:pointer;",
     "flex-shrink:0;border:none;background:transparent;padding:0;",

{workpeg-0.94.3 → workpeg-0.95.0}/src/workpeg/ui/runtime/workpeg-runtime.js

@@ -157,6 +157,43 @@
   // target only Workpeg domains, resolve a path against apiBase, and send the
   // Peg-Namespace whoami header. workpeg.get/post/... in Python compile here.
 
+  // The workpeg.* endpoint allowlist. Being on a Workpeg host is necessary
+  // but no longer sufficient: a namespaced call must ALSO resolve to one of
+  // these sanctioned surfaces, so a Peg can't reach arbitrary platform
+  // endpoints (/v1/users/me/, another business's data, …) through this
+  // client. Each rule may pin the host's first label and/or a pathname regex;
+  // a call is allowed if it satisfies any rule. Matched against the
+  // URL-NORMALIZED pathname, so ".." can't tunnel out of an allowed prefix.
+  // Extend this list as new first-class surfaces are opened to Pegs.
+  Workpeg._wpAllowlist = [
+    // Tables & rows data API — a table, its rows, bulk-create, search and
+    // permissions all live under /v1/businesses/<biz>/tables/. The business
+    // segment may be empty (off a business page); the server rejects that,
+    // and it stays a tables-shaped URL either way.
+    { path: /^\/v1\/businesses\/[^/]*\/tables\// },
+    // The CDN — assets, pegment, bundles, peg media (any path).
+    { host: "cdn" },
+  ];
+
+  Workpeg._wpAllowedEndpoint = function (full) {
+    var u;
+    try {
+      u = new URL(full);
+    } catch (e) {
+      return false;
+    }
+    // First label of a Workpeg host (the caller has already vouched the host
+    // is ours), e.g. "cdn" of cdn.workpeg.com; pathname is normalized by URL.
+    var firstLabel = u.hostname.toLowerCase().split(".")[0];
+    for (var i = 0; i < Workpeg._wpAllowlist.length; i++) {
+      var rule = Workpeg._wpAllowlist[i];
+      if (rule.host && rule.host !== firstLabel) continue;
+      if (rule.path && !rule.path.test(u.pathname)) continue;
+      return true;
+    }
+    return false;
+  };
+
   Workpeg._wpBuildUrl = function (method, url) {
     var full = /^(https?:)?\/\//i.test(String(url))
       ? String(url)
@@ -167,6 +204,13 @@
         full + "); use http." + method.toLowerCase() + "() for the open web."
       );
     }
+    // …and only the allowlisted Workpeg surfaces (tables, rows, CDN).
+    if (!Workpeg._wpAllowedEndpoint(full)) {
+      throw new Error(
+        "workpeg." + method.toLowerCase() + "() may only reach the tables, " +
+        "rows and CDN endpoints, not " + full + "."
+      );
+    }
     return full;
   };
 

{workpeg-0.94.3 → workpeg-0.95.0/src/workpeg.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: workpeg
-Version: 0.94.3
+Version: 0.95.0
 Summary: Workpeg function runtime and SDK
 Author-email: Workpeg <support@workpeg.com>
 License: MIT