release: ksadk-web 0.3.2 durable interaction and runtime v2 UI

CHANGELOG.md

@@ -1,7 +1,145 @@
 # Changelog
 
+## 0.3.2 - 2026-08-21
+
+Release candidate for the durable Interaction/v1 web experience. This is the
+reviewed source that replaces the internal beta sequence. Publication remains
+blocked on the current-digest cross-repository preproduction gate and uses the
+protected release workflow only after that gate is green.
+
+- Unify the Hosted UI composer with Studio's compact attachment, approval,
+  model, Goal, and Plan controls. The runtime's ordinary agent loop remains
+  internal rather than appearing as a third user-selectable mode; a future
+  eval-driven improvement loop must advertise its own honest capability.
+- Simplify the session list: completed runs no longer expose raw status text;
+  active sessions use a small activity ring and subtle background, while failed
+  sessions use a restrained error dot.
+- Keep RuntimeCapabilityMatrix decoding executable before the TypeScript build,
+  so the same fail-closed contract projection is covered by both browser tests
+  and the npm publication workflow's Node compatibility gate.
+
+## 0.3.2-beta.5 - 2026-08-21
+
+When the composer Interaction tray owns a pending approval, its tool-history
+row is now strictly read-only. This removes the second legacy approve/reject
+entry point while preserving the command arguments and terminal audit result.
+
+## 0.3.2-beta.4 - 2026-08-21
+
+Fixes the legacy Responses approval bridge: a pending approval is retained in
+the read-only tool history and also normalized into the unified Interaction
+tray immediately above the composer.  The submit still uses the compatible
+Responses approval transport when Interaction/v1 is unavailable.
+
+## 0.3.2-beta.3 - 2026-08-20
+
+Adds package-internal release provenance. Hosted UI and the preproduction gate
+can verify the resolved tarball's source basis and Interaction/v1 contract
+digest instead of trusting an external evidence label.
+
+## 0.3.2-beta.2 - 2026-08-20
+
+Rebuilt the immutable beta artifact from the complete Interaction/v1 source.
+This supersedes `0.3.2-beta.1`, whose vendored Hosted UI tarball predated the
+two fixes below.
+
+- Treat a successful `SubmitInteraction` receipt as durable acceptance, not as
+  proof that the framework execution has already completed its resolution.
+- Add the queue tray and read-only historical interaction anchors to the
+  published artifact, rather than leaving them only on the Web source branch.
+
+## 0.3.2-beta.1 - 2026-08-19
+
+> Unifies durable human-in-the-loop decisions behind one `Interaction/v1`
+> client. Counterpart of the agent-kernel Interaction/v1 contract: pending
+> approvals, structured inputs, and AG-UI interrupts normalize to a single
+> Interaction shape with one submit path (`SubmitInteraction`) with
+> revision CAS, idempotency keys, and first-wins terminal semantics.
+
+### Interaction/v1 (headless core)
+
+- New `src/core/interaction/` module: `InteractionClientImpl` + shared
+  `InteractionStore` with strict first-wins semantics (a terminal record
+  never regresses to pending), revision-based optimistic concurrency, and
+  an idempotency-key double-submit guard.
+- Transport adapters normalize three sources into the same Interaction:
+  Interaction/v1 SessionEvents (`interaction.requested` / `.resolved`,
+  rejection is `resolved.outcome="rejected"`, not a fifth event type),
+  Responses `mcp_approval_request`, and AG-UI interrupts. Components never
+  branch on the approval protocol.
+- New public API: `POST /agentengine/api/v1/SubmitInteraction`
+  (`submitInteraction` on `ApiFacade`), receipt decoded with the canonical
+  agent-kernel/v1 strict decoder. Pure `/v1/responses` clients keep the
+  official `mcp_approval_response` path.
+- Refresh/replay: session load replays recent durable SessionEvents into
+  the store so a pending Interaction is restored without creating a second
+  request; a double click, a stale tab, or a replayed history can never
+  duplicate a decision.
+
+### UI
+
+- `InteractionTray` renders above the composer with the current pending
+  item, pending count, and queue navigation; the composer input is
+  visually subordinated while a decision is pending.
+- `InteractionHistoryAnchor` replaces interactive historical approval
+  buttons with a read-only status retaining actor, decision time,
+  outcome, and a redacted response summary.
+- A2UI production wire locked to `0.9.1` with catalog digest validation
+  (`validateA2uiPresentation`). Unknown wire versions or catalog
+  mismatches fall back to the canonical JSON schema form, then to plain
+  approve/reject controls. A validation failure is never mapped to an
+  approval.
+- Expiry: interactions with a past `expires_at` disable submission
+  client-side and surface an expired notice.
+
+### Compatibility
+
+- Old servers without the `interaction_v1` capability keep the 0.3.1
+  Responses (`mcp_approval_response`) and AG-UI (`resumeAguiInterrupt`)
+  callbacks; the fallback is isolated in the adapters and the shared UI is
+  unchanged.
+- Public runtime bundle exports `InteractionClientImpl`, `Interaction`,
+  adapters, and `interactionIdempotencyKey`.
+
+### Supply chain
+
+- Refresh the lockfile's production transitive dependencies for the `0.3.2`
+  candidate: Mermaid/DOMPurify and PostCSS/nanoid now resolve to the patched
+  releases verified by `npm audit --omit=dev`.
+
+## 0.3.1 - 2026-08-12
+
+> Identity-aware runtime item reducer. Counterpart of the KsADK `0.8.1`
+> canonical RuntimeEvent(schema_version=2) release. Hosted UI and Studio must
+> ship this version (or later) to keep stream/replay output consistent with the
+> Python canonical pipeline.
+
+### Stream / session reducer
+
+- Introduce `RuntimeItemReducer` (`src/core/stream/runtime-items.ts`) as the
+  single canonical store for streaming output. It reduces identity-addressed
+  item operations into a per-run projection keyed by
+  `runId / scopeId / itemId / partId`, replacing the legacy v1 heuristic dedup
+  (`lastText` / per-agent accumulator / `startswith` / suffix overlap /
+  text hash).
+- Ingress adapters normalize three sources into the same item operations:
+  Responses SSE output item ids, session events `Metadata.RuntimeItem`, and
+  legacy server events (no identity) via synthesized
+  `${invocationId}:legacy-assistant`. `assistant_stream_snapshot` maps to
+  replace, `assistant_message` maps to complete. Nothing inspects body text
+  to decide identity.
+
+### Compatibility
+
+- Consumers tracking the KsADK `0.8.1` canonical RuntimeEvent must use this
+  identity-aware version. `0.3.0` used the v1 heuristic reducer and will
+  duplicate or drop output when paired with canonical v2 producers.
+
 ## 0.3.0 - 2026-07-29
 
+> Published baseline for Hosted runtime transport and the KsADK `0.8.0`
+> web integration.
+
 ### Hosted runtime transport
 
 - Add the official `@ag-ui/client` transport and capability-driven runtime

RELEASE_PROVENANCE.json

@@ -0,0 +1,7 @@
+{
+  "schema_version": 1,
+  "package": "@kingsoftcloud/ksadk-web",
+  "version": "0.3.2",
+  "source_commit": "2136448e038b4d8c475fa20e4722252b1ddb2ebc",
+  "interaction_contract_digest": "47e1003e03d97abeba232cc3e03a14b9cbcf78b1109870ccd2ce371f073b6211"
+}

e2e/agui.spec.mjs

@@ -45,7 +45,10 @@ function bootstrap() {
       Approval: true,
       Thinking: true,
       StopRun: true,
-      ResumeRun: true,
+      ResumeRun: false,
+      // The direct AG-UI HTTP stream is browser-attached: it is only
+      // selected when the agent does not require resumable runs.
+      RunLifecycle: { Enabled: false },
     },
     HostedChat: {
       PreferredTransport: 'ag-ui',
@@ -182,12 +185,19 @@ test('projects AG-UI activity, resumes approval, and replays terminal state', as
   await page.goto('/');
 
   await expect(page.getByText('AG-UI Fixture')).toBeVisible();
-  const composer = page.getByPlaceholder('发送消息...');
+  const composer = page.locator('textarea[placeholder^="发送消息"]');
   await composer.fill('请写入 demo.txt');
   await composer.press('Enter');
 
   await expect(page.getByText('E2E 状态卡')).toBeVisible();
-  await expect(page.locator('summary').filter({ hasText: '等待审批' })).toBeVisible();
+  // 0.3.2: the AG-UI interrupt is normalized into one durable
+  // Interaction — the tray carries the decision UI, the history anchor
+  // is read-only.
+  await expect(page.getByTestId('interaction-tray')).toBeVisible();
+  await expect(page.getByTestId('interaction-history-anchor')).toHaveAttribute(
+    'data-interaction-status',
+    'pending',
+  );
   await expect(page.getByRole('button', { name: '批准并继续' })).toBeVisible();
   await page.getByRole('button', { name: '批准并继续' }).click();
 
@@ -200,7 +210,10 @@ test('projects AG-UI activity, resumes approval, and replays terminal state', as
     },
   ]);
   await expect(page.getByText('审批已完成。')).toBeVisible();
-  await expect(page.locator('summary').filter({ hasText: '已批准' })).toBeVisible();
+  await expect(page.getByTestId('interaction-history-anchor')).toHaveAttribute(
+    'data-interaction-status',
+    'resolved',
+  );
 
   fixture.approved = true;
   await page.reload();