@floless/app 0.12.3 → 0.14.0

package/dist/floless-server.cjs

@@ -52609,7 +52609,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.12.3" : void 0,
+    define: true ? "0.14.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52619,7 +52619,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.12.3" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.14.0" : void 0 });
 }
 
 // oauth-presets.ts
@@ -52755,6 +52755,19 @@ function withBadge(report, opts) {
   return { ...report, html: injectBadge(report.html, opts) };
 }
 
+// report-html.ts
+function extractReportHtml(events) {
+  let found = null;
+  for (const ev of events) {
+    const data = ev?.data;
+    if (!data || typeof data !== "object") continue;
+    const result = data.result;
+    const html = typeof data.html === "string" ? data.html : result && typeof result.html === "string" ? result.html : null;
+    if (html) found = { nodeId: ev.node ?? null, html };
+  }
+  return found;
+}
+
 // index.ts
 var import_node_crypto6 = require("node:crypto");
 
@@ -53180,7 +53193,8 @@ function deriveTriggerProgress(events, sourceNodeId2) {
 }
 var defaultDeps = {
   start: (id, opts) => aware.startTrigger(id, opts),
-  onChange: (id, snapshot) => broadcast({ type: "trigger-session-changed", id, snapshot })
+  onChange: (id, snapshot) => broadcast({ type: "trigger-session-changed", id, snapshot }),
+  onReport: (id, workflow, report) => broadcast({ type: "trigger-report", id, workflow, nodeId: report.nodeId, html: report.html })
 };
 var sessions = /* @__PURE__ */ new Map();
 function isLive(s) {
@@ -53213,6 +53227,7 @@ function startSession(spec, deps = defaultDeps) {
   const emit = () => {
     if (current()) deps.onChange(spec.id, session.snapshot);
   };
+  let lastReportCount = 0;
   const handle = deps.start(spec.workflow, { inputs: spec.inputs });
   session.handle = handle;
   handle.onTrace((events) => {
@@ -53221,6 +53236,17 @@ function startSession(spec, deps = defaultDeps) {
     session.snapshot.firedCount = p.firedCount;
     session.snapshot.lastEvent = p.lastEvent;
     emit();
+    let reportCount = 0;
+    for (const ev of events) {
+      const d = ev?.data;
+      const r = d && d.result;
+      if (ev.kind === "node-output" && d && (typeof d.html === "string" || r && typeof r.html === "string")) reportCount++;
+    }
+    if (reportCount > lastReportCount) {
+      lastReportCount = reportCount;
+      const raw = extractReportHtml(events);
+      if (raw && raw.html) deps.onReport?.(spec.id, spec.workflow, withBadge(raw));
+    }
   });
   handle.onError((msg) => {
     if (!current()) return;
@@ -56812,17 +56838,6 @@ var WEB_ROOT = [(0, import_node_path20.join)(__dirname4, "web"), (0, import_node
 ) ?? (0, import_node_path20.join)(__dirname4, "..", "web");
 var PORT2 = Number(process.env.PORT ?? 4317);
 var HOST = "127.0.0.1";
-function extractReportHtml(events) {
-  let found = null;
-  for (const ev of events) {
-    const data = ev?.data;
-    if (!data || typeof data !== "object") continue;
-    const result = data.result;
-    const html = typeof data.html === "string" ? data.html : result && typeof result.html === "string" ? result.html : null;
-    if (html) found = { nodeId: ev.node ?? null, html };
-  }
-  return found;
-}
 var crashHandlersInstalled = false;
 function installCrashHandlers() {
   if (crashHandlersInstalled) return;

package/dist/skills/floless-app-workflows/SKILL.md

@@ -268,8 +268,15 @@ manifest edit + recompile, no engine. See the design doc for the Stage-1 plan.
     per-app cache (`lastReportByApp`), instantly, **no run**. If nothing has run yet, it shows a
     "click ▶ Run workflow" prompt (never a spinner). Do NOT make this trigger a run — a live run is
     ~15s and showing a spinner over stale content reads as "stuck".
-  - Rendered in a **sandboxed iframe `srcdoc`** (`sandbox="allow-same-origin"`, scripts
-    disabled). The UI never builds the HTML; it relays exactly what the exec returned.
+  - Rendered in a **sandboxed iframe `srcdoc`** (`sandbox="allow-same-origin allow-popups
+    allow-popups-to-escape-sandbox"`, **no `allow-scripts`** → static reports only). The UI never
+    builds the HTML; it relays exactly what the exec returned. **`allow-same-origin` is load-bearing —
+    never drop it:** without it the srcdoc gets an opaque origin, and Chrome (149+) does NOT repaint an
+    opaque-origin sandboxed srcdoc on the 2nd+ assignment — and `runReport` always clears `srcdoc=''`
+    first, so the report HTML is ALWAYS a 2nd assignment → **blank viewer**. Chromium that repaints
+    reassigned srcdoc (e.g. Playwright's bundled build, and the very first render) renders fine, which
+    masks the bug — verify report-viewer changes in real Chrome, not just Playwright. Regressed once
+    (09813c8 added badge popups but replaced the whole sandbox value, dropping the flag); restored.
   - **`Simulate` can't run an exec-data-carrying app**: stubs have no `result.<field>`, so the
     cross-node templates (`{{ bom.result.html }}`) render undefined and the run aborts
     (`template render: undefined value`, exit 3). `/api/run` returns that **in-band** (HTTP 200

package/dist/web/app.css

@@ -2059,6 +2059,27 @@ body {
 #report-close { font-size: 18px; line-height: 1; padding: 4px 10px; }
 .report-stage { position: relative; flex: 1; background: #0f172a; }
 #report-frame { width: 100%; height: 100%; border: 0; display: block; background: #0f172a; }
+
+/* Live "On trigger" report: a pulsing pip in the viewer subtitle + a brief edge
+   flash on the stage when a trigger routine (e.g. tekla-selection-report) pushes a
+   fresh report into the already-open viewer. Brand blue — within the baseline. */
+.live-pip {
+  display: inline-block; width: 7px; height: 7px; margin-right: 7px; border-radius: 999px;
+  background: #3b82f6; vertical-align: middle; animation: live-pip-pulse 1.8s ease-out infinite;
+}
+@keyframes live-pip-pulse {
+  0%   { box-shadow: 0 0 0 0 rgba(59, 130, 246, 0.5); }
+  70%  { box-shadow: 0 0 0 6px rgba(59, 130, 246, 0); }
+  100% { box-shadow: 0 0 0 0 rgba(59, 130, 246, 0); }
+}
+.report-live-pulse { animation: report-live-flash 0.6s ease-out; }
+@keyframes report-live-flash {
+  0%   { box-shadow: inset 0 0 0 2px rgba(59, 130, 246, 0.85); }
+  100% { box-shadow: inset 0 0 0 2px rgba(59, 130, 246, 0); }
+}
+@media (prefers-reduced-motion: reduce) {
+  .live-pip, .report-live-pulse { animation: none; }
+}
 .report-overlay {
   position: absolute; inset: 0; display: flex; align-items: center; justify-content: center;
   flex-direction: column; gap: 12px; background: rgba(7, 10, 15, 0.82);

package/dist/web/aware.js

@@ -1904,7 +1904,7 @@
       openNotesPopover({ component: 'app', version, anchorEl: $appUpdate, onUpdate: applyAppUpdate });
     };
     refreshUpdate();
-    setInterval(refreshUpdate, 6 * 60 * 60 * 1000); // re-check every 6h so a long-running window notices
+    setInterval(refreshUpdate, 60 * 60 * 1000); // hourly backstop; the focus re-check (below) is the fast path
   }
 
   // Dev-override helper — the ONLY forced-visible path. Reveals a pill with a fixed
@@ -2002,7 +2002,34 @@
       openNotesPopover({ component: 'aware', version, anchorEl: $awareUpdate, onUpdate: applyAwareUpdate });
     };
     refreshAwareUpdate();
-    setInterval(refreshAwareUpdate, 6 * 60 * 60 * 1000); // re-check every 6h
+    setInterval(refreshAwareUpdate, 60 * 60 * 1000); // hourly backstop; the focus re-check (below) is the fast path
+  }
+
+  // Re-check both update pills the instant the tab/window regains focus, so returning
+  // to a long-open tab surfaces a freshly-released version immediately instead of waiting
+  // out the hourly backstop poll above — the gap that used to make users hard-refresh (F5)
+  // to see a new release. Guards: only when the tab is actually visible (never poll for a
+  // backgrounded tab); throttled so rapid focus/blur — or the interval firing alongside —
+  // can't storm the feed; and skipped while a pill is mid-apply (disabled, "Updating…") so
+  // a focus event never stomps an in-flight update. Each refresh is already a no-op when its
+  // pill is absent (dev hides them unless force-flagged), so this is safe to wire whenever
+  // either pill exists.
+  if ($appUpdate || $awareUpdate) {
+    const UPDATE_FOCUS_THROTTLE_MS = 10 * 1000;
+    let lastUpdateCheck = Date.now(); // the on-load checks above just ran — don't immediately re-fire
+    const recheckUpdatesOnFocus = () => {
+      if (document.visibilityState !== 'visible') return;
+      // Offline: a failing fetch lands in refreshUpdate's catch and would briefly hide an
+      // already-shown pill — skip and let the next focus/interval (back online) re-check.
+      if (!navigator.onLine) return;
+      const now = Date.now();
+      if (now - lastUpdateCheck < UPDATE_FOCUS_THROTTLE_MS) return;
+      lastUpdateCheck = now;
+      if ($appUpdate && !$appUpdate.disabled) refreshUpdate();
+      if ($awareUpdate && !$awareUpdate.disabled) refreshAwareUpdate();
+    };
+    document.addEventListener('visibilitychange', recheckUpdatesOnFocus);
+    window.addEventListener('focus', recheckUpdatesOnFocus);
   }
 
   // The AWARE version label, once it's a notes affordance (post in-place upgrade),
@@ -2756,6 +2783,8 @@
         if (window.flolessPanels) window.flolessPanels.refreshData(); // routine runs also refresh bindings
       } else if (m.type === 'trigger-session-changed') {
         applyTriggerSnapshot(m.id, m.snapshot);
+      } else if (m.type === 'trigger-report') {
+        applyTriggerReport(m);
       } else if (m.type === 'connect-result') {
         // A run's credential-reconnect card may be waiting on this integration —
         // drive its success/fail state from the same SSE result.
@@ -3378,9 +3407,22 @@
     if (!r) { loadRoutinesData(); return; } // unknown id (created in another tab) → resync
     const prevFired = (r.session && r.session.firedCount) || 0;
     r.session = snapshot;
+    const fired = !!(snapshot && snapshot.firedCount > prevFired);
+    // A new fire lands a beat BEFORE its report (the source node-output streams
+    // first, then the exec runs ~1–3s and emits the report HTML). If the HTML
+    // Viewer is open for this app, show a "collecting…" spinner over the last
+    // report until applyTriggerReport paints the fresh one.
+    const viewerOpenForApp = currentId === r.workflow && $reportModal.classList.contains('show') && !reportRunning;
+    if (fired && viewerOpenForApp) {
+      showTriggerCollecting();
+    } else if (viewerOpenForApp && (snapshot.state === 'error' || snapshot.state === 'stopped') && $reportOverlay.querySelector('.spinner')) {
+      // The session ended before this fire produced a report — don't spin forever.
+      // Fall back to the last report if we have one, else an idle prompt.
+      clearTriggerCollecting();
+    }
     if (!$routinesModal.classList.contains('show')) return;
     renderRoutinesList();
-    if (snapshot && snapshot.firedCount > prevFired) flashRoutineRow(id);
+    if (fired) flashRoutineRow(id);
   }
 
   // Briefly tint a row when it just fired. Re-applies on rapid repeats via a forced
@@ -3394,6 +3436,59 @@
     el.classList.add('rtn-fired-flash');
   }
 
+  // A trigger routine (e.g. tekla-selection-report on each SelectionChange) just
+  // produced a fresh report. Always cache it (so opening the viewer shows the
+  // latest), and if the HTML Viewer is ALREADY open for THIS app, live-repaint it
+  // — the user asked to watch the report update on each selection change. We never
+  // auto-open the viewer, never hijack another app's open viewer, and never stomp
+  // an in-flight manual run. (The live repaint is another srcdoc assignment, so it
+  // depends on the report-frame `allow-same-origin` fix to repaint in Chrome.)
+  function applyTriggerReport(m) {
+    if (!m || !m.workflow || typeof m.html !== 'string') return;
+    lastReportByApp.set(m.workflow, { nodeId: m.nodeId || null, label: 'live · on selection change', html: m.html });
+    const open = $reportModal && $reportModal.classList.contains('show');
+    if (!open || currentId !== m.workflow || reportRunning) return;
+    paintReport(m.html); // unhides Share + clears the overlay
+    const t = new Date().toLocaleTimeString();
+    $reportSub.innerHTML =
+      `<span class="live-pip" aria-hidden="true"></span>Live &middot; updated ${escapeHtml(t)} &middot; on selection change — rendered from the node's output, never composed by the UI.`;
+    pulseReportFrame();
+  }
+
+  // Brief edge-flash on the report stage when a live update lands, so the change
+  // is noticeable. Forced reflow re-arms it on rapid repeats. CSS honors
+  // prefers-reduced-motion.
+  function pulseReportFrame() {
+    const stage = document.getElementById('report-stage');
+    if (!stage) return;
+    stage.classList.remove('report-live-pulse');
+    void stage.offsetWidth;
+    stage.classList.add('report-live-pulse');
+  }
+
+  // A trigger fired (new selection) but its report is still computing on the host.
+  // Show a spinner over the viewer — the previous report dims behind the overlay —
+  // until applyTriggerReport paints the fresh one. Built with DOM nodes (no
+  // innerHTML); reuses the same .spinner the manual run overlay uses.
+  function showTriggerCollecting() {
+    $reportOverlay.hidden = false;
+    $reportOverlay.replaceChildren();
+    const sp = mkEl('div', 'spinner');
+    const msg = mkEl('div', null, 'New selection — collecting report…');
+    $reportOverlay.append(sp, msg);
+  }
+
+  // The trigger session errored/stopped while a "collecting…" spinner was up (a
+  // fire whose report never arrived) — clear it instead of spinning forever:
+  // revert to the last cached report if there is one, else an idle prompt.
+  function clearTriggerCollecting() {
+    const cached = currentId && lastReportByApp.get(currentId);
+    if (cached && cached.html) { paintReport(cached.html); return; }
+    $reportOverlay.replaceChildren();
+    $reportOverlay.hidden = false;
+    $reportOverlay.append(mkEl('div', null, 'Listening for the next selection…'));
+  }
+
   function renderRoutinesList() {
     const $list = document.getElementById('routines-list');
     const $quota = document.getElementById('rtn-quota');

package/dist/web/index.html

@@ -295,11 +295,19 @@
         </div>
       </div>
       <div class="report-stage" id="report-stage">
-        <!-- allow-popups (+ escape): the report's own links — the "Made with FloLess"
-             badge above all — must open in a real, unsandboxed tab. Scripts stay
-             blocked and there is NO allow-same-origin: the report remains an opaque
-             origin with zero access to the app page. -->
-        <iframe id="report-frame" sandbox="allow-popups allow-popups-to-escape-sandbox" title="Report"></iframe>
+        <!-- sandbox flags, each load-bearing:
+             • allow-same-origin — REQUIRED. Without it the srcdoc document gets an
+               opaque origin, and Chrome (149+) fails to repaint an opaque-origin
+               sandboxed srcdoc on the 2nd+ assignment: every report after the first
+               render (and runReport always clears srcdoc='' first, so it's ALWAYS a
+               2nd assignment) shows blank. Dropping this flag was a regression in the
+               badge-popups change (09813c8) that replaced the whole sandbox value.
+               Verified blank in Chrome 149; fine in Chromium that repaints reassigned srcdoc.
+             • allow-popups (+ escape) — the report's own links (the "Made with FloLess"
+               badge) must open in a real, top-level tab.
+             Scripts stay BLOCKED (no allow-scripts), so even though the report is now
+             same-origin it has no JS to touch the app page — static reports only. -->
+        <iframe id="report-frame" sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox" title="Report"></iframe>
         <div class="report-overlay" id="report-overlay" hidden></div>
       </div>
     </div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.12.3",
+  "version": "0.14.0",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {