@floless/app 0.14.0 → 0.16.0

package/dist/floless-server.cjs

@@ -50969,6 +50969,13 @@ function readApp(id) {
     compilerVersion: typeof lockDoc["compiler-version"] === "string" ? lockDoc["compiler-version"] : null,
     agentPins
   };
+  const skillCache = /* @__PURE__ */ new Map();
+  const nodeSkill = (agent, command) => {
+    if (!agent || !command) return null;
+    const key = JSON.stringify([agent, command]);
+    if (!skillCache.has(key)) skillCache.set(key, readNodeSkill(agent, command));
+    return skillCache.get(key) ?? null;
+  };
   const srcNodes = Array.isArray(src.nodes) ? src.nodes : [];
   const nodes = srcNodes.map((n) => {
     const nid = String(n.id);
@@ -50984,7 +50991,8 @@ function readApp(id) {
       mode: lockMode === "write" || lockMode === "read" ? lockMode : "unknown",
       inputs: asRecord(locked?.inputs),
       config: asRecord(n.config),
-      notes: notes2
+      notes: notes2,
+      skill: nodeSkill(n.agent != null ? String(n.agent) : null, command)
     };
   });
   const layout = src.layout === "dag" ? "dag" : "linear";
@@ -51038,7 +51046,7 @@ function sourceNodeId(nodes, connections) {
   return nodes.find((n) => !hasIncoming.has(n.id))?.id ?? nodes[0].id;
 }
 function readCommandSpec(agent, command, agentsDir = AGENTS_DIR) {
-  const safe = (n) => !n.includes("/") && !n.includes("\\") && !n.includes("..");
+  const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
   if (!safe(agent) || !safe(command)) return null;
   const manifestPath = (0, import_node_path2.join)(agentsDir, agent, "manifest.yaml");
   if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
@@ -51065,6 +51073,55 @@ function readCommandSpec(agent, command, agentsDir = AGENTS_DIR) {
   });
   return { lifecycle, streaming, inputs };
 }
+function firstParagraph(s) {
+  if (typeof s !== "string") return "";
+  return (s.trim().split(/\n\s*\n/)[0] ?? "").replace(/\s+/g, " ").trim();
+}
+function parseManifestInputs(raw) {
+  return Object.entries(asRecord(raw)).map(([name, spec]) => {
+    const s = typeof spec === "string" ? { type: spec } : asRecord(spec);
+    const input = {
+      name,
+      type: typeof s.type === "string" ? s.type : "string",
+      default: "default" in s ? s.default : null,
+      description: typeof s.description === "string" ? s.description : ""
+    };
+    if (Array.isArray(s.values)) input.values = s.values.map(String);
+    return input;
+  });
+}
+function readNodeSkill(agent, command, agentsDir = AGENTS_DIR) {
+  const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
+  if (!safe(agent) || !safe(command)) return null;
+  const manifestPath = (0, import_node_path2.join)(agentsDir, agent, "manifest.yaml");
+  if (!(0, import_node_fs3.existsSync)(manifestPath)) return null;
+  let doc;
+  try {
+    doc = asRecord((0, import_yaml.parse)((0, import_node_fs3.readFileSync)(manifestPath, "utf8")));
+  } catch {
+    return null;
+  }
+  const cmd = asRecord(asRecord(doc.commands)[command]);
+  if (Object.keys(cmd).length === 0) return null;
+  const outRec = asRecord(cmd.outputs);
+  const outputs = typeof outRec.type === "string" ? {
+    type: outRec.type,
+    schema: Object.fromEntries(
+      Object.entries(asRecord(outRec.schema)).map(([k, v]) => [k, String(v)])
+    )
+  } : null;
+  return {
+    agent,
+    agentDisplayName: typeof doc["display-name"] === "string" ? doc["display-name"] : agent,
+    agentDescription: firstParagraph(doc.description),
+    homepage: typeof doc.homepage === "string" ? doc.homepage : null,
+    capabilities: Object.keys(asRecord(doc.requires)),
+    command,
+    commandDescription: firstParagraph(cmd.description),
+    inputs: parseManifestInputs(cmd.inputs),
+    outputs
+  };
+}
 function detectTriggerSource(nodes, connections, lookup) {
   const srcId = sourceNodeId(nodes, connections);
   if (!srcId) return null;
@@ -51096,7 +51153,7 @@ function listIntegrations() {
   if (!(0, import_node_fs3.existsSync)(AGENTS_DIR)) return [];
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const safe = (n) => !n.includes("/") && !n.includes("\\") && !n.includes("..");
+  const safe = (n) => !/[/\\\0]/.test(n) && !n.includes("..");
   for (const agentId of (0, import_node_fs3.readdirSync)(AGENTS_DIR)) {
     if (!safe(agentId)) continue;
     const manifestPath = (0, import_node_path2.join)(AGENTS_DIR, agentId, "manifest.yaml");
@@ -52609,7 +52666,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.14.0" : void 0,
+    define: true ? "0.16.0" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52619,7 +52676,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.14.0" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.16.0" : void 0 });
 }
 
 // oauth-presets.ts
@@ -53211,6 +53268,9 @@ function hostRunBlocked(agent, agentsDir) {
   if (!hostWatcherActive()) return null;
   return "a host watcher is live for this host \u2014 stop it before running manually (one live model = one consumer)";
 }
+function foregroundSessionId(appId) {
+  return `__run__:${appId}`;
+}
 function startSession(spec, deps = defaultDeps) {
   if (spec.hostBacked && hostWatcherActive(spec.id)) {
     return { ok: false, reason: "another host watcher is live \u2014 stop it first (one live model = one watcher)" };
@@ -53883,6 +53943,8 @@ function isGatedAwareRoute(url, method) {
   if (path === "/api/routines" || path.startsWith("/api/routines/")) {
     return m === "POST" || m === "PATCH";
   }
+  if (path.startsWith("/api/trigger-run/")) return false;
+  if (path === "/api/trigger-run") return m === "POST";
   return AWARE_ROUTES.some((p) => path.startsWith(p));
 }
 
@@ -57363,6 +57425,42 @@ async function startServer() {
     const running = cancelActiveRun();
     return { ok: true, running };
   });
+  app.post(
+    "/api/trigger-run",
+    async (req, reply) => {
+      const { id, inputs } = req.body ?? {};
+      if (!id) return reply.status(400).send({ ok: false, error: "id required" });
+      let appSpec;
+      try {
+        appSpec = readApp(id);
+      } catch (err) {
+        if (err instanceof AppNotFoundError) return reply.status(404).send({ ok: false, error: "app not found" });
+        throw err;
+      }
+      if (!appSpec.triggerSource) {
+        return reply.status(400).send({ ok: false, error: "not a streaming workflow \u2014 use \u25B6 Run for a one-shot" });
+      }
+      if (!appSpec.runnable) {
+        return reply.send({ ok: false, error: "needs Compile \u2014 Run is gated on a fresh lock", blocked: true });
+      }
+      const sessionId = foregroundSessionId(id);
+      const res = startSession({
+        id: sessionId,
+        workflow: id,
+        sourceNodeId: appSpec.triggerSource.nodeId,
+        hostBacked: isHostBacked(appSpec.triggerSource.agent),
+        inputs
+      });
+      if (!res.ok) return reply.send({ ok: false, error: res.reason, blocked: true });
+      return { ok: true, sessionId };
+    }
+  );
+  app.post("/api/trigger-run/:id/stop", async (req, reply) => {
+    const id = req.params.id;
+    if (!/^[A-Za-z0-9._-]+$/.test(id)) return reply.status(400).send({ ok: false, error: "invalid app id" });
+    await stopSession(foregroundSessionId(id));
+    return { ok: true };
+  });
   app.get("/api/latest-run/:id", async (req, reply) => {
     const id = req.params.id;
     if (!/^[A-Za-z0-9._-]+$/.test(id)) {

package/dist/skills/floless-app-workflows/SKILL.md

@@ -258,6 +258,26 @@ manifest edit + recompile, no engine. See the design doc for the Stage-1 plan.
   it renders the returned `html` in the HTML Viewer and caches it; otherwise it fills the Execution
   trace. The secondary **`Simulate`** header button is `simulate:true` (every node stubbed from its
   output-schema, no host) — a composition check.
+- **▶ Run on a STREAMING/watch app = a LIVE FOREGROUND session** (not the finite run). When the
+  open app's source node is a `lifecycle:start` watch (`app.triggerSource != null`), the finite
+  `/api/run` never completes (a stream doesn't end → 60 s timeout). Instead Run starts an
+  **ephemeral** trigger session — `POST /api/trigger-run {id,inputs}` / `POST
+  /api/trigger-run/:id/stop` — that re-renders the report in the HTML Viewer on **every** fired
+  event (e.g. each Tekla selection change) until Stop, reusing the background-routine machinery
+  (`server/trigger-sessions.ts`: long-lived `aware app run` OUTSIDE the run lock, host-exclusivity
+  guard, per-event report HTML on the `trigger-report` SSE). The session id is namespaced
+  `foregroundSessionId()` → `__run__:<app>` so it can't collide with a routine id in the shared SSE
+  id space; `route-gate` gates the spawning POST and exempts the `/stop` teardown. Per-event repaint
+  reuses the existing `applyTriggerReport`→`paintReport` path (gated on `workflow === currentId`) —
+  **zero** new render plumbing. The watch node's `once:true` (AWARE `tekla.watch` input) makes the
+  same session fire once then exit ("Run complete"); `once:false` (default) streams continuously.
+  **Two UI gotchas a real Playwright pass caught (inference missed both):** (1) the always-on header
+  **■ Stop run is OCCLUDED by the report-modal backdrop**, so a live session shown in the Viewer
+  needs its OWN reachable Stop — the in-modal `#report-stop` (`web/index.html` action row,
+  warn-toned); (2) `paintGate()` recomputes Run-disabled / Stop-hidden on **every** gate repaint
+  (an fs-change → `loadApp` mid-session repaints), so it MUST include the live-session flag
+  (`foregroundTrigger`) exactly like `syncRunControls`, or a repaint re-arms Run and hides Stop
+  while the watcher is still live.
 - **Per-node run status on the canvas + a Stop button.** During a run each node card paints
   running → ✓ done / ✗ failed from the trace (`pushTrace`), and the report-run overlay shows a
   **Stop** button. See `references/dev-server-and-run-trace.md` for the trace event kinds, the live

package/dist/web/app.css

@@ -46,7 +46,10 @@
     grid-template-rows: 60px 1fr 44px;
     --left-width: 340px;
     --right-width: 420px;
-    grid-template-columns: var(--left-width) 1fr var(--right-width);
+    /* minmax(0, 1fr) (not the default minmax(auto, 1fr)) lets the center column
+       shrink below its content's min-size, so a wide center never blows the grid
+       past the viewport. See min-width:0 on the three areas below. */
+    grid-template-columns: var(--left-width) minmax(0, 1fr) var(--right-width);
     grid-template-areas:
       "header  header  header"
       "chat    canvas  inspect"
@@ -104,8 +107,15 @@
     justify-content: space-between;
     padding: 0 18px;
     border-bottom: 1px solid var(--border);
+    /* Let the header's flex children shrink rather than force the whole grid wider
+       than the viewport (the old cause of a page-wide horizontal scrollbar): the
+       workflow picker truncates first (down to its 220px floor), the run spine
+       compresses only slightly after that, and a scrollbar — never off-screen
+       clipping of the run buttons — is the final fallback at tiny widths (#53). */
+    min-width: 0;
   }
-  .header-left { display: flex; align-items: center; gap: 10px; }
+  /* Brand + view-toggle stay full size; .controls is the shrink sink instead. */
+  .header-left { display: flex; align-items: center; gap: 10px; flex-shrink: 0; }
   .brand { display: flex; align-items: center; gap: 12px; }
   .brand .mark {
     display: inline-flex;
@@ -119,7 +129,7 @@
   .brand .mark .mark-node { fill: var(--bg); }
   .brand .name { font-size: 15px; font-weight: 700; letter-spacing: 0.08em; }
   .brand .tag { font-size: 11px; color: var(--text-dim); text-transform: uppercase; letter-spacing: 0.12em; }
-  .controls { display: flex; align-items: center; gap: 10px; }
+  .controls { display: flex; align-items: center; gap: 10px; min-width: 0; }
   /* Vertical divider separating "which workflow + reference" from the run spine
      (state → Compile → Simulate → Run). Uses the existing border token. */
   .ctl-sep { width: 1px; height: 20px; background: var(--border-strong); flex: none; }
@@ -236,6 +246,7 @@
     display: flex;
     flex-direction: column;
     overflow: hidden;
+    min-width: 0;
     position: relative;
   }
   .host-banner {
@@ -326,6 +337,7 @@
     display: flex;
     flex-direction: column;
     overflow: hidden;
+    min-width: 0;
     position: relative;
   }
   /* While middle-mouse panning, force the grab cursor over the whole canvas. */
@@ -738,6 +750,7 @@
     display: flex;
     flex-direction: column;
     overflow: hidden;
+    min-width: 0;
     position: relative;
   }
   .tabs {
@@ -1416,10 +1429,13 @@
   #rtn-delete-confirm:hover { color: var(--err); border-color: var(--err); background: color-mix(in srgb, var(--err) 10%, transparent); }
 
   /* ========== WORKFLOW COMBOBOX (searchable, provider-grouped) ========== */
-  .wf-combo { position: relative; display: inline-flex; }
+  /* Shrinkable in the header flex row: prefers ~300px, but flex-shrink lets it
+     give space back down to a 220px floor (min-width) when the header is tight,
+     so the run spine never overflows the viewport. The name ellipsizes within. */
+  .wf-combo { position: relative; display: inline-flex; flex: 0 1 300px; min-width: 220px; }
   .wf-trigger {
     display: inline-flex; align-items: center; gap: 8px;
-    min-width: 300px; max-width: 400px;
+    min-width: 0; width: 100%;
     background: var(--surface-2); color: var(--text);
     border: 1px solid var(--border-strong); border-radius: 4px;
     padding: 7px 12px; font-family: var(--ui); font-size: 12px; cursor: pointer;
@@ -2041,6 +2057,20 @@ body {
 .kv td { font-family: var(--mono); color: var(--text); word-break: break-word; }
 .kv tr + tr th, .kv tr + tr td { border-top: 1px solid var(--border); }
 
+/* Skill tab (Inspect): capability/mode pills mirror the notes-strip .note-kind
+   pill, and the agent docs link uses the accent — existing tokens only, no new
+   palette (issue #54). */
+.inspect-content .cap-badge {
+  display: inline-block; font-size: 9px; text-transform: uppercase; letter-spacing: 0.06em;
+  color: var(--info); border: 1px solid color-mix(in srgb, var(--info) 35%, transparent);
+  border-radius: 3px; padding: 0 5px; margin: 0 2px; vertical-align: 1px;
+}
+.inspect-content .cap-badge.write { color: var(--warn); border-color: color-mix(in srgb, var(--warn) 40%, transparent); }
+/* Breathing room above the docs link — it follows a schema table (no margin-bottom). */
+.inspect-content .skill-docs-row { margin-top: 8px; }
+.inspect-content .skill-docs { color: var(--accent); text-decoration: none; }
+.inspect-content .skill-docs:hover { text-decoration: underline; }
+
 /* ── HTML Viewer (report) modal ─────────────────────────────────────────────── */
 .modal.report-viewer {
   width: 1180px; max-width: 94vw; height: 86vh;
@@ -2056,6 +2086,10 @@ body {
 .report-actions button { padding: 6px 12px; }
 .report-actions button.ghost { background: var(--surface-3); color: var(--text-muted); }
 .report-actions button.ghost:hover { color: var(--text); border-color: var(--accent-dim); }
+/* The in-modal live-session Stop reads as a stop (warn-toned), matching the header
+   ■ Stop run — not a neutral ghost link like Share/Open. Existing --warn token only. */
+.report-actions button.report-stop { background: transparent; color: var(--warn); border: 1px solid color-mix(in srgb, var(--warn) 45%, transparent); font-weight: 600; letter-spacing: 0.04em; }
+.report-actions button.report-stop:hover { background: color-mix(in srgb, var(--warn) 16%, transparent); border-color: var(--warn); color: var(--text); }
 #report-close { font-size: 18px; line-height: 1; padding: 4px 10px; }
 .report-stage { position: relative; flex: 1; background: #0f172a; }
 #report-frame { width: 100%; height: 100%; border: 0; display: block; background: #0f172a; }

package/dist/web/app.js

@@ -354,7 +354,7 @@ function cardEl(id, ports) {
   `;
   div.onclick = (e) => {
     if (e.target.closest('.fav-btn')) return;
-    selectAgent(id);
+    selectAgent(id, { reveal: true }); // clicking the card (incl. "inspect ▸") opens the panel if collapsed
   };
   div.querySelector('.fav-btn').onclick = (e) => {
     e.stopPropagation();
@@ -379,13 +379,26 @@ function wireEl(idx, label) {
   return wrap;
 }
 
-function selectAgent(id) {
+// `reveal` is set by USER-initiated selections (clicking a node card / the
+// "inspect ▸" hint / a favorite chip). When the Inspect panel is collapsed those
+// would otherwise give zero visible feedback — the panel quietly re-renders behind
+// the rail (issue #52) — so a revealing selection also expands it. Programmatic /
+// initial selection (on render) passes no reveal, so a saved collapsed preference
+// is respected on load.
+function selectAgent(id, { reveal = false } = {}) {
   state.selectedAgentId = id;
   document.querySelectorAll('.agent-card').forEach(c => {
     c.classList.toggle('selected', c.dataset.agentId === id);
   });
   const a = AGENTS[id];
   if (a) $inspectRole.textContent = a.title.toLowerCase();
+  if (reveal && state.collapse.right) {
+    // Momentary reveal — expand the panel for THIS interaction but do NOT persist:
+    // the user collapsed it deliberately, so a single inspect must not overwrite
+    // that saved preference (only an explicit toggle/drag does). UX review on #52.
+    state.collapse.right = false;
+    applyCollapse();
+  }
   renderInspect();
 }
 
@@ -624,7 +637,7 @@ function renderFavBar() {
       const id = chip.dataset.favAgent;
       const p = PROMPTS[state.promptKey];
       if (nodeIds(p).includes(id)) {
-        selectAgent(id);
+        selectAgent(id, { reveal: true });
       } else {
         chip.style.borderColor = 'var(--warn)';
         setTimeout(() => chip.style.borderColor = '', 600);

package/dist/web/aware.js

@@ -24,6 +24,7 @@
   const $reportOpen = document.getElementById('report-open');
   const $reportShare = document.getElementById('report-share');
   const $reportClose = document.getElementById('report-close');
+  const $reportStop = document.getElementById('report-stop');
   const $stopRunBtn = document.getElementById('stop-run-btn');
 
   // One persistent array the inspect Execution tab reads; we mutate in place so
@@ -143,6 +144,47 @@
       .join('')}</table>`;
   }
 
+  // Plain-text summary of one declared command input (for the Skill tab's inputs
+  // table — kvTable escapes it, so this stays text, no markup): "type (enum vals)
+  // · default X — description".
+  function inputSummary(i) {
+    let s = i.type || 'string';
+    if (i.values && i.values.length) s += ` (${i.values.join(' · ')})`;
+    if (i.default !== null && i.default !== undefined && i.default !== '') {
+      s += ` · default ${typeof i.default === 'string' ? i.default : JSON.stringify(i.default)}`;
+    }
+    if (i.description) s += ` — ${i.description}`;
+    return s;
+  }
+
+  // Inspect → Skill tab body. Rich when the agent manifest is installed (n.skill):
+  // what the agent + command do, capabilities, the command's DECLARED inputs and
+  // output schema, and a docs link. Falls back to the lock-pointer summary for
+  // exec/agent-less nodes or an uninstalled agent. DISPLAY of manifest data only —
+  // every file-derived string is escaped (kvTable/escapeHtml), never injected raw.
+  function skillBody(n, fallback, notesHtml) {
+    const sk = n.skill;
+    if (!sk) return fallback; // fallback already carries notesHtml
+    const modeBadge = `<span class="cap-badge${n.mode === 'write' ? ' write' : ''}">${escapeHtml(n.mode)}</span>`;
+    const capBadges = sk.capabilities.map((c) => `<span class="cap-badge">${escapeHtml(c)}</span>`).join(' ');
+    const inputsObj = Object.fromEntries(sk.inputs.map((i) => [i.name, inputSummary(i)]));
+    const docs = sk.homepage && /^https?:\/\//i.test(sk.homepage)
+      ? `<p class="skill-docs-row"><a class="skill-docs" href="${escapeHtml(sk.homepage)}" target="_blank" rel="noopener">Agent documentation ↗</a></p>`
+      : '';
+    const outputs = sk.outputs
+      ? `<p><strong>Returns</strong> · ${escapeHtml(sk.outputs.type)}</p>${Object.keys(sk.outputs.schema).length ? kvTable(sk.outputs.schema) : ''}`
+      : '';
+    return `
+      <h3>${escapeHtml(sk.agentDisplayName)}</h3>
+      ${sk.agentDescription ? `<p>${escapeHtml(sk.agentDescription)}</p>` : ''}
+      <h3>Command · <code>${escapeHtml(sk.command)}</code></h3>
+      ${sk.commandDescription ? `<p>${escapeHtml(sk.commandDescription)}</p>` : ''}
+      <p><strong>Mode</strong> ${modeBadge}${capBadges ? ' · <strong>Requires</strong> ' + capBadges : ''}</p>
+      <p><strong>Accepts</strong></p>${Object.keys(inputsObj).length ? kvTable(inputsObj) : '<p class="dim-note">No declared inputs.</p>'}
+      ${outputs}
+      ${docs}${notesHtml || ''}`;
+  }
+
   // Dependency-free C# highlighter for the Code tab. Single-pass scanner that
   // handles comments/strings/chars BEFORE keywords (so keywords inside strings
   // aren't recolored), escapes every token's text, and reuses the demo's token
@@ -249,8 +291,14 @@
       subtitle: `${agentLabel}${cmd ? '/' + cmd : ''} · ${mode}`,
       blurb: n.notes[0] ? escapeHtml(humanizeNote(n.notes[0].text)) : `${mode}-mode ${cmd ? '<code>' + cmd + '</code>' : escapeHtml(n.kind)} node`,
       description: `${plainDesc ? `<p>${escapeHtml(plainDesc)}</p>` : ''}<p>Resolves to ${modeBadge} via <code>${escapeHtml(n.agent || n.kind)}${n.command ? '.' + escapeHtml(n.command) : ''}</code>.</p>${Object.keys(inputsNoCode).length ? `<p><strong>Inputs</strong></p>${kvTable(inputsNoCode)}` : ''}${execSource ? `<p class="dim-note">Full source in the <strong>Code</strong> tab.</p>` : ''}${notesHtml}`,
-      skill: `<h3>Provided by</h3><p><code>${escapeHtml(n.agent || n.kind)}</code>${pin ? ' · pinned <code>v' + escapeHtml(pin) + '</code>' : ''}${n.command ? ' · command <code>' + escapeHtml(n.command) + '</code>' : ''}</p>
+      // Rich agent/command detail when the manifest is installed (n.skill); else
+      // the lock-pointer fallback below (exec/agent-less nodes, uninstalled agents).
+      skill: skillBody(
+        n,
+        `<h3>Provided by</h3><p><code>${escapeHtml(n.agent || n.kind)}</code>${pin ? ' · pinned <code>v' + escapeHtml(pin) + '</code>' : ''}${n.command ? ' · command <code>' + escapeHtml(n.command) + '</code>' : ''}</p>
         <p>Resolved write/read mode is part of the approved <code>.lock</code> — see the <strong>Code</strong> tab.</p>${notesHtml}`,
+        notesHtml,
+      ),
       // Code tab: the REAL node source. For exec nodes (Roslyn C# run against a
       // live host) that's `config.code` straight from the .flo — the same text
       // the host compiles, so "Debug in VS" attaches to exactly this. For
@@ -330,8 +378,13 @@
 
     // Keep Run disabled (and the header Stop shown) if a gate re-paint lands mid-run (#39) —
     // never let a re-render re-arm Run while a run is still in flight.
-    $runBtn.disabled = !app.runnable || reportRunning || state.running;
-    if ($stopRunBtn) $stopRunBtn.hidden = !(reportRunning || state.running);
+    // …including a live foreground trigger session (▶ Run on a streaming app): a
+    // gate repaint mid-session (e.g. an fs-change → loadApp) must not re-arm Run or
+    // hide the Stop while the watcher is still live. The in-modal Stop tracks the
+    // same state (it's the reachable Stop while the Viewer covers the header one).
+    $runBtn.disabled = !app.runnable || reportRunning || state.running || !!foregroundTrigger;
+    if ($stopRunBtn) $stopRunBtn.hidden = !(reportRunning || state.running || foregroundTrigger);
+    if ($reportStop) $reportStop.hidden = !foregroundTrigger;
     $runBtn.dataset.tip = app.runnable
       ? 'Run the approved workflow'
       : app.runState === 'drift'
@@ -911,6 +964,16 @@
   // double-click LOAD the last result instantly instead of re-running.
   const lastReportByApp = new Map();
 
+  // A live FOREGROUND trigger session — ▶ Run on a streaming/watch app (one whose
+  // source is a lifecycle:start watch). The finite run can't complete for a stream,
+  // so Run hosts a live session that re-renders the report in the Viewer on every
+  // fired event until Stop. `{ appId, sessionId, firedCount }` while live, else null.
+  // Distinct from a background routine (⏱ Routines) and the finite report run
+  // (reportRunning). Its session id is server-namespaced with this prefix so its SSE
+  // snapshots route here, never to the Routines list.
+  const FG_SESSION_PREFIX = '__run__:';
+  let foregroundTrigger = null;
+
   // Reflect run-in-flight state in the ALWAYS-VISIBLE header so a run is stoppable even
   // when the HTML Viewer modal is closed (#39). The header ■ Stop run appears for the whole
   // duration of either run path (the modal run `reportRunning` and the inline run
@@ -919,7 +982,10 @@
   // the user, on the modal's × tooltip, that closing leaves the run going (Stop is in the
   // header) — the canvas keeps showing progress (markCanvasRunning), by design.
   function syncRunControls() {
-    const running = reportRunning || state.running;
+    const running = reportRunning || state.running || !!foregroundTrigger;
+    // The in-modal Stop is reachable only for a live foreground session (the header
+    // Stop is occluded by the report-modal backdrop). Show it while one is live.
+    if ($reportStop) $reportStop.hidden = !foregroundTrigger;
     if ($stopRunBtn) {
       $stopRunBtn.hidden = !running;
       // Reset to a fresh, clickable Stop each run; stopRun() flips it to "Cancelling…".
@@ -945,7 +1011,22 @@
   // pulse, and asks the server to kill the `aware app run` child. The in-flight
   // /api/run then rejects via api() and the catch renders the cancelled state.
   async function stopRun() {
-    if (!reportRunning && !state.running) return;
+    if (!reportRunning && !state.running && !foregroundTrigger) return;
+    // A live foreground session ends via its own stop route (it runs outside the
+    // run lock, so /api/run/stop would no-op). Clear the flag first so the late
+    // `stopped` SSE snapshot is a harmless no-op rather than a double-handle.
+    if (foregroundTrigger) {
+      const ft = foregroundTrigger;
+      foregroundTrigger = null;
+      if ($stopRunBtn) { $stopRunBtn.disabled = true; $stopRunBtn.textContent = 'Stopping…'; }
+      const ovStop = document.querySelector('.overlay-stop');
+      if (ovStop) { ovStop.disabled = true; ovStop.textContent = 'Stopping…'; }
+      try { await api(`/api/trigger-run/${encodeURIComponent(ft.appId)}/stop`, { method: 'POST' }); } catch { /* best effort — the session may already be gone */ }
+      // A deliberate stop needs no toast — the subtitle change is the confirmation.
+      paintForegroundStopped('stopped');
+      syncRunControls();
+      return;
+    }
     cancelRequested = true;
     clearNodeStatus();
     // Reflect "cancelling" on BOTH Stop surfaces — the in-modal overlay and the header.
@@ -1308,6 +1389,10 @@
   });
 
   $reportClose.onclick = () => hideModal($reportModal);
+  // The in-modal Stop for a live foreground session: the always-on header Stop sits
+  // BEHIND the report modal's backdrop, so a session shown in the Viewer needs its
+  // own reachable Stop. Visibility is driven by syncRunControls (foregroundTrigger).
+  if ($reportStop) $reportStop.onclick = () => stopRun();
   $reportModal.addEventListener('click', (e) => { if (e.target === $reportModal) hideModal($reportModal); });
   // The Stop button is rebuilt into the overlay each run — delegate so one
   // listener survives every innerHTML swap.
@@ -2127,7 +2212,12 @@
     const app = currentId && apps.get(currentId);
     if (!app) return;
     if (!app.runnable) { showToast($runBtn.dataset.tip, 'warn'); return; }
-    if (state.running || reportRunning) return;
+    if (state.running || reportRunning || foregroundTrigger) return;
+
+    // Streaming/watch app → a LIVE FOREGROUND session, not a finite run (which would
+    // never complete and time out at 60s). It re-renders the report in the Viewer on
+    // every fired event until Stop. (Simulate still takes the normal stubbed path.)
+    if (!simulate && app.triggerSource) { startForegroundTrigger(app); return; }
 
     markCanvasRunning(); // immediate during-run feedback; the trace refines per node
 
@@ -2782,7 +2872,11 @@
         loadRoutinesData();
         if (window.flolessPanels) window.flolessPanels.refreshData(); // routine runs also refresh bindings
       } else if (m.type === 'trigger-session-changed') {
-        applyTriggerSnapshot(m.id, m.snapshot);
+        // A foreground live-run session (▶ Run on a streaming app) shares this SSE
+        // event with background routines; its server-namespaced id routes it to the
+        // Viewer handler instead of the Routines list.
+        if (typeof m.id === 'string' && m.id.startsWith(FG_SESSION_PREFIX)) applyForegroundSnapshot(m.id, m.snapshot);
+        else applyTriggerSnapshot(m.id, m.snapshot);
       } else if (m.type === 'trigger-report') {
         applyTriggerReport(m);
       } else if (m.type === 'connect-result') {
@@ -3248,8 +3342,10 @@
   // button only for exec nodes (those carry C# the host can run under a debugger).
   // Debug lives HERE in the main window, not in the report modal.
   const _selectAgent = selectAgent;
-  selectAgent = function selectAgentTweakAware(id) {
-    _selectAgent(id);
+  // Forward ALL args (id + the { reveal } opts from app.js) — dropping them here
+  // silently swallowed the collapsed-panel reveal on inspect (issue #52).
+  selectAgent = function selectAgentTweakAware(id, ...rest) {
+    _selectAgent(id, ...rest);
     const tb = document.getElementById('tweak-btn');
     if (tb) tb.hidden = !id;
     const db = document.getElementById('debug-btn');
@@ -3489,6 +3585,144 @@
     $reportOverlay.append(mkEl('div', null, 'Listening for the next selection…'));
   }
 
+  // ── Foreground live run (▶ Run on a streaming/watch app) ──────────────────────
+  // Start a live session: the Viewer re-renders the report on every fired event
+  // (e.g. each Tekla selection change) until Stop. Reuses the exact trigger-report /
+  // trigger-session-changed SSE path the background routine already drives — the
+  // server hosts the long-lived `aware app run`; here we open the Viewer, surface
+  // Stop, and reflect the live state. We never compose HTML — the Viewer relays
+  // exactly what the node returns (applyTriggerReport paints each fresh report).
+  async function startForegroundTrigger(app) {
+    if (foregroundTrigger) return;
+    const id = currentId;
+    $reportTitle.textContent = `HTML Viewer · ${app.displayName}`;
+    $reportModal.dataset.nodeId = reportNodeId() || '';
+    const cached = lastReportByApp.get(id);
+    if (cached && cached.html) paintReport(cached.html);
+    else { $reportFrame.srcdoc = ''; $reportShare.hidden = true; }
+    $reportOverlay.hidden = false;
+    $reportOverlay.replaceChildren();
+    $reportOverlay.append(mkEl('div', 'spinner'), mkEl('div', null, 'Starting live session…'));
+    $reportSub.innerHTML = `Live run of <code>${escapeHtml(id)}</code> — the report re-renders on every event.`;
+    showModal($reportModal);
+    try {
+      const res = await api('/api/trigger-run', { method: 'POST', body: JSON.stringify({ id, inputs: currentInputs() }) });
+      foregroundTrigger = { appId: id, sessionId: res.sessionId, firedCount: 0 };
+      syncRunControls(); // header ■ Stop run becomes reachable; Run disabled while live
+      paintForegroundListening();
+      appendNarration(`Live session started for <strong>${escapeHtml(id)}</strong> — the report updates on every event. Click <strong>■ Stop run</strong> (top right) to end it.`);
+    } catch (e) {
+      const msg = (e && e.message) ? e.message : String(e);
+      // A refusal (a watcher already holds this host) names the concrete path back —
+      // never a dead end. Other failures are recoverable; the server returns them
+      // in-band, so a failed start is a viewer message + toast, not a console fault.
+      const blocked = !!(e.body && e.body.blocked);
+      $reportShare.hidden = true; // the overlay is the primary content — nothing to share
+      $reportOverlay.hidden = false;
+      $reportOverlay.replaceChildren();
+      if (blocked) {
+        $reportOverlay.append(
+          mkEl('div', null, 'One live model, one watcher — a session is already watching this host.'),
+          mkEl('div', null, 'To run here, stop it first: open ⏱ Routines and disable the watcher, then click ▶ Run workflow.'),
+        );
+        $reportSub.textContent = 'Live run blocked — a watcher already holds this host.';
+        showToast('Blocked — stop the active watcher in ⏱ Routines first', 'warn');
+      } else {
+        $reportOverlay.append(mkEl('div', null, `Couldn't start the live session: ${msg}. Check the host is attached and the lock is fresh, then click ▶ Run workflow.`));
+        $reportSub.textContent = 'Live session failed to start.';
+        showToast('Live run failed: ' + msg, 'warn');
+      }
+      syncRunControls();
+    }
+  }
+
+  // SSE: a foreground live session's snapshot changed. Drives the Viewer's live
+  // state (collecting on each fire; ended on stop/error). Ignores a stale snapshot
+  // for a superseded/stopped session (foregroundTrigger already cleared).
+  function applyForegroundSnapshot(id, snapshot) {
+    if (!foregroundTrigger || id !== foregroundTrigger.sessionId || !snapshot) return;
+    const prevFired = foregroundTrigger.firedCount || 0;
+    foregroundTrigger.firedCount = snapshot.firedCount || 0;
+    const fired = foregroundTrigger.firedCount > prevFired;
+    const viewerOpen = currentId === foregroundTrigger.appId && $reportModal.classList.contains('show');
+    if (snapshot.state === 'error') {
+      foregroundTrigger = null;
+      if (viewerOpen) {
+        $reportShare.hidden = true; // the error overlay is the primary content now
+        $reportOverlay.hidden = false;
+        $reportOverlay.replaceChildren();
+        $reportOverlay.append(mkEl('div', null, `Live session ended with an error: ${snapshot.error || 'the host stopped responding'}. Check Tekla is open and the workflow is compiled, then click ▶ Run workflow to try again.`));
+        $reportSub.textContent = 'Live session error.';
+      }
+      showToast('Live session ended: ' + (snapshot.error || 'host error'), 'warn');
+      syncRunControls();
+      return;
+    }
+    if (snapshot.state === 'stopped') {
+      // The stream ended on its own — a one-shot (`once`) snapshot fired then exited,
+      // or the host closed cleanly. A clean self-exit reads as "Run complete".
+      foregroundTrigger = null;
+      if (viewerOpen) paintForegroundStopped('complete');
+      syncRunControls();
+      return;
+    }
+    // listening: a new fire → "collecting" spinner until applyTriggerReport paints it.
+    if (fired && viewerOpen && !reportRunning) showTriggerCollecting();
+  }
+
+  // The live-but-idle state: the session is listening and no event has fired yet.
+  // A watch app shows nothing until the user next acts in the host, so the copy
+  // DIRECTS that action. If a previous report is cached, keep it visible behind a
+  // live pip (NOT a spinner — nothing is computing); else an instructional prompt
+  // with a Stop. Never a dead end, never a spinner that won't resolve on its own.
+  function paintForegroundListening() {
+    if (!$reportModal.classList.contains('show')) return;
+    const cached = currentId && lastReportByApp.get(currentId);
+    if (cached && cached.html) {
+      $reportOverlay.hidden = true;
+      $reportOverlay.replaceChildren();
+      $reportShare.hidden = false; // the cached report is the primary content
+      $reportSub.innerHTML = `<span class="live-pip" aria-hidden="true"></span>Live · waiting for the next change — change your selection in Tekla to refresh the report.`;
+    } else {
+      $reportFrame.srcdoc = '';
+      $reportShare.hidden = true;
+      $reportOverlay.hidden = false;
+      $reportOverlay.replaceChildren();
+      $reportOverlay.append(
+        mkEl('div', null, 'Listening for events — change your selection in Tekla to generate the first report.'),
+        Object.assign(mkEl('button', 'overlay-stop', '■ Stop run'), { type: 'button' }),
+      );
+      $reportSub.innerHTML = `<span class="live-pip" aria-hidden="true"></span>Live · listening…`;
+    }
+  }
+
+  // The session ended. `reason` distinguishes a clean self-exit ('complete' — e.g. a
+  // one-shot `once` snapshot) from a deliberate Stop ('stopped'). Either way keep the
+  // last report visible; the path back is ▶ Run workflow.
+  function paintForegroundStopped(reason) {
+    if (!$reportModal.classList.contains('show')) return;
+    const complete = reason === 'complete';
+    const cached = currentId && lastReportByApp.get(currentId);
+    if (complete) showToast('Run complete', 'ok');
+    if (cached && cached.html) {
+      $reportOverlay.hidden = true;
+      $reportOverlay.replaceChildren();
+      $reportShare.hidden = false;
+      $reportSub.innerHTML = complete
+        ? `Run complete · last report above — click <strong>▶ Run workflow</strong> to run again.`
+        : `Live session stopped · last report above — click <strong>▶ Run workflow</strong> to start again.`;
+    } else {
+      $reportFrame.srcdoc = '';
+      $reportShare.hidden = true;
+      $reportOverlay.hidden = false;
+      $reportOverlay.replaceChildren();
+      $reportOverlay.append(mkEl('div', null, complete
+        ? 'Run complete. Click ▶ Run workflow to run again.'
+        : 'Live session stopped. Click ▶ Run workflow to start again.'));
+      $reportSub.textContent = complete ? 'Run complete.' : 'Live session stopped.';
+    }
+  }
+
   function renderRoutinesList() {
     const $list = document.getElementById('routines-list');
     const $quota = document.getElementById('rtn-quota');

package/dist/web/index.html

@@ -289,6 +289,7 @@
           <div class="modal-sub" id="report-sub">Rendered from the live run — never composed by the UI.</div>
         </div>
         <div class="report-actions">
+          <button id="report-stop" class="ghost report-stop" hidden data-tip="Stop the live session — the report stops updating on each change">■ Stop run</button>
           <button id="report-share" class="ghost" hidden data-tip="Share this report as a link anyone can view — hosted on floless.io">↗ Share</button>
           <button id="report-open" class="ghost" data-tip="Open the report in a new browser tab">↗ Open</button>
           <button id="report-close" data-tip="Close">×</button>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {