@floless/app 0.31.1 → 0.31.3

package/dist/floless-server.cjs

@@ -52835,7 +52835,7 @@ function appVersion() {
   return resolveVersion({
     isSea: isSea2(),
     sqVersionXml: readSqVersionXml(),
-    define: true ? "0.31.1" : void 0,
+    define: true ? "0.31.3" : void 0,
     pkgVersion: readPkgVersion()
   });
 }
@@ -52845,7 +52845,7 @@ function resolveChannel(s) {
   return "dev";
 }
 function appChannel() {
-  return resolveChannel({ isSea: isSea2(), define: true ? "0.31.1" : void 0 });
+  return resolveChannel({ isSea: isSea2(), define: true ? "0.31.3" : void 0 });
 }
 
 // oauth-presets.ts

package/dist/web/app.css

@@ -566,6 +566,7 @@
     font-size: 12px;
     background: var(--accent-soft);
     flex-shrink: 0;
+    cursor: help;
   }
   .agent-card .fav-btn {
     position: absolute;
@@ -1124,6 +1125,10 @@
      never deletes — matching the app's other destructive affordances. */
   .modal-actions button.danger { border-color: var(--border-strong); color: var(--text); font-weight: 600; }
   .modal-actions button.danger:hover { color: var(--err); border-color: var(--err); background: rgba(248, 113, 113, 0.1); box-shadow: none; }
+  /* #125: form modal with many fields must not overflow the viewport — cap + scroll
+     the body between the pinned title and actions, mirroring .modal.routines. */
+  #form-modal .modal { max-height: 86vh; display: flex; flex-direction: column; }
+  #form-modal-body { overflow-y: auto; flex: 1 1 auto; min-height: 0; }
   .modal.library {
     width: 720px;
     max-height: 82vh;

package/dist/web/app.js

@@ -352,7 +352,7 @@ function cardEl(id, ports) {
         <div class="kind">${a.kind}</div>
         <div class="ver">${a.version}</div>
       </div>
-      <div class="icon">${a.icon}</div>
+      <div class="icon"${a.iconTip ? ` data-tip="${escapeAttr(a.iconTip)}"` : ''}>${a.icon}</div>
     </div>
     <div class="title">${a.title}</div>
     <div class="subtitle">${a.subtitle}</div>

package/dist/web/aware.js

@@ -94,10 +94,28 @@
   }
 
   const AGENT_ICONS = {
+    tekla:             '<line x1="4" y1="5" x2="20" y2="5"/><line x1="12" y1="5" x2="12" y2="20"/>',
+    file:              '<path d="M13 2H6a2 2 0 00-2 2v16a2 2 0 002 2h12a2 2 0 002-2V9z"/><polyline points="13 2 13 9 20 9"/>',
+    excel:             '<rect x="2" y="3" width="20" height="18" rx="2"/><line x1="12" y1="3" x2="12" y2="21"/><line x1="2" y1="12" x2="22" y2="12"/>',
+    revit:             '<rect x="3" y="4" width="18" height="17" rx="1"/><line x1="3" y1="12" x2="21" y2="12"/><line x1="12" y1="21" x2="12" y2="12"/>',
+    slack:             '<line x1="4" y1="10" x2="20" y2="10"/><line x1="4" y1="14" x2="20" y2="14"/><line x1="10" y1="4" x2="8" y2="20"/><line x1="16" y1="4" x2="14" y2="20"/>',
+    'trimble-connect': '<path d="M17.5 10a4.5 4.5 0 00-9 0A4 4 0 009 18h6a4 4 0 002.5-7z"/><line x1="12" y1="18" x2="12" y2="12"/><polyline points="9 15 12 12 15 15"/>',
+    'microsoft-365':   '<rect x="2" y="2" width="8" height="8" rx="1"/><rect x="14" y="2" width="8" height="8" rx="1"/><rect x="2" y="14" width="8" height="8" rx="1"/><rect x="14" y="14" width="8" height="8" rx="1"/>',
+    email:             '<rect x="2" y="4" width="20" height="16" rx="2"/><path d="M2 7l10 7 10-7"/>',
+    http:              '<polyline points="16 18 22 12 16 6"/><polyline points="8 6 2 12 8 18"/>',
+  };
+  const AGENT_NAMES = {
+    tekla: 'Tekla', file: 'File', excel: 'Excel', revit: 'Revit', slack: 'Slack',
+    'trimble-connect': 'Trimble Connect', 'microsoft-365': 'Microsoft 365', email: 'Email', http: 'HTTP',
+  };
+  const _svgWrap = (inner) => `<svg viewBox="0 0 24 24" width="14" height="14" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${inner}</svg>`;
+  const iconFor = (agent) => _svgWrap(AGENT_ICONS[agent] || '<path d="M12 2l8 10-8 10L4 12z"/>');
+  const iconTipFor = (agent) => AGENT_NAMES[agent] || (agent ? agent.replace(/-/g, ' ') : '');
+  const AGENT_ICONS_TEXT = {
     tekla: '⊞', file: '🗀', excel: '◵', revit: '◰', slack: '✦',
     'trimble-connect': '☁', 'microsoft-365': '✉', email: '✉', http: '⇄',
   };
-  const iconFor = (agent) => AGENT_ICONS[agent] || '◈';
+  const iconTextFor = (agent) => AGENT_ICONS_TEXT[agent] || '◈';
 
   // The demo's renderChat staggers narration via setTimeout; its bootstrap call
   // (fired before this script runs) would otherwise drip stale demo lines into
@@ -153,6 +171,57 @@
       .join('')}</table>`;
   }
 
+  // The Description tab is for non-coders — it must read as plain English about what a
+  // node does, never a wall of code/markup. Short scalar inputs (phase: 1, version:
+  // '2025.0') are the real knobs and show verbatim; but a baked blob (HTML markup, a
+  // large JSON payload pre-built at compile time, e.g. a steel overlay's `args.html`)
+  // is NOT plain English — dumping it raw is the "rubbish" this view must never show.
+  // So anything oversized collapses to a dimmed one-line summary ("baked HTML · 210.0 KB").
+  const DESC_BLOB_CHARS = 500;
+  function summarizeInputValue(v) {
+    const isStr = typeof v === 'string';
+    const raw = isStr ? v : v == null ? '' : JSON.stringify(v);
+    // Summarize on size OR on any markup/code shape — a non-coder must never see raw
+    // markup, however short. (The slice bounds the scan to 500 chars; the regex is
+    // already linear — a single [^>]* with a disjoint `>` terminator — so no ReDoS.)
+    const markup = /<\/?[a-z!][^>]*>/i.test(raw.slice(0, 500));
+    if (raw.length <= DESC_BLOB_CHARS && !markup) return { text: raw, blob: false };
+    const size = raw.length >= 1024 ? (raw.length / 1024).toFixed(1) + ' KB' : raw.length + ' chars';
+    const kind = markup ? 'HTML' : isStr ? 'content' : 'JSON';
+    return { text: `baked ${kind} · ${size}`, blob: true };
+  }
+
+  // Exec nodes receive their inputs wrapped in an `args` object (an AWARE implementation
+  // detail of how exec passes data in). Flatten that one level so a non-coder sees the
+  // real knobs (phase, html…) directly instead of an `args: {…}` row. `code` is the
+  // implementation, never an input, so it's dropped; a flattened member that collides
+  // with a real top-level input yields to the top-level value.
+  function flattenInputs(inputs) {
+    const out = Object.create(null); // null-proto: keys like `constructor`/`__proto__` stay plain data
+    for (const [k, v] of Object.entries(inputs || {})) {
+      if (k === 'code') continue;
+      if (k === 'args' && v && typeof v === 'object' && !Array.isArray(v)) {
+        for (const [ak, av] of Object.entries(v)) if (ak !== 'code' && !Object.hasOwn(out, ak)) out[ak] = av;
+      } else {
+        out[k] = v;
+      }
+    }
+    return out;
+  }
+
+  // Description-tab Inputs block: flattened, plain-English, baked blobs summarized and
+  // dimmed (meta, not data). Empty inputs → no block at all.
+  function descInputs(inputs) {
+    const rows = Object.entries(flattenInputs(inputs));
+    if (!rows.length) return '';
+    const body = rows.map(([k, v]) => {
+      const s = summarizeInputValue(v);
+      const cell = s.blob ? `<span class="dim-note">${escapeHtml(s.text)}</span>` : escapeHtml(s.text);
+      return `<tr><th>${escapeHtml(k)}</th><td>${cell}</td></tr>`;
+    }).join('');
+    return `<p><strong>Inputs</strong></p><table class="kv">${body}</table>`;
+  }
+
   // Plain-text summary of one declared command input (for the Skill tab's inputs
   // table — kvTable escapes it, so this stays text, no markup): "type (enum vals)
   // · default X — description".
@@ -289,19 +358,19 @@
     // Description tab: a plain-English explanation + a small input table that
     // EXCLUDES the code (code belongs to the Code tab, never dumped here).
     const plainDesc = execSource ? leadingComment(execSource) : '';
-    const inputsNoCode = {};
-    for (const [k, v] of Object.entries(inputs || {})) if (k !== 'code') inputsNoCode[k] = v;
+    const blurbText = plainDesc && (s => s.length > 80 ? s.slice(0, 79) + '…' : s)(plainDesc.replace(/\.\s+.*/, '.').trim());
     return {
       _mode: n.mode,
       _runtimeModel: !!n.runtimeModel, // B2: lock stamped runtime-model → card badge
       _frozen: !!n.frozen, // source node carries a `frozen:` block → card badge + Unfreeze menu
       icon: iconFor(n.agent),
+      iconTip: iconTipFor(n.agent),
       kind: n.kind === 'agent' && n.agent ? `${agentLabel} agent` : escapeHtml(n.kind),
       version: pin ? `v${escapeHtml(String(pin))}` : '—',
       title: escapeHtml(n.id),
       subtitle: `${agentLabel}${cmd ? '/' + cmd : ''} · ${mode}`,
-      blurb: n.notes[0] ? escapeHtml(humanizeNote(n.notes[0].text)) : `${mode}-mode ${cmd ? '<code>' + cmd + '</code>' : escapeHtml(n.kind)} node`,
-      description: `${plainDesc ? `<p>${escapeHtml(plainDesc)}</p>` : ''}<p>Resolves to ${modeBadge} via <code>${escapeHtml(n.agent || n.kind)}${n.command ? '.' + escapeHtml(n.command) : ''}</code>.</p>${Object.keys(inputsNoCode).length ? `<p><strong>Inputs</strong></p>${kvTable(inputsNoCode)}` : ''}${execSource ? `<p class="dim-note">Full source in the <strong>Code</strong> tab.</p>` : ''}${notesHtml}`,
+      blurb: blurbText ? escapeHtml(blurbText) : n.notes[0] ? escapeHtml(humanizeNote(n.notes[0].text)) : `${mode}-mode ${cmd ? '<code>' + cmd + '</code>' : escapeHtml(n.kind)} node`,
+      description: `${plainDesc ? `<p>${escapeHtml(plainDesc)}</p>` : ''}<p>Resolves to ${modeBadge} via <code>${escapeHtml(n.agent || n.kind)}${n.command ? '.' + escapeHtml(n.command) : ''}</code>.</p>${descInputs(inputs)}${execSource ? `<p class="dim-note">Full source in the <strong>Code</strong> tab.</p>` : ''}${notesHtml}`,
       // Rich agent/command detail when the manifest is installed (n.skill); else
       // the lock-pointer fallback below (exec/agent-less nodes, uninstalled agents).
       skill: skillBody(
@@ -1624,7 +1693,7 @@
     card.setAttribute('role', 'status');
 
     const status = mkEl('div', 'cred-fail-status');
-    const icon = mkEl('span', 'cred-fail-icon', iconFor(cred.id));
+    const icon = mkEl('span', 'cred-fail-icon', iconTextFor(cred.id));
     icon.setAttribute('aria-hidden', 'true');
     status.append(icon, document.createTextNode('SESSION EXPIRED'));
 
@@ -1774,6 +1843,7 @@
       const first = $body.querySelector('input:not(.fm-file-input),textarea');
       if (first) { first.focus(); if (first.select) first.select(); }
       else if (danger) $cancel.focus();
+      else $ok.focus();
       // ── images-field setup ──────────────────────────────────────────────────────
       const imageStates = new Map();
       $body.querySelectorAll('.fm-images').forEach((box) => {
@@ -2563,6 +2633,7 @@
   // popover → Update now → POST /api/update/apply, which downloads + relaunches into
   // the new version. Hidden in dev/npm (supported:false).
   const $appUpdate = document.getElementById('app-update');
+  let _appUpdateRecoveryTimer = null; // cleared before each new apply attempt
   // The apply body, extracted so the popover's "Update now" can drive it with the
   // polled target version (no textContent scrape). Preserves the npm-vs-desktop
   // branch verbatim: npm copies the command; desktop confirms → relaunch.
@@ -2578,18 +2649,32 @@
     }
     // desktop (Velopack): one-click download + relaunch
     const v = version || '';
-    if (!window.confirm('Download v' + v + ' and relaunch floless.app now?')) return;
+    const go = await formModal({ title: 'Update and relaunch', sub: 'FloLess will download v' + v + ', close, and relaunch into the new version.', fields: [], okLabel: 'Update now' });
+    if (!go) return;
     // Record the pending version so the new build's first paint can reveal the
     // what's-new panel (survives the relaunch via localStorage; cleared once shown).
     try { localStorage.setItem('floless.whatsNew.pending', v); } catch { /* private mode */ }
+    if (_appUpdateRecoveryTimer) { clearTimeout(_appUpdateRecoveryTimer); _appUpdateRecoveryTimer = null; }
     $appUpdate.disabled = true;
     $appUpdate.textContent = '↑ Updating…';
     try {
-      const r = await fetch('/api/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' } });
+      const r = await fetch('/api/update/apply', { method: 'POST', headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(5 * 60 * 1000) });
       const d = await r.json().catch(() => ({}));
       if (!r.ok || !d.ok) throw new Error(d.error || 'update failed');
       // Success: the server is exiting + Update.exe relaunches the new build. The health
       // poll flips to offline (R1 overlay), then the new version reconnects on its own.
+      // Recovery guard: if the relaunch never happens and this page stays alive (e.g. a UAC
+      // prompt was declined after the server already responded), re-enable the pill after 90 s
+      // so the user can retry — the page won't go offline in that case.
+      _appUpdateRecoveryTimer = setTimeout(() => {
+        _appUpdateRecoveryTimer = null;
+        if ($appUpdate && $appUpdate.disabled) {
+          $appUpdate.disabled = false;
+          $appUpdate.textContent = '↑ Relaunch failed — retry';
+          try { localStorage.removeItem('floless.whatsNew.pending'); } catch { /* private mode */ }
+          refreshUpdate(); // re-poll so the pill state reflects reality, same as catch path
+        }
+      }, 90_000);
     } catch (e) {
       $appUpdate.disabled = false;
       try { localStorage.removeItem('floless.whatsNew.pending'); } catch { /* private mode */ }
@@ -2667,7 +2752,8 @@
   async function applyAwareUpdate(version) {
     if (!$awareUpdate) return;
     const v = version || '';
-    if (!window.confirm('Upgrade AWARE runtime to v' + v + '? This reinstalls the npm package in place — the app stays open and the version restamps automatically.')) return;
+    const go = await formModal({ title: 'Upgrade AWARE runtime', sub: 'Reinstalls @aware-aeco/cli to v' + v + ' in place. The app stays open — the version updates automatically when the install finishes.', fields: [], okLabel: 'Upgrade now' });
+    if (!go) return;
     $awareUpdate.disabled = true;
     $awareUpdate.textContent = '↑ Upgrading…';
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@floless/app",
-  "version": "0.31.1",
+  "version": "0.31.3",
   "type": "module",
   "description": "Thin localhost host for floless.app — serves web/ and shells the aware CLI. No engine, no LLM.",
   "bin": {