@lelouchhe/webagent 0.7.0 → 0.9.0

package/dist/js/{login.2WA6DTGM.js → login.WMURU4NI.js}

@@ -1 +1 @@
-import{b as r,c as i}from"./chunk.UMQMOGWO.js";import"./chunk.AJZBJBMO.js";localStorage.getItem(r)&&location.replace("/");var s=document.getElementById("login-form"),n=document.getElementById("token-input"),o=document.getElementById("error"),t=document.getElementById("submit-btn");function u(e){o&&(o.textContent=e,o.style.display=e?"block":"none")}s&&n&&t&&(s.addEventListener("submit",e=>{e.preventDefault(),u(""),t.disabled=!0,t.textContent="Verifying\u2026",(async()=>{try{let l=await i(n.value);l.ok?location.replace("/"):u(l.error)}finally{t.disabled=!1,t.textContent="Sign in"}})()}),n.focus());
+import{b as r,c as i}from"./chunk.3CLGCUHW.js";import"./chunk.AJZBJBMO.js";localStorage.getItem(r)&&location.replace("/");var s=document.getElementById("login-form"),n=document.getElementById("token-input"),o=document.getElementById("error"),t=document.getElementById("submit-btn");function u(e){o&&(o.textContent=e,o.style.display=e?"block":"none")}s&&n&&t&&(s.addEventListener("submit",e=>{e.preventDefault(),u(""),t.disabled=!0,t.textContent="Verifying\u2026",(async()=>{try{let l=await i(n.value);l.ok?location.replace("/"):u(l.error)}finally{t.disabled=!1,t.textContent="Sign in"}})()}),n.focus());

package/dist/js/viewer.GP5VXAUY.js

@@ -0,0 +1 @@
+import{c as g,e as h,n as y,p as T,q as C}from"./chunk.S5LRNRJI.js";import{a as p}from"./chunk.3CLGCUHW.js";import"./chunk.AJZBJBMO.js";var $=["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"];function f(t){return String(t).padStart(2,"0")}function E(t,n){if(!t)return"";let s=new Date(t),i=s.getTime();if(isNaN(i))return"";let l=Math.floor((n.getTime()-i)/1e3);if(l<60)return"just now";let c=Math.floor(l/60);if(c<60)return`${c}m ago`;let o=Math.floor(c/60);if(o<24)return`${o}h ago`;let e=Math.floor(o/24);if(e<7)return`${e}d ago`;let m=s.getUTCFullYear()===n.getUTCFullYear(),r=$[s.getUTCMonth()],a=s.getUTCDate();return m?`${r} ${a}`:`${r} ${a}, ${s.getUTCFullYear()}`}function _(t){if(!t)return"";let n=new Date(t);return isNaN(n.getTime())?"":`${n.getUTCFullYear()}-${f(n.getUTCMonth()+1)}-${f(n.getUTCDate())} ${f(n.getUTCHours())}:${f(n.getUTCMinutes())} UTC`}function S(t){let n=/^\/api\/v1\/sessions\/[^/]+\/attachments\/([A-Za-z0-9._-]+)(?:\?.*)?$/;return s=>{let i=n.exec(s);return i?`/s/${encodeURIComponent(t)}/attachments/${i[1]}`:s}}function w(t){if(typeof t.data=="string")try{return JSON.parse(t.data)}catch{return{}}return t.data}function x(t,n,s,i){if(t.type!=="assistant_message"||n?.type!=="assistant_message"||t.seq!==n.seq+1||!s?.classList.contains("assistant"))return!1;let l=(s.getAttribute("data-raw")??"")+(typeof i.text=="string"?i.text:"");return s.setAttribute("data-raw",l),C(s,l,void 0,!0),g(s),!0}function v(t,n,s){let i=new Set;for(let r of t)if(r.type==="permission_response")try{let a=JSON.parse(r.data);typeof a.requestId=="string"&&i.add(a.requestId)}catch{}let l=new Map,c=new Map,o=null,e=null,m={rewriteAttachmentSrc:S(s),enhanceMarkdown:g,findToolCallEl:r=>l.get(r)??null,findPermissionEl:r=>c.get(r)??null,findBashEl:()=>o,isPermissionResolved:r=>i.has(r),finalAnswerToolText:null};for(let r=0;r<t.length;r++){let a=t[r];if(!y(a.type))continue;let u=w(a),A=r>0?t[r-1]:null,M=n.lastElementChild;if(x(a,A,M,u)){e=null;continue}m.finalAnswerToolText=a.type==="assistant_message"?e:null;let d=T(a.type,u,m);d?(n.appendChild(d),a.type==="tool_call"&&typeof u.id=="string"?l.set(u.id,d):a.type==="permission_request"&&typeof u.requestId=="string"?c.set(u.requestId,d):a.type==="bash_command"&&(o=d)):a.type==="bash_result"&&(o=null),a.type==="tool_call_update"?e=h(typeof u.status=="string"?u.status:"",Array.isArray(u.content)?u.content:void 0):e=null}}async function U(){try{let e=localStorage.getItem("theme")??"auto";document.documentElement.setAttribute("data-theme",e)}catch{}let t=/^\/s\/([A-Za-z0-9_-]{24})(?:[/?#]|$)/.exec(location.pathname);if(!t){document.body.textContent="invalid share URL";return}let n=t[1],s=document.getElementById("session-info"),i=document.getElementById("messages"),l=document.querySelector(".share-footer-author"),c=document.querySelector(".share-footer-meta");if(!i)return;let o;try{let e=await fetch(`/api/v1/shared/${encodeURIComponent(n)}/events`,{headers:{Accept:"application/json"},credentials:"omit"});if(e.status===p.GONE){document.body.innerHTML="<div class='share-gone'>\u6B64\u94FE\u63A5\u5DF2\u64A4\u9500\u6216\u8FC7\u671F\u3002</div>";return}if(!e.ok){document.body.textContent=`error ${e.status}`;return}o=await e.json()}catch(e){document.body.textContent=`failed to load: ${String(e)}`;return}if(document.title=o.share.session_title?`${o.share.session_title} \u2014 shared`:"shared session",s&&(s.textContent=o.share.session_title??"(untitled)"),l){let e=o.share.display_name??"";l.textContent=e?`by ${e}`:""}if(v(o.events,i,n),c){let e=o.share.shared_at??o.share.created_at;c.textContent=E(e,new Date),c instanceof HTMLElement&&(c.title=_(e))}}U();

package/dist/login.html

@@ -17,7 +17,7 @@
       media="(prefers-color-scheme: light)"
     />
     <script src="/theme-init.js"></script>
-    <link rel="stylesheet" href="/styles.01ky3cex.css" />
+    <link rel="stylesheet" href="/styles.00nlhhf3.css" />
   </head>
   <body class="login-page">
     <div class="login-card">
@@ -44,6 +44,6 @@
         <code>webagent --create-token &lt;name&gt;</code> on the server.
       </p>
     </div>
-    <script type="module" src="/js/login.2WA6DTGM.js"></script>
+    <script type="module" src="/js/login.WMURU4NI.js"></script>
   </body>
 </html>

package/dist/share-viewer.html

@@ -16,10 +16,10 @@
       media="(prefers-color-scheme: light)"
     />
     <meta name="robots" content="noindex, nofollow" />
-    <link rel="stylesheet" href="/s/_/styles.01ky3cex.css" />
+    <link rel="stylesheet" href="/s/_/styles.00nlhhf3.css" />
     <link rel="stylesheet" href="/s/_/share-viewer.00gubshk.css" />
-  <link rel="modulepreload" href="/s/_/chunk.3CCHZCG7.js">
-<link rel="modulepreload" href="/s/_/chunk.UMQMOGWO.js">
+  <link rel="modulepreload" href="/s/_/chunk.S5LRNRJI.js">
+<link rel="modulepreload" href="/s/_/chunk.3CLGCUHW.js">
 <link rel="modulepreload" href="/s/_/chunk.AJZBJBMO.js">
 </head>
   <body class="share-viewer">
@@ -49,6 +49,6 @@
         >
       </div>
     </footer>
-  <script type="module" src="/s/_/viewer.T32M5AZZ.js"></script>
+  <script type="module" src="/s/_/viewer.GP5VXAUY.js"></script>
 </body>
 </html>

package/dist/{styles.01ky3cex.css → styles.00nlhhf3.css}

@@ -84,6 +84,32 @@ body {
   font-weight: bold;
   color: var(--green);
 }
+#inbox-btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 4px;
+  min-height: 28px;
+  padding: 2px 6px;
+  margin-left: -6px;
+  border: 0;
+  background: transparent;
+  color: inherit;
+  font: inherit;
+  cursor: pointer;
+}
+#inbox-btn:hover .logo,
+#inbox-btn:focus-visible .logo {
+  color: var(--text);
+}
+#inbox-btn:focus-visible {
+  outline: 1px solid var(--text-dim);
+  outline-offset: 1px;
+}
+#inbox-count {
+  color: var(--red);
+  font-size: 13px;
+  font-weight: 600;
+}
 .header-side {
   min-width: 0;
   display: flex;
@@ -139,7 +165,8 @@ body {
   width: 100%;
   text-align: center;
 }
-#theme-btn {
+#theme-btn,
+#file-viewer-close {
   background: transparent;
   border: none;
   color: var(--text-dim);
@@ -148,7 +175,8 @@ body {
   font-family: inherit;
   padding: 2px 6px;
 }
-#theme-btn:hover {
+#theme-btn:hover,
+#file-viewer-close:hover {
   color: var(--text);
 }
 @media (max-width: 640px) {
@@ -312,6 +340,22 @@ body {
   font-weight: normal;
 }
 
+.msg.assistant .subagent-result {
+  color: var(--text-dim);
+  font-size: 14px;
+  margin: 2px 0;
+}
+.msg.assistant .subagent-result summary {
+  cursor: pointer;
+}
+.msg.assistant .subagent-result-content {
+  color: var(--text);
+  margin: 4px 0 4px 16px;
+}
+.msg.assistant .assistant-continuation {
+  margin-top: 4px;
+}
+
 /* Thinking */
 .thinking {
   color: var(--text-dim);
@@ -494,6 +538,12 @@ body {
   margin-bottom: 2px;
   cursor: pointer;
 }
+.plan-summary::marker {
+  content: "";
+}
+.plan-summary::-webkit-details-marker {
+  display: none;
+}
 .plan-counts {
   color: var(--text-dim);
   font-weight: normal;
@@ -505,6 +555,28 @@ body {
 .plan-entry {
   padding: 1px 0;
 }
+.plan-status-pending {
+  color: var(--text-dim);
+}
+.plan-status-in_progress .plan-symbol,
+.plan-counts .plan-status-in_progress {
+  color: var(--blue);
+}
+.plan-status-in_progress .plan-symbol {
+  display: inline-block;
+  background: var(--accent-soft);
+  border-radius: 2px;
+}
+.plan-status-completed .plan-symbol,
+.plan-counts .plan-status-completed {
+  color: var(--green);
+}
+.plan-status-completed .plan-content {
+  color: var(--text-dim);
+}
+.plan-status-unknown {
+  color: var(--text-dim);
+}
 
 /* Permission dialog */
 .permission {
@@ -678,7 +750,25 @@ body {
 #status-bar::before {
   content: "\200b";
 }
+#status-bar .status-model {
+  flex: 0 0 auto;
+}
+#status-bar .status-separator,
+#status-bar .status-usage {
+  flex: 0 0 auto;
+}
 #status-bar .status-cwd {
+  display: flex;
+  flex: 1 1 auto;
+  min-width: 0;
+  overflow: hidden;
+}
+#status-bar .status-cwd-prefix {
+  flex: 0 0 auto;
+}
+#status-bar .status-cwd-tail {
+  flex: 1 1 auto;
+  min-width: 0;
   overflow: hidden;
   text-overflow: ellipsis;
   direction: rtl;
@@ -795,6 +885,30 @@ body {
   }
 }
 
+/* Panels attached to the input */
+.input-panel {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-bottom: none;
+  max-height: 220px;
+}
+#plan-panel {
+  flex: 0 0 auto;
+}
+#plan-panel[hidden] {
+  display: none;
+}
+#plan-panel > .plan-summary {
+  margin: 0;
+  padding: 6px 16px;
+}
+#plan-panel > .plan-entries {
+  max-height: 180px;
+  margin: 0;
+  padding: 0 16px 6px;
+  overflow-y: auto;
+}
+
 /* Slash command autocomplete */
 #slash-menu {
   display: none;
@@ -802,10 +916,6 @@ body {
   bottom: 100%;
   left: 0;
   right: 0;
-  background: var(--surface);
-  border: 1px solid var(--border);
-  border-bottom: none;
-  max-height: 220px;
   overflow-y: auto;
   z-index: 10;
 }
@@ -900,6 +1010,151 @@ body {
   cursor: default;
 }
 
+/* Read-only file viewer */
+#file-viewer[hidden] {
+  display: none;
+}
+#file-viewer {
+  position: fixed;
+  inset: 0;
+  z-index: 100;
+  min-width: 0;
+  background: var(--bg);
+  color: var(--text);
+  display: flex;
+  flex-direction: column;
+}
+body.file-viewer-open {
+  overflow: hidden;
+}
+.file-viewer-header {
+  min-height: 41px;
+  padding: 6px 16px;
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  font-size: 15px;
+}
+#file-viewer-path {
+  min-width: 0;
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+  direction: ltr;
+  text-align: left;
+  color: var(--text-dim);
+  font-size: inherit;
+}
+#file-viewer-close {
+  flex: 0 0 auto;
+}
+#file-viewer-notice {
+  flex: 0 0 auto;
+  padding: 6px 14px;
+  border-bottom: 1px solid var(--border);
+  color: var(--yellow);
+  font-size: 13px;
+}
+#file-viewer-notice[hidden] {
+  display: none;
+}
+#file-viewer-content {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow: auto;
+  padding-bottom: env(safe-area-inset-bottom);
+}
+.file-viewer-markdown {
+  width: 100%;
+  min-height: 100%;
+}
+.file-viewer-image {
+  display: block;
+  max-width: 100%;
+  max-height: 100%;
+  margin: auto;
+  padding: 12px;
+  object-fit: contain;
+}
+.file-viewer-code-scroll {
+  min-height: 100%;
+  min-width: max-content;
+}
+.file-viewer-code-grid {
+  display: grid;
+  grid-template-columns: max-content minmax(max-content, 1fr);
+  width: max-content;
+  min-width: 100%;
+  min-height: 100%;
+}
+.file-viewer-line-numbers,
+.file-viewer-code {
+  margin: 0;
+  padding: 10px 12px;
+  border: 0;
+  border-radius: 0;
+  background: var(--bg);
+  color: var(--text);
+  font:
+    14px/1.55 "SF Mono",
+    "Fira Code",
+    monospace;
+  white-space: pre;
+}
+.file-viewer-line-numbers {
+  position: sticky;
+  left: 0;
+  z-index: 1;
+  padding-right: 8px;
+  background: var(--surface);
+  border-right: 1px solid var(--border);
+  color: var(--text-dim);
+  text-align: right;
+  user-select: none;
+}
+.file-viewer-code {
+  padding-left: 12px;
+}
+.file-viewer-code code,
+.file-viewer-code code.hljs {
+  padding: 0;
+  background: transparent;
+  font: inherit;
+}
+.file-viewer-binary-meta {
+  padding: 18px 14px 10px;
+  color: var(--text-dim);
+  overflow-wrap: anywhere;
+}
+.file-viewer-download {
+  display: inline-flex;
+  min-height: 44px;
+  margin: 0 14px;
+  padding: 8px 12px;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  align-items: center;
+  color: var(--accent);
+  text-decoration: none;
+}
+.file-viewer-download:hover,
+.file-viewer-download:focus-visible {
+  border-color: var(--accent);
+}
+@media (min-width: 1024px) {
+  body.file-viewer-open {
+    padding-right: min(55vw, 800px);
+  }
+  #file-viewer {
+    left: auto;
+    width: min(55vw, 800px);
+    border-left: 1px solid var(--border);
+  }
+}
+
 /* Image attach */
 #attach-preview {
   display: none;

package/dist/sw.js

@@ -79,25 +79,35 @@ self.addEventListener("notificationclick", (e) => {
   e.notification.close();
 
   const data = e.notification.data || {};
-  // For inbox messages, route to the bound session (if set) or root.
-  // For session events, route to the session.
   const sessionId = data.sessionId;
-  const urlHash = sessionId ? `/#${sessionId}` : "/";
+  const messageId = data.messageId;
+  const target = sessionId
+    ? { type: "navigate", sessionId }
+    : messageId
+      ? { type: "navigate", messageId }
+      : { type: "navigate" };
+  const targetUrl = sessionId
+    ? `/#${encodeURIComponent(sessionId)}`
+    : messageId
+      ? `/?message=${encodeURIComponent(messageId)}`
+      : "/";
 
   e.waitUntil(
     self.clients
       .matchAll({ type: "window", includeUncontrolled: true })
-      .then((clients) => {
-        // Focus existing window if open
+      .then(async (clients) => {
         for (const client of clients) {
           if (client.url.includes(self.location.origin)) {
-            client.focus();
-            client.postMessage({ type: "navigate", sessionId });
+            try {
+              await client.focus();
+            } catch {
+              // Navigation still works if the browser refuses focus.
+            }
+            client.postMessage(target);
             return;
           }
         }
-        // Otherwise open a new window
-        return self.clients.openWindow(urlHash);
+        return self.clients.openWindow(targetUrl);
       }),
   );
 });

package/lib/agent-key.js

@@ -0,0 +1,6 @@
+export function agentKeyFromCommand(agentCmd) {
+    const key = agentCmd.trim().split(/\s+/, 1)[0];
+    if (!key)
+        throw new Error("ACP agent command is empty");
+    return key;
+}

package/lib/attachments.js

@@ -70,14 +70,51 @@ function looksLikeUtf8Text(buf) {
         if (byte === 0)
             return false;
     }
-    try {
-        const decoder = new TextDecoder("utf-8", { fatal: true });
-        decoder.decode(buf);
-        return true;
-    }
-    catch {
-        return false;
+    return decodesAsUtf8ToleratingTailTruncation(buf);
+}
+/**
+ * Maximum bytes one UTF-8 code point can occupy. A TRAILING code point that
+ * was cut off by the sampling window contributes at most one byte less than
+ * a full character (a complete 4-byte character would decode), so backing up
+ * `MAX_UTF8_CHAR_BYTES - 1` bytes always reaches the preceding boundary.
+ */
+const MAX_UTF8_CHAR_BYTES = 4;
+/**
+ * Whether `buf` decodes cleanly as UTF-8, allowing its FINAL multi-byte
+ * character to be cut off at the buffer end.
+ *
+ * Why the tolerance: sniffMime only receives the first 4096 bytes of a
+ * larger file (the viewer's `SNIFF_BYTES` window in src/files/routes.ts and
+ * the upload-pipeline head). Content dense in multi-byte characters —
+ * Chinese, Japanese, emoji, ... — regularly leaves that window slicing
+ * clean through a character. A strict whole-buffer fatal decode then
+ * misclassifies perfectly valid UTF-8 text as binary, so the viewer
+ * force-downloads it instead of previewing it (real-world regression:
+ * ~100 of the markdown notes under ~/mine/space downloaded instead of
+ * rendering, even though every one of them was valid UTF-8).
+ *
+ * This relaxes ONLY the tail: a truncated trailing code point occupies at
+ * most 3 bytes of the buffer, so backing up at most 3 bytes reaches a
+ * character boundary — and the loop never trims the whole buffer, because an
+ * empty prefix would trivially "decode" and would turn short garbage buffers
+ * into text. NUL bytes and genuinely invalid sequences elsewhere fail every
+ * prefix attempt and still fall through to application/octet-stream — the
+ * "binary stays binary" security posture of the sniff is unchanged.
+ */
+function decodesAsUtf8ToleratingTailTruncation(buf) {
+    for (let end = buf.length; end >= Math.max(1, buf.length - (MAX_UTF8_CHAR_BYTES - 1)); end--) {
+        try {
+            // Fresh decoder per attempt: reuse-after-throw is not part of the
+            // TextDecoder contract across implementations.
+            new TextDecoder("utf-8", { fatal: true }).decode(buf.subarray(0, end));
+            return true;
+        }
+        catch {
+            // Cut deeper into the tail. Only a trailing truncated character can
+            // make a later attempt succeed — real corruption fails all of them.
+        }
     }
+    return false;
 }
 /**
  * Mimes we are willing to render inline in <img>. Everything else is forced

package/lib/auth-middleware.js

@@ -1,5 +1,6 @@
-// All whitelisted paths must be GETs that read non-sensitive data, or static
-// assets needed before the user can present a token.
+// All whitelisted paths must be GETs that either read non-sensitive data,
+// serve static assets needed before the user can present a token, or enforce
+// independent ticket/HMAC authentication inside their route handler.
 const WHITELIST = [
     // Public probes
     { method: "GET", test: (p) => p === "/api/v1/version" },
@@ -35,6 +36,12 @@ const WHITELIST = [
         method: "GET",
         test: (p) => /^\/api\/v1\/sessions\/[A-Za-z0-9_-]+\/attachments\/[A-Za-z0-9._-]+$/.test(p),
     },
+    // File viewer content — read-only bytes for one confirmed path,
+    // authenticated via HMAC sig+exp query string for the same reason as
+    // image GETs above (media tags / downloads cannot send Authorization
+    // headers). The content handler verifies the signature before serving:
+    // without a valid sig+exp it returns 401, never bytes.
+    { method: "GET", test: (p) => p === "/api/v1/files/content" },
     // --- Share viewer (public read-only snapshots) ---
     // Viewer HTML shell + image proxy + viewer-namespaced static assets
     // (CSS/JS) all live under /s/* — see src/share/routes.ts. The auth gate