@sleep2agi/agent-network-dashboard 0.6.3-preview.1 → 0.6.3-preview.10

package/app/api/anet/providers/probe/route.ts

@@ -0,0 +1,79 @@
+import { requireDashboardAuth } from '@/app/lib/dashboard-auth';
+import { hubFetch } from '@/app/lib/hub';
+import { callMcp, parseMcpEnvelope, resolveDefaultNetworkId } from '@/app/lib/hub-mcp';
+
+/**
+ * Provider connectivity probe (RFC-028 P2 — aligned to real #308 schema).
+ *
+ *   GET  → probe-target server set (online host_supervisor daemons).
+ *   POST { provider_id, model_name, daemon_node_id } → DISPATCH a probe
+ *          (probe_provider_model is async: it mints a pending probe_results
+ *          row + doorbells the daemon, and returns only { probe_id }). The
+ *          actual cell status lands later in probe_results — the matrix polls
+ *          /api/anet/providers/probe-results (get_probe_results) for it.
+ *
+ * Hub-without-RFC-028 → flagged `unconfirmed`. MOCK_PROVIDERS=1 → no-op
+ * dispatch (the mock results come from the probe-results route).
+ */
+
+function mockServers() {
+  return [
+    { daemon_node_id: 'node_daemon_gpu1', hostname: 'gpu-node-1' },
+    { daemon_node_id: 'node_daemon_gpu2', hostname: 'gpu-node-2' },
+    { daemon_node_id: 'node_daemon_cpu1', hostname: 'cpu-node-1' },
+  ];
+}
+
+async function resolveServerSet(): Promise<Array<{ daemon_node_id: string; hostname: string }>> {
+  try {
+    const res = await hubFetch('/api/nodes');
+    if (!res.ok) return [];
+    const data = (await res.json()) as { nodes?: unknown; sessions?: unknown };
+    const raw = data.nodes ?? data.sessions ?? data;
+    const arr = (Array.isArray(raw) ? raw : raw && typeof raw === 'object' ? Object.values(raw) : []) as Array<Record<string, unknown>>;
+    const out: Array<{ daemon_node_id: string; hostname: string }> = [];
+    for (const n of arr) {
+      if (!n || typeof n !== 'object') continue;
+      const id = String(n.node_id || '');
+      if (n.role === 'host_supervisor' || id.startsWith('node_daemon_')) {
+        out.push({ daemon_node_id: id, hostname: String(n.server || n.hostname || n.alias || id) });
+      }
+    }
+    return out;
+  } catch { return []; }
+}
+
+export async function GET() {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+  if (process.env.MOCK_PROVIDERS === '1') return Response.json({ ok: true, mock: true, servers: mockServers() });
+  return Response.json({ ok: true, servers: await resolveServerSet() });
+}
+
+export async function POST(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+  let body: { provider_id?: string; model_name?: string; daemon_node_id?: string; network_id?: string };
+  try { body = await req.json(); } catch { return Response.json({ error: 'invalid JSON body' }, { status: 400 }); }
+  const { provider_id, model_name, daemon_node_id } = body;
+  if (!provider_id || !model_name || !daemon_node_id) {
+    return Response.json({ error: 'provider_id, model_name, daemon_node_id required' }, { status: 400 });
+  }
+  if (process.env.MOCK_PROVIDERS === '1') {
+    return Response.json({ ok: true, mock: true, probe_id: `mock_${model_name}_${daemon_node_id}` });
+  }
+  const networkId = body.network_id || (await resolveDefaultNetworkId());
+  const args = { provider_id, model_name, daemon_node_id, ...(networkId ? { network_id: networkId } : {}) };
+  try {
+    const res = await callMcp('probe_provider_model', args);
+    if (res.status === 404 || res.status === 501) {
+      return Response.json({ ok: false, unconfirmed: true, error: 'hub lacks RFC-028 probe_provider_model (needs #308)' }, { status: 200 });
+    }
+    if (!res.ok) return Response.json({ ok: false, error: `hub ${res.status}` }, { status: 502 });
+    const result = (await parseMcpEnvelope(res)) as { ok?: boolean; probe_id?: string; error?: string };
+    if (result?.ok === false) return Response.json({ ok: false, error: result.error || 'dispatch_failed' }, { status: 502 });
+    return Response.json({ ok: true, probe_id: result?.probe_id });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e) }, { status: 502 });
+  }
+}

package/app/api/anet/providers/probe-results/route.ts

@@ -0,0 +1,60 @@
+import { requireDashboardAuth } from '@/app/lib/dashboard-auth';
+import { callMcp, parseMcpEnvelope, resolveDefaultNetworkId } from '@/app/lib/hub-mcp';
+
+/**
+ * Probe-results poll (RFC-028 P2 — get_probe_results, the matrix renderer
+ * source). The matrix dispatches probes (async) then polls this for each
+ * cell's resolved status. Returns rows:
+ *   { provider_id, model_name, daemon_node_id, status, latency_ms, error_label, raw_status_code, probed_at }
+ *
+ * MOCK_PROVIDERS=1 → deterministic schema-shaped fixture so the preview matrix
+ * resolves instantly. Real → get_probe_results MCP.
+ */
+
+const MOCK_SERVERS = ['node_daemon_gpu1', 'node_daemon_gpu2', 'node_daemon_cpu1'];
+const MOCK_MODELS: Record<string, string[]> = {
+  prov_claude: ['claude-opus-4-x', 'claude-sonnet-4-6'],
+  prov_deepseek: ['deepseek-v4-pro'],
+  prov_minimax: ['MiniMax-M3'],
+};
+
+function mockCell(model: string, server: string) {
+  let h = 0;
+  const s = `${model}@${server}`;
+  for (let i = 0; i < s.length; i++) h = (h * 31 + s.charCodeAt(i)) & 0xffff;
+  const bucket = h % 10;
+  if (bucket === 7) return { status: 'auth_fail', error_label: '401 key rejected', raw_status_code: 401 };
+  if (bucket === 3) return { status: 'unreachable', error_label: 'connect ETIMEDOUT', raw_status_code: 0 };
+  if (bucket === 9) return { status: 'incompatible', error_label: 'model not served', raw_status_code: 404 };
+  return { status: 'ok', latency_ms: 80 + (h % 600) };
+}
+
+export async function GET(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+  const { searchParams } = new URL(req.url);
+  const providerId = searchParams.get('provider_id') || undefined;
+
+  if (process.env.MOCK_PROVIDERS === '1') {
+    const models = (providerId && MOCK_MODELS[providerId]) || [];
+    const results = models.flatMap(m => MOCK_SERVERS.map(srv => ({
+      provider_id: providerId, model_name: m, daemon_node_id: srv, probed_at: Date.now(), ...mockCell(m, srv),
+    })));
+    return Response.json({ ok: true, mock: true, results });
+  }
+
+  const networkId = await resolveDefaultNetworkId();
+  const args: Record<string, unknown> = { ...(providerId ? { provider_id: providerId } : {}), ...(networkId ? { network_id: networkId } : {}), limit: 500 };
+  try {
+    const res = await callMcp('get_probe_results', args);
+    if (res.status === 404 || res.status === 501) {
+      return Response.json({ ok: false, unconfirmed: true, results: [], error: 'hub lacks RFC-028 get_probe_results (needs #308)' }, { status: 200 });
+    }
+    if (!res.ok) return Response.json({ ok: false, error: `hub ${res.status}`, results: [] }, { status: 502 });
+    const result = (await parseMcpEnvelope(res)) as { ok?: boolean; results?: unknown[]; error?: string };
+    if (result?.ok === false) return Response.json({ ok: false, error: result.error || 'query_failed', results: [] }, { status: 502 });
+    return Response.json({ ok: true, results: Array.isArray(result?.results) ? result.results : [] });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e), results: [] }, { status: 502 });
+  }
+}

package/app/api/anet/providers/route.ts

@@ -0,0 +1,191 @@
+import { requireDashboardAuth } from '@/app/lib/dashboard-auth';
+import { callMcp, parseMcpEnvelope, resolveDefaultNetworkId } from '@/app/lib/hub-mcp';
+
+/**
+ * Model-provider registry proxy (RFC-028 P1 — aligned to the real #308 schema,
+ * commit f32725e; 通信龙 gap-A ruling commhub 1e451a0f).
+ *
+ *   GET  → list_providers, mapped to the UI shape (vendor→type, models objects
+ *          → model_name strings, in_vault→hasKey).
+ *   POST → create only: secret-FIRST. The vault key must exist before the
+ *          provider, so we upsert_network_secret (UPPERCASE-regex key derived
+ *          from the name) then upsert_provider (vendor + models as objects).
+ *          A key is REQUIRED on create (the backend rejects providers whose
+ *          secret_key_ref is not in the vault).
+ *   DELETE / edit → NOT wired: #308's upsert_provider is INSERT-only with no
+ *          enabled arg and there is no update_provider / set_provider_enabled
+ *          tool (P1.5 follow-up). The UI edit/disable/delete controls are
+ *          disabled placeholders; this route reports `unsupported` if called.
+ *
+ * Keys are WRITE-ONLY (vault); never returned to the client. Hub-without-RFC-028
+ * → flagged `unconfirmed` (no fake success). MOCK_PROVIDERS=1 → env-gated
+ * contract-fixture (schema-shaped) for preview; off in production.
+ */
+
+const VENDORS = ['openai-compatible', 'anthropic', 'grok', 'custom'] as const;
+
+interface ProviderInput {
+  name: string;
+  type: string;      // UI label for `vendor`
+  base_url: string;
+  models: string[];  // UI: model name strings
+  apiKey?: string;   // write-only
+}
+
+// UPPERCASE secret-key ref derived from provider name (matches the backend
+// regex /^[A-Z][A-Z0-9_]{0,63}$/): "OpenAI" → "PROVIDER_OPENAI_KEY".
+function secretKeyFor(name: string): string {
+  const slug = name.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 48) || 'PROVIDER';
+  const ref = `PROVIDER_${slug}_KEY`;
+  return /^[A-Z][A-Z0-9_]{0,63}$/.test(ref) ? ref : `PROVIDER_${Date.now().toString(36).toUpperCase().replace(/[^A-Z0-9]/g, '')}_KEY`;
+}
+
+// Anthropic-compatible covers Claude + DeepSeek (api.deepseek.com/anthropic)
+// + MiniMax (api.minimax.chat/anthropic) etc. via custom base_url — preview
+// reflects that real coverage.
+function mockProviders() {
+  // All three live after #320 (SSRF allowlist: anthropic / deepseek /
+  // minimax.chat / minimax.io).
+  return [
+    { provider_id: 'prov_claude', name: 'Claude (Anthropic)', type: 'anthropic', base_url: 'https://api.anthropic.com', models: ['claude-opus-4-x', 'claude-sonnet-4-6'], enabled: true, hasKey: true },
+    { provider_id: 'prov_deepseek', name: 'DeepSeek', type: 'anthropic', base_url: 'https://api.deepseek.com/anthropic', models: ['deepseek-v4-pro'], enabled: true, hasKey: true },
+    { provider_id: 'prov_minimax', name: 'MiniMax', type: 'anthropic', base_url: 'https://api.minimax.chat/anthropic', models: ['MiniMax-M3'], enabled: false, hasKey: true },
+  ];
+}
+
+export async function GET() {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+  if (process.env.MOCK_PROVIDERS === '1') {
+    return Response.json({ ok: true, mock: true, providers: mockProviders() });
+  }
+
+  const networkId = await resolveDefaultNetworkId();
+  const args = networkId ? { network_id: networkId } : {};
+  try {
+    const res = await callMcp('list_providers', args);
+    if (res.status === 404 || res.status === 501) {
+      return Response.json({ ok: false, unconfirmed: true, providers: [], error: 'hub lacks RFC-028 list_providers (needs #308 + hub upgrade)' }, { status: 200 });
+    }
+    if (!res.ok) return Response.json({ ok: false, error: `hub ${res.status}`, providers: [] }, { status: 502 });
+    const result = (await parseMcpEnvelope(res)) as { ok?: boolean; providers?: unknown[]; error?: string };
+    if (result?.ok === false) return Response.json({ ok: false, error: result.error || 'list_failed', providers: [] }, { status: 502 });
+
+    // Map the real shape → UI shape.
+    const providers = (Array.isArray(result?.providers) ? result.providers : []).map((p) => {
+      const pp = p as Record<string, unknown>;
+      const models = Array.isArray(pp.models) ? (pp.models as Array<Record<string, unknown>>).map(m => String(m.model_name || '')).filter(Boolean) : [];
+      return {
+        provider_id: pp.provider_id,
+        name: pp.name,
+        type: pp.vendor,            // vendor → type (UI label)
+        base_url: pp.base_url,
+        models,
+        enabled: pp.enabled === undefined ? true : !!pp.enabled,
+        hasKey: pp.in_vault === undefined ? true : !!pp.in_vault,
+      };
+    });
+    return Response.json({ ok: true, providers });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e), providers: [] }, { status: 502 });
+  }
+}
+
+export async function POST(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+
+  let body: Partial<ProviderInput> & { provider_id?: string; network_id?: string; enabled?: boolean };
+  try { body = await req.json(); } catch { return Response.json({ error: 'invalid JSON body' }, { status: 400 }); }
+
+  // Edit path (RFC-028 P1.5, #317 update_provider — patch semantics; vendor /
+  // secret / network are immutable; changing the key goes via the secret-first
+  // create flow, not here).
+  if (body.provider_id) {
+    if (process.env.MOCK_PROVIDERS === '1') return Response.json({ ok: true, mock: true, provider_id: body.provider_id });
+    const patch: Record<string, unknown> = {};
+    if (body.name !== undefined) patch.name = String(body.name).trim();
+    if (body.base_url !== undefined) patch.base_url = String(body.base_url).trim();
+    if (Array.isArray(body.models)) patch.models = body.models.map(m => String(m).trim()).filter(Boolean).map(m => ({ model_name: m }));
+    if (body.enabled !== undefined) patch.enabled = !!body.enabled;
+    if (!Object.keys(patch).length) return Response.json({ ok: false, error: 'no fields to update' }, { status: 400 });
+    const networkId = body.network_id || (await resolveDefaultNetworkId());
+    try {
+      const res = await callMcp('update_provider', { provider_id: body.provider_id, ...(networkId ? { network_id: networkId } : {}), patch });
+      if (res.status === 404 || res.status === 501) return Response.json({ ok: false, unconfirmed: true, error: 'hub lacks update_provider (needs #317)' }, { status: 200 });
+      const result = (await parseMcpEnvelope(res)) as { ok?: boolean; error?: string };
+      if (result?.ok === false) {
+        // a no-op patch is benign, not a failure.
+        if (result.error === 'no_changes' || result.error === 'noop_no_changes') return Response.json({ ok: true, no_changes: true });
+        return Response.json({ ok: false, error: result.error || 'update_failed' }, { status: 502 });
+      }
+      return Response.json({ ok: true, provider_id: body.provider_id });
+    } catch (e: unknown) {
+      return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e) }, { status: 502 });
+    }
+  }
+
+  const name = (body.name || '').toString().trim();
+  if (!name) return Response.json({ error: 'name required' }, { status: 400 });
+  const vendor = (body.type || 'openai-compatible').toString();
+  if (!VENDORS.includes(vendor as (typeof VENDORS)[number])) {
+    return Response.json({ error: `type must be one of: ${VENDORS.join(', ')}` }, { status: 400 });
+  }
+  const base_url = (body.base_url || '').toString().trim();
+  if (!base_url) return Response.json({ error: 'base_url required' }, { status: 400 });
+  const modelNames = Array.isArray(body.models) ? body.models.map(m => String(m).trim()).filter(Boolean) : [];
+  const apiKey = (body.apiKey || '').toString();
+  // secret-first: the backend requires secret_key_ref to already be in the vault.
+  if (!apiKey) return Response.json({ ok: false, error: 'API key 必填（供应商创建需先写入密钥库）' }, { status: 400 });
+
+  if (process.env.MOCK_PROVIDERS === '1') {
+    return Response.json({ ok: true, mock: true, provider_id: `prov_mock_${Date.now().toString(36)}` });
+  }
+
+  const networkId = body.network_id || (await resolveDefaultNetworkId());
+  const netArg = networkId ? { network_id: networkId } : {};
+  const secret_key_ref = secretKeyFor(name);
+
+  try {
+    // 1) vault the key (OWNER-only on the hub side).
+    const sres = await callMcp('upsert_network_secret', { ...netArg, key: secret_key_ref, value: apiKey });
+    if (sres.status === 404 || sres.status === 501) {
+      return Response.json({ ok: false, unconfirmed: true, error: 'hub lacks RFC-028 upsert_network_secret (needs #308)' }, { status: 200 });
+    }
+    const sresult = (await parseMcpEnvelope(sres)) as { ok?: boolean; error?: string };
+    if (sresult?.ok === false) {
+      return Response.json({ ok: false, error: sresult.error || 'secret_write_failed', detail: 'vault 写入失败（可能需 OWNER 角色）' }, { status: 502 });
+    }
+    // 2) create the provider referencing the vault key + models as objects.
+    const models = modelNames.map(m => ({ model_name: m }));
+    const pres = await callMcp('upsert_provider', { ...netArg, name, vendor, base_url, secret_key_ref, models });
+    if (pres.status === 404 || pres.status === 501) {
+      return Response.json({ ok: false, unconfirmed: true, error: 'hub lacks RFC-028 upsert_provider (needs #308)' }, { status: 200 });
+    }
+    const presult = (await parseMcpEnvelope(pres)) as { ok?: boolean; error?: string; provider_id?: string };
+    if (presult?.ok === false) return Response.json({ ok: false, error: presult.error || 'upsert_failed', result: presult }, { status: 502 });
+    return Response.json({ ok: true, provider_id: presult?.provider_id });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e) }, { status: 502 });
+  }
+}
+
+export async function DELETE(req: Request) {
+  const authFailure = await requireDashboardAuth();
+  if (authFailure) return authFailure;
+  const { searchParams } = new URL(req.url);
+  const providerId = searchParams.get('id');
+  if (!providerId) return Response.json({ error: 'id required' }, { status: 400 });
+  if (process.env.MOCK_PROVIDERS === '1') return Response.json({ ok: true, mock: true });
+  // Soft-delete = update_provider{enabled:false} (#317; no delete_provider).
+  const networkId = await resolveDefaultNetworkId();
+  try {
+    const res = await callMcp('update_provider', { provider_id: providerId, ...(networkId ? { network_id: networkId } : {}), patch: { enabled: false } });
+    if (res.status === 404 || res.status === 501) return Response.json({ ok: false, unconfirmed: true, error: 'hub lacks update_provider (needs #317)' }, { status: 200 });
+    const result = (await parseMcpEnvelope(res)) as { ok?: boolean; error?: string };
+    if (result?.ok === false && result.error !== 'no_changes') return Response.json({ ok: false, error: result.error || 'disable_failed' }, { status: 502 });
+    return Response.json({ ok: true });
+  } catch (e: unknown) {
+    return Response.json({ ok: false, error: e instanceof Error ? e.message : String(e) }, { status: 502 });
+  }
+}

package/app/api/hub/auth/route.ts

@@ -36,7 +36,6 @@ export async function POST(req: Request) {
     }
 
     if (action === 'change_password') {
-      // UI calls it current_password; the hub expects old_password.
       const { token: userToken, current_password, new_password } = payload;
       const res = await hubFetch('/api/auth/password', {
         method: 'POST',
@@ -45,18 +44,7 @@ export async function POST(req: Request) {
       });
       const data = await res.json();
       const response = NextResponse.json(data);
-      // A successful password change rotates the token server-side, so the
-      // hub returns a fresh one. Re-issue the session cookie with it —
-      // otherwise the old token in the existing cookie is now invalid and
-      // the user's very next request would 401 (logged out mid-session).
-      // This is the only action that touches the cookie; the rest just proxy.
       if (data.ok && data.token) {
-        // Behind the Caddy TLS terminator the connection to Next is plain
-        // http, so req.url's protocol reads "http" and a secure cookie would
-        // never be set over the user's real HTTPS session — trust the
-        // x-forwarded-proto the proxy sets, falling back to the raw protocol
-        // for direct (non-proxied) hits. COOKIE_INSECURE=1 forces it off for
-        // local http dev.
         const proto = req.headers.get('x-forwarded-proto') || new URL(req.url).protocol.replace(':', '');
         response.cookies.set(DASHBOARD_SESSION_COOKIE, `v3:${data.token}`, {
           httpOnly: true,

package/app/api/hub/networks/route.ts

@@ -1,4 +1,4 @@
-import { requireDashboardAuth } from '@/app/lib/dashboard-auth';
+import { requireDashboardAuth, getV3UserToken } from '@/app/lib/dashboard-auth';
 import { hubFetch } from '@/app/lib/hub';
 
 export async function GET(req: Request) {

package/app/api/hub/nodes/route.ts

@@ -9,20 +9,6 @@ async function hubHeaders(): Promise<Record<string, string>> {
   return h;
 }
 
-/**
- * Node list with a three-tier fallback so /nodes is never blank while
- * agents are demonstrably live:
- *   1. hub /api/nodes — the persistent node registry (the canonical source).
- *   2. registry empty but sessions exist — derive node rows from live
- *      /api/status sessions (tagged `source: 'sessions'`). The registry can
- *      lag or be empty (older hub, node never persisted) even when agents
- *      are actively connected; deriving from sessions keeps the page useful
- *      instead of showing "no nodes" next to a busy fleet (cf. #92 / #74).
- *   3. upstream non-JSON / not-ok — empty list tagged `source: 'fallback'`,
- *      so the client renders the empty state rather than erroring.
- * The `source` tag lets the client distinguish registry data from the
- * session-derived stand-in. A thrown fetch (hub down) is the only 502.
- */
 export async function GET(req: Request) {
   const authFailure = await requireDashboardAuth();
   if (authFailure) return authFailure;

package/app/api/hub/upload/route.ts

@@ -6,12 +6,6 @@ import path from 'path';
 const UPLOAD_DIR = '/tmp/agent-network-dashboard-uploads';
 const MAX_BYTES = 12 * 1024 * 1024;
 
-// Generate the on-disk name from scratch — the user's original filename is
-// discarded entirely, keeping only a sanitized extension. This makes stored
-// names unguessable and path-traversal-proof (no "../" can survive), so the
-// untrusted upload name never reaches the filesystem. The "<epoch>-<uuid>.<ext>"
-// shape is the contract the GET handler's regex re-validates against — keep
-// the two in sync if this format ever changes.
 function safeName(name: string) {
   const ext = path.extname(name).toLowerCase().replace(/[^a-z0-9.]/g, '');
   return `${Date.now()}-${randomUUID()}${ext || '.bin'}`;
@@ -63,9 +57,6 @@ export async function GET(req: Request) {
 
   const url = new URL(req.url);
   const filename = url.searchParams.get('file') || '';
-  // Path-traversal guard: only serve names matching safeName's exact shape
-  // (<epoch>-<uuid>.<ext>). The pattern admits no '/', '\' or '.' runs, so a
-  // crafted ?file=../../etc/passwd is rejected before it reaches path.join.
   if (!/^[0-9]+-[a-f0-9-]+\.[a-z0-9]+$/i.test(filename)) {
     return Response.json({ error: 'invalid file' }, { status: 400 });
   }

package/app/components/CommandCenter.tsx

@@ -7,6 +7,7 @@ interface CommandCenterProps {
   /** Currently open chat tabs */
   tabs: string[];
   activeTab: string;
+  onOpenTab: (alias: string) => void;
   onCloseTab: (alias: string) => void;
   onSetActive: (alias: string) => void;
   onClose: () => void;
@@ -16,7 +17,7 @@ interface CommandCenterProps {
  * Multi-tab chat panel for commanding multiple agents simultaneously.
  * Wraps TaskChatPanel with a tab bar for switching between agents.
  */
-export function CommandCenter({ tabs, activeTab, onCloseTab, onSetActive, onClose }: CommandCenterProps) {
+export function CommandCenter({ tabs, activeTab, onOpenTab, onCloseTab, onSetActive, onClose }: CommandCenterProps) {
   if (tabs.length === 0) return null;
 
   return (
@@ -67,11 +68,7 @@ export function CommandCenter({ tabs, activeTab, onCloseTab, onSetActive, onClos
           </button>
         </div>
 
-        {/* Render every open tab, toggling visibility with CSS (block/hidden)
-            rather than conditionally mounting only the active one. Each
-            InlineChat owns a live SSE subscription plus scroll position and
-            an unsent draft — unmounting on tab switch would tear down the SSE
-            and lose scroll/draft. Don't "optimize" this to render only active. */}
+        {/* Active chat - render all but only show active (preserves state) */}
         <div className="flex-1 relative overflow-hidden">
           {tabs.map(alias => (
             <div key={alias} className={`absolute inset-0 ${activeTab === alias ? 'block' : 'hidden'}`}>

package/app/components/CommandPalette.tsx

@@ -59,11 +59,6 @@ function fuzzyMatch(hay: string, needle: string): FuzzyResult {
   const N = needle.toLowerCase();
   let hi = 0, ni = 0, score = 0, streak = 0;
   const indices: number[] = [];
-  // Scoring, highest-weighted first: consecutive matches (the `streak`
-  // bonus stacks on the base +2/char, so contiguous hits beat scattered
-  // ones), then matches at a word boundary (+4 — "sl" ranks "Server Logs"
-  // high, Linear/Raycast style), then a small length penalty at the end as
-  // a tiebreaker that prefers tighter/shorter haystacks.
   while (hi < H.length && ni < N.length) {
     if (H[hi] === N[ni]) {
       score += 2 + streak;