@stratusagent/dashboard 0.11.1 → 0.11.3

package/README.md

@@ -52,7 +52,7 @@ conversations, and a live activity feed.
 **Agent** — one agent, three tabs. *Chat* streams a conversation as it
 happens: text arrives token by token, tool calls appear as status lines, and
 the transcript is re-read from the daemon when the turn settles so the page
-never quietly disagrees with what is stored. *Activity* is the same event
+never quietly disagrees with what is stored. It is re-read the same way when a message an agent overheard lands in the conversation with no turn at all — `session.observed` is the only sign of it, and the activity feed shows it as *overheard a message*. *Activity* is the same event
 stream filtered to that agent. *Settings* edits the soul — name, persona,
 provider and model pins — through a validated round-trip.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratusagent/dashboard",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

package/ui/app.js

@@ -162,6 +162,9 @@ const describe = (envelope) => {
     case 'session.created': return 'started a conversation';
     case 'session.completed': return 'finished a turn';
     case 'session.failed': return `turn failed — ${event.error}`;
+    // News, unlike `session.updated`: a message entered the conversation
+    // with no turn to announce it, so this line is the only sign of it.
+    case 'session.observed': return 'overheard a message';
     case 'tool.called': return `ran ${event.call.toolName}`;
     case 'tool.completed': return `${event.result.toolName} ${event.result.ok ? 'succeeded' : 'failed'}`;
     case 'tool.denied': return `${event.call.toolName} was denied`;
@@ -220,7 +223,9 @@ const handleEnvelope = (envelope) => {
   if (type === 'tool.approval-requested' || type === 'tool.approval-resolved') {
     void refreshCore();
   }
-  if (type === 'session.completed' || type === 'session.failed' || type === 'session.created') {
+  // An overhear belongs here too: it moves the session's own timestamp,
+  // which is what the overview orders by, and emits nothing else.
+  if (type === 'session.completed' || type === 'session.failed' || type === 'session.created' || type === 'session.observed') {
     void refreshCore();
     void refreshForRoute();
   }

package/ui/lib/grants.d.ts

@@ -0,0 +1,6 @@
+// Types for the one UI module a test imports. The UI itself is plain ES
+// modules with no build step; this declaration is what lets `pnpm typecheck`
+// cover the test without pretending the module is TypeScript.
+export type AlwaysMeans = 'scope' | 'origin' | 'tool' | 'session';
+/** The line shown beside **Always allow**, or undefined when the lifetime is unknown. */
+export const alwaysOffer: (always: AlwaysMeans | undefined, agentName: string) => string | undefined;

package/ui/lib/grants.js

@@ -0,0 +1,31 @@
+/**
+ * What **Always allow** would actually do, said beside the button.
+ *
+ * The lifetime is the half of the question that button widens, and it
+ * differs by tool: a standing grant to the agent outlives every session and
+ * every restart, while a send outside a schedule lasts only this
+ * conversation. An operator cannot tell those apart from a button reading
+ * "Always allow" — which is the whole defect step 28 exists to close, so
+ * leaving this surface silent would reintroduce it here.
+ *
+ * `always` rides in on the request (`GET /approvals` and
+ * `tool.approval-requested`), so this never guesses: it is absent exactly
+ * when the answer is remembered nowhere, and `oneShot` already covers that
+ * case with its own line.
+ */
+export const alwaysOffer = (always, agentName) => {
+  switch (always) {
+    case 'tool':
+      return `Always allow grants this tool to ${agentName} until an operator revokes it.`;
+    case 'session':
+      return 'Always allow stops this tool asking again for the rest of this session.';
+    case 'scope':
+      return "Always allow remembers this command's scope for this agent, until revoked.";
+    case 'origin':
+      return 'Always allow remembers this site for this agent, until revoked.';
+    default:
+      // A request from a daemon that does not label its approvals — an older
+      // one across an upgrade. Saying nothing beats guessing at a lifetime.
+      return undefined;
+  }
+};

package/ui/views/agent.js

@@ -383,9 +383,14 @@ export const renderAgent = (agentId, initialSessionId) => {
 
     // Anything that changes the stored conversation is worth re-reading even
     // when somebody else caused it — it is the same conversation. Only the
-    // in-flight rendering below is ours alone.
+    // in-flight rendering below is ours alone. An overhear is always
+    // somebody else's: it runs no turn, so it carries no turn id and this
+    // event is the only one it emits — and a message in the transcript
+    // that no completion follows is exactly the change this branch exists
+    // to notice. The session list re-reads too, since its order follows
+    // the row's own timestamp, which an overhear moves.
     if (!isOurTurn(envelope)) {
-      if (event.type === 'session.completed' || event.type === 'session.failed') {
+      if (event.type === 'session.completed' || event.type === 'session.failed' || event.type === 'session.observed') {
         void loadTranscript();
         void loadSessions();
       }

package/ui/views/dashboard.js

@@ -1,6 +1,7 @@
 import { ago, duration, el, until } from '../lib/dom.js';
 import { api } from '../lib/api.js';
 import { avatar } from '../lib/avatar.js';
+import { alwaysOffer } from '../lib/grants.js';
 import { isActive, navigate, refreshCore, store } from '../app.js';
 
 export const activityPanel = (filter) => {
@@ -46,6 +47,7 @@ const approvalCard = () => {
     ),
     el('div', { class: 'approvals-list' }, ...store.approvals.map((request) => {
       const agent = store.agents.find((candidate) => candidate.id === request.agentId);
+      const offer = request.oneShot ? undefined : alwaysOffer(request.always, agent?.name ?? request.agentId);
       return el('div', { class: 'approval' },
         el('div', { class: 'row' },
           agent ? avatar(agent, 24) : null,
@@ -66,9 +68,16 @@ const approvalCard = () => {
         // answer — a `dangerous` tool, or a browser action with no page to
         // grant. There it does exactly what **Allow once** does, under a
         // label promising a standing grant nobody gets.
+        //
+        // And where there IS one, what it grants: for most gated tools that
+        // is a standing grant to the agent, outliving this session and every
+        // restart, which is a larger thing to hand out than the session the
+        // button used to buy.
         request.oneShot
           ? el('div', { class: 'sub' }, 'An approval covers this call only — nothing about it is remembered.')
-          : null,
+          : offer
+            ? el('div', { class: 'sub' }, offer)
+            : null,
         el('div', { class: 'actions' },
           el('button', { class: 'primary small', onClick: () => decide(request.requestId, 'once') }, 'Allow once'),
           request.oneShot