agentgui 1.0.1009 → 1.0.1010

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## Mid-thread retry (2026-07-02) — twenty-fifth run
+
+Landed the highest-severity finding deferred from the 24th run (gui-completion #7): retry was hard-gated to the LAST message only — a user unhappy with an earlier assistant reply had no way to redo it. Kit `AgentChat` now offers the retry action on every settled assistant turn, not just `i === lastIdx`; `onRetryMessage(m)` passes the specific message. App `retryTurn(m)` truncates+resends from `m`'s preceding user turn (falls back to the trailing assistant turn when called with no argument, preserving the old "retry last" behavior). **Retrying anything before the trailing turn discards every later turn too** — it now arms the same confirm banner edit-and-resend already uses (generalized with a `kind: 'retry'` tag: "Retry this turn? Retrying will remove the later turns") instead of firing immediately; retrying the actual last turn (no data loss) still executes immediately. Caught and fixed a real bug while generalizing: the old `retryLastTurn()` never cleared `state.chat.resumeSid`/`resumeNote` on truncation, unlike `confirmEditAndResend()` which already did per the "never `--resume` a diverged tail" rule — both paths now share `executeTruncateAndResend()` so this can't drift apart again. Kit pushed `834c81d`, agentgui pushed `18cd971`. Browser-witnessed end-to-end (mid-thread retry click -> confirm banner armed with the correct index -> confirm -> truncated to exactly the retried turn -> resent -> resumeSid cleared), 0 console errors, 28/28 tests. **Note:** this run's Deploy GH Pages CI step flaked twice ("Timeout reached" / "Deployment cancelled") before succeeding on a 3rd rerun — an infra flake in the docs-site deploy environment, not a code regression (`npm publish`, the actual consumer artifact, was green from the first attempt every time).
+
 ## GUI completion sweep (2026-07-02) — twenty-fourth run
 
 `gui-completion` workflow wf_4a731841-832 (33 agents, 17 confirmed). Landed 5 of the smaller-scope findings: Live-tab dashboard state (sort/filter/errors-only) now round-trips through the URL hash (`lsort=`/`lfilter=`/`lerr=1`) and localStorage — previously `lv.filter` wasn't persisted anywhere and the whole dashboard view reverted to defaults on reload. Shortcuts overlay (`?`) now wraps its content in the kit's existing `FocusTrap` component instead of a bare `role=dialog` div — Tab could previously escape into the page behind the overlay. History event rows expose copy even when collapsed (was expanded-only). Settings agents panel gives a not-installed direct-runner agent (claude-code/agy) a "re-check" button, matching the ACP rows' "restart" affordance. **Caught and fixed a real CSRF-guard test gap**: adding the regression test for the upload-PUT route (`scripts/validate-mutations.mjs`), the first draft accidentally included the `Authorization` header — matching every other case in the file but testing the wrong scenario (a stolen-token request, not real cross-site CSRF) — and passed trivially at 200. Corrected to omit auth (the path a real cross-site attacker is actually limited to); the server's existing guard correctly rejects it. **Rule for any CSRF/auth regression test: match the real attacker's capability set exactly — copying a nearby test's header pattern can silently test the wrong threat model.** 12 findings deferred to their own re-scoped PRD row (mid-thread retry/fork, file-management move UX with folder-tree picker, event-level permalinks, rolling context-size indicator — each needs a larger architecture change than a targeted fix). No kit changes this run. Pushed `d3e2d1e`. 28/28 tests, 17/17 validate-mutations, 0 console errors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1009",
+  "version": "1.0.1010",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",