agentgui 1.0.1019 → 1.0.1021

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## Sessions-rail selection dead-click fix (2026-07-03) — thirtieth run
+
+User feedback: "layout and design choices look weird... make maximum sense." Live-browser audit of history/live tabs (screenshots + `window.__agentgui` state probing, not a full agent fan-out) found a real logic gap the prior 29 runs' visual sweeps never caught: the conversation rail (`ConversationList`) stays mounted on files/live/settings tabs (`keepSessionsTrack`) and is captioned "Browse a conversation's events" there — but `onSelect` (`site/app/js/app.js` sessions-column builder) only special-cased the chat tab (`resumeInChat`); every other tab fell through to `loadSession(sid)`, which sets `state.selectedSid`/fetches events but never switches tabs. Since only the History tab's `historyMain()` renders `state.events`, clicking a row while on Live/Files/Settings was a dead click — data loaded into state that nothing on screen displayed, with a caption promising an outcome the click didn't deliver. Fixed: selecting from any non-chat tab now navigates to history first. Verified live: `state.tab` was `'live'`, clicked `.ds-session-row`, `state.tab` became `'history'` with `selectedSid` set and the events endpoint fetched. **Standing rule: whenever a persistent-across-tabs component (kept mounted via a `keepXTrack` pattern) has an interaction whose effect is rendered by only ONE of the tabs it appears on, every OTHER tab's handler must produce the same visible effect (usually by navigating to the tab that renders it) — a component kept visually consistent across tabs but behaviorally inert on most of them is worse than not showing it at all.** No kit changes this run (app-only wiring fix). agentgui pushed `c1e4915`.
+
 ## Mobile sessions-drawer sliver fix (2026-07-03) — twenty-ninth run
 
 Scoped negative-space/attention follow-up (not a full agent fan-out) to the explicit "looks very diy" feedback. Live-browser screenshot + DOM measurement at 420px found a real regression the prior two runs' screenshot audits missed: the closed `.ws-sessions` drawer left a ~35px sliver visibly overlapping the chat content on mobile. Root cause in `../design` `app-shell.css`: the `<=1100px` breakpoint's closed-state `transform: translateX(-110%)` assumes the drawer's `left` is `0`; the `<=900px` breakpoint then shifts the drawer's `left` to `var(--ws-rail-w-collapsed)` (60px) so it sits right of the icon-only rail, but never adjusted the closed-state translate to match — `-110%` of a 248px-wide drawer is only -272.8px, undershooting the needed -308px (left + width) by ~35px. Fixed by overriding the closed-state transform inside the 900px block: `translateX(calc(-100% - var(--ws-rail-w-collapsed)))`, which scales correctly with both the drawer width and the rail offset. Verified via `getBoundingClientRect` before (x:-212.8, rightEdge:35.2 — visible) and after (x:-248, rightEdge:0 — fully clear) plus before/after screenshots. **Standing rule: any drawer/overlay whose `left`/`inset` changes across breakpoints must re-derive its closed-state transform from that breakpoint's own offset — a transform tuned for one breakpoint's geometry silently breaks at the next if the offset shifts underneath it.** Kit pushed `76b2bac`, agentgui pushed `4bb9f3f`.
@@ -24,7 +28,7 @@ Landed the highest-severity finding deferred from the 24th run (gui-completion #
 
 ## GUI completion sweep (2026-07-02) — twenty-fourth run
 
-`gui-completion` workflow wf_4a731841-832 (33 agents, 17 confirmed). Landed 5 of the smaller-scope findings: Live-tab dashboard state (sort/filter/errors-only) now round-trips through the URL hash (`lsort=`/`lfilter=`/`lerr=1`) and localStorage — previously `lv.filter` wasn't persisted anywhere and the whole dashboard view reverted to defaults on reload. Shortcuts overlay (`?`) now wraps its content in the kit's existing `FocusTrap` component instead of a bare `role=dialog` div — Tab could previously escape into the page behind the overlay. History event rows expose copy even when collapsed (was expanded-only). Settings agents panel gives a not-installed direct-runner agent (claude-code/agy) a "re-check" button, matching the ACP rows' "restart" affordance. **Caught and fixed a real CSRF-guard test gap**: adding the regression test for the upload-PUT route (`scripts/validate-mutations.mjs`), the first draft accidentally included the `Authorization` header — matching every other case in the file but testing the wrong scenario (a stolen-token request, not real cross-site CSRF) — and passed trivially at 200. Corrected to omit auth (the path a real cross-site attacker is actually limited to); the server's existing guard correctly rejects it. **Rule for any CSRF/auth regression test: match the real attacker's capability set exactly — copying a nearby test's header pattern can silently test the wrong threat model.** 12 findings deferred to their own re-scoped PRD row (mid-thread retry/fork, file-management move UX with folder-tree picker, event-level permalinks, rolling context-size indicator — each needs a larger architecture change than a targeted fix). No kit changes this run. Pushed `d3e2d1e`. 28/28 tests, 17/17 validate-mutations, 0 console errors.
+`gui-completion` workflow wf_4a731841-832 (33 agents, 17 confirmed). Landed 5 smaller-scope findings (live-tab dashboard state persistence, shortcuts overlay FocusTrap, history copy-when-collapsed, settings re-check affordance) plus a CSRF-regression-test gap (a test's `Authorization` header accidentally matched the wrong threat model). Full detail in rs-learn (recall "agentgui 24th run GUI completion sweep"). Pushed `d3e2d1e`.
 
 ## GUI perceived-performance sweep (2026-07-02) — twenty-third run
 
@@ -103,11 +107,7 @@ One-product feel sweep (61 agents -> 40 gaps, `PUNCHLIST-COHESION.md`, workflow
 
 ## GUI predictability + polish sweep (2026-06-05) — fifth maximum-effort run
 
-Polish sweep on the shipped Claude-Desktop redesign (`wf_980345e1-201`, 65 agents -> 44 gaps, `PUNCHLIST-POLISH.md`); new workflow `.claude/workflows/gui-predictability-polish.js`. Landed `FileGrid` sort/filter/skeleton/keyboard, `SessionCard` words+disc status + last-activity/current-tool + `onStopAll`, `ChatMessage` streaming caret + `.chat-msg-actions`, `AgentChat` jump-to-latest, `ContextPane` last-turn usage, the load-bearing `<900px` drawer fix (`.ws-scrim` + `toggleWsDrawer`), and `confineToRoots()` realpath symlink-confinement on `/api/list,file,image`. The 7th run (above) supersedes/extends most of these. Full detail in rs-learn (recall "agentgui GUI predictability+polish sweep").
-
-**Security (`lib/http-handler.js`).** New `confineToRoots()` shared helper adds `fs.realpathSync` re-confinement to `/api/list`, `/api/file`, `/api/image` — a symlink living inside an allowed root but pointing OUTSIDE it passed the lexical prefix check but the resolved target now fails closed (symlink-escape / link-traversal, the workflow's one high-severity server gap).
-
-**Witness.** Live at `localhost:3000/gm/`, 0 console/page errors: shell+5 rail items, session groups [Today,Earlier], files sort(`size asc`)/filter-narrows/keyboard-focus-moves, grid `role=listbox`, live dashboard empty-state, ContextPane, jump button + scrim present; pane reflow chat=4cols files/live/settings=2cols(`ws-no-pane`) history=3cols with NO h-scroll on any tab; 420px mobile sessions-drawer opens + scrim visible + no h-scroll; whole-DOM glyph sweep count:0 (kept middot/ellipsis/dash). Kit `lint-tokens`+`lint-glyphs` pass on build. Deliberately scoped-out (noted in punch-list, not gaps): inline split-pane file preview (modal retained — predictable, focus-trapped) and persistent mid-conversation suggestions (empty-only starter pattern kept). Update flow unchanged: edit kit -> `node scripts/build.mjs` -> copy `dist/247420.{js,css}` into `site/app/vendor/anentrypoint-design/` -> witness -> push kit.
+Superseded/extended by the 7th run. Load-bearing survivor: `confineToRoots()` in `lib/http-handler.js` applies `fs.realpathSync` re-confinement on `/api/list`, `/api/file`, `/api/image` — symlink-escape fails closed. Full detail in rs-learn (recall "agentgui-fifth-run-polish-detail").
 
 ## Claude-Desktop redesign + embedding fix (2026-06-05) — fourth maximum-effort run
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1019",
+  "version": "1.0.1021",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",