agentgui 1.0.1020 → 1.0.1022

package/AGENTS.md

@@ -107,11 +107,7 @@ One-product feel sweep (61 agents -> 40 gaps, `PUNCHLIST-COHESION.md`, workflow
 
 ## GUI predictability + polish sweep (2026-06-05) — fifth maximum-effort run
 
-Polish sweep on the shipped Claude-Desktop redesign (`wf_980345e1-201`, 65 agents -> 44 gaps, `PUNCHLIST-POLISH.md`); new workflow `.claude/workflows/gui-predictability-polish.js`. Landed `FileGrid` sort/filter/skeleton/keyboard, `SessionCard` words+disc status + last-activity/current-tool + `onStopAll`, `ChatMessage` streaming caret + `.chat-msg-actions`, `AgentChat` jump-to-latest, `ContextPane` last-turn usage, the load-bearing `<900px` drawer fix (`.ws-scrim` + `toggleWsDrawer`), and `confineToRoots()` realpath symlink-confinement on `/api/list,file,image`. The 7th run (above) supersedes/extends most of these. Full detail in rs-learn (recall "agentgui GUI predictability+polish sweep").
-
-**Security (`lib/http-handler.js`).** New `confineToRoots()` shared helper adds `fs.realpathSync` re-confinement to `/api/list`, `/api/file`, `/api/image` — a symlink living inside an allowed root but pointing OUTSIDE it passed the lexical prefix check but the resolved target now fails closed (symlink-escape / link-traversal, the workflow's one high-severity server gap).
-
-**Witness.** Live at `localhost:3000/gm/`, 0 console/page errors: shell+5 rail items, session groups [Today,Earlier], files sort(`size asc`)/filter-narrows/keyboard-focus-moves, grid `role=listbox`, live dashboard empty-state, ContextPane, jump button + scrim present; pane reflow chat=4cols files/live/settings=2cols(`ws-no-pane`) history=3cols with NO h-scroll on any tab; 420px mobile sessions-drawer opens + scrim visible + no h-scroll; whole-DOM glyph sweep count:0 (kept middot/ellipsis/dash). Kit `lint-tokens`+`lint-glyphs` pass on build. Deliberately scoped-out (noted in punch-list, not gaps): inline split-pane file preview (modal retained — predictable, focus-trapped) and persistent mid-conversation suggestions (empty-only starter pattern kept). Update flow unchanged: edit kit -> `node scripts/build.mjs` -> copy `dist/247420.{js,css}` into `site/app/vendor/anentrypoint-design/` -> witness -> push kit.
+Superseded/extended by the 7th run. Load-bearing survivor: `confineToRoots()` in `lib/http-handler.js` applies `fs.realpathSync` re-confinement on `/api/list`, `/api/file`, `/api/image` — symlink-escape fails closed. Full detail in rs-learn (recall "agentgui-fifth-run-polish-detail").
 
 ## Claude-Desktop redesign + embedding fix (2026-06-05) — fourth maximum-effort run
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1020",
+  "version": "1.0.1022",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",