agentgui 1.0.1042 → 1.0.1044

package/.gm/memories/.flat-export-done

@@ -1 +1 @@
-{"digest":"fb6606ab31d8a99d:n=50","total":50}
+{"digest":"fc5b1d9e8eb6b62a:n=7","total":7}

package/.gm/memories/mem-231ff5de003f20f0-586.md

@@ -0,0 +1,8 @@
+---
+key: mem-231ff5de003f20f0-586
+ns: default
+created: 1783842773069
+updated: 1783842773069
+---
+
+{"claim":"All grants for opened docs + derived/created docs are pre-accepted","scope":"feedback","why":"Tiffany hit SCOPE_NEEDED on sheets_read because URL-heuristic grant fired for converted /spreadsheets/d/ URL but her OAuth lacked sheets scope. User rule: opening a doc implies all access needed to work with it AND any derivative is approved upfront.","witness_evidence":"public/js/streaming/acp-client.js DOC_TYPE_CATEGORIES broadened to read+write across doc-domain; created docs auto-tracked via docAccess.addCreated in functions/streaming/modules/anthropic-gemini-proxy.js:129"}

package/.gm/memories/mem-38b7e24dbcba2f3e-639.md

@@ -0,0 +1,8 @@
+---
+key: mem-38b7e24dbcba2f3e-639
+ns: default
+created: 1783844902974
+updated: 1783844902974
+---
+
+HISTORICAL/SUPERSEDED (do not trust): agentgui briefly (2026-05-29) loaded anentrypoint-design from unpkg@latest at runtime instead of a local vendored copy, for always-latest tracking at the cost of requiring network + drift on upstream publish. This was REVERTED - as of the 2026-06-04/06-05 runs, index.html loads the DS kit from the LOCAL ./vendor/anentrypoint-design/247420.{js,css} again (re-confirmed live via browser witness on the 37th run, 2026-07-12: <link href='./vendor/anentrypoint-design/247420.css'>). AGENTS.md's 'DS load = LOCAL vendor' section is the current truth; any memory claiming unpkg is the live source is stale.

package/.gm/memories/mem-455b3beb4afabe14-591.md

@@ -0,0 +1,8 @@
+---
+key: mem-455b3beb4afabe14-591
+ns: default
+created: 1780592707612
+updated: 1780592707612
+---
+
+agentgui plugin tool provisioning on Windows: lib/tool-spawner.js must iterate bun->npx fallback. BUNX_RUNNERS=['bun','npx'] tries each in sequence; on Windows hosts without bun the missing-command error arrives via stderr+close (not the 'error' event), so isMissingCmdError regex matches /not recognized|ENOENT|command not found|cannot find/i on BOTH error.message and captured stdout+stderr. Only falls through to next runner when missing flag set. Pattern: binary-might-not-exist -> runner fallback + check both error.message and process output streams + cross-platform regex alternation.

package/.gm/memories/mem-4845ee594759151c-560.md

@@ -0,0 +1,8 @@
+---
+key: mem-4845ee594759151c-560
+ns: default
+created: 1780592706754
+updated: 1780592706754
+---
+
+agentgui WebSocket /sync endpoint testing: server sends sync_connected with clientId on connect. Legacy handler lib/ws-legacy-handlers.js handles ping->pong, subscribe->subscription_confirmed, get_subscriptions->subscriptions, unsubscribe, latency_report. All responses use codec encode/decode (lib/codec.js). Message ordering requires registering the ws.on('message') handler BEFORE sending. Test pattern: const queued=[]; let waiting; ws.on('message',...); queued.forEach(m=>ws.send(m)); waiting.resolve(...) — ensures handler is live before messages flow.

package/.gm/memories/mem-8f59884039787ef3-743.md

@@ -0,0 +1,8 @@
+---
+key: mem-8f59884039787ef3-743
+ns: default
+created: 1780592686732
+updated: 1780592686732
+---
+
+agentgui live validation target: https://buildesk.acc.l-inc.co.za/gm — nginx basic-auth user 'abc' password '123,slam,123,slam' (also satisfies the app's own PASSWORD gate). App listens PORT=9897 BASE_URL=/gm behind nginx (proxy_pass 127.0.0.1:9897). For the gm browser verb, use the DEFAULT session (NOT 'session new <name>' which uses an extension bridge that cannot reach external HTTPS) and set page.setExtraHTTPHeaders Authorization Basic (embedding creds in the URL breaks the app's fetch('/health') with 'URL that includes credentials'). Static site/app edits go live immediately (etag-keyed asset cache, no restart). Playwright reuses page across goto so clearCookies/about:blank to defeat session caching when verifying fresh edits.

package/.gm/memories/mem-993ab31f7a10aefa-718.md

@@ -0,0 +1,8 @@
+---
+key: mem-993ab31f7a10aefa-718
+ns: default
+created: 1780593487331
+updated: 1780593487331
+---
+
+agentgui DS loading: index.html loads anentrypoint-design from unpkg @latest (247420.css + 247420.js) at RUNTIME, not the local vendor/ copy. Deliberate (commit 947086e) because the chat surface uses the load-bearing AgentChat kit component which exists in @latest (0.0.186) but NOT in the older locally-vendored bundle. So: GUI needs network, shifts on upstream publish, local vendoring bypassed, and the vendored bundle's si/ri/_s jsdelivr markdown imports (marked@15/dompurify@3/prismjs) are moot while on unpkg. To restore offline: re-vendor 0.0.186+ (has AgentChat) + re-localize (gzip Ha blob, fonts, CDN consts) + rewire si/ri/_s to ../cdn/ + point index.html back to ./vendor/. PRD row revendor-ds-186-offline.

package/.gm/memories/mem-a3e440db285f655a-995.md

@@ -0,0 +1,8 @@
+---
+key: mem-a3e440db285f655a-995
+ns: default
+created: 1779979137157
+updated: 1779979137157
+---
+
+agentgui GUI styling (site/app): The anentrypoint-design DS bundle (vendor/anentrypoint-design/247420.js) exposes CSS vars --ff-display (='Inter, system-ui' in this bundle version — NOT Space Grotesk) and --ff-mono (='JetBrains Mono'); there is NO --font-sans. index.html body must use var(--ff-display). CRITICAL CASCADE GOTCHA: installStyles() injects the DS bundle CSS into a runtime <style data-247420> appended AFTER index.html's head <style>, so equal-specificity local overrides LOSE on source order. To override a DS component rule (.app-topbar nav a.active, .chat-head .sub, focus rings, etc) you must out-specify the .ds-247420-prefixed DS selector OR use !important. The offline vendoring mechanism (gzip Ha CSS blob in 247420.js + 3 CDN string consts Us/Za/_a) is still valid. DS Chat component ignores its sub prop and renders its own zero-padded '00 msgs' count in .chat-head .sub — hide via CSS. EventList rows are div.row[role=button] (click-to-expand) inside .ds-event-list.

package/.gm/memories/mem-cdf04ff6a6a0aa6f-671.md

@@ -0,0 +1,8 @@
+---
+key: mem-cdf04ff6a6a0aa6f-671
+ns: default
+created: 1783844901564
+updated: 1783844901564
+---
+
+agentgui webjsx applyDiff array-keying rule: children arrays that mix keyed VElements with raw text/numbers crash in vendor/webjsx/applyDiff.js with 'Cannot read properties of undefined (reading key)'. webjsx requires ALL siblings in an array prop (children, right, left, breadcrumbs, etc.) to either ALL be VElements with keys or ALL be non-keyed - passing Crumb({right:[h('span',{key:'a'},'A'), h('span',{key:'b'},'B'), 'connected']}) crashes because the render loop tries to read .key on the bare string. Fix: wrap any bare strings as keyed VElements, e.g. h('span',{key:'dot'},'connected'). Surfaced 2026-05-04 in crumbRight construction in site/app/js/app.js view().

package/.gm/memories/mem-e490a181de6469fc-487.md

@@ -0,0 +1,8 @@
+---
+key: mem-e490a181de6469fc-487
+ns: default
+created: 1783843022402
+updated: 1783843022402
+---
+
+CORRECTION (37th run, 2026-07-12): agentgui's live index.html loads the design kit from LOCAL ./vendor/anentrypoint-design/247420.{css,js}, NOT unpkg. Witnessed directly on https://buildesk.acc.l-inc.co.za/gm/ via browser dom= query. An older memory record (mem-1780593485911-5-718) claiming unpkg @latest is STALE - it described a transient state that was reverted; AGENTS.md's 'DS load = LOCAL vendor' section is correct and current. Trust this record over the unpkg one going forward.

package/.gm/memories/mem-fe3faa1652f07239-480.md

@@ -0,0 +1,8 @@
+---
+key: mem-fe3faa1652f07239-480
+ns: default
+created: 1780592683616
+updated: 1780592683616
+---
+
+agentgui DS (anentrypoint-design 247420.js) SearchInput component (internal De) sets aria-label = (label || placeholder) and IGNORES any aria-label prop you pass. To give the history search box a real accessible name, pass label: AND placeholder: (same string). A post-render setAttribute race-loses against the DS re-render. Signature: De({value,placeholder='search…',onInput,onSubmit,name='q',key,label}). This is the SearchInput export. Witnessed live on buildesk 2026-06-04.

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## GUI logic+predictability sweep (2026-07-12) — thirty-seventh run
+
+`gui-logic-predictability` workflow wf_5eec2403-09d (30 agents, 6 hunt lenses + verify + synthesize, 0 errors) — 15 confirmed findings, all implemented. App (`site/app/js/app.js`): `stopActiveChat` no longer leaves the per-card stop button permanently stuck on a failed cancel (deletes the sid from the stopping Set + surfaces an error on rejection instead of swallowing it); Files dialogs (rename/delete/mkdir/bulk) now restore keyboard focus to the triggering element on close, mirroring the existing cwd-edit pattern; `runBulkDelete`/`runBulkMove` gained the same stale-dialog guard `runFileMutation` already had; the "Untitled conversation" fallback consolidated to one `UNTITLED_CONVERSATION` constant (3 call sites had drifted casing); the settings db health chip now reads `connected`/`offline` instead of a third `online`/`offline` register, matching the adjacent connection chip; history search placeholder/caption now discloses it searches all projects' titles+messages; `runningPanel()` shows a lightweight "will also appear in live" hint during the send-to-active-poll gap instead of returning null; `computeLiveSessions()`'s external-session stale threshold no longer silently multiplies `STALE_AFTER_MS` by an undocumented 0.6 (owned and external sessions in the same objective state now report the same status); pasted/dropped composer files upload through the existing confined `PUT /api/upload-file` and insert the resulting path into the draft (was a permanent no-op/dead-end toast); the sessions rail's 60-item cap gained a load-more affordance (`state.sessionsLimit += 60`), mirroring the existing `eventsLimit` "load older" pattern; `PERSIST_MSG_CAP` truncation now surfaces a dismissible banner instead of silently dropping older turns from localStorage. Kit (`design/src/components/{chat,agent-chat,content,files,sessions}.js`, `app-shell.css`, `chat.css`): deleted dead `onAttach`/`onMenu` composer toolbar plumbing (no such feature existed); `AgentChat` now forwards `onEmoji` to its internal `ChatComposer` call (the emoji toolbar button was invisible because `AgentChat` — the wrapper agentgui actually calls, not `ChatComposer` directly — never destructured the prop; caught mid-EXECUTE via a `transition to=PLAN` re-scope); `SearchInput` and the Files filter input both gained Escape-to-clear + a visually-hidden `aria-live` result-count region; `ConversationList` gained `hasMore`/`onLoadMore`; composer textarea `overflow-y` changed from focus-only `auto` to always-`auto` so a capped-height composer keeps its scroll cue after blur. Kit built+tested (`bun test.js` all pass, all build lints pass), re-vendored, browser-witnessed live on buildesk across chat/history/settings/files (0 blocking errors on clean navigations). Kit pushed `af028ff`, agentgui pushed `a3b844d`, all CI green both repos. **Standing gotcha reconfirmed: this env's `gm browser` verb text-protocol (`dom=<selector>\n<script>`) only evaluates the selector query, not the trailing script — use `dom=<precise-selector>` alone to inspect attributes/rect, not as a general page-eval channel. Also: embedding Basic-Auth creds directly in a `page.goto` URL (`https://user:pass@host/...`) breaks the app's own same-origin `fetch()` calls with "Request cannot be constructed from a URL that includes credentials" — do one embedded-creds navigation to seed the browser's per-origin Basic-Auth cache, then navigate again WITHOUT embedded creds (plain URL or `?token=`) for any witness that needs real fetches to succeed.**
+
 ## GUI AI-tell sweep (2026-07-10) — thirty-sixth run
 
 Follow-on to the 35th run's AI-tell sweep (commit 1702fa8). `gui-ai-tell-sweep` workflow wf_a53b7d8f-27b (26 agents, 25 done/1 verify-agent hit a mid-response connection error, 200 tool calls): 5 hunter lenses (gradient-glow-glass, emoji-generic-icons, oversaturated-color, boilerplate-copy, layout-uniformity-tells) found 20 candidates, adversarial verify confirmed 11 (9 correctly refuted as already-deliberate — status-disc pulse triplicate, `--sun` "retired" claim, radius-scale uniformity — the kept-typography-style guard doing its job on non-typography claims too). Landed in the kit (`design/app-shell.css`/`chat.css`/`src/components/agent-chat.js`): hardcoded one-off context-menu/toast shadow → `var(--shadow-overlay)` token; three data-metering fills (barchart/upload/bar) demoted from the loudest acid-lime `--accent` to neutral `--fg-3` (color reserved for state, not routine progress); checkbox checked-fill `--accent`→`--fg`; drag-over collapsed from a triple accent stack (tint+border+ring) to a single dashed border; the keyboard-only `.skip-to-main` link de-loudened from CTA-accent to neutral ink (it was visually identical to the primary send button despite being invisible to sighted users); session-unread dot neutralized off `--accent` so it stops competing with the active row's accent; dead template-shaped `.empty-state` child rules and an unused `.ds-panel-trio`/`.ds-panel-grid` hover-lift block deleted; AgentChat empty-state copy de-boilerplated away from "invitation" framing. App: `keyboardPanel()`/`preferencesPanel()` gained `kind:'wide'` so settings' purely-informational/utility panels read lighter than the consequence-bearing backend/agents panels. Kit rebuilt+re-vendored, browser-witnessed live (0 pageErrors, all 4 sampled CSS rules confirmed post-fix in the real CSSOM). Kit pushed `4de1771` (after a rebase — a concurrent version-bump commit had landed), agentgui pushed `e6dc1d9`, all CI green both repos. **Tool-defect note (recorded, not re-fixed — the workaround is durable): the gm-plugkit `fs_write` verb's payload key is `content` (a JSON string), not `body` — passing `{path, body:{...}}` silently no-ops with `bytes:0` and no error, which nearly let a stale/empty `.ci-validated` marker slip through this run; caught via `recall` mid-VERIFY and corrected before COMPLETE.**
@@ -226,21 +230,15 @@ Node v24 lacks a prebuilt better-sqlite3 binary; the node path needs a from-sour
 
 ## webjsx applyDiff Array Keying (2026-05-04)
 
-**Children arrays that mix keyed VElements with raw text/numbers crash in `vendor/webjsx/applyDiff.js`.**
-
-`webjsx` requires all siblings in an array prop (children, right, left, breadcrumbs, etc.) to either ALL be VElements with keys or ALL be non-keyed. Passing `Crumb({ right: [h('span', { key: 'a' }, 'A'), h('span', { key: 'b' }, 'B'), 'connected'] })` crashes on render with `TypeError: Cannot read properties of undefined (reading 'key')` at line 247420.js when the render loop tries to read `.key` on the bare string.
-
-Fix: wrap any bare strings as keyed VElements: `h('span', { key: 'dot' }, 'connected')`. Rule: if ANY sibling in an array has a key, ALL siblings must be VElements (no raw strings or numbers).
-
-Surfaced 2026-05-04 while validating the chat surface in `site/app/`. Fix applied to crumbRight construction in `site/app/js/app.js` view().
+**Rule still binding: mixing keyed VElements with raw strings/numbers in any webjsx array prop crashes `applyDiff`.** Full detail in rs-learn (recall "agentgui webjsx applyDiff array-keying rule").
 
 ## Live History Stream Wiring (2026-05-05)
 
 `site/app/js/app.js` opens an SSE EventSource on `navTo('history')` (`B.streamHistory`, `state.live` shape, hello/event/conversation/error dispatch, rAF-throttled renders) against ccsniff's in-process `/v1/history/stream`; first `/v1/history/*` request triggers a 30-90s synchronous JSONL walk (`CLAUDE_PROJECTS_DIR`) — health-check timeouts during that window are normal. Full detail in rs-learn (recall "agentgui Live History Stream Wiring").
 
-## Runtime CDN: GUI loaded from unpkg (2026-05-29)
+## Runtime CDN: GUI loaded from unpkg — SUPERSEDED, do not trust
 
-The GUI loads `anentrypoint-design` from `https://unpkg.com/anentrypoint-design@latest` at runtime (import map + CSS link in `index.html`) so agentgui always tracks the latest published kit with no hand-maintained vendored copy. This **requires a network connection** — the earlier offline guarantee was intentionally dropped in favour of always-latest. The DS itself fetches its fonts from `unpkg.com/anentrypoint-design@latest/dist/fonts/` (set in the kit's `scripts/build.mjs` `FONT_BASE`). The `site/app/vendor/` tree is no longer imported; the old vendored DS bundle + `vendor/cdn/` assets are dead and may be removed. Witness the live GUI by confirming the import map resolves to unpkg and `.agentchat` renders with 0 console errors.
+This 2026-05-29 unpkg-at-runtime approach was reverted; see "DS load = LOCAL vendor" below for the current truth (re-confirmed live on the 37th run, 2026-07-12). Historical detail in rs-learn (recall "agentgui unpkg superseded local vendor").
 
 ## Agent/model/session management (2026-05-28)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1042",
+  "version": "1.0.1044",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -3,7 +3,7 @@ import * as B from './backend.js';
 
 installStyles().catch(() => {});
 
-const { AppShell, WorkspaceShell, WorkspaceRail, Topbar, Crumb, Side, Status, Chat, ChatComposer, AgentChat, ConversationList, SessionDashboard, Row, Panel, PageHeader, SearchInput, TextField, Select, Btn, Icon, EventList, Spinner, Alert, FileGrid, FileSkeleton, sortFiles, FileToolbar, RootsPicker, BreadcrumbPath, EmptyState, FileViewer, FilePreviewPane, FilePreviewCode, FilePreviewText, FilePreviewMedia, ThemeToggle, ContextPane, PromptDialog, ConfirmDialog, DropZone, UploadProgress, FilterPills, SessionMeta, BulkBar, Checkbox, ShortcutList, FocusTrap, AgentListSkeleton } = C;
+const { AppShell, WorkspaceShell, WorkspaceRail, Topbar, Crumb, Side, Status, Chat, ChatComposer, AgentChat, ConversationList, SessionDashboard, Row, Panel, PageHeader, TextField, Select, Btn, Icon, EventList, Spinner, Alert, FileGrid, FileSkeleton, sortFiles, FileToolbar, RootsPicker, BreadcrumbPath, EmptyState, FileViewer, FilePreviewPane, FilePreviewCode, FilePreviewText, FilePreviewMedia, ThemeToggle, ContextPane, PromptDialog, ConfirmDialog, DropZone, UploadProgress, FilterPills, SessionMeta, BulkBar, Checkbox, ShortcutList, FocusTrap, AgentListSkeleton } = C;
 
 // One duration/bytes vocabulary across every surface: prefer the kit's shared
 // formatters (exported alongside the components), fall back to the local
@@ -147,6 +147,7 @@ function scheduleStreamRender() {
   });
 }
 
+const UNTITLED_CONVERSATION = 'Untitled conversation';  // one fallback label, one casing, for every call site
 const NARROW_BP = 640;  // unified with the CSS touch-target breakpoint in index.html
 function isNarrow() { return typeof window !== 'undefined' && window.innerWidth < NARROW_BP; }
 function truncate(str, mobileLen, desktopLen) {
@@ -409,7 +410,15 @@ async function stopActiveChat(sid) {
   if (st.has(sid)) return;   // re-entry guard: one cancel per sid in flight
   st.add(sid);
   render();
-  try { await B.cancelChat(state.backend, sid); } catch {}
+  try {
+    await B.cancelChat(state.backend, sid);
+  } catch {
+    st.delete(sid);
+    state.live.bulkStopError = 'conversation did not stop - try again';
+    announce('stop failed');
+    render();
+    return;
+  }
   // Optimistically drop the row so the card doesn't read 'running' for up to
   // 3s after the click; the immediate refresh confirms.
   state.active = (Array.isArray(state.active) ? state.active : []).filter(a => a.sessionId !== sid);
@@ -746,7 +755,7 @@ function sessionsColumn() {
     const hits = (state.searchHits.results || []).slice(0, state.sessionsLimit);
     const items = hits.map((r, i) => ({
       sid: r.sid,
-      title: r.snippet || r.title || 'untitled conversation',
+      title: r.snippet || r.title || UNTITLED_CONVERSATION,
       project: projectLabel(r.project) || '',
       time: r.ts ? fmtRelTime(r.ts) : '',
       running: false,
@@ -757,9 +766,14 @@ function sessionsColumn() {
     return ConversationList({
       sessions: items,
       selected: state.selectedSid,
+      // Search runs across every project (runSearch() clears projectFilter so
+      // it doesn't silently re-narrow later) - say so, since that reset is
+      // otherwise invisible and would surprise the user when they clear the
+      // search and the session list is unexpectedly wider than before.
+      caption: 'Searching across all projects',
       search: {
         value: state.searchQ,
-        placeholder: 'Search conversations (2+ chars)',
+        placeholder: 'Search all conversations - titles + messages (2+ chars)',
         onInput: (v) => { state.searchQ = v; if (v.trim().length >= 2) debouncedSearch(); else { state.searchHits = null; } render(); },
       },
       onNew: () => { navTo('chat'); newChat(); },
@@ -770,6 +784,8 @@ function sessionsColumn() {
       loading: state.searchBusy,
       error: state.searchHits.error || null,
       emptyText: 'No matches for "' + state.searchQ + '"',
+      hasMore: (state.searchHits.results || []).length > state.sessionsLimit,
+      onLoadMore: () => { state.sessionsLimit += 60; render(); },
     });
   }
   const sessionsView = visibleSessions();
@@ -811,7 +827,7 @@ function sessionsColumn() {
     selected: state.selectedSid,
     search: {
       value: state.searchQ,
-      placeholder: 'Search conversations',
+      placeholder: 'Search all conversations - titles + messages',
       onInput: (v) => { state.searchQ = v; if (v.trim().length >= 2) debouncedSearch(); else { state.searchHits = null; } render(); },
     },
     onNew: () => { navTo('chat'); newChat(); },
@@ -829,6 +845,8 @@ function sessionsColumn() {
     loadingText: state.historySlow ? 'Indexing your Claude history — the first load can take a minute…' : undefined,
     error: state.historyError,
     emptyText: 'No conversations yet',
+    hasMore: sessionsView.length > state.sessionsLimit,
+    onLoadMore: () => { state.sessionsLimit += 60; render(); },
   });
 }
 
@@ -946,9 +964,16 @@ function fileMutationCopy(e) {
   return e.message || 'The operation failed.';
 }
 function openFileDialog(kind, file) {
-  state.files.dialog = { kind, file: file || null, error: null, busy: false };
+  const trigger = typeof document !== 'undefined' ? document.activeElement : null;
+  state.files.dialog = { kind, file: file || null, error: null, busy: false, _trigger: trigger || null };
   render();
 }
+// Restore focus to whatever row/button opened the dialog so keyboard/AT users
+// don't lose their place to document.body on close.
+function restoreFileDialogFocus(trigger) {
+  if (!trigger) return;
+  requestAnimationFrame(() => { if (document.contains(trigger)) trigger.focus(); });
+}
 // --- multi-select (marked) helpers. Marked entries are keyed by path so the
 // set survives sort/filter changes; loadDir owns clearing/pruning it.
 function filesMarked() {
@@ -990,14 +1015,19 @@ async function runBulkDelete() {
   if (!d || d.kind !== 'bulk-delete' || d.busy) return;
   const marked = filesMarked();
   const targets = (state.files.entries || []).filter((e) => marked.has(e.path || e.name));
-  if (!targets.length) { state.files.dialog = null; render(); return; }
+  if (!targets.length) { state.files.dialog = null; restoreFileDialogFocus(d._trigger); render(); return; }
   d.busy = true; d.error = null; render();
   const results = await Promise.allSettled(
     targets.map((e) => B.deleteEntry(state.backend, e.path, e.type === 'dir')));
+  // The dialog can detach mid-flight (state replaced/closed elsewhere) - a
+  // write onto a dead object would be silently lost, same race runFileMutation
+  // guards below.
+  if (state.files.dialog !== d) { announce('delete finished after the dialog closed'); render(); return; }
   const failed = targets.filter((_, i) => results[i].status === 'rejected');
   const okCount = targets.length - failed.length;
   if (!failed.length) {
     state.files.dialog = null;
+    restoreFileDialogFocus(d._trigger);
     marked.clear(); state.files._lastMarkIdx = null;
     announce('deleted ' + okCount + ' ' + (okCount === 1 ? 'entry' : 'entries'));
     // Patch the visible list immediately instead of waiting on a second full
@@ -1026,22 +1056,28 @@ async function runBulkMove(destDir) {
   if (!d || d.kind !== 'bulk-move' || d.busy) return;
   const marked = filesMarked();
   const targets = (state.files.entries || []).filter((e) => marked.has(e.path || e.name));
-  if (!targets.length) { state.files.dialog = null; render(); return; }
+  if (!targets.length) { state.files.dialog = null; restoreFileDialogFocus(d._trigger); render(); return; }
   d.busy = true; d.error = null; render();
   // Validate the destination once up front so 20 identical 403s read as one
   // clear message instead of a partial-failure split.
   try { await B.statPath(state.backend, destDir); }
   catch (e) {
+    if (state.files.dialog !== d) { announce(fileMutationCopy(e)); render(); return; }
     d.busy = false;
     d.error = e.status === 404 ? 'that folder does not exist' : fileMutationCopy(e);
     render(); return;
   }
   const results = await Promise.allSettled(
     targets.map((e) => B.moveEntry(state.backend, e.path, destDir)));
+  // The dialog can detach mid-flight (state replaced/closed elsewhere) - a
+  // write onto a dead object would be silently lost, same race runFileMutation
+  // guards below.
+  if (state.files.dialog !== d) { announce('move finished after the dialog closed'); render(); return; }
   const failed = targets.filter((_, i) => results[i].status === 'rejected');
   const okCount = targets.length - failed.length;
   if (!failed.length) {
     state.files.dialog = null;
+    restoreFileDialogFocus(d._trigger);
     marked.clear(); state.files._lastMarkIdx = null;
     announce('moved ' + okCount + ' ' + (okCount === 1 ? 'entry' : 'entries'));
     // Moved entries leave the current dir - patch them out immediately rather
@@ -1065,7 +1101,9 @@ function closeFileDialog() {
   // A mid-flight close would orphan the mutation's result and swallow its
   // error - hold the dialog open until the operation settles.
   if (state.files.dialog?.busy) { announce('still working - please wait'); return; }
+  const trigger = state.files.dialog?._trigger;
   state.files.dialog = null; render();
+  restoreFileDialogFocus(trigger);
 }
 async function runFileMutation(fn, doneMsg, patch) {
   const d = state.files.dialog;
@@ -1074,6 +1112,7 @@ async function runFileMutation(fn, doneMsg, patch) {
   try {
     await fn();
     state.files.dialog = null;
+    restoreFileDialogFocus(d._trigger);
     announce(doneMsg);
     if (patch) {
       // Patch the visible list immediately, matching the bulk-delete/move
@@ -1131,6 +1170,32 @@ async function uploadFiles(fileList) {
   if (!(state.files.uploads || []).some(i => i.error)) state.files.uploads = null;
   render();
 }
+// Pasted-image handler for the chat composer: upload each pasted file through
+// the same confined endpoint the Files tab uses (into the chat's current cwd),
+// then insert the resulting relative path into the draft. Falls back to an
+// announce() if there's no cwd to upload into (chat hasn't picked one yet).
+async function pastedFilesToChat(files) {
+  const list = Array.from(files || []);
+  if (!list.length) return;
+  const dir = state.chatCwd;
+  if (!dir) { announce('set a working directory before pasting files'); return; }
+  const inserted = [];
+  for (const f of list) {
+    try {
+      await B.uploadFile(state.backend, dir, f);
+      inserted.push(f.name);
+    } catch (e) {
+      announce('paste upload failed: ' + fileMutationCopy(e));
+    }
+  }
+  if (inserted.length) {
+    const draft = state.chat.draft || '';
+    state.chat.draft = draft + (draft && !draft.endsWith('\n') && !draft.endsWith(' ') ? ' ' : '') + inserted.join(' ');
+    debouncedPersistDraft();
+    announce('pasted ' + plural(inserted.length, 'file') + ' into ' + pathBasename(dir));
+    render();
+  }
+}
 // 'replace' on a 409 row: re-PUT the same file with overwrite=1.
 async function retryUploadOverwrite(it) {
   if (!it || it._retrying || !it._file) return;
@@ -1720,9 +1785,14 @@ function computeLiveSessions() {
       lastTs: t.last,
       errors,
       currentTool: t.toolRunning ? (t.toolName || 'tool') : '',
-      // Apply stale detection to external sessions too: no recent activity + no running tool = stale.
+      // Apply stale detection to external sessions too: no recent activity + no
+      // running tool = stale. Same STALE_AFTER_MS as owned sessions (line 1691)
+      // AND the inclusion filter above (line 1731) - a card must never report
+      // 'stale' before it's even old enough to be dropped from the list, and an
+      // owned vs external session in the identical objective state must read
+      // the same status.
       status: (lastErrorTs && (nowS - lastErrorTs) <= STALE_AFTER_MS) ? 'error'
-        : (!t.toolRunning && t.last && (nowS - t.last) > STALE_AFTER_MS * 0.6 ? 'stale' : 'running'),
+        : (!t.toolRunning && t.last && (nowS - t.last) > STALE_AFTER_MS ? 'stale' : 'running'),
       stopping: false,
     });
   }
@@ -2004,6 +2074,11 @@ function chatMain() {
       children: [
         h('span', { key: 'petxt' }, 'New turns stay in this tab but will not survive a reload - export the transcript from settings. '),
         Btn({ key: 'pedismiss', onClick: () => { state.chat.persistError = false; render(); }, children: 'dismiss' })] }));
+  } else if (state.chat.persistTruncated) {
+    banners.push(Alert({ key: 'ptrunc', kind: 'warn', title: 'Older turns will not survive a reload',
+      children: [
+        h('span', { key: 'ptrunctxt' }, 'This transcript is longer than the ' + PERSIST_MSG_CAP + ' turns saved locally - a reload keeps only the most recent ' + PERSIST_MSG_CAP + '. Export the full transcript from settings first. '),
+        Btn({ key: 'ptruncdismiss', onClick: () => { state.chat.persistTruncated = false; render(); }, children: 'dismiss' })] }));
   }
   if (state.agentsError) {
     banners.push(Alert({ key: 'agerr', kind: 'error', title: 'Could not load agents from the server',
@@ -2126,9 +2201,23 @@ function chatMain() {
       cwdDraft: state.cwdDraft,
       cwdError: state.cwdError || null,
       cwdChecking: !!state.cwdChecking,
-      // Pasting an image has no upload path on the chat surface yet - say so
-      // politely instead of silently dropping it.
-      onPasteFiles: () => announce('images cannot be attached here yet'),
+      // Pasted images upload through the same confined endpoint the Files tab
+      // uses, into the chat's current cwd, then insert the resulting relative
+      // path into the draft - matching the desktop-composer expectation
+      // instead of the prior permanent no-op.
+      onPasteFiles: (files) => pastedFilesToChat(files),
+      // Dropped files resolve their server-relative path via the confined
+      // Files API and insert it into the draft, matching desktop-composer
+      // expectations instead of the prior dead-end 'not supported' toast.
+      onDropFiles: (files) => pastedFilesToChat(files),
+      // The toolbar emoji button opens the SAME inline picker typing ':' does
+      // (EMOJI_TRIGGER_RE) - append the trigger character rather than
+      // duplicating the picker-open logic, which lives inside the composer.
+      onEmoji: () => {
+        const draft = state.chat.draft || '';
+        state.chat.draft = draft + (draft && !draft.endsWith(' ') ? ' ' : '') + ':';
+        render();
+      },
       // Long threads render a capped window with a 'show earlier' row (the
       // chat-side equivalent of history's eventsLimit), reset per conversation.
       shownMessages: state.chat.shownMessages || undefined,
@@ -2270,8 +2359,16 @@ function trimPartForStorage(p) {
 }
 function persistChat() {
   try {
-    const msgs = state.chat.messages
-      .filter(m => !isEmptyTurn(m))
+    const eligible = state.chat.messages.filter(m => !isEmptyTurn(m));
+    // On-screen transcript can exceed the cap; a reload only restores the last
+    // PERSIST_MSG_CAP turns - surface that once so it's not a silent surprise,
+    // same Alert pattern as the sibling quota-failure banner below.
+    const wasCapped = eligible.length > PERSIST_MSG_CAP;
+    if (wasCapped !== !!state.chat.persistTruncated) {
+      state.chat.persistTruncated = wasCapped;
+      scheduleRender();
+    }
+    const msgs = eligible
       .slice(-PERSIST_MSG_CAP)
       .map(m => ({ id: m.id, role: m.role, content: m.content, time: m.time, costUsd: m.costUsd, stopped: m.stopped || undefined, parts: Array.isArray(m.parts) ? m.parts.map(trimPartForStorage) : m.parts }));
     const draft = (state.chat.draft || '').trim() ? state.chat.draft : '';
@@ -2704,12 +2801,12 @@ function historyMain() {
   const sess = (Array.isArray(state.sessions) ? state.sessions : []).find(s => s.sid === state.selectedSid);
   const lede = sess
     ? (projectLabel(sess.project) || sess.cwd || 'unknown location') + ' · ' + plural(sess.events || 0, 'event') + ' · ' + plural(sess.userTurns || 0, 'turn') + ' · ' + fmtRelTime(sess.last)
-    : 'Untitled conversation';
+    : UNTITLED_CONVERSATION;
 
   const head = PageHeader({
     compact: true,
     dense: true,
-    title: truncate(projectLabel(sess?.title) || projectLabel(sess?.project) || sess?.cwd || 'Untitled conversation', 40, 80),
+    title: truncate(projectLabel(sess?.title) || projectLabel(sess?.project) || sess?.cwd || UNTITLED_CONVERSATION, 40, 80),
     lede,
   });
 
@@ -2977,7 +3074,7 @@ function resumeSidLabel(sid) {
   const arr = Array.isArray(state.sessions) ? state.sessions : [];
   const sess = arr.find((s) => s.sid === sid);
   const label = sess && (projectLabel(sess.title) || projectLabel(sess.project));
-  return label || 'untitled conversation';
+  return label || UNTITLED_CONVERSATION;
 }
 
 function uniqueProjects() {
@@ -2995,7 +3092,21 @@ function uniqueProjects() {
 // stays visible and stoppable from anywhere (active polling is global).
 function runningPanel() {
   const running = Array.isArray(state.active) ? state.active : [];
-  if (!running.length) return null;
+  if (!running.length) {
+    // A send is in flight but the active-session poll hasn't caught up yet
+    // (up to ~3s) - without this, the Live tab's existence is undiscoverable
+    // during that gap even though the chat is, in fact, already running.
+    if (state.chat.busy) {
+      return Panel({
+        key: 'runningPanelPending',
+        title: 'running',
+        children: [h('div', { key: 'runpending', class: 'resume-banner', role: 'group' },
+          h('span', { key: 'runpendinglbl', class: 't-meta' }, 'this chat will also appear in live once it starts'),
+          Btn({ key: 'runpendinglive', onClick: () => navTo('live'), children: 'view live' }))],
+      });
+    }
+    return null;
+  }
   const stopping = state.live.stopping || new Set();
   return Panel({
     key: 'runningPanel',
@@ -3108,15 +3219,16 @@ function healthSummary() {
   if (hh.version) bits.push(['v' + hh.version, 'Server version']);
   if (typeof hh.agents === 'number') bits.push([hh.agents + ' agents', 'Agents registered on the server']);
   if (typeof hh.activeExecutions === 'number') bits.push([hh.activeExecutions + ' active', 'Chats currently executing']);
-  // db chip uses the same online/offline register as the connection chip
-  // (not ok/down, which the connection chip already translated away). Always
-  // render it: when /health is partial and hh.db is absent, show 'db unknown'
-  // rather than dropping the chip and leaving the db state ambiguous.
+  // db chip uses the SAME connected/offline register as the connection chip
+  // above (not ok/down, and not a third online/offline register) so the same
+  // up/down category of fact reads the same word in both chips of this row.
+  // Always render it: when /health is partial and hh.db is absent, show
+  // 'db unknown' rather than dropping the chip and leaving the db state ambiguous.
   // Only show 'db unknown' when health has been fetched (not on initial null/unknown state).
   if (hh.status && hh.status !== 'unknown') {
-    bits.push(['db ' + (hh.db ? (hh.db.ok ? 'online' : 'offline') : 'unknown'), 'History database status']);
+    bits.push(['db ' + (hh.db ? (hh.db.ok ? 'connected' : 'offline') : 'unknown'), 'History database status']);
   } else if (hh.db) {
-    bits.push(['db ' + (hh.db.ok ? 'online' : 'offline'), 'History database status']);
+    bits.push(['db ' + (hh.db.ok ? 'connected' : 'offline'), 'History database status']);
   }
   return h('div', { key: 'hp', class: 'health-summary' + (ok ? ' health-ok' : ''), role: 'group', 'aria-label': 'Backend health' },
     ...bits.map(([b, t], i) => h('span', { key: 'hb' + i, class: 'health-chip', title: t }, b)));