agentgui 1.0.1043 → 1.0.1045

package/.claude/workflows/gui-claude-code-parity.js

@@ -11,7 +11,7 @@ export const meta = {
 
 // Shared grounding. Nine sweeps have shipped; this one hunts whether what shipped LOOKS and FEELS like the Claude Code web GUI.
 const GROUND =
-  ' GROUND IN REAL SOURCE (read, do not guess - nine sweeps HAVE shipped: jank audit, redesign, polish, cohesion, completion, logic-predictability; the app already has a three-column WorkspaceShell, a ConversationList rail, a full-CRUD Files manager, a SessionDashboard live view, a ContextPane, structured tool cards, per-block code copy, hash routing, edit/retry/export/followups): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,form-primitives.js,theme-toggle.js} + dist CSS {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js + server.js; the fsbrowse reference is c:\\dev\\fsbrowse. AGENTS.md + the PUNCHLIST-*.md files record what already landed - do NOT re-report it; hunt what still looks primitive or feels un-Claude-Code.' +
+  ' GROUND IN REAL SOURCE (read, do not guess - nine sweeps HAVE shipped: jank audit, redesign, polish, cohesion, completion, logic-predictability; the app already has a three-column WorkspaceShell, a ConversationList rail, a full-CRUD Files manager, a SessionDashboard live view, a ContextPane, structured tool cards, per-block code copy, hash routing, edit/retry/export/followups): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,form-primitives.js,theme-toggle.js} + dist CSS {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js + server.js; the fsbrowse reference is c:\\dev\\fsbrowse. AGENTS.md records what already landed - do NOT re-report it; hunt what still looks primitive or feels un-Claude-Code.' +
   ' POLICY: fully-destructive run - reshape anything; ALL visual/component/layout work lands in the KIT as defaults/props/CSS; the app keeps state+callback wiring only; NEVER add new index.html !important overrides; use kit design tokens (CSS vars) not raw hex; NO decorative glyphs (ASCII words + CSS .status-dot-disc) but KEEP the typographic set middot/ellipsis/em-en-dash; any server mutation stays confineToRoots realpath-confined; every visual change must preserve a11y (roles/aria/focus rings/44x44 touch/keyboard), responsive behavior (420px to wide desktop, no h-scroll), reduced-motion guards on any new animation, and explicit empty/loading/error composition.';
 
 const LENSES = [
@@ -65,7 +65,7 @@ const verified = await pipeline(
     agent(
       'Adversarially verify this Claude-Code-web design-language finding against the REAL source (read the cited files - do not trust the claim). '
       + 'KEPT-TYPOGRAPHY GUARD: middot, ellipsis, em/en-dash are intentional product typography - flagging one of those as a decorative glyph is NOT a real finding (real=false). '
-      + 'A finding is real only if the gap genuinely exists in the shipped source AND was not already fixed by a prior sweep (check the PUNCHLIST-*.md files / AGENTS.md) AND the proposed fix is sound, lands in the right place (kit vs app vs server, visual work in the KIT not the app), uses tokens not hex, preserves a11y + reduced-motion + responsive, and any server mutation stays confinement-safe. '
+      + 'A finding is real only if the gap genuinely exists in the shipped source AND was not already fixed by a prior sweep (check AGENTS.md) AND the proposed fix is sound, lands in the right place (kit vs app vs server, visual work in the KIT not the app), uses tokens not hex, preserves a11y + reduced-motion + responsive, and any server mutation stays confinement-safe. '
       + 'Reject vague taste-only findings with no concrete source-grounded fix. '
       + 'Finding: ' + JSON.stringify(g),
       { label: 'verify:' + (g.title || '').slice(0, 32), phase: 'Verify', schema: VERDICT_SCHEMA }

package/.claude/workflows/gui-completion.js

@@ -11,7 +11,7 @@ export const meta = {
 
 // Shared grounding. Seven sweeps have shipped; this one hunts what they SKIPPED.
 const GROUND =
-  ' GROUND IN REAL SOURCE (read, do not guess - seven polish/cohesion sweeps HAVE shipped; hunt what they SKIPPED): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js} + {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js (confineToRoots helper) + lib\\routes-upload.js (legacy, conversationId-keyed) + server.js. The fsbrowse full file manager at c:\\dev\\fsbrowse (index.js checkPermissions/rename/delete/mkdir/upload + public/app.js hash routing/stepViewer) is the file-management bar. PUNCHLIST-COHESION.md + AGENTS.md record the documented scope cuts: file rename/delete (read-only), upload (legacy endpoint not reusable), retry last-turn-only, dir deep-links never landed, followups static-only.' +
+  ' GROUND IN REAL SOURCE (read, do not guess - seven polish/cohesion sweeps HAVE shipped; hunt what they SKIPPED): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js} + {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js (confineToRoots helper) + lib\\routes-upload.js (legacy, conversationId-keyed) + server.js. The fsbrowse full file manager at c:\\dev\\fsbrowse (index.js checkPermissions/rename/delete/mkdir/upload + public/app.js hash routing/stepViewer) is the file-management bar. AGENTS.md records the documented scope cuts: file rename/delete (read-only), upload (legacy endpoint not reusable), retry last-turn-only, dir deep-links never landed, followups static-only.' +
   ' POLICY: this is a fully-destructive run - scope cuts may be REVERSED, but every new mutation endpoint MUST be confineToRoots realpath-confined (403 out-of-roots + traversal + symlink-escape) and witnessed. ALL visual/component work lands in the KIT as defaults/props; app keeps state+callback wiring; NEVER new index.html !important overrides; kit tokens not hex; NO decorative glyphs (ASCII words + CSS .status-dot-disc) but KEEP middot/ellipsis/em-en-dash; every new surface needs a11y (roles/aria/focus/44x44/keyboard), responsive (420px), explicit empty/loading/error states, and plain-language error copy.';
 
 const LENSES = [

package/.claude/workflows/gui-logic-predictability.js

@@ -11,7 +11,7 @@ export const meta = {
 
 // Shared grounding. Eight sweeps have shipped; this one audits whether what shipped OPERATES logically and predictably.
 const GROUND =
-  ' GROUND IN REAL SOURCE (read, do not guess - eight sweeps HAVE shipped: jank audit, redesign, polish, cohesion, completion; the Files manager has full CRUD, hash routing carries tab/sid/dir/file/q/project/section, conversation has edit/retry/export/followups, resilience has ws-grace/health-reprobe/install-hints): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,forms.js} + {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js + lib\\ws-handlers-util.js + server.js. PUNCHLIST-COMPLETION.md + PUNCHLIST-COHESION.md + AGENTS.md record what already landed - do NOT re-report it; hunt what still operates illogically or unpredictably.' +
+  ' GROUND IN REAL SOURCE (read, do not guess - eight sweeps HAVE shipped: jank audit, redesign, polish, cohesion, completion; the Files manager has full CRUD, hash routing carries tab/sid/dir/file/q/project/section, conversation has edit/retry/export/followups, resilience has ws-grace/health-reprobe/install-hints): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,forms.js} + {app-shell.css,chat.css}; server c:\\dev\\agentgui\\lib\\http-handler.js + lib\\ws-handlers-util.js + server.js. AGENTS.md records what already landed - do NOT re-report it; hunt what still operates illogically or unpredictably.' +
   ' POLICY: fully-destructive run - reshape anything; ALL visual/component work lands in the KIT as defaults/props; app keeps state+callback wiring; NEVER new index.html !important overrides; kit tokens not hex; NO decorative glyphs (ASCII words + CSS .status-dot-disc) but KEEP middot/ellipsis/em-en-dash; any server mutation stays confineToRoots realpath-confined; every change needs a11y (roles/aria/focus/44x44/keyboard), responsive (420px), explicit empty/loading/error states, plain-language copy.';
 
 const LENSES = [
@@ -65,7 +65,7 @@ const verified = await pipeline(
     agent(
       'Adversarially verify this GUI logic/predictability finding against the REAL source (read the cited files - do not trust the claim). '
       + 'KEPT-TYPOGRAPHY GUARD: middot, ellipsis, em/en-dash are intentional product typography - flagging one of those as a decorative glyph is NOT a real finding (real=false). '
-      + 'A finding is real only if the behavior genuinely exists in the shipped source AND was not already fixed by a prior sweep (check PUNCHLIST-COMPLETION.md / PUNCHLIST-COHESION.md / AGENTS.md) AND the proposed fix is sound, lands in the right place (kit vs app vs server), and any server mutation stays confinement-safe. '
+      + 'A finding is real only if the behavior genuinely exists in the shipped source AND was not already fixed by a prior sweep (check AGENTS.md) AND the proposed fix is sound, lands in the right place (kit vs app vs server), and any server mutation stays confinement-safe. '
       + 'Reject vague findings with no concrete source-grounded fix. '
       + 'Finding: ' + JSON.stringify(g),
       { label: 'verify:' + (g.title || '').slice(0, 32), phase: 'Verify', schema: VERDICT_SCHEMA }

package/.claude/workflows/gui-screen-realestate.js

@@ -10,7 +10,7 @@ export const meta = {
 };
 
 const GROUND =
-  ' GROUND IN REAL SOURCE (read, do not guess - TEN sweeps HAVE shipped incl the 10th-run Claude-Code-web parity: flat full-width chat turns (.chat-msg-flat), calm rounded-rect composer, bordered tool cards, .ws-main content gutter + mainFlush, folder icons, live command-center with status buckets/breakdown/heartbeat/select-all, motion easing): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,form-primitives.js} + colors_and_type.css + app-shell.css + chat.css; server c:\\dev\\agentgui\\lib\\http-handler.js. KEY current widths: .ws-shell --ws-rail-w 232px, --ws-sessions-w 296px, --ws-pane-w 320px (≈848px of chrome before content); .ws-main padding var(--space-4) var(--space-5); chat thread caps at --measure 68ch; --space scale 4/8/16/24/32px. AGENTS.md + PUNCHLIST-*.md record what already landed - do NOT re-report it; hunt WASTED SPACE and LOW DENSITY.' +
+  ' GROUND IN REAL SOURCE (read, do not guess - TEN sweeps HAVE shipped incl the 10th-run Claude-Code-web parity: flat full-width chat turns (.chat-msg-flat), calm rounded-rect composer, bordered tool cards, .ws-main content gutter + mainFlush, folder icons, live command-center with status buckets/breakdown/heartbeat/select-all, motion easing): agentgui front-end c:\\dev\\agentgui\\site\\app\\js\\app.js + backend.js + index.html; kit c:\\dev\\anentrypoint-design\\src\\components\\{shell.js,sessions.js,agent-chat.js,chat.js,files.js,files-modals.js,context-pane.js,content.js,form-primitives.js} + colors_and_type.css + app-shell.css + chat.css; server c:\\dev\\agentgui\\lib\\http-handler.js. KEY current widths: .ws-shell --ws-rail-w 232px, --ws-sessions-w 296px, --ws-pane-w 320px (≈848px of chrome before content); .ws-main padding var(--space-4) var(--space-5); chat thread caps at --measure 68ch; --space scale 4/8/16/24/32px. AGENTS.md records what already landed - do NOT re-report it; hunt WASTED SPACE and LOW DENSITY.' +
   ' POLICY: fully-destructive run - reshape anything; ALL visual/layout/density work lands in the KIT as defaults/props/CSS; the app keeps state+callback wiring only; NEVER add new index.html !important overrides; use kit design tokens (CSS vars) not raw hex; NO decorative glyphs (ASCII words + CSS .status-dot-disc) but KEEP the typographic set middot/ellipsis/em-en-dash; any server mutation stays confineToRoots realpath-confined; preserve a11y (roles/aria/focus rings/44x44 touch where pointer is coarse/keyboard), responsive behavior (420px to ultrawide, no h-scroll), reduced-motion guards, and explicit empty/loading/error composition. Density must NOT sacrifice readability or a11y minimums.';
 
 const LENSES = [
@@ -64,7 +64,7 @@ const verified = await pipeline(
     agent(
       'Adversarially verify this screen-real-estate / density / SDK-as-application finding against the REAL source (read the cited files - do not trust the claim). '
       + 'KEPT-TYPOGRAPHY GUARD: middot, ellipsis, em/en-dash are intentional product typography - flagging one as a decorative glyph is NOT a real finding (real=false). '
-      + 'A finding is real only if the gap genuinely exists in the shipped source AND was not already fixed by a prior sweep (check the PUNCHLIST-*.md files / AGENTS.md) AND the fix is sound, lands in the right place (visual/layout in the KIT not the app), uses tokens not hex, and preserves a11y minimums + readability + responsive (no new h-scroll) + reduced-motion. '
+      + 'A finding is real only if the gap genuinely exists in the shipped source AND was not already fixed by a prior sweep (check AGENTS.md) AND the fix is sound, lands in the right place (visual/layout in the KIT not the app), uses tokens not hex, and preserves a11y minimums + readability + responsive (no new h-scroll) + reduced-motion. '
       + 'Reject density changes that would harm readability/touch-targets/contrast, and reject vague taste-only findings with no concrete source-grounded fix. '
       + 'Finding: ' + JSON.stringify(g),
       { label: 'verify:' + (g.title || '').slice(0, 32), phase: 'Verify', schema: VERDICT_SCHEMA }

package/.gm/memories/mem-38b7e24dbcba2f3e-639.md

@@ -0,0 +1,8 @@
+---
+key: mem-38b7e24dbcba2f3e-639
+ns: default
+created: 1783844902974
+updated: 1783844902974
+---
+
+HISTORICAL/SUPERSEDED (do not trust): agentgui briefly (2026-05-29) loaded anentrypoint-design from unpkg@latest at runtime instead of a local vendored copy, for always-latest tracking at the cost of requiring network + drift on upstream publish. This was REVERTED - as of the 2026-06-04/06-05 runs, index.html loads the DS kit from the LOCAL ./vendor/anentrypoint-design/247420.{js,css} again (re-confirmed live via browser witness on the 37th run, 2026-07-12: <link href='./vendor/anentrypoint-design/247420.css'>). AGENTS.md's 'DS load = LOCAL vendor' section is the current truth; any memory claiming unpkg is the live source is stale.

package/.gm/memories/mem-cdf04ff6a6a0aa6f-671.md

@@ -0,0 +1,8 @@
+---
+key: mem-cdf04ff6a6a0aa6f-671
+ns: default
+created: 1783844901564
+updated: 1783844901564
+---
+
+agentgui webjsx applyDiff array-keying rule: children arrays that mix keyed VElements with raw text/numbers crash in vendor/webjsx/applyDiff.js with 'Cannot read properties of undefined (reading key)'. webjsx requires ALL siblings in an array prop (children, right, left, breadcrumbs, etc.) to either ALL be VElements with keys or ALL be non-keyed - passing Crumb({right:[h('span',{key:'a'},'A'), h('span',{key:'b'},'B'), 'connected']}) crashes because the render loop tries to read .key on the bare string. Fix: wrap any bare strings as keyed VElements, e.g. h('span',{key:'dot'},'connected'). Surfaced 2026-05-04 in crumbRight construction in site/app/js/app.js view().

package/.gm/prd.yml

@@ -2933,3 +2933,27 @@
   notes: push kit + agentgui changes, confirm CI green both repos
   status: completed
   witness: 'Both repos pushed and CI green: agentgui git_finalize sha e1949a4 (Publish and Release, Deploy GH Pages, Test, Auto-Declaudeify all conclusion=success per gh run list); design repo rebased onto origin/main (bb31857) and pushed sha 4de1771 (Publish 247420 to npm, Deploy GH Pages both conclusion=success). .gm/exec-spool/.ci-validated updated via fs_write to head_sha e1949a42f94d614a1d178a807c4a14ca84ca04cb (current agentgui HEAD, confirmed via git_status/git rev-parse HEAD match).'
+- id: cleanup-verify-punchlist-usage
+  subject: Verify whether PUNCHLIST-*.md files are load-bearing before deleting
+  notes: codesearch found 2 workflow scripts (gui-logic-predictability.js, gui-completion.js) reference PUNCHLIST-COMPLETION.md/PUNCHLIST-COHESION.md by name in agent prompts as content to check against, to avoid re-reporting already-fixed findings - not dead references. This changes the original hand-off assumption; must update those 2 prompts to point at AGENTS.md (which has the same history, denser and current) before deleting the files, not delete blind.
+  status: completed
+  witness: 'grep -rln PUNCHLIST .claude/workflows/*.js found 4 scripts (not 2): gui-claude-code-parity.js, gui-completion.js, gui-logic-predictability.js, gui-screen-realestate.js - all reference PUNCHLIST-*.md by name/glob in agent prompts to avoid re-reporting already-fixed findings. Confirmed load-bearing, not dead filename references.'
+- id: cleanup-delete-dead-punchlist-files
+  subject: Delete the 10 stale PUNCHLIST-*.md files after workflow refs are updated
+  notes: PUNCHLIST-COHESION.md, PUNCHLIST-COMPLETION.md, PUNCHLIST-DENSITY.md, PUNCHLIST-DESIGN-14.md, PUNCHLIST-DESIGN-15.md, PUNCHLIST-DESIGN.md, PUNCHLIST-LOGIC.md, PUNCHLIST-PARITY.md, PUNCHLIST-POLISH.md, PUNCHLIST-UX.md - all findings already resolved+merged, all runs already summarized in AGENTS.md history. ~440KB of stale historical documentation violating the project's own Documentation Policy (git log/CHANGELOG carries history, not standing docs).
+  status: completed
+  witness: git rm removed all 10 PUNCHLIST-*.md files (COHESION/COMPLETION/DENSITY/DESIGN/DESIGN-14/DESIGN-15/LOGIC/PARITY/POLISH/UX). Confirmed 0 remaining live-code references (grep -rln PUNCHLIST *.js *.yml *.json returns only .gm/prd.yml this session's own rows, and AGENTS.md/CHANGELOG.md's narrative past-tense mentions which are fine per Documentation Policy). Syntax of all 4 edited workflow scripts verified valid via node Function() wrap (top-level return is legal in the real Workflow-tool execution context, not standalone node).
+- id: cleanup-scan-other-workflow-scripts-for-refs
+  subject: Scan all .claude/workflows/*.js files (not just the 2 found) for any other PUNCHLIST-*.md references before deleting
+  notes: Only checked gui-logic-predictability.js and gui-completion.js via codesearch hit; must confirm no other workflow script (gui-audit.js, gui-cohesion.js, gui-overhaul.js, gui-predictability-polish.js, gui-screen-realestate.js, gui-claude-code-parity.js, gui-ux-craft.js, gui-ai-tell-sweep.js, gui-design-consolidation.js) references any of the other 8 files being deleted (PUNCHLIST-DENSITY/DESIGN/DESIGN-14/DESIGN-15/PARITY/POLISH/UX).
+  status: completed
+  witness: grep -rln PUNCHLIST .claude/workflows/*.js -> found gui-claude-code-parity.js and gui-screen-realestate.js in addition to the 2 already known (gui-completion.js, gui-logic-predictability.js). All 4 identified; rescoping cleanup-update-workflow-refs to cover all 4 files.
+- id: cleanup-commit-push-verify
+  subject: Commit the punchlist cleanup + workflow-ref update, push, witness CI green
+  notes: agentgui-only change (workflow scripts + doc deletion), no kit involvement expected unless scan in cleanup-scan-other-workflow-scripts-for-refs finds a kit-side workflow reference.
+  status: pending
+- id: cleanup-update-workflow-refs
+  subject: Update gui-logic-predictability.js and gui-completion.js to reference AGENTS.md instead of the PUNCHLIST-*.md files being deleted
+  notes: Both scripts' agent prompts say 'check PUNCHLIST-COMPLETION.md / PUNCHLIST-COHESION.md / AGENTS.md'; edit both prompts this session so they say 'check AGENTS.md' only, before the PUNCHLIST files are deleted, so no workflow prompt references a nonexistent file.
+  status: completed
+  witness: grep -rn PUNCHLIST .claude/workflows/*.js returns 0 matches after editing gui-logic-predictability.js (2 edits), gui-completion.js (1 edit), gui-claude-code-parity.js (2 edits), gui-screen-realestate.js (2 edits) to reference AGENTS.md alone.

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## GUI logic+predictability sweep (2026-07-12) — thirty-seventh run
+
+`gui-logic-predictability` workflow wf_5eec2403-09d (30 agents, 6 hunt lenses + verify + synthesize, 0 errors) — 15 confirmed findings, all implemented. App (`site/app/js/app.js`): `stopActiveChat` no longer leaves the per-card stop button permanently stuck on a failed cancel (deletes the sid from the stopping Set + surfaces an error on rejection instead of swallowing it); Files dialogs (rename/delete/mkdir/bulk) now restore keyboard focus to the triggering element on close, mirroring the existing cwd-edit pattern; `runBulkDelete`/`runBulkMove` gained the same stale-dialog guard `runFileMutation` already had; the "Untitled conversation" fallback consolidated to one `UNTITLED_CONVERSATION` constant (3 call sites had drifted casing); the settings db health chip now reads `connected`/`offline` instead of a third `online`/`offline` register, matching the adjacent connection chip; history search placeholder/caption now discloses it searches all projects' titles+messages; `runningPanel()` shows a lightweight "will also appear in live" hint during the send-to-active-poll gap instead of returning null; `computeLiveSessions()`'s external-session stale threshold no longer silently multiplies `STALE_AFTER_MS` by an undocumented 0.6 (owned and external sessions in the same objective state now report the same status); pasted/dropped composer files upload through the existing confined `PUT /api/upload-file` and insert the resulting path into the draft (was a permanent no-op/dead-end toast); the sessions rail's 60-item cap gained a load-more affordance (`state.sessionsLimit += 60`), mirroring the existing `eventsLimit` "load older" pattern; `PERSIST_MSG_CAP` truncation now surfaces a dismissible banner instead of silently dropping older turns from localStorage. Kit (`design/src/components/{chat,agent-chat,content,files,sessions}.js`, `app-shell.css`, `chat.css`): deleted dead `onAttach`/`onMenu` composer toolbar plumbing (no such feature existed); `AgentChat` now forwards `onEmoji` to its internal `ChatComposer` call (the emoji toolbar button was invisible because `AgentChat` — the wrapper agentgui actually calls, not `ChatComposer` directly — never destructured the prop; caught mid-EXECUTE via a `transition to=PLAN` re-scope); `SearchInput` and the Files filter input both gained Escape-to-clear + a visually-hidden `aria-live` result-count region; `ConversationList` gained `hasMore`/`onLoadMore`; composer textarea `overflow-y` changed from focus-only `auto` to always-`auto` so a capped-height composer keeps its scroll cue after blur. Kit built+tested (`bun test.js` all pass, all build lints pass), re-vendored, browser-witnessed live on buildesk across chat/history/settings/files (0 blocking errors on clean navigations). Kit pushed `af028ff`, agentgui pushed `a3b844d`, all CI green both repos. **Standing gotcha reconfirmed: this env's `gm browser` verb text-protocol (`dom=<selector>\n<script>`) only evaluates the selector query, not the trailing script — use `dom=<precise-selector>` alone to inspect attributes/rect, not as a general page-eval channel. Also: embedding Basic-Auth creds directly in a `page.goto` URL (`https://user:pass@host/...`) breaks the app's own same-origin `fetch()` calls with "Request cannot be constructed from a URL that includes credentials" — do one embedded-creds navigation to seed the browser's per-origin Basic-Auth cache, then navigate again WITHOUT embedded creds (plain URL or `?token=`) for any witness that needs real fetches to succeed.**
+
 ## GUI AI-tell sweep (2026-07-10) — thirty-sixth run
 
 Follow-on to the 35th run's AI-tell sweep (commit 1702fa8). `gui-ai-tell-sweep` workflow wf_a53b7d8f-27b (26 agents, 25 done/1 verify-agent hit a mid-response connection error, 200 tool calls): 5 hunter lenses (gradient-glow-glass, emoji-generic-icons, oversaturated-color, boilerplate-copy, layout-uniformity-tells) found 20 candidates, adversarial verify confirmed 11 (9 correctly refuted as already-deliberate — status-disc pulse triplicate, `--sun` "retired" claim, radius-scale uniformity — the kept-typography-style guard doing its job on non-typography claims too). Landed in the kit (`design/app-shell.css`/`chat.css`/`src/components/agent-chat.js`): hardcoded one-off context-menu/toast shadow → `var(--shadow-overlay)` token; three data-metering fills (barchart/upload/bar) demoted from the loudest acid-lime `--accent` to neutral `--fg-3` (color reserved for state, not routine progress); checkbox checked-fill `--accent`→`--fg`; drag-over collapsed from a triple accent stack (tint+border+ring) to a single dashed border; the keyboard-only `.skip-to-main` link de-loudened from CTA-accent to neutral ink (it was visually identical to the primary send button despite being invisible to sighted users); session-unread dot neutralized off `--accent` so it stops competing with the active row's accent; dead template-shaped `.empty-state` child rules and an unused `.ds-panel-trio`/`.ds-panel-grid` hover-lift block deleted; AgentChat empty-state copy de-boilerplated away from "invitation" framing. App: `keyboardPanel()`/`preferencesPanel()` gained `kind:'wide'` so settings' purely-informational/utility panels read lighter than the consequence-bearing backend/agents panels. Kit rebuilt+re-vendored, browser-witnessed live (0 pageErrors, all 4 sampled CSS rules confirmed post-fix in the real CSSOM). Kit pushed `4de1771` (after a rebase — a concurrent version-bump commit had landed), agentgui pushed `e6dc1d9`, all CI green both repos. **Tool-defect note (recorded, not re-fixed — the workaround is durable): the gm-plugkit `fs_write` verb's payload key is `content` (a JSON string), not `body` — passing `{path, body:{...}}` silently no-ops with `bytes:0` and no error, which nearly let a stale/empty `.ci-validated` marker slip through this run; caught via `recall` mid-VERIFY and corrected before COMPLETE.**
@@ -226,21 +230,15 @@ Node v24 lacks a prebuilt better-sqlite3 binary; the node path needs a from-sour
 
 ## webjsx applyDiff Array Keying (2026-05-04)
 
-**Children arrays that mix keyed VElements with raw text/numbers crash in `vendor/webjsx/applyDiff.js`.**
-
-`webjsx` requires all siblings in an array prop (children, right, left, breadcrumbs, etc.) to either ALL be VElements with keys or ALL be non-keyed. Passing `Crumb({ right: [h('span', { key: 'a' }, 'A'), h('span', { key: 'b' }, 'B'), 'connected'] })` crashes on render with `TypeError: Cannot read properties of undefined (reading 'key')` at line 247420.js when the render loop tries to read `.key` on the bare string.
-
-Fix: wrap any bare strings as keyed VElements: `h('span', { key: 'dot' }, 'connected')`. Rule: if ANY sibling in an array has a key, ALL siblings must be VElements (no raw strings or numbers).
-
-Surfaced 2026-05-04 while validating the chat surface in `site/app/`. Fix applied to crumbRight construction in `site/app/js/app.js` view().
+**Rule still binding: mixing keyed VElements with raw strings/numbers in any webjsx array prop crashes `applyDiff`.** Full detail in rs-learn (recall "agentgui webjsx applyDiff array-keying rule").
 
 ## Live History Stream Wiring (2026-05-05)
 
 `site/app/js/app.js` opens an SSE EventSource on `navTo('history')` (`B.streamHistory`, `state.live` shape, hello/event/conversation/error dispatch, rAF-throttled renders) against ccsniff's in-process `/v1/history/stream`; first `/v1/history/*` request triggers a 30-90s synchronous JSONL walk (`CLAUDE_PROJECTS_DIR`) — health-check timeouts during that window are normal. Full detail in rs-learn (recall "agentgui Live History Stream Wiring").
 
-## Runtime CDN: GUI loaded from unpkg (2026-05-29)
+## Runtime CDN: GUI loaded from unpkg — SUPERSEDED, do not trust
 
-The GUI loads `anentrypoint-design` from `https://unpkg.com/anentrypoint-design@latest` at runtime (import map + CSS link in `index.html`) so agentgui always tracks the latest published kit with no hand-maintained vendored copy. This **requires a network connection** — the earlier offline guarantee was intentionally dropped in favour of always-latest. The DS itself fetches its fonts from `unpkg.com/anentrypoint-design@latest/dist/fonts/` (set in the kit's `scripts/build.mjs` `FONT_BASE`). The `site/app/vendor/` tree is no longer imported; the old vendored DS bundle + `vendor/cdn/` assets are dead and may be removed. Witness the live GUI by confirming the import map resolves to unpkg and `.agentchat` renders with 0 console errors.
+This 2026-05-29 unpkg-at-runtime approach was reverted; see "DS load = LOCAL vendor" below for the current truth (re-confirmed live on the 37th run, 2026-07-12). Historical detail in rs-learn (recall "agentgui unpkg superseded local vendor").
 
 ## Agent/model/session management (2026-05-28)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1043",
+  "version": "1.0.1045",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",