agentgui 1.0.1060 → 1.0.1062

package/.gm/prd.yml

@@ -3076,3 +3076,54 @@
   - gm-plugkit/playwriter browser verb dom=/capture eval context defect - requires an upstream tool fix outside agentgui/design
   status: completed
   witness: 'External tool defect, not resolvable from this repo/session: the gm-plugkit/playwriter browser verb''s dom= and capture prefixes evaluate in a Node vm context with no page/document binding (ReferenceError on every attempt this session), unlike the screenshot= and url=<target> paths which do reach the real page. This is a defect in the upstream gm-plugkit/playwriter tool package itself, outside agentgui and design repo scope. Recorded per the false-completion rule as blockedBy:external rather than marked done - screenshots remain the working witness fallback and were used for all browser verification in this sweep.'
+- id: cwd-validation-realtime-existing-probe-review
+  subject: Audit the existing debouncedCwdProbe/onCwdDraft validation - confirm it still races correctly with the new browse/recent/autocomplete affordances (no double state writes, no stale error surviving a valid pick)
+  status: pending
+- id: practicality-sweep-composer-ergonomics
+  subject: 'Beyond cwd: sweep the chat composer and immediate surrounding controls for other practicality gaps (agent/model switching friction, draft persistence edge cases, file attach friction) via a workflow dispatch'
+  status: pending
+- id: practicality-sweep-files-surface
+  subject: Sweep the Files tab for practicality gaps beyond the cwd-picker integration (navigation friction, bulk-op discoverability, missing shortcuts)
+  status: pending
+- id: practicality-sweep-history-settings
+  subject: Sweep History and Settings surfaces for practicality gaps (search ergonomics, settings organization, discoverability of power-user features)
+  status: pending
+- id: practicality-sweep-live-dashboard
+  subject: Sweep the Live dashboard for remaining practicality gaps beyond the 40th/41st run fixes
+  status: pending
+- id: practicality-verify-buildesk-live
+  subject: Live-verify all cwd-practicality and general-practicality findings on https://buildesk.acc.l-inc.co.za/gm via browser witness
+  status: pending
+- id: practicality-kit-build-vendor
+  subject: Build+test the design kit, re-vendor dist into site/app/vendor/anentrypoint-design
+  status: pending
+- id: practicality-push-ci-green
+  subject: Push kit and agentgui changes, verify CI green on both repos
+  status: pending
+- id: practicality-agents-md-record
+  subject: Record this run's findings in AGENTS.md following the existing run-log convention
+  status: pending
+- id: docstudio-cue-session-group-eyebrow
+  subject: Verify ConversationList's session-group headers (Today/Yesterday/etc) use the --tr-label token + --fg-3 tone consistently, matching docstudio's uppercase letter-spaced low-opacity eyebrow label idiom
+  status: pending
+- id: gc-delete-undo-trash
+  subject: No undo-after-delete (soft-delete/trash) anywhere in the confined delete surface
+  status: pending
+- id: gc-search-hit-hash-anchor
+  subject: Search-hit event anchor (focusEventI/focusEventTs) not carried in the hash - reload/Back loses highlighted line
+  status: pending
+- id: gc-settings-section-scrollspy
+  subject: Settings section anchor is deep-link-in only - scrolling never updates state.settingsSection or the URL
+  status: pending
+- id: gc-context-budget-affordance
+  subject: No context-size/token-budget affordance - only turn count and dollar cost shown, never remaining context headroom
+  status: pending
+- id: gc-expanded-body-highlight
+  subject: Search-result highlighting inside expanded event bodies never highlights the matched query term
+  status: pending
+- id: gc-search-results-export
+  subject: No per-session or global export of History search results themselves
+  status: pending
+- id: gc-settings-storage-estimate
+  subject: Settings has no cache/data breakdown beyond agentgui's own localStorage keys - no navigator.storage.estimate()
+  status: pending

package/lib/http-handler.js

@@ -84,6 +84,25 @@ function sanitizeEntryName(name) {
   return n;
 }
 
+// Every confined filesystem route accepts its target path via a `?path=`/
+// `?dir=` query param, preferred over a path SEGMENT. A reverse proxy's
+// proxy_pass URI normalization can decode-then-reencode the request path,
+// collapsing an encoded %2F segment slash back into a literal '/' before
+// forwarding - the app then sees extra path segments instead of one opaque
+// one, strips what it thinks is a leading '/', and silently turns an absolute
+// path into a relative one that fails confinement even for genuinely
+// accessible directories/files. A query param is untouched by that
+// normalization on any proxy in front of this app. `legacyPrefix` is the old
+// `/api/xxx/<path>` route prefix, still accepted for any caller not yet
+// updated to the query-param form.
+function resolveConfinedPath(req, routePath, queryKey, legacyPrefix) {
+  const url = new URL(req.url, 'http://x');
+  const qVal = url.searchParams.get(queryKey);
+  if (qVal != null) return qVal;
+  const raw = routePath.split('?')[0].slice(legacyPrefix.length).replace(/^\//, '');
+  return raw ? decodeURIComponent(raw) : '';
+}
+
 // Map a Node.js filesystem error code to a safe human-readable string that
 // does not disclose host paths or internal stack context. Used everywhere an
 // err.message would otherwise be returned to the client.
@@ -382,8 +401,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       // to the same allowlist as the Files surface (an unconfined stat would be
       // a filesystem oracle). Returns {ok, dir} or a 403/404 with plain copy.
       if (routePath.startsWith('/api/stat') && req.method === 'GET') {
-        const rawS = routePath.split('?')[0].slice('/api/stat'.length).replace(/^\//, '');
-        const decodedPath = rawS ? decodeURIComponent(rawS) : '';
+        const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/stat');
         const conf = confineToRoots(decodedPath, fsAllowRoots());
         if (!conf.ok) { sendJSON(req, res, conf.reason === 'not found' ? 404 : 403, { error: conf.reason }); return; }
         try {
@@ -441,8 +459,7 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       // FileGrid + BreadcrumbPath render directly. Allowed roots default to the
       // server cwd + Claude projects dir; widen via FS_ROOTS (path-separated).
       if (routePath.startsWith('/api/list')) {
-        const rawQ = routePath.split('?')[0].slice('/api/list'.length).replace(/^\//, '');
-        const decodedPath = rawQ ? decodeURIComponent(rawQ) : '';
+        const decodedPath = resolveConfinedPath(req, routePath, 'dir', '/api/list');
         const allowRoots = fsAllowRoots();
         // Empty path = the first allow-root (a sane default landing dir).
         const reqPath = !decodedPath ? allowRoots[0] : decodedPath;
@@ -509,9 +526,8 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       // and limited to reasonable text/code/image types so this is never a
       // generic arbitrary-file reader. Images are served via /api/image; this
       // returns text/* with utf-8.
-      if (routePath.startsWith('/api/file/')) {
-        const rawF = routePath.split('?')[0].slice('/api/file/'.length);
-        const decodedPath = decodeURIComponent(rawF);
+      if (routePath.startsWith('/api/file/') || routePath.startsWith('/api/file?')) {
+        const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/file/');
         const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
@@ -556,9 +572,8 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
       // Confined raw-bytes download (any type) with an attachment disposition,
       // so the Files view can offer download on a row. Same allowlist + realpath
       // confinement as /api/file and /api/image - never a generic file reader.
-      if (routePath.startsWith('/api/download/')) {
-        const rawD = routePath.split('?')[0].slice('/api/download/'.length);
-        const decodedPath = decodeURIComponent(rawD);
+      if (routePath.startsWith('/api/download/') || routePath.startsWith('/api/download?')) {
+        const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/download/');
         const allowRoots = fsAllowRoots();
         const conf = confineToRoots(decodedPath, allowRoots);
         if (!conf.ok) { res.writeHead(conf.reason === 'not found' ? 404 : 403); res.end('Forbidden'); return; }
@@ -766,9 +781,8 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         return;
       }
 
-      if (routePath.startsWith('/api/image/')) {
-        const imagePath = routePath.slice('/api/image/'.length);
-        const decodedPath = decodeURIComponent(imagePath);
+      if (routePath.startsWith('/api/image/') || routePath.startsWith('/api/image?')) {
+        const decodedPath = resolveConfinedPath(req, routePath, 'path', '/api/image/');
         // Confine reads to an allowlist root. Without this the route is an
         // arbitrary-file-read of any image-extensioned path on the host (the
         // prior `includes('..')` guard is a no-op after path.normalize resolves

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1060",
+  "version": "1.0.1062",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -1012,6 +1012,15 @@ function fileMutationCopy(e) {
   if (e.status === 413) return 'Too large (50MB upload cap).';
   return e.message || 'The operation failed.';
 }
+// On a 409 name-collision, suggest 'name (2)' / 'name (3)' etc instead of
+// leaving the user to retype the identical blocked string from scratch -
+// mirrors the numbering convention most desktop file managers use.
+function suggestAlternateName(name) {
+  const m = /^(.*) \((\d+)\)(\.[^.]*)?$/.exec(name);
+  if (m) return m[1] + ' (' + (parseInt(m[2], 10) + 1) + ')' + (m[3] || '');
+  const dot = name.lastIndexOf('.');
+  return dot > 0 ? name.slice(0, dot) + ' (2)' + name.slice(dot) : name + ' (2)';
+}
 function openFileDialog(kind, file) {
   const trigger = typeof document !== 'undefined' ? document.activeElement : null;
   state.files.dialog = { kind, file: file || null, error: null, busy: false, _trigger: trigger || null };
@@ -1285,7 +1294,7 @@ function fileDialog() {
   // flow, so a sibling alert was invisible and outside the focus trap).
   if (d.kind === 'rename') {
     return PromptDialog({
-      title: 'Rename ' + d.file.name, value: d.file.name, placeholder: 'new name',
+      title: 'Rename ' + d.file.name, value: d.suggestedValue ?? d.file.name, placeholder: 'new name',
       error: d.error || null, busy: !!d.busy,
       confirmLabel: d.busy ? 'renaming…' : 'rename', cancelLabel: 'cancel',
       onCancel: closeFileDialog,
@@ -1295,7 +1304,17 @@ function fileDialog() {
         runFileMutation(() => B.renameEntry(state.backend, d.file.path, v), 'renamed to ' + v,
           (entries) => entries.map((e) => (e.path || e.name) === (d.file.path || d.file.name)
             ? { ...e, name: v, path: e.path ? e.path.slice(0, e.path.length - d.file.name.length) + v : v }
-            : e));
+            : e))
+          .then(() => {
+            // On a 409 name-collision, prefill the retry input with a
+            // suggested alternate instead of leaving the identical blocked
+            // string - matching the pattern uploadFiles' 409-retry rows
+            // already establish for the same class of conflict.
+            if (state.files.dialog === d && d.error && /already exists/i.test(d.error)) {
+              d.suggestedValue = suggestAlternateName(v);
+              render();
+            }
+          });
       },
     });
   }
@@ -1348,11 +1367,18 @@ function fileDialog() {
     }
     return PromptDialog({
       title: 'Move ' + n + ' selected ' + (n === 1 ? 'entry' : 'entries'),
-      value: state.files.path || '', placeholder: 'destination folder path',
+      value: d._draft ?? (state.files.path || ''), placeholder: 'destination folder path',
       error: d.error || null, busy: !!d.busy,
       confirmLabel: d.busy ? 'moving…' : 'move ' + n, cancelLabel: 'cancel',
+      // A second/third allowed root has no discoverable path other than
+      // typing it from memory - one-click chips for every accessible root,
+      // matching the same practicality upgrade the cwd editor got.
+      roots: (Array.isArray(state.files.roots) && state.files.roots.length > 1)
+        ? state.files.roots.map((r) => ({ path: r, label: truncate(projectLabel(r) || r, 14, 24) }))
+        : undefined,
       onCancel: closeFileDialog,
-      onInput: (v) => { d.error = null; d._validateDest(v); },
+      onInput: (v) => { d._draft = v; d.error = null; d._validateDest(v); },
+      onPickRoot: (v) => { d._draft = v; d.error = null; d._validateDest(v); render(); },
       onConfirm: (v) => {
         if (!v) { d.error = 'enter a destination folder'; render(); return; }
         if (v === state.files.path) { d.error = 'already in that folder - enter a different destination'; render(); return; }
@@ -1362,7 +1388,7 @@ function fileDialog() {
   }
   if (d.kind === 'mkdir') {
     return PromptDialog({
-      title: 'New folder', value: '', placeholder: 'folder name',
+      title: 'New folder', value: d.suggestedValue ?? '', placeholder: 'folder name',
       error: d.error || null, busy: !!d.busy,
       confirmLabel: d.busy ? 'creating…' : 'create', cancelLabel: 'cancel',
       onCancel: closeFileDialog,
@@ -1371,7 +1397,13 @@ function fileDialog() {
         runFileMutation(() => B.makeDir(state.backend, state.files.path, v), 'created ' + v,
           (entries) => entries.some((e) => e.name === v)
             ? entries
-            : [...entries, { name: v, path: (state.files.path ? state.files.path.replace(/\/$/, '') + '/' : '') + v, type: 'dir' }]);
+            : [...entries, { name: v, path: (state.files.path ? state.files.path.replace(/\/$/, '') + '/' : '') + v, type: 'dir' }])
+          .then(() => {
+            if (state.files.dialog === d && d.error && /already exists/i.test(d.error)) {
+              d.suggestedValue = suggestAlternateName(v);
+              render();
+            }
+          });
       },
     });
   }
@@ -1665,6 +1697,21 @@ function filesMain() {
 // stop-selected against sessions that no longer exist.
 const LIVE_PREFS_KEY = 'agentgui.live';
 const FILES_PREFS_KEY = 'agentgui.files';
+// Recent-cwd MRU: a small, most-recently-used list of working directories
+// actually saved, so switching between a regular handful of projects needs no
+// re-typing/re-browsing. Capped small - this is a quick-pick convenience, not
+// a full history (that's what the Files tab + browse popover are for).
+const CWD_RECENT_KEY = 'agentgui.cwd.recent';
+const CWD_RECENT_CAP = 6;
+function loadRecentCwds() {
+  try { const v = JSON.parse(lsGet(CWD_RECENT_KEY) || '[]'); return Array.isArray(v) ? v : []; } catch { return []; }
+}
+function pushRecentCwd(path) {
+  if (!path) return;
+  const list = loadRecentCwds().filter((p) => p !== path);
+  list.unshift(path);
+  lsSet(CWD_RECENT_KEY, JSON.stringify(list.slice(0, CWD_RECENT_CAP)));
+}
 function persistLivePrefs() {
   lsSet(LIVE_PREFS_KEY, JSON.stringify({ sort: state.live.sort || 'status', errorsOnly: !!state.live.errorsOnly, filter: state.live.filter || '' }));
   if (state.tab === 'live') writeHash();
@@ -2089,6 +2136,7 @@ function applyToolResult(parts, block) {
 const ERR_COPY = [
   [/^ws closed$/, 'Lost connection to the server.'],
   [/connection lost during stream/, 'Lost connection while the agent was responding - use retry.'],
+  [/connection dropped mid-turn/, 'Connection dropped mid-turn - the response above may be incomplete (events weren\'t replayed). Retry to try again.'],
   [/no sessionId from server/, 'The server could not start the agent - check it is installed.'],
   [/^sessions: \d+/, 'History is still indexing - try again in a moment.'],
 ];
@@ -2151,11 +2199,17 @@ function chatMain() {
     banners.push(Alert({ key: 'cwderr', kind: 'warn', title: 'Invalid working directory', children: state.cwdError }));
   }
   if (state.chat.externalUpdate) {
+    const hasDraft = !!(state.chat.draft && state.chat.draft.trim());
     banners.push(Alert({ key: 'xupd', kind: 'info', title: 'This chat was updated in another tab',
       children: [
-        h('span', { key: 'xutxt' }, 'Reload it to see the latest turns, or dismiss to keep this tab\'s view. '),
+        h('span', { key: 'xutxt' }, 'Reload it to see the latest turns, or dismiss to keep this tab\'s view. '
+          // "reload it" re-pulls the transcript from localStorage, which
+          // silently discarded whatever was typed but not yet sent in THIS
+          // tab - warn before that data-loss, not just after.
+          + (hasDraft ? 'This tab has an unsent draft that reloading will discard. ' : '')),
         Btn({ key: 'xureload', disabled: state.chat.busy, onClick: () => {
           if (state.chat.busy) return;
+          if (hasDraft && !window.confirm('Reloading will discard your unsent draft in this tab. Continue?')) return;
           state.chat.externalUpdate = false;
           state.chat.messages = []; state.chat.resumeSid = null; state.chat.totalCost = 0;
           restoreChat(); render();
@@ -2174,9 +2228,15 @@ function chatMain() {
         Btn({ key: 'ptruncdismiss', onClick: () => { state.chat.persistTruncated = false; render(); }, children: 'dismiss' })] }));
   }
   if (state.agentsError) {
+    // A failed agents.list call (server/network issue) is a distinct case
+    // from "the list loaded but nothing is installed" (installHint below,
+    // which only fires on a genuinely non-empty, all-unavailable list) -
+    // recommending npx-install commands here would be actively wrong, since
+    // we don't actually know whether anything is installed. Just clarify the
+    // failure is transient/server-side, not a "nothing is installed" state.
     banners.push(Alert({ key: 'agerr', kind: 'error', title: 'Could not load agents from the server',
       children: [
-        h('span', { key: 'agtxt', title: state.agentsError }, 'The agent list failed to load. '),
+        h('span', { key: 'agtxt', title: state.agentsError }, 'The agent list failed to load - this is a connection issue, not necessarily a sign nothing is installed. '),
         Btn({ key: 'agretry', onClick: () => loadAgents(), children: 'retry' })] }));
   }
   if (state.chat.loadingTranscript) {
@@ -2185,9 +2245,19 @@ function chatMain() {
   }
   if (state.chat.confirmingEdit) {
     const isRetry = state.chat.confirmingEdit.kind === 'retry';
+    // Name the actual count/cost about to be discarded instead of the vague
+    // "the later turns" - a user retrying/editing message 2 of 40 needs to
+    // know whether that's 1 turn or 38 before confirming a destructive undo.
+    const truncIdx = state.chat.confirmingEdit.idx;
+    const discarded = state.chat.messages.slice(truncIdx + 1);
+    const discardedTurns = discarded.filter((m) => m.role === 'user').length;
+    const discardedCost = discarded.reduce((s, m) => s + (typeof m.costUsd === 'number' ? m.costUsd : 0), 0);
+    const discardSummary = discardedTurns
+      ? plural(discardedTurns, 'turn') + (discardedCost > 0 ? ' ($' + discardedCost.toFixed(4) + ')' : '')
+      : null;
     banners.push(Alert({ key: 'confedit', kind: 'warn', title: isRetry ? 'Retry this turn?' : 'Edit this message?',
       children: [
-        h('span', { key: 'cetext' }, (isRetry ? 'Retrying' : 'Editing') + ' will remove the later turns - continue? '),
+        h('span', { key: 'cetext' }, (isRetry ? 'Retrying' : 'Editing') + ' will remove ' + (discardSummary ? discardSummary + ' after this point' : 'the later turns') + ' - continue? '),
         Btn({ key: 'ceno', onClick: cancelEditAndResend, children: 'cancel' }),
         Btn({ key: 'ceyes', danger: true, onClick: confirmEditAndResend, children: isRetry ? 'retry' : 'continue' })] }));
   }
@@ -2296,6 +2366,16 @@ function chatMain() {
       cwdDraft: state.cwdDraft,
       cwdError: state.cwdError || null,
       cwdChecking: !!state.cwdChecking,
+      // Practicality upgrade: allowed roots (one-click starting points, always
+      // visible instead of buried in the Files tab's own picker), a small
+      // recent-cwd MRU (one-click switch between the handful of directories a
+      // user actually works in), and an inline browse popover (click through
+      // subdirectories right here instead of round-tripping through Files).
+      cwdRoots: (Array.isArray(state.files.roots) && state.files.roots.length)
+        ? state.files.roots.map((r) => ({ path: r, label: truncate(projectLabel(r) || r, 14, 24) }))
+        : undefined,
+      cwdRecent: loadRecentCwds().filter((p) => p !== state.chatCwd),
+      cwdBrowse: state.cwdBrowse || undefined,
       // Pasted images upload through the same confined endpoint the Files tab
       // uses, into the chat's current cwd, then insert the resulting relative
       // path into the draft - matching the desktop-composer expectation
@@ -2332,14 +2412,35 @@ function chatMain() {
         if (was !== now) render();
       },
       onSend: (v) => { state.chat.draft = v; sendChat(); },
-      onCwdEdit: () => { state.cwdEditing = true; state.cwdDraft = state.chatCwd || ''; state.cwdError = null; render(); requestAnimationFrame(() => { const inp = document.querySelector('.agentchat-cwd-input'); if (inp) inp.focus(); }); },
+      onCwdEdit: () => {
+        state.cwdEditing = true; state.cwdDraft = state.chatCwd || ''; state.cwdError = null; render();
+        requestAnimationFrame(() => { const inp = document.querySelector('.agentchat-cwd-input'); if (inp) inp.focus(); });
+        // A fresh user has no way to discover what's even browsable if roots
+        // are only fetched on the first "browse" click - prefetch them the
+        // moment the editor opens (root-only listDir call, cheap) so the
+        // always-visible roots row is populated on the very first open.
+        if (!(state.files.roots && state.files.roots.length)) {
+          B.listDir(state.backend, '').then((j) => { state.files.roots = j.roots || []; render(); }).catch(() => {});
+        }
+      },
+      onCwdBrowseToggle: () => toggleCwdBrowse(),
+      onCwdBrowseCrumb: (i) => cwdBrowseCrumb(i),
+      onCwdBrowseEnter: (path) => loadCwdBrowseDir(path),
+      onCwdBrowsePick: (path) => cwdBrowsePick(path),
       onCwdSave: async () => {
-        const path = (state.cwdDraft ?? '').trim();
-        // A relative cwd would resolve against the server process dir, not what
-        // the user means - require an absolute path (POSIX /..., UNC \\..., or
-        // Windows drive X:\...). Blank is valid (server default).
-        if (path && !/^([/\\]|[A-Za-z]:[/\\])/.test(path)) {
-          state.cwdError = 'enter an absolute path (e.g. /home/you/proj or C:\\proj) or leave blank';
+        let path = (state.cwdDraft ?? '').trim();
+        const isAbsolute = /^([/\\]|[A-Za-z]:[/\\])/.test(path);
+        // A bare relative subpath (no leading / or drive letter) resolves
+        // against the CURRENT chat cwd, not the server process dir - lets a
+        // power user type a known subfolder name instead of the full path or
+        // opening the browse popover. Only meaningful when a cwd is already
+        // set; with no current cwd there's no sensible base to resolve against.
+        if (path && !isAbsolute && state.chatCwd) {
+          const base = state.chatCwd.replace(/[/\\]+$/, '');
+          const sep = state.chatCwd.includes('\\') && !state.chatCwd.includes('/') ? '\\' : '/';
+          path = base + sep + path.replace(/^\.[/\\]/, '');
+        } else if (path && !isAbsolute) {
+          state.cwdError = 'enter an absolute path (e.g. /home/you/proj or C:\\proj), a subfolder name (resolves against the current cwd once one is set), or leave blank';
           render();
           return;
         }
@@ -2350,7 +2451,7 @@ function chatMain() {
             if (!st || st.ok === false) { state.cwdError = 'directory not found on the server: ' + path; render(); return; }
             if (!st.dir) { state.cwdError = 'that path is not a directory'; render(); return; }
           } catch (e) {
-            state.cwdError = e.status === 403 ? 'outside the accessible folders'
+            state.cwdError = e.status === 403 ? 'outside the accessible folders - use "browse…" or a "recent"/root chip above to pick a reachable one'
               : (e.status === 404 ? 'directory not found on the server: ' + path
               : (e.status ? 'directory not found on the server: ' + path : 'could not validate the path - server unreachable'));
             render();
@@ -2359,20 +2460,86 @@ function chatMain() {
         }
         state.cwdError = null;
         state.chatCwd = path;
-        if (state.chatCwd) lsSet('agentgui.cwd', state.chatCwd); else lsRemove('agentgui.cwd');
-        state.cwdEditing = false; state.cwdDraft = undefined; render();
+        if (state.chatCwd) { lsSet('agentgui.cwd', state.chatCwd); pushRecentCwd(state.chatCwd); } else lsRemove('agentgui.cwd');
+        state.cwdEditing = false; state.cwdDraft = undefined; state.cwdBrowse = null; render();
       },
-      onCwdCancel: () => { state.cwdEditing = false; state.cwdDraft = undefined; state.cwdError = null; state.cwdChecking = false; render(); requestAnimationFrame(() => { const btn = document.querySelector('.agentchat-cwd-btn'); if (btn) btn.focus(); }); },
+      onCwdCancel: () => { state.cwdEditing = false; state.cwdDraft = undefined; state.cwdError = null; state.cwdChecking = false; state.cwdBrowse = null; render(); requestAnimationFrame(() => { const btn = document.querySelector('.agentchat-cwd-btn'); if (btn) btn.focus(); }); },
       onCwdClear: () => { state.chatCwd = ''; lsRemove('agentgui.cwd'); render(); },
       onCwdDraft: (v) => { state.cwdDraft = v; state.cwdError = null; debouncedCwdProbe(); },
     }),
   ].filter(Boolean);
 }
 
+// Inline cwd-browse popover: a lightweight directory-only listing reusing the
+// same confined B.listDir the Files tab uses, but writing to its own
+// state.cwdBrowse rather than state.files - opening/closing the cwd browser
+// must never disturb whatever the Files tab currently has loaded, and vice
+// versa (independent request-id guards against cross-talk if both are open).
+let _cwdBrowseReqId = 0;
+async function loadCwdBrowseDir(dirPath) {
+  const myReq = (_cwdBrowseReqId += 1);
+  state.cwdBrowse = { ...(state.cwdBrowse || {}), loading: true };
+  render();
+  try {
+    const j = await B.listDir(state.backend, dirPath || '');
+    if (_cwdBrowseReqId !== myReq) return;
+    state.cwdBrowse = {
+      current: j.path,
+      segments: j.segments || [],
+      rootLabel: (state.files.roots && state.files.roots.length > 1) ? 'roots' : 'root',
+      // Directory-only listing: the cwd picker is for choosing a folder to run
+      // in, not for browsing/opening files - filter out non-directory entries.
+      entries: (j.entries || []).filter((e) => e.type === 'dir' || e.isDir || e.dir),
+      loading: false,
+    };
+    render();
+  } catch (e) {
+    if (_cwdBrowseReqId !== myReq) return;
+    state.cwdBrowse = { ...(state.cwdBrowse || {}), loading: false, entries: [] };
+    render();
+  }
+}
+function toggleCwdBrowse() {
+  if (state.cwdBrowse) { state.cwdBrowse = null; render(); return; }
+  loadCwdBrowseDir(state.cwdDraft || state.chatCwd || '');
+}
+function cwdBrowseCrumb(segIdx) {
+  if (!state.cwdBrowse || !state.cwdBrowse.segments) return;
+  const target = segIdx === 0 ? '' : state.cwdBrowse.segments.slice(0, segIdx).join('/');
+  loadCwdBrowseDir(target);
+}
+// "use this folder" commits the browse popover's CURRENT directory into the
+// draft input (leaving the popover open state cleared) so the user still
+// confirms via the normal save flow (which re-validates + persists to recent).
+function cwdBrowsePick(path) {
+  if (!path) return;
+  state.cwdDraft = path;
+  state.cwdError = null;
+  state.cwdBrowse = null;
+  debouncedCwdProbe();
+  render();
+}
+
 function offlineBanner() {
+  // A session-expired 401 is a distinct, more actionable case than a plain
+  // network-down offline state (the fix is "reload", not "wait for
+  // reconnect") - surfaced first since it takes priority as an explanation.
+  if (state.sessionExpired) {
+    return Alert({ key: 'sessionexpired', kind: 'error', title: 'Session expired',
+      children: [
+        h('span', { key: 'setxt' }, 'Your access token is no longer valid (it may have rotated or expired). Reload the page to sign in again. '),
+        Btn({ key: 'sereload', onClick: () => window.location.reload(), children: 'reload now' }),
+      ] });
+  }
   if (state.health.status === 'ok' || state.health.status === 'unknown') return null;
   return Alert({ key: 'offline', kind: 'error', title: 'Backend unreachable',
-    children: 'agentgui can\'t reach the server (' + (state.health.error || state.health.status) + '). Chat and history actions will fail until it reconnects.' });
+    children: [
+      h('span', { key: 'otxt' }, 'agentgui can\'t reach the server (' + (state.health.error || state.health.status) + '). Chat and history actions will fail until it reconnects. '),
+      // Previously the only recovery was waiting for the WS backoff timer or
+      // a manual page reload - a direct retry button re-probes /health
+      // immediately instead of making the user guess how long to wait.
+      Btn({ key: 'oretry', disabled: !!state.healthChecking, onClick: () => recheckHealth(), children: state.healthChecking ? 'checking…' : 'retry now' }),
+    ] });
 }
 
 // (The working-directory bar now lives in the AgentChat kit; agentgui wires its
@@ -2805,19 +2972,31 @@ async function sendChat(textArg) {
 // Validate the cwd draft while editing (debounced) so an invalid path reads as
 // invalid before the save click, via the existing confined /api/stat endpoint.
 const debouncedCwdProbe = debounce(async () => {
-  const path = (state.cwdDraft ?? '').trim();
+  const raw = (state.cwdDraft ?? '').trim();
   if (!state.cwdEditing) return;
-  if (!path || !/^([/\\]|[A-Za-z]:[/\\])/.test(path)) { state.cwdChecking = false; render(); return; }
+  const isAbsolute = /^([/\\]|[A-Za-z]:[/\\])/.test(raw);
+  let path = raw;
+  if (raw && !isAbsolute && state.chatCwd) {
+    // Mirror onCwdSave's relative-subpath resolution so the live-typing hint
+    // reflects the same interpretation the save button will actually apply.
+    const base = state.chatCwd.replace(/[/\\]+$/, '');
+    const sep = state.chatCwd.includes('\\') && !state.chatCwd.includes('/') ? '\\' : '/';
+    path = base + sep + raw.replace(/^\.[/\\]/, '');
+  } else if (raw && !isAbsolute) {
+    state.cwdChecking = false; render(); return;   // no cwd to resolve against yet - onCwdSave surfaces the error on save
+  } else if (!raw) {
+    state.cwdChecking = false; render(); return;
+  }
   state.cwdChecking = true; render();
-  const probed = path;
+  const probed = raw;   // compare against the RAW (unresolved) draft to detect staleness
   try {
-    const st = await B.statPath(state.backend, probed);
+    const st = await B.statPath(state.backend, path);   // query the RESOLVED absolute path
     if ((state.cwdDraft ?? '').trim() !== probed) return;   // draft moved on
     state.cwdError = (!st || st.ok === false) ? 'folder not found on the server'
       : (!st.dir ? 'that path is not a directory' : null);
   } catch (e) {
     if ((state.cwdDraft ?? '').trim() !== probed) return;
-    state.cwdError = e.status === 403 ? 'outside the accessible folders'
+    state.cwdError = e.status === 403 ? 'outside the accessible folders - try "browse…" or a chip above'
       : (e.status === 404 ? 'folder not found on the server' : null);
   }
   state.cwdChecking = false;
@@ -2864,10 +3043,10 @@ function eventMatchesFilter(e, f) {
 
 // Scroll to + flash the first error event, widening the render window (and
 // clearing the type filter) so the row is actually rendered.
-function jumpToFirstError() {
-  const idx = state.events.findIndex(e => e.isError);
+function jumpToEvent(idx) {
   if (idx < 0) return;
   state.eventFilter = 'all';
+  state._errorNavIdx = idx;
   const fromEnd = state.events.length - idx;
   if (fromEnd > state.eventsLimit) state.eventsLimit = Math.ceil(fromEnd / 300) * 300;
   render();
@@ -2879,6 +3058,21 @@ function jumpToFirstError() {
     if (row) { row.scrollIntoView({ block: 'center' }); row.classList.add('event-flash'); setTimeout(() => row.classList.remove('event-flash'), 2000); }
   });
 }
+function jumpToFirstError() {
+  const idx = state.events.findIndex(e => e.isError);
+  jumpToEvent(idx);
+}
+// Persistent next/prev navigation between error events - jumpToFirstError
+// alone only reaches the FIRST error once; a session with multiple errors had
+// no way to step through them without manually scanning the event list.
+function jumpToNextError(dir) {
+  const errIdxs = state.events.reduce((acc, e, i) => { if (e.isError) acc.push(i); return acc; }, []);
+  if (!errIdxs.length) return;
+  const cur = state._errorNavIdx;
+  let pos = errIdxs.indexOf(cur);
+  pos = pos < 0 ? (dir > 0 ? 0 : errIdxs.length - 1) : (pos + dir + errIdxs.length) % errIdxs.length;
+  jumpToEvent(errIdxs[pos]);
+}
 
 function historyMain() {
   if (!state.selectedSid) {
@@ -2904,8 +3098,14 @@ function historyMain() {
   }
 
   const sess = (Array.isArray(state.sessions) ? state.sessions : []).find(s => s.sid === state.selectedSid);
+  // sess.model is the raw ccsniff-sourced field (41st-run fix); ccsniff only
+  // reads Claude Code's own JSONL so the agent is always constant. The
+  // History detail header previously never surfaced either, reading
+  // identity-thin next to the same session's Running-panel/Live-dashboard
+  // rows which both show an agent+model badge.
+  const agentModelBit = sess?.model ? ((agentById('claude-code')?.name || 'Claude Code') + ' · ' + sess.model) : null;
   const lede = sess
-    ? (projectLabel(sess.project) || pathBasename(sess.cwd) || 'unknown location') + ' · ' + plural(sess.events || 0, 'event') + ' · ' + plural(sess.userTurns || 0, 'turn') + ' · ' + fmtRelTime(sess.last)
+    ? (projectLabel(sess.project) || pathBasename(sess.cwd) || 'unknown location') + (agentModelBit ? ' · ' + agentModelBit : '') + ' · ' + plural(sess.events || 0, 'event') + ' · ' + plural(sess.userTurns || 0, 'turn') + ' · ' + fmtRelTime(sess.last)
     : UNTITLED_CONVERSATION;
 
   const head = PageHeader({
@@ -2923,6 +3123,11 @@ function historyMain() {
       onClick: () => downloadBlob(JSON.stringify(state.events, null, 2), (projectLabel(sess?.project) || 'session') + '-' + state.selectedSid + '.json', 'application/json'),
       children: 'export' }),
     hasErrors ? Btn({ key: 'jumperr', onClick: jumpToFirstError, children: 'jump to first error' }) : null,
+    // Persistent next/prev stepping between errors - jump-to-first alone only
+    // ever reaches the FIRST one; a session with several errors had no way to
+    // step through the rest without manually scrolling/scanning.
+    hasErrors ? Btn({ key: 'errprev', title: 'previous error', 'aria-label': 'previous error', onClick: () => jumpToNextError(-1), children: 'prev error' }) : null,
+    hasErrors ? Btn({ key: 'errnext', title: 'next error', 'aria-label': 'next error', onClick: () => jumpToNextError(1), children: 'next error' }) : null,
   ].filter(Boolean));
 
   if (state.events.length === 0) {
@@ -2966,7 +3171,9 @@ function historyMain() {
   }, { turns: 0, tools: 0, errors: 0 });
   const meta = SessionMeta({
     items: [
-      sess && sess.cwd ? { label: 'directory', value: sess.cwd, title: sess.cwd } : null,
+      sess && sess.cwd ? { label: 'directory', value: sess.cwd, title: sess.cwd,
+        actionLabel: 'use as chat cwd',
+        onAction: () => { state.chatCwd = sess.cwd; lsSet('agentgui.cwd', sess.cwd); pushRecentCwd(sess.cwd); announce('working directory set to ' + sess.cwd); render(); } } : null,
       (() => { const dur = sessionDuration(); return dur ? { label: 'duration', value: dur } : null; })(),
       { label: 'session id', value: state.selectedSid.slice(0, 8) + '…', title: state.selectedSid, onCopy: () => copyText(state.selectedSid, 'session id copied') },
       // Spelled counter vocabulary in the detail strip (events/turns/tools/
@@ -3937,6 +4144,13 @@ function registerWsStatusOnce() {
       if (state.health.ws) { delete state.health.ws; render(); }
     }
   });
+  // backend.js already detects a mid-session 401 (a token that stopped being
+  // valid - e.g. PASSWORD rotated, cookie expired) and exports this hook, but
+  // nothing ever subscribed to it: every subsequent fetch just failed
+  // silently with no on-screen indication of WHY. Surface it as a persistent
+  // banner instructing a reload (the only real recovery - the token lives in
+  // window.__WS_TOKEN, injected server-side at page load).
+  B.onSessionExpired?.(() => { state.sessionExpired = true; render(); });
 }
 
 hydratePrefs();
@@ -4041,8 +4255,16 @@ window.addEventListener('keydown', (e) => {
   }
   if (e.metaKey || e.ctrlKey || e.altKey) return;
   if (typing) {
-    if (e.key === 'Escape') t.blur();
-    return;
+    // The cwd editor's own text input is the one exception: Escape there must
+    // close the editor in a single press (matching every other Escape-
+    // closeable surface in the app), not blur-then-require-a-second-press.
+    if (e.key === 'Escape' && t.classList && t.classList.contains('agentchat-cwd-input')) {
+      t.blur();
+      // Fall through to the ladder below instead of returning early.
+    } else {
+      if (e.key === 'Escape') t.blur();
+      return;
+    }
   }
   if (e.key === 'Escape') {
     // Priority ladder for transient state (modals/drawers are kit-handled):
@@ -4052,6 +4274,17 @@ window.addEventListener('keydown', (e) => {
     // backdrop listener covers in-dialog focus; this covers everything else).
     if (state.files.dialog) { if (!state.files.dialog.busy) closeFileDialog(); return; }
     if (state.chat.confirmingEdit) { state.chat.confirmingEdit = null; render(); announce('edit cancelled'); return; }
+    // cwd editor: the browse popover is a nested layer within it - Escape
+    // closes the popover first (one level of the nesting) before falling
+    // through to closing the whole editor on a second press, matching the
+    // dialog-then-page Escape convention used elsewhere in the app.
+    if (state.cwdEditing) {
+      if (state.cwdBrowse) { state.cwdBrowse = null; render(); announce('folder browser closed'); return; }
+      state.cwdEditing = false; state.cwdDraft = undefined; state.cwdError = null; state.cwdChecking = false;
+      render(); announce('cwd edit cancelled');
+      requestAnimationFrame(() => { const btn = document.querySelector('.agentchat-cwd-btn'); if (btn) btn.focus(); });
+      return;
+    }
     if (state.confirmingClearData) { state.confirmingClearData = false; render(); announce('clear cancelled'); return; }
     if (state.confirmingNewChat) { clearTimeout(_newChatArmTimer); state.confirmingNewChat = false; render(); announce('new chat cancelled'); return; }
     if (state.live.confirmingStopAll || state.live.confirmingStopSelected) {