agentgui 1.0.1060 → 1.0.1062

package/site/app/js/backend.js

@@ -91,8 +91,16 @@ export async function probeBackend(base) {
 // An empty path lands on the server's first allow-root. The server confines
 // every path to an allowlist root, so a 403 means the path is out of bounds.
 export async function listDir(base, dirPath) {
-  const seg = dirPath ? '/' + encodeURIComponent(dirPath) : '';
-  const r = await authedFetch(base + '/api/list' + seg);
+  // A path SEGMENT (encoded as %2F for its own slashes) is silently mangled by
+  // some reverse-proxy configs that normalize proxy_pass URIs - a nginx
+  // decode-then-reencode of the request path collapses %2F back into a literal
+  // slash before forwarding, so the app receives extra path segments instead
+  // of one opaque one, loses its leading slash on strip, and 403s every
+  // absolute-path listing that isn't the bare root. A query param is never
+  // subject to that URI-path normalization, so it survives any proxy in front
+  // of this app untouched.
+  const qs = dirPath ? '?dir=' + encodeURIComponent(dirPath) : '';
+  const r = await authedFetch(base + '/api/list' + qs);
   const j = await r.json().catch(() => ({}));
   if (!r.ok) {
     // Carry the HTTP status so the app can map 403/404 to plain copy (W9).
@@ -108,7 +116,10 @@ export async function listDir(base, dirPath) {
 // a 403 means out-of-bounds or unsupported type, 404 missing. Returns
 // { content, truncated }.
 export async function readFile(base, filePath) {
-  const r = await authedFetch(base + '/api/file/' + encodeURIComponent(filePath));
+  // Query param, not a path segment - see listDir()'s comment above for why:
+  // a reverse proxy's URI normalization can silently collapse an encoded %2F
+  // path-segment slash back into a literal slash before forwarding.
+  const r = await authedFetch(base + '/api/file?path=' + encodeURIComponent(filePath));
   if (!r.ok) {
     const t = await r.text().catch(() => '');
     throw new Error(t || ('file: ' + r.status));
@@ -119,13 +130,13 @@ export async function readFile(base, filePath) {
 
 // Same-origin URL for an image file (served by /api/image, token-threaded).
 export function imageUrl(base, filePath) {
-  return withToken(base + '/api/image/' + encodeURIComponent(filePath));
+  return withToken(base + '/api/image?path=' + encodeURIComponent(filePath));
 }
 
 // Same-origin download URL (served by /api/download, attachment disposition,
 // confined + token-threaded). Used by the Files row download action.
 export function downloadUrl(base, filePath) {
-  return withToken(base + '/api/download/' + encodeURIComponent(filePath));
+  return withToken(base + '/api/download?path=' + encodeURIComponent(filePath));
 }
 
 // ---------- File mutations (confined server endpoints) ----------
@@ -143,10 +154,13 @@ async function mutateJSON(base, route, body) {
   return j;
 }
 
-// Stat a path (GET /api/stat/<encoded>) for cwd validation. Returns {ok, dir}.
+// Stat a path (GET /api/stat?path=<encoded>) for cwd validation. Returns {ok, dir}.
 // Throws an Error carrying .status (403 outside roots, 404 missing).
 export async function statPath(base, p) {
-  const r = await authedFetch(base + '/api/stat/' + encodeURIComponent(p));
+  // Query param, not a path segment - see the comment in listDir() above for
+  // why: a reverse proxy's URI normalization can silently collapse an encoded
+  // %2F path-segment slash back into a literal slash before forwarding.
+  const r = await authedFetch(base + '/api/stat?path=' + encodeURIComponent(p));
   const j = await r.json().catch(() => ({}));
   if (!r.ok) { const e = new Error(j.error || ('stat: ' + r.status)); e.status = r.status; throw e; }
   return j;

package/site/app/vendor/anentrypoint-design/247420.css

@@ -60,8 +60,14 @@
   --sky:         #3A6EFF;
   /* --warn = interactive danger controls (buttons, banners, menus, error
      inputs); --danger below = passive error/status text and metrics
-     (kpi/sparkline deltas, auth-error text). Two tokens, one convention. */
-  --warn:        #E0241A;
+     (kpi/sparkline deltas, auth-error text). Two tokens, one convention.
+     #E0241A measured 4.19:1 on --paper — fails WCAG AA 4.5:1 for the many
+     TEXT usages (.field-error, .ds-btn-warn, .ds-stat-val.err-rate, toast/
+     session error labels), not just the interactive-control (>=3:1) usages.
+     Darkened to clear AA on --paper (5.29:1), --paper-2 (4.78:1), and the
+     thebird warm-paper preset (5.25:1) while staying visually a clear
+     warm red. */
+  --warn:        #C41C0C;
   /* Syntax-token aliases: light values pass 4.5:1 on paper; the dark blocks
      restore the bright dark-tuned originals. Components reference ONLY these. */
   --code-string:  var(--green);
@@ -477,7 +483,7 @@
   --accent: var(--acid); --accent-fg: var(--ink); --accent-ink: var(--acid-deep);
   --accent-tint: color-mix(in oklab, var(--accent-ink) 22%, var(--bg));
   /* A paper island under a dark ancestor must not inherit the dark signal pair. */
-  --flame: #C53E00; --amber: #7C570F; --warn: #E0241A; --sky: #3A6EFF;
+  --flame: #C53E00; --amber: #7C570F; --warn: #C41C0C; --sky: #3A6EFF;
 }
 
 /* thebird — warm-paper brand preset. A first-class swappable theme: it lives
@@ -951,6 +957,22 @@
 .ds-247420 .app-main > .ds-files-stack,
 .ds-247420 .app-main > .grow { flex: 1 1 auto; min-height: 0; }
 .ds-247420 .app-main.narrow { max-width: var(--measure-narrow); margin: 0 auto; }
+/* Article-body heading rhythm and lede spacing, consumed by flatspace-rendered
+   long-form pages (docs, papers) that drop headings/panels directly into .app-main. */
+.ds-247420 .app-main > h1,
+.ds-247420 .app-main > h2,
+.ds-247420 .app-main > h3 { margin-top: 36px; margin-bottom: 12px; }
+.ds-247420 .app-main > h1:first-child { margin-top: 8px; }
+.ds-247420 .app-main > .panel,
+.ds-247420 .app-main > .work-detail-chips,
+.ds-247420 .app-main > .cli { margin-top: 18px; margin-bottom: 18px; }
+.ds-247420 .app-main .ds-lede { margin-top: 4px; margin-bottom: 18px; max-width: 64ch; line-height: 1.6; }
+.ds-247420 .work-detail-chips { display: flex; flex-wrap: wrap; align-items: center; gap: 10px; row-gap: 10px; }
+@media (max-width: 720px) {
+  .ds-247420 .app-main > h1,
+  .ds-247420 .app-main > h2,
+  .ds-247420 .app-main > h3 { margin-top: 28px; }
+}
 
 @media (min-width: 1400px) {
   /* Fluid ceiling, not a hard stop: scales from 1400px up to 1920px across the
@@ -2664,6 +2686,17 @@
 @media (hover: none), (pointer: coarse) {
   .ds-247420 .ds-modal-input { font-size: 16px; min-height: 44px; }
 }
+/* PromptDialog's optional roots-chip row (destination-path prompts with more
+   than one allowed root) - same chip idiom the cwd editor's roots row uses. */
+.ds-247420 .ds-prompt-roots { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; margin-top: 8px; }
+.ds-247420 .ds-prompt-root-chip {
+  background: var(--bg-2); border: var(--bw-hair) solid var(--rule); color: var(--fg-2);
+  border-radius: var(--r-pill); padding: 3px 10px; font: inherit; font-size: var(--fs-tiny);
+  cursor: pointer;
+}
+.ds-247420 .ds-prompt-root-chip:hover { border-color: var(--accent); color: var(--fg); }
+.ds-247420 .ds-prompt-root-chip:focus-visible { outline: var(--focus-w) solid var(--focus-color); outline-offset: var(--focus-offset); }
+@media (pointer: coarse) { .ds-247420 .ds-prompt-root-chip { min-height: 44px; } }
 /* In-body modal error (role=alert): mutation failures (409/403) surface INSIDE
    the dialog, not behind the fixed overlay. */
 .ds-247420 .ds-modal-error {
@@ -7077,6 +7110,37 @@
 .ds-247420 .agentchat-cwd-input[aria-invalid='true'] { border-color: var(--flame); box-shadow: inset 0 0 0 var(--bw-hair) var(--flame); }
 .ds-247420 .agentchat-cwd-input[aria-busy='true'] { border-color: var(--fg-3); box-shadow: inset 0 0 0 var(--bw-hair) var(--fg-3); }
 
+/* cwd practicality upgrade: editing mode stacks the input row plus any
+   optional roots/recent/browse rows the host wires, instead of a single flat
+   row - each sub-row wraps independently at narrow widths. */
+.ds-247420 .agentchat-cwd-editing { flex-direction: column; align-items: stretch; }
+.ds-247420 .agentchat-cwd-row { display: flex; align-items: center; gap: var(--space-2, 8px); flex-wrap: wrap; }
+.ds-247420 .agentchat-cwd-roots, .ds-247420 .agentchat-cwd-recent {
+  display: flex; align-items: center; gap: 6px; flex-wrap: wrap;
+}
+.ds-247420 .agentchat-cwd-recent-label { font-size: var(--fs-tiny); color: var(--fg-3); }
+.ds-247420 .agentchat-cwd-chip {
+  background: var(--bg-2); border: var(--bw-hair) solid var(--rule); color: var(--fg-2);
+  border-radius: var(--r-pill); padding: 3px 10px; font: inherit; font-size: var(--fs-tiny);
+  cursor: pointer;
+}
+.ds-247420 .agentchat-cwd-chip:hover { border-color: var(--accent); color: var(--fg); }
+.ds-247420 .agentchat-cwd-chip:focus-visible { outline: var(--focus-w) solid var(--focus-color); outline-offset: var(--focus-offset); }
+.ds-247420 .agentchat-cwd-browse {
+  border: var(--bw-hair) solid var(--rule); border-radius: var(--r-1);
+  padding: var(--space-2, 8px); background: var(--bg-2);
+  display: flex; flex-direction: column; gap: 6px;
+  max-height: 220px;
+}
+.ds-247420 .agentchat-cwd-browse-list { overflow-y: auto; display: flex; flex-direction: column; max-height: 160px; }
+.ds-247420 .agentchat-cwd-browse-item {
+  background: none; border: none; color: var(--fg-2); text-align: left;
+  padding: 6px 8px; border-radius: var(--r-1); font: inherit; font-size: var(--fs-tiny);
+  cursor: pointer;
+}
+.ds-247420 .agentchat-cwd-browse-item:hover, .ds-247420 .agentchat-cwd-browse-item:focus-visible { background: var(--bg-3, var(--bg)); color: var(--fg); }
+.ds-247420 .agentchat-cwd-browse-loading, .ds-247420 .agentchat-cwd-browse-empty { padding: 6px 8px; font-size: var(--fs-tiny); color: var(--fg-3); }
+
 /* head + thread */
 .ds-247420 .agentchat-head {
   display: flex;
@@ -7277,7 +7341,7 @@
 }
 /* Coarse-pointer (touch): raise cwd button to 44px minimum tap target */
 @media (pointer: coarse) {
-  .ds-247420 .agentchat-cwd-btn { min-height: 44px; }
+  .ds-247420 .agentchat-cwd-btn, .ds-247420 .agentchat-cwd-chip, .ds-247420 .agentchat-cwd-browse-item { min-height: 44px; }
 }
 
 /* ----------------------------------------------------------------------------
@@ -7363,7 +7427,7 @@
    label sticks to the top of the scroll area for Claude-Desktop-style headers. */
 .ds-247420 .ds-session-group { display: flex; flex-direction: column; }
 .ds-247420 .ds-session-group-rows { display: flex; flex-direction: column; gap: 2px; }
-.ds-247420 .ds-session-group-label { position: sticky; top: 0; z-index: 1; background: var(--bg-1, var(--bg)); font-size: var(--fs-tiny); font-weight: 600; color: var(--fg-3); text-transform: uppercase; letter-spacing: var(--tr-caps); padding: var(--space-2) var(--space-2) var(--space-1); }
+.ds-247420 .ds-session-group-label { position: sticky; top: 0; z-index: 1; background: var(--bg-1, var(--bg)); font-size: var(--fs-tiny); font-weight: 600; color: var(--fg-3); text-transform: uppercase; letter-spacing: var(--tr-label); padding: var(--space-2) var(--space-2) var(--space-1); }
 .ds-247420 .ds-session-row {
   position: relative; display: flex; align-items: center; gap: var(--space-2);
   width: 100%; padding: var(--space-2); min-height: 52px; margin-bottom: 2px;
@@ -7660,15 +7724,15 @@
 .ds-247420 .ds-session-meta-item + .ds-session-meta-item::before { content: '\00B7'; color: var(--fg-3); margin-right: var(--space-1); }
 .ds-247420 .ds-session-meta-label { color: var(--fg-3); }
 .ds-247420 .ds-session-meta-value { font-family: var(--ff-mono); color: var(--fg-2); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.ds-247420 .ds-session-meta-copy {
+.ds-247420 .ds-session-meta-copy, .ds-247420 .ds-session-meta-action {
   padding: 2px 8px; min-height: 24px; cursor: pointer;
   background: var(--bg-2); border: var(--bw-hair) solid var(--bg-3); border-radius: var(--r-1);
   color: var(--fg-3); font-family: var(--ff-body); font-size: var(--fs-micro);
 }
-.ds-247420 .ds-session-meta-copy:hover { background: var(--bg-3); color: var(--fg); }
-.ds-247420 .ds-session-meta-copy:focus-visible { outline: var(--focus-w) solid var(--focus-color); outline-offset: 1px; }
+.ds-247420 .ds-session-meta-copy:hover, .ds-247420 .ds-session-meta-action:hover { background: var(--bg-3); color: var(--fg); }
+.ds-247420 .ds-session-meta-copy:focus-visible, .ds-247420 .ds-session-meta-action:focus-visible { outline: var(--focus-w) solid var(--focus-color); outline-offset: 1px; }
 @media (pointer: coarse), (max-width: 640px) {
-  .ds-247420 .ds-session-meta-copy { min-height: 44px; min-width: 44px; }
+  .ds-247420 .ds-session-meta-copy, .ds-247420 .ds-session-meta-action { min-height: 44px; min-width: 44px; }
 }
 
 /* ============================================================================
@@ -7917,7 +7981,7 @@
 
 /* Live command-center: status-bucket groups + header breakdown + heartbeat. */
 .ds-247420 .ds-dash-group { display: flex; flex-direction: column; gap: var(--space-2); }
-.ds-247420 .ds-dash-group-label { font-size: var(--fs-tiny); font-weight: 600; text-transform: uppercase; letter-spacing: var(--tr-caps); color: var(--fg-3); padding: 0 var(--space-1); }
+.ds-247420 .ds-dash-group-label { font-size: var(--fs-tiny); font-weight: 600; text-transform: uppercase; letter-spacing: var(--tr-label); color: var(--fg-3); padding: 0 var(--space-1); }
 .ds-247420 .ds-dash-breakdown { display: flex; align-items: center; gap: var(--space-1); font-size: var(--fs-sm); color: var(--fg-2); }
 /* Shape-channel discs mirror the .status-dot-disc vocabulary (solid /
    solid+halo / hollow ring) so a colour-blind user can scan the breakdown by