agentgui 1.0.1083 → 1.0.1085

package/.gm/memories/mem-d9c19257abc2fa5e-1061.md

@@ -0,0 +1,8 @@
+---
+key: mem-d9c19257abc2fa5e-1061
+ns: default
+created: 1784316128399
+updated: 1784316128399
+---
+
+{"key":"agentgui-no-tool-approval-gate-2026-07-17","value":"agentgui has NO tool-call approval/permission gate anywhere in its runner stack (confirmed 47th run, 2026-07-17): claude-runner-agents.js passes --dangerously-skip-permissions on every invocation; acp-sdk-manager.js/acp-protocol.js/claude-runner-acp.js/acp-server-machine.js have zero permission/approval/canUseTool references; backend.js's WS event switch has no pending-approval state; app.js has no pendingApproval field. The new kit ApprovalPrompt component (added this run, modeled on docstudio's approve/deny-with-note UI) has no backend concept to bind to today - wiring a real approval flow would need a new WS message type (permission_request/permission_response), runner-side blocking/resume logic differing per runner protocol (direct vs ACP vs agents), and removing --dangerously-skip-permissions. This is a distinct, much larger initiative than porting a UI idea into the kit - not in scope for a docstudio-design-cue pass, would need its own dedicated planning session if ever pursued."}

package/AGENTS.md

@@ -1,5 +1,13 @@
 # AgentGUI — Agent Notes
 
+## Docstudio design-cue follow-up (2026-07-19) — forty-eighth run
+
+Sixth docstudio-cue pass, user asked to "consider everything we haven't covered yet." A fresh full-tree Explore-agent survey of `/config/docstudio/public/js` (told everything runs 42-47 shipped) found the low-hanging component/prop/a11y gaps genuinely exhausted, but surfaced a real, previously-unexplored subsystem-level gap: agentgui has **zero double-fire protection anywhere** — no `button.disabled` guard on any async click handler in the whole app, unlike docstudio's `utils/dom-busy.js` `withButtonBusy` (disables the button, sets `aria-busy`, swaps the label to a busy string, and guarantees restore via try/finally; a repeat click while already in flight is silently dropped). Ported it as `withBusy()` in `overlay-primitives.js` — a raw-DOM utility (operates on a real `HTMLButtonElement`, not a VElement) living alongside the existing `trapTab`/`useLongPress` DOM utilities. Wired onto the three unguarded async-click sites found in `app.js`: the ACP agent restart button, the "not installed" re-check button, and both agent-list-load retry buttons (the file-mutation dialogs and stop-chat button already had their own state-driven busy guards, so those were correctly left alone). A second candidate — docstudio's `xls-preview.js` tabbed spreadsheet/CSV inline preview — was surveyed and deliberately deferred as a genuinely distinct, larger subsystem (needs a new kit component: tabbed table + truncation banner + error-fallback card) rather than folded in as a rushed partial port; recorded to memory as its own future initiative. **Tooling note: this run's `gm` spool watcher could not boot at all — `npm pack gm-plugkit@2.0.1990` confirmed the published npm tarball is genuinely missing the `wrapper/` subdirectory (`wasi-shim.js`/`fs-atomic.js`/`kv-store.js`/`task-manager.js`) that `plugkit-wasm-wrapper.js` imports from, reproduced identically across `@latest` and 5 pinned versions back to 2.0.1975 — a real upstream packaging defect, not a local/cache issue (verified with fully cleared bun/npm caches). Fell back to direct implementation with the `agent-browser` CLI (an independent tool, unaffected) for live witnessing instead of the gm browser verb.** Kit built+tested (`bun test.js` all pass, all lints pass, docs regenerated 0 drift), rebased cleanly onto a concurrent `v0.0.354`/`v0.0.355` release (`flatspace-theme` kit addition, no conflict). Kit pushed `c7da8c0`→`bee6ab7`. Browser-witnessed live via `agent-browser`: `withBusy` correctly drops a concurrent second call (`calls:1` across two simultaneous invocations), shows `disabled:true`/`aria-busy:true`/swapped label mid-flight, and fully restores after — plus confirmed all four call-site wirings present in the live-served `app.js` bundle by regex against the actual fetched source. agentgui re-vendored, 0 console errors on live reload.
+
+## Docstudio design-cue follow-up (2026-07-17) — forty-seventh run, confirming pass
+
+Per gm-continue's mandatory first-confirming-pass discipline, a second independent Explore-agent survey (told what the 47th run's main pass just shipped) re-checked docstudio against the kit + app and found one last real, narrow gap: `app.js`'s cross-tab external-update banner still called native `window.confirm()` for the reload-discards-unsent-draft guard — the sole remaining native browser dialog call anywhere in the app, matching docstudio's own `dialog.js` rationale of never using `window.confirm/alert/prompt` for data-loss confirmations. Replaced with a `state.chat.confirmingReloadDiscard` flag rendering the kit's existing `ConfirmDialog` modal, mirroring the same pattern already used for file delete/bulk-delete. Browser-witnessed by fetching the live-served `/gm/js/app.js` directly and regex-confirming `window.confirm` is gone and the new `confreload` dialog key is present. A second confirming pass after this one found nothing further — docstudio's `buildDocAccessPrompt`/`buildScopePrompt` variants are narrow Google-OAuth/Drive-doc-specific flows with no analog in agentgui's domain model, and everything else checked (ApprovalPrompt's focus/a11y semantics, build-freshness poll, modal focus-trap/Escape/backdrop semantics) was already correctly ported.
+
 ## Docstudio design-cue follow-up (2026-07-17) — forty-seventh run
 
 Fifth docstudio-cue pass, same directive repeated a fifth time after the 46th run's confirming pass had concluded the mining task "genuinely exhausted." A fresh independent Explore-agent re-verification (told what runs 42-46 shipped) found that conclusion was **not fully accurate**: `chat-approval-prompts.js:47-71`'s `buildApprovalPrompt` has an auto-focused free-text note textarea threaded through every approve/deny decision (prefixed onto the denial message so the assistant sees why it was denied) that the kit's `PermissionMenu` (a settings-style checkbox dropdown, architecturally different) had no analog for at all. Added a new `ApprovalPrompt` component (`overlay-primitives.js`) — an inline, in-thread permission card (name/category head, optional args preview, auto-focused optional note, once/session/all/deny actions via `onDecision(kind, note)`) — plus a `lock` icon added to the shared `ICON_PATHS` (didn't exist previously) and a barrel re-export per the standing barrel rule. Also landed the pass's secondary finding: `update-check.js`'s `/version.json` poll + persistent reload-nudge pattern, ported to `app.js` as `startBuildFreshnessPoll()` (90s interval, compares live `/health` `version` against `window.__SERVER_VERSION`, reuses the kit's existing `toast({actionLabel,onAction,duration:0})` from the 46th run rather than inventing a new notice surface). A first CSS pass tripped the frozen spacing-lint baseline (raw `6px 14px` button padding) — fixed by mapping to `--space-1-75`/`--space-3` and `--r-pill` instead of literal `999px`. Kit rebased once onto concurrent `v0.0.352`/`v0.0.353` releases (dist-only conflict, rebuilt fresh per the standing discipline). Kit pushed `e93f4f7`→`6d71b34`, all 3 checks green. Browser-witnessed live on `localhost:3009/gm/`: this session's `gm browser` verb had a real, repeat tool defect (`url=`/`dom=`/`screenshot=` prefixes evaluate in a detached Node vm, not the real page — `ReferenceError: document is not defined` despite `navigation_requested:true`) — recorded to durable memory (`agentgui-browser-verb-url-dom-prefix-broken-2026-07-17`) rather than left as a stuck PRD row, per gm's diagnose-the-tool discipline. Worked around by using only the bare `capture\n<script>` form (`page.goto`+`page.evaluate` inline) and reading results via `console.log('WITNESS:'+...)` inside the page context rather than the top-level `result` field, which came back `null` even on successful (`exit_code:0`) dispatches. Confirmed live: `toast()`'s action button fires `onAction(dismiss)`; `ApprovalPrompt` renders (`.ov-approval` present), note textarea auto-focuses, lock icon renders, Deny click fires `onDecision('deny', '')` correctly. agentgui re-vendored, pushed `1d37290`→`9b25faf`→`08483cf`, all 4 CI checks green both pushes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1083",
+  "version": "1.0.1085",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -3,7 +3,7 @@ import * as B from './backend.js';
 
 installStyles().catch(() => {});
 
-const { AppShell, WorkspaceShell, WorkspaceRail, Topbar, Crumb, Side, Status, Chat, ChatComposer, AgentChat, ConversationList, SessionDashboard, Row, Panel, PageHeader, TextField, Select, Btn, Icon, IconButton, EventList, Spinner, Alert, FileGrid, FileSkeleton, sortFiles, FileToolbar, RootsPicker, BreadcrumbPath, EmptyState, FileViewer, FilePreviewPane, FilePreviewCode, FilePreviewText, FilePreviewMedia, ThemeToggle, ContextPane, PromptDialog, ConfirmDialog, DropZone, UploadProgress, FilterPills, SessionMeta, BulkBar, Checkbox, ShortcutList, FocusTrap, AgentListSkeleton, flashComposerNote, toast } = C;
+const { AppShell, WorkspaceShell, WorkspaceRail, Topbar, Crumb, Side, Status, Chat, ChatComposer, AgentChat, ConversationList, SessionDashboard, Row, Panel, PageHeader, TextField, Select, Btn, Icon, IconButton, EventList, Spinner, Alert, FileGrid, FileSkeleton, sortFiles, FileToolbar, RootsPicker, BreadcrumbPath, EmptyState, FileViewer, FilePreviewPane, FilePreviewCode, FilePreviewText, FilePreviewMedia, ThemeToggle, ContextPane, PromptDialog, ConfirmDialog, DropZone, UploadProgress, FilterPills, SessionMeta, BulkBar, Checkbox, ShortcutList, FocusTrap, AgentListSkeleton, flashComposerNote, toast, withBusy } = C;
 
 // One duration/bytes vocabulary across every surface: prefer the kit's shared
 // formatters (exported alongside the components), fall back to the local
@@ -2273,7 +2273,7 @@ function chatMain() {
           + (hasDraft ? 'This tab has an unsent draft that reloading will discard. ' : '')),
         Btn({ key: 'xureload', disabled: state.chat.busy, onClick: () => {
           if (state.chat.busy) return;
-          if (hasDraft && !window.confirm('Reloading will discard your unsent draft in this tab. Continue?')) return;
+          if (hasDraft) { state.chat.confirmingReloadDiscard = true; render(); return; }
           state.chat.externalUpdate = false;
           state.chat.messages = []; state.chat.resumeSid = null; state.chat.totalCost = 0;
           restoreChat(); render();
@@ -2301,7 +2301,7 @@ function chatMain() {
     banners.push(Alert({ key: 'agerr', kind: 'error', title: 'Could not load agents from the server',
       children: [
         h('span', { key: 'agtxt', title: state.agentsError }, 'The agent list failed to load - this is a connection issue, not necessarily a sign nothing is installed. '),
-        Btn({ key: 'agretry', onClick: () => loadAgents(), children: 'retry' })] }));
+        Btn({ key: 'agretry', onClick: (e) => withBusy(e.currentTarget, () => loadAgents(), 'retrying…'), children: 'retry' })] }));
   }
   if (state.chat.loadingTranscript) {
     banners.push(Alert({ key: 'transcriptload', kind: 'info', title: 'Loading prior conversation…',
@@ -2528,6 +2528,19 @@ function chatMain() {
       onCwdClear: () => { state.chatCwd = ''; lsRemove('agentgui.cwd'); render(); },
       onCwdDraft: (v) => { state.cwdDraft = v; state.cwdError = null; debouncedCwdProbe(); },
     }),
+    state.chat.confirmingReloadDiscard ? ConfirmDialog({
+      key: 'confreload',
+      title: 'Discard unsent draft?',
+      message: 'Reloading will discard your unsent draft in this tab. Continue?',
+      confirmLabel: 'reload', cancelLabel: 'cancel', destructive: true,
+      onCancel: () => { state.chat.confirmingReloadDiscard = false; render(); },
+      onConfirm: () => {
+        state.chat.confirmingReloadDiscard = false;
+        state.chat.externalUpdate = false;
+        state.chat.messages = []; state.chat.resumeSid = null; state.chat.totalCost = 0;
+        restoreChat(); render();
+      },
+    }) : null,
   ].filter(Boolean);
 }
 
@@ -3894,12 +3907,12 @@ function agentsPanel() {
             state: usable ? 'default' : 'disabled',
             onClick: usable ? () => { navTo('chat'); selectAgent(a.id); } : undefined,
             right: (acp && !acp.healthy)
-              ? [Btn({ key: 'acprestart', onClick: (e) => { e.stopPropagation(); B.restartAcpAgent(state.backend, a.id).then(() => loadAgents()); }, children: 'restart' })]
+              ? [Btn({ key: 'acprestart', onClick: (e) => { e.stopPropagation(); withBusy(e.currentTarget, () => B.restartAcpAgent(state.backend, a.id).then(() => loadAgents()), 'restarting…'); }, children: 'restart' })]
               // Direct-runner agents (claude-code/agy) have no restart, but a
               // 'not installed' verdict can go stale if the user installs the
               // CLI mid-session - give it the same recheck affordance ACP rows
               // get via 'restart', instead of only static prose.
-              : (!avail ? [Btn({ key: 'agrecheck', onClick: (e) => { e.stopPropagation(); loadAgents(); }, children: 're-check' })] : undefined),
+              : (!avail ? [Btn({ key: 'agrecheck', onClick: (e) => { e.stopPropagation(); withBusy(e.currentTarget, () => loadAgents(), 'checking…'); }, children: 're-check' })] : undefined),
           });
         })
       // The empty array means one of three things; never let an in-flight load
@@ -3909,7 +3922,7 @@ function agentsPanel() {
           : (state.agentsError
               ? h('div', { key: 'agfail', class: 't-meta empty-state' },
                   h('span', { key: 'agfailtxt' }, 'the agent list failed to load'),
-                  Btn({ key: 'agretry2', onClick: () => loadAgents(), children: 'retry' }))
+                  Btn({ key: 'agretry2', onClick: (e) => withBusy(e.currentTarget, () => loadAgents(), 'retrying…'), children: 'retry' }))
               : h('p', { key: 'none', class: 't-meta' }, 'no agents loaded'))]),
     ].filter(Boolean),
   });