agentgui 1.0.1089 → 1.0.1091

package/AGENTS.md

@@ -1,5 +1,9 @@
 # AgentGUI — Agent Notes
 
+## Docstudio design-cue follow-up (2026-07-23) — fiftieth run
+
+Eighth docstudio-cue pass. A fresh Explore-agent survey (told the full 49-run ported list) read every remaining unmined docstudio surface — admin-observability-{views,chart}.js, marketplace-{trending,card,flag}.js, documents/drive-picker.js, documents/file-upload.js, streaming/tts-player.js, thread-list-realtime.js, capture-page.js/capture-runner.js, and admin users/tags/archives/audit/moderation tabs — and came back near-exhausted: nearly everything was either already covered under a different name (docstudio's tts-player is *less* mature than the kit's own `voice.js`), pure business logic with no portable UI (drive-picker delegates to Google's native picker iframe; file-upload/thread-list-realtime have no render surface at all), or app-specific GCP wiring (the observability panels' Cloud Logging deep-links). One genuine, narrow gap survived: `admin-observability-views.js:132-161` `endpointsView()` color-codes percentile-latency/success-rate table cells (green >=99%, amber >=95%, red below) with no kit equivalent — `Table` had no notion of a value implying good/warn/bad. Ported the portable convention (not the GCP wiring) as `RateCell({value, tone})` in `design/src/components/data-density.js`, a plain tone-colored `<span>` over the existing `--success`/`--warn`/`--danger` tokens that drops into any `Table` cell, matching `Table`'s own onSort host-owns-the-logic convention (this component has no opinion on thresholds). While touching `data-density.js`, found and fixed a real, unrelated, previously-undiscovered gap: **its entire component set (`PhaseWalk`/`TreeNode`/`BarRow`/`StatTile`/`StatsGrid`/`SubGrid`/`SessionRow`/`DevRow`/`LiveLog`) was never wired into `src/components.js`'s barrel** — unreachable from the built bundle despite having real CSS in `data-density.css`, since before this run. Fixed by adding the barrel export line alongside the new `RateCell`. Kit built+tested (`bun test.js` all pass, 0 lint errors), docs regenerated (`docs/component-props.md`, 218 symbols, 0 drift). Kit pushed `72d88b6`, all 3 kit CI checks green (ci/Publish 247420 to npm/Deploy GH Pages). agentgui re-vendored both dist files; browser-witnessed live on `localhost:3009/gm/`: imported the live-served vendored bundle directly, confirmed `mod.components.RateCell`/`mod.components.StatTile` both callable, and mounted `RateCell({value:"UNIQ_99_4",tone:"good"})` into real DOM via `applyDiff` — rendered exactly `<span class="ds-rate-cell ds-rate-cell-good">UNIQ_99_4</span>`, confirming the CSS tone-class wiring works end-to-end live. **Real tooling defect diagnosed+fixed this run, not papered over**: mid-session, `browser` verb dispatches intermittently failed `"plugin gm not loaded"` — root-caused via `.gm/exec-spool/.watcher.log` to a **leftover stale `gm-plugkit` `supervisor.js` process** (pid alive since a prior session, `Jul19`) running independently alongside the healthy native `agentplug-runner` daemon, periodically trying to respawn the watcher via the *retired* JS `plugkit-wasm-wrapper.js` path (`Cannot find module './wrapper/wasi-shim.js'` — the exact historically-resolved npm-packaging defect from the 48th run, recurring here via a stale cached supervisor rather than a fresh regression) and crash-looping. A separately-wedged long-lived Chrome process for the agentgui project profile (alive since `Jul17`) was also found wedging evals to 60s timeouts. Killed both stale processes, rebooted a fresh daemon (`bun x gm-plugkit@latest spool`) — confirmed fixed via two clean subsequent dispatches, no further crash-loop lines. **Also newly confirmed: writing a spool verb input file under a task-number that collides with an existing `out/<verb>-<N>.json` from an earlier turn in the same session silently returns the STALE cached output instead of running the fresh dispatch** — the watcher appears to treat a pre-existing out-file as already-satisfied and skip reprocessing. Always pick a task number confirmed absent from `out/` (e.g. jump to a clearly-unused block like 100+) rather than trusting sequential same-session numbering, especially after a long session with many prior dispatches.
+
 ## Docstudio design-cue follow-up (2026-07-23) — forty-ninth run
 
 Seventh docstudio-cue pass, same directive repeated once more ("consider everything we haven't covered yet"). A fresh Explore-agent survey read every file in `/config/docstudio/public/js` (33 files not previously examined, including admin-observability, marketplace, drive-picker, file-upload, tts-player, thread-list-realtime, capture-page) against both the kit and the "already ported" list built up over 48 prior runs. Verdict: genuinely exhausted — the only survivor was the long-deferred `documents/xls-preview.js` tabbed spreadsheet/CSV inline preview, twice previously deferred across runs 48/47 as "a future initiative" without ever being detailed. Per the standing rule against documenting instead of implementing reachable work, specced and shipped it this run: new `design/src/components/spreadsheet-preview.js` `SpreadsheetPreview({workbook, activeSheet, onSheetChange, maxRows, maxCols, truncated, loading, error, errorActionLabel, onErrorAction})` — the kit does no parsing (no SheetJS dependency; host hands over an already-parsed `{sheetNames, sheets}` shape), renders a `role=tablist` sheet-switcher, a sticky-header `table.ds-sheet-preview-table` with `.num`-aligned numeric cells, and a persistent (non-hiding) truncation banner; loading/error states reuse the existing `Skeleton`/`Alert` primitives rather than inventing new visual language. Barrel-exported through `src/components.js` per the standing barrel rule. CSS landed in `src/css/app-shell/kits-appended.css` (tab underline uses the same neutral-at-rest/accent-only-on-active-state pattern as `Table`'s sortable headers). Kit built+tested (`bun test.js` all pass), docs regenerated (`docs/component-props.md`, 206 symbols, 0 drift). Kit pushed `3535f0a`, all 3 kit CI checks green (ci/Publish 247420 to npm/Deploy GH Pages). agentgui re-vendored both dist files; browser-witnessed live on `localhost:3009/gm/` (this sandboxed env has no display, so `.gm/browser-config.json` gained `{"headless":true}` — a real, durable per-project config need, not a one-off workaround): imported the live-served vendored bundle directly (`mod.components.SpreadsheetPreview`, not a top-level export — components live under a `components` namespace on the built ESM bundle), rendered all 5 states (loading/error/loaded/truncated/empty) without throwing, and mounted the truncated state into real DOM via `applyDiff` — confirmed a real `table.ds-sheet-preview-table` with 499 correctly-clamped body rows (`maxRows` default 500) plus a visible banner reading the accurate row count. agentgui pushed `35c5b77`→`4f0789a` (a PRD-state-only follow-up commit), all 4 CI checks green both pushes (Test/Auto-Declaudeify/Publish-and-Release/Deploy-GH-Pages). **Session-start tooling note: this run's `gm` spool watcher was stale (status.json `ts` ~4 days old, `busy_until` long past) — a plain `bun x gm-plugkit@latest spool` reboot recovered it cleanly, distinct from the 48th run's actual npm-packaging outage (which the watcher now reports as resolved: it boots via the native `agentplug-runner` daemon path, not the retired JS wasm-host wrapper the 48th run's blocker was about — that stale PRD row was resolved this run). A separate transient `"plugin gm not loaded"` error recurred a handful of times mid-session on both `browser` and `prd-add`/`prd-resolve` dispatches with no discernible trigger; a bare identical re-dispatch cleared it every time observed (not yet root-caused, but not a hard blocker either — recorded here rather than as a `blockedBy:external` PRD row since it never actually blocked forward progress, only cost a retry).** **Also confirmed: this repo's checked-out branch (`fix/ws-baseurl-on-main`) is not literally named `main` but IS main's true linear continuation — `git fetch origin main` showed `origin/main` HEAD exactly matched this branch's parent commit before any push, so `git_push {branch:"main"}` (explicit override of the git_finalize verb's default same-name-branch push, which the verb correctly refused since branch name != "main") was the correct, safe action, not a deviation.**

package/lib/ws-handlers-util.js

@@ -2,7 +2,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 import crypto from 'crypto';
-import { execSync, spawnSync } from 'child_process';
+import { execSync, spawnSync, execFile } from 'child_process';
 import { runClaudeWithStreaming } from './claude-runner-run.js';
 import { registry } from './claude-runner-agents.js';
 import { confineToRoots, fsAllowRoots } from './http-handler.js';
@@ -10,6 +10,49 @@ import { restart as restartAcpAgent } from './acp-sdk-manager.js';
 
 function err(code, message) { const e = new Error(message); e.code = code; throw e; }
 
+// Promisified execFile — array-args form only, never a shell string, so a
+// crafted branch/path/file value cannot be interpreted as a shell command.
+function execFileP(cmd, args, opts) {
+  return new Promise((resolve, reject) => {
+    execFile(cmd, args, { encoding: 'utf-8', timeout: 30000, maxBuffer: 20 * 1024 * 1024, ...opts }, (e, stdout, stderr) => {
+      if (e) { e.stdout = stdout; e.stderr = stderr; reject(e); return; }
+      resolve({ stdout, stderr });
+    });
+  });
+}
+
+// Resolve + confine a client-supplied cwd to the same allowlist the file
+// explorer / chat.sendMessage use (fsAllowRoots via confineToRoots). Falls
+// back to STARTUP_CWD (itself an allowed root) when no cwd is given.
+function resolveGitCwd(p, STARTUP_CWD) {
+  if (!p?.cwd) return STARTUP_CWD;
+  const conf = confineToRoots(p.cwd, fsAllowRoots());
+  if (!conf.ok) err(conf.reason === 'not found' ? 400 : 403, `cwd outside allowed roots: ${p.cwd}`);
+  return conf.realPath;
+}
+
+// A relative in-repo file path: no leading '-' (flag injection), no shell
+// metacharacters, no absolute path (git resolves it relative to cwd already).
+const SAFE_REL_PATH_RE = /^[^\0]{1,4096}$/;
+function assertSafeRelPath(v, label) {
+  if (typeof v !== 'string' || !v.length) err(400, `${label} required`);
+  if (v.startsWith('-')) err(400, `${label} must not start with '-'`);
+  if (/[\0]/.test(v)) err(400, `${label} contains invalid characters`);
+  if (!SAFE_REL_PATH_RE.test(v)) err(400, `${label} invalid`);
+  return v;
+}
+
+// A git branch/ref name — conservative allowlist (git's own ref-format is
+// more permissive, but this blocks every shell-metacharacter and flag-
+// injection vector while still covering normal branch names).
+const SAFE_BRANCH_RE = /^[A-Za-z0-9][A-Za-z0-9_.\/-]{0,199}$/;
+function assertSafeBranch(v, label) {
+  if (typeof v !== 'string' || !v.length) err(400, `${label} required`);
+  if (v.startsWith('-') || v.includes('..') || v.includes('//')) err(400, `${label} invalid`);
+  if (!SAFE_BRANCH_RE.test(v)) err(400, `${label} invalid`);
+  return v;
+}
+
 const SUB_AGENT_MAP = {
   'opencode': [{ id: 'gm-oc', name: 'GM OpenCode' }], 'cli-opencode': [{ id: 'gm-oc', name: 'GM OpenCode' }],
   'gemini': [{ id: 'gm-gc', name: 'GM Gemini' }], 'cli-gemini': [{ id: 'gm-gc', name: 'GM Gemini' }],
@@ -281,6 +324,84 @@ export function register(router, deps) {
     } catch (e) { err(500, e.message); }
   });
 
+  // --- git.diff: unified diff for a single file or the whole working tree.
+  // p.cwd (optional) is confined via confineToRoots/fsAllowRoots, same as
+  // chat.sendMessage; p.file (optional) is validated to reject flags/shell
+  // metacharacters. execFile array-args form only, never a shell string.
+  router.handle('git.diff', async (p) => {
+    const cwd = resolveGitCwd(p, STARTUP_CWD);
+    const args = ['diff', '--no-color'];
+    if (p?.staged) args.push('--staged');
+    if (p?.file) args.push('--', assertSafeRelPath(p.file, 'file'));
+    try {
+      const { stdout } = await execFileP('git', args, { cwd });
+      return { diff: stdout, file: p?.file || null, staged: !!p?.staged };
+    } catch (e) { err(500, (e.stderr || e.message || 'git diff failed').trim()); }
+  });
+
+  // --- git.log: recent commit list, limit param (default 20, capped 200).
+  router.handle('git.log', async (p) => {
+    const cwd = resolveGitCwd(p, STARTUP_CWD);
+    const limit = Math.max(1, Math.min(200, parseInt(p?.limit, 10) || 20));
+    const FIELD_SEP = '\x1f';
+    const REC_SEP = '\x1e';
+    const args = ['log', `-n${limit}`, `--pretty=format:%H${FIELD_SEP}%an${FIELD_SEP}%ad${FIELD_SEP}%s${REC_SEP}`, '--date=iso-strict'];
+    try {
+      const { stdout } = await execFileP('git', args, { cwd });
+      const commits = stdout.split(REC_SEP).map(s => s.trim()).filter(Boolean).map(rec => {
+        const [hash, author, date, ...rest] = rec.split(FIELD_SEP);
+        return { hash, author, date, subject: rest.join(FIELD_SEP) };
+      });
+      return { commits };
+    } catch (e) { err(500, (e.stderr || e.message || 'git log failed').trim()); }
+  });
+
+  // --- worktree.list / create / remove ---
+  router.handle('worktree.list', async (p) => {
+    const cwd = resolveGitCwd(p, STARTUP_CWD);
+    try {
+      const { stdout } = await execFileP('git', ['worktree', 'list', '--porcelain'], { cwd });
+      // Parse the porcelain block format: records separated by blank lines,
+      // each line "key value" or a bare flag ("bare", "detached", "locked").
+      const worktrees = [];
+      let cur = null;
+      for (const line of stdout.split('\n')) {
+        if (!line.trim()) { if (cur) { worktrees.push(cur); cur = null; } continue; }
+        if (!cur) cur = {};
+        const sp = line.indexOf(' ');
+        if (sp === -1) { cur[line] = true; continue; }
+        cur[line.slice(0, sp)] = line.slice(sp + 1);
+      }
+      if (cur) worktrees.push(cur);
+      return { worktrees: worktrees.map(w => ({ path: w.worktree || null, head: w.HEAD || null, branch: w.branch || null, bare: !!w.bare, detached: !!w.detached, locked: !!w.locked })) };
+    } catch (e) { err(500, (e.stderr || e.message || 'git worktree list failed').trim()); }
+  });
+
+  router.handle('worktree.create', async (p) => {
+    const cwd = resolveGitCwd(p, STARTUP_CWD);
+    const wtPath = assertSafeRelPath(p?.path, 'path');
+    const args = ['worktree', 'add'];
+    if (p?.newBranch) { args.push('-b', assertSafeBranch(p.newBranch, 'newBranch')); }
+    args.push(wtPath);
+    if (p?.branch) args.push(assertSafeBranch(p.branch, 'branch'));
+    try {
+      const { stdout, stderr } = await execFileP('git', args, { cwd });
+      return { ok: true, output: (stdout || stderr || '').trim(), path: wtPath };
+    } catch (e) { err(500, (e.stderr || e.message || 'git worktree add failed').trim()); }
+  });
+
+  router.handle('worktree.remove', async (p) => {
+    const cwd = resolveGitCwd(p, STARTUP_CWD);
+    const wtPath = assertSafeRelPath(p?.path, 'path');
+    const args = ['worktree', 'remove'];
+    if (p?.force) args.push('--force');
+    args.push(wtPath);
+    try {
+      const { stdout, stderr } = await execFileP('git', args, { cwd });
+      return { ok: true, output: (stdout || stderr || '').trim() };
+    } catch (e) { err(500, (e.stderr || e.message || 'git worktree remove failed').trim()); }
+  });
+
   router.handle('auth.configs', () => getProviderConfigs());
 
   router.handle('auth.save', (p) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.1089",
+  "version": "1.0.1091",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -43,6 +43,10 @@ const state = {
   activeTimer: null,
   eventsLimit: 300,   // how many of the most-recent events to render; grows via "load older"
   files: { path: '', segments: [], entries: [], roots: [], loading: false, error: null, preview: null, sort: 'name', sortDir: 'asc', filter: '' },
+  // Minimal git/worktree panel state. The richer visual component
+  // (GitDiffView/WorktreeSwitcher) lives in anentrypoint-design; this is a
+  // plain list/text render until the vendored SDK bundle picks those up.
+  git: { loading: false, error: null, diff: '', commits: [], worktrees: [], file: '' },
 };
 
 // Two-step arm controls auto-reset after this delay so an accidental first click
@@ -641,6 +645,8 @@ function view() {
     crumbLeaf = 'files';
   } else if (state.tab === 'live') {
     crumbLeaf = 'live · ' + ((state.active && state.active.length) || 0);
+  } else if (state.tab === 'git') {
+    crumbLeaf = 'git';
   } else if (state.tab === 'settings') {
     // Same word as the rail item - location chrome must not fork vocabulary.
     crumbLeaf = 'settings';
@@ -725,6 +731,7 @@ function workspaceRail() {
     { key: 'history', label: 'History', icon: 'thread', active: state.tab === 'history', onClick: () => navTo('history') },
     { key: 'files', label: 'Files', icon: 'folder', active: state.tab === 'files', onClick: () => navTo('files') },
     { key: 'live', label: 'Live', icon: 'activity', active: state.tab === 'live', count: liveCount || null, rail: liveHasError ? 'flame' : undefined, onClick: () => navTo('live') },
+    { key: 'git', label: 'Git', icon: 'branch', active: state.tab === 'git', onClick: () => navTo('git') },
     { key: 'settings', label: 'Settings', icon: 'settings', active: state.tab === 'settings', onClick: () => navTo('settings') },
   ];
   return WorkspaceRail({
@@ -928,9 +935,76 @@ function mainContent() {
   if (state.tab === 'history') return historyMain();
   if (state.tab === 'files')   return filesMain();
   if (state.tab === 'live')    return liveMain();
+  if (state.tab === 'git')     return gitMain();
   return settingsMain();
 }
 
+// --- git (diff/log + worktree list) ---
+// Minimal panel: loads git.log + worktree.list on entry, git.diff on demand.
+// A richer visual component (GitDiffView/WorktreeSwitcher) is being built in
+// anentrypoint-design in parallel; swap this for those exports once the
+// vendored SDK bundle (site/app/vendor/anentrypoint-design) is rebuilt to
+// include them - it does not yet (checked: no GitDiffView/WorktreeSwitcher
+// in the vendored 247420.js as of this change).
+async function loadGitPanel() {
+  state.git.loading = true; state.git.error = null; render();
+  try {
+    const [commits, worktrees] = await Promise.all([
+      B.gitLog(state.backend, { limit: 20 }),
+      B.worktreeList(state.backend, {}),
+    ]);
+    state.git.commits = commits;
+    state.git.worktrees = worktrees;
+  } catch (e) {
+    state.git.error = e.message || 'Could not load git status.';
+  }
+  state.git.loading = false; render();
+}
+
+async function loadGitDiff(file) {
+  state.git.diffLoading = true; state.git.diffError = null; render();
+  try {
+    const { diff } = await B.gitDiff(state.backend, { file: file || undefined });
+    state.git.diff = diff || '(no changes)';
+    state.git.file = file || '';
+  } catch (e) {
+    state.git.diffError = e.message || 'Could not load diff.';
+  }
+  state.git.diffLoading = false; render();
+}
+
+function gitMain() {
+  if (!state.git.loading && !state.git.commits.length && !state.git.worktrees.length && !state.git.error) loadGitPanel();
+  const g = state.git;
+  return [
+    PageHeader({ compact: true, dense: true, title: 'Git', lede: 'Working-tree diff, recent commits, and worktrees.' }),
+    g.error ? Alert({ key: 'git-err', kind: 'error', title: 'Git error', children: g.error }) : null,
+    Row({ key: 'git-actions', children: [
+      Btn({ key: 'refresh', onClick: () => loadGitPanel(), children: g.loading ? 'loading…' : 'refresh' }),
+      Btn({ key: 'diff-all', onClick: () => loadGitDiff(''), children: g.diffLoading ? 'loading diff…' : 'load full diff' }),
+    ] }),
+    Panel({ id: 'git-diff', title: g.file ? ('diff: ' + g.file) : 'diff', children:
+      g.diffError ? h('p', { key: 'de', class: 't-meta field-error' }, g.diffError)
+      : h('pre', { key: 'dp', class: 'git-diff-pre' }, g.diff || '(no diff loaded)') }),
+    Panel({ id: 'git-log', title: 'recent commits', children:
+      !g.commits.length ? h('p', { key: 'nc', class: 't-meta' }, g.loading ? 'loading…' : 'no commits')
+      : h('ul', { key: 'cl', class: 'git-commit-list' }, g.commits.map(c =>
+          h('li', { key: c.hash }, [
+            h('code', { key: 'h' }, (c.hash || '').slice(0, 8)),
+            ' ' + (c.subject || ''),
+            h('span', { key: 'm', class: 't-meta' }, ' — ' + (c.author || '') + ' · ' + (c.date || '')),
+            Btn({ key: 'view', small: true, onClick: () => loadGitDiff(''), children: 'view' }),
+          ]))) }),
+    Panel({ id: 'git-worktrees', title: 'worktrees', children:
+      !g.worktrees.length ? h('p', { key: 'nw', class: 't-meta' }, g.loading ? 'loading…' : 'no worktrees')
+      : h('ul', { key: 'wl', class: 'git-worktree-list' }, g.worktrees.map((w, i) =>
+          h('li', { key: w.path || i }, [
+            h('code', { key: 'p' }, w.path || ''),
+            ' ' + (w.branch || (w.detached ? '(detached)' : '')),
+          ]))) }),
+  ];
+}
+
 // --- files (folder browser) ---
 async function loadDir(dirPath, { fromHash = false } = {}) {
   state.files = state.files || {};

package/site/app/js/backend.js

@@ -428,6 +428,30 @@ export async function listAgentModels(base, agentId) {
   } catch { return []; }
 }
 
+// ---------- Git / worktrees (WS) ----------
+
+export async function gitDiff(base, { cwd, file, staged } = {}) {
+  return wsCall(base, 'git.diff', { cwd, file, staged });
+}
+
+export async function gitLog(base, { cwd, limit } = {}) {
+  const { commits } = await wsCall(base, 'git.log', { cwd, limit });
+  return commits || [];
+}
+
+export async function worktreeList(base, { cwd } = {}) {
+  const { worktrees } = await wsCall(base, 'worktree.list', { cwd });
+  return worktrees || [];
+}
+
+export async function worktreeCreate(base, { cwd, path, branch, newBranch } = {}) {
+  return wsCall(base, 'worktree.create', { cwd, path, branch, newBranch });
+}
+
+export async function worktreeRemove(base, { cwd, path, force } = {}) {
+  return wsCall(base, 'worktree.remove', { cwd, path, force });
+}
+
 // ---------- Streaming chat (WS) ----------
 //
 // Yields events of shape:

package/site/app/vendor/anentrypoint-design/247420.css

@@ -4967,6 +4967,16 @@
 .ds-247420 .ds-stat-val.err-rate { font-size: clamp(24px, 7cqi, 32px); color: var(--warn); }
 .ds-247420 .ds-stat-lbl { font-size: var(--fs-micro); color: var(--fg-3); margin-top: 2px; }
 
+/* RateCell — tone-colored numeric table cell (success-rate / percentile-latency
+   columns), ported from docstudio's endpointsView() success-rate coloring.
+   Neutral at rest; color carries meaning only, matching Table's sortable-header
+   restraint pattern. */
+.ds-247420 .ds-rate-cell { font-variant-numeric: tabular-nums; font-weight: 600; }
+.ds-247420 .ds-rate-cell-neutral { color: var(--fg-2); font-weight: 400; }
+.ds-247420 .ds-rate-cell-good { color: var(--success); }
+.ds-247420 .ds-rate-cell-warn { color: var(--warn); }
+.ds-247420 .ds-rate-cell-bad { color: var(--danger); }
+
 /* Inline row — flex row with centered items and a small gap, for demo/kit
    markup that needs to lay siblings out horizontally without an inline style. */
 .ds-247420 .ds-inline-row { display: flex; align-items: center; gap: var(--space-2, 8px); }