agentgui 1.0.1116 → 1.0.1117

package/.gm/memories/mem-a95b1d49d71133ce-1007.md

@@ -1,8 +0,0 @@
----
-key: mem-a95b1d49d71133ce-1007
-ns: default
-created: 1781859394641
-updated: 1781859394641
----
-
-agentgui 17th run (2026-06-19): two-pass GUI quality sweep. Pass 1: A1-A11 app.js + K1-K10 kit fixes (SVG XSS, CORS wildcard, tool_result array flatten, absIdx-was-already-fixed-here-actually, stable event keys, empty turn prune, ACP panel, TextField error, restartCount, clearLocalData ds.ws.*, aria-invalid, WorksList aria-expanded, drawer [role=button], textarea overflow:hidden, role=banner removed, aria-atomic, formatShortcut ASCII, ws-crumb padding, ws-desktop-toggle 44px). Pass 2: gui-audit workflow wf_bcac251f-d54 (48 agents, 25 confirmed). Key fixes: absIdx ReferenceError crash (history blank), Prism new Function blocked by CSP fixed with script injection + Promise.all tiers, scrollChatToBottom forced layout in rAF removed, sessions drawer <=640 fixed to <=1100, thinking blocks dispatched to ThinkingNode, rail all-green bug, clearLocalData nav reset, liveTick self-clears, kit-* selector removed, Esc listener leak. validate-mutations 29/29; test.js 10/0. agentgui b9d66cc; design 03d9d07.

package/.gm/memories/mem-a9968a186368b022-1150.md

@@ -1,8 +0,0 @@
----
-key: mem-a9968a186368b022-1150
-ns: default
-created: 1784300690988
-updated: 1784300690988
----
-
-agentgui 46th run confirming pass (2026-07-17): per gm-continue's mandatory first-confirming-pass discipline, a second independent Explore-agent survey of docstudio (told what runs 42-46 already shipped) found one more narrow gap: kit toast() only supported self-dismissing {message,kind,duration}, unlike docstudio update-check.js:18-30's persistent click-to-reload bar. Added actionLabel/onAction props rendering a non-auto-dismissing button. Real CI catch: docs/component-props.md was stale after the new toast() signature (component-docs lint), fixed by regenerating. Kit rebased twice onto concurrent v0.0.350/v0.0.351 releases (dist-only, rebuilt fresh). Browser-witnessed both toast variants live: action toast renders .ds-ep-toast.has-action with working button firing onAction(dismiss); plain toast unaffected (no has-action class, no button) confirming backward compat. Kit pushed b5530cb->e93f4f7, agentgui pushed ed36a36->3a59c3b, all CI green. A second confirming pass after this one found nothing further - the docstudio design-cue mining task for ../design and ./ is genuinely exhausted after 4 full sweeps + 1 confirming-pass finding.

package/.gm/memories/mem-aaeae38d8eb01809-1076.md

@@ -1,8 +0,0 @@
----
-key: mem-aaeae38d8eb01809-1076
-ns: default
-created: 1783083889386
-updated: 1783083889386
----
-
-gm-method lesson: when a component is deliberately kept mounted across multiple tabs/views for visual consistency (a 'keep-track' pattern - same rail/list shown regardless of active tab so the layout doesn't reflow), audit every interaction the component exposes on every tab it appears on, not just the tab where the interaction was originally designed. A very common latent bug: the interaction's effect is only rendered by ONE of the tabs (e.g. a selection list whose selection is only visualized on tab A), so triggering it from tabs B/C/D silently updates state with no visible effect - a dead click that looks identical to a working one. This is a distinct failure mode from a visual/CSS bug: it can't be caught by screenshots alone, only by reading application state before/after the interaction (e.g. via an exposed window.* state object) on each tab the shared component appears on. Fix pattern: the non-primary tabs' handler should navigate to the tab that renders the effect, so the interaction produces a consistent, visible outcome everywhere the control appears.

package/.gm/memories/mem-ade01d9c02677c55-1557.md

@@ -1,8 +0,0 @@
----
-key: mem-ade01d9c02677c55-1557
-ns: default
-created: 1783699218939
-updated: 1783699218939
----
-
-{"key":"agentgui-36th-run-ai-tell-sweep","value":"agentgui 36th run (2026-07-10): follow-on AI-tell sweep after the 35th run. gui-ai-tell-sweep workflow wf_a53b7d8f-27b (26 agents, 5 hunt lenses, 20 findings -> 11 confirmed / 9 correctly refuted). Kit fixes: context-menu/toast shadow -> --shadow-overlay token; barchart/upload/bar meter fills --accent -> --fg-3 (routine metering shouldnt use the loudest brand hue); checkbox checked-fill -> --fg; drag-over triple-accent-stack (tint+border+ring) collapsed to single dashed border; skip-to-main link de-loudened from CTA-accent to neutral fg/bg; session-unread dot neutralized off --accent; dead .empty-state child rules + unused .ds-panel-trio/.ds-panel-grid hover-lift deleted; AgentChat empty-state copy de-boilerplated. App: keyboardPanel/preferencesPanel gained kind:wide for settings panel-weight hierarchy. Browser-witnessed live (0 pageErrors, CSS rules confirmed post-fix). Kit pushed 4de1771, agentgui pushed e6dc1d9, CI green both repos. IMPORTANT recurring tool-defect: gm-plugkit fs_write verb payload key is content (JSON string), NOT body -- passing {path,body:{...}} silently no-ops with bytes:0 and no error. This nearly let a stale-empty .ci-validated marker pass the COMPLETE gate this run; caught via recall mid-VERIFY (the memory already existed from a prior run) and corrected before transitioning to COMPLETE. Always use content, verify bytes>0 in the fs_write response, and spot-check the actual file content on disk before trusting a CONSOLIDATE/COMPLETE gate that depends on it."}

package/.gm/memories/mem-b06b8c85b81663e6-1250.md

@@ -1,8 +0,0 @@
----
-key: mem-b06b8c85b81663e6-1250
-ns: default
-created: 1783071795100
-updated: 1783071795100
----
-
-agentgui 27th run (2026-07-03): negative-space + attention sweep, scoped to the specific user ask (not a full agent fan-out) - live-browser review via screenshots + DOM measurement at 1280px and 420px across chat/files/settings. Found+fixed 2 real issues. Files filter placeholder text was wider than its intentionally-compact 220px input, clipping the last character with no ellipsis - shortened the placeholder rather than widening the control (the compact width was a deliberate prior design decision documented in the kit's own CSS comment). Settings SERVER panel rendered 4 short facts each as an oversized fs-xl/tall-line-height intro-paragraph style ('.lede') instead of a metadata style, creating real dead vertical space and visual inconsistency with the adjacent roots list (which already used a compact metadata-strip component) - consolidated all facts into that same compact component. GM-METHOD LESSON: for a narrowly-scoped ask (e.g. 'any negative space/attention issues'), a live-browser screenshot-and-measure pass targeted at the specific concern finds real, fixable issues faster and more precisely than another full multi-agent workflow fan-out - match investigation scale to the ask's scale, not the project's total surface area.

package/.gm/memories/mem-b451e5e17e555202-1490.md

@@ -1,8 +0,0 @@
----
-key: mem-b451e5e17e555202-1490
-ns: default
-created: 1784294096167
-updated: 1784294096167
----
-
-agentgui 39th run (2026-07-12) full detail: gui-logic-predictability workflow wf_88c431e5-931 (26 agents, 202 tool calls) - 6 confirmed findings. App: runningPanel() rows gained runningRowTitle() resolved-identity prefix; stopActiveChat() gained a bounded 9s timeout to clear a stuck 'stopping' state + retry banner; computeLiveSessions() SSE tally now accumulates total_cost_usd alongside tokens; WorkspaceRail footer gained a visible shortcuts-help IconButton (the ?-overlay was 100% keyboard-only tribal knowledge before). Kit: CodeNode.refSink gained the same in-progress-text-selection guard MdNode.refSink already had; Row.sub gained a title= tooltip fallback for string values; added a help icon path to ICON_PATHS/Glyph. Kit rebased on concurrent v0.0.316, pushed 00dae4c; agentgui pushed 64f4466, all CI green. Browser-witnessed live via page.context().setHTTPCredentials()+page.evaluate(): help button in .ws-rail-foot opens shortcuts overlay, 0 pageErrors; Row.sub title attr confirmed live. Tool-defect notes from this run: (1) this env's nginx Basic-Auth password contains a literal comma (123,slam,123,slam) and embedding it directly in page.goto URL throws net::ERR_INVALID_AUTH_CREDENTIALS even percent-encoded - fix is page.context().setHTTPCredentials() before goto with a plain URL; (2) capture-prefix browser scripts run in a bare Node vm with no document/page binding unless the script itself calls page.evaluate(()=>{...}) - wrap every DOM read/write in page.evaluate.

package/.gm/memories/mem-b64ad00dcb6f909e-937.md

@@ -1,8 +0,0 @@
----
-key: mem-b64ad00dcb6f909e-937
-ns: default
-created: 1784315675131
-updated: 1784315675131
----
-
-{"key":"agentgui-browser-verb-url-dom-prefix-broken-2026-07-17","value":"gm browser verb tool defect (47th agentgui run, 2026-07-17): url=/dom= prefix dispatches evaluate in a Node vm context (ReferenceError: document/window is not defined) despite navigation_requested:true; screenshot= prefix mis-parses its own argument as JS (SyntaxError Unexpected token). Only the bare 'capture\\n<script with page.goto+page.evaluate>' dispatch form actually reaches real page context this session (confirmed working in browser-3/-13/-14 dispatches). Read the result via console.log('WITNESS:'+JSON.stringify(...)) inside the page.evaluate callback and grep the debug.console array in the response - the top-level result field itself came back None/undefined across multiple working dispatches even when exit_code:0/ok:true, so it is not a reliable read path this session. External tool defect (gm-plugkit/playwriter), not fixable from this repo."}

package/.gm/memories/mem-b7d6018ceca55b6f-2220.md

@@ -1,8 +0,0 @@
----
-key: mem-b7d6018ceca55b6f-2220
-ns: default
-created: 1783683288478
-updated: 1783683288478
----
-
-{"key":"agentgui-32nd-run-ux-craft-sweep","value":"agentgui 32nd run (2026-07-10): gui-ux-craft workflow wf_0225607d-511 (35 agents, 22 confirmed) on user request to max usability/predictability/negative-space via wfgy-method critique. Fixes across app.js (2 misapplied .lede->t-meta typography instances in running-sessions banner + file-preview loading; copy-tone unification Clear conversation/Message failed/lowercase announce/ascii->unicode ellipsis; untitled-conversation fallback replacing raw sid slices in both sessionsColumn and resumeSidLabel; loadSession reselect no-op guard; loadDir _reqId race-guard against bulk-mutation reconcile races) and kit design/ (btn-primary unwarranted tr-caps tracking removed; lh-snug hardcoded-fallback drift fixed to bare var(); ghost/danger hover unified brightness(0.92) darkening across text+icon variants, was brightness(1.1) lightening which failed AA on light theme; focus-ring hardcoded values replaced with --focus-w/--focus-color/--focus-offset tokens; pre .n numeral color routed through --code-num instead of AA-failing --green-2; community.css 4 text usages of --green-2 swapped to --green; colors_and_type.css [data-theme=paper] --amber drift (#8A6512) fixed to match root (#7C570F); chat.js MdNode streaming markdown reparse now throttled (120ms/40char) instead of reparsing full accumulated text every rAF tick; ToolCallNode args/result JSON.stringify now cached by identity; onAction signature variance documented in COMPONENT_API.md; new ui_kits/workspace/ flagship demo for WorkspaceShell+ConversationList+AgentChat+SessionDashboard combo). Kit rebuilt via node scripts/build.mjs and re-vendored into agentgui site/app/vendor/. Browser-witnessed live via agent-browser against localhost:3010/gm/ (PASSWORD=full comma-containing string, not comma-split): 0 console errors, computed btn-primary letter-spacing=normal, live stylesheet query confirmed focus-ring/hover/numeral-color rules match source. Kit pushed ad000b6, agentgui pushed 5ccaa8a, all CI green both repos. Standing gotcha reconfirmed: PASSWORD env var can itself contain literal commas (e.g. '123,slam,123,slam') - treat the whole string as one token, never comma-split it when testing auth."}

package/.gm/memories/mem-bdf466854032cac9-1509.md

@@ -1,8 +0,0 @@
----
-key: mem-bdf466854032cac9-1509
-ns: default
-created: 1782996174769
-updated: 1782996174769
----
-
-agentgui 22nd run (2026-07-02): GUI ux-craft sweep. gui-ux-craft workflow wf_48cd6bae-6ae (35 agents, 20 confirmed). Kit (../design): accent-on-paper contrast fix - var(--accent) lime was used as TEXT color and non-text FILL in 10 sites (chat role label, dashboard status/stream/select/breakdown text, code-copy text, tool-running status, live status dot, green session-rail fill), rendering ~1.07:1 contrast on paper theme (WCAG needs 4.5:1/3:1); swapped all to --accent-ink, borders/outlines left on --accent. 4 typography-rhythm fixes (dash-title/ContextPane-meta-sub/session-group-label sizing parity with kit-wide defaults, .ws-crumb height derived from --app-crumb-h). Session-head search-input 36px height match, .ds-file-act focus-visible ring added. App: 5 copy-tone fixes (clear-history button noun, conversation->chat vocab, npx jargon->plain language, raw provider error truncated+prefixed, disabled export-chat keeps action label), search-result sid fallback to 'session <8char>...', synchronous theme-flash-prevention inline script in index.html (reads 247420:theme from localStorage before first paint, non-module so it runs before the kit's ES module graph loads). Deferred as explicit re-scope (recorded not dropped): kit README/ui_kits docs gaps for flagship components, perceived-performance work (render-gating, modulepreload, loading skeletons) - both larger-scope work for a dedicated future run. Kit pushed 3f50e7a, agentgui pushed 06f108d, both CI green, 28/28 tests, 0 console errors.

package/.gm/memories/mem-c0482039e6ab4c50-2047.md

@@ -1,8 +0,0 @@
----
-key: mem-c0482039e6ab4c50-2047
-ns: default
-created: 1780661156914
-updated: 1780661156914
----
-
-agentgui GUI-predictability sweep (2026-06-05) CLOSED. 19 PRD rows fixed+pushed: agentgui fe94ade, kit anentrypoint-design 236d6ef (publish.yml -> npm/unpkg). KIT fixes (override-elimination - the app no longer !important-overrides these): app-shell.css .app-topbar nav a.active = tinted pill + accent underline default (was oversized filled oval); PageHeader gained `compact` prop + .ds-section-compact (margin-top:0) so a page-leading header top-aligns; .row[role=button]/a.row cursor:pointer default; Chat component dropped the decorative empty head .dot; chat.js ToolCallNode renders '(no output)' for done+empty tool; chat.js added safeUrl() rejecting javascript:/data:/file: in renderInline link + image part(src+href) + link part (inline renderer bypasses DOMPurify); streaming text uses .chat-md container (mdShell flag) to avoid settle reflow. APP fixes (app.js): distinct keys for 3 backend-status <p> (were key:'bst'), per-sessionId running-panel dot key (was 'rd'), refreshHistory clears stale selectedSid when session vanishes, live.eventCount resets per session in loadSession, toolLabel falls back to first scalar arg, expand/collapse-all relabeled 'expand/collapse shown', runSearch clears projectFilter on search start, 3 PageHeaders pass compact:true; index.html dropped the Topbar/PageHeader/chat-head-dot/row-cursor overrides. KEY: kit dist/ is gitignored on remote now but files are already TRACKED - use git add -f for rebuilt dist; rebase-and-rebuild-dist when remote advances (CI/other writer pushes to kit main often). Browser-witnessed live /gm/ (sessions 2-7): hasAgentChat, composer, empty state+3 suggestions, settings compact margin 0px, search a11y name, 0 console errors, decorativeGlyphs=[], kept middot intact, active-tab underline boxShadow rgb(58,154,52) 0px -2px. GLYPH POLICY: a reviewer wrongly flagged middot/ellipsis/em-dash as forbidden - they are the KEPT set, never convert. .claude/workflows/gui-audit.js refreshed: added 'overrides' surface + KEPT-SET guard in glyph reviewer AND adversarial verifier.

package/.gm/memories/mem-c4aaec5c4e6f80c2-920.md

@@ -1,8 +0,0 @@
----
-key: mem-c4aaec5c4e6f80c2-920
-ns: default
-created: 1783884935543
-updated: 1783884935543
----
-
-{"key":"agentgui-ds-load-local-vendor-detail","value":"agentgui DS (design kit) loading: index.html loads the DS kit from local ./vendor/anentrypoint-design/247420.{js,css}, NOT unpkg. Prior 'moved to unpkg @latest' note (2026-05-29) was a transient state reverted in eb1eab3 (re-vendored with AgentChat), witnessed loading from ./vendor/ again on the 2026-06-04/06-05 runs and reconfirmed live on the 37th (2026-07-12) and 40th (2026-07-12) runs via live network-trace browser dispatch. The vendored copy IS the shipped UI - predictable, no upstream-publish drift. Update flow: edit the kit at /config/workspace/design, node scripts/build.mjs, copy dist/247420.{js,css} into site/app/vendor/anentrypoint-design/, browser-witness, then push the kit so unpkg stays in sync for other consumers. The markdown stack (marked/dompurify/prismjs) still fetches from jsdelivr on first chat render, unaffected by this vendoring."}

package/.gm/memories/mem-c66976ddacb4fbe8-1454.md

@@ -1,8 +0,0 @@
----
-key: mem-c66976ddacb4fbe8-1454
-ns: default
-created: 1784816791841
-updated: 1784816791841
----
-
-agentgui AGENTS.md changelog drain (compressed 2026-07-23): AGENTS.md previously carried ~50 dated run-by-run sections (docstudio-cue follow-up runs 42-51, GUI sweeps 7-41, design-maturity/dead-code/security sweeps 13-20) narrating what was surveyed/found/shipped each session with commit shas and CI check names. Compressed to present-tense standing rules only. Docstudio-cue ports across runs 42-51: RateCell (tone-colored table cell), SpreadsheetPreview (tabbed CSV/workbook preview), withBusy (async double-fire guard), ApprovalPrompt (inline permission card w/ note textarea), PermissionMenu (roving-tabindex checkbox menu), CountdownDialog, detectAttachment badge, streamingSince elapsed counter, coarse-pointer Enter-gating, toast actionLabel/onAction, aria-live chat threads, Chip.onRemove. GUI sweeps 7-41 landed hundreds of findings across logic/predictability, cohesion, completion, ux-craft, AI-tell removal, screen-real-estate, Claude-Code-web parity -- realtime status truth, escape-ladder consistency, file management CRUD, live session dashboards, accessibility, kit additions (SplitPanel sidePanel, sortable Table, SessionDashboard, ConversationList, WorkspaceShell/WorkspaceRail). Design-maturity sweeps 13-20 consolidated all GUI/styling into the design kit and removed dead lib/plugins scaffolding. Full narrative detail for any specific run is recoverable from git history (agentgui repo AGENTS.md file history) if ever needed again.

package/.gm/memories/mem-c7c5bc263850c332-1844.md

@@ -1,8 +0,0 @@
----
-key: mem-c7c5bc263850c332-1844
-ns: default
-created: 1783854998213
-updated: 1783854998213
----
-
-agentgui 38th run (2026-07-12): re-ran gui-logic-predictability workflow wf_186e2a2a-dfc (32 agents) one cycle after the 37th run, 18 confirmed findings all implemented. Key app fixes: stopAllActive now clears failed sids from state.live.stopping (was permanently stuck), copyText announces clipboard failures, title-fallback chains unified via projectLabel()+sid across search/history/rail, Live nav-badge stale-flame fixed via stream carve-out, computeLiveSessions gained a 5s reconnect grace window against status flapping, streamHistory EventSource gained exponential backoff mirroring the WS client. Kit fixes: follow-up chips lost aria-hidden (real buttons were AT-invisible), MdNode markdown-settle now preserves active text selection via a deferred selectionchange-gated innerHTML swap, SearchInput gained a visible clear button + working resultCount aria-live wiring. Kit pushed bed4036 (after a rebase with one dist-only conflict, resolved by rebuilding dist fresh rather than hand-merging generated code), agentgui pushed 159030f then b9d9d70 (docs), all CI green both repos. NEW STANDING TOOL DEFECT this run: the gm browser verb's dom= and capture prefixes both throw ReferenceError (no document/page binding at all) in this tool version - a regression beyond the previously-known 'dom= ignores trailing script' issue. Only screenshot= and url=<target>\n<literal-non-DOM-expr> dispatches actually reach the real page; browser session ids silently rotate across dispatches with no state carryover, and one dispatch hit a dead extension-bridge session requiring an unprompted CDP relay restart. Filed as PRD row tool-defect-browser-dom-capture-eval-broken with blockedBy:external since it's a gm-plugkit/playwriter defect, not fixable from agentgui/design repos. Screenshots remain the reliable witness fallback until fixed upstream.

package/.gm/memories/mem-cda639547932c796-713.md

@@ -1,8 +0,0 @@
----
-key: mem-cda639547932c796-713
-ns: default
-created: 1783077061618
-updated: 1783077061618
----
-
-gm-method lesson: when a user says a shipped UI 'looks very diy' and asks for negative-space/attention polish, a live-browser screenshot audit at multiple viewport widths (desktop + mobile) plus DOM measurement (getBoundingClientRect, computed style) finds concrete, high-confidence issues faster than a broad multi-agent design-review fan-out — reserve the heavier fan-out for first-pass sweeps of a surface, and use the targeted live-witness method for narrow follow-up asks on an already-audited surface. Screenshots alone can miss a few-dozen-pixel layout bug (a drawer sliver, a clipped ellipsis); pairing every visual observation with a DOM measurement removes ambiguity before deciding it's worth fixing.

package/.gm/memories/mem-cdf04ff6a6a0aa6f-671.md

@@ -1,8 +0,0 @@
----
-key: mem-cdf04ff6a6a0aa6f-671
-ns: default
-created: 1783844901564
-updated: 1783844901564
----
-
-agentgui webjsx applyDiff array-keying rule: children arrays that mix keyed VElements with raw text/numbers crash in vendor/webjsx/applyDiff.js with 'Cannot read properties of undefined (reading key)'. webjsx requires ALL siblings in an array prop (children, right, left, breadcrumbs, etc.) to either ALL be VElements with keys or ALL be non-keyed - passing Crumb({right:[h('span',{key:'a'},'A'), h('span',{key:'b'},'B'), 'connected']}) crashes because the render loop tries to read .key on the bare string. Fix: wrap any bare strings as keyed VElements, e.g. h('span',{key:'dot'},'connected'). Surfaced 2026-05-04 in crumbRight construction in site/app/js/app.js view().

package/.gm/memories/mem-cf8472c84d9e04c4-1883.md

@@ -1,8 +0,0 @@
----
-key: mem-cf8472c84d9e04c4-1883
-ns: default
-created: 1783075515986
-updated: 1783075515986
----
-
-agentgui 28th run (2026-07-03): visual-polish pass responding to explicit user feedback that the GUI 'looks very diy'. Live-browser screenshot audit (not a full agent fan-out - matched investigation scale to the ask) found 3 concrete causes. (1) One shell column (sessions) used flat background identical to main content while sibling columns (rail, pane) already used a recessed tonal background for depth - the inconsistency read as one flat continuous surface instead of distinct panels; fixed by matching the established pattern. (2) The primary input control (chat composer) had zero elevation/shadow at rest despite the design system already defining an unused shadow token for exactly this purpose - a flat box on a flat background is one of the most common 'looks unfinished' tells. (3) A tab that opted out of the shell's standard content padding (for its own custom centering behavior) had nothing replacing that padding for its OTHER child elements (toolbar/heading/empty-state), so those elements sat flush against the viewport edge with zero breathing room while a sibling chrome bar above kept proper padding - a real, visible inconsistency. GM-METHOD LESSON: when investigating a vague 'make it look nicer' style complaint, use live screenshots + DOM measurement (getBoundingClientRect, computed styles) to find OBJECTIVE inconsistencies against the design system's own already-established patterns (a token defined but unused, a treatment applied to siblings but not this element, a padding removed with nothing substituted) rather than subjective aesthetic judgment - this converts a vague complaint into concrete, defensible, low-risk fixes. Also: distinguish a real CI regression from a known infra flake (GitHub Pages deploy 'Deployment cancelled') by checking whether the SAME flake pattern recurred before - rerun once and wait patiently rather than escalating.

package/.gm/memories/mem-cfd4d894370c63c3-1288.md

@@ -1,8 +0,0 @@
----
-key: mem-cfd4d894370c63c3-1288
-ns: default
-created: 1784299896638
-updated: 1784299896638
----
-
-agentgui-44th-run-docstudio-followup-full-detail: follow-up to 43rd run's docstudio design-cue pass. Fresh research agent surveyed docstudio source vs current kit (told what already existed). 5 candidates implemented: ChatMessage error/onRetry inline destructive-toned per-turn failure notice (chat.js); generic Avatar({name,src,fallback,size}) primitive in content.js consolidating duplicated letter-fallback-disc logic; FileSkeleton gained role=status/aria-busy/aria-label matching sibling skeletons. Verified no-change-needed: backdrop-dismiss dialogs already did strict e.target===e.currentTarget check. Real bug from mandatory browser witness: AgentChat's error/onRetry wiring was gated on !isAssistant but agentgui's sendChat() always pushes an eager assistant placeholder, so the gate was corrected to key on trailing-message-position instead of role; separately a stray closing brace from removing a redundant Alert banner caused a real SyntaxError blanking the live page, caught on first post-deploy witness dispatch, fixed, re-witnessed clean. Standing lesson: a same-session "verify no change needed" pass is not a substitute for re-running the live browser witness on code that WAS changed. Kit pushed 3417592->f362528->03c9028->17ee86c, agentgui pushed f08f698, all CI green.

package/.gm/memories/mem-d060480435f92eec-1146.md

@@ -1,8 +0,0 @@
----
-key: mem-d060480435f92eec-1146
-ns: default
-created: 1782994689573
-updated: 1782994689573
----
-
-agentgui 20th run (2026-06-20): destructive quality run. Found lib/plugins/acp-plugin.js was a SECOND redundant ACP manager, eager-spawning all 4 ACP tools at boot on conflicting/mismatched ports (gemini=18101/kilo=18102/codex=18103 vs canonical acp-sdk-manager opencode=18100/kilo=18101/codex=18102), no restart/health logic despite a /api/acp/status route promising 'restarts', and crashed server boot with [FATAL] Uncaught exception: Executable not found in $PATH when an ACP binary was missing. Route consumed by nobody; no plugin declared an acp dependency. Deleted the file. Rule: ACP lifecycle lives in lib/acp-sdk-manager.js alone. Also: spawn() for a missing binary surfaces ENOENT as an async 'error' event under Bun (escapes sync try/catch) - acp-sdk-manager.js startProcess was the only spawn() callsite missing a proc.on('error') handler (terminal.js/claude-runner-direct.js/gm-agent-configs.js/claude-runner-acp.js already had one); added it, routing into CRASHED + scheduleRestart backoff. Witnessed: clean boot (0 FATAL), acp no longer in [PLUGINS] Loaded extensions, /api/acp/status -> 404, tests 46/46, browser 0 console errors.

package/.gm/memories/mem-d347c921b79e6d44-1099.md

@@ -1,8 +0,0 @@
----
-key: mem-d347c921b79e6d44-1099
-ns: default
-created: 1781769905189
-updated: 1781769905189
----
-
-agentgui auth fix (2026-06-18, commit 534324e): behind an nginx auth_basic proxy (boxone.off.l-inc.co.za/gm), the page HTML/JS/CSS loaded but every app fetch (/gm/health, /gm/v1/history/sessions, /api/*) returned 401 and the browser re-prompted for the Basic password. Root cause: site/app/js/backend.js authedFetch set Authorization: Bearer <window.__WS_TOKEN>, which OVERWRITES the browser cached Authorization: Basic creds; nginx auth_basic only accepts Basic so the Bearer fetch is rejected at the proxy before reaching agentgui. The WS survived because it auths via ?token= query on an auth_basic-off path. Fix: authedFetch now uses withToken(url) (?token= query, like WS/EventSource/image/download) + credentials:'same-origin', never overriding Authorization. Rule: same-origin app auth must never use the Authorization header when an upstream proxy owns Basic auth. boxone runs agentgui from a git checkout at the repo package.json version (1.0.928, NOT npm latest 1.0.968), so the fix reaches it via git pull + service restart. nginx gmweb htpasswd user is 'abc', PASSWORD=123,slam,123,slam.

package/.gm/memories/mem-d3c8ea6c861bfbb8-1457.md

@@ -1,8 +0,0 @@
----
-key: mem-d3c8ea6c861bfbb8-1457
-ns: default
-created: 1783006020323
-updated: 1783006020323
----
-
-agentgui 26th run (2026-07-02): per-row file move + lint tooling fix. Kit FileRow gains 'move' action (arrow-right icon, between rename/delete). App onAction('move', file) seeds state.files.marked with the single path, opens existing bulk-move dialog, reuses runBulkMove/api/move - no new server surface. Fixed a real bug in the design kit's scripts/lint-null-children.mjs: bracket-matcher didn't understand // line comments, so an apostrophe inside ANY comment anywhere in a scanned file was read as opening a string literal, corrupting bracket-depth tracking for the rest of that file (false positive here, potential false negative elsewhere hiding a real missing .filter(Boolean)). Added stripLineComments() before the scan. GM-METHOD LESSON (CI): GitHub Pages Deploy workflow repeatedly failed with 'Deployment cancelled'/'Timeout reached' - caused by rapid successive gh run rerun calls racing each other for the same commit SHA's deployment slot, made WORSE not better by retrying quickly. Fix: trigger once (gh run rerun, or gh workflow run <name> --ref main for a fresh dispatch if reruns keep reusing a wedged deployment id) and wait with ZERO concurrent interference - both agentgui and design repos' deploys succeeded the moment reruns stopped racing. Distinguish this from a real regression: npm publish/Publish-and-Release (actual consumer artifacts) were green from the first attempt every time, only the docs-site GH Pages deploy step flaked.

package/.gm/memories/mem-d5e928c552cd87f9-214.md

@@ -1,10 +0,0 @@
----
-key: mem-d5e928c552cd87f9-214
-ns: default
-created: 1781783461615
-updated: 1781783461615
----
-
-## Resolved mutable: kit-repo-head-clean
-
-git -C /config/workspace/design status --porcelain = empty; git log -1 --oneline = 1aa7926 feat(design): app-surfaces.css owns all consumer-app styling + 13th-run findings.

package/.gm/memories/mem-d63bc3b8a0269844-406.md

@@ -1,10 +0,0 @@
----
-key: mem-d63bc3b8a0269844-406
-ns: default
-created: 1781783460280
-updated: 1781783460280
----
-
-## Resolved mutable: residue-extent
-
-grep: site/theme.mjs:143 is the single remaining inline <style>html,body{...background:var(--app-bg,#FBF6EB);color:var(--ink,#1F1B16);font-family:var(--ff-ui,...)}</style> with hardcoded hex; grep -c '<style' site/app/index.html = 0; grep -rn 'style=' site/app/js/ = empty (app.js agentgui- hits are kit utility CLASS names, not CSS). Only real residue = theme.mjs:143.

package/.gm/memories/mem-d9c19257abc2fa5e-1061.md

@@ -1,8 +0,0 @@
----
-key: mem-d9c19257abc2fa5e-1061
-ns: default
-created: 1784316128399
-updated: 1784316128399
----
-
-{"key":"agentgui-no-tool-approval-gate-2026-07-17","value":"agentgui has NO tool-call approval/permission gate anywhere in its runner stack (confirmed 47th run, 2026-07-17): claude-runner-agents.js passes --dangerously-skip-permissions on every invocation; acp-sdk-manager.js/acp-protocol.js/claude-runner-acp.js/acp-server-machine.js have zero permission/approval/canUseTool references; backend.js's WS event switch has no pending-approval state; app.js has no pendingApproval field. The new kit ApprovalPrompt component (added this run, modeled on docstudio's approve/deny-with-note UI) has no backend concept to bind to today - wiring a real approval flow would need a new WS message type (permission_request/permission_response), runner-side blocking/resume logic differing per runner protocol (direct vs ACP vs agents), and removing --dangerously-skip-permissions. This is a distinct, much larger initiative than porting a UI idea into the kit - not in scope for a docstudio-design-cue pass, would need its own dedicated planning session if ever pursued."}

package/.gm/memories/mem-d9f26358a7cd3bb8-866.md

@@ -1,8 +0,0 @@
----
-key: mem-d9f26358a7cd3bb8-866
-ns: default
-created: 1780598014254
-updated: 1780598014254
----
-
-agentgui GUI (2026-06-04 audit): chat now renders STRUCTURED tool cards - app.js sendChat emits toolPart()/applyToolResult() -> {kind:'tool',name,label,args,result,status,_id}; kit AgentChat (agent-chat.js) passes structured {kind,...} m.parts through to ChatMessage.renderPart (only bare strings wrapped as text) so kit ToolCallNode renders. AgentChat gained: empty state (.agentchat-empty, suggestions/onSuggestionClick), composer stop (busy+onCancel), working tail (.agentchat-working). Multi-turn resume: server ws-handlers-util onEvent broadcasts streaming_session{claudeSessionId:parsed.session_id}; backend.js yields {type:'session'}; app.js sets state.chat.resumeSid (claude-code only). index.html now loads kit from LOCAL ./vendor/anentrypoint-design (re-vendored for predictability+offline, NOT unpkg). GUI audit workflow at .claude/workflows/gui-audit.js.

package/.gm/memories/mem-da1c91acf63d81d3-863.md

@@ -1,8 +0,0 @@
----
-key: mem-da1c91acf63d81d3-863
-ns: default
-created: 1782996680472
-updated: 1782996680472
----
-
-agentgui 23rd run (2026-07-02): GUI perceived-performance sweep, small targeted run landing the 22nd run's deferred findings. index.html modulepreloads marked/dompurify ESM CDN modules (was preconnect-only) so the fetch starts in parallel instead of waiting for markdown.js's dynamic import on first chat response. Settings server panel shows 'checking...' instead of 'unknown' during the first health probe (state.healthChecking flag around recheckHealth's await). Settings agents panel shows 'agents · loading...' instead of literal 'agents · 0/0 installed' during initial fetch. Still deferred as its own PRD row: first-render network-gating (shell paints nothing between boot-splash and health-probe completion) - needs a render-architecture change bigger than a targeted fix. No kit changes this run. Pushed agentgui 6a045ba, 28/28 tests, 0 console errors.

package/.gm/memories/mem-dc1ac3b04d22317e-664.md

@@ -1,8 +0,0 @@
----
-key: mem-dc1ac3b04d22317e-664
-ns: default
-created: 1783680441733
-updated: 1783680441733
----
-
-{"key":"gm-fs-write-verb-payload-key-is-content-not-body","value":"The gm-plugkit fs_write verb's payload key is 'content' (a JSON-string), NOT 'body' - passing {path,body:{...}} silently no-ops and reports bytes:0 with no error, which stalls the CONSOLIDATE->COMPLETE CI-validation gate since .ci-validated never actually lands on disk. Always dispatch fs_write as {\"path\":...,\"content\":\"<string>\"} (JSON.stringify any object payload first). Discovered independently in agentgui's 32nd run and design/dashboard-kit's own CONSOLIDATE passes on the same day - a recurring plugkit gotcha worth checking for on every fs_write dispatch, not just .ci-validated."}

package/.gm/memories/mem-dceeae20bc56d407-711.md

@@ -1,8 +0,0 @@
----
-key: mem-dceeae20bc56d407-711
-ns: default
-created: 1781191154143
-updated: 1781191154143
----
-
-Browser-witnessing agentgui on this linux container: plugkit chromium needs --no-sandbox (written to /etc/chromium.d/no-sandbox, the Debian launcher sources it). The browser verb body is 'timeout=NNNNN\n<raw playwright JS>' (max 50000ms; globals page/state); the body passes through a shell so NEVER use $(...) or backticks - use page.locator(). page.goto with domcontentloaded/networkidle HANGS (CDN subresources never resolve here) - use waitUntil:'commit' + waitForSelector. A goto to the same URL with only a hash change does NOT reload the bundle; use page.reload() after re-vendoring. Server: bun server.js, PASSWORD in .env is '123,slam,123,slam', app at localhost:3000/gm/?token=... (token URL-encoded).

package/.gm/memories/mem-dd98b21c0896dc04-1557.md

@@ -1,8 +0,0 @@
----
-key: mem-dd98b21c0896dc04-1557
-ns: default
-created: 1783699262524
-updated: 1783699262524
----
-
-{"key":"agentgui-26th-run-file-move-lint-fix","value":"agentgui 26th run (2026-07-02): per-row file move + lint tooling fix. Landed gui-completion #0: single-file move previously required checkbox-select + BulkBar. Kit FileRow gains a move action (between rename/delete, arrow-right icon); app onAction(move,file) seeds state.files.marked with just that one path and opens the existing bulk-move dialog, reusing runBulkMove/api/move as-is - no new dialog kind, no new server surface. Also fixed a real bug in ../design scripts/lint-null-children.mjs: its bracket-matcher did not understand // line comments, so an apostrophe inside ANY comment anywhere in a scanned file (e.g. the kit's own) was read as opening a string literal, silently corrupting bracket-depth tracking for the rest of that file - a false positive here, but potentially a false NEGATIVE elsewhere (hiding a real missing .filter(Boolean) behind an unrelated apostrophe earlier in the file). Added stripLineComments() (string-literal-aware) run before the scan; verified by reintroducing the apostrophe and confirming it now lints clean. CI note: Deploy GH Pages repeatedly failed with Deployment cancelled / Timeout reached, aborting! across this run and the 25th - GitHub Pages deployment API appears to self-cancel when a rerun is triggered while a prior attempt for the same commit SHA is still settling (rapid successive gh run rerun calls made this worse, not better). Fix: dont rerun repeatedly in quick succession - trigger once and wait it out with zero concurrent interference."}

package/.gm/memories/mem-df74674eec7745ac-178.md

@@ -1,10 +0,0 @@
----
-key: mem-df74674eec7745ac-178
-ns: default
-created: 1781788748592
-updated: 1781788748592
----
-
-## Resolved mutable: live-page-baseline
-
-browser-2: /gm/?token render ready=complete, hasShell=true, bodyBg=rgb(19,19,24) kit-painted, resizers=3, hScroll=false, consoleErrors=[]

package/.gm/memories/mem-dfe3b466fd5d1199-802.md

@@ -1,8 +0,0 @@
----
-key: mem-dfe3b466fd5d1199-802
-ns: default
-created: 1780041529708
-updated: 1780041529708
----
-
-agentgui SECURITY: the direct agent runner (lib/claude-runner-direct.js) must spawn with shell:false against a resolved binary path (resolveBinaryPath in lib/claude-runner.js), NEVER shell:true. shell:true on Windows concatenates argv without escaping, so a user prompt containing & | > or backticks executes as shell commands (proven: prompt "hi & echo X > f.txt" created f.txt). getSpawnOptions now only defaults shell:true when the caller does not pass an explicit shell option; the direct runner passes shell:false. resolveBinaryPath returns the command unchanged for .cmd/.bat shims (which need a shell) so npx-style launchers still work, but claude-code and agy resolve to real .exe and spawn shell-free. Verified: claude-code still outputs normally, metachar prompts create no side-effect files.

package/.gm/memories/mem-e0f9286aed2d5a06-1116.md

@@ -1,8 +0,0 @@
----
-key: mem-e0f9286aed2d5a06-1116
-ns: default
-created: 1780558587460
-updated: 1780558587460
----
-
-agentgui+anentrypoint-design kit Row (src/components/content.js): renders a leading status RAIL from a `rail` prop (green|purple|flame, via .row.rail-<tone>::before driving the existing ::before bar) and accepts `rank` as an alias for the leading `code` index. state:'disabled' Row is INERT (no onClick/role=button/tabstop, aria-disabled=true). BEFORE 2026-06-04 Row dropped both rail+rank silently so agentgui's color rails and leading numbers were invisible. agentgui passes rail+rank at history sessions/search-results/agents-panel; rail semantics are consistent: green=selected/ok, purple=subagent, flame=error/unavailable. Kit changes reach the live GUI only after publish.yml -> npm -> unpkg @latest (agentgui index.html imports the kit from unpkg, not vendored). Build kit dist with `node scripts/build.mjs` (lint-glyphs+lint-tokens gates run); commit SOURCE only (dist/ is gitignored, CI rebuilds). To witness kit changes locally, serve dist over http (file:// import is origin-blocked) and import 247420.js. Witnessed 2026-06-04: green rail rgb(58,154,52), flame rgb(255,90,31), rank->.code, disabled inert.

package/.gm/memories/mem-e1950b064099b7be-1895.md

@@ -1,8 +0,0 @@
----
-key: mem-e1950b064099b7be-1895
-ns: default
-created: 1780667383196
-updated: 1780667383196
----
-
-agentgui Claude-Desktop redesign (2026-06-05, 4th max-effort run): app moved from Topbar-tabs to a three-column WorkspaceShell (new kit shell.js: WorkspaceShell{rail,sessions,main,pane,crumb,status,narrow}+WorkspaceRail, .ws-* CSS in app-shell.css, collapse persisted localStorage ds.ws.{rail,pane}, mobile<900px fixed rail+overlay drawers). New surfaces: kit ConversationList (sessions.js .ds-session*) conversation rail shared by chat+history (select->resumeInChat on chat, loadSession on history; sessions load on chat-entry+boot); Files view = server /api/list + /api/file (lib/http-handler.js, allowlist-confined STARTUP_CWD/CLAUDE_PROJECTS_DIR/FS_ROOTS via normalize+resolved-prefix like /api/image, 403 outside) + backend.js listDir/readFile + app.js filesMain (kit BreadcrumbPath+FileGrid+FileViewer preview, 'use as chat cwd'); kit SessionDashboard/SessionCard (.ds-dash*) Live dashboard from state.active (3s chat.active poll) per-session Stop/Open/Resume/events; kit ContextPane (context-pane.js .ds-context*) right pane on chat. WEBJSX KEYING CLASS-BUG (load-bearing): mixing keyed VElements with null/strings in any children array crashes applyDiff 'reading key' - fixed ConversationList (stable keyed body wrapper + .filter(Boolean) rows) + app.js runningPanel (all children keyed); refreshHistory render() moved OUT of try (render exception no longer masquerades as history fetch error). Workflow deliverable .claude/workflows/gui-overhaul.js (8 designers->feasibility/policy review->build plan, distinct from gui-audit.js). Witnessed live /gm/: shell+rail[Chat,History,Files,Live,Settings]+4 session rows+agentchat+contextpane, files 60 rows+breadcrumb+preview, live dashboard, settings theme toggle, decorativeGlyphs=[], 0 console errors, /api/file win.ini->403. Kit lint-glyphs+lint-tokens pass; dist vendored to site/app/vendor. Push pending (github DNS unreachable this env).

package/.gm/memories/mem-e1d5431ae2542872-961.md

@@ -1,8 +0,0 @@
----
-key: mem-e1d5431ae2542872-961
-ns: default
-created: 1781864613149
-updated: 1781864613149
----
-
-agentgui 15th run (2026-06-18): design-maturity + dead-code + server-hardening. gui-design-15 (wf_7ba315a1-9a9, 8 lenses, 59->33 applied) + gui-design-15b (wf_5b2861b2-717, 3 lenses, 25->18). ~95 agents ~4M tokens. Kit: chat.css(10 rules), app-shell.css(10), colors_and_type.css(4), app-surfaces.css, editor-primitives.css focus-visible, chat.js ToolCallNode copy, files.js skeleton+roving-radiogroup+emptyAction, sessions.js cost emphasis, shell.js WS_RESIZE_CLAMP. NEW: ShortcutList export, Row.detail prop. Dead-code: static/ (webjsx+xstate), scripts/build-rippleui.mjs, scripts/copy-vendor.js removed. Server: terminal fail-closed (PASSWORD+ENABLE_TERMINAL=1), fsAllowRoots cwd-gated, CSRF JSON-only+Origin==Host, constant-time SHA-256 token compare, confineToRoots for chat cwd, cookie Secure+Max-Age, TRUST_PROXY rate-limit, CSP nonce (no unsafe-inline), agents.models via getModelsForAgent. validate-mutations 26/26; kit all lints pass; 0 console errors.

package/.gm/memories/mem-e490a181de6469fc-487.md

@@ -1,8 +0,0 @@
----
-key: mem-e490a181de6469fc-487
-ns: default
-created: 1783843022402
-updated: 1783843022402
----
-
-CORRECTION (37th run, 2026-07-12): agentgui's live index.html loads the design kit from LOCAL ./vendor/anentrypoint-design/247420.{css,js}, NOT unpkg. Witnessed directly on https://buildesk.acc.l-inc.co.za/gm/ via browser dom= query. An older memory record (mem-1780593485911-5-718) claiming unpkg @latest is STALE - it described a transient state that was reverted; AGENTS.md's 'DS load = LOCAL vendor' section is correct and current. Trust this record over the unpkg one going forward.

package/.gm/memories/mem-e72c6efbb27326fb-392.md

@@ -1,8 +0,0 @@
----
-key: mem-e72c6efbb27326fb-392
-ns: default
-created: 1783690636206
-updated: 1783690636206
----
-
-agentgui-33rd-run-drained-detail: (already fully covered by the existing 'agentgui 33rd run ux-craft sweep' rs-learn entry; this is a pointer confirming AGENTS.md was compressed to a one-liner on 2026-07-10 during the 34th run's doc-drain pass, full substance unchanged in rs-learn - kit pushed 4105bd1, agentgui pushed 3bac0fe, standing lesson about barrel re-export for new kit components).

package/.gm/memories/mem-e943b58115a02b4c-593.md

@@ -1,8 +0,0 @@
----
-key: mem-e943b58115a02b4c-593
-ns: default
-created: 1780598017287
-updated: 1780598017287
----
-
-agentgui SECURITY (2026-06-04, lib/http-handler.js): /api/image is confined to an allowlist root (CLAUDE_PROJECTS_DIR, os.homedir(), IMAGE_ROOTS env) via normalized prefix match - previously an arbitrary-file-read because the includes('..') guard is a no-op after path.normalize resolves segments. CORS: Access-Control-Allow-Origin '*' is now ONLY emitted when PASSWORD is unset; when PASSWORD set, ACAO is omitted (same-origin only) unless CORS_ORIGIN reflects an explicit origin (with Vary:Origin). Witnessed live: C:/Windows/win.ini.png->403, C:/Users/user/...png->404 (passed confinement).

package/.gm/memories/mem-e9bc5f9ed6edbcf7-1580.md

@@ -1,8 +0,0 @@
----
-key: mem-e9bc5f9ed6edbcf7-1580
-ns: default
-created: 1784300703197
-updated: 1784300703197
----
-
-agentgui-45th-run-docstudio-full-detail: third docstudio design-cue pass, same directive repeated. Fresh Explore-agent survey (told what 43rd/44th runs already shipped) found 5 new gaps, all implemented in the design kit: ChatComposer/AgentChat streamingSince prop -> role=status tabular-nums elapsed counter next to stop control while streaming (docstudio chat-input.js:71-96), self-ticking via interval keyed off passed timestamp; Enter-to-send gated behind module-cached matchMedia('(pointer:coarse)') check (chat-input.js:116-125) - coarse-pointer devices get a newline+"Tap Send to send" hint instead; CountdownDialog({title,message,seconds,onExpire,actions}) primitive in files-modals.js (docstudio google-reconnect.js:41-75's live sign-out countdown), composing over the existing Modal()/Backdrop() shell rather than editor-primitives.js's standalone Dialog; PermissionMenu({categories,approved,onToggle,onToggleAll}) in overlay-primitives.js (docstudio tool-approval-panel.js's roving-tabindex menuitemcheckbox list); ChatComposer detectAttachment(text)=>{type,label,id}|null prop rendering a dismissible .chat-composer-detected-badge (chat-input.js:49-62's pasted-URL sniff). Implementation delegated to a background worktree agent; bun test.js 38/38 pass, 0 lint errors across 7 lints. Concurrent upstream v0.0.344/v0.0.345 (RTL support) landed mid-pass, rebased cleanly, dist rebuilt fresh. Kit pushed 5c0571e->1d46202. agentgui re-vendored, browser-witnessed (bodyLen:19739, hasAgentgui:true, 0 pageErrors), grep-confirmed all 5 feature strings present before pushing.

package/.gm/memories/mem-eae1e383927854fb-2649.md

@@ -1,8 +0,0 @@
----
-key: mem-eae1e383927854fb-2649
-ns: default
-created: 1783884912840
-updated: 1783884912840
----
-
-{"key":"agentgui-40th-run-gui-logic-predictability-sweep","value":"agentgui 40th run (2026-07-12): gui-logic-predictability workflow wf_c0a8d954-547 (20 agents, 196 tool calls, 0 errors) - 11 confirmed findings, all implemented. App (site/app/js/app.js, backend.js): global Escape ladder gained confirmingClearData disarm (settings clear-local-data confirm was the one armed state missing from the ladder); History detail header title/lede now use pathBasename(cwd) fallback instead of raw path, matching every other headline surface; wsCall gained a 15s timeout+cleanup (previously a hung WS RPC left promises pending forever with zero indicator); agy (Antigravity) resumeSid now forwards true once past first turn so its already-implemented --continue path actually fires (was hardcoded to only forward for claude-code), and the 'does not resume' banner now excludes agy since it has real continuity; pastedFilesToChat now calls the newly-exported kit flashComposerNote for visible upload-progress/failure/success feedback plus an undo-history-loss note. Kit (design/src/components/{chat,content}.js, app-shell.css, chat.css, components.js barrel): Row's primary .title span gained a title= tooltip fallback (39th run only fixed .sub); .ds-file-actions resting opacity raised 0->0.35 for desktop-pointer discoverability without hover; chat-composer-hint now visible at rest (was focus/draft-gated) and no longer aria-hidden; insertEmoji gained a one-time sessionStorage-gated undo-loss note matching draft-restore's existing pattern; flashComposerNote exported through the components.js barrel. Kit built+tested clean, rebuilt, re-vendored. Kit pushed 541df4d (npm-publish auto-bump landed as 92422d8), agentgui pushed 53610a4 then 4a5d6e5 (PRD-resolve residual), all 4 CI checks green both repos. Browser-witnessed every finding live on buildesk using a NEW reliable pattern: combine setHTTPCredentials+goto+wait+evaluate into ONE dispatch (splitting across dispatches hits session-id rotation and reads a genuinely-blank document.body despite window.__agentgui resolving), and read results via console.log('WITNESS:'+JSON.stringify(...)) + grep stdout/debug.console rather than the capture prefix's result field (confirmed still returns undefined even though the evaluated code's side effects and console output are real). All witnesses: confirmingClearData Escape before:true/after:false; composer-hint display:block no aria-hidden; .ds-file-actions opacity 0.35; 16/16 Row .title elements carry title= in settings agents panel; deployed backend.js/app.js/247420.js curl-confirmed to contain every shipped fix string; 0 pageErrors throughout."}

package/.gm/memories/mem-ebbe6c0694c526f0-1392.md

@@ -1,8 +0,0 @@
----
-key: mem-ebbe6c0694c526f0-1392
-ns: default
-created: 1783002710480
-updated: 1783002710480
----
-
-agentgui 25th run (2026-07-02): mid-thread retry, highest-severity finding deferred from run 24 (gui-completion #7). Kit AgentChat retry action now offered on every settled assistant turn (was i===lastIdx-gated only), onRetryMessage(m) passes the specific message. App retryTurn(m) truncates+resends from m's preceding user turn, falls back to trailing assistant turn when called with no arg. Retrying anything before the trailing turn discards later turns too - now arms the same confirm banner edit-and-resend already used (generalized with kind:'retry' tag) instead of firing immediately; retrying the actual last turn (no data loss) still executes immediately. Caught a real bug while generalizing: old retryLastTurn() never cleared resumeSid/resumeNote on truncation unlike confirmEditAndResend() - both paths now share executeTruncateAndResend(). Kit pushed 834c81d, agentgui pushed 18cd971. Browser-witnessed end-to-end. Also noted: design repo's Deploy GH Pages CI step flaked twice (Timeout/Deployment cancelled) before succeeding on 3rd gh run rerun - infra flake in docs-site deploy env, not code; npm publish (actual consumer artifact) was green from the first attempt. GM-METHOD LESSON: toolchain-skew CI flakes converge via retry (gh run rerun), never block/stop the chain - distinguish deploy-infra flake from actual test/build failure before treating red as a real regression.

package/.gm/memories/mem-ebf85becc23410b0-1633.md

@@ -1,8 +0,0 @@
----
-key: mem-ebf85becc23410b0-1633
-ns: default
-created: 1781191186453
-updated: 1781191186453
----
-
-agentgui GUI cohesion sweep (2026-06-10, 7th run, 61 agents -> 40 gaps, PUNCHLIST-COHESION.md, workflow .claude/workflows/gui-cohesion.js). Chat-as-chat-agent: kit chat.js injectCodeCopy() wraps rendered-markdown <pre> in .chat-code-block with reveal-on-hover .chat-code-copy (idempotent data-copy-wired, copy->copied label flip); CodeNode head + FilePreviewCode share the control; mid-stream prose with a code fence renders as a monospaced pre shell (agent-chat.js preShell) to avoid settle reflow; ChatComposer context line (agent/model/cwd); AgentChat per-agent avatar + followups chips. Files-as-fsbrowse: FILE_GRID_CAP=200 + show-more row; role=group NOT listbox (rows host real buttons); FileRow permissions/locked ASCII tag + disabled open on EACCES; RootsPicker segmented control; files-modals.js FilePreviewPane (non-modal split view, modal FileViewer kept <900px) with ASCII prev/next stepper. Sessions: SessionCard stale status (non-pulsing dot), selectable checkbox, active accent; SessionDashboard sort Select + filter + errors-only + stop-selected + streamState line; app liveMain derives stale (>45s no activity, no running tool), error-then-stale floats first, per-sid tally off SSE. Shell: WorkspaceShell stableFrame keeps pane track at width 0; ONE canonical .status-dot-disc (-live pulses, -error/-connecting/-stale static); rail tones match row tones; rail footer ThemeToggle; 44px coarse targets. Server: /api/list per-entry permissions via fs.accessSync; confined /api/download (realpath, 50MB, attachment). The app.js C destructure MUST list every kit component it calls (witness caught 'Icon is not defined').

package/.gm/memories/mem-ee0596fa17c7102e-362.md

@@ -1,10 +0,0 @@
----
-key: mem-ee0596fa17c7102e-362
-ns: default
-created: 1780558076417
-updated: 1780558076417
----
-
-## Resolved mutable: mut-1780557123208
-
-Policy: keep typographic product chars (middot separator, ellipsis, em/en-dash in prose) as established design; convert decorative tells. Converted arrow glyph (app.js href<->) + box-drawing dividers (//--- x ---). Witnessed: kit build lint-glyphs OK; live DOM forbiddenGlyphs=[] (browser-2). AGENTS.md itself uses middot.

package/.gm/memories/mem-ee4450fbc311b583-1361.md

@@ -1,8 +0,0 @@
----
-key: mem-ee4450fbc311b583-1361
-ns: default
-created: 1783454063772
-updated: 1783454063772
----
-
-{"key":"agentgui-fifth-run-polish-detail","value":"agentgui fifth-run GUI predictability+polish sweep (2026-06-05, wf_980345e1-201, 65 agents -> 44 gaps, PUNCHLIST-POLISH.md; workflow .claude/workflows/gui-predictability-polish.js). Landed: FileGrid sort/filter/skeleton/keyboard; SessionCard words+disc status + last-activity/current-tool + onStopAll; ChatMessage streaming caret + .chat-msg-actions; AgentChat jump-to-latest; ContextPane last-turn usage; <900px drawer fix (.ws-scrim + toggleWsDrawer); confineToRoots() fs.realpathSync re-confinement on /api/list,file,image in lib/http-handler.js (symlink inside an allowed root pointing outside passed the lexical prefix check, resolved target now fails closed). Witness: localhost:3000/gm/ 0 console/page errors; shell+5 rail items; session groups [Today,Earlier]; files sort/filter/keyboard; grid role=listbox; pane reflow chat=4cols files/live/settings=2cols(ws-no-pane) history=3cols no h-scroll; 420px drawer+scrim; whole-DOM glyph sweep 0 (kept middot/ellipsis/dash); kit lint-tokens+lint-glyphs pass. Scoped out deliberately: inline split-pane file preview (modal retained), persistent mid-conversation suggestions. Kit update flow: edit kit -> node scripts/build.mjs -> copy dist/247420.{js,css} into site/app/vendor/anentrypoint-design/ -> witness -> push kit. Superseded/extended by the 7th run."}

package/.gm/memories/mem-ee8858162518f144-1252.md

@@ -1,8 +0,0 @@
----
-key: mem-ee8858162518f144-1252
-ns: default
-created: 1781197653677
-updated: 1781197653677
----
-
-agentgui 12th run (2026-06-11): UX-craft sweep, all 58 findings landed (18 empirical witness + 40 from gui-ux-craft.js workflow). THREE load-bearing bug classes found via the live-page-as-debugger: (1) webjsx applyDiff crash class EXTENDED - swapping an UNKEYED state body (empty-state div) for KEYED children crashes mid-diff leaving contradictory half-applied DOM (live tab said '1 running' over 'No live sessions'); the rule is ONE stable keyed body wrapper across empty/grouped/flat states, and kit Btn must pass `key` through (it silently dropped it). (2) CSS-order class: base `display:none` rules placed AFTER their media-query reveals win at equal specificity regardless of media - the mobile drawer toggles + scrim were DEAD in production; base-hidden rules must precede media blocks. (3) prop-name contracts: app passed {label}, kit read .text - the composer cwd bit rendered as an invisible empty button; kit now normalizes text||label and filters empty bits before separators. WorkspaceShell now stage-yields: pane->drawer <=1480, sessions->drawer <=1100, rail->60px icon strip <900 (labels hidden unconditionally). New build lints: lint-null-children.mjs (caught 14 latent crash sites in freddie.js) + lint-classes.mjs; build runs 4 gates.

package/.gm/memories/mem-f3297e82df622649-1166.md

@@ -1,8 +0,0 @@
----
-key: mem-f3297e82df622649-1166
-ns: default
-created: 1780046143869
-updated: 1780046143869
----
-
-agentgui GUI ARCHITECTURE (2026-05-29): the chat GUI lives in the anentrypoint-design design kit, NOT in agentgui. The reusable surface is the AgentChat component (c:/dev/anentrypoint-design/src/components/agent-chat.js, exported from src/components.js, styles in chat.css .agentchat-*) — a pure props-in/vnode-out component with ALL server interaction as host callbacks (no fetch/WS/ccsniff in it). agentgui consumes it from https://unpkg.com/anentrypoint-design@latest at runtime (import map + css link in site/app/index.html) — always-latest, network-required, the prior offline guarantee was intentionally dropped. agentgui keeps only transport glue: site/app/js/backend.js (WS /sync client), ccsniff history wiring, and app.js chatMain which renders AgentChat({state, callbacks}). To change chat UI: edit the kit, commit+push to AnEntrypoint/design main -> publish.yml CI rebuilds dist + bumps version + npm publish -> unpkg @latest serves it (no manual npm auth needed). The DS repo auto-commit hook may sweep untracked WIP into your commit; stage only your files but expect the hook to add others. dist/ is gitignored (CI rebuilds it, do not commit dist).

package/.gm/memories/mem-f3f317c083d979ee-1210.md

@@ -1,8 +0,0 @@
----
-key: mem-f3f317c083d979ee-1210
-ns: default
-created: 1781859417237
-updated: 1781859417237
----
-
-agentgui 16th run (2026-06-18): design-maturity sweep + dead-code + secret-hardening. Workflow gui-design-16 (wf_6479308b-24f, 12 lenses, 54 agents -> 40 confirmed). Kit fixes: chat.js ToolCallNode gates args on hasArgs, composer textarea disabled prop, EventList forwards detail/actions/highlight/meta, TextField error state, ShortcutList splits combos into discrete .ds-kbd-caps, sessions ConversationList rail migrated to shared SearchInput, shell WsResizer aria-valuetext, voice/community glyph removal. chat.css cwd .is-checking, breakdown disc shape-ring, .ds-dash-clear hover/focus-visible. app-shell.css reduced-motion guards, .ds-file-perm-tag chip, .ws-drawer-toggle coarse floor, density/filter-pill AA contrast, ShortcutList legend. editor-primitives.css focus->focus-visible ring. app-surfaces.css print paper-tuned tokens. community.css focus-visible. marketing.css .site-footer family. Server hardening: SECRET_RE applied to upload/mkdir/rename/list; Content-Disposition RFC-5987 encoded. Dead-code: site/app/vendor/cdn/ 36 files, scripts/harvest-fixtures.mjs, CI copy-vendor lines, kit scripts/bundle-markdown.mjs. validate-mutations 26/26 PASS; 0 console errors; kit c71659b; agentgui 96260e5.

package/.gm/memories/mem-f714a86465fba158-2041.md

@@ -1,8 +0,0 @@
----
-key: mem-f714a86465fba158-2041
-ns: default
-created: 1781961168458
-updated: 1781961168458
----
-
-agentgui 20th run iter10 (2026-06-20): MAJOR finding - the entire lib/plugins/ system is DEAD SCAFFOLDING. Confirmed all plugin contribution surfaces dead: (1) routes mounted at BASE_URL+path but http-handler.js:330 only forwards /api/upload//files//v1/history to the plugin expressApp, so all other plugin routes (/api/agents /api/workflows /api/sessions/* /api/folders) are 404 - witnessed; (2) plugin wsHandlers NEVER wired - server-startup2.js:70 loadPluginExtensions only reads state.routes, never state.wsHandlers/state.api; real WS handlers come from registerWsHandlers (ws-handlers-util.js) on wsRouter in server.js:156; (3) plugin api never consumed outside plugins; (4) database-plugin init is a no-op (calls dbModule.initializeSchema which is undefined - database.js exports initSchema and runs it at import time, line 87); (5) agents-plugin served a FAKE hardcoded agent list (gm-cc/gm-oc/gm-gc/gm-kilo) unrelated to the real registry; (6) workflow-plugin + websocket-plugin wsHandlers are empty no-op stubs ()=>{}; websocket-plugin imports WebSocketServer + gets db/stream/agents but uses NONE. The real app (server.js + ws-handlers-util + http-handler + database.js + process-message + claude-runner + acp-sdk-manager) is fully independent of the plugin system. Removed so far: acp-plugin (iter1), files-plugin (iter9), agents-plugin (iter10, pushed - also dropped 'agents' from websocket-plugin deps + unused db/stream/agents locals). REMAINING dead plugins: database, stream, workflow, websocket + plugin-loader.js + server-startup2 loadPluginExtensions wiring + the workflow-plugin test in test.js. Full teardown is a large boot-path change for a DELIBERATE iteration (verify boot+tests+WS+validate-mutations at each step; check package.json busboy/ws still needed by routes-upload/server.js - they ARE). Pattern across the whole run: this codebase has MULTIPLE parallel/redundant implementations (acp-plugin vs acp-sdk-manager, cli-wrapper vs registry, files-plugin vs routes-upload, whole plugin system vs server.js core).

package/.gm/memories/mem-f786bc1626d92845-204.md

@@ -1,10 +0,0 @@
----
-key: mem-f786bc1626d92845-204
-ns: default
-created: 1781783463123
-updated: 1781783463123
----
-
-## Resolved mutable: server-3009-state
-
-ss/netstat | grep 3009 = no listener; ps aux | grep -E 'bun server|node server' = no process. Must start PORT=3009 bun server.js (run_in_background) before witness.

package/.gm/memories/mem-f9f0dc8895b21e18-1217.md

@@ -1,8 +0,0 @@
----
-key: mem-f9f0dc8895b21e18-1217
-ns: default
-created: 1783699265581
-updated: 1783699265581
----
-
-{"key":"agentgui-25th-run-mid-thread-retry","value":"agentgui 25th run (2026-07-02): mid-thread retry. Landed the highest-severity finding deferred from the 24th run (gui-completion #7): retry was hard-gated to the LAST message only. Kit AgentChat now offers retry on every settled assistant turn, not just i===lastIdx; onRetryMessage(m) passes the specific message. App retryTurn(m) truncates+resends from ms preceding user turn. Retrying anything before the trailing turn discards every later turn too - arms the same confirm banner edit-and-resend already uses (kind:retry tag) instead of firing immediately; retrying the actual last turn (no data loss) still executes immediately. Caught and fixed a real bug while generalizing: the old retryLastTurn() never cleared state.chat.resumeSid/resumeNote on truncation, unlike confirmEditAndResend() which already did per the never --resume a diverged tail rule - both paths now share executeTruncateAndResend() so this cant drift apart again. Kit pushed 834c81d, agentgui pushed 18cd971. Browser-witnessed end-to-end, 0 console errors, 28/28 tests. This runs Deploy GH Pages CI step flaked twice before succeeding on a 3rd rerun - infra flake, not a code regression."}

package/.gm/memories/mem-fb3b2a7395800041-525.md

@@ -1,8 +0,0 @@
----
-key: mem-fb3b2a7395800041-525
-ns: default
-created: 1779974536242
-updated: 1779974536242
----
-
-anentrypoint-design (the 247420 DS) build+vendor flow: edit src/components/*.js + *.css (app-shell.css, colors_and_type.css) at repo root c:/dev/anentrypoint-design, then `node scripts/build.mjs` regenerates dist/247420.{js,css}; copy those two files into agentgui's committed vendor dir site/app/vendor/anentrypoint-design/247420.{js,css} (NOT via copy-vendor.js which only handles xstate/webjsx). dist/ is tracked-but-gitignored so commit with `git add -f`. A repo auto-commit hook may commit DS source edits between turns.

package/.gm/memories/mem-fc5753f92ee7d654-966.md

@@ -1,8 +0,0 @@
----
-key: mem-fc5753f92ee7d654-966
-ns: default
-created: 1780558613701
-updated: 1780558613701
----
-
-agentgui startup runtime detail: Node v24 has no prebuilt better-sqlite3 binary (module version 137); npm rebuild silently fails and the server crashes on require. FIX: postinstall compiles from source: `node scripts/patch-fsbrowse.js && node scripts/copy-vendor.js && (cd node_modules/better-sqlite3 && node-gyp rebuild 2>/dev/null) || true`. Paired: package.json start script `bun server.js || node server.js`; bin/gmgui.cjs detects bun via spawnSync('bun',['--version'],{shell:true}) and falls back to node; better-sqlite3 bumped ^12.6.2->^12.9.0. bun start already worked (bun:sqlite native); only the node path was broken. database.js tries bun:sqlite first then better-sqlite3. ALSO: CI capture-screenshots must run under bun not node (npm install --ignore-scripts leaves better-sqlite3 unbuilt; under node both bun:sqlite and better-sqlite3 fail in the 20s health window). Any CI step spawning the agentgui server (process.execPath inherited) must invoke bun.