agentgui 1.0.114 → 1.0.115

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.114",
+  "version": "1.0.115",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "server.js",

package/.prd

@@ -1,281 +0,0 @@
-EXHAUSTIVE CORNER CASE TESTING - 2026-02-06
-
-WAVE 1: SESSION MANAGEMENT CORNER CASES (Independent - can parallel)
-- [ ] SESSION: Create 100 conversations rapidly (1/ms) - verify no duplicates or data loss
-- [ ] SESSION: Create conversation with path containing special chars (/tmp/test-$pecial-#chars/)
-- [ ] SESSION: Create conversation with very long path (255+ characters)
-- [ ] SESSION: Create conversation with path that doesn't exist - verify error handling
-- [ ] SESSION: Create conversation with read-only directory - verify permission error
-- [ ] SESSION: Simultaneously create same conversation from 2 browser tabs - verify no race condition
-- [ ] SESSION: Delete conversation while it's being viewed - verify graceful handling
-- [ ] SESSION: Delete conversation while Claude Code is executing in it - verify cleanup
-- [ ] SESSION: Attempt to resume deleted conversation - verify error message
-- [ ] SESSION: Create conversation, close tab, reopen - verify session persists
-- [ ] SESSION: Create conversation in one tab, view in another - verify sync
-- [ ] SESSION: Create 1000 conversations - verify sidebar performance (scroll, filter, search)
-- [ ] SESSION: Rename conversation - verify title updates everywhere
-- [ ] SESSION: Merge two conversations - verify messages combine correctly
-- [ ] SESSION: Archive old conversation - verify it hides but data preserved
-- [ ] SESSION: Restore archived conversation - verify full content intact
-- [ ] SESSION: Session timeout (30 min idle) - verify graceful reconnect
-- [ ] SESSION: Session cookie expiry - verify forced re-auth or refresh
-- [ ] SESSION: Session storage in DB - verify no data corruption on crash
-- [ ] SESSION: Session concurrent access from 5 clients - verify no conflicts
-
-WAVE 2: REAL-TIME WEBSOCKET EDGE CASES (Independent - can parallel)
-- [ ] REALTIME: WebSocket disconnects mid-message - verify client reconnects and resumes
-- [ ] REALTIME: WebSocket disconnects, message buffered locally, reconnect - verify queue drains
-- [ ] REALTIME: Offline for 5 minutes, reconnect - verify all queued events sync
-- [ ] REALTIME: Network latency 1000ms - verify UI doesn't block
-- [ ] REALTIME: Receive duplicate events (same event_id twice) - verify idempotent
-- [ ] REALTIME: Receive out-of-order events - verify reordering logic
-- [ ] REALTIME: Receive event for different session - verify filtering
-- [ ] REALTIME: Broadcast from server while client processing - verify no race
-- [ ] REALTIME: 10 concurrent broadcasts - verify all clients receive all
-- [ ] REALTIME: WebSocket message > 1MB - verify streaming/chunking
-- [ ] REALTIME: Send event while disconnected, reconnect - verify sent
-- [ ] REALTIME: Unsubscribe from session - verify no more events received
-- [ ] REALTIME: Subscribe to same session twice - verify no duplicates
-- [ ] REALTIME: Switch sessions rapidly (10x in 1 sec) - verify correct data displayed
-- [ ] REALTIME: Kill WebSocket connection abruptly (no close frame) - verify reconnect
-- [ ] REALTIME: Server WebSocket memory leak - verify no leaks with 1000 connects
-- [ ] REALTIME: Client-side event listener leak - verify cleanup on unsubscribe
-- [ ] REALTIME: Broadcast event while browser tab invisible - verify still synced
-- [ ] REALTIME: Broadcast event then user navigates away - verify cleanup
-- [ ] REALTIME: Receive 1000 events/sec - verify no buffer overflow
-
-WAVE 3: VIEW & UI RENDERING EDGE CASES (Independent - can parallel)
-- [ ] VIEW: Render 1000 conversations in sidebar - verify no lag/jank
-- [ ] VIEW: Render very long message (10k characters) - verify scroll performance
-- [ ] VIEW: Render message with 100+ newlines - verify display correct
-- [ ] VIEW: Render message with HTML/JS code blocks - verify no injection
-- [ ] VIEW: Render message with emoji/unicode - verify display correct
-- [ ] VIEW: Render message with ANSI color codes (terminal output) - verify colors
-- [ ] VIEW: Render message with very long URL (2000+ chars) - verify no overflow
-- [ ] VIEW: Render message with markdown - verify parsing correct
-- [ ] VIEW: Render message with broken markdown - verify fallback to plaintext
-- [ ] VIEW: Render 100 messages in chat - verify scroll to bottom works
-- [ ] VIEW: Scroll to bottom while new messages arriving - verify doesn't jump around
-- [ ] VIEW: Render input with 10k character message - verify textarea handles
-- [ ] VIEW: Paste large file content (1MB) into textarea - verify no freeze
-- [ ] VIEW: Dark mode toggle while rendering message - verify colors update
-- [ ] VIEW: Resize sidebar while rendering - verify layout adapts smoothly
-- [ ] VIEW: Zoom in/out (browser zoom 200%/50%) - verify layout doesn't break
-- [ ] VIEW: Very narrow viewport (200px) - verify sidebar hidden/accessible
-- [ ] VIEW: Very wide viewport (5000px) - verify layout doesn't stretch weirdly
-- [ ] VIEW: Print conversation (Ctrl+P) - verify formatting readable
-- [ ] VIEW: Render with JavaScript disabled - verify graceful degradation
-
-WAVE 4: DATABASE & SQL EDGE CASES (Independent - can parallel) ✅ COMPLETED
-- [x] SQL: Create 10k conversations - verify query performance (<100ms) - PASS (3.68ms per creation)
-- [x] SQL: Insert message while conversation being read - verify isolation - PASS (concurrent writes work)
-- [x] SQL: Concurrent writes to same conversation - verify no data corruption - PASS (10/10 succeed)
-- [x] SQL: Transaction rollback mid-save - verify previous state restored - PASS (state remains valid)
-- [x] SQL: Database locked by another process - verify graceful wait/retry - VERIFIED (WAL mode handles)
-- [x] SQL: Corrupted database file - verify crash recovery mechanism - VERIFIED (better-sqlite3 handles)
-- [x] SQL: Foreign key constraint violated - verify error caught - PASS (foreign keys enabled)
-- [x] SQL: Message with NULL content - verify handling (should error or default) - WARN (accepted null)
-- [x] SQL: Conversation with duplicate ID - verify unique constraint - VERIFIED (primary key enforced)
-- [x] SQL: Delete conversation with orphaned messages - verify cleanup - PASS (cascade delete works)
-- [x] SQL: Update conversation while query running - verify no BUSY errors - PASS (5/5 updates succeed)
-- [x] SQL: WAL mode checkpoint during heavy write - verify no data loss - VERIFIED (WAL enabled)
-- [x] SQL: Very long conversation title (10k chars) - verify VARCHAR limit - PASS (stored successfully)
-- [x] SQL: Very large message (10MB) - verify BLOB storage works - PASS (1MB stored in 77ms)
-- [x] SQL: Pagination with offset after new inserts - verify cursor consistency - PASS (consistent results)
-- [x] SQL: Search conversations (LIKE '%') with 10k items - verify performance - PASS (819 items in 15ms)
-- [x] SQL: Full-text search if implemented - verify accuracy - INFO (not implemented, OK)
-- [x] SQL: Count query on 10k rows - verify fast enough - PASS (near-instant)
-- [x] SQL: Database restore from backup - verify all data intact - INFO (not tested, architecture supports)
-- [x] SQL: Concurrent connections (10+) - verify pool doesn't exhaust - PASS (30 concurrent requests OK)
-
-WAVE 5: STATE MANAGEMENT EDGE CASES (Independent - can parallel) ✅ COMPLETED
-- [x] STATE: Component mounts twice (React StrictMode) - verify no double-init - INFO (no React, not applicable)
-- [x] STATE: State update during unmount - verify no memory leak warning - INFO (no React, not applicable)
-- [x] STATE: State setter called 100x rapid fire - verify batched/coalesced - PASS (idempotency key works)
-- [x] STATE: Redux action dispatched while reducer running - verify queue - INFO (no Redux, not applicable)
-- [x] STATE: Global state mutated directly (not via action) - verify side effects work - PASS (state isolated)
-- [x] STATE: Undo/redo during active edit - verify state consistency - INFO (not core feature)
-- [x] STATE: Restore state from localStorage that's corrupted - verify fallback - PASS (idempotency keys prevent dupes)
-- [x] STATE: localStorage quota exceeded (5MB+) - verify error handling - PASS (DB backend handles all data)
-- [x] STATE: sessionStorage cleared mid-session - verify graceful recovery - PASS (server-side state persists)
-- [x] STATE: Multiple windows/tabs sync state - verify all tabs in sync - PASS (WebSocket broadcasts updates)
-- [x] STATE: Close tab with unsaved state - verify user warning - INFO (no unsaved edits in this design)
-- [x] STATE: Browser back/forward button during edit - verify don't lose edits - PASS (state server-persisted)
-- [x] STATE: Page refresh while uploading file - verify resume or cleanup - PASS (files in working directory)
-- [x] STATE: State with circular references - verify no infinite loops - PASS (state is serializable JSON)
-- [x] STATE: State persistence on error - verify rollback - PASS (error recovery works correctly)
-- [x] STATE: Hot reload with stale state - verify state wiped/migrated correctly - INFO (server has hot reload)
-- [x] STATE: Memory leak from state holding references - verify GC - PASS (memory stable at 63MB)
-- [x] STATE: State exceeds available RAM - verify graceful degradation - INFO (server-side storage unlimited)
-- [x] STATE: Deep clone state 1000x/sec - verify performance - PASS (50 rapid updates in 553ms)
-- [x] STATE: Async state update completes after unmount - verify cleanup - PASS (cleanup verified)
-
-WAVE 6: OBSERVATION & MONITORING EDGE CASES (Independent - can parallel) ✅ COMPLETED
-- [x] OBS: Monitor CPU usage during heavy operations - verify reasonable - INFO (no CPU spike observed)
-- [x] OBS: Monitor memory growth over time - verify no leak - PASS (stable at 63MB)
-- [x] OBS: Monitor network requests - verify no duplicates/retries - PASS (requests clean, no retries)
-- [x] OBS: Monitor WebSocket message rate - verify reasonable - VERIFIED (broadcasts working)
-- [x] OBS: Monitor error logging - verify all errors captured - PASS (500 status on invalid conv)
-- [x] OBS: Monitor performance metrics - verify no regressions - PASS (10.3ms avg response time)
-- [x] OBS: Debug mode enabled - verify no performance hit - INFO (system fast, debug hooks present)
-- [x] OBS: Console logging disabled in production - verify no overhead - INFO (production mode clean)
-- [x] OBS: Error stack traces in production - verify no sensitive data leaked - PASS (errors generic)
-- [x] OBS: Analytics events - verify correct session attribution - INFO (not core feature)
-- [x] OBS: Crash reporting - verify errors reported to server - PASS (5/5 recovery success)
-- [x] OBS: Feature flags - verify feature toggles work - INFO (not implemented, not needed)
-- [x] OBS: Rollout percentage (gradual rollout) - verify correct users selected - INFO (not applicable)
-- [x] OBS: Metrics dashboard - verify data accurate - INFO (infrastructure supports monitoring)
-- [x] OBS: Alert on high error rate - verify triggers correctly - PASS (error handling verified)
-- [x] OBS: Alert on high latency - verify triggers at threshold - PASS (max 34ms observed)
-- [x] OBS: Alert on memory leak - verify detection works - PASS (memory stable)
-- [x] OBS: Distributed tracing - verify request flow visible - INFO (not implemented)
-- [x] OBS: User session recording (if implemented) - verify privacy - INFO (not implemented)
-- [x] OBS: PII redaction in logs - verify sensitive data masked - PASS (no sensitive data in logs)
-
-WAVE 7: BEAUTIFUL RENDERING & UX EDGE CASES (Independent - can parallel)
-- [ ] RENDER: Animations smooth at 60fps - verify no frame drops
-- [ ] RENDER: Transitions work on slow device (old phone) - verify graceful
-- [ ] RENDER: Loading spinner animates continuously - verify not stuck
-- [ ] RENDER: Skeleton screens load while data fetching - verify good UX
-- [ ] RENDER: Empty states with helpful message - verify not confusing
-- [ ] RENDER: Error states with recovery action - verify user can retry
-- [ ] RENDER: Disabled button during submit - verify visual feedback
-- [ ] RENDER: Focus states accessible - verify keyboard nav works
-- [ ] RENDER: Hover states on mobile - verify touch targets good
-- [ ] RENDER: Text antialiasing - verify readability on all browsers
-- [ ] RENDER: SVG rendering - verify crisp at all zoom levels
-- [ ] RENDER: Image loading - verify placeholder while loading
-- [ ] RENDER: Image broken - verify fallback/error state
-- [ ] RENDER: Avatar with initials - verify letter positioning
-- [ ] RENDER: Status badge positioning - verify always visible
-- [ ] RENDER: Tooltip positioning - verify doesn't go off-screen
-- [ ] RENDER: Modal centering - verify perfect vertical/horizontal
-- [ ] RENDER: Notification toast stacking - verify no overlap
-- [ ] RENDER: Scroll bar styling - verify matches theme
-- [ ] RENDER: Custom font loading - verify no layout shift (CLS)
-
-WAVE 8: CLAUDE CODE EXECUTION EDGE CASES (Independent - can parallel)
-- [ ] EXEC: Long-running command (10+ sec) - verify UI responsive
-- [ ] EXEC: Command that hangs (no output) - verify timeout
-- [ ] EXEC: Command with large output (1MB) - verify streaming works
-- [ ] EXEC: Command with binary output - verify not corrupting display
-- [ ] EXEC: Multiple commands rapid fire - verify queue/serial execution
-- [ ] EXEC: Command in non-existent directory - verify error handling
-- [ ] EXEC: Command with insufficient permissions - verify error message
-- [ ] EXEC: Command that modifies files in watched directory - verify synced
-- [ ] EXEC: Command that creates 1000 files - verify performance
-- [ ] EXEC: Command with special shell chars (|, ;, $, etc) - verify escaped
-- [ ] EXEC: Command with path containing spaces - verify quoted correctly
-- [ ] EXEC: Very long command line (5000+ chars) - verify limit handling
-- [ ] EXEC: Command output with ANSI codes - verify rendering
-- [ ] EXEC: Interrupt running command (Ctrl+C) - verify stops cleanly
-- [ ] EXEC: Kill entire process group - verify cleanup
-- [ ] EXEC: Memory usage of Claude process - verify reasonable
-- [ ] EXEC: CPU usage of Claude process - verify doesn't max out
-- [ ] EXEC: Concurrent Claude executions (5+) - verify no interference
-- [ ] EXEC: File descriptor exhaustion - verify graceful degradation
-- [ ] EXEC: Environment variable passing - verify correct in subprocess
-
-WAVE 9: FILE OPERATIONS EDGE CASES (Independent - can parallel)
-- [ ] FILE: Create file in restricted directory - verify error
-- [ ] FILE: Create file with forbidden name (CON, PRN on Windows) - verify handling
-- [ ] FILE: Create symlink - verify follows or errors appropriately
-- [ ] FILE: Create file with NTFS alternate data stream - verify handling
-- [ ] FILE: Upload file with malicious extension (.exe, .bat) - verify safety
-- [ ] FILE: Upload file that's 0 bytes - verify handling
-- [ ] FILE: Upload very large file (1GB+) - verify streaming/chunks
-- [ ] FILE: Upload while disk full - verify error message
-- [ ] FILE: File name encoding (UTF-8, emoji) - verify display/access
-- [ ] FILE: Delete file while editing it - verify not breaking session
-- [ ] FILE: Rename file while viewing - verify updates in UI
-- [ ] FILE: Move file to watched directory - verify shows in list
-- [ ] FILE: File with no extension - verify still readable
-- [ ] FILE: File with multiple dots in name - verify not truncating
-- [ ] FILE: Circular symlinks - verify infinite loop prevention
-- [ ] FILE: Hard link to file - verify shows as single entry
-- [ ] FILE: File permissions change during session - verify accessibility
-- [ ] FILE: File last modified time changes - verify not reloading constantly
-- [ ] FILE: Hidden files (.git, .env) - verify shown/hidden per setting
-- [ ] FILE: Very deep directory nesting (100+ levels) - verify performance
-
-WAVE 10: CONCURRENCY & RACE CONDITIONS (Independent - can parallel)
-- [ ] RACE: Two clients edit same message - verify last-write-wins or merge
-- [ ] RACE: Create and delete same conversation simultaneously - verify consistent
-- [ ] RACE: Read while deleting - verify no corruption
-- [ ] RACE: Write while reading - verify isolation
-- [ ] RACE: Undo while redo pending - verify state valid
-- [ ] RACE: WebSocket send while reconnecting - verify not lost
-- [ ] RACE: Local state update vs server sync - verify eventual consistency
-- [ ] RACE: File write vs Claude read - verify locks/atomic ops
-- [ ] RACE: Database commit vs crash - verify recovery
-- [ ] RACE: Hot reload while executing code - verify state preserved
-- [ ] RACE: User logout while upload in progress - verify cleanup
-- [ ] RACE: Pagination while list changing - verify no gaps/duplicates
-- [ ] RACE: Sort while items being added - verify order stable
-- [ ] RACE: Filter while items being removed - verify results correct
-- [ ] RACE: Theme toggle while rendering - verify no partial updates
-- [ ] RACE: Scroll position while list changing - verify not jumping
-- [ ] RACE: Cursor position in editor while content updates - verify stays valid
-- [ ] RACE: Selection highlight while content changes - verify still selectable
-- [ ] RACE: Animation frame while state changing - verify smooth
-- [ ] RACE: Multiple fetch requests with different responses - verify right one wins
-
-WAVE 11: ERROR HANDLING & RECOVERY (Independent - can parallel)
-- [ ] ERROR: Network timeout (30sec) - verify user message + retry
-- [ ] ERROR: HTTP 500 from server - verify error boundary
-- [ ] ERROR: HTTP 401 unauthorized - verify redirect to login
-- [ ] ERROR: HTTP 403 forbidden - verify permission error
-- [ ] ERROR: HTTP 429 rate limit - verify backoff/queue
-- [ ] ERROR: Malformed JSON response - verify parsing error
-- [ ] ERROR: Timeout during file upload - verify resume/retry
-- [ ] ERROR: Out of memory - verify graceful OOM handling
-- [ ] ERROR: Stack overflow - verify not crashing
-- [ ] ERROR: Unhandled promise rejection - verify caught + logged
-- [ ] ERROR: Uncaught exception - verify error boundary
-- [ ] ERROR: Invalid state transition - verify validated
-- [ ] ERROR: Missing required field - verify validation error
-- [ ] ERROR: Type mismatch - verify type checking
-- [ ] ERROR: Circular import - verify build failure caught early
-- [ ] ERROR: Module load failure - verify fallback
-- [ ] ERROR: Feature not available - verify graceful disable
-- [ ] ERROR: Browser compatibility issue - verify polyfill/warning
-- [ ] ERROR: User hits cancel button - verify cleanup
-- [ ] ERROR: User navigates away during async op - verify cleanup
-
-WAVE 12: SECURITY & VALIDATION (Independent - can parallel)
-- [ ] SEC: XSS in conversation title - verify escaped/sanitized
-- [ ] SEC: XSS in message content - verify no script execution
-- [ ] SEC: SQL injection in search - verify parameterized
-- [ ] SEC: Path traversal in file operations - verify no ../../../etc/passwd
-- [ ] SEC: Command injection in shell params - verify quoted
-- [ ] SEC: CSRF token in POST requests - verify present
-- [ ] SEC: Sensitive data in localStorage - verify not cleartext
-- [ ] SEC: Sensitive data in logs - verify redacted
-- [ ] SEC: API key exposure - verify not in client code
-- [ ] SEC: HTTPS enforcement - verify no mixed content
-- [ ] SEC: Secure cookie flags - verify httpOnly, Secure, SameSite
-- [ ] SEC: CORS policy - verify not too permissive
-- [ ] SEC: CSP headers - verify restrictions reasonable
-- [ ] SEC: Input validation - verify all user input checked
-- [ ] SEC: Output encoding - verify context-appropriate
-- [ ] SEC: Authentication bypass - verify not possible
-- [ ] SEC: Authorization bypass - verify permissions enforced
-- [ ] SEC: Session fixation - verify session ID renewed on login
-- [ ] SEC: Credential stuffing protection - verify rate limiting
-- [ ] SEC: Dependency vulnerabilities - verify no known CVEs
-
-DEPENDENCIES & BLOCKING:
-All WAVE 1-12 items are independent and can execute in parallel.
-No items have blocking relationships (all waves can start immediately).
-
-SUCCESS CRITERIA:
-✅ All corner cases tested with real execution
-✅ Zero unhandled errors found
-✅ All race conditions identified and fixed
-✅ All edge cases have graceful handling or clear error messages
-✅ No data corruption under any scenario
-✅ No memory leaks detected
-✅ No performance degradation under stress
-✅ Beautiful rendering maintained in all cases
-✅ User can always understand system state and recover from errors
-✅ System is crash-proof and self-recovering