agentgui 1.0.948 → 1.0.950

package/.claude/workflows/gui-audit.js

@@ -0,0 +1,86 @@
+export const meta = {
+  name: 'gui-audit',
+  description: 'Sweep every agentgui GUI surface for jank, verify findings adversarially, and emit kit-update tasks',
+  whenToUse: 'Run a maximum-effort GUI audit of agentgui: review chat, history, settings, a11y, security, performance, and glyph hygiene across the client (site/app) and the design kit (c:\\dev\\anentrypoint-design). Fans out one reviewer per surface, verifies each finding with an independent skeptic, then synthesizes a prioritized punch-list. GUI fixes land in the design kit.',
+  phases: [
+    { title: 'Review', detail: 'one reviewer agent per GUI surface/aspect' },
+    { title: 'Verify', detail: 'independent skeptic confirms each finding is real' },
+    { title: 'Synthesize', detail: 'dedupe + prioritize into a punch-list with kit-vs-app split' },
+  ],
+};
+
+// Every GUI surface and cross-cutting aspect the audit must cover. Each becomes
+// one reviewer agent. Add a row to widen coverage; the fan-out scales with it.
+const SURFACES = [
+  { key: 'chat', prompt: 'Audit the agentgui CHAT surface for jank. Read site/app/js/app.js (chatMain, sendChat, toolPart, applyToolResult), site/app/js/backend.js (streamChat), and the kit AgentChat at c:\\dev\\anentrypoint-design/src/components/agent-chat.js + chat.js. Check: tool_use/tool_result render as structured collapsible cards (not flattened text); markdown/text/tool parts interleave in arrival order; empty state; composer stop button while streaming; thinking/working indicator during silent tool runs; aborted-empty turn pruning; multi-turn resume correctness. Report each issue with file:line, why it is jank, and whether the fix is in the kit or the app.' },
+  { key: 'history', prompt: 'Audit the agentgui HISTORY surface (site/app/js/app.js historyMain, historySide, loadSession, EventList usage). Check: event rendering consistency with chat (same event same way), expand/collapse + keyboard activation, the silent 300-event cap with no load-older, search-result click landing on the matched event, live SSE wiring, session list filtering/subagent toggle. Report each issue with file:line and kit-vs-app.' },
+  { key: 'settings', prompt: 'Audit the agentgui SETTINGS surface (site/app/js/app.js settingsMain, agentsPanel, preferencesPanel, saveBackend). Check: ACP agent start/stop/restart/health controls (read-only today), cwd surfacing + server-side validation, backend URL validation, clear-local-data flow, health summary clarity. Report each issue with file:line and kit-vs-app.' },
+  { key: 'a11y', prompt: 'Audit agentgui ACCESSIBILITY across site/app and the kit. Check: skip-link target reachability/focus, tab order on each tab, agent/model select labels, EventList row role=button keyboard activation + expand announcement, aria-live over/under-announcing, color contrast on the dark theme (WCAG AA 4.5:1 text / 3:1 UI), focus-visible rings, reduced-motion. Report each issue with file:line.' },
+  { key: 'security', prompt: 'Audit agentgui GUI-reachable SECURITY. Read lib/http-handler.js. Check: Access-Control-Allow-Origin:* with Authorization + ?token= cross-origin/leak risk; /api/image arbitrary-file-read (the .. check runs after path.normalize); markdown XSS (kit marked+dompurify) — does DOMPurify actually neutralize script/javascript: URLs in agent output. Report each issue with file:line, severity, and the concrete exploit path.' },
+  { key: 'perf', prompt: 'Audit agentgui GUI PERFORMANCE. Check: per-token render+scroll thrash on the chat stream (should be rAF-coalesced via scheduleStreamRender), history EventList rebuild cost on burst SSE loads (last-300 map per rAF), webjsx keying stability, markdown/Prism cache warmup, resize/relTime tick cost. Report each hotspot with file:line and a concrete fix.' },
+  { key: 'glyph', prompt: 'Sweep EVERY GUI source file (site/app/**, c:\\dev\\anentrypoint-design/src/**, *.css) for decorative tell-tale glyphs: arrows, box-drawing, bullets, status dots, checks, emoji, any non-ASCII decorative symbol. KEEP the typographic set (middot, ellipsis, em/en-dash in prose), SVG line-icons via Icon(), CSS-drawn discs, and intentional ascii-art (AICAT_FACE). Report every decorative glyph found with file:line and its ASCII replacement.' },
+  { key: 'responsive', prompt: 'Audit agentgui RESPONSIVE behavior from site/app/index.html media queries + the kit AppShell. Check: chat controls cluster wrap at 360/640/900px, cwd path overflow, history sidebar drawer (open/close/scrim/select-closes-it), touch-target sizes, settings two-column collapse. Report each issue with the breakpoint and file:line.' },
+  { key: 'consistency', prompt: 'Audit agentgui PREDICTABILITY/CONSISTENCY. Check that the same state reads the same way everywhere: connection/activity status vocabulary across crumb dot, chat status, AgentControls status, settings health, agentsPanel; ellipsis convention (… vs ...); rail tone semantics (green=ok/selected, purple=subagent, flame=error); button labels. Report each divergence with file:line.' },
+];
+
+const FINDINGS_SCHEMA = {
+  type: 'object',
+  required: ['surface', 'findings'],
+  properties: {
+    surface: { type: 'string' },
+    findings: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['title', 'where', 'why', 'fixLocation'],
+        properties: {
+          title: { type: 'string' },
+          where: { type: 'string', description: 'file:line' },
+          why: { type: 'string' },
+          fixLocation: { type: 'string', enum: ['kit', 'app', 'server', 'both'] },
+          severity: { type: 'string', enum: ['low', 'medium', 'high'] },
+        },
+      },
+    },
+  },
+};
+
+const VERDICT_SCHEMA = {
+  type: 'object',
+  required: ['isReal', 'reason'],
+  properties: {
+    isReal: { type: 'boolean' },
+    reason: { type: 'string' },
+    correctedFix: { type: 'string' },
+  },
+};
+
+phase('Review');
+
+// Pipeline: each surface is reviewed, then every finding it produced is
+// independently verified — a surface's findings start verifying the moment that
+// surface's review returns, without waiting for slower surfaces.
+const reviewed = await pipeline(
+  SURFACES,
+  (s) => agent(s.prompt, { label: 'review:' + s.key, phase: 'Review', schema: FINDINGS_SCHEMA }),
+  (review, surface) =>
+    parallel((review.findings || []).map((f) => () =>
+      agent(
+        'Adversarially verify this GUI audit finding. Default to isReal=false if you cannot confirm it from the actual source. Finding: "' + f.title + '" at ' + f.where + ' — ' + f.why,
+        { label: 'verify:' + surface.key, phase: 'Verify', schema: VERDICT_SCHEMA }
+      ).then((v) => ({ ...f, surface: surface.key, verdict: v }))
+    ))
+);
+
+const confirmed = reviewed.flat().filter(Boolean).filter((f) => f.verdict && f.verdict.isReal);
+log(confirmed.length + ' confirmed findings across ' + SURFACES.length + ' surfaces');
+
+phase('Synthesize');
+
+const punchList = await agent(
+  'Synthesize these confirmed agentgui GUI audit findings into a prioritized punch-list. Group by fixLocation (kit vs app vs server), order by severity then user impact, dedupe overlaps, and for each give a one-line concrete remedy. Findings JSON:\n' +
+    JSON.stringify(confirmed, null, 2),
+  { label: 'synthesize', phase: 'Synthesize' }
+);
+
+return { confirmedCount: confirmed.length, confirmed, punchList };

package/AGENTS.md

@@ -6,7 +6,7 @@ One surface. `server.js` serves `site/app/` under `BASE_URL` (default `/gm`) and
 
 When `PASSWORD` env var is set, every HTTP route is gated by `lib/http-handler.js` accepting **Basic auth**, **`Authorization: Bearer <pwd>`**, OR **`?token=<pwd>`** query param (added 2026-05-26 so `EventSource` and direct deep-links work — neither can set headers). WS `/sync` requires `?token=` only. The HTML head script injects `window.__BASE_URL`, `window.__SERVER_VERSION`, and `window.__WS_TOKEN`; `site/app/js/backend.js` reads `__WS_TOKEN` and threads it onto every fetch (Bearer header) / EventSource (qs) / WebSocket (qs).
 
-- `site/app/index.html` — shell + CSS; imports `anentrypoint-design` from `https://unpkg.com/anentrypoint-design@latest` at runtime (always-latest; requires network — the prior offline guarantee is intentionally dropped)
+- `site/app/index.html` — shell + CSS; imports `anentrypoint-design` from the **local vendored copy** `./vendor/anentrypoint-design/247420.{js,css}` (re-vendored 2026-06-04 for a PREDICTABLE shipped UI that does not shift when upstream publishes, and offline operation — the markdown stack marked/dompurify/prismjs still fetches from jsdelivr on first chat render). Update flow: edit the kit at `c:\dev\anentrypoint-design`, `node scripts/build.mjs`, copy `dist/247420.{js,css}` into `site/app/vendor/anentrypoint-design/`, then publish the kit so unpkg stays in sync.
 - `site/app/js/backend.js` — same-origin WS/HTTP client (`DEFAULT_BACKEND = ''`); the transport glue that wires the kit; `?backend=` query override for cross-origin debugging
 - `site/app/js/app.js` — webjsx view + state; renders the `AgentChat` kit (from `anentrypoint-design`) for the chat surface and wires agentgui's WS/ccsniff state as kit callbacks; history/settings remain agentgui-local. Exposes `window.__agentgui`
 
@@ -18,6 +18,20 @@ Dependencies:
 - `ccsniff` (>=1.1.0) — exports `createHistoryRouter({projectsDir})` mountable on Express; serves `/v1/history/{sessions,sessions/:sid/events,search,snapshot,reindex,stream}`. Reads `~/.claude/projects` (override via `CLAUDE_PROJECTS_DIR`).
 - `anentrypoint-design` (>=0.0.119) — kit library, single-file ESM from unpkg
 
+## GUI audit pass (2026-06-04) — structured chat, predictable presentation
+
+A maximum-effort GUI sweep landed these, GUI changes in the kit `c:\dev\anentrypoint-design` (built+vendored locally), correctness/security in agentgui:
+
+- **Structured tool cards in chat.** `app.js sendChat` now emits structured parts — `toolPart()` builds `{kind:'tool',name,label,args,status,_id}` and `applyToolResult()` matches a `tool_result` back to its `tool_use` by id (sets `result`+done/error status). The kit `AgentChat` passes structured `{kind,...}` parts straight through to `ChatMessage.renderPart` (only bare strings are wrapped as text), so the kit's collapsible `ToolCallNode` (args/result sections, status icons) renders instead of the old flattened `'-> '+text`. Full args/result live in the card (no 120/160-char truncation).
+- **AgentChat kit additions** (`src/components/agent-chat.js`): empty state (`.agentchat-empty*`, title/sub/`suggestions`+`onSuggestionClick`), composer stop button while streaming (`busy`+`onCancel:onStop` into `ChatComposer`), a `working…` tail (`.agentchat-working`) when a content-bearing turn is still streaming (silent tool runs no longer read as frozen). CSS in `chat.css`.
+- **Streaming render is rAF-coalesced** via `scheduleStreamRender()` (was render+scroll per token).
+- **Multi-turn resume wired end-to-end.** Server `chat.sendMessage` is one-shot (new ephemeral `chat-` id per call); claude's real session id is `parsed.session_id` in the stream. `ws-handlers-util.js onEvent` now broadcasts `streaming_session{claudeSessionId}` once; `backend.js` yields `{type:'session'}`; `app.js` captures it into `state.chat.resumeSid` (claude-code only) + persists, so the next turn `--resume`s.
+- **Skip link works.** Kit `AppShell` `<main id=app-main>` now has `tabindex=-1` so the skip-link moves focus, not just scrolls.
+- **History:** `state.eventsLimit` (default 300, reset per session) + `load N older` control (no more silently-unreachable older events); expand-all/collapse-all; per-event rail tone (green=normal, purple=tool_use, flame=error) matching the GUI-wide rail semantics; search hits carry `{focusEventI,focusEventTs}` so a click scrolls to + flashes (`.event-flash`) the matched event; mobile drawer auto-closes on session select (`loadSession` removes `.side-open` since DS only auto-closes on `<a>` clicks).
+- **Security** (`lib/http-handler.js`): `/api/image` confined to an allowlist root (`CLAUDE_PROJECTS_DIR`, home, `IMAGE_ROOTS`) — was arbitrary-file-read (the `..` check was a no-op after `path.normalize`); CORS no longer advertises `Access-Control-Allow-Origin:*` when `PASSWORD` is set (reflects `CORS_ORIGIN` if set, else same-origin only). Markdown XSS verified inert (DOMPurify strips script/onerror/`javascript:`).
+- **Consistency:** unified ellipsis to `…` (kept set); settings health chip uses connection vocab (`connected/connecting/offline`) matching the crumb dot; running-chats panel now shows on chat tab too (extracted `runningPanel()`); aborted-empty turns pruned from persisted/restored chat; restored transcript reopens under its own agent (`restoredAgent`).
+- **Workflow:** `.claude/workflows/gui-audit.js` — a reusable multi-agent GUI-audit workflow (per-surface reviewers -> adversarial verify -> synthesize, kit-vs-app fixLocation).
+
 ## Orchestration agents
 
 The four flagship agents the GUI drives are **Claude Code, OpenCode, Kilo, and Antigravity (`agy`)**; the agent picker (`site/app/js/app.js`, `PRIMARY_AGENTS`) sorts these first, then other-available, then npx-installable, then not-installed.

package/AUDIT-PUNCHLIST.md

@@ -0,0 +1,62 @@
+All findings are pre-confirmed (isReal: true). Here is the deduped, prioritized punch-list grouped by fixLocation, ordered by severity then user impact.
+
+## SERVER (lib/) — highest impact: security correctness
+
+1. **[HIGH · security] /api/image broad arbitrary-file-read** — `lib/http-handler.js:144-162`: drop `os.homedir()` from `allowRoots` (restrict to `CLAUDE_PROJECTS_DIR` + `IMAGE_ROOTS`) and 403 any path whose extension isn't in the image `mimeTypes` map instead of falling back to `application/octet-stream`.
+2. **[HIGH · security] ?token= credential leak, no Referrer-Policy/CSP** — `lib/http-handler.js:56-61`: always `res.setHeader('Referrer-Policy','no-referrer')`, add a CSP restricting img/connect/script-src to self + unpkg/jsdelivr, and migrate token→httpOnly SameSite=Strict cookie so the password leaves the URL/history/logs.
+3. **[MEDIUM · robustness] cwd unvalidated before spawn** — `lib/ws-handlers-util.js:70`: when `p?.cwd` is set, `fs.statSync(cwd).isDirectory()` check and `err(400,'no such directory')` before `runClaudeWithStreaming`; optionally confine to an allowlist root.
+
+## APP (site/app/) — chat correctness, then history, then settings
+
+4. **[HIGH · chat] Live SSE event read flat but arrives nested** — `app.js:281-293`: unwrap `const ev = data.payload || data;` and use `ev` for `state.events.push` and the tool_use/isError counters (keep `data.sid` for routing). Core live-history regression.
+5. **[MEDIUM · chat] resumeSid persists across agent switch** — `app.js:149-168`: clear `resumeSid`/`resumeNote` in `selectAgent` when `id !== 'claude-code'`, and gate the banner (474), status sub (527), and forwarded arg (662) on `selectedAgent === 'claude-code'` (stale sid wrongly triggers agy `--continue`).
+6. **[MEDIUM · chat] scrollChatToBottom queries dead `.chat-thread`** — `app.js:133-142`: prefer `.agentchat-thread` (the kit's real scroller), keep `.chat-thread`/`#agentgui-main` as fallbacks.
+7. **[MEDIUM · history] Live events not deduped vs snapshot** — `app.js:282-285`: after the unwrap (#4), guard `state.events.push` with `ev.i != null && state.events.some(e => e.i === ev.i)` and count each `ev.i` once via a per-session Set.
+8. **[MEDIUM · settings] Schemeless backend URL validated-but-stored-raw** — `app.js:998-1013`: normalize on save (`new URL(...).origin`), validate/store/use the same canonical string so `localhost:3000` can't resolve against the page origin.
+9. **[MEDIUM · settings] clear-local-data leaves in-memory state that re-persists** — `app.js:1090-1098`: zero `selectedAgent`/`selectedModel`/`chatCwd`/`backend`/`backendDraft`/`agentModels` (don't re-call `B.setBackend('')` which rewrites the key), or `location.reload()` after clearing.
+10. **[LOW · chat] Aborted-empty turn not pruned from in-memory array** — `app.js:599-604`: in `cancelChat`, `state.chat.messages = state.chat.messages.filter(m => !isEmptyTurn(m))` so `messages.length`-derived UI isn't off-by-one (persist only filters its snapshot, never the live array).
+11. **[LOW · history] Search-hit focus scroll races live append** — `app.js:1228-1234`: snapshot the target event's `.i`/`.ts`, re-derive `rowPos` inside the rAF from current `state.events`, bail if it moved.
+12. **[LOW · history] Search results ignore subagent/project filters** — `app.js:904-921`: apply the same `showSubagents`/`projectFilter` gating as `visibleSessions` before slicing (or label the header "incl. hidden").
+13. **[LOW · settings] preferencesPanel cwd "(current: X)" can misrepresent running chats** — `app.js:1108-1109`: relabel as "default for new chats" or derive the displayed cwd from in-flight `chat.active` ctrl.cwd.
+
+## APP — consistency / vocabulary (low, batch together)
+
+14. **[MEDIUM · consistency] Status bar says 'live' where crumb/health say 'connected'** — `app.js:387`: use `ok ? 'connected' : 'offline'`; reserve 'live' for the history SSE label (335).
+15. **[MEDIUM · consistency] agentsPanel rail inverts purple=subagent contract** — `app.js:1152`: `rail: avail ? 'green' : 'flame'` (selection already shown via `active`); purple must stay subagent-only.
+16. **[LOW · settings] db chip absent on partial /health + 'N active' is dead text** — `app.js:1022-1040`: always render `db unknown` when `hh.db` absent; make the active-executions chip a button routing to history's running panel.
+17. **[LOW · consistency] Resume label noun vs gerund** — `app.js:527`: `'resuming…'` to match banner + sibling gerund statuses.
+18. **[LOW · consistency] Literal '...' in resume banner** — `app.js:479`: drop the trailing `...` (it's a fixed 8-char slice, not a truncation) or use `…`.
+19. **[LOW · consistency] ACP 'running·healthy' tight middot vs spaced separator** — `app.js:1144`: `'running healthy'` so `·` keeps one meaning.
+20. **[LOW · consistency] db 'ok/down' reuses vocabulary the connection chip translated away** — `app.js:1037`: `db online/offline` to match the connection register.
+
+## KIT (c:\dev\anentrypoint-design) — requires build + publish to unpkg
+
+21. **[HIGH · perf] Streaming re-parses full growing markdown every rAF (O(n²))** — `chat.js:82-90` MdNode: parse markdown once on turn-complete; render the live turn as cheap inline/plain text while streaming (gate on `isStreaming`), promote to `{kind:'md'}` only when settled.
+22. **[HIGH · responsive] Chat control cluster + cwd bar have no media queries** — `chat.css`: add `@media` breakpoints for `.agentchat-controls`/`.agentchat-cwd-text` (the 360/640/900 rules in index.html target dead `.chat-controls`/`.cwd-bar`; also delete that dead CSS in `index.html`).
+23. **[MEDIUM · a11y] EventList Row toggle never emits aria-expanded** — `content.js:23,39-50`: add an `expanded` prop → `aria-expanded` on the button branch; app passes the boolean at `app.js:796-806`.
+24. **[MEDIUM · responsive] cwd `max-width:60ch` overflows phones** — `chat.css:59-64`: `max-width: min(60ch, 60vw)` (+ optional 640px 42vw clamp).
+25. **[MEDIUM · responsive] Hamburger 36px + drawer rows ~40px + send button under 44px** — `247420.css` source: raise `.app-side-toggle` and `.app-side a` and the small/landscape composer `send` to min 44×44 (WCAG 2.5.5).
+26. **[MEDIUM · security] marked/dompurify imported from unpinned CDN** — `markdown.js:9-26`: vendor marked+dompurify locally (dynamic import can't carry SRI) and ship a `script-src 'self'` CSP; success/fallback sanitization paths are already safe.
+27. **[LOW · perf] CodeNode highlight cache key uses code LENGTH not content** — `chat.js:95-97`: key on full `p.code` (or export+use `simpleHash`) so same-length blocks re-highlight.
+28. **[LOW · a11y] `.agentchat-cwd-btn` has no :focus-visible** — `chat.css`: add `:focus-visible` ring mirroring `.agentchat-empty-suggestion`.
+29. **[LOW · a11y] Native select pickers have title-only accessible name** — `agent-chat.js:36-48`: pass `label:` (visible or sr-only) to the agent/model `Select`.
+30. **[LOW · consistency] Head sub-line re-derives 'streaming…' ignoring status prop** — `agent-chat.js:175`: derive from the same `status` prop (`busy ? (status||'streaming…') : …`) so reconnecting-while-streaming reads one word.
+31. **[LOW · glyph] Box-drawing dividers in OS-kit comments** — `src/kits/os/app-panes.css:4,51,114`: replace `──` with `---` (comment-only; not the shipped AgentChat surface).
+
+## BOTH (coordinated app + kit + publish)
+
+32. **[HIGH · chat] Text and tool parts don't interleave — all prose renders before every tool card** — `app.js:673-675` + `agent-chat.js:114-124`: model the assistant turn as one ordered `parts[]` (append/extend `{kind:'md'}` segments and tool parts in arrival order; tool boundary closes the md segment); drop the forced `m.content` prepend in the kit and render `parts` strictly in order. This is the core chat-jank fix and supersedes the standalone perf concern in #21 about ordering.
+33. **[MEDIUM · chat] Orphan tool_result renders as detached bottom card** — `app.js:446-457`: ids already match on both runner paths, so harden the client fallback — attach an unmatched result to the most recent running tool part (or insert after the last tool part) rather than pushing to array end. Compounds #32.
+34. **[MEDIUM · history] Same event kinds render differently in chat vs history** — `app.js:773-808` + kit ToolCallNode: generalize the kit's ToolCallNode so EventList rows accept structured `{kind:'tool',...}` parts, then route history tool_use/tool_result through the same `toolPart`/`applyToolResult` pairing chat uses (preserve green/purple/flame rails).
+
+## PERF — confirmed no-fix (mitigating context)
+
+- `app.js:264,1306` relTime/resize full re-render: acceptable (rAF-coalesced); resolves once #36 row-build is lazy.
+- `app.js` webjsx keying: stable, no collision — this is why the perf findings stay at vnode-build cost, not DOM teardown.
+
+## APP — remaining perf (high/medium)
+
+35. **[HIGH · perf] Full app tree re-renders per rAF during stream** — `app.js:78-86`: scope the streaming re-render to the active transcript/bubble rather than rebuilding Topbar/Crumb/Status/panels every token (pairs with kit #21).
+36. **[HIGH · perf] EventList computes `full`+JSON.stringify for all ~300 rows every frame** — `app.js:790`: build `full` (and `JSON.stringify(e.toolInput,...)`) only when the row is `expanded`.
+37. **[MEDIUM · perf] O(sessions) linear scan per live event** — `app.js:287-299`: build `state.sessionsBySid = new Map(...)` on each refresh, `.get(data.sid)` instead of `arr.find`.
+38. **[MEDIUM · perf] scrollChatToBottom nests a 2nd rAF + re-querySelector per frame** — `app.js:133-142`: cache the scroller (re-query only if detached), drop the inner rAF (caller already in a frame). Folds into #6.

package/lib/http-handler.js

@@ -6,9 +6,41 @@ import * as term from './terminal.js';
 
 export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, serveFile, staticDir, messageQueues, getWss, activeExecutions, getACPStatus, discoveredAgents, PKG_VERSION, RATE_LIMIT_MAX, rateLimitMap, routes, PORT }) {
   return async function httpHandler(req, res) {
-    res.setHeader('Access-Control-Allow-Origin', '*');
+    // CORS: when PASSWORD is set the server holds credentials a cross-origin
+    // page must not be able to spend, so we do NOT advertise a wildcard origin
+    // (a wildcard + a leaked Bearer/token would let any site the user visits
+    // drive this server). Reflect an explicitly-allowed origin (CORS_ORIGIN)
+    // when configured, else same-origin only. With no PASSWORD the server is
+    // already open, so the permissive wildcard is harmless and kept for tools.
+    const _corsOrigin = process.env.CORS_ORIGIN;
+    if (_corsOrigin) {
+      res.setHeader('Access-Control-Allow-Origin', _corsOrigin);
+      res.setHeader('Vary', 'Origin');
+    } else if (!process.env.PASSWORD) {
+      res.setHeader('Access-Control-Allow-Origin', '*');
+    } // else: no ACAO header -> browsers block cross-origin reads (same-origin still works)
     res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
     res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+    // The password can ride in a ?token= query param (EventSource/deep-links
+    // can't set headers), so a navigation away from the app would leak it in
+    // the Referer header to the destination. Strip the referrer on every
+    // response so the credential never crosses an origin boundary that way.
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    // CSP: the markdown stack (marked/dompurify/prismjs) and the DS kit load
+    // from unpkg/jsdelivr; everything else is self. connect-src also allows
+    // self for the same-origin WS/SSE. 'unsafe-inline' on style/script is
+    // required by the inlined head bootstrap + DS runtime <style> injection.
+    res.setHeader('Content-Security-Policy', [
+      "default-src 'self'",
+      "script-src 'self' 'unsafe-inline' https://unpkg.com https://cdn.jsdelivr.net",
+      "style-src 'self' 'unsafe-inline' https://unpkg.com https://cdn.jsdelivr.net https://fonts.googleapis.com",
+      "img-src 'self' data: blob:",
+      "font-src 'self' data: https://unpkg.com https://cdn.jsdelivr.net https://fonts.gstatic.com",
+      "connect-src 'self' https://unpkg.com https://cdn.jsdelivr.net ws: wss:",
+      "object-src 'none'",
+      "base-uri 'self'",
+      "frame-ancestors 'self'",
+    ].join('; '));
     if (req.method === 'OPTIONS') { res.writeHead(200); res.end(); return; }
     if (req.headers.upgrade && req.headers.upgrade.toLowerCase() === 'websocket') return;
 
@@ -124,12 +156,31 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
         const normalizedPath = path.normalize(expandedPath);
         const isWindows = os.platform() === 'win32';
         const isAbsolute = isWindows ? /^[A-Za-z]:[\\\/]/.test(normalizedPath) : normalizedPath.startsWith('/');
-        if (!isAbsolute || normalizedPath.includes('..')) { res.writeHead(403); res.end('Forbidden'); return; }
+        // Confine reads to an allowlist root. Without this the route is an
+        // arbitrary-file-read of any image-extensioned path on the host (the
+        // prior `includes('..')` guard is a no-op after path.normalize resolves
+        // the segments). Allowed roots: the Claude projects dir (history images)
+        // only; add more via IMAGE_ROOTS (path-separated). The user home is NOT
+        // a default root - it covers ~/.ssh, ~/.aws, dotfiles etc., so an image
+        // route reaching all of home is a broad read of anything image-shaped.
+        const allowRoots = [
+          process.env.CLAUDE_PROJECTS_DIR || path.join(os.homedir(), '.claude', 'projects'),
+          ...(process.env.IMAGE_ROOTS ? process.env.IMAGE_ROOTS.split(path.delimiter) : []),
+        ].map(r => path.normalize(r));
+        const norm = isWindows ? normalizedPath.toLowerCase() : normalizedPath;
+        const withinAllowed = allowRoots.some(root => {
+          const r = isWindows ? root.toLowerCase() : root;
+          return norm === r || norm.startsWith(r + path.sep);
+        });
+        if (!isAbsolute || !withinAllowed) { res.writeHead(403); res.end('Forbidden'); return; }
         try {
           if (!fs.existsSync(normalizedPath)) { res.writeHead(404); res.end('Not found'); return; }
           const ext = path.extname(normalizedPath).toLowerCase();
           const mimeTypes = { '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp', '.svg': 'image/svg+xml' };
-          const contentType = mimeTypes[ext] || 'application/octet-stream';
+          // Only serve known image types - never an octet-stream fallback, which
+          // would turn this into a generic file reader for any extension.
+          const contentType = mimeTypes[ext];
+          if (!contentType) { res.writeHead(403); res.end('Forbidden'); return; }
           res.writeHead(200, { 'Content-Type': contentType, 'Cache-Control': 'no-cache' });
           res.end(fs.readFileSync(normalizedPath));
         } catch (err) { sendJSON(req, res, 400, { error: err.message }); }

package/lib/ws-handlers-util.js

@@ -70,6 +70,14 @@ export function register(router, deps) {
     const cwd = p?.cwd || STARTUP_CWD;
     const resumeSessionId = p?.resumeSid || p?.resumeSessionId || undefined;
     if (!registry.has(agentId)) err(404, `Unknown agentId: ${agentId}`);
+    // A client-supplied cwd that doesn't exist would have the agent CLI spawn
+    // fail opaquely (or inherit STARTUP_CWD on some runners). Validate up front
+    // so the caller gets a clear 400 instead of a confusing mid-stream error.
+    if (p?.cwd) {
+      let st = null;
+      try { st = fs.statSync(cwd); } catch (_) {}
+      if (!st || !st.isDirectory()) err(400, `cwd is not an existing directory: ${cwd}`);
+    }
 
     const sessionId = 'chat-' + crypto.randomBytes(8).toString('hex');
     // Auto-subscribe the originating ws so it receives its own broadcasts.
@@ -85,8 +93,17 @@ export function register(router, deps) {
     (async () => {
       let eventCount = 0;
       broadcastSync({ type: 'streaming_start', sessionId, agentId, timestamp: Date.now() });
+      let claudeSessionBroadcast = false;
       const onEvent = (parsed) => {
         eventCount++;
+        // Surface claude's REAL session id (from the stream) once, so the client
+        // can --resume this conversation on its next turn. The ephemeral
+        // 'chat-...' sessionId is not a claude session id and cannot be resumed.
+        if (!claudeSessionBroadcast && parsed?.session_id) {
+          claudeSessionBroadcast = true;
+          ctrl.claudeSessionId = parsed.session_id;
+          broadcastSync({ type: 'streaming_session', sessionId, claudeSessionId: parsed.session_id, agentId, timestamp: Date.now() });
+        }
         if (parsed?.type === 'assistant' && parsed.message?.content) {
           for (const block of parsed.message.content) {
             broadcastSync({ type: 'streaming_progress', sessionId, block, blockRole: 'assistant', seq: eventCount, timestamp: Date.now() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.948",
+  "version": "1.0.950",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",
@@ -43,7 +43,7 @@
     "webjsx": "^0.0.73",
     "webtalk": "^1.0.31",
     "ws": "^8.14.2",
-    "xstate": "^5.28.0",
+    "xstate": "^5.32.0",
     "zod": "^4.3.6"
   },
   "devDependencies": {

package/site/app/index.html

@@ -5,15 +5,16 @@
   <meta name="viewport" content="width=device-width,initial-scale=1">
   <title>agentgui</title>
   <meta name="description" content="agentgui - multi-agent client with same-origin server, in-process ccsniff history, and ACP chat.">
-  <!-- The GUI lives in the anentrypoint-design kit and is loaded from unpkg at
-       its latest published version, so agentgui always tracks the kit without a
-       hand-maintained vendored copy. (This trades the prior offline guarantee for
-       always-latest, per project decision; a network connection is required.)
-       NOTE: re-vendoring 0.0.186+ locally (it adds the load-bearing AgentChat
-       component) would restore offline + predictability -- tracked in AGENTS.md. -->
-  <link rel="stylesheet" href="https://unpkg.com/anentrypoint-design@latest/dist/247420.css">
+  <!-- The GUI lives in the anentrypoint-design kit and is vendored locally under
+       ./vendor/anentrypoint-design so the shipped UI is PREDICTABLE: it does not
+       silently shift when the upstream package publishes, and it works offline
+       (the markdown stack still fetches marked/dompurify/prismjs on first chat
+       render). Update flow: edit the kit at c:\dev\anentrypoint-design, run
+       `node scripts/build.mjs`, copy dist/247420.{js,css} here, then publish the
+       kit so unpkg stays in sync. -->
+  <link rel="stylesheet" href="./vendor/anentrypoint-design/247420.css">
   <script type="importmap">
-    { "imports": { "anentrypoint-design": "https://unpkg.com/anentrypoint-design@latest/dist/247420.js" } }
+    { "imports": { "anentrypoint-design": "./vendor/anentrypoint-design/247420.js" } }
   </script>
   <style>
     :root {
@@ -72,14 +73,8 @@
     .ds-247420 [data-prog-focus]:focus-visible,
     [data-prog-focus]:focus, [data-prog-focus]:focus-visible { outline: none !important; box-shadow: none !important; }
 
-    /* skip link for keyboard/AT users */
-    .skip-link {
-      position: absolute; left: -9999px; top: 0; z-index: 1000;
-      padding: .5em .9em; border-radius: 6px;
-      background: var(--accent, var(--agentgui-accent)); color: #06120a;
-      text-decoration: none; font-weight: 600;
-    }
-    .skip-link:focus { left: 8px; top: 8px; outline: 2px solid #fff; outline-offset: 2px; }
+    /* (The skip link is rendered + styled by the design system's AppShell;
+       agentgui carries no local .skip-link rule.) */
 
     /* status connection dot - a CSS-drawn disc (real UI affordance, not a text
        glyph). The .status-dot-disc child is always present; the parent's state
@@ -260,6 +255,15 @@
        them a pointer cursor, so the affordance is invisible. */
     .ds-event-list .row[role="button"] { cursor: pointer; }
     .ds-event-list .row[role="button"]:hover { background: color-mix(in srgb, var(--fg, var(--agentgui-fg)) 5%, transparent); }
+    /* Flash the row a search result landed on, so the match is obvious. */
+    .ds-event-list .row.event-flash { animation: agentgui-event-flash 2s ease-out; }
+    @keyframes agentgui-event-flash {
+      0%   { background: color-mix(in srgb, var(--accent, var(--agentgui-accent)) 40%, transparent); }
+      100% { background: transparent; }
+    }
+    @media (prefers-reduced-motion: reduce) {
+      .ds-event-list .row.event-flash { animation: none; outline: 2px solid var(--accent, var(--agentgui-accent)); }
+    }
 
     /* Chat composer: hide the idle scrollbar on the (empty/short) textarea. */
     .chat-composer textarea { overflow-y: auto; scrollbar-width: thin; }