agentgui 1.0.951 → 1.0.952
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/AGENTS.md +1 -5
- package/package.json +1 -1
package/AGENTS.md
CHANGED
|
@@ -2,11 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
## GUI-audit closure (2026-06-04 fan-out) — second maximum-effort sweep
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
- **Server `lib/http-handler.js`:** `/api/image` allowlist no longer includes `os.homedir()` (was a broad image-shaped read of all of `$HOME`); unknown extensions 403 instead of an `application/octet-stream` fallback. Always emits `Referrer-Policy: no-referrer` (so a `?token=` credential can't leak via `Referer`) and a **CSP** (`default-src 'self'`; script/style self+unsafe-inline+unpkg+jsdelivr; `style-src` also `fonts.googleapis.com`, `font-src` also `fonts.gstatic.com` — the kit's Google Fonts, a regression caught live; `connect-src` self+cdns+ws/wss; `object-src 'none'`). `lib/ws-handlers-util.js` validates a client-supplied chat `cwd` is an existing directory (`fs.statSync`) before spawn.
|
|
8
|
-
- **App `site/app/js/app.js`:** live SSE events are `{sid, payload:fl}` (ccsniff `store.js`) — unwrap `data.payload` (counters were reading `undefined`); dedupe by `.i`; `state.sessionsBySid` Map for O(1) per-event lookup; `scrollChatToBottom` targets `.agentchat-thread` (cached) not the dead `.chat-thread`; resume state cleared on switch off claude-code and banner/status/forwarded-arg all gated on claude-code; backend URL normalized to its origin on save; clear-local-data `location.reload()`s; status vocab unified (`connected`/`offline`, `db online/offline/unknown`, `running healthy`); agentsPanel rail `green`/`flame` (purple reserved for subagents); a non-resume warning banner for non-claude-code multi-turn chats.
|
|
9
|
-
- **Kit `c:\dev\anentrypoint-design`:** `AgentChat` renders the live-streaming turn's prose as cheap inline text and promotes to full markdown only once settled (MdNode was re-parsing the whole growing answer every frame, O(n²)); head sub-line derives its busy label from the `status` prop; `Row`/`EventList` gained an `expanded` prop driving `aria-expanded`; `CodeNode` highlight cache keys on the full code not its length; `chat.css` responsive `@media` for the control cluster + `min(60ch,60vw)` cwd clamp + `.agentchat-cwd-btn:focus-visible`; `app-shell.css` 44×44 min tap targets (side-toggle + landscape composer send); box-drawing comment glyphs -> ASCII.
|
|
5
|
+
`.claude/workflows/gui-audit.js` ran a 64-agent fan-out (9 per-surface reviewers -> adversarial verify -> synthesize) -> 44 confirmed findings (`AUDIT-PUNCHLIST.md`, 38 deduped), all fixed across server/app/kit and pushed (agentgui `eb1eab3`/`951404e`, kit `anentrypoint-design` `bb776aa` -> CI publishes npm/unpkg). Per-finding detail + key learnings (ccsniff SSE `{sid,payload}` unwrap, CSP must allow Google Fonts, DS `Select` promotes `title`->`aria-label`, index.html now loads the kit from local `./vendor/`, kit publish flow) in rs-learn (recall "agentgui GUI-audit closure").
|
|
10
6
|
|
|
11
7
|
## Architecture (2026-05-19 pivot — single surface)
|
|
12
8
|
|