agentgui 1.0.977 → 1.0.979

package/AGENTS.md

@@ -2,19 +2,11 @@
 
 ## GUI quality sweep (2026-06-19) — seventeenth run
 
-Two-pass: first pass applied A1-A11 app.js fixes + K1-K10 kit fixes from prior audit; second pass ran **gui-audit (wf_bcac251f-d54, 10 lenses, 48 agents -> 25 confirmed findings, ~1.6M tokens)**. Applied across backend.js / app.js / design kit. Critical fixes: absIdx undefined crash in history pane, Prism `new Function` blocked by CSP → script injection with Promise.all tiers, scrollChatToBottom forced reflow in rAF removed, sessions drawer only closing at <640px (should be <=1100px), thinking-block type dispatched to ThinkingNode. Also: rail tone all-green bug, '...' → '…' consistency, crumb dot prefixed with 'stream:' on history tab, saveBackend re-probes on same URL, clearLocalData confirm resets on tab nav, `_liveTick` self-clears, `[class*="kit-"]` fragile selector removed, Esc listener leak in closeWsDrawers. validate-mutations 29/29; test.js 10/0; browser 0 console errors. Kit pushed fe7050a→03d9d07; agentgui 9dddcdd→92a69a9.
+Two-pass 48-agent audit (wf_bcac251f-d54, 25 confirmed). Critical: absIdx ReferenceError crash in history, Prism new Function → CSP-safe script injection + Promise.all tiers, scrollChatToBottom rAF reflow removed, sessions drawer <=1100px fix, thinking block dispatched. Full detail in rs-learn (recall "agentgui 17th run").
 
 ## Design-maturity sweep + dead-code + secret-hardening (2026-06-18) — sixteenth run
 
-Same mandate ("fix every aspect, all design lives in ../design, fan out subagents, track with a workflow"). One tracking Workflow **`gui-design-16` (run `wf_6479308b-24f`, 12 lenses chat-thread/composer-input/files-browser/sessions-dashboard/shell-chrome/tokens-theme/a11y-motion/history-settings/marketing-site/glyph-residue/dead-code/server-security): 54 agents -> hunt -> adversarial verify -> 40 confirmed findings, ~2.7M tokens.** Applied via a clean per-file subagent fan-out (one agent per physical file, zero edit conflicts).
-
-**Kit fixes (ALL in `/config/workspace/design`):** chat.js ToolCallNode now gates the `args` section on real args (`hasArgs`) so result-only/arg-less cards no longer show `args {}` + composer `<textarea>` binds the `disabled` prop; agent-chat.js cwd input emits `aria-busy` while checking; content.js EventList now forwards `detail/actions/highlight/meta` to Row (expanded history events were dropping toolInput detail + copy + search-highlight) + TextField gained a full invalid/error state (`error`/`aria-invalid`/`aria-describedby`/`.ds-field-error` role=alert); interaction-primitives.js ShortcutList splits combos into discrete `.ds-kbd` caps (`.ds-kbd-caps`/`.ds-kbd-sep` + CSS) instead of one wide cap; sessions.js ConversationList rail filter migrated from bespoke `.ds-session-search` to the shared `SearchInput`/`.ds-search-input` (one filter control across rail + dashboard); shell.js WsResizer adds `aria-valuetext "<n> pixels"`; voice.js `×`->`Icon('x')`, community.js `⋯`->`'more'` (glyph residue). chat.css: cwd `.is-checking` hint tone + `aria-busy` field cue + cwd-btn `6px`->`var(--r-1)`, breakdown idle disc moved off the connecting-amber to canonical `--stale` double-inset, breakdown running disc shape-ring, `.ds-dash-clear` hover/focus-visible, `.chat-tool-copy:focus-visible`, errors-toggle AA fix, ds-session-search base block removed. app-shell.css: composer + WorkspaceShell (`.ws-rail/.ws-pane/.ws-sessions/.ws-scrim`) reduced-motion guards, `.ds-file-row.is-locked/.is-restricted` + `.ds-file-perm-tag` chip, `.ws-drawer-toggle` 44px coarse floor, `.ds-density-btn.active`/`.ds-filter-pill.active` AA contrast (`color:var(--fg)`), ShortcutList legend rules. editor-primitives.css `#000` dock shadow->`var(--shadow-3)` + checkbox `#fff` fallback dropped. app-surfaces.css `@media print` re-asserts paper-tuned signal tokens. community.css `:focus-visible` for ThreadPanel/Forum/Page + forum-search. marketing.css NEW `.site-footer` family (theme.mjs footers migrated off the in-app `.app-status` strip that suppressed content <=1100px) + `.site-cli` baseline+card-chrome + token paddings + `100dvh` embed.
-
-**Server secret-hardening (`lib/http-handler.js`, the high-sev cluster):** the module-level `SECRET_RE` (already blocking `/api/file`+`/api/download`) is now ALSO applied to `/api/upload-file`, `/api/mkdir`, `/api/rename` (403 on a secret/dotfile target name — was an overwrite-a-secret hole) and `/api/list` (filters secret-named dirents from the listing — was enumerating `.env`/`.pem` the preview/download routes block); `/api/download` Content-Disposition is now RFC-5987 encoded (ASCII `filename=` fallback + `filename*=UTF-8''<pct>`) so a CJK/emoji name no longer throws `ERR_INVALID_CHAR`. `validate-mutations.mjs` 26/26 PASS, no regression.
-
-**Dead-code removal:** agentgui `site/app/vendor/cdn/` (36 dead files — marked/dompurify/prismjs/fonts, zero refs; markdown stack fetches jsDelivr at runtime), `scripts/harvest-fixtures.mjs` (zero refs), and the 3 `node scripts/copy-vendor.js` lines in `.github/workflows/build-platforms.yml` (script deleted in the 15th run — CI was broken); kit `scripts/bundle-markdown.mjs` (orphaned, superseded by src/markdown.js). 
-
-**Witnessed** (localhost:3009/gm/?token, PASSWORD=`123,slam,123,slam`, fresh server + re-vendored dist, via gm `browser` verb): readyState complete, `ds-247420` dark body `rgb(19,19,24)`, 3 resizers, hScroll 0, rail `ds-search-input`=1 / bespoke `ds-session-search`=0 (consolidation landed), `ds-file-perm-tag`/`site-footer`/`ds-kbd-caps` rules all resolve, **0 console errors**. Kit build all 4 lints PASS. `test.js` 10 pass/0 fail. Re-vendored `dist/247420.{css,js}`.
+54-agent workflow gui-design-16 (wf_6479308b-24f, 12 lenses, 40 confirmed). SECRET_RE extended to upload/mkdir/rename/list; RFC-5987 Content-Disposition; dead vendor/cdn/ 36 files + harvest-fixtures + CI copy-vendor lines removed. Full detail in rs-learn (recall "agentgui 16th run").
 
 ## Design-maturity sweep + dead-code + server-hardening (2026-06-18) — fifteenth run
 

package/lib/ws-handlers-util.js

@@ -90,9 +90,17 @@ export function register(router, deps) {
   // Bypasses the gutted db-queries layer entirely; calls runClaudeWithStreaming
   // directly and broadcasts streaming_* events scoped to an ephemeral sessionId.
   router.handle('chat.sendMessage', async (p, ws) => {
-    const content = (p?.content || '').toString();
+    let content = (p?.content || '').toString();
     if (!content) err(400, 'content required');
     const agentId = p?.agentId || 'claude-code';
+    // For non-resume agents (not claude-code which uses --resume), prepend prior
+    // conversation turns so the agent has context. claude-code handles multi-turn
+    // natively via resumeSessionId; direct runners (agy, etc.) get a preamble.
+    const priorMessages = Array.isArray(p?.messages) ? p.messages.filter(m => m?.role && m?.content) : [];
+    if (agentId !== 'claude-code' && !p?.resumeSid && !p?.resumeSessionId && priorMessages.length > 0) {
+      const preamble = priorMessages.map(m => (m.role === 'user' ? 'User: ' : 'Assistant: ') + (m.content || '').trim()).join('\n\n');
+      content = '[Prior conversation]\n' + preamble + '\n\n[Current message]\n' + content;
+    }
     const model = p?.model || undefined;
     const subAgent = p?.subAgent || undefined;
     const cwd = p?.cwd || STARTUP_CWD;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.977",
+  "version": "1.0.979",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -2275,7 +2275,7 @@ async function sendChat(textArg) {
       agentId: state.selectedAgent,
       model: state.selectedModel || undefined,
       cwd: state.chatCwd || undefined,
-      messages: state.chat.messages.slice(0, -1).map(m => ({ role: m.role, content: m.content })),
+      messages: state.chat.messages.slice(0, -1).map(m => ({ role: m.role, content: m.content || messageToText(m) })),
       signal: ctrl.signal,
       // Only claude-code consumes a resume sid; never forward a stale one to
       // another agent (it makes agy spuriously run --continue).
@@ -2558,6 +2558,7 @@ function historyMain() {
           const errMark = e.isError ? ' · error' : '';
           const raw = e.text || '';
           const text = raw.replace(/\s+/g, ' ').trim();
+          const typePrefix = e.type === 'tool_result' ? '(result) ' : (e.type === 'tool_use' ? '(tool call) ' : '');
           const expanded = state.expandedEvents.has(key);
           // Only build the expanded body (JSON.stringify tool input) when the row is
           // expanded - doing it for all ~300 rows every frame wastes work mid-stream.
@@ -2569,7 +2570,7 @@ function historyMain() {
           // When the session was opened from a search hit, window the collapsed
           // title AROUND the first query match (a match at char 5000 would
           // otherwise be invisible behind the 0-220 slice).
-          let collapsedTitle = text.slice(0, 220);
+          let collapsedTitle = typePrefix + text.slice(0, 220);
           const q = state.sessionSearchQ;
           if (q && !expanded) {
             const qi = text.toLowerCase().indexOf(q.toLowerCase());
@@ -2585,7 +2586,7 @@ function historyMain() {
               label: 'copy', title: 'copy event',
               onClick: () => copyText(full || raw || ('(' + type + ')'), 'event copied'),
             }] : undefined,
-            title: expanded ? (text || '(' + type + ')') : (collapsedTitle || '(' + type + ')'),
+            title: expanded ? (typePrefix + (text || '(' + type + ')')) : (collapsedTitle || typePrefix + '(' + type + ')'),
             detail: expanded && e.toolInput ? JSON.stringify(e.toolInput, null, 2) : undefined,
             // Guard ts: a missing/zero timestamp renders "Invalid Date" otherwise.
             // Every row is click-to-expand, so always show the affordance word