agentgui 1.0.999 → 1.0.1001

package/lib/http-handler.js

@@ -362,6 +362,10 @@ export function createHttpHandler({ BASE_URL, expressApp, queries, sendJSON, ser
           status: 'ok', version: PKG_VERSION, uptime: process.uptime(), agents: discoveredAgents.length,
           activeExecutions: activeExecutions.size, wsClients: getWss()?.clients?.size ?? 0,
           acp: getACPStatus(), db: dbStatus, queueSizes,
+          // Surfaces the console-only CORS_ORIGIN=*+no-PASSWORD warning (above)
+          // as a fact the GUI settings panel can render a persistent banner
+          // from - an operator not tailing logs otherwise never sees the risk.
+          corsWildcardOpen: process.env.CORS_ORIGIN === '*' && !process.env.PASSWORD,
         };
         // Host-internal facts (memory, filesystem paths) are exposed only to an
         // authenticated caller, never on the unauthenticated health-probe bypass.

package/lib/ws-setup.js

@@ -60,6 +60,10 @@ export function createWsSetup(server, { BASE_URL, watch, staticDir, _assetCache,
         }
         debugLog(`[WebSocket] Client ${ws.clientId} disconnected`);
       });
+    } else {
+      // No handler owns this route - close it rather than leaving an
+      // authenticated socket open and idle (it would never be serviced).
+      ws.close(4404, 'unknown-route');
     }
   });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentgui",
-  "version": "1.0.999",
+  "version": "1.0.1001",
   "description": "Multi-agent ACP client with real-time communication",
   "type": "module",
   "main": "electron/main.js",

package/site/app/js/app.js

@@ -345,6 +345,10 @@ function activeSig(list) {
   return (Array.isArray(list) ? list : []).map(a => a.sessionId + ':' + (a.claudeSessionId || '') + ':' + (a.model || '') + ':' + (a.startedAt || '')).sort().join('|');
 }
 async function refreshActive() {
+  // A backgrounded tab still holds its interval timer, but polling every ~3.3s
+  // while hidden is needless server load across many left-open tabs - skip the
+  // network call (and let the next visible tick catch up).
+  if (typeof document !== 'undefined' && document.hidden) return;
   let next;
   try { next = await B.listActiveChats(state.backend); } catch { return; }
   const changed = activeSig(next) !== activeSig(state.active);
@@ -366,6 +370,10 @@ function startActivePolling() {
   refreshActive();
   // Small jitter so many tabs don't hit the server in lockstep.
   state.activeTimer = setInterval(refreshActive, 3000 + Math.floor(Math.random() * 600));
+  if (!state._visActiveBound && typeof document !== 'undefined') {
+    state._visActiveBound = true;
+    document.addEventListener('visibilitychange', () => { if (!document.hidden) refreshActive(); });
+  }
 }
 function stopActivePolling() {
   if (state.activeTimer) { clearInterval(state.activeTimer); state.activeTimer = null; }
@@ -606,7 +614,7 @@ function view() {
   // main content, and an optional right context pane. The rail replaces the old
   // Topbar tabs; it collapses to icon-only and, on mobile, behind its own toggle.
   const rail = workspaceRail();
-  const sessions = (state.tab === 'chat' || state.tab === 'history') ? sessionsColumn() : null;
+  const sessions = (state.tab === 'chat' || state.tab === 'history' || state.tab === 'live') ? sessionsColumn() : null;
   // Right context pane. On chat it carries agent/model/cwd + the live running-tool
   // count + last-turn usage. On files it hosts the inline file preview (split view).
   // On other tabs it is null but the shell keeps the column TRACK (stableFrame) so
@@ -623,6 +631,13 @@ function view() {
         turns: state.chat.messages.filter(m => m.role === 'user').length,
         cost: state.chat.totalCost || null,
       },
+      recentFiles: recentSessionFiles(),
+      onOpenFile: (path) => {
+        const base = pathBasename(path);
+        const dir = base === path ? '' : path.slice(0, path.length - base.length - 1);
+        navTo('files');
+        loadDir(dir);
+      },
       // One affordance per action: the cwd row opens the SAME inline editor as
       // the composer context line (it validates via /api/stat) instead of
       // navigating away to the Files tab.
@@ -638,7 +653,11 @@ function view() {
 
 // The left workspace rail: brand, New chat action, and the primary view nav.
 function workspaceRail() {
-  const liveCount = (Array.isArray(state.active) ? state.active.length : 0);
+  // Same owned+external session set the Live dashboard renders, so the nav
+  // badge count and error tone never diverge from what the dashboard shows.
+  const liveSessions = computeLiveSessions();
+  const liveCount = liveSessions.length;
+  const liveHasError = liveSessions.some((s) => s.status === 'error');
   // Show a live pulse on the chat rail item when a stream is in progress but the
   // user has navigated to a different tab - so the background stream stays visible.
   const chatStreaming = state.chat.busy && state.tab !== 'chat';
@@ -646,7 +665,7 @@ function workspaceRail() {
     { key: 'chat', label: 'Chat', icon: 'forum', active: state.tab === 'chat', count: chatStreaming ? 1 : null, onClick: () => navTo('chat') },
     { key: 'history', label: 'History', icon: 'thread', active: state.tab === 'history', onClick: () => navTo('history') },
     { key: 'files', label: 'Files', icon: 'folder', active: state.tab === 'files', onClick: () => navTo('files') },
-    { key: 'live', label: 'Live', icon: 'activity', active: state.tab === 'live', count: liveCount || null, onClick: () => navTo('live') },
+    { key: 'live', label: 'Live', icon: 'activity', active: state.tab === 'live', count: liveCount || null, rail: liveHasError ? 'flame' : undefined, onClick: () => navTo('live') },
     { key: 'settings', label: 'Settings', icon: 'settings', active: state.tab === 'settings', onClick: () => navTo('settings') },
   ];
   return WorkspaceRail({
@@ -748,6 +767,10 @@ function sessionsColumn() {
   const sessionsView = visibleSessions();
   const sliced = sessionsView.slice(0, state.sessionsLimit);
   const runningSids = new Set((Array.isArray(state.active) ? state.active : []).map(a => a.claudeSessionId || a.sessionId));
+  // Same status computation the Live tab uses (running/stale/error), keyed by
+  // realSid, so a session pinned to the rail's "Running" group shows whether it
+  // is actually stuck vs busy instead of just a plain live dot.
+  const liveStatusBySid = new Map(computeLiveSessions().map((s) => [s.realSid, s.status]));
   const items = sliced.map((s) => {
     const title = projectLabel(s.title) || projectLabel(s.project) || s.sid;
     const project = projectLabel(s.project) || '';
@@ -760,6 +783,7 @@ function sessionsColumn() {
       time: fmtRelTime(s.last),
       agent: undefined,
       running: runningSids.has(s.sid),
+      status: runningSids.has(s.sid) ? liveStatusBySid.get(s.sid) : undefined,
       unread: false,
       // Tool errors are NORMAL in agent sessions (a failed Bash call counts) -
       // flame-on-any-error painted every real session red. Flame only when
@@ -1507,17 +1531,15 @@ const STALE_AFTER_MS = 45000;
 const STATUS_RANK = { error: 0, stale: 1, running: 2 };
 
 // --- live (multi-session dashboard) ---
-function liveMain() {
-  const offline = state.health.status !== 'ok' && state.health.status !== 'unknown';
+// Shared source of truth for "every live session" (owned chat.active rows plus
+// external SSE-observed sessions) - used by BOTH the Live tab dashboard and the
+// WorkspaceRail nav badge/tone, so the count and error signal never diverge
+// between the two surfaces (a prior cohesion gap: the rail counted owned-only).
+function computeLiveSessions() {
   const bySid = state.sessionsBySid || new Map();
   const tally = state.live.tally || new Map();
   const now = Date.now();
-  // Live-stream health: connected (recent event), connecting (opened, no event
-  // yet), or offline (errored - one connection vocabulary across the GUI).
-  const streamState = state.live.error ? 'offline' : (state.live.connected ? 'connected' : 'connecting');
   const stoppingSet = state.live.stopping || new Set();
-  // Clock-skew-corrected "now" in server-timestamp terms, so pure skew never
-  // derives a session stale.
   const nowS = now - (state.live.clockSkew || 0);
   let sessions = (Array.isArray(state.active) ? state.active : []).map((r) => {
     // The history index + SSE tally are keyed by claude's REAL session id, not
@@ -1627,6 +1649,16 @@ function liveMain() {
       stopping: false,
     });
   }
+  return sessions;
+}
+
+function liveMain() {
+  const offline = state.health.status !== 'ok' && state.health.status !== 'unknown';
+  // Live-stream health: connected (recent event), connecting (opened, no event
+  // yet), or offline (errored - one connection vocabulary across the GUI).
+  const streamState = state.live.error ? 'offline' : (state.live.connected ? 'connected' : 'connecting');
+  const stoppingSet = state.live.stopping || new Set();
+  let sessions = computeLiveSessions();
   // W12: in-dir filter + errors-only toggle.
   const lv = state.live;
   if (lv.errorsOnly) sessions = sessions.filter(s => s.status === 'error');
@@ -1751,6 +1783,29 @@ function runningToolCount() {
   return last.parts.filter(p => p && p.kind === 'tool' && p.status === 'running').length;
 }
 
+// Files touched by Edit/Write/MultiEdit/Read tool calls in the current chat
+// session, most-recent first, deduped by path - feeds ContextPane's "recent
+// files" panel (Claude Desktop surfaces recently-touched files; this GUI had
+// no path to that fact at all before).
+const FILE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'Read', 'NotebookEdit']);
+function recentSessionFiles() {
+  const msgs = Array.isArray(state.chat.messages) ? state.chat.messages : [];
+  const seen = new Set();
+  const out = [];
+  for (let i = msgs.length - 1; i >= 0 && out.length < 5; i--) {
+    const parts = Array.isArray(msgs[i].parts) ? msgs[i].parts : [];
+    for (let j = parts.length - 1; j >= 0 && out.length < 5; j--) {
+      const p = parts[j];
+      if (!p || p.kind !== 'tool' || !FILE_TOOLS.has(p.name)) continue;
+      const path = p.args && (p.args.file_path || p.args.path || p.args.notebook_path);
+      if (!path || seen.has(path)) continue;
+      seen.add(path);
+      out.push({ path });
+    }
+  }
+  return out;
+}
+
 function toolPart(block) {
   const name = block.name || block.kind || 'tool';
   const input = block.input || block.rawInput || {};
@@ -2262,7 +2317,7 @@ function chatFollowups() {
   const fm = text.match(/([A-Za-z]:\\\S+|\/[\w./-]+\.\w+)/);
   if (fm) {
     const base = fm[1].split(/[/\\]/).filter(Boolean).pop();
-    if (base) out.push('Open ' + base.replace(/[^\w.\-]/g, '') + ' in files');
+    if (base) out.push('Explain ' + base.replace(/[^\w.\-]/g, ''));
   }
   const result = out.length ? out.slice(0, 3) : FOLLOWUP_SEEDS;
   state._followupsMsgs = msgs;
@@ -2457,7 +2512,7 @@ function reconnectAlert() {
   return Alert({
     key: 'liveerr',
     kind: 'error',
-    title: 'Live stream disconnected',
+    title: 'Live stream offline',
     children: [h('span', { key: 'lemsg' }, state.live.error + ' - '), Btn({ key: 'reco', onClick: openLiveStream, children: 'reconnect', title: 'Reconnect to history stream' })],
   });
 }
@@ -2946,6 +3001,10 @@ function settingsMain() {
       // backend panel where it applies.
       lede: 'Connection, agents, appearance, keyboard, and local data.',
     }),
+    state.health.corsWildcardOpen
+      ? Alert({ key: 'cors-open-warn', kind: 'error', title: 'Open CORS with no password',
+          children: 'This server allows requests from any origin (CORS_ORIGIN=*) with no PASSWORD set - any page a user visits in their browser can read and modify this filesystem. Set PASSWORD or restrict CORS_ORIGIN to a specific origin.' })
+      : null,
     h('div', { key: 'settings-grid', class: 'settings-grid' }, [
     Panel({
       id: 'backend',
@@ -3121,7 +3180,7 @@ function agentsPanel() {
           const usable = avail || a.npxInstallable;     // selectable from this row
           const bits = [PROTOCOL_WORDS[a.protocol] || 'agent'];
           if (!avail) bits.push(a.npxInstallable ? 'runs via npx' : 'not installed');
-          if (acp) bits.push(acp.healthy ? 'connected' : (acp.running ? 'connecting' : 'disconnected'));
+          if (acp) bits.push(acp.healthy ? 'connected' : (acp.running ? 'connecting' : 'offline'));
           if (acp && acp.restartCount >= 1) bits.push('restarted ' + acp.restartCount + (acp.restartCount === 1 ? ' time' : ' times'));
           if (acp && !acp.healthy && acp.providerInfo?.error) bits.push(acp.providerInfo.error);
           if (acp && acp.idleMs > 3_600_000) bits.push(fmtDuration(acp.idleMs) + ' idle');