claude-code-kanban 7.16.0 → 7.17.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-kanban",
-  "version": "7.16.0",
+  "version": "7.17.0",
   "description": "A web-based Kanban board for viewing Claude Code tasks with agent teams support",
   "main": "server.js",
   "type": "commonjs",
@@ -39,6 +39,7 @@
     "@xterm/addon-fit": "0.11.0",
     "@xterm/addon-serialize": "0.14.0",
     "@xterm/addon-unicode11": "0.9.0",
+    "@xterm/addon-web-links": "0.12.0",
     "@xterm/addon-webgl": "0.19.0",
     "@xterm/headless": "6.0.0",
     "@xterm/xterm": "6.0.0",

package/public/app.js

@@ -7503,7 +7503,13 @@ function _findOrphanedKeys(known) {
   const orphaned = [];
   for (const id of pinnedSessionIds) if (!known.has(id)) orphaned.push(`__pinned__${id}`);
   for (const id of stickySessionIds) if (!known.has(id)) orphaned.push(`__sticky__${id}`);
-  const sessionKeyPrefixes = [PINNED_MESSAGES_PREFIX, PAD_EMOJI_PREFIX, PREVIEW_STORAGE_PREFIX, PAD_LINKED_PREFIX];
+  const sessionKeyPrefixes = [
+    PINNED_MESSAGES_PREFIX,
+    PAD_EMOJI_PREFIX,
+    PREVIEW_STORAGE_PREFIX,
+    PAD_LINKED_PREFIX,
+    DROPPED_ARTIFACTS_PREFIX,
+  ];
   for (const key of store.keys()) {
     const pad = _parsePadKey(key);
     if (pad?.kind === 'group') {
@@ -9173,7 +9179,7 @@ function bindPreviewRelativeLinks(bodyEl, baseOf = () => currentPreviewPath) {
     if (isUrlRef(href)) return;
     const cleanHref = href.replace(/#.*$/, '');
     e.preventDefault();
-    openPreviewByPath(cleanHref, isAbsolutePath(href) ? undefined : baseOf(a), openFileInEditor);
+    openPreviewByPath(cleanHref, baseOf(a), openFileInEditor);
   });
   bodyEl.dataset.relLinkBound = '1';
 }
@@ -9675,8 +9681,34 @@ function artifactLabel(a) {
   return a.path ? pathBasename(a.path).replace(/\.html?$/i, '') : 'Artifact';
 }
 
+// The list comes from the transcript on every read, so a dropped artifact is kept out by URL.
+const DROPPED_ARTIFACTS_PREFIX = 'artifacts-dropped-';
+
+function droppedArtifacts(sessionId) {
+  return new Set(readStoredList(DROPPED_ARTIFACTS_PREFIX + sessionId));
+}
+
+function setArtifactDropped(sessionId, url, dropped) {
+  const urls = droppedArtifacts(sessionId);
+  if (dropped) urls.add(url);
+  else urls.delete(url);
+  if (urls.size) store.writeJson(DROPPED_ARTIFACTS_PREFIX + sessionId, [...urls]);
+  else store.removeItem(DROPPED_ARTIFACTS_PREFIX + sessionId);
+  artifactsSection.repaint(sessionId);
+}
+
+// biome-ignore lint/correctness/noUnusedVariables: used in HTML
+function dropArtifact(sessionId, url) {
+  setArtifactDropped(sessionId, url, true);
+  showToast('Artifact dropped from the list', 'info', {
+    label: 'Undo',
+    onClick: () => setArtifactDropped(sessionId, url, false),
+  });
+}
+
 function artifactsInnerHtml(sessionId) {
-  const list = artifactsSection.get(sessionId);
+  const dropped = droppedArtifacts(sessionId);
+  const list = artifactsSection.get(sessionId).filter((a) => !dropped.has(a.url));
   if (!list.length) return '';
   const items = list
     .map(
@@ -9684,6 +9716,7 @@ function artifactsInnerHtml(sessionId) {
         <a class="artifact-link" href="${escapeHtml(a.url)}" target="_blank" rel="noopener" title="${escapeHtml(a.url)}">${escapeHtml(artifactLabel(a))}</a>
         <span class="row-actions artifact-actions">
           <button type="button" onclick="copyWithFeedback('${escAttrJs(a.url)}', this)" title="Copy link" aria-label="Copy artifact link">${ICON_COPY}</button>
+          <button type="button" class="artifact-remove" onclick="dropArtifact('${escAttrJs(sessionId)}','${escAttrJs(a.url)}')" title="Drop from the list" aria-label="Drop ${escapeHtml(artifactLabel(a))} from the list">&times;</button>
         </span>
       </li>`,
     )
@@ -11055,9 +11088,14 @@ function toRelativeIfUnder(filePath, baseDir) {
   return fp.slice(bd.length + 1);
 }
 
+// DOMPurify's default list plus `file:` and drive paths (`C:/x` reads as a scheme), so a link to a
+// local file survives and opens in the preview.
+const MARKDOWN_URI =
+  /^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|matrix|file):|[a-z]:[\\/]|[^a-z]|[a-z+.-]+(?:[^a-z+.\-:]|$))/i;
+
 function renderMarkdown(text) {
   if (typeof DOMPurify !== 'undefined' && typeof marked !== 'undefined') {
-    return DOMPurify.sanitize(marked.parse(text));
+    return DOMPurify.sanitize(marked.parse(text), { ALLOWED_URI_REGEXP: MARKDOWN_URI });
   }
   return `<pre style="white-space:pre-wrap;margin:0;">${escapeHtml(text)}</pre>`;
 }
@@ -15377,6 +15415,12 @@ function terminalInitOptions(themeOptions) {
   };
 }
 
+function openTerminalLink(href) {
+  if (typeof href === 'string' && isLocalHref(href)) return openLocalHref(href);
+  const url = linkUrl(href);
+  if (url) hub.openExternal(url);
+}
+
 function onTerminalFrameMessage(t, m) {
   const socket = termState.socket;
   const current = socket && m.socketId === socket.id;
@@ -15396,6 +15440,7 @@ function onTerminalFrameMessage(t, m) {
       reconnectTerminal();
     }
   } else if (t === 'key') replayKey(m, document.getElementById('terminal-key-proxy'));
+  else if (t === 'link') openTerminalLink(m.href);
   // Chrome does not always fire focusin on the iframe element when its content takes focus.
   else if (t === 'focused') terminalHadFocus = terminalPaneFocused();
   else if (t === 'opening') {
@@ -18092,13 +18137,6 @@ function publishSession() {
   );
 }
 
-// The help modal stops click propagation, so the document handler below never sees this link.
-// The service worker can pair a cached page that lacks the link with this script.
-document.getElementById('help-docs')?.addEventListener('click', (e) => {
-  e.preventDefault();
-  hub.openExternal(e.currentTarget.href);
-});
-
 function webUrl(href) {
   let url;
   try {
@@ -18109,17 +18147,38 @@ function webUrl(href) {
   return url.protocol === 'http:' || url.protocol === 'https:' ? url : null;
 }
 
-document.addEventListener('click', (e) => {
-  const a = e.target.closest?.('a[href]');
-  if (!a) return;
-  const href = a.getAttribute('href');
-  if (!href) return;
-  const url = webUrl(href);
-  if (!url || url.origin === window.location.origin) return;
-  e.preventDefault();
-  e.stopPropagation();
-  hub.openExternal(url.href);
-});
+function isLocalHref(href) {
+  return /^file:/i.test(href) || (isAbsolutePath(href) && !href.startsWith('//'));
+}
+
+function openLocalHref(href) {
+  openPreviewByPath(href.replace(/#.*$/, ''), undefined, openFileInEditor);
+}
+
+// Capture, because the modals stop a click's propagation, and stopped here so a link in a message
+// preview does not also open the row. Under the hub the SDK has already opened a web link
+// outside (defaultPrevented), and leaves a link to a hub app alone.
+document.addEventListener(
+  'click',
+  (e) => {
+    if (e.button !== 0) return;
+    const href = e.target.closest?.('a[href]')?.getAttribute('href');
+    if (!href) return;
+    const url = webUrl(href);
+    const external = url && url.origin !== window.location.origin;
+    if (e.defaultPrevented) {
+      if (external) e.stopPropagation();
+      return;
+    }
+    const local = isLocalHref(href);
+    if (!local && (!external || hub.inHub)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    if (local) openLocalHref(href);
+    else hub.openExternal(url.href);
+  },
+  true,
+);
 
 (function initHubTheme() {
   const getTheme = () => (document.body.classList.contains('light') ? 'light' : 'dark');

package/public/style.css

@@ -7030,13 +7030,15 @@ body.show-resizing iframe {
 }
 
 /* The × is a glyph, not an svg, so .row-actions button svg does not size it. */
-.linked-doc-remove {
+.linked-doc-remove,
+.artifact-remove {
   font-family: var(--mono);
   font-size: 15px;
   line-height: 1;
 }
 
-.linked-doc-actions .linked-doc-remove:hover {
+.linked-doc-actions .linked-doc-remove:hover,
+.artifact-actions .artifact-remove:hover {
   background: var(--bg-elevated);
   border-color: var(--border);
   color: var(--text-primary);
@@ -8134,6 +8136,13 @@ body.light .msg-assistant .msg-text {
   padding: 8px 16px;
   white-space: nowrap;
 }
+
+/* The modal focuses a button itself, and after a mouse click Chrome does not match
+   :focus-visible for that, so Enter would act on a button with no ring. */
+.confirm-buttons .btn:focus {
+  outline: 2px solid var(--accent);
+  outline-offset: 2px;
+}
 /* #endregion */
 
 /* Reference card, not reading material: it stays out of the modal zoom, uses the app's

package/public/terminal-frame.js

@@ -48,6 +48,39 @@
     return lines.join('\n');
   }
 
+  const PATH_ROOT = String.raw`(?:[A-Za-z]:[\\/]|\/(?=[\w.@+-]+\/)|\\\\(?=[\w.$-]+\\))`;
+  // A quoted path may hold spaces; a bare one ends at the first.
+  const PATH_RE = new RegExp(
+    [
+      String.raw`"(${PATH_ROOT}[^"<>|*?]*[^\s"<>|*?])"`,
+      String.raw`'(${PATH_ROOT}[^'<>|*?]*[^\s'<>|*?])'`,
+      String.raw`(?<![\w/\\:.~-])${PATH_ROOT}[^\s"'<>|*?${'`'}]*[^\s"'<>|*?${'`'}.,;:!)\]}]`,
+    ].join('|'),
+    'g',
+  );
+
+  function pathsIn(text) {
+    return Array.from(text.matchAll(PATH_RE), (m) => {
+      const quoted = m[1] ?? m[2];
+      const found = quoted ?? m[0];
+      return { index: m.index + (quoted ? 1 : 0), text: found, path: found.replace(/(?::\d+){1,2}$/, '') };
+    });
+  }
+
+  // Cell x of each character, because a wide character spans two cells and translateToString counts it once.
+  function lineCells(line, cols, reuse) {
+    let text = '';
+    const xs = [];
+    for (let x = 0; x < cols; x++) {
+      const cell = line.getCell(x, reuse);
+      if (!cell || cell.getWidth() === 0) continue;
+      const chars = cell.getChars() || ' ';
+      for (let i = 0; i < chars.length; i++) xs.push(x);
+      text += chars;
+    }
+    return { text, xs };
+  }
+
   function oscColor(hex) {
     const m = /^#([0-9a-f]{6})$/i.exec(hex || '');
     if (!m) return null;
@@ -147,6 +180,8 @@
         scrollback: o.scrollback,
         cursorBlink: true,
         allowProposedApi: true,
+        // xterm's default asks with confirm() and opens a window, which the installed hub window blocks.
+        linkHandler: { activate: (_e, uri) => up('link', { href: uri }), allowNonHttpProtocols: true },
         ...o.themeOptions,
       });
       state.term = term;
@@ -154,6 +189,22 @@
       term.loadAddon(state.fit);
       term.loadAddon(new win.Unicode11Addon.Unicode11Addon());
       term.unicode.activeVersion = '11';
+      // Link providers scan a line only when the pointer moves onto it, never on output.
+      term.loadAddon(new win.WebLinksAddon.WebLinksAddon((_e, uri) => up('link', { href: uri })));
+      const cellReuse = term.buffer.active.getNullCell();
+      term.registerLinkProvider({
+        provideLinks(y, done) {
+          const line = term.buffer.active.getLine(y - 1);
+          if (!line || !/[\\/]/.test(line.translateToString(true))) return done(undefined);
+          const { text, xs } = lineCells(line, term.cols, cellReuse);
+          const links = pathsIn(text).map((p) => ({
+            text: p.text,
+            range: { start: { x: xs[p.index] + 1, y }, end: { x: xs[p.index + p.text.length - 1] + 1, y } },
+            activate: () => up('link', { href: p.path }),
+          }));
+          done(links.length ? links : undefined);
+        },
+      });
       term.open(host);
       try {
         const gl = new win.WebglAddon.WebglAddon();
@@ -346,7 +397,7 @@
   }
 
   if (typeof module === 'object' && module.exports) {
-    module.exports = { createTerminalFrame, claimSig, isClaimed, handsBack, parentOriginOf, tailOf };
+    module.exports = { createTerminalFrame, claimSig, isClaimed, handsBack, parentOriginOf, tailOf, pathsIn };
   } else {
     createTerminalFrame(root);
   }

package/public/terminal.html

@@ -22,6 +22,7 @@
   <script src="/vendor/xterm/addon-fit.js"></script>
   <script src="/vendor/xterm/addon-webgl.js"></script>
   <script src="/vendor/xterm/addon-unicode11.js"></script>
+  <script src="/vendor/xterm/addon-web-links.js"></script>
   <script src="/terminal-frame.js"></script>
 </body>
 </html>

package/public/vendor/claude-hub-sdk.js

@@ -1,4 +1,4 @@
-// claude-hub-sdk 1.5.0 (sha256 1505d3d5f8ba). Copied by npm run sdk:sync in claude-code-hub. Do not edit.
+// claude-hub-sdk 1.6.0 (sha256 71a58022516d). Copied by npm run sdk:sync in claude-code-hub. Do not edit.
 // Claude Code Hub SDK: the one rule that names a key press, shared by the hub page, client.js and
 // stub.js. The hub serves it to its page as /sdk/keys.js; mount() and sdk:sync put it in front of
 // client.js and stub.js, so an app still loads one file.

package/server.js

@@ -3468,6 +3468,7 @@ const XTERM_FILES = {
   'addon-fit.js': '@xterm/addon-fit/lib/addon-fit.js',
   'addon-webgl.js': '@xterm/addon-webgl/lib/addon-webgl.js',
   'addon-unicode11.js': '@xterm/addon-unicode11/lib/addon-unicode11.js',
+  'addon-web-links.js': '@xterm/addon-web-links/lib/addon-web-links.js',
 };
 app.get('/vendor/xterm/:file', (req, res) => {
   const rel = Object.hasOwn(XTERM_FILES, req.params.file) ? XTERM_FILES[req.params.file] : null;