fraim-hub 2.0.232 → 2.0.234

package/dist/src/ai-hub/server.js

@@ -154,6 +154,14 @@ function getHubPersonaForJob(jobName) {
         return null;
     return getProtectedPersonaForHubJob(jobName) ?? DEFAULT_UNASSIGNED_PERSONA_KEY;
 }
+// Issue #991: consult custom employee records before falling back to the catalog.
+// Returns the key of the first custom employee whose jobIds array includes jobId,
+// or null if no custom employee owns it.
+function getCustomPersonaForJob(projectPath, jobId) {
+    const employees = (0, custom_employees_1.readCustomEmployees)(projectPath);
+    const match = employees.find((e) => Array.isArray(e.jobIds) && e.jobIds.includes(jobId));
+    return match ? match.key : null;
+}
 const FRAIM_INTERNAL_JOB_IDS = new Set([
     'contribute-to-fraim',
     'create-registry-asset',
@@ -2452,7 +2460,7 @@ class AiHubServer {
                 id: employeeJob.id,
                 title: employeeJob.title,
                 stubPath: employeeJob.stubPath,
-                personaKey: employeeJob.requiredPersonaKey ?? getHubPersonaForJob(employeeJob.id),
+                personaKey: employeeJob.requiredPersonaKey ?? getCustomPersonaForJob(projectPath, employeeJob.id) ?? getHubPersonaForJob(employeeJob.id),
             };
         }
         const managerTemplate = (0, catalog_1.discoverManagerTemplates)(projectPath).find((job) => job.id === jobId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim-hub",
-  "version": "2.0.232",
+  "version": "2.0.234",
   "description": "FRAIM Hub local companion package.",
   "bin": {
     "fraim-hub": "bin/fraim-hub.js"
@@ -158,7 +158,7 @@
     "electron": "^41.2.2",
     "electron-updater": "^6.8.9",
     "express": "^5.2.1",
-    "fraim": "2.0.232",
+    "fraim": "2.0.234",
     "mongodb": "^7.0.0",
     "node-cron": "4.2.1",
     "node-edge-tts": "^1.2.10",

package/public/ai-hub/script.js

@@ -73,6 +73,8 @@ const state = {
   // the active employee; the user never sees the raw invocation syntax.
   pendingCoachingJobId: null,
   pendingCoachingLabel: null,
+  // Issue #989 R1-R6: area preserved when a next-job chip opens step-2 pre-filled.
+  pendingNextJobArea: null,
   conversationPersistTimer: null,
   conversationRefreshHandle: null,
   conversationDiskAvailable: true,
@@ -300,7 +302,11 @@ function tfRefreshPersonaDependentSurfaces() {
   else if (tf.area === 'brain') tfRenderBrain();
   if (tf.area === 'projects') {
     if (tf.projectView === 'overview') tfRenderOverview();
-    else tfRenderTree();
+    else {
+      tfRenderTree();
+      // tfRenderTree rebuilds tree chrome only; renderRail rebuilds per-employee accordion groups.
+      if (typeof renderRail === 'function') renderRail();
+    }
   }
 }
 
@@ -1305,6 +1311,19 @@ function stripHubInjectedPromptBlocks(text) {
     .trim();
 }
 
+// Returns a validated http/https URL string suitable for use in an href, or null if unsafe.
+function _safeHref(raw) {
+  try {
+    const url = new URL(raw);
+    return (url.protocol === 'https:' || url.protocol === 'http:') ? url.href : null;
+  } catch (_) { return null; }
+}
+
+// Escape & and " in a URL for safe insertion into an href="..." attribute.
+function _escapeHref(href) {
+  return href.replace(/&/g, '&').replace(/"/g, '"');
+}
+
 // R8: render markdown subset safely. HTML is escaped first.
 function formatEmployeeText(text) {
   if (!text) return '';
@@ -1320,6 +1339,27 @@ function formatEmployeeText(text) {
   s = s.replace(/```[\w]*\n?([\s\S]*?)```/g, (_, code) => `<pre><code>${code.trimEnd()}</code></pre>`);
   // 3. Inline code (single backtick, non-greedy, no newlines).
   s = s.replace(/`([^`\n]+)`/g, '<code>$1</code>');
+  // 3.5. Markdown links [text](url) — only http/https hrefs allowed; link text is already HTML-escaped.
+  // Empty-text links and non-absolute URLs fall back to plain text.
+  s = s.replace(/\[([^\]]*)\]\(([^)]*)\)/g, (match, linkText, rawUrl) => {
+    const trimmed = linkText.trim();
+    // Empty link text: render as plain text; sentinel prevents step 3.6 auto-linkify.
+    if (!trimmed) return `\x00NOLINK\x00${rawUrl.trim()}\x00ENDNOLINK\x00`;
+    // Reverse HTML entities step 1 introduced inside the URL before structural validation.
+    const decodedUrl = rawUrl.trim().replace(/&amp;/g, '&').replace(/&quot;/g, '"').replace(/&lt;/g, '<').replace(/&gt;/g, '>');
+    const href = _safeHref(decodedUrl);
+    if (!href) return trimmed;
+    return `<a href="${_escapeHref(href)}" target="_blank" rel="noopener noreferrer">${trimmed}</a>`;
+  });
+  // 3.6. Auto-linkify bare https:// / http:// URLs not already inside href="...".
+  // Sentinel prefix prevents double-linkifying empty-text [](url) patterns.
+  s = s.replace(/(?<!href=")(?<!href=')(?<!\x00NOLINK\x00)(https?:\/\/[^\s<>"'\x00]+)/g, (url) => {
+    const href = _safeHref(url);
+    if (!href) return url;
+    return `<a href="${_escapeHref(href)}" target="_blank" rel="noopener noreferrer">${_escapeHref(href)}</a>`;
+  });
+  // Strip sentinels: emit the URL as plain text (no anchor).
+  s = s.replace(/\x00NOLINK\x00(.*?)\x00ENDNOLINK\x00/g, (_, url) => url);
   // 4. Bold (**text**).
   s = s.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>');
   // 5–7. Process line by line for lists and paragraphs.
@@ -1664,7 +1704,7 @@ function renderRail() {
     titleSpan.className = 'conv-title';
     titleSpan.textContent = conv.title || '';
     bodyDiv.appendChild(titleSpan);
-    appendHubTimestamp(bodyDiv, conv.lastUpdatedAt, 'conv-time', 'Run last updated');
+    appendHubTimestamp(bodyDiv, conversationStartTimestamp(conv), 'conv-time', 'Job started');
     btn.appendChild(bodyDiv);
     // Issue #566 R7: mark runs of a personalized (taught/customized) job.
     if (isTaughtJob(conv.jobId)) {
@@ -4851,7 +4891,14 @@ function renderNextJobRecommendations(conv) {
           : conv.scope === 'company' ? 'company'
             : 'projects';
         const employeeId = conversationAgentName(conv) || (state.selectedEmployeeId) || 'claude';
-        startRun(job, instructions, employeeId, undefined, area);
+        // Issue #989 R1-R6: open step-2 with job pre-selected and instructions pre-filled
+        // so the manager can review/edit before starting, instead of calling startRun directly.
+        state.selectedJob = job;
+        state.selectedEmployeeId = employeeId;
+        state.pendingNextJobArea = area;
+        showStep2(job);
+        els['instructions'].value = instructions;
+        els['start'].disabled = instructions.trim().length === 0;
       });
     }
     chips.appendChild(btn);
@@ -6018,6 +6065,7 @@ function closeModal() {
   els['modal'].classList.remove('open');
   els['modal'].hidden = true;
   state.activeFilter = null;
+  state.pendingNextJobArea = null;
 }
 
 // Build the unified picker list. Employee jobs are organized by their
@@ -6707,7 +6755,15 @@ function foldRunIntoConversation(conv, run) {
   if (run.configuredAgentLabel) conv.configuredAgentLabel = run.configuredAgentLabel;
   if (run.baseHostId) conv.baseHostId = run.baseHostId;
   if (run.personaKey !== undefined) {
-    conv.personaKey = run.personaKey;
+    // Issue #991: do not let a server-side catalog/default key overwrite a custom:*
+    // key the client already holds. The client stamps custom:* at kickoff from the
+    // user's explicit action (cpPersonaOverride); the server resolves it via
+    // getCustomPersonaForJob, but the client guard is defense-in-depth.
+    const isClientCustom = conv.personaKey && conv.personaKey.startsWith('custom:');
+    const isServerCustom = run.personaKey && run.personaKey.startsWith('custom:');
+    if (!isClientCustom || isServerCustom) {
+      conv.personaKey = run.personaKey;
+    }
   }
   // Issue #347: keep the latest server snapshot under conv.run so the
   // tracker / totals renderers can read it without re-doing work. Stages,
@@ -7561,6 +7617,9 @@ function wireEvents() {
     if (!job || !text) return;
     const employeeId = els['employee-select'].value || state.selectedEmployeeId;
     state.selectedEmployeeId = employeeId;
+    // Issue #989 R4: consume pendingNextJobArea so the run lands in the right tab.
+    const invokedArea = state.pendingNextJobArea || undefined;
+    state.pendingNextJobArea = null;
     closeModal();
     // R2: if no project path is set, show the inline project picker instead.
     if (!state.projectPath) {
@@ -7574,7 +7633,7 @@ function wireEvents() {
       showHireStrip(job, pendingConvId, text, employeeId);
       return;
     }
-    await startRun(job, text, employeeId);
+    await startRun(job, text, employeeId, undefined, invokedArea);
   });
   els['job-search'].addEventListener('input', () => renderJobCatalog(els['job-search'].value));
   els['modal'].addEventListener('click', (e) => {
@@ -10486,7 +10545,7 @@ function tfBuildManagerRunItem(conv) {
   const body = document.createElement('span'); body.className = 'conv-body';
   const title = document.createElement('span'); title.className = 'conv-title';
   title.textContent = conv.title || conv.jobTitle || conv.jobId || 'Run';
-  body.appendChild(title); appendHubTimestamp(body, conv.lastUpdatedAt, 'conv-time', 'Run last updated'); btn.appendChild(body);
+  body.appendChild(title); appendHubTimestamp(body, conversationStartTimestamp(conv), 'conv-time', 'Job started'); btn.appendChild(body);
   const dotClass = conversationStateDotClass(conv);
   const dot = document.createElement('span'); dot.className = 'state-dot conv-state-dot dot-' + dotClass;
   if (typeof tfDotTitle === 'function') dot.title = tfDotTitle(dotClass);

package/public/ai-hub/styles.css

@@ -1669,6 +1669,15 @@ img.coach-employee-avatar { object-fit: cover; border-radius: 4px; }
   border: 1px solid var(--line);
   color: var(--text);
 }
+.message.employee .bubble a {
+  color: var(--accent);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  word-break: break-all;
+}
+.message.employee .bubble a:hover {
+  color: var(--accent-strong);
+}
 .typing-indicator {
   animation: none;
   justify-items: start;