loopengine 0.1.50 → 0.1.52

package/dist/web/playground.js

@@ -200,7 +200,14 @@ export const playgroundHtml = `<!doctype html>
      image's real visible edge instead of floating in empty space beside
      a narrower image inside a full-width box. */
   .msg-preview-wrap { position: relative; display: inline-block; max-width: 100%; margin: 6px 0; }
-  .msg-preview-img { display: block; max-width: 100%; max-height: 260px; width: auto; height: auto; border-radius: 8px; cursor: zoom-in; }
+  /* .msg-plain-img (no download link — see renderMessageMarkdown's own
+     doc comment) gets the same capped size and click-to-zoom as the
+     merged .msg-preview-img, just without the corner download icon and
+     without a wrap element of its own (nothing needs to be positioned
+     relative to it) — see the chatPane click handler below and
+     openImageLightbox's own handling of a missing downloadHref. */
+  .msg-preview-img, .msg-plain-img { display: block; max-width: 100%; max-height: 260px; width: auto; height: auto; border-radius: 8px; cursor: zoom-in; }
+  .msg-plain-img { margin: 6px 0; }
   .msg-download-icon {
     position: absolute;
     top: 8px;
@@ -405,6 +412,42 @@ export const playgroundHtml = `<!doctype html>
   // target for one that happens to reuse an id namespace.
   var toolCallCardsById = {};
 
+  // Keyed by a signed URL's own base (everything before its "?") —
+  // populated from every 'toollane:result' event's own 'summary' (see
+  // core/loop-events.ts's own ToolLaneResultEvent doc comment: the raw,
+  // unparsed tool return value, straight from execute() with nothing
+  // reshaped in between). A long signed-URL query string (a GCS
+  // Signature param can run ~300 opaque base64 characters) is exactly
+  // the kind of thing an LLM can flip one character of while generating
+  // its own reply text from the same value earlier in its context — see
+  // correctKnownUrls below, which snaps a written URL back to this
+  // known-good one whenever the base (the object path — descriptive,
+  // not random, so far less likely to get mistyped) matches but the
+  // full string doesn't. Cleared on every conversation switch, same as
+  // toolCallCardsById above — a base from an unrelated earlier session
+  // is never a valid correction target (and its signed URL has likely
+  // expired anyway).
+  var knownUrlsByBase = {};
+
+  // Recursively walks an arbitrary JSON value (a tool's own summary,
+  // parsed) collecting every string that looks like a signed URL — has
+  // a "?" (nothing to correct in a bare URL with no query to corrupt).
+  // Last one seen for a given base wins, which is fine: a re-signed URL
+  // for the same object is just as valid a correction target as the
+  // first one seen.
+  function recordKnownUrls(value) {
+    if (typeof value === 'string') {
+      if (value.indexOf('https://') === 0 || value.indexOf('http://') === 0) {
+        var qIndex = value.indexOf('?');
+        if (qIndex !== -1) knownUrlsByBase[value.slice(0, qIndex)] = value;
+      }
+    } else if (Array.isArray(value)) {
+      for (var i = 0; i < value.length; i++) recordKnownUrls(value[i]);
+    } else if (value && typeof value === 'object') {
+      for (var key in value) recordKnownUrls(value[key]);
+    }
+  }
+
   // A page refresh only ever loses *this tab's* JS state — the actual
   // conversation is durably stored server-side (see session-store.ts).
   // What's missing after a refresh is just "which session ids did I
@@ -456,8 +499,30 @@ export const playgroundHtml = `<!doctype html>
   // attachment — a real HTTP response header, so a plain click already
   // downloads correctly regardless of origin, no JS fetch/blob trick or
   // same-origin requirement needed.
+  //
+  // Before any of that: correctKnownUrls (see knownUrlsByBase's own doc
+  // comment) snaps any signed URL the model wrote back to the exact
+  // known-good one whenever they share a base but differ — recovers a
+  // broken image/download link from a transcription slip without
+  // needing the model to get a ~300-character signature exactly right.
+  //
+  // Built from a runtime backslash character, never a literal
+  // backslash-letter sequence in this file's own source — same gotcha
+  // renderMessageMarkdown's own patterns below document in full (this
+  // page is one big outer template literal whose own output is itself
+  // parsed as JS a second time).
+  var urlBs = String.fromCharCode(92);
+  var urlPattern = new RegExp('https?:' + urlBs + '/' + urlBs + '/[^' + urlBs + 's)' + urlBs + ']]+', 'g');
+  function correctKnownUrls(md) {
+    return md.replace(urlPattern, function (url) {
+      var qIndex = url.indexOf('?');
+      if (qIndex === -1) return url;
+      var known = knownUrlsByBase[url.slice(0, qIndex)];
+      return known || url;
+    });
+  }
   function renderMessageMarkdown(md) {
-    var lines = escapeHtml(md).split('\\n');
+    var lines = escapeHtml(correctKnownUrls(md)).split('\\n');
     var html = '';
     var inCode = false;
     var codeBuffer = '';
@@ -488,7 +553,7 @@ export const playgroundHtml = `<!doctype html>
         .replace(inlineCodePattern, '<code>$1</code>')
         .replace(boldPattern, '<strong>$1</strong>')
         .replace(italicPattern, '<em>$1</em>')
-        .replace(imagePattern, '<img src="$2" alt="$1" class="msg-plain-img">')
+        .replace(imagePattern, '<img src="$2" alt="$1" class="msg-plain-img" data-full-src="$2">')
         .replace(linkPattern, '<a href="$2" target="_blank" rel="noopener noreferrer">$1</a>');
     }
     function flushParagraph() {
@@ -571,7 +636,7 @@ export const playgroundHtml = `<!doctype html>
     // isn't a recognized string escape character either. A plain string
     // needs no such escaping for "/" at all.
     var previewMergePattern = new RegExp(
-      '<img src="([^"]*)" alt="([^"]*)" class="msg-plain-img">' + bs + 's*<a href="([^"]*)"[^>]*>[^<]*</a>',
+      '<img src="([^"]*)" alt="([^"]*)" class="msg-plain-img" data-full-src="[^"]*">' + bs + 's*<a href="([^"]*)"[^>]*>[^<]*</a>',
       'g',
     );
     html = html.replace(previewMergePattern, function (match, src, alt, href) {
@@ -591,7 +656,16 @@ export const playgroundHtml = `<!doctype html>
 
   function openImageLightbox(src, downloadHref) {
     lightboxImage.src = src;
-    lightboxDownload.href = downloadHref;
+    // A plain image (no download link — see renderMessageMarkdown's own
+    // doc comment on .msg-plain-img) has no downloadHref at all; hiding
+    // the button beats pointing it at '' (a dead link that would just
+    // reload the page) or at src (opens inline, not an actual download).
+    if (downloadHref) {
+      lightboxDownload.href = downloadHref;
+      lightboxDownload.style.display = '';
+    } else {
+      lightboxDownload.style.display = 'none';
+    }
     lightboxOverlay.classList.add('open');
   }
   function closeImageLightbox() {
@@ -616,7 +690,7 @@ export const playgroundHtml = `<!doctype html>
   // rewired after each new message.
   chatPane.addEventListener('click', function (ev) {
     var target = ev.target;
-    if (target && target.classList && target.classList.contains('msg-preview-img')) {
+    if (target && target.classList && (target.classList.contains('msg-preview-img') || target.classList.contains('msg-plain-img'))) {
       openImageLightbox(target.getAttribute('data-full-src'), target.getAttribute('data-download-href'));
     }
   });
@@ -1168,6 +1242,7 @@ export const playgroundHtml = `<!doctype html>
     sessionLabel.classList.add('copyable');
     chatPane.textContent = '';
     toolCallCardsById = {};
+    knownUrlsByBase = {};
     setEmptyHint(timelinePane, 'Loop events (tool calls, permission checks, budget checks) will appear here as the agent runs.');
     renderSessionsPane();
 
@@ -1318,6 +1393,7 @@ export const playgroundHtml = `<!doctype html>
   function resetConversation() {
     sessionId = null;
     toolCallCardsById = {};
+    knownUrlsByBase = {};
     removeThinking();
     sessionLabel.textContent = 'session: (new)';
     sessionLabel.classList.remove('copyable');
@@ -1451,6 +1527,19 @@ export const playgroundHtml = `<!doctype html>
       removeThinking();
       appendQuestionCard(data);
       appendTimelineEntry(eventName, data);
+    } else if (eventName === 'toollane:result') {
+      // data.summary is a tool's raw, unreshaped return value (see
+      // knownUrlsByBase's own doc comment above) — a JSON string for
+      // this ability, but tools generally can return plain text too, so
+      // a parse failure here just means nothing to record, not an error.
+      if (typeof data.summary === 'string') {
+        try {
+          recordKnownUrls(JSON.parse(data.summary));
+        } catch (err) {
+          // Not JSON — nothing to correct against.
+        }
+      }
+      appendTimelineEntry(eventName, data);
     } else {
       appendTimelineEntry(eventName, data);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "loopengine",
-  "version": "0.1.50",
+  "version": "0.1.52",
   "type": "module",
   "description": "Runtime for tool-using AI agents with a transparent ReAct loop.",
   "license": "MIT",