shadow-claw 1.40.1 → 1.41.1

package/dist/public/docs/subsystems/pages.md

@@ -71,6 +71,8 @@ The `shadow-claw-pages` web component handles rendering the UI and displaying fi
 ### Navigation & URL State Synchronization
 
 - **URL Sync & App Route Validation**: Selecting or reordering pages dispatches navigation events (`shadow-claw-navigate`) and updates browser URL history via `history.pushState()`, preserving active page state across refreshes. Same-origin link navigation uses `isPossibleAppRoute(pathname)` to validate internal routes against top-level valid pages (`VALID_PAGES`) and static route manifests; same-origin links pointing to non-app paths (such as external demo applications or static deployments) bypass SPA router interception and fall back to native browser navigation (`window.open`).
+- **Root Pretty Path Resolution**: `src/storage/staticRouting.ts` supports mapping root paths (`/` and `/index.html`) directly to page definitions (e.g. `/pages/main/index.html`) via `"prettyPath": "/"`, and reverse-resolves root page routes back to `"/"`.
+- **In-Feed Scroll & Navigation Guarding**: `replaceState` navigations with state flags (`inFeedScroll: true`, `scrollSpy: true`, or `suppressRouter: true` in history or Navigation API destination state) are bypassed by the router in `getRoute` and `popstateListener`, preventing unnecessary page resets and view thrashing during scroll-driven URL synchronization.
 - **Ebook-Style Pagination**: Includes Previous (`[data-pages-prev]`) and Next (`[data-pages-next]`) page controls. Navigation buttons are dynamically enabled/disabled and set to `hidden` (`display: none !important`) based on current page index to avoid layout shifts.
 - **Keyboard & Gesture Navigation**: Supports `ArrowLeft` and `ArrowRight` keyboard navigation for page turning, with strict focus guards to prevent interference when typing in inputs or content-editable regions. Swipe gestures are fully supported via touch and mouse drag interactions, including swipe passthrough from sandboxed iframe previews via `postMessage`.
 - **Accessibility Announcements**: Uses an `aria-live` announcer to provide immediate screen reader feedback (`Navigated to page: [Title]`) when the active page changes.
@@ -130,24 +132,29 @@ Applications pre-rendered with Declarative Shadow DOM (DSD) shell via `src/cli/p
   - When navigating to pages not embedded in the initial HTML or stored in local storage, `shadow-claw-pages` and `getStaticPageContent()` dynamically fetch individual markdown files from `static-main/` or fallback to `static-main-manifest.json`.
 - **Pretty Paths & Sub-Routes**:
   - Configured via `routes.json` (normally `pages/routes.json`) to map markdown page sources to clean URL paths (e.g. `/2026/06/30/on-developing-loops/`). Candidate locations include `pages/resources/`, `pages/deps/`, `resources/`, `deps/`, `pages/`, and the project root.
-  - Supports recursive nested `subRoutes` entries matching child URL hierarchies.
+  - Supports recursive nested `subRoutes` entries matching child URL hierarchies, as well as root pretty path mapping (`"prettyPath": "/"`).
   - The pre-render pipeline generates dedicated physical `index.html` files with page-specific DSD templates.
   - If no `routes.json` exists, pretty-path generation is skipped without failing the build.
 - **Static Routing Manifest**:
   - Embedded via `#shadow-claw-static-routing` JSON script tags or fetched via `static-routing.json` (`src/storage/staticRouting.ts`), allowing client-side router (`app-routes.ts`) and pages component to resolve routes asynchronously (`resolvePrettyPathToRouteAsync`, `parseRouteFromUrlAsync`) across Node.js, Electron, and GitHub Pages.
 - **Server Middleware Fallbacks**:
-  - Express server includes static file middleware serving fallback content from `pages/main` for `/files/main/`, `/static-main/`, and `/pages/`, alongside SPA redirect fallback middleware for clean URL reloads.
+  - Express server includes static file middleware serving fallback content from `pages/main` for `/files/main/`, `/static-main/`, and `/pages/`, alongside SPA redirect fallback middleware for clean URL reloads, serving `index.html` for app routes even when matching directories exist on disk.
 - **DSD Shell Override**:
   - Enabled via the "Override pre-rendered content" toggle in Settings (`CONFIG_KEYS.OVERRIDE_PRERENDER_SKELETON`). Hides the initial DSD shell on boot, showing the skeleton loader until hydration finishes.
 - **Declarative Configuration (`shadow-claw.config.json`)**:
   - Template repositories and content publishers can declaratively brand and customize the site shell without editing ShadowClaw source files. The canonical location is `shadow-claw.config.json` in the project root (legacy `site-config.json` is also supported for backward compatibility):
     - **`site`**: `title`, `description`, `themeColor`, `lang`.
     - **`branding`**: `titleText`, `siteUrl`, `repoUrl`, `repoLabel`, `faviconPath`, `appleTouchIconPath`, `logoSlotHtml`.
-    - **`sidebar`**: `pagesHidden`, `chatHidden`, `tasksHidden`, `filesHidden`, `defaultPage` (`"pages"` | `"chat"` | `"tasks"` | `"files"`).
+    - **`sidebar`**: `pagesHidden`, `chatHidden`, `tasksHidden`, `filesHidden`, `defaultPage` (`"pages"` | `"chat"` | `"tasks"` | `"files"`), `slotHtml` (raw HTML string), `slotPath` (path to a custom sidebar HTML file), `sections` (array of declarative sidebar sections with `title`, `headerHref`, `items: [{ title, label, href, target, rel, active }]`, or `html`).
     - **`pages`**: `sortOrder` (`"asc"` | `"desc"`), `defaultPinnedPage`.
     - **`theme`**: `stylesheet` (custom theme CSS stylesheet injected into head).
     - **`settings`**: `assistantName` (pre-seeds the default assistant name), `defaultToolsProfile` (pre-seeds the default tool profile e.g. `"__builtin_default"` or `"none"`), `enabledTools` (pre-seeds default enabled built-in tool array).
     - **`cacheDir`** / **`server.cacheDir`**: Custom directory for storing cache, control tokens, and SQLite databases.
+  - **Slotted Sidebar & Custom Sections**:
+    - The root `<shadow-claw>` web component exposes named slots for custom navigation: `slot="sidebar-nav"`, `slot="sidebar"`, `slot="sidebar-content"`, and `slot="sidebar-footer"`.
+    - `applySiteConfig` discovers sidebar markup from `sidebar.slotHtml`, `sidebar.sections`, or auto-discovered candidate files (`pages/main/sidebar.html`, `pages/sidebar.html`, `sidebar.html`, `resources/sidebar.html`), patching the markup directly into `<shadow-claw>` light DOM.
+    - Slotted links (`.sidebar-link`, `[slot^="sidebar"] a`) automatically synchronize active classes (`.active`) and `aria-current="page"` via `syncSlottedSidebarActiveLinks` on route changes, `popstate`, and Navigation API `navigate`.
+    - On mobile viewports (<896px), clicking any slotted sidebar link automatically closes the navigation drawer.
   - **Build-Time Application**: `src/cli/site-config/apply.ts` patches `index.html`, `manifest.json`, `sitemap.xml` / `sitemap.txt`, and copies custom theme stylesheets into the build distribution. Stylesheets under `pages/resources/`, `pages/deps/`, `resources/`, `deps/`, `pages/assets/`, or `pages/main/assets/` are flattened to the distribution root and have that prefix removed from the generated `href`; other paths, such as `pages/main/theme.css`, retain their path.
   - **Branding Asset Precedence**: For `faviconPath` and `appleTouchIconPath`, content-specific locations under `pages/` and its supported resource/dependency paths are checked before bare repository-root defaults, so a published site's branding assets are not shadowed by ShadowClaw's built-in assets.
   - **DSD Shell Navigation Visibility**: `src/cli/prerender/dsd-shell/prerender-dsd-shell.ts` applies `hidden` and `aria-hidden` attributes to sidebar navigation items at build time, preventing layout shift on first paint.

package/dist/public/docs/subsystems/theming.md

@@ -0,0 +1,242 @@
+# Theming, Stylesheets & Layout Customization
+
+> Architecture, configuration, and styling patterns for theming ShadowClaw sites, customizing layout tokens, and styling slotted components across light and shadow DOM boundaries.
+
+---
+
+## Overview
+
+ShadowClaw provides a layered theming and templating system designed for both standalone AI assistant deployments and published static documentation hubs or personal sites. The styling architecture operates across two distinct DOM domains:
+
+1. **Shadow DOM (Component Internals)**:
+   - Built-in web components (`<shadow-claw>`, `<shadow-claw-pages>`, `<shadow-claw-chat>`, `<shadow-claw-dialog>`, etc.) render inside open Shadow Roots with pre-rendered Declarative Shadow DOM (DSD) templates.
+   - These components are insulated from external CSS rules, but inherit and reflect global **CSS Custom Properties** (`--shadow-claw-*`).
+2. **Light DOM (Slotted Content & Custom Shell)**:
+   - Slotted elements injected into named slots (`slot="sidebar"`, `slot="sidebar-nav"`, `slot="sidebar-content"`, `slot="sidebar-footer"`, `slot="header-actions-logo"`, `slot="logo"`) live directly in the host page's Light DOM.
+   - These elements are styled using standard CSS selectors defined in the site's custom stylesheet (`theme.stylesheet`).
+
+---
+
+## Configuration (`shadow-claw.config.json`)
+
+Custom theming is declared in the root configuration file (`shadow-claw.config.json` or legacy `site-config.json`):
+
+```json
+{
+  "theme": {
+    "stylesheet": "pages/main/theme.css"
+  },
+  "sidebar": {
+    "pagesHidden": true,
+    "chatHidden": true,
+    "tasksHidden": true,
+    "filesHidden": true,
+    "defaultPage": "pages"
+  },
+  "branding": {
+    "titleText": "My Custom Site",
+    "faviconPath": "pages/resources/favicon.ico",
+    "appleTouchIconPath": "pages/resources/icon-192x192.png"
+  }
+}
+```
+
+### `theme.stylesheet`
+
+- **Build-Time Processing**: When `theme.stylesheet` is defined:
+  - `src/cli/site-config/apply.ts` locates the source stylesheet.
+  - The stylesheet is copied into the distribution directory (`dist/public/`).
+  - An HTML link tag (`<link rel="stylesheet" href="..." />`) is injected immediately before the closing `</head>` in `dist/public/index.html` and across all pre-rendered pretty path `index.html` files.
+- **Path Resolution & Asset Flattening**:
+  - Stylesheets located in resource folders (`pages/resources/`, `pages/deps/`, `resources/`, `deps/`, `pages/assets/`, or `pages/main/assets/`) are flattened to the root of the distribution directory, and their href prefix is automatically resolved.
+  - Custom paths such as `pages/main/theme.css` retain their posix path relative to `<base href="/">`.
+  - External stylesheets starting with `http://`, `https://`, or `//` are preserved verbatim.
+
+---
+
+## CSS Custom Properties (Theme Tokens)
+
+ShadowClaw exposes CSS variables across several functional categories:
+
+### 1. Layout & Shell Visibility Overrides
+
+These tokens allow a custom site to selectively hide or reconfigure default built-in chrome without modifying core component templates:
+
+| CSS Custom Property                              | Default  | Purpose / Usage                                                                             |
+| :----------------------------------------------- | :------- | :------------------------------------------------------------------------------------------ |
+| `--shadow-claw-sidebar-footer-display`           | `block`  | Set to `none` to hide the default sidebar footer containing the Settings button.            |
+| `--shadow-claw-header-main-toggle-display`       | `block`  | Set to `none` to hide the top-left main app drawer / hamburger toggle button in the header. |
+| `--shadow-claw-page-header-display`              | `flex`   | Set to `none` to hide the `<shadow-claw-page-header>` component entirely.                   |
+| `--shadow-claw-pages-dropdown-container-display` | `flex`   | Set to `none` to hide the page navigation dropdown / breadcrumb selector.                   |
+| `--shadow-claw-article-header-margin-bottom`     | `1.5rem` | Controls the bottom margin beneath markdown article headers.                                |
+
+### 2. Design Tokens (Colors, Typography & Radii)
+
+Defined globally in `index.css`:
+
+```css
+:root {
+  /* Fonts */
+  --shadow-claw-font-sans:
+    system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+  --shadow-claw-font-mono: "Fira Code", "Courier New", monospace;
+
+  /* Colors (Light Mode) */
+  --shadow-claw-bg-primary: #f8fafc;
+  --shadow-claw-bg-secondary: #f1f5f9;
+  --shadow-claw-bg-tertiary: #e2e8f0;
+  --shadow-claw-border-color: #e2e8f0;
+  --shadow-claw-text-primary: #0f172a;
+  --shadow-claw-text-secondary: #475569;
+  --shadow-claw-text-tertiary: #64748b;
+  --shadow-claw-link: #1e40af;
+  --shadow-claw-link-hover: #334155;
+  --shadow-claw-accent-primary: #334155;
+  --shadow-claw-accent-hover: #1e293b;
+
+  /* Border Radii */
+  --shadow-claw-radius-s: 0.5rem;
+  --shadow-claw-radius-m: 0.75rem;
+  --shadow-claw-radius-l: 1.25rem;
+  --shadow-claw-radius-pill: 62.5rem;
+
+  /* Transitions */
+  --shadow-claw-duration-min: 150ms;
+  --shadow-claw-duration-regular: 300ms;
+}
+```
+
+In dark mode (`html.dark-mode`), variables automatically adapt or can be overridden via `@media (prefers-color-scheme: dark)` or `html.dark-mode` selectors.
+
+---
+
+## Slotted Navigation & Viewport Containment
+
+### Slotted Sidebar Elements
+
+Custom sidebars can be supplied via `pages/main/sidebar.html`, `sidebar.slotHtml`, or declarative `sidebar.sections` in `shadow-claw.config.json`. These render into the light DOM within `<shadow-claw>`:
+
+```html
+<div slot="sidebar" class="sidebar-custom-sections">
+  <section class="sidebar-section">
+    <div class="sidebar-section-header"><span>Projects</span></div>
+    <div class="sidebar-item">
+      <a href="/project-a" class="sidebar-link">Project A</a>
+    </div>
+  </section>
+</div>
+```
+
+### Viewport Scroll Containment
+
+To prevent dual scrollbars when using a custom slotted sidebar alongside scrollable main content, enforce viewport containment on the outer document:
+
+```css
+/* Prevent the outer SPA window from producing a secondary scrollbar */
+html:has(shadow-claw),
+body:has(shadow-claw) {
+  height: 100%;
+  height: 100dvh;
+  overflow: hidden;
+}
+
+/* Ensure the slotted sidebar container scrolls independently */
+.sidebar-custom-sections {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  max-height: calc(100vh - 4rem);
+  max-height: calc(100dvh - 4rem);
+  overflow-y: auto;
+  padding: 0.5rem;
+}
+```
+
+### Active Link Synchronization
+
+Slotted anchor elements (`.sidebar-link`, `[slot^="sidebar"] a`) automatically synchronize `.active` classes and `aria-current="page"` via `syncSlottedSidebarActiveLinks` on:
+
+- History API events (`pushState`, `replaceState`, `popstate`).
+- Modern Navigation API transitions (`navigate`).
+- Route changes dispatched by the client-side router (`app-routes.ts`).
+
+On viewports narrower than `896px` (mobile drawer), clicking any slotted link automatically collapses the navigation drawer.
+
+---
+
+## Sandboxed Preview Iframe Theme Sync
+
+When viewing markdown documents or HTML files in the Pages preview or File Viewer, content renders inside a sandboxed iframe. ShadowClaw ensures styling consistency across the iframe boundary via `src/ui/iframe-theme.ts`:
+
+1. **Automatic Stylesheet Inclusion**:
+   - `getIframeThemeStylesheetLink(siteConfig)` inspects the active site configuration and injects the configured `theme.stylesheet` into the iframe's `<head>`.
+2. **Computed CSS Property Reflection**:
+   - `getIframeThemeStyleHtml()` reads all computed `--*` CSS custom properties from `document.documentElement` and mirrors them into the iframe's `:root` style block.
+3. **Color Scheme & Class Mirroring**:
+   - The iframe root receives the matching `.dark-mode` or `.light-mode` class and `color-scheme: dark | light` to prevent Flash of Unstyled Content (FOUC).
+
+---
+
+## Complete Theming Example
+
+Below is a complete, working `pages/main/theme.css` example implementing custom layout tokens, viewport containment, and slotted sidebar styling:
+
+```css
+:root {
+  /* Hide unwanted built-in shell elements */
+  --shadow-claw-header-main-toggle-display: none;
+  --shadow-claw-page-header-display: none;
+  --shadow-claw-pages-dropdown-container-display: none;
+  --shadow-claw-sidebar-footer-display: none;
+
+  /* Custom Spacing */
+  --shadow-claw-article-header-margin-bottom: 1.5rem;
+}
+
+/* Contain the outer viewport */
+html:has(shadow-claw),
+body:has(shadow-claw) {
+  height: 100%;
+  height: 100dvh;
+  overflow: hidden;
+}
+
+/* Slotted Sidebar Scroll & Layout */
+.sidebar-custom-sections {
+  --shadow-claw-radius-m: var(--shadow-claw-radius-s, 0.375rem);
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  max-height: calc(100vh - 4rem);
+  max-height: calc(100dvh - 4rem);
+  overflow-y: auto;
+  padding: 0.5rem;
+}
+
+.sidebar-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+}
+
+.sidebar-section-header {
+  color: var(--shadow-claw-text-secondary, #888);
+  font-size: var(--shadow-claw-font-size-sm, 0.875rem);
+  font-weight: 500;
+  padding: 0.25rem 0.5rem;
+}
+
+.sidebar-link {
+  color: var(--shadow-claw-text-primary);
+  text-decoration: none;
+  padding: 0.375rem 0.5rem;
+  border-radius: var(--shadow-claw-radius-s, 0.375rem);
+  transition: background-color var(--shadow-claw-duration-min) ease;
+}
+
+.sidebar-link:hover,
+.sidebar-link.active {
+  background-color: var(--shadow-claw-bg-secondary);
+  color: var(--shadow-claw-link);
+}
+```

package/dist/public/docs/subsystems/webmcp.md

@@ -143,7 +143,32 @@ Executes a tool on a WebMCP `ModelContext` instance with backwards compatibility
 1. Accepts an optional JavaScript object directly or a JSON string.
 2. Calls `modelContext.executeTool(tool, inputObject, options)` first.
 3. If the host environment rejects with an error starting with `"Failed to parse input"` (Chrome < 155 / `@mcp-b/webmcp-polyfill`) or a WebIDL `TypeError`, it retries with `JSON.stringify(inputObject)`.
-4. Propagates all other errors without retrying.
+
+### `getWebMcpEventTarget(type?): WebMcpEventTarget | null`
+
+Resolves the appropriate `EventTarget` for WebMCP lifecycle events (`toolactivated` and `toolcancel`) with backwards compatibility across Chrome versions:
+
+- **Chrome 156.0.8076.0+ (PR #245):** Returns `document.modelContext` when `ontoolactivated` or `ontoolcancel` exists on `document.modelContext`.
+- **Chrome < 156:** Falls back to `window` where legacy event handlers resided.
+- **Older Canary (< 152):** Checks `navigator.modelContext` if `document.modelContext` is not defined.
+- **Node.js / Headless / Workers:** Safely returns `null` without throwing `ReferenceError`.
+
+### `addWebMcpEventListener(type, listener, options?): () => void`
+
+Safely registers a listener for WebMCP lifecycle events (`toolactivated`, `toolcancel`) with graceful degradation, event payload normalization, and automatic unsubscription:
+
+- Automatically extracts and normalizes `toolName` whether passed on `event.toolName` (`ToolActivatedEvent` / `ToolCancelEvent`) or legacy `event.detail.toolName`.
+- Returns an idempotent unsubscribe cleanup function `() => void`.
+- Supports standard `AddEventListenerOptions` including `{ signal }` for `AbortSignal`-driven unsubscription.
+- Supports `{ listenBoth: true }` to listen across both `document.modelContext` and `window` with tick-level deduplication during migration periods.
+
+### `onWebMcpToolActivated(listener, options?): () => void`
+
+Convenience helper to subscribe to tool execution start events (`toolactivated`). Returns an unsubscribe cleanup function.
+
+### `onWebMcpToolCancel(listener, options?): () => void`
+
+Convenience helper to subscribe to tool execution cancel events (`toolcancel`). Returns an unsubscribe cleanup function.
 
 ### `unregisterWebMcpTools(): void`
 
@@ -367,6 +392,69 @@ Internally, `executeWebMcpTool()`:
 2. If `executeTool` rejects with an error starting with `"Failed to parse input"` or a `TypeError`, it transparently retries with `JSON.stringify(inputObject)`.
 3. Propagates all other application or execution errors without retrying.
 
+### Tool Lifecycle Events & Backward Compatibility (PR #245 / Chrome 156+)
+
+Starting in Chrome 156.0.8076.0 (PR #245, superseding PR #146), the `ontoolactivated` and `ontoolcancel` event handler properties and lifecycle events moved from `window` to `document.modelContext`.
+
+The WebMCP specification introduces dedicated event interfaces:
+
+- `ToolActivatedEvent`: Dispatched when tool execution starts, exposing `readonly attribute DOMString toolName`.
+- `ToolCancelEvent`: Dispatched when tool execution is cancelled, exposing `readonly attribute DOMString toolName`.
+
+#### Backward Compatibility & Degradation Strategy
+
+Because Chrome updates unevenly across user environments, enterprise installs, channels (Stable vs Dev vs Canary), and runtime shells (Electron, PWA, headless agents), ShadowClaw implements a robust target detection and subscription layer:
+
+```ts
+import {
+  getWebMcpEventTarget,
+  addWebMcpEventListener,
+  onWebMcpToolActivated,
+  onWebMcpToolCancel,
+} from "./webmcp.js";
+
+// 1. Subscribe to tool execution start
+const unsubscribeActivated = onWebMcpToolActivated(({ toolName }) => {
+  console.log(`Tool "${toolName}" started execution.`);
+});
+
+// 2. Subscribe to tool execution cancellation
+const unsubscribeCancel = onWebMcpToolCancel(({ toolName }) => {
+  console.log(`Tool "${toolName}" execution is cancelled.`);
+});
+
+// Clean up listeners when needed
+unsubscribeActivated();
+unsubscribeCancel();
+```
+
+#### Why ShadowClaw's Implementation is More Robust
+
+While the canonical Chrome preview compat snippet checks:
+
+```js
+const targetFor = (type, listener, options) =>
+  (`on${type}` in (document.modelContext ?? {})
+    ? document.modelContext
+    : window
+  ).addEventListener(type, listener, options);
+```
+
+ShadowClaw's `getWebMcpEventTarget()` and `addWebMcpEventListener()` add essential production safeguards:
+
+1. **Environment Safety:** Safely guards against `ReferenceError` when `document` or `window` are undefined (such as in Node.js headless CLI agents, background tasks, or Web Workers).
+2. **Capability Verification:** Verifies that the resolved target actually implements `addEventListener` (guarding against partial mocks, older polyfills, or non-EventTarget objects).
+3. **Multi-tier Fallback Chain:**
+   - Checks `document.modelContext` (Chrome 156+).
+   - Falls back to `navigator.modelContext` (retained for older Canary builds < 152).
+   - Falls back to `window` (Chrome < 156 legacy event location).
+   - Returns `null` cleanly in non-browser environments without throwing.
+4. **Idempotent Cleanup:** Returns an unsubscription callback `() => void` to prevent memory leaks and dangling listeners.
+5. **AbortSignal Support:** Accepts standard `AddEventListenerOptions` including `{ signal }` to automatically unsubscribe when an `AbortController` triggers.
+6. **Payload Normalization:** Safely resolves `toolName` whether delivered directly via `ToolActivatedEvent` / `ToolCancelEvent` (`event.toolName`) or through legacy/custom event payloads (`event.detail.toolName`).
+7. **Optional Dual-Coverage with Deduplication:** Allows `{ listenBoth: true }` to listen across both `modelContext` and `window` during migration/testing phases while deduplicating duplicate firings within the same tick.
+8. **Orchestrator Event Bus Integration:** `syncWebMcpRegistration()` automatically binds WebMCP lifecycle events to `orchestrator.events`, emitting `"webmcp-tool-activated"` and `"webmcp-tool-cancel"` and cleaning up listeners during unregistration.
+
 ### Tool Querying & Graceful Degradation (`getWebMcpTools`)
 
 ShadowClaw provides `getWebMcpTools()` to safely query registered WebMCP tools across different browser environments:

package/dist/public/{downloadGroupFile-BiZQYY-O.js → downloadGroupFile-ChWHuap_.js}

@@ -1 +1 @@
-import{t as e}from"./getGroupDir-CLz5c8cg.js";import{p as t}from"./tools-nysPKnGT.js";async function n(n,r,i){let a=await e(n,r),{dirs:o,filename:s}=t(i),c=a;for(let e of o)c=await c.getDirectoryHandle(e);let l=await(await c.getFileHandle(s)).getFile(),u=URL.createObjectURL(l),d=document.createElement(`a`);d.href=u,d.download=s,document.body.appendChild(d),d.click(),document.body.removeChild(d),URL.revokeObjectURL(u)}export{n as t};
+import{t as e}from"./getGroupDir-CeSr4fzS.js";import{p as t}from"./tools-sOLCHTj8.js";async function n(n,r,i){let a=await e(n,r),{dirs:o,filename:s}=t(i),c=a;for(let e of o)c=await c.getDirectoryHandle(e);let l=await(await c.getFileHandle(s)).getFile(),u=URL.createObjectURL(l),d=document.createElement(`a`);d.href=u,d.download=s,document.body.appendChild(d),d.click(),document.body.removeChild(d),URL.revokeObjectURL(u)}export{n as t};

package/dist/public/e2e/README.md

@@ -429,8 +429,9 @@ export const TIME_MINUTES_ONE = 60000;
 - For Provider Help dialogs, mock provider errors to trigger the dialogs and verify the contextual instructions and links.
 - **Remote MCP Testing**: Verify tool discovery, execution, and automatic OAuth reconnection flows by mocking streamable HTTP responses and OAuth failure modes.
 - **Proxy Security Testing**: Verify that the `/proxy` endpoint rejects non-HTTP/S schemes (`file:`, `ftp:`, etc.) with `400` and blocks private/loopback IP targets (`localhost`, `127.*`, `10.*`, `192.168.*`, `169.254.*`) with `403`. Use the unit tests in `src/server/utils/proxy-helpers.test.ts` for scheme and SSRF guard coverage; E2E tests should verify that the authenticated service-worker format (body-based JSON with `Content-Type: application/json`) is still allowed to reach local tool servers.
-- **Page Navigation Testing**: When testing pages or file viewer navigation, ensure keyboard events (`ArrowLeft`/`ArrowRight`) are properly guarded and do not trigger when the active element is an input or content-editable. Swipe gestures can be simulated using mouse events (`mousedown`, `mousemove`, `mouseup`) or touch events; ensure drag/text-selection does not trigger a false swipe. Assert that same-origin links are validated via `isPossibleAppRoute` so non-app routes (e.g. standalone demo subpaths) bypass SPA navigation and trigger native browser navigation (`window.open`).
-- **Sidebar Visibility & Fallback Testing**: When verifying sidebar toggle controls, assert that hiding the currently active view triggers automatic navigation to the next available visible view (`getDefaultSidebarPage`).
+- **Page Navigation Testing**: When testing pages or file viewer navigation, ensure keyboard events (`ArrowLeft`/`ArrowRight`) are properly guarded and do not trigger when the active element is an input or content-editable. Swipe gestures can be simulated using mouse events (`mousedown`, `mousemove`, `mouseup`) or touch events; ensure drag/text-selection does not trigger a false swipe. Assert that same-origin links are validated via `isPossibleAppRoute` so non-app routes (e.g. standalone demo subpaths) bypass SPA navigation and trigger native browser navigation (`window.open`). Verify root pretty path resolution (mapping `/` and `/index.html` to `{ page: "pages", groupId: "br:main", path: "index.html" }` and resolving `{ page: "pages" }` back to `/`), and assert that in-feed scroll / scroll-spy `replaceState` navigations with `inFeedScroll: true`, `scrollSpy: true`, or `suppressRouter: true` do not trigger router route changes or re-renders.
+- **Sidebar Visibility & Fallback Testing**: When verifying sidebar toggle controls, assert that hiding the currently active view triggers automatic navigation to the next available visible view (`getDefaultSidebarPage`). For custom slotted sidebar links (`[slot="sidebar"]`, `[slot="sidebar-nav"]`, etc.), assert that link elements accurately reflect `.active` classes and `aria-current="page"` across route navigations, and clicking slotted links on mobile viewports (<896px) auto-closes the sidebar drawer.
+- **Theming & Stylesheet Testing**: When testing custom themed deployments or template sites (`theme.stylesheet`), assert that `<link rel="stylesheet">` tags are placed before `</head>` in the document head without corrupting inlined scripts. Verify that layout tokens (e.g. `--shadow-claw-sidebar-footer-display: none;`, `--shadow-claw-header-main-toggle-display: none;`) correctly apply to shadow DOM elements, slotted `.sidebar-custom-sections` elements scroll independently within `max-height: calc(100dvh - 4rem)`, and preview iframes correctly load the custom stylesheet and inherit computed `--*` CSS custom properties.
 - **Custom Element Guard Testing**: When testing custom elements in E2E or unit suites, verify that registering unapproved custom element tags throws a security error and DOM injection of unapproved custom element tags results in immediate removal by the DOM mutation guard. For custom element script descriptors (`customElements.scripts`), verify that object entries (`{ src, hasInit }`) are correctly parsed alongside legacy URLs, and `init()` is executed exclusively when `hasInit: true`.
 - **Sandboxed Iframe & Storage Proxy Testing**: Verify preview iframe navigation and storage bridges in `file-viewer-preview-bridge.js` and `iframe-storage-bridge.js`. Assert that link clicks and programmatic navigation (`location.href`, `location.assign()`, `location.replace()`) relay navigation messages to the parent frame via `postMessage`, rebuilding the iframe `srcdoc` with injected `location.search` parameters before custom element scripts execute. Assert that `IndexedDB` and `localStorage` CRUD operations are proxied via `shadow-claw-storage-proxy` to parent storage, `showOpenFilePicker` and `showSaveFilePicker` degrade gracefully to input/download triggers, ServiceWorker/caches getters are trapped without `SecurityError` rejections, and `IframeBroadcastProxy` relays BroadcastChannel messages while suppressing command echo feedback loops via `isRelayingCommandFromParent`.
 - **Peer & Room File Sharing Testing**: When verifying file actions in `<shadow-claw-files>` and `<shadow-claw-file-viewer>`, ensure tests assert that peer transfer options (`.files__send-peer`, `.modal-share-dropdown`) appear strictly when the conversation is a peer (`peer:...`) or room (`room:...`), and remain hidden in non-peer conversations. Verify that clicking peer transfer options correctly calls the underlying channel/store methods, shows typing indicators during transfer, and renders the sent attachment in the local chat stream.

package/dist/public/{e2e-bridge-CybB810Q.js → e2e-bridge-BkaldjV2.js}

@@ -1 +1 @@
-import{W as e,it as t,tt as n,v as r}from"./orchestrator-D6tel2Zp.js";function i(i,a){globalThis.__SHADOWCLAW_E2E__={isReady(){return i.ready},getDb(){return a.db},getActiveGroupId(){return i.activeGroupId},async createConversation(e){let t=a.db;if(!t)throw Error(`[E2E Bridge] DB not ready`);return i.createConversation(t,e)},async switchConversation(e){let t=a.db;if(!t)throw Error(`[E2E Bridge] DB not ready`);await i.switchConversation(t,e)},async loadTasks(){let e=a.db;if(!e)throw Error(`[E2E Bridge] DB not ready`);await i.loadTasks(e)},async configureProvider(o,s,c,l){let u=i.orchestrator,d=a.db;if(!u||!d)throw Error(`[E2E Bridge] Orchestrator or DB not ready`);await t(u,d,o,{loadApiKeyForProvider:u.loadApiKeyForProvider.bind(u),getApiKeyForHeaders:()=>e(u)}),await u.setApiKey(d,s),await n(u,d,c),await r(u,d,l)}}}function a(){return globalThis.__SHADOWCLAW_E2E_ENABLE__===!0}export{a as n,i as t};
+import{W as e,it as t,tt as n,v as r}from"./orchestrator-BVnC4Vtt.js";function i(i,a){globalThis.__SHADOWCLAW_E2E__={isReady(){return i.ready},getDb(){return a.db},getActiveGroupId(){return i.activeGroupId},async createConversation(e){let t=a.db;if(!t)throw Error(`[E2E Bridge] DB not ready`);return i.createConversation(t,e)},async switchConversation(e){let t=a.db;if(!t)throw Error(`[E2E Bridge] DB not ready`);await i.switchConversation(t,e)},async loadTasks(){let e=a.db;if(!e)throw Error(`[E2E Bridge] DB not ready`);await i.loadTasks(e)},async configureProvider(o,s,c,l){let u=i.orchestrator,d=a.db;if(!u||!d)throw Error(`[E2E Bridge] Orchestrator or DB not ready`);await t(u,d,o,{loadApiKeyForProvider:u.loadApiKeyForProvider.bind(u),getApiKeyForHeaders:()=>e(u)}),await u.setApiKey(d,s),await n(u,d,c),await r(u,d,l)}}}function a(){return globalThis.__SHADOWCLAW_E2E_ENABLE__===!0}export{a as n,i as t};

package/dist/public/{file-viewer-DLUBvOVD.js → file-viewer-Df4qUJCn.js}

@@ -1 +1 @@
-import{o as e}from"./config-D4lVqMs8.js";import{t}from"./dist-B9m1QM9v.js";import{pn as n}from"./orchestrator-D6tel2Zp.js";import{t as r}from"./getGroupDir-CLz5c8cg.js";import{f as i,p as a}from"./tools-nysPKnGT.js";async function o(e,t,n){let i=await r(e,t),{dirs:o,filename:s}=a(n),c=i;for(let e of o)c=await c.getDirectoryHandle(e);return await(await c.getFileHandle(s)).getFile()}const s=new class{_file;constructor(){this._file=new t.State(null)}closeFile(){this._file.set(null)}get file(){return this._file.get()}getFile(){return this.file}getPreviewBinaryMimeType(e){return{"3gp":`video/3gpp`,"7z":`application/x-7z-compressed`,aac:`audio/aac`,apng:`image/apng`,avi:`video/x-msvideo`,avif:`image/avif`,bin:`application/octet-stream`,bmp:`image/bmp`,db:`application/vnd.sqlite3`,dll:`application/octet-stream`,dmg:`application/octet-stream`,dylib:`application/octet-stream`,exe:`application/vnd.microsoft.portable-executable`,flac:`audio/flac`,flv:`video/x-flv`,gif:`image/gif`,gz:`application/gzip`,heic:`image/heic`,heif:`image/heif`,ico:`image/x-icon`,iso:`application/octet-stream`,jpeg:`image/jpeg`,jpg:`image/jpeg`,m4a:`audio/mp4`,m4v:`video/mp4`,mkv:`video/x-matroska`,mov:`video/mp4`,mp3:`audio/mpeg`,mp4:`video/mp4`,oga:`audio/ogg`,ogg:`audio/ogg`,ogv:`video/ogg`,png:`image/png`,rar:`application/vnd.rar`,so:`application/octet-stream`,sqlite:`application/vnd.sqlite3`,sqlite3:`application/vnd.sqlite3`,tar:`application/x-tar`,tif:`image/tiff`,tiff:`image/tiff`,wasm:`application/wasm`,wav:`audio/wav`,weba:`audio/webm`,webm:`video/webm`,webp:`image/webp`,wmv:`video/x-ms-wmv`,zip:`application/zip`}[e.toLowerCase().split(`.`).pop()||``]||``}async openFile(t,r,a=e){try{let e=r.split(`/`).pop()||r,s=/\.pdf$/i.test(e),c=this.getPreviewBinaryMimeType(e);if(s){let i=await n(t,a,r);this._file.set({name:e,path:r,groupId:a,content:``,kind:`pdf`,binaryContent:i,mimeType:`application/pdf`});return}if(c){let n=await o(t,a,r);this._file.set({name:e,path:r,groupId:a,content:``,kind:`binary`,binaryContent:null,nativeFile:n,mimeType:c});return}let l=await i(t,a,r);this._file.set({name:e,path:r,groupId:a,content:l,kind:`text`,binaryContent:null,mimeType:`text/plain`})}catch(e){throw console.error(`Failed to open file:`,r,e),e}}};export{s as t};
+import{o as e}from"./config-Dewnqegf.js";import{t}from"./dist-B9m1QM9v.js";import{pn as n}from"./orchestrator-BVnC4Vtt.js";import{t as r}from"./getGroupDir-CeSr4fzS.js";import{f as i,p as a}from"./tools-sOLCHTj8.js";async function o(e,t,n){let i=await r(e,t),{dirs:o,filename:s}=a(n),c=i;for(let e of o)c=await c.getDirectoryHandle(e);return await(await c.getFileHandle(s)).getFile()}const s=new class{_file;constructor(){this._file=new t.State(null)}closeFile(){this._file.set(null)}get file(){return this._file.get()}getFile(){return this.file}getPreviewBinaryMimeType(e){return{"3gp":`video/3gpp`,"7z":`application/x-7z-compressed`,aac:`audio/aac`,apng:`image/apng`,avi:`video/x-msvideo`,avif:`image/avif`,bin:`application/octet-stream`,bmp:`image/bmp`,db:`application/vnd.sqlite3`,dll:`application/octet-stream`,dmg:`application/octet-stream`,dylib:`application/octet-stream`,exe:`application/vnd.microsoft.portable-executable`,flac:`audio/flac`,flv:`video/x-flv`,gif:`image/gif`,gz:`application/gzip`,heic:`image/heic`,heif:`image/heif`,ico:`image/x-icon`,iso:`application/octet-stream`,jpeg:`image/jpeg`,jpg:`image/jpeg`,m4a:`audio/mp4`,m4v:`video/mp4`,mkv:`video/x-matroska`,mov:`video/mp4`,mp3:`audio/mpeg`,mp4:`video/mp4`,oga:`audio/ogg`,ogg:`audio/ogg`,ogv:`video/ogg`,png:`image/png`,rar:`application/vnd.rar`,so:`application/octet-stream`,sqlite:`application/vnd.sqlite3`,sqlite3:`application/vnd.sqlite3`,tar:`application/x-tar`,tif:`image/tiff`,tiff:`image/tiff`,wasm:`application/wasm`,wav:`audio/wav`,weba:`audio/webm`,webm:`video/webm`,webp:`image/webp`,wmv:`video/x-ms-wmv`,zip:`application/zip`}[e.toLowerCase().split(`.`).pop()||``]||``}async openFile(t,r,a=e){try{let e=r.split(`/`).pop()||r,s=/\.pdf$/i.test(e),c=this.getPreviewBinaryMimeType(e);if(s){let i=await n(t,a,r);this._file.set({name:e,path:r,groupId:a,content:``,kind:`pdf`,binaryContent:i,mimeType:`application/pdf`});return}if(c){let n=await o(t,a,r);this._file.set({name:e,path:r,groupId:a,content:``,kind:`binary`,binaryContent:null,nativeFile:n,mimeType:c});return}let l=await i(t,a,r);this._file.set({name:e,path:r,groupId:a,content:l,kind:`text`,binaryContent:null,mimeType:`text/plain`})}catch(e){throw console.error(`Failed to open file:`,r,e),e}}};export{s as t};

package/dist/public/{getGroupDir-CLz5c8cg.js → getGroupDir-CeSr4fzS.js}

@@ -1 +1 @@
-import{n as e}from"./rolldown-runtime-aKtaBQYM.js";import{r as t,x as n}from"./config-D4lVqMs8.js";import{a as r}from"./app-routes-BMQ4HFaM.js";import{t as i}from"./txPromise-C2iYogHX.js";import{t as a}from"./getConfig-4saf0Tkq.js";import{r as o}from"./headless-BbtDA5cs.js";import{t as s}from"./memoryStorage-Bew1X8Uy.js";async function c(e,...t){let n=e;for(let e of t){let t=await n.getDirectoryHandle(e,{create:!0});if(typeof n.isSameEntry==`function`&&await n.isSameEntry(t))throw Error(`Directory navigation failed: "${e}" resolved to the same directory as its parent. The stored directory handle may be stale — try re-selecting the storage folder.`);n=t}return n}function l(e,t){return i(e,`config`,`readwrite`,e=>e.delete(t)).then(()=>void 0)}let u=null;async function d(e,t){try{return await e.entries().next(),`granted`}catch{return t}}function f(){let e=r();return e?`${n}-${e}`:n}async function p(){try{if(typeof navigator<`u`&&navigator.storage&&typeof navigator.storage.getDirectory==`function`){let e=await navigator.storage.getDirectory(),t=f();return await e.getDirectoryHandle(t,{create:!0})}}catch(e){console.warn(`OPFS is unavailable (e.g. Firefox Private Browsing). Using in-memory storage fallback:`,e)}return s()}function m(e){if(!e||typeof e!=`object`)return!1;let t=globalThis.FileSystemDirectoryHandle;return t!==void 0&&e instanceof t||typeof e.getDirectoryHandle==`function`&&typeof e.getFileHandle==`function`}async function h(e){if(u)return u;try{let n=await a(e,t.STORAGE_HANDLE);if(m(n)){let e=n;if(typeof e.queryPermission==`function`&&await e.queryPermission({mode:`readwrite`})!==`granted`&&typeof e.requestPermission==`function`)try{await e.requestPermission({mode:`readwrite`})}catch{}return e}}catch(e){console.warn(`Failed to retrieve local storage handle from DB:`,e)}return p()}function g(e){u=e}function _(){u=null}function v(e){return e instanceof DOMException&&e.name===`InvalidStateError`}async function y(e){await l(e,t.STORAGE_HANDLE),u=null}async function b(e){if(u)try{let e=await u.queryPermission({mode:`readwrite`});return{type:`local`,permission:e===`granted`?`granted`:await d(u,e),name:u.name}}catch{console.warn(`Getting storage status failed for explicit storage root.`)}try{let n=await a(e,t.STORAGE_HANDLE);if(m(n)){let e=n,t=await e.queryPermission({mode:`readwrite`});return{type:`local`,permission:t===`granted`?`granted`:await d(e,t),name:e.name}}}catch(e){console.warn(`Failed to check storage status:`,e)}return{type:`opfs`,permission:`granted`,name:`OPFS`}}var x=e({getGroupDir:()=>S});async function S(e,t){let n=await h(e);return o()?n:c(n,`groups`,t.replace(/:/g,`-`))}export{b as a,y as c,h as i,g as l,x as n,_ as o,f as r,v as s,S as t};
+import{n as e}from"./rolldown-runtime-aKtaBQYM.js";import{r as t,x as n}from"./config-Dewnqegf.js";import{a as r}from"./app-routes-C6-H2zPH.js";import{t as i}from"./txPromise-C2iYogHX.js";import{t as a}from"./getConfig-4saf0Tkq.js";import{r as o}from"./headless-BbtDA5cs.js";import{t as s}from"./memoryStorage-ykv-Ri-y.js";async function c(e,...t){let n=e;for(let e of t){let t=await n.getDirectoryHandle(e,{create:!0});if(typeof n.isSameEntry==`function`&&await n.isSameEntry(t))throw Error(`Directory navigation failed: "${e}" resolved to the same directory as its parent. The stored directory handle may be stale — try re-selecting the storage folder.`);n=t}return n}function l(e,t){return i(e,`config`,`readwrite`,e=>e.delete(t)).then(()=>void 0)}let u=null;async function d(e,t){try{return await e.entries().next(),`granted`}catch{return t}}function f(){let e=r();return e?`${n}-${e}`:n}async function p(){try{if(typeof navigator<`u`&&navigator.storage&&typeof navigator.storage.getDirectory==`function`){let e=await navigator.storage.getDirectory(),t=f();return await e.getDirectoryHandle(t,{create:!0})}}catch(e){console.warn(`OPFS is unavailable (e.g. Firefox Private Browsing). Using in-memory storage fallback:`,e)}return s()}function m(e){if(!e||typeof e!=`object`)return!1;let t=globalThis.FileSystemDirectoryHandle;return t!==void 0&&e instanceof t||typeof e.getDirectoryHandle==`function`&&typeof e.getFileHandle==`function`}async function h(e){if(u)return u;try{let n=await a(e,t.STORAGE_HANDLE);if(m(n)){let e=n;if(typeof e.queryPermission==`function`&&await e.queryPermission({mode:`readwrite`})!==`granted`&&typeof e.requestPermission==`function`)try{await e.requestPermission({mode:`readwrite`})}catch{}return e}}catch(e){console.warn(`Failed to retrieve local storage handle from DB:`,e)}return p()}function g(e){u=e}function _(){u=null}function v(e){return e instanceof DOMException&&e.name===`InvalidStateError`}async function y(e){await l(e,t.STORAGE_HANDLE),u=null}async function b(e){if(u)try{let e=await u.queryPermission({mode:`readwrite`});return{type:`local`,permission:e===`granted`?`granted`:await d(u,e),name:u.name}}catch{console.warn(`Getting storage status failed for explicit storage root.`)}try{let n=await a(e,t.STORAGE_HANDLE);if(m(n)){let e=n,t=await e.queryPermission({mode:`readwrite`});return{type:`local`,permission:t===`granted`?`granted`:await d(e,t),name:e.name}}}catch(e){console.warn(`Failed to check storage status:`,e)}return{type:`opfs`,permission:`granted`,name:`OPFS`}}var x=e({getGroupDir:()=>S});async function S(e,t){let n=await h(e);return o()?n:c(n,`groups`,t.replace(/:/g,`-`))}export{b as a,y as c,h as i,g as l,x as n,_ as o,f as r,v as s,S as t};