newos4/modules, branch v4.6.156

fix(newos4): workspace re-opened the modules panel every tick; picker lost two cards; commander was black

2026-11-07T18:29:06+00:00

Three defects reported against v4.6.155, each reproduced before touching code: 1. 'the modules tab keeps opening' (workspace). api.capture() runs dispatchCommand() for real, and the Modules card called bare 'modules' — whose only effect is terminal.openModuleManager(). Every 15 s refresh re-opened the panel (measured: #module-manager display:flex at t+9s and t+18s). The card now captures 'listmods' (same inventory as text), and api.capture() refuses UI-only commands outright so a future card cannot reintroduce it. 2. 'the picker got reduced to 4 items'. showPicker() used this.list() once four modes were registered — but modes are lazy, so that is 'modes you have already visited'. It now always renders the six in level order, taking registered specs for label/tagline. 3. 'commander is mostly black' on a phone. The base sheet's #ui-root rule used body[data-ui-mode]:not(...) #ui-root (1,2,1) and therefore beat every mode's own body[data-ui-mode='x'] #ui-root (1,1,1): commander/studio/cockpit asked for display:grid and got flex column. Commander collapsed to a 253 px centre column in an 844 px page with both rails hidden. Base specificity is now (1,0,0) with an explicit !important hide for classic/boot, and the commander phone query pins grid-template-rows: minmax(0,1fr) so the single row fills. Measured after: picker 6 cards after visiting four modes; #module-manager stays display:none across a refresh cycle; commander display:grid, phone centre 390x810 with a 673 px terminal, desktop 232/788/260 columns. probe-ui-modes.py --cycle -> ALL PASS, 13 checks; shell test 25/25. v4.6.156

fix(newos4): second review round — identity for every stock node, load dedup, sweep race, a11y

2026-11-07T18:03:38+00:00

Four models (kimi-k2.7-code, deepseek-v4-pro, minimax-m3, glm-5.3) reviewed the shipped change set. Review log with every accepted and rejected finding: .hermes/plans/2026-11-07_163420-newos4-six-ui-modes.review-log.md - identity guard now covers every snapshot node, not just #terminal-container: terminal.js also binds #output, #command-input, #input-area and #status-bar, so a cloned one leaves the terminal writing into a detached node while the page looks perfect - _restoreStock anchors on the next stock node already home, then on the recorded trailing sibling; a raw child index was measured wrong (terminal,input,status-bar,quick-actions) - _loading map: a double-clicked card or a repeated 'ui easy' loads the mode once - _sweepPending returns while that id is in flight instead of declaring failure at 6 s and overwriting the stored preference - _syncChrome() on every switch (quick-actions was left in the tab order behind the mode root) - picker: role=dialog/aria-modal/labelledby/focus, shown after 600 ms instead of waiting for a registration that never happens with lazy modes, and suppressed when ?ui= already applied - ?ui= must be one of the six; _loadMode only accepts packages['ui-']; hasOwnProperty on modes - VFS names are shell-quoted before reaching api.exec (cat/edit) - refresh generation no longer bumps per tick (slow captures left later panes at '...') - easy: padding shorthand reset the 34 px footer reserve (footer overlapped the composer) - cockpit panes get tabIndex and focus; F1/F12 left to the browser; nothing swallowed in inputs - api.el lost its unused innerHTML sink; the test lost its _parseArgs stub (it hid the regression) - v4.6.155

chore(newos4): v4.6.153 — cache-bust the review fixes

2026-11-07T17:57:47+00:00

fix(newos4): four-model review — lazy-load race, restore order, a11y, key handling

2026-11-07T17:56:04+00:00

Reviewed the shipped change set with kimi-k2.7-code, deepseek-v4-pro, glm-5.3 and minimax-m3. Findings below are the ones that survived verification against file:line; the rest are in .hermes/plans/2026-11-07_163420-newos4-six-ui-modes.review-log.md Accepted and fixed: - apply() had no generation token: a lazy mode load that finished after the user switched to another mode force-applied the abandoned one (`apply(want,{force:true})` in the .then). Every apply() now bumps `_loadSeq` and the callback acts only while its token is newest. Same token also removes a double mount: registerMode() already applies the mode as it registers, so the callback was mounting every lazy mode twice (teardown+cleanup twice). - _restoreStock() used the recorded `nextSibling` as insert anchor. Every real mode moves SEVERAL stock nodes (terminal, input, status bar), so the recorded sibling is inside the mode container and every insert fell through to append. Now anchors on the next stock node that is already back home. A raw child index also fails (elements removed shift the indices) — measured order terminal,input,status-bar,quick-actions. - _abortToClassic() left the broken mode persisted and `_pending` set, so the next reload retried the same failure with no way out. It now clears both and stores 'classic'. - ?ui= reached classList.add('wx11-ui-' + id) unvalidated: a space or colon throws a DOMException and boot dies. Validated against /^[a-z][a-z0-9-]{0,15}$/ and no longer persisted (the comment always claimed it was a request, not a preference). - Modes hide .prompt-label, so #command-input had no accessible name at all. The shell sets aria-label once when a mode reparents it. - cockpit: preventDefault on all F1-F8 killed help, the address bar and devtools. F1/F12 are left to the browser and nothing is swallowed when focus is in a text field. - commander: Ctrl/Cmd+K opened the palette even while typing in the composer. Ignored from inside editable elements now. - picker: role=dialog + aria-modal + aria-labelledby + focus on the first card. - api.capture(): strip the quoting characters from argv (capturePipeOutput takes argv). - stale `wx11-ui-*` body class removed on switch instead of accumulating. Rejected with evidence: - "loadModuleFromURL may not return a boolean" — modules/core/module-manager.js:56 returns true on success and :60 false in the catch. Verified by reading the function. - "_abortToClassic does not clear _pending" — it did not; that one is accepted above. The sibling claim that it "leaves the broken mode persisted" was verified by reading the function: it never touched localStorage, so also accepted. - "mm.LATEST_VER / webx11_cache_ver are never set, so the mode URL falls back to ?v=0" — modules/core/module-loader.js:12 sets window.webx11.moduleManager.LATEST_VER and :14-15 writes webx11_cache_ver. Verified live: the mode fetch carries ?v=v4.6.152. - "moduleManager.modules may be a Map" — it is a plain object (terminal.moduleManager.modules .CryptoGzipModule is the documented access path), so ui-commander's Object.keys works. Verified: node modules/test/test-ui-shell.js -> 25/25 (the test now moves TWO stock nodes; a raw-index restore fails it with "terminal-container,input-area,status-bar,quick-actions"); probe-ui-modes.py --cycle against production -> ALL PASS, 13 checks.

fix(newos4): mode layout constraints, capture() arg split, suppress classic welcome modal

2026-11-07T17:28:29+00:00

- #ui-root is a flex column (it was display:block, so every mode's flex:1 was inert and the terminal collapsed to 0px while the composer sat at the bottom of a 4600px flow) - overflow:clip on #ui-root and body: overflow:hidden is still a scroll container, and the terminal's scrollIntoView() on new output scrolled the mode's own chrome off-screen - terminal min-height 100px: in the tabbed/panel modes its grid parent is not a flex parent - api.capture() split arguments itself; term._parseArgs does not exist, so every panel showed 'unavailable: term._parseArgs is not a function' - the classic Let's Get Started modal is suppressed in non-classic modes: it covered easy's cards

feat(newos4): six interface modes (easy -> cockpit) over one terminal

2026-11-07T17:19:47+00:00

Symptom: newOS4 had exactly one layout. A first-time user had no way in that did not require learning commands, and an operator had no surface showing live runtime state; the only way to see heap/VFS/tool-call telemetry was to type cat /sys/... Root cause: no UI layer existed. main.html hard-codes one flex column, and terminal.js binds the stock nodes by id at construction, so an alternative layout had to either duplicate the output stream or reparent the real nodes. Fix: - modules/core/module-uishell.js (new): mode registry, #ui-root, stock-node snapshot/restore, identity check that reverts to classic when a mode removes or clones #terminal-container, shell-docked #ui-foot (the AI stop button exists in every mode), ui command, gated first-run picker, ?ui= honoured only if the mode actually registers, lazy mode loading via the same loader ext modules use. - modules/ext/ui-{easy,chat,studio,workspace,commander,cockpit}.js (new): six reparenting skins with scoped CSS. Workspace/commander/cockpit read real /sys/* mounts and captured command output; no value on screen is invented. - modules/test/test-ui-shell.js (new): 25 assertions - teardown, clone rejection, failed-mount fallback, footer docking, destructive-mode rejection. - terminal.js: register the shell; make one failing ext module stop aborting the rest of the serial load loop (it did, silently, which is why six ui-* files at the end of extKeys never loaded). - module-loader.js: LATEST_VER v4.6.152. The six ui-* keys are deliberately NOT in extKeys - see the rate-limit note below. - admin/scripts/probe-ui-modes.py (new): 6 modes x 2 viewports plus a --cycle pass that switches all seven states on ONE page and asserts the output node keeps its identity. Also fixed, found while testing (pre-existing, production-affecting): - nginx limit_req zone=webx11 burst 50 -> 200. One newOS4 boot fans out ~40 assets; the bucket emptied mid-boot and every later module got 503. Measured in webx11.error.log: "limiting requests, excess: 50.696 by zone webx11" against modules/ext/ui-chat.js. A reload within ~50 s silently broke modules. Sustained rate unchanged at 60r/m. Verified: node modules/test/test-ui-shell.js -> 25/25; removing both _restoreStock() calls measures 20/25 with five FAILs; probe-ui-modes.py --cycle against production -> ALL PASS, 13 checks; served bytes: v4.6.152 x3 in main.html, class UIShellModule x1 in core-bundle.js, six ui-* packages in packages.json.

release: v4.6.151 — wget that actually saves, web_fetch that actually pages

2026-11-06T15:19:59+00:00

S1 (reported by agent-os4-maint-01, wrongly refuted by the chat auto-reply): wget existed but was unusable and dishonest. - Cause 1: _cmdWget used the page's own fetch(url), so every cross-origin URL died on CORS ("Failed to fetch"). Measured in the served v4.6.150 page: fetch(cgit README) threw, /api/fetch returned 200/1954 bytes. - Cause 2: _vfsWriteBytes ignored writeFile()'s boolean, so the command printed a green tick when the target directory did not exist. Measured: fs.writeFile('nosuchdir/x.txt') === false. - Cause 3: bytes were round-tripped through String.fromCharCode, mangling UTF-8. - Fix: fetch through /api/fetch (raw source), mkdir -p, writeFile + read-back verification, error instead of a tick on failure. Register curl with -s/-o parsing delegating to the same writer so the two cannot drift. S2 (same reporter): web_fetch could not page and said it could. - Cause: the handler honoured max_chars up to 50 000, then _clipToolResult kept toolResultChars-200 = 11 800, so 38 200 chars vanished silently; offset was not in the schema and was never read, so next_offset pointed at a page the caller could not request again. - Fix: offset/next_offset/total_chars/source_bytes in the contract; the page is built, measured against the clip budget and shrunk until the envelope fits, so next_offset - returned_chars is always 0. - Also fixed: _clipToolResult appended "0 of N chars withheld" when the content already fitted, claiming a loss that did not happen. C1: fetch --save=FILE — the only terminal path from a remote URL to the VFS, so a 90 KB source page no longer has to be read through 3 000-char scrollback. Proxy: /api/extract now returns source_bytes (raw page size) and content_chars_utf16. Python len() counts code points while JS String.length counts UTF-16 units; 7 astral characters in the changelog left a 7-char gap at the end of a 90 KB page (measured). _html_ok declares charset=utf-8. Verified: node --check on all four modules; py_compile; bundles rebuilt; served bytes identical to disk for all five assets at ?v=v4.6.151; live in the browser: curl -s -o review/main.md saved 1954 chars with the correct head, a 404 wrote no file, fetch --save wrote 91 518 chars, web_fetch p1 returned 11 754 with next_offset 11 754 (gap 0), page 2 started at a different offset with next 23 496.

release(v4.6.150): commit the module work that has been live but uncommitted

2026-11-06T10:45:21+00:00

Operator commit-approve, 2026-11-06. These changes have been served since 2026-11-02/03 while git HEAD still stamped v4.6.146, so the mirror published a tree four builds behind the running instance and the release tag named the wrong build. module-orchestrator.js — orchestrate-parallel reported success it could not prove. Results are now recorded by sub-task id through a resultSink handed to delegateTask (harvest matched by currentTask/lastTask strings, which a later delegation on the same agent overwrote, losing finished work as "agent not found"); the tally counts summaries with status ok instead of Promise.allSettled resolutions (a spawn refusal fulfils with undefined and used to print green); and a busy agent is no longer reused at pool cap, where two siblings erased each other's lease. Guard: modules/test/test-orchestrator-parallel-harvest.js (16 cases, reproduces the one-agent three-sub-task cap case that printed 3/3 succeeded). module-billing.js — the balance said "not signed in — newOS4 sends no session token", which was already false: the browser sends the HttpOnly cookie and parse_bearer_token() falls back to it. `cost` is on by default (the flag was opt-in and nobody knew the command existed; `cost off` opts out) and the command now prints today's platform spend from GET /api/billing/usage?days=1 alongside the session estimate. modules/ext/webdav.js — the inline WebView detector missed "Version/4.0" Android WebViews, including the operator's own phone, so the login offered a Telegram widget that cannot complete there. It now delegates to modules/wx11-tg-webview.js when the page loaded it and keeps a matching fallback (wv token, Version/4.0-Android, Telegram, FBAN/Instagram/Line). modules/ext/media.js — text analysis model renamed deepseek-v4-flash -> deepseek-v4.1-flash in both the field and the printed label. main.html + module-loader.js — v4.6.146 -> v4.6.150 in LATEST_VER and the three asset queries; core-bundle.js rebuilt (rebuild-bundles.py reports it already in sync, 1,250,569 bytes). Verified: node --check on all six scripts and the new test; the 16-case orchestrator guard passes against the deployed bundle (ORCH_SRC=...); bundle rebuild is a no-op; core-bundle.js?v=v4.6.150 answers 200.

refactor(dashboard): one dashboard — port billing/API keys, 301 the duplicate

2026-11-02T21:18:09+00:00

Two dashboards existed and had drifted apart: root /dashboard.html (118 KB single file with Subscription & Usage + API Keys) and /spaces/dashboard.html (34 KB shell + assets/js/dashboard-*.js). The nginx log settles which one is real: 77.211.5.129 requests /spaces/dashboard.html and never the root page. Tonight's fixes landed on the root page twice before that was noticed. Neither page was a superset, so deleting outright would have lost features: root only -> Subscription & Usage card, API Keys card (create/revoke/reveal) spaces only -> 2FA/TOTP, change password, delete space, email change, files, logs assets/js/dashboard-billing.js + assets/css/dashboard-billing.css (new) loadSubscription / loadApiKeys / cancelSubscription / createApiKey / revokeApiKey / copyNewApiKey / dismissNewKey + isProPlusPlan / capPlan, lifted verbatim from the root page, wrapped in an IIFE that re-exports the onclick handlers on window; getAuthHeaders() reads the modular app's localStorage.webx11_session_id; PRO_PLUS_PLANS carried over (its absence threw "PRO_PLUS_PLANS is not defined" and silently hid both cards on the first attempt) spaces/dashboard.html the two cards inserted after the Activity Logs card, plus the css/js includes dashboard-auth.js showDashboard() calls loadSubscription() once the view is up retirement root dashboard.html deleted (git rm); `location = /dashboard.html { return 301 /spaces/dashboard.html$is_args$args; }` so bookmarks keep working and ?next= survives links repointed in ai-api.html (6), ai-course.html (3), models.html (1), newOS4 hint string (v4.6.146 + rebuilt bundles so the cached bundle cannot serve the old URL) Measured (playwright, 390x844 WebView UA, agando's real session): subscriptionCard display block, height 315px, plan "Free", price "EUR0/mo", badge "Free", usage "$0.00 / inf", API-keys card hidden for a free plan, 0 console warnings /dashboard.html?next=/skills.html -> 301 -> /spaces/dashboard.html?next=/skills.html, 200, login card + Telegram button present

fix(auth-ui): stop offering a Telegram widget where it cannot work

2026-11-02T21:02:45+00:00

Two hosts cannot complete the widget flow and both are in use: an Android WebView / in-app browser (the operator's phone UA ends "; wv)") and a desktop browser that blocks the popup or hands the link to the Telegram app. The widget needs a popup that can postMessage back into the opener; in those hosts the link lands in a browser tab or in Chrome with no opener, onTelegramAuth never fires, and the login card looks dead — "it opens my default browser" (reported twice: phone, then Max's laptop). modules/wx11-tg-webview.js (new) WX11TG.isWebView() -> "; wv)", Telegram in-app, Meta in-app UAs WX11TG.dropWidgets()-> removes already-rendered oauth.telegram.org iframes/scripts dashboard.html code box is open by default and drops the nested

WebView: widget removed + "cannot work inside an app window" hint desktop: if the widget was clicked and onTelegramAuth has not fired in 12 s, open the code flow with a hint instead of leaving a dead card spaces/newos4 (webdav-login panel) in a WebView the widget is never injected, the mount is hidden and the device-code flow starts by itself; desktop keeps the widget unchanged version v4.6.145 Measured with playwright (390x844 WebView UA and 1440x900 Chrome): WebView -> 0 Telegram iframes, hint shown, code box open, real WX11- code minted desktop -> widget still rendered, code box open, real WX11- code minted newOS4 WebView -> no widget injected, code area auto-visible, code WX11-..., no JS errors newOS4 desktop -> widget still offered