Ship the in-progress ES-module refactor of the web-ui (new static/modules/
layout, Usage/Settings pages, uplot-based dashboard) alongside a round of
security and UX fixes:
- main.go: add CSP + X-Frame-Options: DENY + X-Content-Type-Options:
nosniff + Referrer-Policy middleware on every response; WS CheckOrigin
now requires Origin host to match Host (blocks cross-site WebSocket
hijacking); upgrade client before dialing upstream so origin check
runs first; fatal on unparseable AGENTMON_QUERY_BASE.
- app.js: delegated click handler intercepts same-origin <a> clicks for
SPA navigation (prev. every nav link caused a full page reload,
dropping WS + in-memory state); delegated .copy-btn[data-copy]
handler replaces inline onclick=; removed window.navigate /
window.copyToClipboard globals and the duplicated handleGlobalSearch.
- modules/nav-signal.js: per-route AbortController so in-flight fetches
are cancelled when the user navigates away, preventing stale toasts
and wasted renders.
- modules/api.js: honours the nav signal by default; AbortError is
silent.
- modules/router.js: resets the nav controller on every route; dropped
the fixed 80ms transition delay; breadcrumbs no longer emit inline
onclick= (delegated handler picks them up).
- modules/utils.js: renderCopyButton emits data-copy=\"...\" instead of
nesting a JS string inside an HTML attribute — fixes an XSS where
values containing ' broke out via ' decoding.
Verified: go build clean; `node --check` clean on all modified modules;
manual curl probes confirm security headers present on every response
and WS upgrade returns 403 for cross-origin/missing Origin while 101
for same-origin.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Label all agentmon docker-compose services with agentmon.monitor=true
and agentmon.group=agentmon so the swarm-monitor picks them up.
Adds Group field to ServiceSnapshot, probes /healthz for api/web roles,
and renders a separate "Agentmon" section below Swarm Services on the
Infrastructure page with new api and worker card renderers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Active sessions query now finds truly active sessions (started
anytime, no session.end ever) instead of only today's sessions
- Use uPlot setData() for live WS updates instead of destroying
and recreating the chart on every event
- Destroy chart only on window change so it recreates with new scale
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add event_type and framework filters to events query endpoint
- Add /agents SPA route to web-ui server
- Add Agents nav link and route in frontend
- Add agents page CSS (timeline, VM pills, stats panel)
- Build VM status strip, activity timeline, and real-time stats
- Add agentmon hook for OpenClaw (HOOK.md + handler.ts)
- Add docker-compose, Dockerfile, and supporting infra files
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Sessions list with filters (time, framework, host)
- Session detail with runs table
- Run detail with expandable spans
- Dark theme GitHub-style UI
- API proxy to query-api via /api
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
William Valentin