Fix search spinner overlay, scroller reset, highlight leak ...

- AppSidebar: use i.ph selector + !important for spinner overlay on
  input-group-addon icon. Add transition for smooth fade.
- SessionList: simplify DynamicScroller :key to 'search'/'all' only,
  removing sessions.length to prevent scroll reset on fetchMore.
- SessionList: pass empty searchQuery when searchActive is false,
  preventing stale highlights in normal session list.
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Final search UX polish: focus, cache, spinner opacity, scroller key ...

- AppSidebar: auto-focus input when search opens via querySelector.
  Spinner icon now hides via opacity:0 instead of visibility:hidden.
- SessionsStore: add searchCache ref + restoreSearch(). Cache stores last
  search results (items, hasMore, nextOffset) so reopening search avoids
  re-fetching when query hasn't changed.
- SessionList: add :key on DynamicScroller to force recreate when switching
  between search/normal mode, fixes pinned item spacing bug.
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix search spinner placement, msg-flash disappearance, results cleanup ...

- AppSidebar: spinner moved inside GnSearchField input-group-addon via CSS
  (:deep .input-group-addon overlay). Removed spinner from sessions-label.
- AppSidebar: closeSearch and handleSelect now call sessionsStore.exitSearch()
  and reload normal session list, so search results disappear after selection.
  toggleSearch restores previous query and re-activates search on reopen.
- CSS msg-flash: removed animation-fill-mode:both and background-color:transparent
  from keyframes, so message bubble keeps its original background after flash.
- SessionsStore: added exitSearch() method (preserves query, disables active flag).
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix search flash for assistant messages, move spinner, hide highlights ...

- MessageList: pass isFlashing prop to UserMessage/AssistantMessage instead
  of applying msg-flash on wrapper div. scrollToMessage now uses rawIndices
  to map backend match_index to grouped message index.
- UserMessage: add isFlashing prop, apply msg-flash to msg-user-bubble
- AssistantMessage: add isFlashing prop, apply msg-flash to msg-assistant-content
- ChatStore: add rawIndices to built messages (user, summary, assistant)
- AppSidebar: move spinner into sessions-label, remove from search field
- SessionList: accept searchOpen prop, pass empty searchQuery when closed
  so highlights disappear after selecting a session
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Polish session search UX: GnSearchField, spinner, flash timing ...

- AppSidebar: use GnSearchField from gnexus-ui-kit, spinner during search,
  search toggle button always visible in sessions-header, hide search on select
- MessageList: fix msg-flash timing — make content visible before scrolling,
  extend flash duration to 2.5s with background + brightness
- CSS: enhance msg-flash keyframe animation
- Tests pass (51/51)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add session search across messages with backend + frontend ...

Backend:
- GET /sessions now accepts `search` query param
- _session_summary computes match_indices and match_preview from messages
- pg_session_store: messages ILIKE added to search_list and count_all
- In-memory store: search_list also filters by message content

Frontend:
- AppSidebar: search toggle icon + debounced input, Ctrl+K shortcut
- SessionItem: highlight matching text, show match_preview from search
- SessionList: pass searchQuery to SessionItem
- SessionsStore: searchQuery/searchActive state, setSearch/clearSearch
- API layer: getSessions accepts search param
- MessageList: scroll to target message + brightness flash animation
- ChatStore: loadSession accepts targetMessageIndex, scrollToMessageIndex ref
- CSS: msg-flash keyframe animation in app.scss
- Tests updated for new getSessions signature

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Compact and improve tool/thinking/plan card UX ...

- ToolCard: remove emoji header, collapse Arguments behind <details>,
  render results with structured JSON (color-coded values) or markdown
  detection for string outputs.
- SubagentStep: mirror ToolCard compact layout with same helpers.
- AssistantMessage: fold tool lists when >3 tools — show last 3 + summary
  bar with count and toggle icon-button; TransitionGroup for smooth
  expand/collapse animations.
- Plan card: switch accent color from info to secondary, compact sizing.
- Thinking card: compact sizing, remove bottom margin.
- app.scss: add details::details-content animation, fix nested chevron
  rotation in subagent steps, adjust margins and input-bar padding.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Markdown images: adaptive 3-column grid, lightbox modal, and broken-image handling ...

- useMarkdown.js: custom marked renderer wraps images in clickable links with
  inline onerror for broken-image detection
- app.scss: .msg-assistant-content becomes flex-wrap container; image paragraphs
  sized to 3-per-row via calc((100% - 16px) / 3); images are square via
  aspect-ratio: 1 / 1 and object-fit: cover
- ImageLightbox.vue: rewritten with proper gnexus-ui-kit .modal/.modal-dialog
  DOM structure; broken images show error placeholder inside modal
- AssistantMessage.vue: attachImageLightbox() wired after v-html render
- Broken images: .is-broken class prevents lightbox click; CSS shows 🖼️ icon

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Persist uploaded files in messages, live file tree updates, and UI polish ...

Backend:
- Add `files` field to `Message` model so uploaded file metadata survives page refresh
- Pass `files` through websocket handler → `agent.run_stream` / `agent.run`
- `list_tools`: make `profile_id` required; return error instead of all-tools fallback

Webclient:
- Call `fetchFiles()` after successful file upload for immediate Files tab update
- Live refresh file tree on filesystem (write/edit/append/mkdir/rm/cp/mv), terminal, and code_exec tool calls
- Add manual refresh button (desktop) and pull-to-refresh (mobile) to Files tab
- Fix live link updates: move regex creation inside per-message loop to avoid lastIndex state leak
- Restore full profile name text next to avatar in ChatHeader; hide avatar in header
- Fix mobile ArtifactsPanel: collapse tab text labels so close button fits with 3 tabs

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix profile icon class in WelcomeScreen — prepend 'ph' prefix ...

GnAvatar's :icon prop expects the full Phosphor class (e.g. 'ph ph-briefcase'),
not just the icon name. profileIcon() now returns 'ph ${cls}'.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add session file directory listing endpoint and Files tab in ArtifactsPanel ...

Backend:
- New GET /sessions/{session_id}/files endpoint (recursive, max depth 10)
- Includes hidden files, returns {path, size, is_dir, modified_at}
- Path traversal protection via resolve() + relative_to(base)
- list_session_files() helper in session_files.py

Webclient:
- Third "Files" tab in ArtifactsPanel alongside Artifacts and Links
- Tree display with depth-based indentation
- File type icons by extension (image, video, code, etc.)
- Download and inline-open actions per file
- Fetch on session load/reload via chatStore.fetchFiles()

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix GnAvatar usage: use props (src/icon/initials) instead of default slot ...

GnAvatar render function ignores default slot content; it only reads
src, icon, and initials props. Fixes broken user avatar image display.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Migrate avatars to GnAvatar component from gnexus-ui-kit ...

- ProfileBadge.vue: GnBadge → GnAvatar with profile initials
- AppSidebar.vue: custom user-avatar/img → GnAvatar with image or fallback initial
- WelcomeScreen.vue: profile-icon → GnAvatar with Phosphor icon + secondary variant

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add Links tab to ArtifactsPanel and restyle to gnexus-ui-kit design system ...

- Extract markdown + bare URLs from assistant messages, deduplicate, show in new Links tab
- Add tab switcher (Artifacts / Links) with counts in header
- Add copy-all and open-all link actions
- Full style migration to gnexus-ui-kit palette:
  - surface-page #16161E, borders 2px rgba(192,202,245,0.24)
  - accent color #FF9E64, hover/active #7AA2F7
  - tabs: uppercase, bold, border-right separators
  - list items: 2px transparent border, surface-panel-muted bg
  - action buttons: 2px border, electric-blue hover
  - zero border-radius throughout

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Rename login button text from gnexus-auth to GNEXUS. ...

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix Phosphor icon class on GnButton/GnIconButton usages. ...

gnexus-ui-kit's iconNode() does not prepend the base `ph` class
when the icon string starts with `ph-`; it only keeps the string
as-is. All icon props must include the base class explicitly:
`icon="ph ph-sidebar"` instead of `icon="ph-sidebar"`.

Updated 15 icon bindings across 9 components.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Wire gnexus-ui-kit v0.2.0 Vue 3 adapter and migrate Wave 1 components. ...

- Update vendor/gnexus-ui-kit to v0.2.0 (Vue components + composables)
- Add Vite aliases for gnexus-ui-kit/vue and gnexus-ui-kit/css
- Install GnexusUiVue plugin in main.js + GnToastProvider in App.vue
- Migrate ProfileBadge → GnBadge
- Migrate ErrorMessage → GnAlert
- Migrate ConfirmDialog → GnConfirmDialog
- Migrate raw <button> elements → GnButton / GnIconButton in:
  WelcomeScreen, LoginScreen, ChatArea, ChatHeader, AppSidebar,
  ArtifactsPanel, UserMessage, AssistantMessage, SelectionToolbar

Build and tests pass (51/51).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add deterministic line-based file editing (edit_lines), rating UI fix, and session refresh ...

- filesystem.py: add edit_lines action (deterministic line ops via operations array)
           + numbered param for read (1-based line numbers in output)
           + clarify four editing modes in tool description
- chat.js: fix rating IDs for streaming messages (assign h_ ID on stream_end)
- SessionList.vue: mobile pull-to-refresh with PTR_THRESHOLD=80
- AppSidebar.vue: desktop refresh button next to Conversations header
- planning.py: knowledge source assessment in Phase 1
- debug panel: MCP servers tab + resolved tools per profile
- NAVI.md: reposition as neutral quick-reference

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix blank session rendering and 401 auth handling ...

- Install missing vue-router dependency (was imported but not in node_modules,
  causing app init failure and empty app-main)
- Add :sessionId? route param and HomeView watcher for hash-based session routing
- Update hash format to '#/' for Vue Router compatibility
- Add 401 handling in api/index.js to invalidate auth and show login overlay
- Add error handling in loadSession and WelcomeScreen start to prevent stuck UI

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Open admin panel in new browser tab from Android and webclient ...

Android:
- Add /admin path to shouldOpenExternally so admin links open in
  the system browser instead of the WebView.

Webclient:
- Add target="_blank" and rel="noopener noreferrer" to the admin
  link in AppSidebar.vue so it opens in a new tab.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Compact admin/logout buttons in sidebar footer ...

In sidebar-footer-actions, replace text+icon Admin and Logout buttons
with icon-only btn-icon buttons (shield-check and sign-out icons).
Add without-hover class to suppress the default icon rotation hover
animation. Keep the Login button unchanged (text + icon as before).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add pagination, search, and sorting to admin sessions ...

Backend:
- Add count_all and search_list abstract methods to SessionStore
- Implement count_all and search_list in PgSessionStore (SQL with ILIKE)
- Implement count_all and search_list in InMemorySessionStore
- Update /admin/sessions to accept limit, offset, search, sort_by, sort_order
- Return {total, limit, offset, items} from /admin/sessions

Frontend:
- Add search input for sessions in admin panel
- Add clickable sortable column headers with asc/desc toggle
- Add pagination controls (prev/next, page size selector, item count)
- Debounce search input (300ms)

Tests:
- Add integration tests for pagination, offset, search, and sorting
- All 217 tests pass

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Dark login screen: #111 overlay, transparent card ...

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add full-screen login overlay for unauthenticated users ...

- Backend: new endpoint GET /auth/status returns {configured: bool}
- Webclient auth store: add authConfigured ref + fetchStatus()
- LoginScreen.vue: centered card with logo, title, and login button
- App.vue: show LoginScreen overlay when auth is configured but
  user is not authenticated (z-index 9999, blocks all UI)
- App.vue onMounted: fetch auth status before trying to resolve user

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Add avatar display and gnexus-auth profile link ...

Backend:
- User model: add avatar_url field
- auth/deps.py: extract avatar_url from auth_user.profile (picture/avatar_url)
- auth.py /auth/me: return avatar_url + computed profile_url
- config.py: add gnauth_profile_path setting
- .env.example: document GNAUTH_PROFILE_PATH

Frontend:
- AppSidebar.vue: show user avatar (or initial fallback) next to name
- Clicking user info opens gnexus-auth profile in new tab
- Rebuild dist/

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Fix missing Annotated/Depends imports in auth.py and UI button class ...

- auth.py: add from typing import Annotated and from fastapi import Depends
  to fix 422 Unprocessable Content on /auth/me and /auth/logout
- AppSidebar.vue: replace btn-ghost with btn-primary for login/logout buttons

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Multi-user auth via gnexus-auth OAuth + hybrid role/permission model ...

- Integrate gnexus-auth-client-py (GAuthClient) for OAuth flow, token refresh,
  and webhook parsing
- Add navi/auth/ package: User model, Fernet encryptor, client singleton,
  deps (get_current_user, require_admin, require_permission)
- New tables: navi_users, user_auth_sessions (auto-created on startup)
- Session/memory isolation by user_id with legacy NULL support
- Cookie-based auth proxy: /auth/login, /callback, /logout, /me
- Webhook receiver /webhooks/gnexus-auth handling user events, global logout,
  session revocation, role/permission changes
- Admin endpoints (/admin/*) gated by role + permissions
- Webclient auth store with isAdmin/hasPermission guards
- Admin-only profile filtering in /agents/profiles
- 200/200 tests passing

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Paginate session list loading

Improve artifacts workspace controls

Add artifact source previews