Refactor agent initialization and fix permission flow

CLAUDE.md

@@ -74,7 +74,7 @@ The shared loop lives in `Agent._loop()` (`app/core/agent.py`). Subclasses overr
 | `_on_no_choices` | raise | exponential backoff | raise |
 | `_should_stop` | — | `channel.has_stopped` | — |
 
-Tool calls within a single LLM turn are dispatched in parallel via `asyncio.gather`. After each turn, the full message chain (assistant tool-call message + tool results + final response) is saved to `self.messages` with tool results truncated to `TOOL_RESULT_HISTORY_LIMIT` chars to keep context lean. `MessageHistory` (SQLite) stores only user + final assistant text for cross-session persistence.
+Tool calls within a single LLM turn are dispatched in parallel via `asyncio.gather`. After each turn, the full message chain (assistant tool-call message + tool results + final response) is saved to `self.messages` at full length. `MessageHistory` (SQLite) stores only user + final assistant text for cross-session persistence.
 
 ### Tool System
 
@@ -104,7 +104,7 @@ On startup, `load_system_context()` (`app/infra/startup.py`) loads `app/core/sys
 
 **Channel types** are defined in `ChannelType` enum (`app/channels/channel.py`): `CLI`, `TELEGRAM`, `DISCORD`, `WEB`. Each channel implements the `Channel` ABC and owns a `MessageQueue` instance. `bg_server.py` wires up enabled channels — each gets its own `MessageQueue`, `BackgroundAgent`, and set of coroutines (`run_polling`, `process_incoming`, `process_outgoing`) gathered into the event loop.
 
-**WebChannel** (`app/channels/web_channel.py`) uses `python-fasthtml` + uvicorn to serve both a browser chat UI (`GET /`) and a JSON WebSocket endpoint (`WS /ws`) on the same port. Multiple concurrent browser tabs are supported — each connection gets a UUID tracked in `_connections`. A per-connection `asyncio.Lock` in `_send_locks` serializes writes to each WebSocket. The channel also exposes `GET /api/conversations`, `GET /api/messages` (scoped to web channel only), and `GET /api/status` REST endpoints. Only `/whoami` is handled inline (it needs the per-connection client ID); all other slash commands — including `/help`, `/status`, `/stop` — are forwarded to `BackgroundAgent`'s `CommandRegistry` via the message queue with `is_command=True` in metadata so `send_message()` emits `{"type":"system"}` responses, enabling the sidebar to refresh after conversation-mutating commands.
+**WebChannel** (`app/channels/web_channel.py`) uses `python-fasthtml` + uvicorn to serve both a browser chat UI (`GET /`) and a JSON WebSocket endpoint (`WS /ws`) on the same port. Multiple concurrent browser tabs are supported — each connection gets a UUID tracked in `_connections`. A per-connection `asyncio.Lock` in `_send_locks` serializes writes to each WebSocket. The channel also exposes `GET /api/conversations`, `GET /api/messages` (scoped to web channel only), `GET /api/status`, and `POST /api/upload` REST endpoints. `POST /api/upload` accepts multipart `files` (one or more), writes each under `$ANOTHERBOT_HOME/uploads` with a UUID prefix, and returns the stored basenames; the browser (paperclip button next to the input) sends those basenames back in the WebSocket `message` frame's `files` field. `_resolve_upload_paths()` joins each basename to the upload dir (basename-only, so client paths can't traverse out) and the resolved absolute paths reach the agent via `metadata["files"]`, which `Agent._build_user_message()` encodes as image/file parts. Only `/whoami` is handled inline (it needs the per-connection client ID); all other slash commands — including `/help`, `/status`, `/stop` — are forwarded to `BackgroundAgent`'s `CommandRegistry` via the message queue with `is_command=True` in metadata so `send_message()` emits `{"type":"system"}` responses, enabling the sidebar to refresh after conversation-mutating commands.
 
 **Slash commands** are handled entirely by `BackgroundAgent`. Channel handlers (`command_handler` in Telegram, `on_message` in Discord) intercept only `/whoami` (resolved inline using the platform user object) and enqueue everything else as a plain `IncomingMessage`. `BackgroundAgent.process_incoming()` detects the leading `/` and dispatches via its own `CommandRegistry`. That registry owns the full command set: `/model`, `/status`, `/stop`, `/help`, `/list`, `/new`, `/load`, `/fork`, `/rename`, `/export`.
 

app/channels/commands.py

@@ -69,6 +69,20 @@ async def model_cmd(args: str = "") -> str:
     return f"Model set to: {args.strip()}"
 
 
+async def trace_cmd(args: str = "") -> str:
+    arg = args.strip().lower()
+    tracedir = runtime.get("tracedir")
+    if arg == "on":
+        runtime.set("trace", True)
+        return f"Tracing on. Writing to {tracedir}"
+    elif arg == "off":
+        runtime.set("trace", False)
+        return "Tracing off."
+    else:
+        state = runtime.get("trace", False)
+        return f"Tracing is {'on' if state else 'off'}. Dir: {tracedir}"
+
+
 def make_status_cmd(channel_str: str = "") -> CommandHandler:
     async def _status(args: str = "") -> str:
         uptime = datetime.now() - _STARTUP_TIME
@@ -81,11 +95,15 @@ async def _status(args: str = "") -> str:
         else:
             conv_id = runtime.get("conversation_id", "—")
             conv_name = runtime.get("conversation_name", "—")
+        tracing = runtime.get("trace", False)
+        last_trace = runtime.get("last_trace")
+        trace_line = f"on ({last_trace})" if (tracing and last_trace) else ("on" if tracing else "off")
         return (
             f"Bot status:\n"
             f"  Model:        {model}\n"
             f"  Uptime:       {hours}h {minutes}m {seconds}s\n"
-            f"  Conversation: [{conv_id}] {conv_name}"
+            f"  Conversation: [{conv_id}] {conv_name}\n"
+            f"  Tracing:      {trace_line}"
         )
     return _status
 
@@ -225,7 +243,6 @@ async def _mcp(args: str = "") -> str:
                     desc = fn.get("description", "")
                     lines.append(f"  {bare}" + (f" — {desc}" if desc else ""))
                 return "\n".join(lines)
-                return "\n".join(lines)
             else:
                 specs = mcp_manager.get_tool_specs()
                 if not specs:

app/channels/static/web_channel.css

@@ -318,3 +318,82 @@ body {
 #send-btn:hover   { background: var(--accent-h); }
 #send-btn:active  { transform: scale(.97); }
 #send-btn:disabled { background: var(--border); cursor: not-allowed; }
+
+/* Hide the file input without display:none — keeps it in the layout/event
+   tree so its `change` event fires reliably (Edge) when opened via the label. */
+.visually-hidden {
+    position: absolute;
+    width: 1px;
+    height: 1px;
+    padding: 0;
+    margin: -1px;
+    overflow: hidden;
+    clip: rect(0, 0, 0, 0);
+    white-space: nowrap;
+    border: 0;
+}
+
+/* ---- attach button (a <label for="file-input">) ---- */
+#attach-btn {
+    background: var(--surface2);
+    border: 1px solid var(--border);
+    border-radius: 10px;
+    color: var(--text-muted);
+    cursor: pointer;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    box-sizing: border-box;
+    height: 42px;
+    width: 42px;
+    padding: 0;
+    margin: 0;
+    line-height: 0;          /* kill inline baseline gap (Edge alignment) */
+    flex-shrink: 0;
+    user-select: none;
+    -webkit-user-select: none;
+    transition: border-color .15s, color .15s, background .15s;
+}
+#attach-btn:hover { border-color: var(--accent); color: var(--accent); }
+#attach-btn:active { transform: scale(.97); }
+#attach-btn svg { display: block; width: 20px; height: 20px; }
+
+/* ---- attachment chips ---- */
+#attachments {
+    display: none;
+    flex-wrap: wrap;
+    gap: 8px;
+    padding: 10px 20px 0;
+    background: var(--surface);
+    flex-shrink: 0;
+}
+#attachments.has-files { display: flex; }
+
+.attach-chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 8px;
+    max-width: 240px;
+    background: var(--surface2);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    padding: 5px 8px 5px 10px;
+    font-size: 0.8rem;
+}
+.attach-name {
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+    color: var(--text);
+}
+.attach-remove {
+    background: none;
+    border: none;
+    color: var(--text-muted);
+    cursor: pointer;
+    font-size: 1rem;
+    line-height: 1;
+    padding: 0 2px;
+    transition: color .12s;
+}
+.attach-remove:hover { color: #ef4444; }

app/channels/static/web_channel.js

@@ -18,6 +18,11 @@
     const toggleBtn   = document.getElementById('sidebar-toggle');
     const convListEl  = document.getElementById('conv-list');
     const newConvBtn  = document.getElementById('new-conv-btn');
+    const fileInput   = document.getElementById('file-input');
+    const attachEl    = document.getElementById('attachments');
+
+    // Files staged for the next send (cleared after a successful upload).
+    let selectedFiles = [];
 
     // ---- theme ----
     const savedTheme = localStorage.getItem('ab-theme') || 'dark';
@@ -141,7 +146,7 @@
         ws.onopen = () => {
             reconnectDelay = 1000;
             setStatus('connected', 'Connected');
-            sendBtn.disabled = false;
+            refreshSendState();
             clearMessages();       // always reset DOM before reloading — prevents duplicates on reconnect
             loadConversations(true);
         };
@@ -213,14 +218,105 @@
     }
     function scrollBottom() { scrollEl.scrollTop = scrollEl.scrollHeight; }
 
+    // ---- attachments ----
+    function renderAttachments() {
+        attachEl.innerHTML = '';
+        attachEl.classList.toggle('has-files', selectedFiles.length > 0);
+        selectedFiles.forEach((file, idx) => {
+            const chip = document.createElement('div');
+            chip.className = 'attach-chip';
+            const label = document.createElement('span');
+            label.className = 'attach-name';
+            label.textContent = file.name;
+            label.title = `${file.name} (${fmtSize(file.size)})`;
+            const remove = document.createElement('button');
+            remove.className = 'attach-remove';
+            remove.type = 'button';
+            remove.textContent = '×';
+            remove.title = 'Remove attachment';
+            remove.addEventListener('click', () => {
+                selectedFiles.splice(idx, 1);
+                renderAttachments();
+                refreshSendState();
+            });
+            chip.appendChild(label);
+            chip.appendChild(remove);
+            attachEl.appendChild(chip);
+        });
+    }
+
+    function fmtSize(bytes) {
+        if (bytes < 1024) return bytes + ' B';
+        if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(0) + ' KB';
+        return (bytes / 1024 / 1024).toFixed(1) + ' MB';
+    }
+
+    function refreshSendState() {
+        const connected = ws && ws.readyState === WebSocket.OPEN;
+        const hasInput = inputEl.value.trim().length > 0 || selectedFiles.length > 0;
+        sendBtn.disabled = !connected || !hasInput;
+    }
+
+    // The attach control is a <label for="file-input">, so clicking it opens
+    // the picker natively — no JS click needed (and avoids a double-open).
+    // Copy the FileList into a real array before clearing .value: Edge can
+    // invalidate the live FileList once .value is reset mid-handler.
+    fileInput.addEventListener('change', () => {
+        const picked = Array.from(fileInput.files || []);
+        for (const file of picked) selectedFiles.push(file);
+        fileInput.value = '';   // allow re-selecting the same file later
+        renderAttachments();
+        refreshSendState();
+    });
+
+    async function uploadFiles(files) {
+        const form = new FormData();
+        files.forEach(f => form.append('files', f, f.name));
+        const res = await fetch('/api/upload', { method: 'POST', body: form });
+        if (!res.ok) {
+            let detail = '';
+            try { detail = (await res.json()).error || ''; } catch (e) { /* ignore */ }
+            throw new Error(detail || `Upload failed (${res.status})`);
+        }
+        const { files: saved } = await res.json();
+        return saved;   // [{path, name}, ...]
+    }
+
     // ---- send ----
-    function send() {
+    async function send() {
         const text = inputEl.value.trim();
-        if (!text || !ws || ws.readyState !== WebSocket.OPEN) return;
-        appendMessage(text, 'user');
-        ws.send(JSON.stringify({ type: 'message', content: text }));
+        const files = selectedFiles.slice();
+        if (sendBtn.disabled) return;
+
+        let uploaded = [];
+        if (files.length) {
+            sendBtn.disabled = true;
+            try {
+                uploaded = await uploadFiles(files);
+            } catch (e) {
+                appendMessage('Attachment upload failed: ' + e.message, 'system');
+                refreshSendState();
+                return;
+            }
+        }
+
+        const payload = { type: 'message', content: text };
+        if (uploaded.length) payload.files = uploaded.map(f => f.path);
+        try {
+            ws.send(JSON.stringify(payload));
+        } catch (err) {
+            appendMessage('Send failed: disconnected (please retry).', 'system');
+            refreshSendState();
+            return;
+        }
+
+        appendMessage(renderUserContent(text, files), 'user');
+        selectedFiles = [];
+        renderAttachments();
         inputEl.value = '';
         inputEl.style.height = '42px';
+        refreshSendState();
+
         if (text === '/new') {
             clearMessages();
         } else if (/^\/load\s+\d+/.test(text)) {
@@ -232,13 +328,20 @@
         }
     }
 
+    function renderUserContent(text, files) {
+        if (!files.length) return text;
+        const tags = files.map(f => `📎 ${f.name}`).join('  ');
+        return text ? `${text}\n\n${tags}` : tags;
+    }
+
     sendBtn.addEventListener('click', send);
     inputEl.addEventListener('keydown', (e) => {
         if (e.key === 'Enter' && !e.shiftKey) { e.preventDefault(); send(); }
     });
     inputEl.addEventListener('input', () => {
         inputEl.style.height = 'auto';
         inputEl.style.height = Math.min(inputEl.scrollHeight, 160) + 'px';
+        refreshSendState();
     });
 
     // sidebar pre-populate (messages already loaded via ws.onopen → loadConversations(true))