feat(home-hub): Recent Sessions per-project alert dot (lr-2b1f03)

[clagentic-builder]

Summary

The Home Hub Projects list shows a per-project alert count badge (proj.unread), but the Recent Sessions list had no alert indicator at all -- no way to tell which project a session's unresolved activity belonged to from that view.

This adds a small red dot to each Recent Sessions row whose session's project currently has unread activity (proj.unread > 0). A numeric count would not fit the row, per the task description, so a plain dot is used -- goal is showing WHERE the alert is from, not how many.

Data source

Reuses the exact same per-project source that already drives the Projects-list unread badge (.icon-strip-project-badge.has-unread / .mobile-project-unread): getCachedProjects() from app-projects.js, keyed off proj.unread. No new data path, no server-side change -- pure read of the existing client-side cache, looked up per row via sess.projectSlug (matches proj.slug via lib/project-loop.js:1358-1392 and lib/server.js:994-1017).

Changes

• lib/public/modules/app-home-hub.js: new projectHasAlert(projectSlug) helper; handleHubRecentSessions() renders a .hub-recent-alert-dot span per row when the project has unread activity. Rows for projects with no alerts render unchanged.
• lib/public/css/home-hub.css: .hub-recent-alert-dot styled as a small circular red dot (#e74c3c), matching the existing .icon-strip-project-badge unread-badge color.
• test/hub-recent-sessions-alert-dot-lr-2b1f03.test.js: source-text regression coverage matching project convention for DOM-heavy frontend modules (e.g. mobile-home-toggle-lr-551048.test.js).

Frontend-only. No LLM calls added. No user-facing brand strings changed.

Task: lr-2b1f03

Test status

npm test: 956/960 pass. The 4 failures are all in test/sdk-bridge-context-window-warn.test.js, pre-existing on main and unrelated to this diff (that file and lib/sdk-bridge.js are untouched here).

[clagentic-reviewer]

PEACHES — clean (0 nits)

CSS .hub-recent-alert-dot (lines 500–509): small red dot, color #e74c3c matches existing alert badge convention. Styled correctly.

JavaScript projectHasAlert(projectSlug) (lines 235–249): reads per-project unread count via existing getCachedProjects() export, no new data paths. Correct logic and scope.

Alert rendering in handleHubRecentSessions() (lines 479–492): calls helper per row, injects as safe empty string when no alert — no DOM pollution on unaffected rows.

Regression test (full file): validates helper presence, correct cache usage, and fallback behavior.

No brand violations, no new SDK requires, no hardcoded paths, no cross-layer imports. Minimal change, test included.

{"reviewer": "peaches", "review_status": "clean", "head_sha": "411811713b6d32c5a660fe4343e751cf280e9b9f", "pr_number": 342}

[clagentic-security]

No security-relevant findings. This PR adds a small per-project alert-dot indicator to the Home Hub Recent Sessions list (lib/public/css/home-hub.css, lib/public/modules/app-home-hub.js) plus a matching regression test. The new projectHasAlert() helper only reads an existing in-memory project cache (getCachedProjects()) and does a boolean slug lookup - no new network or IO calls. The new alertHtml markup injected into item.innerHTML is a static string with no interpolated data (unlike sess.title/sess.agentName, which already pass through escapeHtml and are unchanged by this PR), so no new XSS surface. CSS change is a static rule. No dependency manifest changes in this diff. gitleaks and semgrep both ran clean against the full base..head diff; trufflehog was unavailable in this environment (command not found); osv-scanner not applicable (no package.json/lock changes in scope).

Scanners run:

• gitleaks detect (base..head): no leaks found
• semgrep --config=auto (changed files): 0 findings
• trufflehog: unavailable (not installed)
• osv-scanner: not applicable (no dependency manifest in diff)

BOBBIE -- clean

{"reviewer": "bobbie", "review_status": "clean", "head_sha": "411811713b6d32c5a660fe4343e751cf280e9b9f", "pr_number": 342}

[clagentic-merger]

Merged via clagentic-loadout v0.1.0

• Gated HEAD SHA: 411811713b6d32c5a660fe4343e751cf280e9b9f
• Merged SHA: 411811713b6d32c5a660fe4343e751cf280e9b9f
• Reviews: clagentic-reviewer[bot], clagentic-security[bot]
• CI status: no-runner-by-design (0 commit-status entries at HEAD)
• task_id: lr-2b1f03