fix: escape server-provided plugin fields in marketplace view (XSS)

Interpolated plugin name/description/id/category/version/permissions into innerHTML without escaping, unlike sibling views (mcp.js, channels.js, chat.js) which use an esc() helper. Add the same esc() helper and apply it for defense-in-depth and convention consistency. Co-authored-by: Mervin Praison <[email protected]>
feat: add plugin marketplace dashboard page (fixes #199 )
2026-11-07 05:56:17 -10:00 · 2026-07-14 07:46:42 +00:00 · 2026-07-14 07:26:24 +00:00 · 2026-07-14 02:00:30 +00:00 · 2026-07-13 10:12:12 +00:00 · 2026-07-13 10:08:48 +00:00
30 changed files with 1870 additions and 64 deletions
@@ -0,0 +1,290 @@
+name: "Claude Code Action"
+description: "Run Claude Code in GitHub Actions workflows"
+
+inputs:
+  anthropic_api_key:
+    description: "Anthropic API key"
+    required: false
+  claude_code_oauth_token:
+    description: "Claude Code OAuth Token for Claude Pro"
+    required: false
+  github_token:
+    description: "GitHub token for Claude to operate with"
+    required: false
+    default: ${{ github.token }}
+  trigger_phrase:
+    description: "The trigger phrase to look for in comments, issue/PR bodies, and issue titles"
+    required: false
+    default: "@claude"
+  assignee_trigger:
+    description: "The assignee username that triggers the action (e.g. @claude). Only used for issue assignment"
+    required: false
+  max_turns:
+    description: "Maximum number of conversation turns Claude can take"
+    required: false
+  timeout_minutes:
+    description: "Timeout in minutes for execution"
+    required: false
+    default: "30"
+  model:
+    description: "Model to use (provider-specific format required for Bedrock/Vertex)"
+    required: false
+  use_bedrock:
+    description: "Use Amazon Bedrock with OIDC authentication instead of direct Anthropic API"
+    required: false
+    default: "false"
+  use_vertex:
+    description: "Use Google Vertex AI with OIDC authentication instead of direct Anthropic API"
+    required: false
+    default: "false"
+  allowed_tools:
+    description: "Additional tools for Claude to use (the base GitHub tools will always be included)"
+    required: false
+    default: ""
+  disallowed_tools:
+    description: "Tools that Claude should never use"
+    required: false
+    default: ""
+  custom_instructions:
+    description: "Additional custom instructions to include in the prompt for Claude"
+    required: false
+    default: ""
+  mcp_config:
+    description: "Additional MCP configuration (JSON string) that merges with the built-in GitHub MCP servers"
+    required: false
+    default: ""
+  claude_env:
+    description: "Custom environment variables to pass to Claude Code execution (YAML format)"
+    required: false
+    default: ""
+  direct_prompt:
+    description: "Direct prompt for Claude to execute automatically without needing a trigger (for automated workflows)"
+    required: false
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install Claude Code
+      shell: bash
+      run: npm install -g @anthropic-ai/claude-code
+
+    - name: Install GitHub MCP Server
+      shell: bash
+      run: |
+        claude mcp add-json github '{
+          "command": "docker",
+          "args": [
+            "run",
+            "-i",
+            "--rm",
+            "-e",
+            "GITHUB_PERSONAL_ACCESS_TOKEN",
+            "ghcr.io/github/github-mcp-server:sha-ff3036d"
+          ],
+          "env": {
+            "GITHUB_PERSONAL_ACCESS_TOKEN": "${{ inputs.github_token }}"
+          }
+        }'
+
+    - name: Extract GitHub Context and Create Prompt
+      shell: bash
+      id: prepare_context
+      env:
+        # Pass user-controlled inputs via environment variables to prevent script injection (GHSL-2025-093)
+        EVENT_COMMENT_BODY: ${{ github.event.comment.body }}
+        EVENT_ISSUE_TITLE: ${{ github.event.issue.title }}
+        EVENT_ISSUE_BODY: ${{ github.event.issue.body }}
+        EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+        EVENT_PR_TITLE: ${{ github.event.pull_request.title }}
+        EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+        EVENT_REVIEW_BODY: ${{ github.event.review.body }}
+        EVENT_ASSIGNEE_LOGIN: ${{ github.event.assignee.login }}
+        INPUT_TRIGGER_PHRASE: ${{ inputs.trigger_phrase }}
+        INPUT_ASSIGNEE_TRIGGER: ${{ inputs.assignee_trigger }}
+        INPUT_DIRECT_PROMPT: ${{ inputs.direct_prompt }}
+        EVENT_ACTION: ${{ github.event.action }}
+        EVENT_NAME: ${{ github.event_name }}
+        REPO_NAME: ${{ github.repository }}
+      run: |
+        echo "🔍 Extracting GitHub context from event: $EVENT_NAME"
+        
+        # Function to check for trigger phrase
+        check_trigger() {
+          local text="$1"
+          local trigger="$INPUT_TRIGGER_PHRASE"
+          if [[ "$text" == *"$trigger"* ]]; then
+            return 0
+          fi
+          return 1
+        }
+        
+        # Extract context based on event type
+        TRIGGER_FOUND="false"
+        USER_REQUEST=""
+        CONTEXT_INFO=""
+        
+        case "$EVENT_NAME" in
+          "issue_comment")
+            COMMENT_BODY="$EVENT_COMMENT_BODY"
+            ISSUE_TITLE="$EVENT_ISSUE_TITLE"
+            ISSUE_NUMBER="$EVENT_ISSUE_NUMBER"
+            
+            if check_trigger "$COMMENT_BODY"; then
+              TRIGGER_FOUND="true"
+              USER_REQUEST="$COMMENT_BODY"
+              CONTEXT_INFO="Issue Comment on #$ISSUE_NUMBER: $ISSUE_TITLE"
+            fi
+            ;;
+            
+          "pull_request_review_comment")
+            COMMENT_BODY="$EVENT_COMMENT_BODY"
+            PR_TITLE="$EVENT_PR_TITLE"
+            PR_NUMBER="$EVENT_PR_NUMBER"
+            
+            if check_trigger "$COMMENT_BODY"; then
+              TRIGGER_FOUND="true"
+              USER_REQUEST="$COMMENT_BODY"
+              CONTEXT_INFO="PR Comment on #$PR_NUMBER: $PR_TITLE"
+            fi
+            ;;
+            
+          "pull_request_review")
+            REVIEW_BODY="$EVENT_REVIEW_BODY"
+            PR_TITLE="$EVENT_PR_TITLE"
+            PR_NUMBER="$EVENT_PR_NUMBER"
+            
+            if check_trigger "$REVIEW_BODY"; then
+              TRIGGER_FOUND="true"
+              USER_REQUEST="$REVIEW_BODY"
+              CONTEXT_INFO="PR Review on #$PR_NUMBER: $PR_TITLE"
+            fi
+            ;;
+            
+          "issues")
+            ISSUE_BODY="$EVENT_ISSUE_BODY"
+            ISSUE_TITLE="$EVENT_ISSUE_TITLE"
+            ISSUE_NUMBER="$EVENT_ISSUE_NUMBER"
+            
+            if check_trigger "$ISSUE_TITLE" || check_trigger "$ISSUE_BODY"; then
+              TRIGGER_FOUND="true"
+              USER_REQUEST="$ISSUE_BODY"
+              CONTEXT_INFO="Issue #$ISSUE_NUMBER: $ISSUE_TITLE"
+            elif [[ "$EVENT_ACTION" == "assigned" && -n "$INPUT_ASSIGNEE_TRIGGER" ]]; then
+              ASSIGNEE="$EVENT_ASSIGNEE_LOGIN"
+              if [[ "$ASSIGNEE" == "$INPUT_ASSIGNEE_TRIGGER" ]]; then
+                TRIGGER_FOUND="true"
+                USER_REQUEST="$ISSUE_BODY"
+                CONTEXT_INFO="Issue #$ISSUE_NUMBER assigned to $ASSIGNEE: $ISSUE_TITLE"
+              fi
+            fi
+            ;;
+        esac
+        
+        # Check for direct prompt override
+        if [[ -n "$INPUT_DIRECT_PROMPT" ]]; then
+          TRIGGER_FOUND="true"
+          USER_REQUEST="$INPUT_DIRECT_PROMPT"
+          CONTEXT_INFO="Automated GitHub workflow"
+        fi
+        
+        if [[ "$TRIGGER_FOUND" != "true" ]]; then
+          echo "❌ No trigger phrase found or direct prompt provided. Exiting gracefully."
+          echo "SKIP_EXECUTION=true" >> $GITHUB_ENV
+          exit 0
+        fi
+        
+        echo "✅ Trigger found! Context: $CONTEXT_INFO"
+        
+        # Create comprehensive prompt
+        mkdir -p /tmp/claude-action
+        cat > /tmp/claude-action/github-context-prompt.txt << EOF
+        You are Claude Code, an AI assistant helping with GitHub workflows and code.
+        
+        Repository: $REPO_NAME
+        Context: $CONTEXT_INFO
+        Event: $EVENT_NAME
+        
+        User Request:
+        $USER_REQUEST
+        
+        Please analyze the request and provide helpful assistance.
+
+        CRITICAL INSTRUCTION: If your task involves modifying codebase files to add a feature or fix a bug:
+
+        STEP 0 — SETUP GIT IDENTITY:
+        git config user.name "MervinPraison"
+        git config user.email "[email protected]"
+
+        STEP 1 — READ GUIDELINES:
+        MANDATORY: Before writing any code, you MUST carefully read "src/praisonai-agents/AGENTS.md" to understand this repository's extremely specific Architecture, Protocol-First design rules, and Agent-Centric Philosophy.
+
+        STEP 2 — ARCHITECTURE VALIDATION & ROUTING (MANDATORY before writing code):
+        Before implementing anything, answer these questions:
+        - CORE vs WRAPPER vs TOOLS ROUTING:
+          1. Core SDK (praisonaiagents/): Only core protocols, base classes, decorators. No heavy implementations.
+          2. Wrapper (praisonai/): CLI, heavy implementations, optional dependencies.
+          3. Tools (PraisonAI-Tools): Specific integrations, external tools (e.g. SurrealDB, Slack), and community extensions MUST go to the `MervinPraison/PraisonAI-Tools` repository. If the feature is a tool, clone `https://github.com/MervinPraison/PraisonAI-Tools`, implement it there, and create the PR using `gh pr create -R MervinPraison/PraisonAI-Tools`.
+        - Does it duplicate existing functionality? Check if Agent already supports this via existing params (reflection, planning, tools, hooks, memory).
+        - Does it inherit from Agent properly? New agent types MUST inherit Agent, not wrap it with composition.
+        - Does it add new dependencies? Only optional deps allowed, must be lazy-imported.
+        - Will agent.py grow larger? If the change adds >50 lines to agent.py, find a way to extract instead.
+        - Is there a name collision with existing exports in __init__.py?
+        If ANY of these conceptual checks fail (excluding routing), add a comment to the issue explaining why and close it. Do NOT create a PR.
+
+        STEP 3 — IMPLEMENT:
+        - Create a new git branch appropriately named (e.g. \`feature/issue-<number>\`)
+        - Follow protocol-driven design: protocols in core SDK, heavy implementations in wrapper
+        - Keep changes small and backward-compatible
+
+        STEP 4 — TEST:
+        - Run: cd src/praisonai-agents && PYTHONPATH=. python -m pytest tests/ -x -q --timeout=30
+        - Ensure no regressions
+
+        STEP 5 — CREATE PR:
+        - Commit with descriptive message, push the branch
+        - Use the GitHub CLI (\`gh pr create --title "..." --body "Fixes #<number>"\`) to open a Pull Request
+        CRITICAL: You MUST create the PR automatically using \`gh pr create\`. Do NOT just provide a link.
+
+        Respond naturally and helpfully to the user's request using the available tools.
+        EOF
+        
+        echo "PROMPT_FILE=/tmp/claude-action/github-context-prompt.txt" >> $GITHUB_ENV
+        echo "SKIP_EXECUTION=false" >> $GITHUB_ENV
+
+    - name: Run Claude Code
+      if: env.SKIP_EXECUTION != 'true'
+      shell: bash
+      run: |
+        echo "🚀 Running Claude Code with GitHub context..."
+        
+        # Build command arguments
+        CMD_ARGS=("-p" "--verbose" "--output-format" "stream-json")
+        
+        # Add max turns if specified
+        if [[ -n "${{ inputs.max_turns }}" ]]; then
+          CMD_ARGS+=("--max-turns" "${{ inputs.max_turns }}")
+        fi
+        
+        # Add allowed tools (include GitHub tools by default)
+        TOOLS="mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues,mcp__github__create_comment,Read,Write,Edit,Bash"
+        if [[ -n "${{ inputs.allowed_tools }}" ]]; then
+          TOOLS="$TOOLS,${{ inputs.allowed_tools }}"
+        fi
+        CMD_ARGS+=("--allowedTools" "$TOOLS")
+        
+        # Add disallowed tools
+        if [[ -n "${{ inputs.disallowed_tools }}" ]]; then
+          CMD_ARGS+=("--disallowedTools" "${{ inputs.disallowed_tools }}")
+        fi
+        
+        echo "📝 Executing Claude Code with prompt from file..."
+        
+        # Execute Claude Code with timeout, using stdin for the prompt
+        TIMEOUT_SECONDS=$((${{ inputs.timeout_minutes }} * 60))
+        timeout $TIMEOUT_SECONDS claude "${CMD_ARGS[@]}" < "${{ env.PROMPT_FILE }}"
+        
+        echo "✅ Claude Code execution completed"
+      env:
+        ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
+        CLAUDE_CODE_OAUTH_TOKEN: ${{ inputs.claude_code_oauth_token }}
+        GITHUB_TOKEN: ${{ inputs.github_token }} 
@@ -0,0 +1,91 @@
+name: "Claude Issue Triage Action"
+description: "Automatically triage GitHub issues using Claude Code"
+
+inputs:
+  timeout_minutes:
+    description: "Timeout in minutes for execution"
+    required: false
+    default: "5"
+  claude_code_oauth_token:
+    description: "Claude Code OAuth token for Pro subscription access"
+    required: true
+  github_token:
+    description: "GitHub token with repo and issues permissions"
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Checkout repository code
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+
+    - name: Create prompt
+      id: generate_prompt
+      shell: bash
+      run: |
+        mkdir -p /tmp/claude-prompts
+        cat > /tmp/claude-prompts/claude-issue-triage-prompt.txt << 'EOF'
+        You're an issue triage assistant for GitHub issues. Your task is to analyze the issue and select appropriate labels from the provided list.
+
+        IMPORTANT: Don't post any comments or messages to the issue. Your only action should be to apply labels.
+
+        Issue Information:
+        - REPO: ${{ github.repository }}
+        - ISSUE_NUMBER: ${{ github.event.issue.number }}
+
+        TASK OVERVIEW:
+
+        1. First, fetch the list of labels available in this repository by running: `gh label list`. Run exactly this command with nothing else.
+
+        2. Next, use the GitHub tools to get context about the issue:
+           - You have access to these tools:
+             - mcp__github__get_issue: Use this to retrieve the current issue's details including title, description, and existing labels
+             - mcp__github__get_issue_comments: Use this to read any discussion or additional context provided in the comments
+             - mcp__github__update_issue: Use this to apply labels to the issue (do not use this for commenting)
+             - mcp__github__search_issues: Use this to find similar issues that might provide context for proper categorization and to identify potential duplicate issues
+             - mcp__github__list_issues: Use this to understand patterns in how other issues are labeled
+           - Start by using mcp__github__get_issue to get the issue details
+
+        3. Analyze the issue content, considering:
+           - The issue title and description
+           - The type of issue (bug report, feature request, question, etc.)
+           - Technical areas mentioned
+           - Severity or priority indicators
+           - User impact
+           - Components affected
+
+        4. Select appropriate labels from the available labels list provided above:
+           - Choose labels that accurately reflect the issue's nature
+           - Be specific but comprehensive
+           - Select priority labels if you can determine urgency (high-priority, med-priority, or low-priority)
+           - Consider platform labels (android, ios) if applicable
+           - If you find similar issues using mcp__github__search_issues, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
+
+        5. Apply the selected labels:
+           - Use mcp__github__update_issue to apply your selected labels
+           - DO NOT post any comments explaining your decision
+           - DO NOT communicate directly with users
+           - If no labels are clearly applicable, do not apply any labels
+
+        IMPORTANT GUIDELINES:
+        - Be thorough in your analysis
+        - Only select labels from the provided list above
+        - DO NOT post any comments to the issue
+        - Your ONLY action should be to apply labels using mcp__github__update_issue
+        - It's okay to not add any labels if none are clearly applicable
+        EOF
+        
+        echo "PROMPT<<DELIMITER" >> $GITHUB_OUTPUT
+        cat /tmp/claude-prompts/claude-issue-triage-prompt.txt >> $GITHUB_OUTPUT
+        echo "DELIMITER" >> $GITHUB_OUTPUT
+
+    - name: Run Claude Code
+      uses: ./.github/actions/claude-code-action
+      with:
+        direct_prompt: ${{ steps.generate_prompt.outputs.PROMPT }}
+        allowed_tools: "Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues"
+        timeout_minutes: ${{ inputs.timeout_minutes }}
+        claude_code_oauth_token: ${{ inputs.claude_code_oauth_token }}
+        github_token: ${{ inputs.github_token }} 
@@ -251,7 +251,11 @@ jobs:
            });

      - name: Stash merge gate helpers
-        run: cp .github/scripts/merge-gate.js /tmp/merge-gate.js
+        run: |
+          # Keep scripts together so require('./gate-config.js') works from /tmp
+          mkdir -p /tmp/merge-gate-scripts /tmp/gh-actions
+          cp .github/scripts/merge-gate.js .github/scripts/gate-config.js /tmp/merge-gate-scripts/
+          cp -R .github/actions/claude-code-action /tmp/gh-actions/

      - name: Fetch PR branch
        env:
@@ -259,6 +263,9 @@ jobs:
        run: |
          git fetch origin "pull/${PR_NUMBER}/head:pr-${PR_NUMBER}"
          git checkout "pr-${PR_NUMBER}"
+          mkdir -p .github/actions
+          rm -rf .github/actions/claude-code-action
+          cp -R /tmp/gh-actions/claude-code-action .github/actions/

      - name: Claude merge gate assessment (read-only)
        id: assess
@@ -315,7 +322,7 @@ jobs:
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
-            const mergeGate = require('/tmp/merge-gate.js');
+            const mergeGate = require('/tmp/merge-gate-scripts/merge-gate.js');
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const prNumber = ${{ matrix.pr_number }};
@@ -354,7 +361,7 @@ jobs:
        with:
          github-token: ${{ steps.app-token.outputs.token }}
          script: |
-            const mergeGate = require('/tmp/merge-gate.js');
+            const mergeGate = require('/tmp/merge-gate-scripts/merge-gate.js');
            const comments = await mergeGate.listAllComments(
              github, context.repo.owner, context.repo.repo, ${{ matrix.pr_number }}
            );
@@ -1,6 +1,6 @@
 [project]
 name = "aiui"
-version = "0.3.127"
+version = "0.3.132"
 description = "YAML-driven website generator - CLI and compiler"
 readme = "README.md"
 license = {text = "MIT"}
@@ -199,11 +199,11 @@ text = text.replace(
    root.appendChild(sidebar);
    setupMobileNav(root, sidebar);
  }
+  root.appendChild(main);
  const shellHeader = document.createElement('div');
  shellHeader.id = 'db-shell-header-slot';
  renderSlot('shell:header', shellHeader);
-  if (shellHeader.children.length) root.insertBefore(shellHeader, main);
-  root.appendChild(main);""",
+  if (shellHeader.children.length) root.insertBefore(shellHeader, main);""",
 )

 # 6) selectPage toolbar
@@ -1,3 +1,3 @@
 """Version information."""

-__version__ = "0.3.124"
+__version__ = "0.3.132"
@@ -1596,10 +1596,18 @@ def run(
        # Run gateway - check if user module defines its own main function
        import asyncio
        import inspect
+        import os

        if hasattr(user_module, 'main') and callable(getattr(user_module, 'main')):
            # Call user's main function directly (gateway pattern)
            main_func = getattr(user_module, 'main')
+            # Propagate CLI --port/--host to gateway examples that read the
+            # PORT/HOST environment variables. Explicit env set by the user
+            # takes precedence over the CLI flag.
+            if "PORT" not in os.environ:
+                os.environ["PORT"] = str(actual_port)
+            if "HOST" not in os.environ:
+                os.environ["HOST"] = host
            if inspect.iscoroutinefunction(main_func):
                console.print("[yellow]ℹ️[/yellow] Delegating to user-defined async main()")
                asyncio.run(main_func())
@@ -76,6 +76,17 @@ SECRET_FIELD_PATTERNS = {
    "private_key", "access_token", "refresh_token", "webhook_secret"
 }

+# Suffixes that identify secret-bearing config keys not covered by the
+# exact-match SECRET_FIELD_PATTERNS set (e.g. app_token, signing_secret).
+_SECRET_KEY_SUFFIXES = ("_token", "_key", "_secret", "_password")
+
+
+def _is_secret_key(key: str) -> bool:
+    """True if a config key holds a secret and must be redacted on read."""
+    lowered = key.lower()
+    return lowered in SECRET_FIELD_PATTERNS or lowered.endswith(_SECRET_KEY_SUFFIXES)
+
+
 def _validate_config_security(config: Dict[str, Any]) -> Optional[str]:
    """Validate channel config doesn't contain inline secrets.

@@ -84,7 +95,7 @@ def _validate_config_security(config: Dict[str, Any]) -> Optional[str]:
    if not isinstance(config, dict):
        return None
    for key, value in config.items():
-        if key.lower() in SECRET_FIELD_PATTERNS:
+        if _is_secret_key(key):
            if isinstance(value, str) and value and not value.startswith("env:"):
                # Check for common secret patterns
                if (value.startswith(("sk-", "xoxb-", "xoxp-", "xapp-", "am_", "bot")) or
@@ -93,15 +104,25 @@ def _validate_config_security(config: Dict[str, Any]) -> Optional[str]:
                           f"'{key}_ref': 'env:YOUR_ENV_VAR'")
    return None

+
 def _redact_config_secrets(config: Dict[str, Any]) -> Dict[str, Any]:
-    """Redact secret values in config for API responses."""
+    """Redact secret values in config for API responses.
+
+    Any key matching a known secret name or a secret-bearing suffix is
+    replaced with ``***REDACTED***`` and a ``<key>_set`` boolean is added so
+    the UI can indicate whether a value is configured without exposing it.
+    Values referencing env vars (``env:...``) are left as-is — they contain
+    no literal secret.
+    """
    if not isinstance(config, dict):
        return config
    redacted = config.copy()
    for key, value in config.items():
-        if key.lower() in SECRET_FIELD_PATTERNS and isinstance(value, str) and value:
-            if not value.startswith("env:"):
-                redacted[key] = "***REDACTED***"
+        if _is_secret_key(key) and isinstance(value, str) and value:
+            if value.startswith("env:"):
+                continue
+            redacted[key] = "***REDACTED***"
+            redacted[f"{key}_set"] = True
    return redacted

 def _get_config_secret(config: Dict[str, Any], key: str, env_fallback: Optional[str] = None) -> str:
@@ -1030,7 +1051,11 @@ class ChannelsFeature(BaseFeatureProtocol):
                channel["start_error"] = error
        else:
            await self._stop_channel_bot(channel_id)
-        return JSONResponse(channel)
+
+        # Redact secrets in response
+        safe_channel = channel.copy()
+        safe_channel["config"] = _redact_config_secrets(channel.get("config", {}))
+        return JSONResponse(safe_channel)

    async def _status(self, request: Request) -> JSONResponse:
        channel_id = request.path_params["channel_id"]
@@ -116,7 +116,14 @@ class OpenAIRealtimeManager(RealtimeProtocol):
        logger.debug(f"Audio chunk for session {session_id}: {len(audio_data)} bytes")

    async def receive_audio(self, session_id: str) -> AsyncIterator[Dict[str, Any]]:
-        """Receive events from OpenAI realtime session."""
+        """Receive events from OpenAI realtime session.
+
+        First-event contract:
+            - Unknown session         -> ``error`` (Session not found)
+            - ``OPENAI_API_KEY`` set  -> ``session.ready`` (WebRTC handshake)
+            - Integrated mode, no key -> ``error`` (status=degraded)
+            - Standalone, no key      -> ``conversation.item.created`` (mock)
+        """
        # In WebRTC mode, events come via WebRTC connection
        # This method would handle transcript/tool call events
        session = self._sessions.get(session_id)
@@ -3372,6 +3372,14 @@ def create_app(
            "description": "Agent skills & plugins",
            "order": 20,
        },
+        {
+            "id": "marketplace",
+            "title": "Marketplace",
+            "icon": "🧩",
+            "group": "Agent",
+            "description": "Browse, install & manage plugins",
+            "order": 22,
+        },
        {
            "id": "memory",
            "title": "Memory",
@@ -3499,6 +3507,7 @@ def create_app(
        "cron": "/api/schedules",
        "channels": "/api/channels",
        "mcp": "/api/mcp/servers",
+        "marketplace": "/api/marketplace/plugins",
    }

    # Read page whitelist from config.yaml if set_pages() was not called
@@ -386,16 +386,17 @@ function injectStyles() {
 }

 function checkForChannelsPage(root) {
-  // Look for a channels page container or dashboard section
-  const channelsSection = root.querySelector('[data-page="channels"]') ||
-                          root.querySelector('.channels-page') ||
+  // The dashboard channels view (plugins/views/channels.js) now owns the full
+  // CRUD UI and mounts into the [data-page="channels"] container. Only take over
+  // legacy standalone containers that the dashboard view does not manage, so we
+  // never clobber the Add Channel modal and card actions.
+  const channelsSection = root.querySelector('.channels-page') ||
                          root.querySelector('#channels');
-  
+
  if (channelsSection && !channelsSection.hasAttribute('data-aiui-channels')) {
    channelsSection.setAttribute('data-aiui-channels', 'true');
    fetchChannels().then(renderChannelsUI);
-    
-    // Set up auto-refresh every 30 seconds
+
    if (refreshInterval) clearInterval(refreshInterval);
    refreshInterval = setInterval(async () => {
      await fetchChannels();
@@ -175,6 +175,7 @@ const BUILTIN_VIEWS = {
  auth:           '/plugins/views/auth.js',
  api:            '/plugins/views/api.js',
  mcp:            '/plugins/views/mcp.js',
+  marketplace:    '/plugins/views/marketplace.js',
 };

 const SLOT_REGISTRY = {};
@@ -316,8 +317,12 @@ const DASHBOARD_STYLE = `
    padding: 20px; font-size: 15px; font-weight: 600;
    letter-spacing: -0.01em; border-bottom: 1px solid var(--db-border);
    display: flex; align-items: center; gap: 10px;
+    min-width: 0; padding-right: 28px;
  }
-  .db-sidebar-header .logo { font-size: 20px; }
+  .db-sidebar-header > span:not(.logo) {
+    min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .db-sidebar-header .logo { font-size: 20px; flex-shrink: 0; }
  .db-sidebar-toggle {
    position: absolute;
    right: -12px;
@@ -480,6 +485,9 @@ const DASHBOARD_STYLE = `
  @keyframes db-spin { to { transform: rotate(360deg); } }
  .db-spinner { display: inline-block; width: 24px; height: 24px; border: 2px solid var(--db-border); border-top-color: var(--db-accent); border-radius: 50%; animation: db-spin 0.8s linear infinite; }

+  /* Init error banner */
+  .db-error { margin: 24px; padding: 16px 20px; border: 1px solid #b91c1c; border-radius: 8px; background: rgba(185, 28, 28, 0.12); color: #fca5a5; font-size: 14px; }
+
  /* Hide React docs layout when dashboard is active */
  .db-active .sidebar:not(.db-sidebar), .db-active .topnav, .db-active .toc-sidebar,
  .db-active > .main-content, .db-active > nav:not(.db-sidebar) { display: none !important; }
@@ -583,6 +591,22 @@ const DASHBOARD_STYLE = `
    appearance: none; cursor: pointer;
  }
  .db-form-select:focus { border-color: var(--db-accent); }
+  .db-form-select option, select.db-form-select option {
+    background-color: var(--db-sidebar-bg);
+    color: var(--db-text);
+  }
+  .db-form-select option:checked, select.db-form-select option:checked {
+    background-color: var(--db-accent);
+    color: #fff;
+  }
+  .db-active select option, #root select option {
+    background-color: var(--db-sidebar-bg);
+    color: var(--db-text);
+  }
+  .db-active select option:checked, #root select option:checked {
+    background-color: var(--db-accent);
+    color: #fff;
+  }
  .db-form-textarea {
    width: 100%; padding: 8px 12px; font-size: 13px; color: var(--db-text);
    background: var(--db-card-bg); border: 1px solid var(--db-border); border-radius: 6px;
@@ -1064,7 +1088,11 @@ function closeCommandPalette() {
  _paletteResults = [];
 }

+let _paletteInitialized = false;
+
 function initCommandPalette() {
+  if (_paletteInitialized) return;
+  _paletteInitialized = true;
  document.addEventListener('keydown', (e) => {
    if ((e.ctrlKey || e.metaKey) && (e.key === 'k' || e.key === 'K')) {
      e.preventDefault();
@@ -1073,6 +1101,11 @@ function initCommandPalette() {
  });
 }

+window.aiui = window.aiui || {};
+window.aiui.openCommandPalette = openCommandPalette;
+window.aiui.closeCommandPalette = closeCommandPalette;
+window.openCommandPalette = openCommandPalette;
+
 // ── Session Search Palette ──────────────────────────────────────────
 // Vanilla-JS port of the React SessionSearch / useSessionSearch behavior so
 // that the dashboard style reaches C-01 parity. The palette lists sessions
@@ -1495,6 +1528,20 @@ function buildSidebar(pages) {
  return sidebar;
 }

+function showDashboardInitError(message) {
+  const root = document.getElementById('root');
+  if (!root) return;
+  let banner = document.getElementById('db-init-error');
+  if (!banner) {
+    banner = document.createElement('div');
+    banner.id = 'db-init-error';
+    banner.className = 'db-error';
+    banner.setAttribute('role', 'alert');
+    root.appendChild(banner);
+  }
+  banner.textContent = message;
+}
+
 async function selectPage(pageId) {
  // Cleanup previous view if it has a cleanup function
  if (_activeCleanup) { try { _activeCleanup(); } catch(e) {} _activeCleanup = null; }
@@ -1513,7 +1560,15 @@ async function selectPage(pageId) {

  const page = pagesData.find(p => p.id === pageId);
  const main = document.getElementById('db-main-content');
-  if (!main || !page) return;
+  if (!main) {
+    console.error('[AIUI] selectPage aborted: #db-main-content not in DOM — dashboard shell incomplete');
+    showDashboardInitError('Dashboard shell layout incomplete. Reload the page or check the dashboard plugin.');
+    return;
+  }
+  if (!page) {
+    console.error(`[AIUI] selectPage aborted: page '${pageId}' not found in pagesData`);
+    return;
+  }

  // Set page header (controlled by dashboard config protocol)
  const showPageHeader = main.dataset.showPageHeader !== 'false';
@@ -1,8 +1,266 @@
-/** Channels view — delegates to channels dashboard module. */
+/**
+ * Channels View — Multi-platform messaging channel management with CRUD.
+ *
+ * Restores the Add Channel modal, per-platform credential fields, setup hints,
+ * and card actions (Enable/Disable, Restart, Test, Delete) removed in the
+ * 3961508 refactor. Aligned with #176 secret policy: credential inputs default
+ * to env references (env:VAR_NAME), stored secrets are never re-displayed
+ * (uses *_set flags from the redacted GET), and API 400 validation errors are
+ * surfaced inline in the modal.
+ *
+ * API: /api/channels, /api/channels/platforms, /api/channels/{id}/{toggle,restart,test}
+ */
+import { showToast, showConfirm } from '../toast.js';
+
+const PLATFORM_META = {
+  discord: { icon: '🎮', color: '#5865F2', fields: [{ key: 'bot_token', label: 'Bot Token', secret: true }] },
+  slack: { icon: '💬', color: '#4A154B', fields: [
+    { key: 'bot_token', label: 'Bot Token', secret: true },
+    { key: 'app_token', label: 'App Token', secret: true },
+    { key: 'signing_secret', label: 'Signing Secret', secret: true, optional: true },
+  ] },
+  telegram: { icon: '✈️', color: '#229ED9', fields: [{ key: 'bot_token', label: 'Bot Token', secret: true }] },
+  whatsapp: { icon: '📱', color: '#25D366', fields: [
+    { key: 'access_token', label: 'Access Token', secret: true },
+    { key: 'phone_number_id', label: 'Phone Number ID' },
+    { key: 'verify_token', label: 'Verify Token', secret: true, optional: true },
+  ] },
+  imessage: { icon: '🍎', color: '#007AFF', fields: [
+    { key: 'apple_id', label: 'Apple ID' },
+    { key: 'handler_path', label: 'Handler Path' },
+  ] },
+  signal: { icon: '🔒', color: '#3A76F0', fields: [
+    { key: 'phone_number', label: 'Phone Number' },
+    { key: 'api_url', label: 'API URL' },
+  ] },
+  googlechat: { icon: '💼', color: '#00AC47', fields: [
+    { key: 'service_account', label: 'Service Account', secret: true },
+    { key: 'space_name', label: 'Space Name' },
+  ] },
+  nostr: { icon: '🟣', color: '#9B59B6', fields: [
+    { key: 'private_key', label: 'Private Key (nsec)', secret: true },
+    { key: 'relay_url', label: 'Relay URL' },
+  ] },
+};
+
+const SETUP_HINTS = {
+  discord: '1. Create a Bot at discord.com/developers\n2. Enable Message Content Intent\n3. Copy the Bot Token\n4. Invite bot to your server',
+  slack: '1. Create a Slack App at api.slack.com\n2. Add Bot Token Scopes (chat:write, app_mentions:read)\n3. Enable Socket Mode → copy App Token (xapp-...)\n4. Install to workspace → copy Bot Token (xoxb-...)',
+  telegram: '1. Message @BotFather on Telegram\n2. Create a new bot with /newbot\n3. Copy the Bot Token',
+  whatsapp: '1. Create a Meta Business App\n2. Set up WhatsApp Business API\n3. Copy Phone Number ID and Access Token',
+};
+
+function metaFor(platform) {
+  return PLATFORM_META[platform] || { icon: '📡', color: 'var(--db-accent)', fields: [] };
+}
+
+function esc(s) {
+  const d = document.createElement('div');
+  d.textContent = s == null ? '' : String(s);
+  return d.innerHTML;
+}
+
 export async function render(container) {
  container.setAttribute('data-page', 'channels');
-  const mod = await import('../channels.js');
-  if (mod.default?.init) await mod.default.init();
-  const root = container.closest('#root') || document.getElementById('root');
-  if (mod.default?.onContentChange && root) mod.default.onContentChange(root);
+  container.innerHTML = '<div class="db-loading"><div class="db-spinner"></div></div>';
+
+  let channels = [];
+  let platforms = [];
+  try {
+    const r = await fetch('/api/channels');
+    const d = await r.json();
+    channels = d.channels || d || [];
+    if (!Array.isArray(channels)) {
+      channels = Object.entries(channels).map(([id, c]) => ({ id, ...(typeof c === 'object' ? c : { platform: c }) }));
+    }
+  } catch (e) {}
+  try {
+    const r = await fetch('/api/channels/platforms');
+    const d = await r.json();
+    platforms = d.platforms || d || [];
+  } catch (e) {}
+  if (!Array.isArray(platforms) || platforms.length === 0) platforms = Object.keys(PLATFORM_META);
+
+  const online = channels.filter(c => c.running === true).length;
+
+  container.innerHTML = `
+    <div style="padding:24px;max-width:1200px;margin:0 auto">
+      <div class="aiui-channels-header" style="display:flex;align-items:center;justify-content:space-between;margin-bottom:20px">
+        <div>
+          <h2 style="margin:0;font-size:1.5rem">Messaging Channels</h2>
+          <div style="margin-top:4px;font-size:13px;color:var(--db-text-dim)">${online} Online · ${channels.length} Total</div>
+        </div>
+        <button id="ch-add" style="padding:8px 18px;background:var(--db-accent,#6366f1);color:#fff;border:none;border-radius:8px;cursor:pointer;font-weight:600;font-size:.85rem">+ Add Channel</button>
+      </div>
+      <div id="ch-grid" class="db-columns" style="display:grid;grid-template-columns:repeat(auto-fill,minmax(340px,1fr));gap:16px"></div>
+      <div id="ch-modal" style="display:none;position:fixed;inset:0;background:rgba(0,0,0,0.6);z-index:100;align-items:center;justify-content:center"></div>
+    </div>`;
+
+  const grid = container.querySelector('#ch-grid');
+
+  if (channels.length === 0) {
+    grid.innerHTML = `
+      <div class="aiui-channels-empty" style="grid-column:1/-1;text-align:center;padding:3rem 2rem;color:var(--db-text-dim)">
+        <div style="font-size:3rem;opacity:.5;margin-bottom:1rem">📡</div>
+        <h3 style="color:var(--db-text);margin:0 0 .5rem">No Channels Configured</h3>
+        <p style="margin:.5rem 0">Click <strong>+ Add Channel</strong> to connect Discord, Slack, Telegram, or WhatsApp.</p>
+      </div>`;
+  } else {
+    channels.forEach(ch => {
+      const platform = (ch.platform || ch.type || ch.id || '').toLowerCase();
+      const meta = metaFor(platform);
+      const enabled = ch.enabled !== false;
+      const isRunning = ch.running === true;
+      const hasError = !!(ch.start_error && ch.start_error !== '');
+      const statusLabel = !enabled ? 'Disabled' : isRunning ? 'Connected' : hasError ? 'Error' : 'Stopped';
+      const card = document.createElement('div');
+      card.className = 'db-card';
+      card.style.cssText = 'padding:16px;border-radius:12px';
+      card.innerHTML = `
+        <div style="display:flex;align-items:center;gap:12px;margin-bottom:12px">
+          <div style="width:42px;height:42px;border-radius:10px;display:flex;align-items:center;justify-content:center;font-size:22px;background:${meta.color}22">${meta.icon}</div>
+          <div style="flex:1;min-width:0">
+            <div style="font-weight:600;font-size:15px">${esc(ch.name || ch.id || platform)}</div>
+            <div style="font-size:12px;color:var(--db-text-dim);margin-top:1px;text-transform:capitalize">${esc(platform)}</div>
+          </div>
+          <span style="font-size:11px;padding:3px 10px;border-radius:12px;${isRunning ? 'background:rgba(34,197,94,.15);color:#22c55e' : hasError ? 'background:rgba(234,179,8,.15);color:#eab308' : 'background:rgba(239,68,68,.15);color:#ef4444'}">${isRunning ? '●' : hasError ? '⚠' : '○'} ${statusLabel}</span>
+        </div>
+        <div style="display:flex;gap:6px;margin-top:8px;flex-wrap:wrap">
+          <button class="ch-toggle" data-id="${esc(ch.id)}" style="font-size:11px;padding:4px 12px;border:1px solid var(--db-border);background:transparent;color:var(--db-text);border-radius:6px;cursor:pointer">${enabled ? 'Disable' : 'Enable'}</button>
+          <button class="ch-restart" data-id="${esc(ch.id)}" style="font-size:11px;padding:4px 12px;border:1px solid var(--db-border);background:transparent;color:var(--db-text);border-radius:6px;cursor:pointer">⟳ Restart</button>
+          <button class="ch-test" data-id="${esc(ch.id)}" style="font-size:11px;padding:4px 12px;border:1px solid var(--db-border);background:transparent;color:var(--db-text);border-radius:6px;cursor:pointer">🔍 Test</button>
+          <button class="ch-del" data-id="${esc(ch.id)}" style="font-size:11px;padding:4px 12px;border:1px solid rgba(239,68,68,0.3);background:transparent;color:#ef4444;border-radius:6px;cursor:pointer">Delete</button>
+        </div>`;
+      grid.appendChild(card);
+    });
+  }
+
+  container.querySelectorAll('.ch-toggle').forEach(b => b.addEventListener('click', async () => {
+    try {
+      const r = await fetch(`/api/channels/${b.dataset.id}/toggle`, { method: 'POST' });
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      render(container);
+    } catch (e) { showToast('Toggle failed: ' + e.message, 'error'); }
+  }));
+
+  container.querySelectorAll('.ch-restart').forEach(b => b.addEventListener('click', async () => {
+    try {
+      const r = await fetch(`/api/channels/${b.dataset.id}/restart`, { method: 'POST' });
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      showToast('Channel restart initiated', 'success');
+    } catch (e) { showToast('Restart failed: ' + e.message, 'error'); }
+  }));
+
+  container.querySelectorAll('.ch-test').forEach(b => b.addEventListener('click', async () => {
+    try {
+      const r = await fetch(`/api/channels/${b.dataset.id}/test`, { method: 'POST' });
+      const d = await r.json().catch(() => ({}));
+      const ok = r.ok && d.success !== false;
+      showToast(ok ? 'Connection test passed!' : 'Test failed: ' + (d.error || `HTTP ${r.status}`), ok ? 'success' : 'error');
+      if (ok) render(container);
+    } catch (e) { showToast('Test failed: ' + e.message, 'error'); }
+  }));
+
+  container.querySelectorAll('.ch-del').forEach(b => b.addEventListener('click', async () => {
+    if (!await showConfirm('Delete channel?', 'This action cannot be undone.')) return;
+    try {
+      const r = await fetch(`/api/channels/${b.dataset.id}`, { method: 'DELETE' });
+      if (!r.ok) throw new Error(`HTTP ${r.status}`);
+      render(container);
+    } catch (e) { showToast('Delete failed: ' + e.message, 'error'); }
+  }));
+
+  container.querySelector('#ch-add')?.addEventListener('click', () => openAddModal(container, platforms));
+}
+
+function openAddModal(container, platforms) {
+  const m = container.querySelector('#ch-modal');
+  m.style.display = 'flex';
+  m.innerHTML = `
+    <div style="background:var(--db-sidebar-bg);border:1px solid var(--db-border);border-radius:12px;padding:28px;width:480px;max-width:92vw;max-height:80vh;overflow-y:auto">
+      <h3 style="margin:0 0 20px;font-size:18px">Add Channel</h3>
+      <label style="display:block;margin-bottom:14px">
+        <span style="font-size:12px;color:var(--db-text-dim);display:block;margin-bottom:4px">Platform</span>
+        <select id="chf-platform" class="db-form-select">
+          ${platforms.map(p => `<option value="${esc(p)}">${metaFor(p).icon} ${esc(p.charAt(0).toUpperCase() + p.slice(1))}</option>`).join('')}
+        </select>
+      </label>
+      <label style="display:block;margin-bottom:14px">
+        <span style="font-size:12px;color:var(--db-text-dim);display:block;margin-bottom:4px">Channel Name <span style="opacity:.5">(Optional)</span></span>
+        <input id="chf-name" class="db-form-input" placeholder="my-bot">
+      </label>
+      <div id="chf-fields" style="margin-bottom:14px"></div>
+      <div id="chf-error" style="display:none;margin-bottom:14px;padding:10px 14px;background:rgba(239,68,68,.12);border:1px solid rgba(239,68,68,.3);border-radius:8px;font-size:12px;color:#ef4444"></div>
+      <div id="chf-setup-hint" style="margin-bottom:20px;padding:10px 14px;background:rgba(99,102,241,.08);border-radius:8px;font-size:12px;color:var(--db-text-dim)"></div>
+      <div style="display:flex;gap:10px;justify-content:flex-end">
+        <button id="chf-cancel" style="padding:8px 16px;border:1px solid var(--db-border);background:transparent;color:var(--db-text);border-radius:8px;cursor:pointer">Cancel</button>
+        <button id="chf-save" style="padding:8px 16px;background:var(--db-accent,#6366f1);color:#fff;border:none;border-radius:8px;cursor:pointer;font-weight:500">Add Channel</button>
+      </div>
+    </div>`;
+
+  const selectEl = m.querySelector('#chf-platform');
+  const fieldsDiv = m.querySelector('#chf-fields');
+  const hintDiv = m.querySelector('#chf-setup-hint');
+  const errDiv = m.querySelector('#chf-error');
+
+  function updateFields() {
+    const platform = selectEl.value;
+    const meta = metaFor(platform);
+    fieldsDiv.innerHTML = meta.fields.map(f => {
+      const optTag = f.optional ? ' <span style="opacity:.5">(Optional)</span>' : '';
+      const placeholder = f.secret ? `env:${platform.toUpperCase()}_${f.key.toUpperCase()}` : f.label;
+      const helper = f.secret
+        ? '<span style="font-size:11px;color:var(--db-text-dim);display:block;margin-top:3px">Use an env reference — inline secrets are rejected.</span>'
+        : '';
+      return `<label style="display:block;margin-bottom:10px">
+        <span style="font-size:12px;color:var(--db-text-dim);display:block;margin-bottom:4px">${esc(f.label)}${optTag}</span>
+        <input class="chf-field db-form-input" data-field="${esc(f.key)}" data-optional="${f.optional ? '1' : '0'}" type="text" placeholder="${esc(placeholder)}">
+        ${helper}
+      </label>`;
+    }).join('');
+    hintDiv.innerHTML = SETUP_HINTS[platform]
+      ? '<strong>Setup Steps:</strong><pre style="margin:6px 0 0;white-space:pre-wrap;font-family:inherit">' + esc(SETUP_HINTS[platform]) + '</pre>'
+      : `Configure your ${esc(platform)} integration above.`;
+    errDiv.style.display = 'none';
+  }
+
+  updateFields();
+  selectEl.addEventListener('change', updateFields);
+  m.querySelector('#chf-cancel').addEventListener('click', () => { m.style.display = 'none'; });
+  m.addEventListener('click', e => { if (e.target === m) m.style.display = 'none'; });
+
+  m.querySelector('#chf-save').addEventListener('click', async () => {
+    const platform = selectEl.value;
+    const config = {};
+    m.querySelectorAll('.chf-field').forEach(f => {
+      const v = f.value.trim();
+      if (v) config[f.dataset.field] = v;
+    });
+    const body = {
+      platform,
+      name: m.querySelector('#chf-name').value.trim() || platform + '-bot',
+      enabled: true,
+      config,
+    };
+    errDiv.style.display = 'none';
+    try {
+      const r = await fetch('/api/channels', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      if (!r.ok) {
+        const d = await r.json().catch(() => ({}));
+        errDiv.textContent = d.error || d.detail || `Request failed (HTTP ${r.status})`;
+        errDiv.style.display = 'block';
+        return;
+      }
+      m.style.display = 'none';
+      showToast('Channel added', 'success');
+      render(container);
+    } catch (e) {
+      errDiv.textContent = e.message;
+      errDiv.style.display = 'block';
+    }
+  });
 }
@@ -9,6 +9,8 @@
 * Config-driven: auto-discovers agents and sessions from existing APIs.
 */

+import { showToast } from '../toast.js';
+
 // ── State ────────────────────────────────────────────────────────
 let ws = null;
 let currentSessionId = null;
@@ -1063,6 +1065,7 @@ function connectWebSocket() {

    ws.onerror = (e) => {
      console.error('[Chat] WebSocket error:', e);
+      setStatus('error');
    };
  } catch (e) {
    console.warn('[Chat] WebSocket connection failed:', e);
@@ -1359,6 +1362,9 @@ function appendMessage(role, content, agentName, elements) {

  const msgEl = document.createElement('div');
  msgEl.className = 'chat-msg chat-msg-' + role;
+  if (role === 'system' && typeof content === 'string' && content.startsWith('❌')) {
+    msgEl.setAttribute('role', 'alert');
+  }

  const avatarEl = document.createElement('div');
  avatarEl.className = 'chat-msg-avatar';
@@ -1907,12 +1913,20 @@ function sendMessage() {
    if (pendingAttachments.length > 0) {
      payload.attachment_ids = pendingAttachments.map(a => a.id);
    }
-    ws.send(JSON.stringify(payload));
-    setStreaming(true);
-    setStatus('streaming');
+    try {
+      ws.send(JSON.stringify(payload));
+      setStreaming(true);
+      setStatus('streaming');
+    } catch (e) {
+      const msg = 'Connection lost. Message not sent.';
+      appendMessage('system', '❌ ' + msg);
+      setStatus('error');
+      try { showToast(msg, 'error'); } catch (_) {}
+    }
  } else {
    // Fallback to HTTP
    setStatus('sending…');
+    const offlineHint = (typeof navigator !== 'undefined' && navigator.onLine === false) ? 'You are offline. ' : '';
    fetch('/api/chat/send', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
@@ -1925,13 +1939,19 @@ function sendMessage() {
    }).then((r) => r.json()).then((data) => {
      if (data.error) {
        appendMessage('system', '❌ ' + data.error);
+        setStatus('error');
+        try { showToast(data.error, 'error'); } catch (_) {}
      } else if (data.content || data.response) {
        appendMessage('assistant', data.content || data.response, data.agent_name);
+        setStatus('connected');
+      } else {
+        setStatus('connected');
      }
-      setStatus('connected');
    }).catch((e) => {
-      appendMessage('system', '❌ ' + e.message);
+      const msg = offlineHint + (e.message || 'Network error');
+      appendMessage('system', '❌ ' + msg);
      setStatus('error');
+      try { showToast(msg, 'error'); } catch (_) {}
    });
  }

@@ -88,6 +88,7 @@ const FEATURES = [
    { name: "channels",       endpoints: [
      { label: "List Channels", method: "GET",  url: "/api/channels" },
      { label: "Platforms",     method: "GET",  url: "/api/channels/platforms" },
+      { label: "Add Channel",   method: "POST", url: "/api/channels", body: { platform: "telegram", name: "my-bot", enabled: true, config: { bot_token: "env:TELEGRAM_BOT_TOKEN" } } },
    ]},
    { name: "agents_crud",    endpoints: [
      { label: "All Agents",    method: "GET",  url: "/api/agents" },
@@ -0,0 +1,242 @@
+/**
+ * Marketplace View — browse, inspect, install, and uninstall plugins.
+ * API: /api/marketplace/plugins, /api/marketplace/search,
+ *      /api/marketplace/install, /api/marketplace/uninstall,
+ *      /api/marketplace/plugins/{id}
+ */
+import { helpBanner, pageToolbar, filterChips, searchInput } from './_helpers.js';
+import { showToast, showConfirm } from '../toast.js';
+
+const CATEGORY_ICONS = { tools: '🔧', memory: '🧠', all: '📦' };
+
+function esc(s) {
+  const d = document.createElement('div');
+  d.textContent = s == null ? '' : String(s);
+  return d.innerHTML;
+}
+
+function catIcon(cat) {
+  return CATEGORY_ICONS[cat] || '🧩';
+}
+
+function permissionsFor(plugin) {
+  if (Array.isArray(plugin.permissions) && plugin.permissions.length) return plugin.permissions;
+  const map = {
+    web_search: ['network:outbound'],
+    code_executor: ['process:spawn', 'filesystem:temp'],
+    file_manager: ['filesystem:read', 'filesystem:write'],
+    memory_plugin: ['filesystem:read', 'filesystem:write', 'network:outbound'],
+  };
+  return map[plugin.id] || [];
+}
+
+export async function render(container) {
+  container.innerHTML = '<div class="db-loading"><div class="db-spinner"></div></div>';
+
+  let plugins = [];
+  try {
+    const r = await fetch('/api/marketplace/plugins');
+    const d = await r.json();
+    plugins = d.plugins || [];
+  } catch (e) {
+    container.innerHTML = '<div class="db-viewer"><pre>Failed to load marketplace: ' + e.message + '</pre></div>';
+    return;
+  }
+
+  const state = { query: '', category: 'all', tab: 'browse' };
+
+  const categories = ['all', ...Array.from(new Set(plugins.map((p) => p.category).filter(Boolean)))];
+
+  function dedupe(list) {
+    const seen = new Map();
+    list.forEach((p) => { seen.set(p.id, { ...seen.get(p.id), ...p }); });
+    return Array.from(seen.values());
+  }
+
+  function filtered() {
+    const all = dedupe(plugins);
+    return all.filter((p) => {
+      if (state.tab === 'installed' && !p.installed) return false;
+      if (state.category !== 'all' && p.category !== state.category) return false;
+      if (state.query) {
+        const q = state.query.toLowerCase();
+        return (p.name || '').toLowerCase().includes(q) || (p.description || '').toLowerCase().includes(q);
+      }
+      return true;
+    });
+  }
+
+  function cardHtml(p) {
+    const installed = !!p.installed;
+    const id = esc(p.id);
+    return `
+      <div class="db-card" data-plugin="${id}" style="padding:16px 18px;display:flex;flex-direction:column;gap:10px;cursor:pointer">
+        <div style="display:flex;align-items:center;gap:10px">
+          <span style="font-size:22px">${catIcon(p.category)}</span>
+          <div style="flex:1;min-width:0">
+            <div style="font-size:14px;font-weight:600">${esc(p.name || p.id)}</div>
+            <div style="font-size:11px;color:var(--db-text-dim)">${esc(p.category || 'plugin')} · v${esc(p.version || '1.0.0')}</div>
+          </div>
+          ${installed ? '<span style="font-size:10px;font-weight:600;color:#22c55e;padding:2px 8px;border-radius:6px;background:rgba(34,197,94,.12)">Installed</span>' : ''}
+        </div>
+        <div style="font-size:12px;color:var(--db-text-dim);line-height:1.5;min-height:34px">${esc(p.description || '')}</div>
+        <div style="display:flex;gap:8px">
+          <button type="button" class="mkt-open" data-plugin="${id}" style="flex:1;padding:6px 10px;border:1px solid var(--db-border);background:transparent;color:var(--db-text);border-radius:7px;cursor:pointer;font-size:12px">Details</button>
+          ${installed
+            ? `<button type="button" class="mkt-uninstall" data-plugin="${id}" style="flex:1;padding:6px 10px;border:1px solid rgba(239,68,68,.35);background:rgba(239,68,68,.08);color:#f87171;border-radius:7px;cursor:pointer;font-size:12px">Uninstall</button>`
+            : `<button type="button" class="mkt-install" data-plugin="${id}" style="flex:1;padding:6px 10px;border:1px solid var(--db-accent);background:var(--db-accent);color:#fff;border-radius:7px;cursor:pointer;font-size:12px">Install</button>`}
+        </div>
+      </div>`;
+  }
+
+  function paint() {
+    const list = filtered();
+    const installedCount = dedupe(plugins).filter((p) => p.installed).length;
+    container.innerHTML = `
+      ${helpBanner({
+        title: 'Marketplace',
+        what: 'Browse agent plugins, review the permissions they request, then install or uninstall them.',
+        howToUse: 'Search or filter by category, click <strong>Details</strong> to inspect permissions, then <strong>Install</strong>. Switch to the <strong>Installed</strong> tab to manage your active plugins.',
+        tip: 'The <strong>Code Executor</strong> plugin pairs with Code Studio for sandboxed execution.',
+        collapsed: true,
+      })}
+      ${pageToolbar('Plugin Marketplace', `
+        <button type="button" class="db-filter-chip mkt-tab" data-tab="browse" style="padding:5px 14px;border:1px solid var(--db-border);background:${state.tab === 'browse' ? 'var(--db-accent)' : 'transparent'};color:${state.tab === 'browse' ? '#fff' : 'var(--db-text)'};border-radius:6px;cursor:pointer;font-size:12px;font-weight:500">Browse</button>
+        <button type="button" class="db-filter-chip mkt-tab" data-tab="installed" style="padding:5px 14px;border:1px solid var(--db-border);background:${state.tab === 'installed' ? 'var(--db-accent)' : 'transparent'};color:${state.tab === 'installed' ? '#fff' : 'var(--db-text)'};border-radius:6px;cursor:pointer;font-size:12px;font-weight:500">Installed (${installedCount})</button>
+      `)}
+      <div style="display:flex;gap:12px;align-items:center;flex-wrap:wrap;margin-bottom:16px">
+        ${searchInput('Search plugins…', 'mkt-search')}
+        <div style="display:flex;gap:6px;flex-wrap:wrap">${filterChips(categories, state.category, 'data-cat')}</div>
+      </div>
+      <div id="mkt-grid" class="db-columns" style="grid-template-columns:repeat(auto-fill,minmax(280px,1fr))">
+        ${list.map(cardHtml).join('') || '<div class="db-viewer"><pre>No plugins match your filters</pre></div>'}
+      </div>
+      <div id="mkt-drawer"></div>`;
+
+    wire();
+  }
+
+  function drawerHtml(p) {
+    const perms = permissionsFor(p);
+    const installed = !!p.installed;
+    const id = esc(p.id);
+    return `
+      <div class="mkt-drawer-overlay" style="position:fixed;inset:0;background:rgba(0,0,0,.55);z-index:120;display:flex;justify-content:flex-end">
+        <div style="width:min(480px,100%);height:100%;background:var(--db-sidebar-bg);border-left:1px solid var(--db-border);overflow-y:auto;padding:24px;box-sizing:border-box">
+          <div style="display:flex;align-items:flex-start;gap:12px;margin-bottom:16px">
+            <span style="font-size:32px">${catIcon(p.category)}</span>
+            <div style="flex:1">
+              <div style="font-size:18px;font-weight:700">${esc(p.name || p.id)}</div>
+              <div style="font-size:12px;color:var(--db-text-dim)">${esc(p.category || 'plugin')} · v${esc(p.version || '1.0.0')}</div>
+            </div>
+            <button type="button" class="mkt-close" style="background:transparent;border:none;color:var(--db-text-dim);font-size:22px;cursor:pointer;line-height:1">×</button>
+          </div>
+          <div style="font-size:13px;line-height:1.6;color:var(--db-text-dim);margin-bottom:20px">${esc(p.description || 'No description provided.')}</div>
+          <div style="font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.06em;color:var(--db-text-dim);margin-bottom:8px">Permissions</div>
+          <div style="display:flex;flex-direction:column;gap:6px;margin-bottom:24px">
+            ${perms.length
+              ? perms.map((perm) => `<div style="display:flex;align-items:center;gap:8px;padding:8px 12px;border:1px solid var(--db-border);border-radius:8px;font-size:12px"><span>🔐</span><code style="font-size:12px">${esc(perm)}</code></div>`).join('')
+              : '<div style="font-size:12px;color:var(--db-text-dim)">No special permissions requested.</div>'}
+          </div>
+          ${installed
+            ? `<button type="button" class="mkt-uninstall" data-plugin="${id}" style="width:100%;padding:11px;border:1px solid rgba(239,68,68,.35);background:rgba(239,68,68,.08);color:#f87171;border-radius:9px;cursor:pointer;font-size:14px;font-weight:600">Uninstall</button>`
+            : `<button type="button" class="mkt-install" data-plugin="${id}" style="width:100%;padding:11px;border:1px solid var(--db-accent);background:var(--db-accent);color:#fff;border-radius:9px;cursor:pointer;font-size:14px;font-weight:600">Install ${perms.length ? '(' + perms.length + ' permissions)' : ''}</button>`}
+        </div>
+      </div>`;
+  }
+
+  function openDrawer(id) {
+    const p = dedupe(plugins).find((x) => x.id === id);
+    if (!p) return;
+    const drawer = container.querySelector('#mkt-drawer');
+    drawer.innerHTML = drawerHtml(p);
+    drawer.querySelector('.mkt-close').addEventListener('click', () => { drawer.innerHTML = ''; });
+    drawer.querySelector('.mkt-drawer-overlay').addEventListener('click', (e) => {
+      if (e.target.classList.contains('mkt-drawer-overlay')) drawer.innerHTML = '';
+    });
+    wireActions(drawer);
+  }
+
+  async function install(id) {
+    const p = dedupe(plugins).find((x) => x.id === id);
+    const perms = p ? permissionsFor(p) : [];
+    const ok = await showConfirm(
+      `Install ${p ? p.name || id : id}?`,
+      perms.length ? 'This plugin requests: ' + perms.join(', ') : 'This plugin requests no special permissions.'
+    );
+    if (!ok) return;
+    try {
+      const r = await fetch('/api/marketplace/install', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ plugin_id: id }),
+      });
+      const d = await r.json();
+      if (!r.ok || d.status !== 'installed') throw new Error(d.error || `HTTP ${r.status}`);
+      plugins = plugins.map((x) => (x.id === id ? { ...x, installed: true } : x));
+      showToast(`Installed ${id}`, 'success');
+      paint();
+    } catch (e) {
+      showToast('Install failed: ' + e.message, 'error');
+    }
+  }
+
+  async function uninstall(id) {
+    const ok = await showConfirm(`Uninstall ${id}?`, 'This will remove the plugin from your installed set.');
+    if (!ok) return;
+    try {
+      const r = await fetch('/api/marketplace/uninstall', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ plugin_id: id }),
+      });
+      const d = await r.json();
+      if (!r.ok || d.status !== 'uninstalled') throw new Error(d.error || `HTTP ${r.status}`);
+      plugins = plugins.map((x) => (x.id === id ? { ...x, installed: false } : x));
+      showToast(`Uninstalled ${id}`, 'success');
+      paint();
+    } catch (e) {
+      showToast('Uninstall failed: ' + e.message, 'error');
+    }
+  }
+
+  function wireActions(root) {
+    root.querySelectorAll('.mkt-install').forEach((b) =>
+      b.addEventListener('click', (e) => { e.stopPropagation(); install(b.dataset.plugin); })
+    );
+    root.querySelectorAll('.mkt-uninstall').forEach((b) =>
+      b.addEventListener('click', (e) => { e.stopPropagation(); uninstall(b.dataset.plugin); })
+    );
+  }
+
+  function wire() {
+    const search = container.querySelector('#mkt-search');
+    if (search) {
+      search.value = state.query;
+      search.addEventListener('input', () => {
+        state.query = search.value;
+        const grid = container.querySelector('#mkt-grid');
+        grid.innerHTML = filtered().map(cardHtml).join('') || '<div class="db-viewer"><pre>No plugins match your filters</pre></div>';
+        wireActions(grid);
+        grid.querySelectorAll('.mkt-open').forEach((b) =>
+          b.addEventListener('click', (e) => { e.stopPropagation(); openDrawer(b.dataset.plugin); })
+        );
+      });
+    }
+    container.querySelectorAll('.mkt-tab').forEach((b) =>
+      b.addEventListener('click', () => { state.tab = b.dataset.tab; paint(); })
+    );
+    container.querySelectorAll('.db-filter-chip[data-cat]').forEach((b) =>
+      b.addEventListener('click', () => { state.category = b.dataset.cat; paint(); })
+    );
+    container.querySelectorAll('.mkt-open').forEach((b) =>
+      b.addEventListener('click', (e) => { e.stopPropagation(); openDrawer(b.dataset.plugin); })
+    );
+    container.querySelectorAll('.db-card[data-plugin]').forEach((c) =>
+      c.addEventListener('click', () => openDrawer(c.dataset.plugin))
+    );
+    wireActions(container);
+  }
+
+  paint();
+}
@@ -516,9 +516,33 @@ class TestProtocolAPI:

 class TestMarketplaceAPI:
    def test_list_marketplace(self, client):
-        r = client.get("/api/marketplace")
+        r = client.get("/api/marketplace/plugins")
        assert r.status_code == 200

+    def test_list_plugins(self, client):
+        r = client.get("/api/marketplace/plugins")
+        assert r.status_code == 200
+        data = r.json()
+        assert "plugins" in data
+        assert isinstance(data["plugins"], list)
+
+    def test_install_uninstall_roundtrip(self, client):
+        r = client.post("/api/marketplace/install", json={"plugin_id": "web_search"})
+        assert r.status_code == 200
+        assert r.json()["status"] == "installed"
+
+        r = client.get("/api/marketplace/plugins")
+        installed = [p for p in r.json()["plugins"] if p.get("installed")]
+        assert any(p["id"] == "web_search" for p in installed)
+
+        r = client.post("/api/marketplace/uninstall", json={"plugin_id": "web_search"})
+        assert r.status_code == 200
+        assert r.json()["status"] == "uninstalled"
+
+    def test_install_unknown_plugin(self, client):
+        r = client.post("/api/marketplace/install", json={"plugin_id": "does_not_exist"})
+        assert r.status_code == 404
+

 # ===========================================================================
 # Memory (from original tests, kept for completeness)
@@ -747,6 +771,14 @@ class TestPagesAPI:
        assert r.status_code == 200
        assert "servers" in r.json()

+    def test_marketplace_page_registered(self, client):
+        r = client.get("/api/pages")
+        pages = r.json().get("pages", r.json())
+        mkt = next((p for p in pages if p["id"] == "marketplace"), None)
+        assert mkt is not None, "Marketplace page should be registered"
+        assert mkt["group"] == "Agent"
+        assert mkt["api_endpoint"] == "/api/marketplace/plugins"
+

 # ===========================================================================
 # Persistence across restart
@@ -0,0 +1,222 @@
+"""Tests for channel secret redaction in API responses.
+
+Regression coverage for issue #176 (recurrence of #58): ``GET /api/channels``
+and related handlers serialized the in-memory ``_channels`` dict verbatim,
+exposing ``config.bot_token`` and other secrets in the browser Network panel
+without authentication. Read handlers must redact secrets while the write path
+still accepts and uses the real token for bot startup.
+"""
+
+from __future__ import annotations
+
+import json
+from unittest.mock import patch
+
+import pytest
+
+from praisonaiui.features import channels as channels_mod
+from praisonaiui.features.channels import (
+    ChannelsFeature,
+    _redact_config_secrets,
+    _validate_config_security,
+)
+
+_DISCORD_TOKEN = "MTQ" + "a1b2c3d4e5f6g7h8i9j0k1l2"
+
+
+class _Req:
+    def __init__(self, path_params=None, body=None):
+        self.path_params = path_params or {}
+        self._body = body or {}
+
+    async def json(self):
+        return self._body
+
+
+@pytest.fixture(autouse=True)
+def _isolate_channel_state():
+    saved_channels = dict(channels_mod._channels)
+    saved_bots = dict(channels_mod._live_bots)
+    saved_flag = ChannelsFeature._auto_started
+    channels_mod._channels.clear()
+    channels_mod._live_bots.clear()
+    ChannelsFeature._auto_started = True
+    yield
+    channels_mod._channels.clear()
+    channels_mod._channels.update(saved_channels)
+    channels_mod._live_bots.clear()
+    channels_mod._live_bots.update(saved_bots)
+    ChannelsFeature._auto_started = saved_flag
+
+
+def _seed_channel():
+    entry = {
+        "id": "e4a6d6e1d0cf",
+        "name": "DhivyaBot",
+        "platform": "discord",
+        "enabled": True,
+        "running": True,
+        "config": {"bot_token": _DISCORD_TOKEN},
+    }
+    channels_mod._channels[entry["id"]] = entry
+    return entry
+
+
+def _body(resp):
+    return json.loads(resp.body)
+
+
+# ── Redaction helper ─────────────────────────────────────────────────
+
+
+def test_redact_covers_suffix_secret_keys():
+    out = _redact_config_secrets(
+        {
+            "bot_token": _DISCORD_TOKEN,
+            "app_token": "xapp-1-abc",
+            "signing_secret": "shh",
+            "client_secret": "shh2",
+            "api_key": "k",
+            "webhook_url": "https://example.com/hook",
+        }
+    )
+    assert out["bot_token"] == "***REDACTED***"
+    assert out["app_token"] == "***REDACTED***"
+    assert out["signing_secret"] == "***REDACTED***"
+    assert out["client_secret"] == "***REDACTED***"
+    assert out["api_key"] == "***REDACTED***"
+    assert out["webhook_url"] == "https://example.com/hook"
+    assert out["bot_token_set"] is True
+    assert out["app_token_set"] is True
+
+
+def test_redact_preserves_env_references():
+    out = _redact_config_secrets({"bot_token": "env:DISCORD_BOT_TOKEN"})
+    assert out["bot_token"] == "env:DISCORD_BOT_TOKEN"
+    assert "bot_token_set" not in out
+
+
+def test_redact_is_non_mutating():
+    original = {"bot_token": _DISCORD_TOKEN}
+    _redact_config_secrets(original)
+    assert original["bot_token"] == _DISCORD_TOKEN
+
+
+# ── Write path rejects inline secrets on suffix keys ─────────────────
+
+
+def test_validate_rejects_inline_suffix_secret():
+    err = _validate_config_security({"app_token": "xapp-1-" + "a" * 30})
+    assert err is not None
+    assert "app_token" in err
+
+
+def test_validate_allows_env_reference_suffix_key():
+    assert _validate_config_security({"signing_secret": "env:SLACK_SIGNING_SECRET"}) is None
+
+
+# ── Read handlers must not leak ──────────────────────────────────────
+
+
+@pytest.mark.asyncio
+async def test_list_redacts_bot_token():
+    _seed_channel()
+    feature = ChannelsFeature()
+    with patch.object(feature, "_sync_running_status"):
+        resp = await feature._list(_Req())
+    body = _body(resp)
+    assert _DISCORD_TOKEN not in json.dumps(body)
+    cfg = body["channels"][0]["config"]
+    assert cfg["bot_token"] == "***REDACTED***"
+    assert cfg["bot_token_set"] is True
+
+
+@pytest.mark.asyncio
+async def test_get_redacts_bot_token():
+    entry = _seed_channel()
+    feature = ChannelsFeature()
+    with patch.object(feature, "_sync_running_status"):
+        resp = await feature._get(_Req(path_params={"channel_id": entry["id"]}))
+    body = _body(resp)
+    assert _DISCORD_TOKEN not in json.dumps(body)
+    assert body["config"]["bot_token"] == "***REDACTED***"
+
+
+@pytest.mark.asyncio
+async def test_add_response_redacts_bot_token():
+    feature = ChannelsFeature()
+    req = _Req(
+        body={
+            "id": "newch",
+            "name": "New",
+            "platform": "discord",
+            "config": {"bot_token": "env:DISCORD_BOT_TOKEN"},
+        }
+    )
+    with patch.object(feature, "_start_channel_bot", return_value=None), patch.object(
+        feature, "_sync_running_status"
+    ), patch.object(channels_mod, "_persist_channels"):
+        resp = await feature._add(req)
+    body = _body(resp)
+    assert resp.status_code == 201
+    assert _DISCORD_TOKEN not in json.dumps(body)
+    assert body["config"]["bot_token"] == "env:DISCORD_BOT_TOKEN"
+
+
+@pytest.mark.asyncio
+async def test_update_response_redacts_bot_token():
+    entry = _seed_channel()
+    feature = ChannelsFeature()
+    req = _Req(
+        path_params={"channel_id": entry["id"]},
+        body={"name": "Renamed"},
+    )
+    with patch.object(channels_mod, "_persist_channels"):
+        resp = await feature._update(req)
+    body = _body(resp)
+    assert body["name"] == "Renamed"
+    assert _DISCORD_TOKEN not in json.dumps(body)
+    assert body["config"]["bot_token"] == "***REDACTED***"
+
+
+@pytest.mark.asyncio
+async def test_toggle_response_redacts_bot_token():
+    entry = _seed_channel()
+    feature = ChannelsFeature()
+    req = _Req(path_params={"channel_id": entry["id"]})
+    with patch.object(feature, "_stop_channel_bot", return_value=None):
+        resp = await feature._toggle(req)
+    body = _body(resp)
+    assert _DISCORD_TOKEN not in json.dumps(body)
+    assert body["config"]["bot_token"] == "***REDACTED***"
+
+
+# ── Write path must keep the real secret internally ──────────────────
+
+
+@pytest.mark.asyncio
+async def test_internal_store_retains_real_token_after_read():
+    entry = _seed_channel()
+    feature = ChannelsFeature()
+    with patch.object(feature, "_sync_running_status"):
+        await feature._list(_Req())
+    assert channels_mod._channels[entry["id"]]["config"]["bot_token"] == _DISCORD_TOKEN
+
+
+@pytest.mark.asyncio
+async def test_start_channel_bot_reads_unredacted_token():
+    entry = _seed_channel()
+    feature = ChannelsFeature()
+
+    captured: dict = {}
+
+    def _fake_direct(platform, token, agent, config):
+        captured["token"] = token
+        return None
+
+    with patch.object(feature, "_get_gateway", return_value=None), patch.object(
+        feature, "_create_bot_direct", side_effect=_fake_direct
+    ):
+        await feature._start_channel_bot(entry["id"], entry)
+
+    assert captured["token"] == _DISCORD_TOKEN
@@ -0,0 +1,96 @@
+"""Regression tests for issue #189.
+
+The Channels dashboard view lost its CRUD controls in the 3961508 refactor,
+leaving a read-only page (list + restart only). These tests assert the
+committed frontend view source
+``src/praisonaiui/templates/frontend/plugins/views/channels.js`` restores the
+Add Channel modal and per-card actions (Enable/Disable, Restart, Test, Delete),
+aligned with the #176 secret policy (env references, no plaintext token paste
+by default) and the #172 dropdown contrast fix (``.db-form-select``).
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+_FRONTEND = (
+    Path(__file__).resolve().parents[2]
+    / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
+)
+CHANNELS_VIEW = _FRONTEND / "views" / "channels.js"
+EXPLORER_VIEW = _FRONTEND / "views" / "explorer.js"
+
+
+def _view() -> str:
+    return CHANNELS_VIEW.read_text()
+
+
+class TestAddChannelControls:
+    def test_add_channel_button_present(self):
+        src = _view()
+        assert 'id="ch-add"' in src
+        assert "+ Add Channel" in src
+
+    def test_add_modal_has_platform_select(self):
+        src = _view()
+        assert 'id="chf-platform"' in src
+        assert 'id="ch-modal"' in src
+
+    def test_platform_select_uses_dashboard_form_class(self):
+        # #172 dark-theme option contrast fix applies to .db-form-select.
+        src = _view()
+        assert "db-form-select" in src
+
+    def test_save_posts_to_channels_api(self):
+        src = _view()
+        assert "/api/channels" in src
+        assert "'POST'" in src or '"POST"' in src
+        assert "JSON.stringify" in src
+
+
+class TestCardActions:
+    def test_all_card_actions_present(self):
+        src = _view()
+        for cls in ("ch-toggle", "ch-restart", "ch-test", "ch-del"):
+            assert cls in src, f"missing card action {cls}"
+
+    def test_toggle_endpoint(self):
+        assert "/toggle" in _view()
+
+    def test_test_endpoint(self):
+        assert "/test" in _view()
+
+    def test_delete_uses_confirm(self):
+        src = _view()
+        assert "showConfirm" in src
+        assert "DELETE" in src
+
+
+class TestSecretPolicy:
+    def test_secret_fields_default_to_env_reference(self):
+        # Placeholders steer operators to env references per #176.
+        src = _view()
+        assert "env:" in src
+
+    def test_modal_surfaces_api_validation_error(self):
+        src = _view()
+        assert 'id="chf-error"' in src
+
+    def test_no_inline_password_prefill(self):
+        # Fields must not be pre-populated with stored secrets.
+        src = _view()
+        assert "value=" not in src or "***REDACTED***" not in src
+
+
+class TestEmptyState:
+    def test_empty_state_references_add_button(self):
+        src = _view()
+        assert "+ Add Channel" in src
+        assert "Use the API or CLI to add channels." not in src
+
+
+class TestExplorerPreset:
+    def test_explorer_has_add_channel_post(self):
+        src = EXPLORER_VIEW.read_text()
+        assert "Add Channel" in src
+        assert "env:TELEGRAM_BOT_TOKEN" in src
@@ -0,0 +1,82 @@
+"""Regression tests for #177 — offline chat send produces no user-visible error.
+
+The browser E2E audit simulated offline mode on /chat and found no visible
+error feedback. These source-parsing tests assert the fixes:
+
+  RC-2  selectPage shows a shell error (.db-error / role=alert via
+        showDashboardInitError) when #db-main-content is missing instead
+        of returning silently.
+  RC-3  the HTTP fallback catch path surfaces an offline hint plus a toast.
+  RC-3b system error bubbles (prefixed with ❌) get role="alert" for a11y.
+  RC-4  ws.send() is wrapped in try/catch with a user-visible error.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+FRONTEND = (
+    Path(__file__).resolve().parents[2]
+    / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
+)
+DASHBOARD_JS = FRONTEND / "dashboard.js"
+CHAT_JS = FRONTEND / "views" / "chat.js"
+
+
+class TestSelectPageShellError:
+    def test_shell_error_helper_defined(self):
+        src = DASHBOARD_JS.read_text()
+        assert "function showDashboardInitError(" in src
+        assert "'alert'" in src
+        assert "db-error" in src
+
+    def test_select_page_calls_shell_error_on_missing_main(self):
+        src = DASHBOARD_JS.read_text()
+        idx = src.find("const main = document.getElementById('db-main-content')")
+        assert idx != -1
+        region = src[idx:idx + 400]
+        assert "if (!main)" in region
+        assert "showDashboardInitError(" in region
+
+
+class TestChatOfflineMessaging:
+    def test_toast_imported(self):
+        src = CHAT_JS.read_text()
+        assert "import { showToast } from '../toast.js';" in src
+
+    def test_offline_hint_in_fallback(self):
+        src = CHAT_JS.read_text()
+        assert "navigator.onLine === false" in src
+        assert "You are offline. " in src
+
+    def test_fallback_catch_shows_toast(self):
+        src = CHAT_JS.read_text()
+        idx = src.find("fetch('/api/chat/send'")
+        assert idx != -1
+        region = src[idx:idx + 900]
+        assert ".catch(" in region
+        assert "showToast(" in region
+        assert "appendMessage('system'" in region
+        assert "setStatus('error')" in region
+
+
+class TestSystemErrorRoleAlert:
+    def test_append_message_sets_role_alert(self):
+        src = CHAT_JS.read_text()
+        idx = src.find("function appendMessage(")
+        assert idx != -1
+        region = src[idx:idx + 700]
+        assert "setAttribute('role', 'alert')" in region
+        assert "startsWith('❌')" in region
+
+
+class TestWebSocketSendGuard:
+    def test_ws_send_wrapped_in_try_catch(self):
+        src = CHAT_JS.read_text()
+        idx = src.find("ws.send(JSON.stringify(payload))")
+        assert idx != -1
+        before = src[max(0, idx - 120):idx]
+        after = src[idx:idx + 300]
+        assert "try {" in before
+        assert "catch" in after
+        assert "Connection lost. Message not sent." in after
@@ -0,0 +1,67 @@
+"""Regression tests for #178 — Ctrl+K command palette exposure and idempotency.
+
+The dashboard command palette (initCommandPalette / openCommandPalette /
+.db-cmdk-overlay) is implemented in the shipped bundle, but the acceptance
+criteria require openCommandPalette to be reachable from the global scope
+(``typeof openCommandPalette === 'function'``) and require that repeated
+initialisation (HMR / full reload) does not double-register the keydown
+handler. These source-parsing tests mirror ``test_dashboard_shell_order.py``.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+FRONTEND = (
+    Path(__file__).resolve().parents[2]
+    / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
+)
+DASHBOARD_JS = FRONTEND / "dashboard.js"
+
+
+class TestCommandPalette:
+    def _src(self) -> str:
+        return DASHBOARD_JS.read_text()
+
+    def test_open_command_palette_exposed_globally(self):
+        src = self._src()
+        assert "window.openCommandPalette = openCommandPalette" in src, (
+            "openCommandPalette must be exposed on window for the global "
+            "'typeof openCommandPalette === function' acceptance criterion"
+        )
+
+    def test_open_command_palette_on_aiui_namespace(self):
+        src = self._src()
+        assert "window.aiui.openCommandPalette = openCommandPalette" in src
+
+    def test_init_command_palette_guarded_against_double_register(self):
+        src = self._src()
+        m = re.search(
+            r"function initCommandPalette\([^)]*\)\s*\{(.*?)^}",
+            src, re.DOTALL | re.MULTILINE,
+        )
+        assert m, "initCommandPalette not found"
+        body = m.group(1)
+        assert "_paletteInitialized" in body, (
+            "initCommandPalette must guard against duplicate registration"
+        )
+        assert "return" in body, (
+            "initCommandPalette must early-return when already initialised"
+        )
+
+    def test_init_command_palette_called_after_build(self):
+        src = self._src()
+        build_idx = src.find("await buildDashboard()")
+        init_idx = src.find("initCommandPalette();")
+        assert build_idx != -1, "buildDashboard call not found"
+        assert init_idx != -1, "initCommandPalette call not found"
+        assert build_idx < init_idx, (
+            "initCommandPalette must run after buildDashboard so the shell exists"
+        )
+
+    def test_ctrl_and_meta_k_bound(self):
+        src = self._src()
+        assert re.search(
+            r"e\.ctrlKey \|\| e\.metaKey", src
+        ), "Ctrl+K / Cmd+K must both open the palette"
@@ -12,9 +12,9 @@ def test_feature_registry_basic():
    assert registry.is_implemented("site")
    assert registry.is_implemented("seo")
    assert registry.is_implemented("a11y")
-
-    # Test experimental features
-    assert registry.is_experimental("i18n")
+    # i18n graduated to implemented (since 0.5.0)
+    assert registry.is_implemented("i18n")
+    assert not registry.is_experimental("i18n")

    # Test non-existent features
    assert not registry.is_implemented("nonexistent")
@@ -34,14 +34,14 @@ def test_feature_registry_with_config():
    experimental = registry.get_experimental_fields(config)
    assert experimental == []

-    # Config with experimental features
-    config_with_experimental = Config(
+    # i18n is now an implemented feature, so it is not reported as experimental
+    config_with_i18n = Config(
        site=SiteConfig(title="Test"),
        i18n=I18nConfig(locales=["en", "es"])
    )

-    experimental = registry.get_experimental_fields(config_with_experimental)
-    assert "i18n" in experimental
+    experimental = registry.get_experimental_fields(config_with_i18n)
+    assert "i18n" not in experimental


 def test_feature_info():
@@ -55,5 +55,5 @@ def test_feature_info():

    i18n_info = registry.get_feature("i18n")
    assert i18n_info is not None
-    assert i18n_info.status == FeatureStatus.EXPERIMENTAL
-    assert i18n_info.since is None
+    assert i18n_info.status == FeatureStatus.IMPLEMENTED
+    assert i18n_info.since == "0.5.0"
@@ -0,0 +1,77 @@
+"""Regression tests for issue #172.
+
+Two dark-theme defects on the dashboard shell:
+
+1. Native ``<select>`` option popups inherited the dashboard's light
+   foreground colour while the browser painted a white system background,
+   producing unreadable white-on-white platform labels (WCAG AA failure).
+
+2. The sidebar header brand text could overlap an adjacent control because
+   the long title had no overflow/ellipsis guard and the absolutely
+   positioned toggle reserved no space.
+
+Both fixes live in the committed dashboard bundle
+``src/praisonaiui/templates/frontend/plugins/dashboard.js`` (``DASHBOARD_STYLE``).
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+DASHBOARD_JS = (
+    Path(__file__).resolve().parents[2]
+    / "src" / "praisonaiui" / "templates" / "frontend"
+    / "plugins" / "dashboard.js"
+)
+
+
+def _style() -> str:
+    src = DASHBOARD_JS.read_text()
+    m = re.search(r"const DASHBOARD_STYLE = `(.*?)`;", src, re.DOTALL)
+    assert m, "DASHBOARD_STYLE template literal not found"
+    return m.group(1)
+
+
+class TestSelectOptionContrast:
+    """Native option popups must use a dark surface with light text."""
+
+    def test_form_select_option_has_explicit_colors(self):
+        style = _style()
+        m = re.search(r"\.db-form-select option[^{]*\{([^}]*)\}", style)
+        assert m, "no explicit styling for .db-form-select option"
+        body = m.group(1)
+        assert "background-color" in body
+        assert "color" in body
+        assert "var(--db-text)" in body
+
+    def test_generic_dashboard_select_option_styled(self):
+        style = _style()
+        assert ".db-active select option" in style or "#root select option" in style
+
+    def test_selected_option_is_highlighted(self):
+        style = _style()
+        assert "option:checked" in style
+
+
+class TestSidebarHeaderNoOverlap:
+    """Sidebar brand text must not overlap adjacent controls."""
+
+    def test_header_reserves_space_and_truncates(self):
+        style = _style()
+        m = re.search(r"\n  \.db-sidebar-header\s*\{([^}]*)\}", style)
+        assert m, ".db-sidebar-header base rule not found"
+        body = m.group(1)
+        assert "min-width: 0" in body or "min-width:0" in body
+        assert "padding-right" in body
+
+    def test_header_label_has_ellipsis(self):
+        style = _style()
+        assert "text-overflow: ellipsis" in style
+        assert "white-space: nowrap" in style
+
+    def test_logo_does_not_shrink(self):
+        style = _style()
+        m = re.search(r"\.db-sidebar-header \.logo\s*\{([^}]*)\}", style)
+        assert m, ".db-sidebar-header .logo rule not found"
+        assert "flex-shrink: 0" in m.group(1)
@@ -0,0 +1,71 @@
+"""Regression tests for #175 — selectPage() silent abort when #db-main-content missing.
+
+The dashboard style (`dashboard.js`) skips React. When the shell layout is
+incomplete and `#db-main-content` is absent, `selectPage()` used to return
+silently, leaving every view empty with no console error or user-visible signal.
+These source-parsing tests assert the defensive guard and error surface are
+wired in, mirroring `test_session_search_dashboard.py`.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+FRONTEND = (
+    Path(__file__).resolve().parents[2]
+    / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
+)
+DASHBOARD_JS = FRONTEND / "dashboard.js"
+
+
+class TestSelectPageGuard:
+    def _select_page_body(self) -> str:
+        src = DASHBOARD_JS.read_text()
+        m = re.search(
+            r"async function selectPage\(pageId\)\s*\{(.*?)^}",
+            src, re.DOTALL | re.MULTILINE,
+        )
+        assert m, "selectPage not found"
+        return m.group(1)
+
+    def test_missing_main_logs_console_error(self):
+        body = self._select_page_body()
+        m = re.search(
+            r"if \(!main\)\s*\{(.*?)\}", body, re.DOTALL,
+        )
+        assert m, "guard for missing #db-main-content not found"
+        guard = m.group(1)
+        assert "console.error" in guard
+        assert "db-main-content" in guard
+
+    def test_missing_main_surfaces_init_error(self):
+        body = self._select_page_body()
+        m = re.search(
+            r"if \(!main\)\s*\{(.*?)\}", body, re.DOTALL,
+        )
+        assert m, "guard for missing #db-main-content not found"
+        assert "showDashboardInitError" in m.group(1)
+
+    def test_missing_page_logs_console_error(self):
+        body = self._select_page_body()
+        m = re.search(
+            r"if \(!page\)\s*\{(.*?)\}", body, re.DOTALL,
+        )
+        assert m, "guard for missing page not found"
+        assert "console.error" in m.group(1)
+
+    def test_show_dashboard_init_error_helper_present(self):
+        src = DASHBOARD_JS.read_text()
+        m = re.search(
+            r"function showDashboardInitError\(message\)\s*\{(.*?)^}",
+            src, re.DOTALL | re.MULTILINE,
+        )
+        assert m, "showDashboardInitError helper not found"
+        helper = m.group(1)
+        assert "db-init-error" in helper
+        assert "role" in helper and "alert" in helper
+
+    def test_no_silent_combined_return(self):
+        body = self._select_page_body()
+        assert "if (!main || !page) return;" not in body
@@ -13,11 +13,12 @@ from __future__ import annotations
 import re
 from pathlib import Path

+ROOT = Path(__file__).resolve().parents[2]
 FRONTEND = (
-    Path(__file__).resolve().parents[2]
-    / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
+    ROOT / "src" / "praisonaiui" / "templates" / "frontend" / "plugins"
 )
 DASHBOARD_JS = FRONTEND / "dashboard.js"
+GENERATOR = ROOT / "scripts" / "patch_dashboard_modular.py"


 class TestDashboardShellOrder:
@@ -48,3 +49,17 @@ class TestDashboardShellOrder:
            body,
        )
        assert m, "shellHeader insert must be guarded by children.length"
+
+    def test_generator_emits_main_before_insert_before(self):
+        src = GENERATOR.read_text()
+        append_idx = src.find("root.appendChild(main);\n  const shellHeader")
+        insert_idx = src.find("root.insertBefore(shellHeader, main)")
+        assert append_idx != -1, (
+            "generator must emit root.appendChild(main) before shellHeader"
+        )
+        assert insert_idx != -1, (
+            "generator must emit root.insertBefore(shellHeader, main)"
+        )
+        assert append_idx < insert_idx, (
+            "generator must append main to root before insertBefore references it"
+        )
@@ -90,9 +90,10 @@ class TestSessionLifecycle:
            assert "openai package not installed" in session_info["error"]

    @pytest.mark.asyncio
-    async def test_session_lifecycle_with_mocked_openai(self):
+    async def test_session_lifecycle_with_mocked_openai(self, monkeypatch):
        """Test full session lifecycle with mocked OpenAI."""
        import sys
+        monkeypatch.delenv("OPENAI_API_KEY", raising=False)
        manager = OpenAIRealtimeManager()

        # Mock OpenAI client and response
@@ -140,6 +141,27 @@ class TestSessionLifecycle:
            # Verify session is removed from internal tracking
            assert session_id not in manager._sessions

+    @pytest.mark.asyncio
+    async def test_receive_audio_yields_session_ready_with_api_key(self, monkeypatch):
+        """With OPENAI_API_KEY set, receive_audio yields session.ready first."""
+        monkeypatch.setenv("OPENAI_API_KEY", "sk-test")
+        manager = OpenAIRealtimeManager()
+        session_id = "session_ready_test"
+        manager._sessions[session_id] = {
+            "status": "created",
+            "client_secret": "secret_abc",
+        }
+
+        events = []
+        async for event in manager.receive_audio(session_id):
+            events.append(event)
+            break
+
+        assert len(events) == 1
+        assert events[0]["type"] == "session.ready"
+        assert events[0]["provider"] == "openai"
+        assert events[0]["client_secret"] == "secret_abc"
+
    @pytest.mark.asyncio
    async def test_receive_audio_invalid_session(self):
        """Test receive_audio with invalid session ID."""
@@ -0,0 +1,73 @@
+"""Unit tests for `aiui run` propagating --port/--host to gateway main()."""
+
+import os
+import textwrap
+from unittest.mock import MagicMock, patch
+
+from typer.testing import CliRunner
+
+from praisonaiui.cli import app
+
+runner = CliRunner()
+
+
+def _write_gateway_app(tmp_path):
+    app_file = tmp_path / "app.py"
+    app_file.write_text(
+        textwrap.dedent(
+            """
+            from praisonaiui.integration import AIUIGateway
+
+
+            async def main():
+                pass
+            """
+        ),
+        encoding="utf-8",
+    )
+    return app_file
+
+
+def _invoke(tmp_path):
+    app_file = _write_gateway_app(tmp_path)
+    captured = {}
+
+    def fake_run(coro):
+        coro.close()
+        captured["PORT"] = os.environ.get("PORT")
+        captured["HOST"] = os.environ.get("HOST")
+
+    with patch("socket.socket") as mock_socket:
+        mock_socket.return_value.__enter__.return_value.bind.return_value = None
+        with patch(
+            "praisonaiui.integration.AIUIGateway", return_value=MagicMock()
+        ), patch(
+            "praisonaiui.integration.check_praisonai_available", return_value=True
+        ), patch("asyncio.run", side_effect=fake_run):
+            result = runner.invoke(
+                app,
+                ["run", str(app_file), "--backend", "praisonai", "--port", "8101"],
+            )
+    return result, captured
+
+
+def test_run_sets_port_env_before_gateway_main(tmp_path, monkeypatch):
+    monkeypatch.delenv("PORT", raising=False)
+    monkeypatch.delenv("HOST", raising=False)
+
+    result, captured = _invoke(tmp_path)
+
+    assert result.exit_code == 0, result.stdout
+    assert captured["PORT"] == "8101"
+    assert captured["HOST"] == "127.0.0.1"
+
+
+def test_explicit_port_env_overrides_cli_flag(tmp_path, monkeypatch):
+    monkeypatch.setenv("PORT", "9000")
+    monkeypatch.delenv("HOST", raising=False)
+
+    result, captured = _invoke(tmp_path)
+
+    assert result.exit_code == 0, result.stdout
+    assert captured["PORT"] == "9000"
+    assert os.environ["PORT"] == "9000"
@@ -3,11 +3,19 @@
 from __future__ import annotations

 import asyncio
+import importlib.util

 import pytest
 from starlette.testclient import TestClient


+def _praisonai_jobs_available() -> bool:
+    try:
+        return importlib.util.find_spec("praisonai.jobs") is not None
+    except ModuleNotFoundError:
+        return False
+
+
@pytest.fixture
 def simple_jobs_client():
    import praisonaiui.server as server
@@ -30,8 +38,15 @@ def test_jobs_submit_and_get(simple_jobs_client):
    assert detail.json()["id"] == job_id


+def _praisonai_jobs_available() -> bool:
+    try:
+        return __import__("importlib").util.find_spec("praisonai.jobs") is not None
+    except ModuleNotFoundError:
+        return False
+
+
@pytest.mark.skipif(
-    __import__("importlib").util.find_spec("praisonai.jobs") is None,
+    not _praisonai_jobs_available(),
    reason="praisonai package not installed",
 )
 def test_sdk_job_store_roundtrip():
@@ -25,18 +25,38 @@ class TestDashboardSessionSearch:
        return DASHBOARD_JS.read_text()

    def test_ctrl_k_keydown_handler_present(self):
+        # The Ctrl+K binding is owned by the command palette, which exposes a
+        # "Search sessions…" entry that routes to openSessionSearch(). Assert the
+        # UX contract (Ctrl+K reaches session search) rather than where the
+        # keydown listener physically lives.
        src = self._src()
        assert "initSessionSearch" in src
+        # Ctrl+K / Cmd+K ownership lives in the command palette
+        # (initCommandPalette), which exposes a "Search sessions…" entry that
+        # calls openSessionSearch. initSessionSearch only owns Escape-to-close.
        m = re.search(
-            r"function initSessionSearch\(\)\s*\{(.*?)^}",
+            r"function initCommandPalette\(\)\s*\{(.*?)^}",
            src, re.DOTALL | re.MULTILINE,
        )
-        assert m, "initSessionSearch not found"
+        assert m, "initCommandPalette not found"
        body = m.group(1)
        assert "keydown" in body
        assert "ctrlKey" in body and "metaKey" in body
        assert "'k'" in body or '"k"' in body
        assert "preventDefault" in body
+        # The palette must route the "sessions" action to openSessionSearch().
+        assert "openSessionSearch()" in src
+        assert "action: 'sessions'" in src or 'action: "sessions"' in src
+
+        # initSessionSearch owns only Escape-to-close for the session palette.
+        m = re.search(
+            r"function initSessionSearch\(\)\s*\{(.*?)^}",
+            src, re.DOTALL | re.MULTILINE,
+        )
+        assert m, "initSessionSearch not found"
+        assert "Escape" in m.group(1), (
+            "initSessionSearch must own Escape-to-close for the session palette"
+        )

    def test_palette_fetches_sessions_endpoint(self):
        src = self._src()
@@ -207,7 +207,7 @@ wheels = [

 [[package]]
 name = "aiui"
-version = "0.3.127"
+version = "0.3.132"
 source = { editable = "." }
 dependencies = [
    { name = "pydantic" },
@@ -1745,7 +1745,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
+    { name = "typing-extensions" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -3352,11 +3352,11 @@ resolution-markers = [
    "python_full_version < '3.11' and sys_platform == 'win32'",
 ]
 dependencies = [
-    { name = "click", marker = "sys_platform == 'win32'" },
-    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11' and sys_platform == 'win32'" },
-    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11' and sys_platform == 'win32'" },
-    { name = "onnxruntime", marker = "sys_platform == 'win32'" },
-    { name = "python-dotenv", marker = "sys_platform == 'win32'" },
+    { name = "click" },
+    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "onnxruntime" },
+    { name = "python-dotenv" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/fe/b6/8fdd991142ad3e037179a494b153f463024e5a211ef3ad948b955c26b4de/magika-0.6.2.tar.gz", hash = "sha256:37eb6ae8020f6e68f231bc06052c0a0cbe8e6fa27492db345e8dc867dbceb067", size = 3036634, upload-time = "2025-05-02T14:54:18.88Z" }
 wheels = [
@@ -3376,11 +3376,11 @@ resolution-markers = [
    "python_full_version < '3.11' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "click", marker = "sys_platform != 'win32'" },
-    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11' and sys_platform != 'win32'" },
-    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11' and sys_platform != 'win32'" },
-    { name = "onnxruntime", marker = "sys_platform != 'win32'" },
-    { name = "python-dotenv", marker = "sys_platform != 'win32'" },
+    { name = "click" },
+    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "onnxruntime" },
+    { name = "python-dotenv" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/a3/f3/3d1dcdd7b9c41d589f5cff252d32ed91cdf86ba84391cfc81d9d8773571d/magika-0.6.3.tar.gz", hash = "sha256:7cc52aa7359af861957043e2bf7265ed4741067251c104532765cd668c0c0cb1", size = 3042784, upload-time = "2025-10-30T15:22:34.499Z" }
 wheels = [
@@ -6416,7 +6416,7 @@ resolution-markers = [
    "python_full_version < '3.11' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" },
+    { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" } },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/0f/37/6964b830433e654ec7485e45a00fc9a27cf868d622838f6b6d9c5ec0d532/scipy-1.15.3.tar.gz", hash = "sha256:eae3cf522bc7df64b42cad3925c876e1b0b6c35c1337c93e12c0f366f55b0eaf", size = 59419214, upload-time = "2025-05-08T16:13:05.955Z" }
 wheels = [
@@ -6482,7 +6482,7 @@ resolution-markers = [
    "python_full_version == '3.11.*' and sys_platform != 'win32'",
 ]
 dependencies = [
-    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" },
+    { name = "numpy", version = "2.4.3", source = { registry = "https://pypi.org/simple" } },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/7a/97/5a3609c4f8d58b039179648e62dd220f89864f56f7357f5d4f45c29eb2cc/scipy-1.17.1.tar.gz", hash = "sha256:95d8e012d8cb8816c226aef832200b1d45109ed4464303e997c5b13122b297c0", size = 30573822, upload-time = "2026-02-23T00:26:24.851Z" }
 wheels = [
@@ -6814,8 +6814,8 @@ name = "standard-aifc"
 version = "3.13.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "audioop-lts", marker = "python_full_version >= '3.13'" },
-    { name = "standard-chunk", marker = "python_full_version >= '3.13'" },
+    { name = "audioop-lts" },
+    { name = "standard-chunk" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/c4/53/6050dc3dde1671eb3db592c13b55a8005e5040131f7509cef0215212cb84/standard_aifc-3.13.0.tar.gz", hash = "sha256:64e249c7cb4b3daf2fdba4e95721f811bde8bdfc43ad9f936589b7bb2fae2e43", size = 15240, upload-time = "2024-10-30T16:01:31.772Z" }
 wheels = [
Author	SHA1	Message	Date
praisonai-triage-agent[bot]andMervin Praison	32d27c20c8	fix: escape server-provided plugin fields in marketplace view (XSS) Interpolated plugin name/description/id/category/version/permissions into innerHTML without escaping, unlike sibling views (mcp.js, channels.js, chat.js) which use an esc() helper. Add the same esc() helper and apply it for defense-in-depth and convention consistency. Co-authored-by: Mervin Praison <[email protected]>	2026-07-14 07:46:42 +00:00
MervinPraisonandClaude	74260cd68a	feat: add plugin marketplace dashboard page (fixes #199 ) Add a /marketplace dashboard view that browses, inspects permissions, installs, and uninstalls plugins via the existing features/marketplace.py backend. Registers the view in dashboard.js BUILTIN_VIEWS and adds the page entry (Agent group) with the /api/marketplace/plugins endpoint. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-14 07:26:24 +00:00
MervinPraison	2ebb56f609	Release v0.3.132	2026-07-14 02:00:30 +00:00
praisonai-triage-agent[bot]	6725a5bdf7	Merge pull request #194 from MervinPraison/claude/issue-191-20260713-0819 fix: honor aiui run --port for gateway examples that delegate to async main()	2026-07-13 10:12:12 +00:00
MervinPraison	f1f953be76	Release v0.3.131	2026-07-13 10:08:48 +00:00
praisonai-triage-agent[bot]	ee994b586d	Merge pull request #193 from MervinPraison/claude/issue-192-20260713-120000 fix: isolate OPENAI_API_KEY in realtime lifecycle test	2026-07-13 10:04:40 +00:00
praisonai-triage-agent[bot]andMervin Praison	44428e5caf	fix: propagate --port/--host to gateway main() delegation (fixes #191 ) Set PORT/HOST env before delegating to a user-defined async main() so gateway examples that read os.getenv("PORT") honor the CLI --port flag. Explicit env set by the user takes precedence over the CLI flag. Co-authored-by: Mervin Praison <[email protected]>	2026-07-13 08:25:16 +00:00
MervinPraisonandClaude	1748d6d023	fix: isolate OPENAI_API_KEY in realtime session lifecycle test (fixes #192 ) 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-13 08:21:25 +00:00
MervinPraison	a45c3af006	Release v0.3.130	2026-07-10 10:49:34 +00:00
praisonai-triage-agent[bot]	b54d94dd56	Merge pull request #190 from MervinPraison/claude/issue-189-20260710-0829 feat: restore Channels dashboard Add/Delete/Test CRUD UI	2026-07-10 10:46:59 +00:00
praisonai-triage-agent[bot]andMervin Praison	d9e8b12628	feat: restore Channels dashboard Add/Delete/Test CRUD UI (fixes #189 ) Restore the + Add Channel modal, per-platform credential fields, setup hints, and card actions (Enable/Disable, Restart, Test, Delete) that were removed in the `3961508` refactor. Aligned with #176 secret policy (env references, no plaintext prefill, inline 400 errors surfaced) and #172 dropdown contrast fix (.db-form-select). Adds POST /api/channels preset to the API Explorer and neutralizes the legacy read-only plugin so it no longer clobbers the managed view. Co-authored-by: Mervin Praison <[email protected]>	2026-07-10 08:34:43 +00:00
MervinPraison	2fb299a454	Release v0.3.129	2026-07-09 17:05:28 +00:00
praisonai-triage-agent[bot]	e288fca9ca	Merge pull request #184 from MervinPraison/claude/issue-174-20260708-0849 fix: dashboard generator emits main before shellHeader insertBefore (#174)	2026-07-09 16:53:45 +00:00
praisonai-triage-agent[bot]	f3dd9b218d	Merge pull request #182 from MervinPraison/claude/issue-177-20260708-120000 feat: surface user-visible errors for offline chat send	2026-07-09 16:51:10 +00:00
praisonai-triage-agent[bot]	949a1862da	Merge pull request #181 from MervinPraison/claude/issue-178-20260708-120000 fix: expose Ctrl+K command palette globally + guard init idempotency	2026-07-09 16:47:38 +00:00
praisonai-triage-agent[bot]andMervin Praison	7167546900	test: align shell-error assertions with showDashboardInitError after rebase The rebase onto main kept main's showDashboardInitError() helper, which supersedes this PR's showShellError() and renders the same .db-error banner with role=alert. Update the RC-2 assertions to match the surviving helper name; UX guarantee (visible shell error on missing #db-main-content) is unchanged. Co-authored-by: Mervin Praison <[email protected]>	2026-07-09 16:10:20 +00:00
MervinPraisonandClaude	e029f6e063	feat: surface user-visible errors for offline chat send (fixes #177 ) Add defensive shell error UI in dashboard.js selectPage, offline-aware HTTP fallback messaging with toast, role=alert on system error bubbles, and a try/catch guard around ws.send in chat.js sendMessage. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-09 17:06:25 +01:00
praisonai-triage-agent[bot]	32e8552840	Merge pull request #173 from MervinPraison/claude/issue-172-20260630-120000 fix: dark-theme dropdown contrast and sidebar header overlap	2026-07-09 16:04:43 +00:00
Mervin Praison	e31df90d0e	Merge pull request #179 from MervinPraison/claude/issue-175-20260708-000000 fix: surface selectPage error when dashboard shell incomplete	2026-07-09 17:04:40 +01:00
praisonai-triage-agent[bot]	58c66b65e5	Merge pull request #180 from MervinPraison/claude/issue-176-20260708-120000 fix: redact channel secrets in all API responses	2026-07-09 16:04:10 +00:00
praisonai-triage-agent[bot]andMervin Praison	f0c298802b	fix: emit main before shellHeader insertBefore in dashboard generator (fixes #174 ) The dashboard.js generator emitted root.insertBefore(shellHeader, main) before root.appendChild(main), so regenerating the bundle re-introduced the #166/#174 insertBefore NotFoundError. Reorder the generator to append main first, and lock it with a source-parsing regression test. Co-authored-by: Mervin Praison <[email protected]>	2026-07-09 17:00:21 +01:00
praisonai-triage-agent[bot]andMervin Praison	45a5f0cd2d	test: align session-search Ctrl+K test with command-palette ownership The Ctrl+K/Cmd+K binding moved to initCommandPalette; initSessionSearch now only owns Escape-to-close. Update test_ctrl_k_keydown_handler_present to assert the current architecture instead of the outdated contract. Co-authored-by: Mervin Praison <[email protected]>	2026-07-09 17:00:18 +01:00
MervinPraisonandClaude	1b0e1646c9	fix: expose command palette globally and guard init idempotency (fixes #178 ) BQA-002 (insertBefore) and the base command palette are already present in the shipped dashboard bundle. This closes the remaining acceptance gaps: openCommandPalette is now reachable in the global scope (typeof openCommandPalette === 'function') and initCommandPalette no longer double-registers its keydown handler on HMR / full reload. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-09 17:00:18 +01:00
praisonai-triage-agent[bot]andpraisonai-triage-agent[bot]	2fe1a83c9a	fix(ci): guard find_spec so missing praisonai parent pkg skips instead of erroring find_spec("praisonai.jobs") raises ModuleNotFoundError (not returns None) when the parent 'praisonai' package is absent, aborting collection of the entire tests/unit suite in CI. Wrap in a helper that treats the missing parent as unavailable so the SDK test skips cleanly. Co-authored-by: praisonai-triage-agent[bot] <praisonai-triage-agent[bot]@users.noreply.github.com>	2026-07-09 17:00:15 +01:00
praisonai-triage-agent[bot]andMervin Praison	971033b905	fix(channels): align write-path secret validation with read-path redaction _validate_config_security used the narrow exact-match SECRET_FIELD_PATTERNS while _redact_config_secrets was hardened to also catch _token/_key/_secret/ _password suffix keys. This closed the read leak but still let inline app_token/signing_secret/client_secret values be stored on write. Route both paths through the shared _is_secret_key helper so suffix secrets are rejected at write time too, and add regression tests. Co-authored-by: Mervin Praison <[email protected]>	2026-07-09 17:00:15 +01:00
MervinPraisonandClaude	0626d0bb96	fix: redact channel secrets in all API responses (fixes #176 ) GET /api/channels and related handlers serialized the in-memory _channels dict verbatim, exposing config.bot_token and other secrets. Harden _redact_config_secrets to cover _token/_key/_secret/_password suffix keys (app_token, signing_secret, client_secret) and emit a <key>_set flag, and redact the previously-unredacted _toggle response. Write path still accepts and uses real tokens for bot startup. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-09 17:00:15 +01:00
MervinPraisonandClaude	581df433ed	fix: surface selectPage error when dashboard shell incomplete (fixes #175 ) Replace the silent `if (!main \|\| !page) return;` early return in selectPage() with explicit guards that log a console error and, when #db-main-content is absent, render a visible db-error banner via the new showDashboardInitError helper. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-09 17:00:13 +01:00
MervinPraisonandClaude	bead6e4542	fix: dark-theme dropdown contrast and sidebar header overlap (fixes #172 ) Native <select> option popups inherited the dashboard light foreground while the browser painted a white system surface, producing unreadable white-on-white platform labels. Add explicit dark-surface/light-text styling for .db-form-select option and any dashboard select option, plus an accent highlight for the checked option. Harden the sidebar header so a long brand title truncates with an ellipsis and reserves space for the toggle, preventing text overlap. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2026-07-09 17:00:11 +01:00
MervinPraison	d0c8e060ff	Release v0.3.128	2026-07-09 15:24:52 +00:00
Mervin Praison	cdd6b21d3b	Merge pull request #188 from MervinPraison/fix/merge-gate-stash-config fix(merge-gate): stash gate-config.js with merge-gate.js	2026-07-09 16:21:34 +01:00
praisonai-triage-agent[bot]andMervin Praison	b5f35214ef	fix(ci): sync version and update stale registry/session-search tests Pre-existing failures on main unrelated to the merge-gate workflow diff: - sync __version__.py to 0.3.127 to match pyproject.toml - i18n graduated to IMPLEMENTED (0.5.0); update feature-registry tests - Ctrl+K binding is owned by initCommandPalette; assert the UX contract (Ctrl+K routes to session search) instead of the old implementation detail 🤖 Generated with [Claude Code](https://claude.ai/code) Co-authored-by: Mervin Praison <[email protected]>	2026-07-09 15:03:46 +00:00
MervinPraison	2f73a94808	fix(merge-gate): stash gate-config.js with merge-gate.js	2026-07-09 15:57:21 +01:00
Mervin Praison	611c06f31b	Merge pull request #187 from MervinPraison/fix/ci-sdk-job-store-import fix(ci): skip SDK job store test when praisonai missing	2026-07-09 14:37:21 +01:00
MervinPraison	7f41bcbd9c	fix(ci): skip SDK job store test when praisonai missing find_spec(\"praisonai.jobs\") raises ModuleNotFoundError when the parent package is absent, aborting pytest collection. Catch that and skip. Also add claude-code-action and restore it after PR checkout for merge gate.	2026-07-09 14:30:26 +01:00
Mervin Praison	f47b9f3824	Merge pull request #186 from MervinPraison/fix/ruff-channels-whitespace fix(ci): clear ruff whitespace blocking main CI	2026-07-09 10:03:50 +01:00