feat: release evidence-backed review workflow (v1.18.0)

.gitignore

@@ -5,3 +5,6 @@ node_modules/
 
 frontend/node_modules/
 frontend/dist/
+
+output/
+.playwright-cli/

README.md

@@ -88,6 +88,9 @@ Rule of thumb: if you build and operate your own agent in production, use a trac
 - **Prompt library** — Curate the prompts worth keeping into `~/.agentxray/library`, tag / edit / search them, then install any of them as a native slash command for Claude Code, Codex or OMP with one click — `$ARGUMENTS` is passed through, so `/name some args` works in the target CLI
 - **Global search** — One search box across all seven platforms at once, multi-keyword AND matching, colored platform badges per hit — including prompts recovered from sessions that Claude Code's cleanup already deleted
 - **Session insights** — Aggregate analytics dashboard with tool stats, error clustering and daily trends
+- **Evidence-backed failure events (React UI)** — Groups unresolved failures by the same tool, complete arguments and call's user turn, with repeated operations first, first/last evidence jumps and every original result retained. Successful results split groups; missing arguments stay separate. Execution success requires an explicit zero exit code or OMP-native completion evidence. These are review groups, not root-cause diagnoses or proof of task failure. Local rules, no LLM. [Try the synthetic walkthrough and read the boundaries](docs/diagnostics.md).
+- **Local review queue** — Record follow-up, expected-failure or alternative-verification notes in your browser. Evidence changes invalidate the old review; manual labels never rewrite automatic outcomes. No account or review backend. [Review workflow and storage limits](docs/diagnostics.md#local-review-workflow).
+- **Narrow-screen session workflow** — Below 768px, switch between the session list and full-width content without losing the current review draft; platform tabs scroll horizontally, and evidence jumps keep navigation visible. Desktop retains the two-column layout. [Scope and tested viewports](docs/diagnostics.md#narrow-screen-session-workflow).
 - **Spawn tracking** — Detect and navigate parent/child agent relationships
 - **OMP sub-agents** — Sub-agents spawned by an OMP session show up as chips in the summary; click one to read the child agent's full transcript
 - **Message timeline** — Visual graph showing conversation flow with role indicators

README.zh-CN.md

@@ -54,6 +54,10 @@ LangSmith、Langfuse 这类观测平台面向的是*你自己写的* agent：接
 
 ## 功能特性
 
+- **有证据的失败事件（React UI）** — 将同一调用所在用户轮次、同工具、完整同参数的待复查失败分组，重复最多的操作优先展示；可跳转首末及每条原始证据。同参成功切断分组，缺少参数不合并。执行成功采用明确零退出码或 OMP 原生完成证据；事件不等于根因或任务失败。本地规则，无 LLM。[合成演示与判定边界](docs/diagnostics.md#中文使用指南)。
+- **本机复核队列** — 用必填依据标记“需跟进”“预期失败”“其他验证已通过”，仅存当前浏览器；新证据使旧标记失效，人工判断不改写自动结果。无需账号或复核后端。[使用方式与存储边界](docs/diagnostics.md#本机复核闭环)。
+- **窄屏会话复核** — 小于 768px 时切换“会话列表 / 返回内容”，正文获得完整宽度，切换列表不清空当前复核草稿；平台栏横向滚动，证据跳转保留顶部导航，桌面继续双栏。[验收范围](docs/diagnostics.md#窄屏操作)。
+
 - **多平台支持** — 一个界面统一查看 OpenClaw、Codex、Claude Code、Hermes、OMP、DeepSeek Harness、Gemini CLI 的会话日志（dsh 的多帧 zstd 压缩日志透明解压；Gemini CLI 的 `/rewind` 回滚记录会先折叠，回滚掉的历史不会重复渲染）
 - **会话浏览** — 浏览 Agent 列表，搜索/过滤会话，查看消息历史
 - **工具调用检查** — 可展开的工具调用详情，包含参数和返回结果

claims.json

@@ -1,8 +1,8 @@
 {
-  "$comment": "Receipts for every number AgentXRay publishes in prose: the README first screen, the hero figure caption, the FAQ, the roadmap and the CI description. Each claim carries the command that recomputes it from committed artifacts (scripts/claims-receipts.mjs derives the figures from the platform registry, lib/config.js, package.json, the workflow, the demo sample log and the test fixtures) or check.manual with the reason no command can. No claim asserts a package version: package.json is 1.17.2 while npm still serves 1.17.1 and this machine has no npm token, so a version-consistency claim would be permanently red; instead readme-no-version pins the deliberate absence of a version in the README. .github/workflows/claims.yml runs the lot weekly and on every push.",
+  "$comment": "Receipts for every number AgentXRay publishes in prose: the README first screen, the hero figure caption, the FAQ, the roadmap and the CI description. Each claim carries the command that recomputes it from committed artifacts (scripts/claims-receipts.mjs derives the figures from the platform registry, lib/config.js, package.json, the workflow, the demo sample log and the test fixtures) or check.manual with the reason no command can. The readme-no-version receipt keeps version-specific installation details in release notes rather than the README. .github/workflows/claims.yml runs the lot weekly and on every push.",
   "project": "AgentXRay",
   "repository": "https://github.com/alloevil/AgentXRay",
-  "updated": "2026-09-13",
+  "updated": "2026-09-23",
   "claims": [
     {
       "id": "platform-registry",
@@ -102,16 +102,16 @@
     },
     {
       "id": "test-count",
-      "claim": "130 tests pass on Node's built-in test runner, the count docs/ROADMAP.md records for `npm test`.",
-      "value": "130",
-      "metric": "passing node:test cases (# tests 130 / # pass 130 / # fail 0)",
-      "method": "npm test → node --test test/*.test.js, run in the claims job after npm ci, and the TAP summary is asserted. The roadmap sentence ('130 tests on Node's built-in runner (`npm test`, 2026-09-12)') is verified by the run, not read back from the prose.",
+      "claim": "214 tests pass on Node's built-in test runner, the count docs/ROADMAP.md records for `npm test`.",
+      "value": "214",
+      "metric": "passing node:test cases (# tests 214 / # pass 214 / # fail 0)",
+      "method": "npm test → node --test test/*.test.js, run in the claims job after npm ci, and the TAP summary is asserted. The roadmap sentence ('214 tests on Node's built-in runner (`npm test`, 2026-09-23)') is verified by the run, not read back from the prose.",
       "repro": "npm test 2>&1 | grep -E '^# (tests|pass|fail)'",
       "evidence": "docs/ROADMAP.md",
       "as_of": "2026-09-13",
       "check": {
         "cmd": "npm test 2>&1 | grep -E '^# (tests|pass|fail)'",
-        "expect": { "contains": ["# tests 130", "# pass 130", "# fail 0"] },
+        "expect": { "contains": ["# tests 214", "# pass 214", "# fail 0"] },
         "timeout": 120
       }
     },
@@ -238,7 +238,7 @@
       "check": {
         "cmd": "node scripts/claims-receipts.mjs tests-node-only",
         "expect": {
-          "equals": "12 files in test/ · 11 distinct requires: 9 node builtins, 2 relative, 0 third-party"
+          "equals": "16 files in test/ · 14 distinct requires: 11 node builtins, 3 relative, 0 third-party"
         },
         "timeout": 60
       }
@@ -248,7 +248,7 @@
       "claim": "The README publishes no version number of its own — the npm release badge is the only version shown — so no committed prose can go stale against the registry.",
       "value": "0 version strings",
       "metric": "semver-looking strings in README.md, excluding the 127.0.0.1 in the host example",
-      "method": "README.md is scanned for standalone x.y.z tokens (not part of an IP address). package.json's own version is deliberately not claimed anywhere: it is 1.17.2 while npm still serves 1.17.1, and there is no npm token on this machine to reconcile the two, so a version-consistency claim would be permanently red.",
+      "method": "README.md is scanned for standalone x.y.z tokens (not part of an IP address). Version-specific installation instructions belong to release notes; this receipt does not assert registry availability.",
       "repro": "node scripts/claims-receipts.mjs readme-no-version",
       "evidence": "README.md",
       "as_of": "2026-09-13",
@@ -263,8 +263,8 @@
       "claim": "master requires the `test` check to pass before a pull request can merge, so the workflow above is a gate and not just a notification.",
       "value": "required check: test",
       "metric": "the required status checks on the master branch",
-      "method": "Branch protection is GitHub repository state, not a committed file: no command in this repository can read it, and this machine has no token that could query the protection API (the same absence that makes the published-version comparison manual). The committed half — that test.yml defines exactly one job, named test — is machine-checked by ci-test-workflow.",
-      "repro": "gh api repos/alloevil/AgentXRay/branches/master/protection --jq '.required_status_checks.contexts'",
+      "method": "Branch protection and rulesets are GitHub repository state, not committed files; inspect them with an authenticated GitHub API request. The committed half — that test.yml defines exactly one job, named test — is machine-checked by ci-test-workflow.",
+      "repro": "gh api repos/alloevil/AgentXRay/rulesets (then inspect the active default-branch ruleset by ID)",
       "evidence": ".github/workflows/test.yml",
       "as_of": "2026-09-13",
       "check": {

docs/ROADMAP.md

@@ -2,13 +2,14 @@
 
 > Moved from issue #4 on 2026-09-04. Issues are for bug reports and feature requests; the roadmap lives here. To pick up an item, open an issue referencing it.
 
-## Where we are (v1.12)
+## Where we are
 
-- **5 platforms** — OpenClaw, Codex, Claude Code, Hermes (SQLite) and OMP, parsed from their native log formats
+- **7 platforms** — OpenClaw, Codex, Claude Code, Hermes (SQLite), OMP, DeepSeek Harness and Gemini CLI, parsed from their native log formats
 - **Session browser** with tool-call inspection, trace/waterfall view, spawn tracking and message timeline
 - **Prompt tooling** — extraction (noise filtered), template clustering with outcome attribution, Claude-powered rewrites, and a prompt library that installs entries as native slash commands
 - **Global search** across all platforms, insights dashboard, incremental session backup
-- **React + Vite frontend** served by an Express backend; 130 tests on Node's built-in runner (`npm test`, 2026-09-12), CI on Node 22
+- **React + Vite frontend** served by an Express backend; 214 tests on Node's built-in runner (`npm test`, 2026-09-23), CI on Node 22
+- **Evidence-backed failure events and local review** with full-result invalidation, evidence navigation and narrow-screen session layout
 
 ## Roadmap
 

docs/diagnostics-verification.md

@@ -0,0 +1,59 @@
+# Diagnostics verification receipt
+
+This receipt accompanies the evidence-backed diagnostics, local review queue and narrow-screen session workflow. All public screenshots and demo fixtures are synthetic. Personal session logs, sample manifests, review notes and detailed local evaluation artifacts are not distributed.
+
+## Reproduce from a checkout
+
+With Node 22.13+ and the project dependencies installed:
+
+```sh
+npm test
+npm run build:ui
+npm run lint
+git diff --exit-code -- public/js/pure.js
+node scripts/demo-diagnostics.cjs
+```
+
+Open the printed URL and select the OMP session marked `[Synthetic]`:
+
+- Initially 72 unresolved failure records form 7 events, with 66 repeated edit failures in the first event. One earlier failure already has a matching success.
+- First/last/all-evidence actions retain every original result, including results outside message pagination.
+- Save a human review note. Refresh retains the note; another session cannot inherit it. Human status never changes automatic failure counts.
+- Enter `n` in the terminal to append a synthetic failure. The repeated event now contains 67 failures and its previous review becomes stale.
+- Enter `r` to append matching success. Six events and six unresolved records remain, with 68 automatically recovered failures (67 if `n` was not used).
+- Enter `q` or Ctrl-C to stop the isolated server and clean up its temporary HOME.
+
+## Recorded checks (2026-09-23)
+
+| Check | Result |
+| --- | --- |
+| Node test suite | 214 passed, 0 failed, 0 skipped |
+| Diagnostics/events/OMP/review focused suites | 84 passed |
+| UI build | TypeScript and Vite passed |
+| Lint | Exit 0; existing 91 warnings / 159 informational findings |
+| Legacy generated bundle | No drift |
+| Review persistence | Save, refresh, session isolation and cross-tab updates passed |
+| Review invalidation | New failure/full-result changes reopen review; stale notes remain distinguishable |
+| Storage failure | Read denial, corrupt records and write failure visibly reported; failed save never claims success |
+| Evidence navigation | First/middle/last results retained; pagination expands and target is shown |
+| Narrow screens | 360×640, 390×844, 740×360, 768×1024 and 1440×1000 checked |
+| Touch simulation | Chromium mobile/touch taps navigate and save review |
+| Virtual session list | 240 synthetic sessions; initially 16 rendered cards, final item reachable |
+
+At 360px viewport width, the real session diagnostic panel measures 340px (the old fixed-sidebar layout left 44px). At 740×360, 75px remains for transcript scrolling; portrait orientation is more comfortable. On mobile and desktop, evidence jumps retain `window.scrollY=0` when starting at the top.
+
+The preceding private, already-inspected regression set had 30 sessions and 9,076 tool results. Its 438 unresolved records grouped into 373 events while retaining all evidence; 373 in-memory synthetic review labels were checked for isolation and invalidation, then discarded. These aggregate counts are contextual observations, **not a public benchmark, independent human judgment, accuracy measure or proof of time saved**. The private dataset is deliberately not included; the commands above reproduce the public synthetic acceptance tests.
+
+## Screenshots
+
+![Synthetic event grouping](../screenshots/diagnostic-events.png)
+![Synthetic human review](../screenshots/diagnostic-reviews.png)
+![Synthetic narrow-screen review](../screenshots/diagnostic-mobile.png)
+
+## Limits
+
+- Human notes are unencrypted, browser-local and origin-specific; they are not authenticated evidence or a backup.
+- Alternate commands, implicit working directories, background-task chains and semantic equivalence are not inferred.
+- Existing aggregate statistics retain their original error-field semantics and may differ from diagnostic counts.
+- No physical iOS/Android device, Safari or software-keyboard certification is claimed. Other complex pages are not fully covered by the narrow-screen checks.
+- Existing lint findings and the Vite large-chunk warning remain; no claim of zero technical debt is made.