{/* Connection arrow up to a fake menubar — design hint */}

{/* Quick chat panel */}

{/* Header */}

Quick chat

⌘⇧G to toggle

{/* Content */}

{variant === 'idle' ? (

Ask anything without opening the main window.

⌘N main window · ⌘Q quit

) : (

What's on the calendar today?

3 things: 10:00 standup · 14:30 with Marcus · 17:00 design review.

)}

{/* Composer */}

Ask… ↵

); } // ── Thread context menu (right-click on a thread) ── function AuxThreadContextMenu({ dark }) { const t = dark ? G.d : G.l; const items = [ { icon: 'edit', label: 'Rename' }, { icon: 'pin', label: 'Pin to top' }, { icon: 'archive', label: 'Archive' }, { icon: 'copy', label: 'Duplicate' }, { icon: 'share', label: 'Export…' }, null, { icon: 'trash', label: 'Delete', danger: true }, ]; return (

{items.map((it, i) => it === null ? (

) : (

{it.label} {it.label.includes('→') && }

))}

); } // ── Tool selector (composer, MCP-grouped) ── function AuxToolSelector({ dark, variant = 'open' }) { const t = dark ? G.d : G.l; const groups = [ { name: 'Built-in', tools: [ { name: 'web_search', enabled: true }, { name: 'computer_use', enabled: true }, { name: 'browser', enabled: false }, ]}, { name: 'MCP · github', tools: [ { name: 'list_repos', enabled: true }, { name: 'create_issue', enabled: true }, { name: 'merge_pr', enabled: false }, ]}, { name: 'MCP · linear', tools: [ { name: 'list_issues', enabled: true }, { name: 'add_comment', enabled: true }, ]}, ]; return ( Audit auth.ts

Tools available {groups.flatMap(g => g.tools).filter(t => t.enabled).length} on

{groups.map((g, i) => (

{g.name}

{g.tools.map((tool, j) => (

{tool.name}

))}

); } // ── Prompts picker (composer / picks a prompt app to run) ── function AuxPromptsPicker({ dark }) { const t = dark ? G.d : G.l; const apps = [ { name: 'Translate to natural English', icon: 'docs', kbd: '⌘⇧T', desc: 'Casual / formal / academic tone' }, { name: 'Summarize this thread', icon: 'sparkle', kbd: '⌘⇧S', desc: '5-bullet recap with action items' }, { name: 'Audit security', icon: 'lock', kbd: '⌘⇧A', desc: 'OWASP-style review of selection' }, { name: 'Explain like I\'m 5', icon: 'chat', kbd: '', desc: 'Simplify any technical input' }, { name: 'Make tests', icon: 'check', kbd: '', desc: 'Generate unit + integration tests' }, ]; return ( /

prompt apps ↑↓ ↵

{apps.map((a, i) => (

{a.name}

{a.desc}

{a.kbd && {a.kbd}}

))}

Create new prompt app

); } // ── TodoListIndicator (live progress bar at top of chat) ── function AuxTodoIndicator({ dark, variant = 'progress' }) { const t = dark ? G.d : G.l; const totals = variant === 'progress' ? { done: 2, total: 5, active: 'Add regression test' } : variant === 'all-done' ? { done: 5, total: 5, active: null } : { done: 0, total: 4, active: null }; return ( {/* Sticky-feeling indicator at the top */}

{totals.done}/{totals.total}

{totals.active ? `Working on: ${totals.active}` : (totals.done === totals.total ? 'All todos complete' : 'Plan ready · waiting to start')}

{totals.done} of {totals.total} done · click to expand

{totals.active && ( )} {totals.done === totals.total && }

); } // ── Suggestions (next-step chips after assistant reply) ── function AuxSuggestions({ dark }) { const t = dark ? G.d : G.l; const suggestions = [ { icon: 'edit', text: 'Apply the diff and re-run tests' }, { icon: 'docs', text: 'Show me the final auth.ts file' }, { icon: 'plus', text: 'Add a similar fix to session.ts' }, ]; return ( What's the safest fix? Remove the bypass and require the JWT path always. The header was a debug shortcut — production can't trust it.

{suggestions.map((s, i) => (

{s.text}

))}

); } // ── Quote display (replying to specific message or file region) ── function AuxQuoteDisplay({ dark, variant = 'message' }) { const t = dark ? G.d : G.l; return ( {variant === 'message' && ( <> The bypass on lines 5–7 is the highest-priority finding. Two more medium issues, but they don't block. {/* Quote of the previous message in user composer */}

Replying to

"The bypass on lines 5–7 is the highest-priority finding."

Why "highest"? What's the medium-severity stuff?

)} {variant === 'file' && ( <> What does this code do? {/* Quote of a file region */}

auth.ts · lines 5–7 quoted by user

{`5: if (req.headers['x-internal-trust'] === 'true') {
6:   return next();
7: }`}

That's the unsafe bypass — any client can set x-internal-trust: true and skip JWT verification entirely. )} {variant === 'code' && ( <> What about this snippet from a different repo? {/* Quoted code block (pasted with attribution) */}

pasted snippet · 14 lines typescript

{`function isInternal(req) {
  const trusted = process.env.TRUSTED_PROXIES.split(',');
  const ip = req.socket.remoteAddress;
  return trusted.includes(ip);
}`}

That's safer — checks the actual remote address against a configured list. But still consider source-spoofing under proxy. )} ); } Object.assign(window, { AuxQuickChat, AuxThreadContextMenu, AuxToolSelector, AuxPromptsPicker, AuxTodoIndicator, AuxSuggestions, AuxQuoteDisplay, });