UX improvements: message viewer, analytics, and sync performance

[wesm]

Summary

• Overhaul session message viewer for readability: system font stack, role icon circles, proportional body text at 14px, darker code blocks, refined tool/thinking blocks
• Sync header project filter to analytics dashboard so selecting a project in the top bar filters the dashboard
• Highlight selected activity timeline bar instead of re-rendering the chart with a single bar
• Fix excessive CPU usage by making the file watcher sync only changed files instead of running full SyncAll with SHA-256 hashing of every file
• Fix duplicate fetchAll on analytics page mount and activity timeline staleness

Test plan

• All 304 frontend vitest tests pass (including new analytics tests)
• All Go tests pass across all packages (including 5 new SyncPaths tests)
• Manual: verify message viewer readability in light/dark themes
• Manual: verify selecting a project in header updates the analytics dashboard
• Manual: verify clicking a timeline bar highlights it and dims others
• Manual: verify CPU usage is reduced during active file watching

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (7511cb1)

Verdict: Changes introduce 1 high-severity regression and 2 medium-severity backend correctness issues that should be fixed before merge.

High

• frontend/src/lib/components/analytics/AnalyticsPage.svelte:54, frontend/src/lib/components/analytics/AnalyticsPage.svelte:60 (also reported around lines 56–65)
  The $effect calls analytics.fetchAll() in a way that can track analytics.project and react to local drill-down changes, causing project selection to be reset to header filters and triggering duplicate/unintended fetches.
  Recommended fix: isolate effect tracking to header filter state (e.g., untrack around fetch/sync logic, or split initial fetch from header-sync branch).

Medium

• internal/sync/engine.go:89
SyncPaths updates lastSync but not lastSyncStats, so /sync/status can return stale stats after watcher-triggered syncs.
  Recommended fix: update e.lastSyncStats = stats under the same lock where lastSync is set.

• internal/sync/engine.go:125, internal/sync/engine.go:135
  Path classification relies on raw strings.HasPrefix(...) and string slicing. With non-normalized configured roots (e.g., trailing slash/non-clean paths), valid watcher updates can be missed.
  Recommended fix: normalize paths (filepath.Clean) and use filepath.Rel-style containment checks instead of prefix/slice math.

---

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (17e63a8)

Verdict: Changes are not clean yet; 4 medium+ issues remain (1 high, 3 medium).

High

1. Reactive fetch loop / duplicate fetch risk
   • Files: frontend/src/lib/components/analytics/AnalyticsPage.svelte:49, frontend/src/lib/components/analytics/AnalyticsPage.svelte:54-62
   • Issue: analytics.fetchAll() is invoked inside a tracked $effect, so reactive reads inside fetchAll can become dependencies. This can trigger duplicate fetches on unrelated analytics state changes and may reset local drill-down selection.
   • Suggested fix: Call fetch in untrack (or split effects so only sessions.filters.project is tracked).

Medium

1. Symlink escape in path containment checks

   • Files: internal/sync/engine.go:108, internal/sync/engine.go:126, cmd/agentsview/main.go:209
   • Issue: SyncPaths trusts watcher paths and uses lexical containment checks (Clean/Rel) without resolving symlinks. A symlink inside a watched tree can point outside and still pass classification, enabling unintended file ingestion and TOCTOU exposure.
   • Suggested fix: Canonicalize with filepath.EvalSymlinks (base + candidate), reject symlinked targets (Lstat), and/or enforce no-follow open + FD-level containment verification.

2. SyncPaths classification too permissive for Claude paths

   • File: internal/sync/engine.go (in classifyOnePath, Claude branch)
   • Issue: Current split logic accepts nested paths like <project>/subdir/file.jsonl, despite expected shape <project>/<session>.jsonl, which can ingest unrelated .jsonl files and diverge from SyncAll behavior.
   • Suggested fix: Require exactly two path segments for Claude session files.

3. No fallback sync when changed-path batch yields zero classified files

   • File: cmd/agentsview/main.go:207
   • Issue: Watcher callback moved from SyncAll(nil) to SyncPaths(paths) without fallback; temp/rename/dir-only event batches can classify nothing, leaving UI stale until periodic sync.
   • Suggested fix: If paths is non-empty and SyncPaths classifies zero files, trigger fallback full sync (or improve event normalization for atomic-save flows).

---

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (01aad04)

Verdict: Mostly clean, but 2 medium-severity regressions should be addressed before merge.

Medium

1. Directory CREATE watcher events may miss immediate indexing (regression)

   • Files: cmd/agentsview/main.go:207, internal/sync/engine.go:75, internal/sync/engine.go:108
   • Finding: Watcher batches now call SyncPaths(paths), but directory create paths are not classified as session files, so files inside newly added/moved directories may not be indexed until periodic/manual full sync.
   • Suggested fix: If a changed path is a directory (or classification returns none for a create batch), fall back to SyncAll(nil), or make SyncPaths recursively discover session files under changed directories.

2. Activity timeline can render all bars dimmed after granularity change

   • Files: frontend/src/lib/components/analytics/ActivityTimeline.svelte:249, frontend/src/lib/components/analytics/ActivityTimeline.svelte:250, frontend/src/lib/stores/analytics.svelte.ts:376
   • Finding: Dimming is keyed on selectedDate !== null; after switching from day to week/month, selectedDate can remain set without matching any bucket date, causing all bars to appear dimmed.
   • Suggested fix: Only apply selected/dimmed styling in day granularity, or clear selectedDate when leaving day.

---

Synthesized from 4 reviews (agents: codex, gemini | types: default, security)