Fix PR review issues and validation coverage

Author: steveseguin

actions/EventFlowSystem.js

@@ -1647,6 +1647,12 @@ class EventFlowSystem {
 		return !hasChatFields;
 	}
 
+	isCounterEventPayload(message) {
+		if (!this.isMetaOnlyPayload(message)) return false;
+		const eventType = String(message.event || '').trim().toLowerCase();
+		return ['viewer_update', 'likes_update', 'follower_update', 'subscriber_update'].includes(eventType);
+	}
+
 	isObsEventPayload(message) {
 		return !!(message && typeof message === 'object' && (message.type || '').toLowerCase() === 'obs' && message.event);
 	}
@@ -1696,8 +1702,9 @@ class EventFlowSystem {
         // Automatic User Memory resets happen before flows evaluate the stream event.
         await this.resetUserMemoriesForEvent(message);
 
-		// Ignore meta-only payloads (e.g., viewer/follower count updates) so they never trigger flows
-		if (this.isMetaOnlyPayload(message)) {
+		// Counter payloads may continue only to explicit matching event triggers.
+		// Other meta-only traffic remains excluded from Event Flow.
+		if (this.isMetaOnlyPayload(message) && !this.isCounterEventPayload(message)) {
 			return message;
 		}
 
@@ -2068,8 +2075,9 @@ class EventFlowSystem {
         // console.log(`[EvaluateTrigger] Node: ${triggerNode.id}, Type: ${triggerType}, Config: ${JSON.stringify(config)}, Message: ${message.chatmessage}`);
         let match = false;
 
-		// Skip meta-only payloads so metric updates can't trigger flows
-		if (this.isMetaOnlyPayload(message)){
+		// Known counters may match only an explicit Event Type trigger. This keeps
+		// them out of Any Message and other generic chat-oriented triggers.
+		if (this.isMetaOnlyPayload(message) && (triggerType !== 'eventOther' || !this.isCounterEventPayload(message))){
 			return false;
 		}
 

ai.js

@@ -1073,7 +1073,7 @@ let tmpModelFallback = "";
 let localBrowserLLMClient = null;
 let localBrowserActiveRequestState = null;
 let localBrowserLLMQueue = Promise.resolve();
-const LOCAL_BROWSER_WORKER_VERSION = '17';
+const LOCAL_BROWSER_WORKER_VERSION = '18';
 
 function getLocalBrowserWorkerPath() {
     if (typeof chrome !== 'undefined' && chrome.runtime?.getURL) {

cohost.html

@@ -1772,7 +1772,7 @@
 			const GEMINI_AUDIO_TOKENS_PER_SECOND = 25;
 			const GEMINI_VIDEO_TOKENS_PER_SECOND = 258;
 			const LOCAL_BROWSER_DEFAULT_REMOTE_HOST = "https://largefiles.socialstream.ninja/";
-			const LOCAL_BROWSER_WORKER_PATH = "local-browser-model-worker.js?v=17";
+			const LOCAL_BROWSER_WORKER_PATH = "local-browser-model-worker.js?v=18";
 			const CUSTOM_OPENAI_DEFAULT_ENDPOINT = "http://127.0.0.1:1234/v1";
 			const CUSTOM_OPENAI_DEFAULT_MODEL = "";
 			const CONFIGURED_LLM_BRIDGE_CHUNK_SIZE = 12000;
@@ -1859,6 +1859,9 @@
 				const providerKey = String(providerConfig?.key || "")
 					.trim()
 					.toLowerCase();
+				if (providerKey === "localgemma") {
+					return ["config.json", "generation_config.json", "tokenizer.json", "tokenizer_config.json", "preprocessor_config.json", "onnx/embed_tokens_q4.onnx", "onnx/embed_tokens_q4.onnx_data", "onnx/decoder_model_merged_q4.onnx", "onnx/decoder_model_merged_q4.onnx_data", "onnx/vision_encoder_q4.onnx", "onnx/vision_encoder_q4.onnx_data", "onnx/audio_encoder_q4.onnx", "onnx/audio_encoder_q4.onnx_data"];
+				}
 				if (providerKey.startsWith("localqwen")) {
 					return ["config.json", "generation_config.json", "tokenizer.json", "tokenizer_config.json", "preprocessor_config.json", "onnx/embed_tokens_q4.onnx", "onnx/embed_tokens_q4.onnx_data", "onnx/decoder_model_merged_q4.onnx", "onnx/decoder_model_merged_q4.onnx_data", "onnx/vision_encoder_q4.onnx", "onnx/vision_encoder_q4.onnx_data"];
 				}
@@ -1986,24 +1989,27 @@
 				if (providerKey === "localgemma") {
 					return {
 						key: "localgemma",
-						label: "Local Gemma 4 E2B (Browser, text-only)",
-						providerLabel: "Local Gemma 4 (Browser, text-only)",
+						label: "Local Gemma 4 E2B (Browser, self-hosted)",
+						providerLabel: "Local Gemma 4 (Browser, self-hosted)",
 						modelId: "gemma4-e2b-it-onnx",
 						localPath: "thirdparty/models/gemma4-e2b-it-onnx",
 						remoteHost: LOCAL_BROWSER_DEFAULT_REMOTE_HOST,
 						runtime: {
-							modelClass: "Gemma4ForCausalLM",
+							modelClass: "Gemma4ForConditionalGeneration",
 							requiresWebGPU: true,
 							dtype: {
 								embed_tokens: "q4",
-								decoder_model_merged: "q4"
+								decoder_model_merged: "q4",
+								vision_encoder: "q4",
+								audio_encoder: "q4"
 							},
 							generation: {
-								text: { temperature: 1.0, topP: 0.95, topK: 64 }
+								text: { temperature: 1.0, topP: 0.95, topK: 64 },
+								vision: { temperature: 1.0, topP: 0.95, topK: 64 }
 							}
 						},
-						supportsVision: false,
-						defaultPrompt: "You are a concise, friendly social chat co-host. Keep answers short, natural, and relevant to the ongoing conversation."
+						supportsVision: true,
+						defaultPrompt: "You are a concise, friendly social chat co-host. You can reference visible context when it helps, but do not narrate the scene unless asked."
 					};
 				}
 				if (providerKey === "localqwen2b") {
@@ -9095,7 +9101,7 @@
     <option value="gemini">Google Gemini Live</option>
     <option value="localqwen">Local Qwen 3.5 0.8B (Browser)</option>
     <option value="localqwen2b">Local Qwen 3.5 2B (Browser, quality)</option>
-    <option value="localgemma">Local Gemma 4 E2B (Browser, text-only)</option>
+    <option value="localgemma">Local Gemma 4 E2B (Browser, self-hosted)</option>
     <option value="configuredllm">SSN Configured LLM</option>
     <option value="customopenai">OpenAI-Compatible (Custom)</option>
     <option value="chatgpt">OpenAI Realtime</option>

docs/agents/04-standalone-app/SITEMAP.md

@@ -0,0 +1,17 @@
+# Standalone App Sitemap
+
+Status: generated folder sitemap on 2026-07-22 for docs/agents/04-standalone-app.
+
+Use this file to navigate this folder without scanning the filesystem.
+
+- [Agent docs sitemap](../SITEMAP.md)
+- [Master agent index](../99-agent-index.md)
+
+## Files
+
+- [Standalone App Deep Docs Index](../04-standalone-app/index.md) - Entry point for detailed Electron-app docs; explains the ssapp-repo path convention.
+- [Main Process Lifecycle](../04-standalone-app/main-process-lifecycle.md) - Use this page for startup order, window types and lifecycle, tray/headless behavior, single-instance rules, and shutdown.
+- [Social Stream Loading And Injection](../04-standalone-app/social-stream-loading.md) - Use this page for how the app resolves background/popup/source pages, the fallback bundle, content-script injection mechanics, and the chrome.runtime emulation bridge.
+- [IPC Reference](../04-standalone-app/ipc-reference.md) - Use this page when you need an ipcMain channel name, its direction, or its handler location.
+- [Control API And MCP](../04-standalone-app/control-api-and-mcp.md) - Use this page for the localhost control HTTP API, the MCP stdio server and tool list, token auth/lifecycle, SSE events, and the legacy `/exec` security caveat.
+- [Packaging, Updates, And State](../04-standalone-app/packaging-updates-and-state.md) - Use this page for electron-builder targets, signing, the lack of auto-update, settings persistence files, and portable mode.

docs/agents/04-standalone-app/control-api-and-mcp.md

@@ -0,0 +1,94 @@
+# Standalone App Control API And MCP Server
+
+Status: deep extraction pass on 2026-07-22 from `ssapp/main.js`, `ssapp/resources/electron-control-api.js` (API version 1.1.3), `ssapp/resources/ssapp-mcp.js` (MCP 1.0.1), `ssapp/index.html` (renderer bridge), and `docs/skills/control-social-stream/`. Source-backed; endpoints verified against the ssapp e2e tests (`tests/electron/llm-control-headless-e2e.js`, `ssapp-mcp-e2e.js`).
+
+## Purpose
+
+Use this page for how external programs — scripts, LLM agents, MCP clients — observe and control the standalone app. For the operational how-to (token hygiene, workflows), use `../../skills/control-social-stream/SKILL.md`; this page is the implementation-level reference. For in-app AI chat features (Ollama, chatbots), use `../09-api-and-integrations/ai-features.md` — that is a separate surface.
+
+## Architecture At A Glance
+
+```
+MCP client (Claude etc.)
+  └─ stdio JSON-RPC → ssapp/resources/ssapp-mcp.js  (adapter, no SDK)
+                       └─ HTTP → 127.0.0.1:17777 control API
+Python/script agents ──────HTTP──┘  (X-SSAPP-Token auth)
+                                   └─ main.js router → electron-control-api.js
+                                        └─ commands → renderer bridge
+                                             (window.SSAppStreamDeckBridge.handleCommand,
+                                              index.html:7452-7480)
+```
+
+## Enabling The API
+
+- Off by default. Enable via:
+  - Menu: File → "AI / LLM Control" → Enable Control API (persists `controlApi.enabled`, needs restart) (`main.js:16883-16950`).
+  - CLI: `--ssapp-control-api`, or `--ssapp-headless-control` (also hides all windows), or legacy `--remote-control`.
+  - Env: `SSAPP_CONTROL_API`, `SSAPP_HEADLESS_CONTROL` (`main.js:1875-1886`).
+- Port: default 17777, `--ssapp-control-port` / `SSAPP_CONTROL_PORT` (`main.js:1887-1895`). Bound to loopback only (`server.listen(port, '127.0.0.1')`, `main.js:2554`).
+
+## Authentication And Token Lifecycle
+
+- Every request (except `/ping`) needs the token via `X-SSAPP-Token` header or `?token=` query param (`main.js:2214-2222`), compared with `crypto.timingSafeEqual` (`main.js:1926-1930`).
+- Token precedence: token file → env `SSAPP_CONTROL_TOKEN` → CLI flag → stored/generated (`main.js:1896-1921`). Auto-generated 64-hex token persisted in electron-store `controlApi.token`.
+- Rotation: File → "AI / LLM Control" → Rotate Control Token (`main.js:16927-16943`). "Copy Control Connection" copies `{url, token, ssappVersion}` JSON for agent config.
+- Query-param token exists for SSE `EventSource` clients; the credential-leak risk is tracked in `../issues/ISSUE-006-control-api-token-in-query-param.md`.
+
+## HTTP Endpoints
+
+Versioned router in `resources/electron-control-api.js:211-247`:
+
+| Endpoint | Purpose |
+| --- | --- |
+| `GET /api/v1/capabilities` | Advertised commands + versions. |
+| `GET /api/v1/status` | App/source status snapshot. |
+| `GET /api/v1/events` | SSE stream; resumable via `Last-Event-ID`, 15 s heartbeat, 500-event ring buffer (`:122-145`). |
+| `GET /api/v1/operations/{id}` | Async operation result polling. |
+| `POST /api/v1/command` | Body `{"action": "...", "value": {...}}`. |
+
+Every response includes `apiVersion`, `ssappVersion`, `requestId` (`:95-109`). Mutations return operation IDs (`op_<uuid>`) and publish `operation.started/completed/failed` + `status.changed` events on the SSE stream (`:185-206`).
+
+### Command actions (`electron-control-api.js:11-34`)
+
+| Class | Actions |
+| --- | --- |
+| Read-only | `getCapabilities`, `getSources`, `getSource`, `getSettings`, `getOperation` |
+| Mutating | `addSource`, `updateSource`, `startSource`, `stopSource`, `restartSource`, `removeSource`, `setSourceMute`, `toggleSourceMute`, `setSourceVisibility`, `toggleSourceVisibility`, `setSourceConnectionMode`, `startAllSources`, `stopAllSources`, `restartAllSources`, `updateSettings` |
+| Confirm-gated (`confirm:true` required, `:170-172`) | `removeSource`, `stopAllSources`, `restartAllSources`, `reloadApp`, `shutdownApp` |
+
+Renderer-side execution and allowlists live in `index.html`: global settings allowlist `:6936-6946` (`betaMode`, `youtubeAutoAdd`, `youtubeAutoCleanup`, `youtubeCheckInterval`, `forceTikTokClassic`, `preferTikTokLegacy`, `lastTikTokMode`), platform/mode definitions `:6957-6971`, URL building restricted to http/https `:6983-7014`. Normalized sources deliberately omit stored `url` (may contain credentials).
+
+What the API **cannot** do: read chat messages, send chat messages, or drive overlays — no such commands exist. Chat data still flows only through the normal SSN session transport.
+
+## Legacy Endpoints (`--remote-control` only)
+
+Gated at `main.js:2252`: `/ping` (always available, `:2242`), `/queue-file-selection` (`:2257`), `/youtube-auth` (`:2273`), `/twitch-auth` (`:2341`), `/kick-auth` (`:2348`), `/create-youtube-source` (`:2281-2339`), `/create-kick-source` (`:2356`), and **`/exec` arbitrary JS execution** (`:2521-2544`).
+
+`/exec` contradicts the documented "no arbitrary JavaScript execution" guarantee — tracked as `../issues/ISSUE-005-exec-arbitrary-js-endpoint.md`. Do not claim the app never exposes JS execution without the legacy-mode caveat.
+
+## MCP Server (`resources/ssapp-mcp.js`)
+
+- Dependency-free stdio MCP server (newline-delimited JSON-RPC 2.0, `:177-229`); Node stdlib only. Run with `npm run mcp` (`package.json:32`) or `node resources/ssapp-mcp.js`.
+- Protocol version `2025-06-18`, serverInfo `{name: 'social-stream-ninja', version: '1.0.1'}` (`:189-192`). Capabilities: `tools` only (no resources/prompts).
+- Config via env: `SSAPP_CONTROL_URL`, `SSAPP_CONTROL_TOKEN` or `SSAPP_CONTROL_TOKEN_FILE` (`:86-95`).
+- Methods: `initialize`, `tools/list`, `tools/call`; everything else → `-32601`.
+- 12 tools (`:14-53`), thin wrappers over the HTTP commands: `ssapp_get_status`, `ssapp_get_capabilities`, `ssapp_list_sources`, `ssapp_add_source`, `ssapp_update_source`, `ssapp_start_source`, `ssapp_stop_source`, `ssapp_reload_source`, `ssapp_remove_source`, `ssapp_get_settings`, `ssapp_update_settings`, `ssapp_shutdown`.
+- Tools are filtered at runtime against the app's advertised capabilities (`:124-152`), and every result embeds `ssappVersion`/`apiVersion` (`:168-174`) — so an older app simply exposes fewer tools.
+
+## Companion Skill And Tests
+
+- `docs/skills/control-social-stream/` (this repo): SKILL.md + `references/control-api.md` + `scripts/ssapp_control.py`. The Python script is a thin client for this exact API (`GET /api/v1/capabilities` `:51`, `GET /api/v1/status` `:53`, `POST /api/v1/command` `:61`, header `X-SSAPP-Token` `:18`).
+- ssapp's own e2e test runs that exact script against a headless app (`llm-control-headless-e2e.js:251-259`) — contract parity is enforced in CI.
+- `ssapp/AGENTS.md:55-59` mandates the skill be updated whenever the API changes; version history lives in `docs/skills/control-social-stream/references/version-log.md`.
+
+## Do Not Overclaim
+
+- The control API is loopback-only; do not describe it as remote/LAN reachable without user reconfiguration (there is no supported non-loopback bind).
+- The MCP adapter is not an SDK-based server and exposes no resources/prompts — tools only.
+- The settings allowlist is small by design; do not promise arbitrary settings control.
+- `/exec` exists in legacy mode (ISSUE-005); the "no arbitrary JS" claim only holds for the versioned `/api/v1/*` surface.
+
+## Follow-Up Extraction Needs
+
+- Settings-allowlist growth per API version (currently only in version-log.md bullets).
+- Whether `--remote-control` legacy endpoints are slated for removal.

docs/agents/04-standalone-app/index.md

@@ -0,0 +1,28 @@
+# Standalone App (ssapp) Deep Docs
+
+Status: deep extraction pass on 2026-07-22 from the live `ssapp` repo (`C:\Users\steve\Code\ssapp`, a separate repository, not a subfolder of this one). Source-backed orientation with file:line anchors; not a replacement for in-app/e2e testing.
+
+## Purpose
+
+This folder holds the detailed Electron-app docs that `../04-standalone-app-architecture.md` and `../04-standalone-app-source-windows.md` explicitly deferred: main-process lifecycle, IPC reference, control API + MCP surface, packaging/state, and how Social Stream code is loaded and injected.
+
+Path convention: anchors prefixed `ssapp/...` refer to the separate ssapp repository on disk (`C:\Users\steve\Code\ssapp`). Anchors without a prefix refer to this social_stream repository.
+
+## Pages
+
+| Page | Use it when |
+| --- | --- |
+| [Main Process Lifecycle](main-process-lifecycle.md) | Startup order, window types, tray/headless modes, shutdown, single-instance behavior. |
+| [Social Stream Loading And Injection](social-stream-loading.md) | How the app resolves background/popup/source pages (remote → cache → fallback), injects content scripts, and emulates `chrome.runtime`. |
+| [IPC Reference](ipc-reference.md) | Channel names, direction, and purpose for the ~90 ipcMain channels. |
+| [Control API And MCP](control-api-and-mcp.md) | Localhost control HTTP API, MCP stdio server, token auth/lifecycle, SSE events, legacy `/exec` caveat. |
+| [Packaging, Updates, And State](packaging-updates-and-state.md) | electron-builder targets, code signing, no auto-updater, savedSync.json/electron-store schema, portable mode. |
+
+## Related docs outside this folder
+
+- `../04-standalone-app-architecture.md` - layer map and source-root loading rules (backbone pass).
+- `../04-standalone-app-source-windows.md` - source-state vs source-window mental model and app-vs-extension parity.
+- `../08-platform-sources/tiktok-standalone-app.md` - TikTok connector modes, signing, fallbacks.
+- `../08-platform-sources/tiktok-app-event-payload-map.md` - TikTok app event → SSN payload field mapping.
+- `../../skills/control-social-stream/` - operational skill for driving the app via the control API (Python client + MCP).
+- `../issues/` - bugs found during documentation passes, including ssapp defects.