4 Commits

Author	SHA1	Message	Date
Patrick Buckley	480a1426b3	Fail-closed history-commit handoff (#1005) ... * fix(session): fail-closed history-commit handoff (#981) The deleted-workstream discovery is now a terminal, ws_id-keyed latch: keyed conversation commits refuse admission once the durable parent is gone (convergence finalizers and force-abandon are exempt), history handoff refuses to mint a proof token so /history fails closed with a 503 instead of silently wiping the pane, and the SSE stream carries a workstream_gone resync reason. Discarded commits leave a forensic log of commit keys and roles, never content. Conversation rows gain a commit_key (migration 071): keyed saves are idempotent under retry, validated against the full commit identity, and refused when they would cross a workstream deletion. The prune orphan category now requires a NULL alias plus a two-hour updated grace, with cutoffs computed at discovery time and carried into both dialects' rechecks. The mid-turn interjection queue is owner-partitioned with no per-site mode flags: pops take the acting principal's and unowned rows, other participants' rows are structurally retained, and enforcement lives at queue admission plus the shared before_spawn gates. The retraction ledger is bounded by open pop windows: pops open a window atomically with the queue delete, restores close their ids atomically with the ledger consume, every other exit closes through one helper, and misses for unheld ids record nothing. The workstream-gone latch refuses unattended wakes at all three gates (watcher spawn, claim, delivery pre-pop), and the retry dispatcher regained its pre-envelope cancel/error convergence net. Persistence-state reporting derives through the session bound to each UI instead of a registry lookup by id that failed open to healthy during tombstone retention. The dashboard roster no longer re-inserts ghost entries from trailing activity events, the history tool-outcome scan tolerates interleaved non-turn rows, and the shared handoff-deadline handle owns its own retirement. Single-sourced across call sites: keyed-commit row values, attachment save wrappers, tail-truncation and conflict-resolution bodies for both storage dialects; worker-slot lifecycle field sets; the direct-commit admission frame; queued-row layout accessors; the string-aware comment stripper shared by every JS harness suite. Refs #981 #964 * fix(session): sweep handoff fixes to their sibling surfaces The interactive replay loop treated a system row as a tool-batch boundary, so every tool result after an interleaved row vanished from that pane while the coordinator rendered the same history correctly. Only a conversational turn ends the batch window now, matching the shared outcome index. Accepted user turns clear the composer's attachment chips on the same viewer policy that settles optimistic bubbles rather than on having matched a local bubble, so a workstream created with an upload no longer keeps a chip for an attachment the create dispatch already consumed. The coordinator's raced-Stop arm emits the stream-end hook it inherits alongside the idle state, leaving no unfinalized bubble or unflushed tool output. Ending a session surfaces a failure toast when the request never lands or answers with a non-JSON body. The per-second persistence reconcile now probes each session without blocking: a workstream whose generation and handoff locks are held is skipped until the next pass instead of contending the locks every commit needs. The one-shot repair that gates workstream creation at capacity keeps a definite probe — it has no next pass, and the sessions likeliest to be contended are the ones whose unresolved journals emptied its candidate list. Single-sourced: the attachment lane builds its conversation row through the shared commit-identity builder; the ordinary worker exit releases its slot through the lifecycle owner; both operator surfaces snapshot their counters through one non-consuming helper; the replay preamble loses its per-kind wrappers and its config hook; the browser harness suites share one brace walker; and each in-flight history attempt is one record carrying both its abort controller and its deadline. Refs #981 #964	2026-08-11 04:18:36 -07:00
Patrick Buckley	ace9e034f9	fix(ui): ephemeral panes close on split-dismiss instead of orphaning a tab ... The preview pane opens beside the conversation as a split cell. Dismissing that cell — the per-cell chip, or Unsplit from the other pane — ran closeCell(), which hides the pane but keeps it in _panes/_order, leaving an orphan tab with no meaningful reopen (the reopen affordance is the transcript chip, not the tab bar). Add an `ephemeral` flag on ShellPane. For an ephemeral pane the cell chip and Unsplit route to close() — destroying the pane and its tab — and the chip's glyph/label read as a destructive close rather than a reversible hide. Unsplit still spares the focused survivor even when it is ephemeral ("keep the focused pane"). The preview pane sets the flag; conversational panes do not, so an all-conversation split is unchanged (Unsplit reduces to the prior _exitLayout(_activeId)).	2026-07-07 22:07:20 -07:00
Patrick Buckley	1e2ab91ec2	feat(preview): probe preflight, legacy charsets, remote-assets opt-in, md vendor parity ... Four follow-ups to the preview pane: - Probe-mode preflight: the pane preflights src-loaded kinds with GET ?probe=1 (204, real hardening headers, no body) instead of HEAD — the console reverse proxy forwards HEAD as a full GET, so the old preflight dragged the whole blob across the node→console hop twice. Ownership gate + renderable-type check still run on probes. - Legacy-charset text: table/text/markdown now transcode to UTF-8 at store time (declared charset → UTF-8 → cp1252-replace ladder), same model the web kind already used. The ladder applies only when the text kind was DECLARED (MIME/extension/override); the bare no-hint fallback stays strict UTF-8 and NUL bytes still hard-reject, so binary rejection is unchanged. - Remote assets default OFF: previewed pages are now served under "sandbox; default-src 'none'; style-src 'unsafe-inline'; img-src data:; font-src data:" — they render with inline styling but cannot contact their origin site (no viewer IP/traffic disclosure). A per-pane "Load remote images & styles" checkbox (web previews only, sticky, not persisted) reloads with ?assets=1 for the permissive bare-sandbox mode. - Markdown vendor parity: preview markdown now runs renderer.js's postRenderMarkdown (hljs token coloring + lazy mermaid diagrams) like the conversation pane, with preview-scoped code-block/KaTeX chrome (the conversation theme is .msg.assistant-scoped). Tests: probe/assets HTTP + policy coverage, charset ladder units + stored-bytes round-trip, JS static guards for the probe form, the default-off toggle, and the post-pass; headless-chrome harness grew to 41 assertions (probe-not-HEAD, toggle visibility/default, fenced-code render). Full suite green.	2026-07-07 08:20:57 -07:00
Patrick Buckley	e010124008	feat(preview): rich preview pane + open_preview tool ... Tool results only ever rendered as plain text in the transcript. This adds the model-driven rich-preview lane every comparable surface has, in turnstone's developer-tool idiom: a preview pane that opens BESIDE the conversation, keyboard-operable, sandboxed, never replacing the transcript that spawned it. Backend - New built-in open_preview(target, kind?, title?): resolves an http(s) URL, a file path, or attachment:<id> to bytes; classifies into web/pdf/image/table/text/markdown (magic bytes > MIME hint > extension > UTF-8 fallback, legacy-charset pages transcoded); caps size per kind; persists content-addressed with kind="preview" — refcounted and GC'd with the workstream, skipped by trajectory reconstruction so preview bytes can never materialize onto the wire. URL targets gate like web_fetch (network egress); paths/attachments run unprompted like read_file. - New core.web.fetch_with_ssrf_guard: manual redirect walk that SSRF-screens every hop BEFORE requesting it (follow_redirects=True checked nothing between hops); adopted by both open_preview and web_fetch. URL userinfo is stripped before the descriptor or the stored bytes see it; <base href> is injected doctype-safely so relative assets resolve without quirks mode. - The preview descriptor rides the tool turn's meta side channel with ONE shape on every boundary: the live tool_result SSE event, the conversations.meta column, and the /history projection. Cancelled batches commit an already-announced preview (blob + meta) instead of stranding the open pane on a permanent 404. - New GET {ws}/attachments/{id}/preview (read scope, same ownership gate as /content) serves the STORED type with per-MIME hardening: bare CSP sandbox for text/html (renderable, scriptless, opaque origin), no CSP for application/pdf (Chromium's viewer refuses sandboxed contexts), full default-src 'none' otherwise; filenames fold to latin-1-safe ASCII. The console /node proxy now forwards CSP/nosniff/disposition/cache-control instead of dropping them. - History loads exclude preview blobs from the bulk content fetch at the query (they were read and discarded on every load). Frontend - New "preview" pane type registered in the shared shell (server + console): openPaneBeside placement, per-kind renderers — fully sandboxed iframe for pages, browser PDF viewer, sortable tables (CSV/TSV/JSON, ragged-file safe, 5k-row cap), rendered markdown, text — plus back/forward history with arrow keys, reload persistence via pane meta, and backoff auto-retry (0.9s..7.2s) bridging the gap between the live descriptor and the batch fold that commits its blob. - Tool results carrying a descriptor render a credential-redacted preview chip (the reopen + replay affordance); live results auto-open the pane only while the originating pane holds focus. Docs: docs/tools.md + prompts/tools.md. Tests: policy unit tests, tool prepare/exec (mocked fetch), serving route + proxy header pass-through, storage exclusion on both backends, cancel-path commit, JS static guards; a headless-Chrome harness drives the real module graph (32 DOM assertions).	2026-07-07 08:20:57 -07:00