67 Commits

Author	SHA1	Message	Date
Patrick Buckley	480a1426b3	Fail-closed history-commit handoff (#1005) ... * fix(session): fail-closed history-commit handoff (#981) The deleted-workstream discovery is now a terminal, ws_id-keyed latch: keyed conversation commits refuse admission once the durable parent is gone (convergence finalizers and force-abandon are exempt), history handoff refuses to mint a proof token so /history fails closed with a 503 instead of silently wiping the pane, and the SSE stream carries a workstream_gone resync reason. Discarded commits leave a forensic log of commit keys and roles, never content. Conversation rows gain a commit_key (migration 071): keyed saves are idempotent under retry, validated against the full commit identity, and refused when they would cross a workstream deletion. The prune orphan category now requires a NULL alias plus a two-hour updated grace, with cutoffs computed at discovery time and carried into both dialects' rechecks. The mid-turn interjection queue is owner-partitioned with no per-site mode flags: pops take the acting principal's and unowned rows, other participants' rows are structurally retained, and enforcement lives at queue admission plus the shared before_spawn gates. The retraction ledger is bounded by open pop windows: pops open a window atomically with the queue delete, restores close their ids atomically with the ledger consume, every other exit closes through one helper, and misses for unheld ids record nothing. The workstream-gone latch refuses unattended wakes at all three gates (watcher spawn, claim, delivery pre-pop), and the retry dispatcher regained its pre-envelope cancel/error convergence net. Persistence-state reporting derives through the session bound to each UI instead of a registry lookup by id that failed open to healthy during tombstone retention. The dashboard roster no longer re-inserts ghost entries from trailing activity events, the history tool-outcome scan tolerates interleaved non-turn rows, and the shared handoff-deadline handle owns its own retirement. Single-sourced across call sites: keyed-commit row values, attachment save wrappers, tail-truncation and conflict-resolution bodies for both storage dialects; worker-slot lifecycle field sets; the direct-commit admission frame; queued-row layout accessors; the string-aware comment stripper shared by every JS harness suite. Refs #981 #964 * fix(session): sweep handoff fixes to their sibling surfaces The interactive replay loop treated a system row as a tool-batch boundary, so every tool result after an interleaved row vanished from that pane while the coordinator rendered the same history correctly. Only a conversational turn ends the batch window now, matching the shared outcome index. Accepted user turns clear the composer's attachment chips on the same viewer policy that settles optimistic bubbles rather than on having matched a local bubble, so a workstream created with an upload no longer keeps a chip for an attachment the create dispatch already consumed. The coordinator's raced-Stop arm emits the stream-end hook it inherits alongside the idle state, leaving no unfinalized bubble or unflushed tool output. Ending a session surfaces a failure toast when the request never lands or answers with a non-JSON body. The per-second persistence reconcile now probes each session without blocking: a workstream whose generation and handoff locks are held is skipped until the next pass instead of contending the locks every commit needs. The one-shot repair that gates workstream creation at capacity keeps a definite probe — it has no next pass, and the sessions likeliest to be contended are the ones whose unresolved journals emptied its candidate list. Single-sourced: the attachment lane builds its conversation row through the shared commit-identity builder; the ordinary worker exit releases its slot through the lifecycle owner; both operator surfaces snapshot their counters through one non-consuming helper; the replay preamble loses its per-kind wrappers and its config hook; the browser harness suites share one brace walker; and each in-flight history attempt is one record carrying both its abort controller and its deadline. Refs #981 #964	2026-08-11 04:18:36 -07:00
Patrick Buckley	7a06f5e8bc	refactor(session): make ModelLane the provider boundary (#979) (#989) ... * refactor(session): make ModelLane the provider boundary (#979) ## Summary This closes the model-lane ownership gap left by #832: `ChatSession` no longer stores raw provider/client handles. `ResolvedModelBinding` now carries the provider, client, model, capabilities, registry generation, and backend-auth configuration as one coherent snapshot. - Atomically rebind existing sessions after model-registry changes while pinning each in-flight send, fallback, judge, output guard, task agent, title, compaction, perception, and voice operation to its initiating principal and binding. - Fence UI publication, canonical trajectory folds, durable writes, streams, retries, child scopes, and judge work by generation. Stop can hand off to a successor without accepting late state; cancelled tools retain typed effect receipts, and concurrent approval batches resolve by exact cycle or call. - Make create, fork, open, close, and delete race-safe with hidden `creating` reservations, incarnation-aware state tails, and an ACL-rechecked transaction that clones checkpoint-bounded history, configuration, project/persona state, and attachment references. - Extend REST/OpenAPI and Python/TypeScript SDK contracts for create/fork inputs, routed-create metadata, live-workstream probes, targeted approvals, and structured cancellation results. - Update architecture, storage, authentication, judge, channel, console, API, and SDK documentation, including regenerated architecture diagrams and OpenAPI artifacts. ## Validation - SQLite suite: 11,188 passed, 9 skipped, 10 deselected - PostgreSQL suite: 11,195 passed, 2 skipped, 10 deselected - Live backend: 3 passed - SSE recovery: 6 passed; browser recovery harness passed all scenarios - Ruff: clean; 595 files correctly formatted - mypy: 243 source files clean - TypeScript: typecheck/build and 35 tests passed - OpenAPI artifacts fresh; all 14 changed diagrams reproduce byte-for-byte - `git diff --check` and Git LFS integrity clean Closes #979. * fix(deps): update nanoid for GHSA-2v37-7h3g-55p8 Refresh the transitive lock entry admitted by PostCSS so the TypeScript security gate no longer resolves the vulnerable custom-generator implementation. Validation: - npm ci - npm audit --audit-level=moderate: 0 vulnerabilities - TypeScript typecheck and build - TypeScript tests: 35 passed * fix(test): assert canonical model registry URLs Replace prefix checks with exact canonical base URL assertions so the tests do not model incomplete URL validation. Validation: tests/test_model_registry.py (185 passed); Ruff check/format; mypy.	2026-08-08 16:13:35 -07:00
Patrick Buckley	e99673eb0c	fix(compaction): review round 6 — defer-and-drain send windows, workstream-scoped notify, ERROR badge survives /compact ... Replace park-and-abandon /send semantics with defer-and-drain: a send landing in a command window is answered {status: queued, msg_id} immediately and dispatched full-fidelity by a per-workstream drain thread when the window closes. Parking encoded client disconnect as message retraction — true only for the composer's ✕-abort; every bounded caller (coordinator client and console proxy at timeout=30, SDKs, stock proxies) timed out and lost its message for the whole window, and the compensating client machinery was racy (one-shot sendAbortMs sample) and over-broad (_sendAbort fired on the interjection path, dispatching dismissed messages while showing a connection error). Dismissal is now uniformly bind() → DELETE, with a fall-through that retracts pending entries; retracting an attachment-bearing deferred send surfaces the discarded-attachments consequence. The drain claims entries under ws._lock immediately before dispatch (DELETE can never remove an in-flight message), refuses the truncating interjection fallback for oversized or attachment entries atomically inside the enqueue callback, and never gives up while the workstream lives; durability is documented as node-local at-most-once. sendAbortMs, _sendAbort, the 600s bound and the park loop are deleted; route and drain share one dispatch implementation (spawn metrics included). Also: the initial-send completion notify is un-gated from slot ownership (_fire_notify_targets has exactly one call site — successor turns never notify, so the round-5 guard prevented a duplicate that cannot exist while converting force-cancel into permanent notification loss for scheduled workstreams); /compact on an ERROR workstream restores the badge instead of stamping idle over it; duck-typed SessionUIs without on_compaction get the classic on_info lines back via a shared renderer (superseded OK ends included — a committed swap must never be silent; pre-1.8 SSE clients are deliberately not dual-emitted, documented as a 1.8 breaking change); failed-end notice suppression is computed once by the emitter as a notice bool on the end event (SDK py+ts), replacing the hand-synced cli/JS policy while the panes keep their pane-local card-ownership clause.	2026-07-17 11:28:44 -07:00
Patrick Buckley	1dbf7f410c	feat(compaction): lifecycle events, web progress card, history re-render ... Compaction becomes visible: a first-class 'compaction' SSE lifecycle (start/progress/end, compaction_id-correlated, superseded-flagged ends) replaces the loose info lines; both web panes render a progress-bar card that settles into a persistent result card, re-rendered after reload via the /history projection of the compaction marker row. Slash commands echo as command chips instead of fake user turns. The enabling rework: /command dispatches onto the workstream worker slot (the old inline path blocked the node's event loop for whole compactions and let /clear interleave with live turns). Busy refusals answer 409; quick commands are awaited loop-natively with a 60s backstop; /compact is fire-and-forget. Sends during a command window park in the /send route and dispatch full-fidelity afterwards — the interjection queue (length cap, cross-user guard, identity-swap hazards) is unreachable there — with a compaction-aware client abort bound shared by both panes. compact_now() carries send()'s full generation discipline; Stop aborts the in-flight summary HTTP stream via a generation-scoped cancel ref; force-abandoned compactions retire at their next checkpoint and their stragglers are fenced off every surface (panes, pill latch, CLI). Every session retry backoff is cancel-aware via one shared helper. Docs, OpenAPI spec, and both SDKs updated. Verified: 9457-test non-live suite, JS pin suites, headless-Chrome reducer harness; five unprimed multi-agent review rounds (correctness trend 15/6/6/4/4) with plan-level design passes on every fix round.	2026-07-17 11:28:44 -07:00
Patrick Buckley	e60c19befd	fix(watch): harden nudge/wake delivery across eviction, cancel, and identity rebinds ... Wake path: - Denial metacog nudge moves to the tool channel so it drains with the denied tool batch instead of the next user-message seam. - wake_workstream_if_pending: shared wake gate for watch fires on already-idle workstreams (no IDLE transition for the watcher to observe), wired as wake_fn at every set_watch_runner site via the shared _watch_fire_wake_fn helper (closes over the Workstream OBJECT — after eviction+restore an id-keyed manager lookup would miss). - session_worker exit backstop re-runs the wake gate the moment worker ownership clears: IDLE fans out on the worker thread, so transition-time wakes always landed on the reuse path and no-op'd (the coordinator idle_children strand). - deliver_wake_nudge_from_queue contains GenerationCancelled — it is the wake worker's run() closure and only Exception is caught downstream. Watch delivery: - Terminal fires that cannot reach their workstream are HELD and redelivered on min(interval, 60s) without re-running the command, bounded by MAX_DELIVERY_ATTEMPTS per cycle and the watch's own max_polls across cycles; the poll charge commits durably at hold time so restarts stay budget-bounded. - Restore admission control: per-ws dedup + MAX_CONCURRENT_RESTORES cap, presence-only re-check under the lock, detection-only stall alerts (reclaiming a wedged admission would trade capped degradation for total poll-pool collapse). - Permanent-vs-transient restore taxonomy: corrupt persona stamp and genuinely-missing history (confirmed by a raising storage probe — the resume loader swallows read blips into []) deactivate the watch immediately; everything else holds and retries. - Cancel-race defense: delivery paths re-check is_watch_active before stashing/dispatching, cancel paths write the row BEFORE forget_terminal_dispatched, the HTTP cancel endpoint clears runner state, and a per-tick sweep bounds the residual stash-after-clear interleaving to one check_interval. - Abandon/exhaustion commits are write-then-clear so storage that can read but not write retries the row write instead of re-running the command every cycle; the fresh-fire unrestorable path stashes before its deactivation write for the same reason. Registry follows identity: - The dispatch registry is keyed by _ws_id at registration time; every rebind now moves it: non-fork resume() and /new go through _follow_watch_registration (new key live before the old is removed, never stealing a registration another live session holds), removals are owner-checked so tearing down a watch-restore shell or a resumed-away session cannot unregister a live pane, the restore shell yields to a registration that appears mid-restore, CLI --resume registers after the successful resume, and both the open path and the detail-GET lazy rehydrate wire the registration. Teardown gating and backpressure honesty: - cleanup_session_ui marks ws._closed FIRST under ws._lock — every teardown path (close, close_idle, evict, delete, discard) funnels through it — and session_worker.send re-checks under the same lock, so a wake can never spawn a worker on a torn-down workstream. - Create responses carry initial_message_status when the initial message could not be delivered (queue_full / refused_closed) instead of reading as success; staged attachments survive for the retry; /send surfaces a closed workstream as 404 rather than queue_full. Docs/spec: OpenAPI artifacts regenerated; api-reference documents the new create-response field; TS SDK type extended. Tests: ~30 new pins (cancel races, budget durability across restarts, owner-checked registry moves, teardown gating, stall alerts, backpressure surfaces, wait_until final re-check); wide subsystem sweep green (2353 passed).	2026-07-07 16:42:36 -07:00
Patrick Buckley	16ee4e12ef	fix(sdk): mark 1.7-added approval-cycle fields optional in the TS SDK ... ApproveRequestEvent.cycle_id and ApprovalResolvedEvent.cycle_id / call_ids were typed required, but they are 1.7 additions: a pre-1.7 server omits them on the wire, so a current SDK talking to an older node sees undefined. The UI and channel adapters already keep the legacy no-selector fallback for exactly that case. Mark them optional so consumer code can't assume a string that may be absent — matching the Python SDK, whose dataclasses default all three.	2026-07-05 01:57:54 -07:00
Patrick Buckley	18c3301428	feat(api): cycle-routed approval resolution across server, console, schemas, SDKs ... POST /approve accepts cycle_id / call_id selectors and 409s on stale selectors with the current cycle's ids so clients re-render instead of silently resolving an unrelated batch. Selector-less bodies pin the resolve to the cycle the lookup returned (not "whichever is oldest by the time the resolve runs"), and Approve+Always names apply only after the pinned cycle actually resolved — the auto-approve whitelist can no longer describe a different batch than the one that resolved. approve_request carries cycle_id; approval_resolved carries cycle_id + call_ids; SSE reconnect replays every live cycle's card. The console collector, coordinator UI fan-out, and both SDKs (Python + TS) thread the cycle correlation through. BREAKING (1.7): the singular pending_approval_detail field is removed from dashboard rows, workstream detail, and node snapshots — replaced by the pending_approval_details list (one entry per live cycle, each carrying its cycle_id). stable/1.6 keeps the old shape.	2026-07-05 01:57:54 -07:00
Patrick Buckley	54ebb24374	feat(personas): core stamping, four-lever application, create/spawn/SDK threading; remove /creative; add --persona ... The persona resolved at creation is snapshotted into workstream_config (five keys, all-or-none) and applied ONLY from the stamp — the personas table is never read post-create, so edits/archives never touch existing workstreams, and a corrupt stamp fails construction loudly instead of silently reverting to a default envelope. Legacy pre-063 workstreams carry no keys and keep today's behavior byte-for-byte. The four levers (turnstone/core/personas.py holds the codec): 1. Base override — compose_system_message(base_override=...) replaces exactly the BASE module; ENV/CONTEXT/TOOLS/POLICIES keep composing so mandatory prompt policies ride on top of every persona. This also closes the old /creative hole where the fork bypassed composition (no CONTEXT, no DB policies). 2. Tool visibility — the allowlist intersects both the composition name set (TOOLS block self-suppresses, tool-gated policies drop, the memory advisory drops) and the END of _get_active_tools so the wire never advertises hidden tools. tool_search in the set = soft (discovered tools union with the allowlist via the session's expanded-names set); absent = hard (the whole pathway is disabled, covering provider-native defer_loading, which has no synthetic name to filter). Persona sets force client-side tool search. 3. MCP gate (session-wide) — an MCP-off persona drops the client reference at construction: no merge into _tools OR _task_tools, no listeners, refresh callbacks inert, resource/prompt catalogs gone. 4. Memory (own hands only) — no recall injection, memory-directed nudges suppressed (MEMORY_NUDGE_TYPES; behavioural nudges keep firing), memory tool hidden. _task_tools is NOT filtered; compaction spill/markers are never persona-gated, and the post-compaction recall pointer is emitted only when the recall tool is actually visible. Threading: the create handler resolves once (explicit name -> 400 on unknown/disabled/kind-mismatch; empty -> the kind's default; pre-seed DB -> unstamped legacy) and stamps via constructor kwargs + config keys + the workstreams.persona column; SessionManager.open threads the stamp pre-construction exactly like the saved model alias. Non-fork resume adopts the target's stamp so _save_config can't clobber it. spawn / spawn_batch gain a persona arg with prep-time validation (children are interactive-kind; omitted = kind default, never the parent's). Python + TS SDKs, OpenAPI specs, the picker feed GET /v1/api/personas (authed, no perm), and console admin CRUD /api/admin/personas (persona.* perms, archive-only — no DELETE) round out the surface. BREAKING: /creative is removed (the REPL command now points at the writer persona); turnstone --persona <name> is the replacement. Also fixes the CLI session factory, which TypeErrored on the project_id kwarg the shared InteractiveAdapter passes unconditionally.	2026-07-03 00:29:26 -07:00
Patrick Buckley	2169559d6e	feat(projects): governed project containers — memory scope, grouping, manage UI (#724) ... * feat(projects): governed project containers — memory scope, grouping, manage UI A workstream can attach to a project: a first-class, shareable resource container that owns a `project` memory scope, groups conversations, and is managed from the console. Storage / migration 062: projects + project_members tables, workstreams. project_id, and the memory type default project→general; grants project.{create,read,write,delete} (admin-default). Recall + writes: project memory is recalled iff the workstream is attached AND the user has access (owner ∨ member ∨ public-for-read), resolved once at session construction; coordinators recall it too. New saves default to the project when attached + writable; the save and delete paths are write-gated; deleting a project purges its scoped memory; archived projects aren't recalled. Access = RBAC capability ∧ per-project ACL (auth.resolve_project_access, a single-fetch resolver); visibility changes, member management, and delete are owner-only. API: project CRUD routes on both the server and console; project_id threaded through workstream creation, spawn inheritance, the cluster-create proxy, the dashboard / snapshot / coordinator row builders, and the collector deltas. UI: a project picker with an inline "+ New project" creator in every creation box (console launcher + standalone dialog + dashboard); group-by-project in the rail; a project badge in the composer and on dashboard rows; a console manage tab (list + create/edit + members shelves). The admin Memories view gains coordinator/project scope filters and human scope labels (name, not hex). The memory tool schema documents the project scope and the attach-aware default. * fix(projects): client refresh hardening, creator race guard, SDK project_id Addresses PR #724 review feedback plus two bugs found while validating it. - projects.js refreshProjects: a non-OK status (e.g. 403 when the caller lacks project.read) or a network/parse error no longer blanks the cache or masquerades as "no projects" -- the prior cache is preserved, the failure is recorded (new projectsError()) and warned. Honors the long-standing "a transient error can't blank the rail" docstring. - projects.js _fp: the fingerprint separators were raw control bytes, which made git treat the whole file as binary (no reviewable diff). Rewritten as escape sequences instead of raw bytes -- behavior is byte-identical at runtime. - project_creator.js: createProject() could reject unhandled (authFetch throws on network/401; r.json() throws on a non-JSON body), leaving the widget stuck busy/disabled. Added a .catch, plus a generation guard so a create whose widget was cancelled/reopened mid-flight drops its result instead of selecting a project the user backed out of. - types.ts: add project_id to CreateWorkstreamRequest / WorkstreamInfo / DashboardWorkstream to match the server schemas (was SDK-invisible). - test_project_api.py: move side-effecting HTTP calls out of asserts so the requests run even under python -O. * fix(projects): JSON.stringify the cache fingerprint, drop control-byte separators _fp joined fields/rows on raw NUL/SOH bytes, which made projects.js read as binary to git. Replace with a collision-proof, escape-free JSON.stringify encoding -- same change-detection semantics, zero embedded control characters.	2026-06-26 17:24:06 -07:00
Patrick Buckley	dd80ca3655	chore(attachments): hygiene sweep — dead code, stale comments, SDK type, pdf nit ... - Remove the unused PerceptionUnavailableError (never raised/caught/imported). - Reword the now-shipped 'Phase 3' placeholder comments on the Anthropic + OpenAI-Responses audio paths to describe the live upstream STT/perception fallback (these placeholders are defensive, not pending work). - Clarify the no-vision image fall-through comment (fires when perception is unconfigured OR can't see, not only the former). - Type AttachmentInfo.kind as the image|text|pdf|audio union in the TS SDK. - extract_pdf_text: append the truncation marker only when there's actual text, so a scanned PDF over the page cap returns '' (-> placeholder) instead of a content-free document part.	2026-06-16 00:48:14 -07:00
Patrick Buckley	8ad6d3d2f3	feat(attachments): accept pdf/audio uploads in the UI + admin capability toggles ... - composer: accept pdf/audio in the upload picker; client-side kind inference for the optimistic chip (server classify_upload stays authoritative) - admin Models tab: supports_pdf + supports_audio_input toggles (flow through the field-aware capabilities merge into ModelCapabilities, so flipping supports_audio_input on an omni alias enables native input_audio) - docs: AttachmentInfo.kind, AttachmentUpload, and the TS SDK note pdf/audio	2026-06-16 00:48:14 -07:00
Patrick Buckley	107967f548	fix: pre-push review — operator-context retry walk, get_content offload, doc cleanups ... - A1: add a shared `operator-context` marker to every operator-context row in both UIs; the retry-skip walk keys on it, so a trailing watch-result / guard-finding / idle-children card no longer makes retry regenerate the wrong turn. Pinned by source-grep tests + a headless-DOM self-test. - A2: wrap get_content's two sync DB gates (get_attachment + the unbounded ws-scoped attachment_referenced_in_ws LIKE scan) in asyncio.to_thread so a long scan can't stall the event loop — matching the module's convention. - A3: add the HistoryEvent attachments docstring bullet; drop the dead `interjection` class; document the interactive-only system-context label; correct the SDK attachments-meta docs to {kind, filename, mime_type} (size_bytes is not carried through the history projection).	2026-06-04 11:03:13 -07:00
Patrick Buckley	164f74dead	feat(operator-context): deliver structured per-kind meta to the UI ... Operator-context system turns (watch results, output-guard findings, idle children, user interjections) carried their kind (_source) and a flattened text content, but the structured per-kind fields were dropped at every persist/deliver boundary — so the UI rendered every kind as one generic operator bubble and the structured watch-result card was lost. Wire the structured meta through as the single source of truth: - Storage: new conversations.meta JSON column (migration 060); threaded through save_message/save_messages_bulk (facade + protocol + both backends) and rehydrated in reconstruct_turns onto Turn.meta.extra["source_meta"]. - Canonical: make_system_turn carries meta as one _source_meta dict; turn_from_dict/turn_to_dict bridge it to/from Turn.meta.extra. - Live + history: widen on_system_turn(content, source, meta) across all impls + the SSE payload; surface _source_meta -> meta in the /history projection. SDK HistoryEvent docs note the field. - Producers derive both the model-facing content text AND the card from one meta dict, so they cannot drift: render_output_guard_text, build_watch_ reminder carrying output, idle_children and user_interjection metadata. - Frontend: addSystemContext / renderSystemTurn dispatch by source to the watch-result, guard-finding, idle-children, and queued-message cards in both the interactive and coordinator panes; every untrusted field renders via textContent. The meta is a leading-underscore key, stripped before the wire (sanitize_ messages and the native mid-conversation path copy only role+content), so the per-provider wire payloads stay byte-identical. Additive column, no backfill: operator turns predating it reload as plain text bubbles.	2026-06-04 11:03:13 -07:00
Patrick Buckley	0e0d0bbf72	fix: pre-push review fixes from the canonical-trajectory deep-dive ... A deep-dive review of the branch surfaced a budget regression, SDK doc drift, dead code, and stale docstrings. Each was boundary-spiked before fixing. - R1 (regression): by-reference document attachments were invisible to the token budget — _msg_text_chars returned 0 doc_chars for a {type:document,attachment_id} placeholder, and the comment's claim that the budget "lands at calibration" was false (calibration discards doc_chars). Thread the doc size through _attachments_meta (size_bytes, at both the live-append and reconstruct build sites) and count it in _msg_text_chars, guarded against double-counting the inline form. Regression test added. - F1: the history-DTO schema description and the TS HistoryEvent docstring still advertised the removed reminders/advisories keys and omitted the system role; corrected server_schemas.py + sdk/typescript/src/events.ts to match the shipped shape. The committed OpenAPI JSON snapshots were already ~679 lines stale on main; their regen is left to its own chore branch. - D1: removed AttachmentBuffer.take() — dead (no production caller; the commit path uses discard()) and scope-weak (ws_id only, unlike its siblings) — with its test and the now-orphaned Iterable import. - O1: 4 docstrings referenced the moved ChatSession._fold_system_turns → lowering.fold_system_turns.	2026-06-04 11:03:13 -07:00
Patrick Buckley	110d44b07e	refactor(tools): remove man, math, and plan_agent built-in tools ... `man` and `math` duplicated capabilities already reachable through `bash`; `plan_agent` is better expressed as a `task_agent` running a planning skill, and carried a large amount of special-case machinery (plan-review gate, refinement loop, per-kind model routing). Removing all three shrinks the tool surface and cuts per-call token cost. Also removed, as dead-once-the-tools-are-gone: - the `math` sandbox executor (`turnstone.core.sandbox`) and its `[sandbox]` extra; the eval analyst now runs bash-only - the read-only `AGENT_TOOLS` sub-agent tool set and the `agent` tool-metadata key (`task_agent`/`TASK_AGENT_TOOLS` retained) - the plan-review protocol end to end: the `on_plan_review` UI hook, `resolve_plan`, `POST /v1/api/plan` + `POST /v1/api/route/plan`, the `plan_review`/`plan_resolved` SSE events, and their Python SDK / TypeScript SDK / OpenAPI / frontend / Discord+Slack bindings - the `model.plan_alias` / `model.plan_effort` settings and the registry `plan_model` / `plan_effort` routing fields TOOLS 31->28, TASK_AGENT_TOOLS 13->11; COORDINATOR_TOOLS unchanged. BREAKING CHANGE: removes the `man`, `math`, `plan_agent` tools, the plan-review SSE/HTTP/SDK surface, and the plan_* model-routing settings from the experimental 1.6 line.	2026-05-31 19:54:43 -07:00
Patrick Buckley	c80354880a	feat(api): enrich saved-workstream list with model/skill/context fields ... GET /v1/api/workstreams/saved returned only ws_id/alias/title/created/ updated/message_count — too little to drive the planned saved-list table redesign. Add seven fields, all sourced from already-persisted data (no migration): - state, kind, node_id: columns on the workstreams table - model_alias, launch_skill: from workstream_config via LEFT JOIN - child_count: COUNT of child workstreams via parent_ws_id - context_tokens: most recent usage_events prompt size for the workstream - context_ratio: context-window occupancy (context_tokens / model context window), computed in the handler so the NULL / zero-window cases stay explicit and identical across both storage backends context_window comes from a model_definitions join; aliases defined only in config.toml are absent there, so context_ratio degrades to 0.0 rather than reporting bogus occupancy. The Python SDK reuses the Pydantic model; the TypeScript SDK OpenAPI snapshot and hand-maintained interface are updated. Tests cover the new storage columns (including NULL-when-absent), the handler ratio math + zero-window degradation, and the SDK enriched round-trip.	2026-05-29 16:05:17 -07:00
Patrick Buckley	5bd7af6b73	feat(session): path-key /rewind + /retry into shared verb handlers (#549) ... Lift the conversation-modifying /rewind and /retry verbs out of the body-keyed POST /v1/api/command into path-keyed POST /v1/api/workstreams/{ws_id}/rewind ({turns:N}) and /retry, as make_rewind_handler/make_retry_handler in SharedSessionVerbHandlers (template: make_close_handler/make_cancel_handler), wired on both interactive and coordinator kinds. Closes the last unlifted conversation-modifying surface — coordinator workstreams gain rewind/retry where they had none — and removes the surviving exception to the post-#422 path-keyed URL convention. Handler shape: auth gate (coord -> admin.coordinator via permission_gate; interactive -> conversation.modify via accepted_permissions) -> busy-gate -> session.rewind(n)/retry() -> always emit clear_ui (incl. rewind-to-zero, carries #503) -> audit (conversation.rewind/retry on both kinds). Retry re-dispatch reuses the shared session_worker.send via a per-kind dispatch_retry closure (hard-reject on busy), not a third hand-rolled thread. The web /command handler now rejects /rewind+/retry with a pointer to the path-keyed endpoint (BREAKING; 1.6.0aN-tolerant); session.handle_command's branches stay for the terminal CLI. auth.py adds the verbs to both write suffix-sets; Python + TS SDKs, OpenAPI (RewindRequest + server/console specs), the /route/ proxy mounts + audit actions, and coordinator_client all gain them. Interactive frontend (app.js): the 3 /command POST sites + the hand-typed-slash reroute now hit the path-keyed endpoints; the bare .msg.user rewind selector is kept (matches the server's _find_turn_boundaries, which counts system-nudge user turns). The coordinator frontend rewind UX lands in a follow-up commit (browser-verified). Tests: route-walk mount/order, /route/ audit rows, required_scope, OpenAPI catalog, SDK body-inspection, and HTTP-level handler behavior (busy-gate, turns validation, clear_ui emit, retry dispatch, audit invocation + swallow).	2026-05-28 21:02:51 -07:00
Patrick Buckley	20e1e7b110	fix(reasoning): apply Copilot review feedback + docs sync ... PR #498 round-robin review surfaced 5 findings. 4 applied; 1 rejected with rationale. Applied * **Copilot finding 5** (history_decoration.py:341): dispatcher inspected only ``provider_content[0]['type']``. OpenAI Responses captures EVERY ``output_item.done`` event into ``provider_blocks`` (not just reasoning) — in practice the order is ``[reasoning, message, ...]`` but the API doesn't guarantee that; a hypothetical ``[message, reasoning]`` ordering would silently drop the reasoning under an index-only check. Now walks the list for the first block whose type is in ``_BLOCK_TYPE_PROVIDER_FACTORY``, then dispatches the WHOLE list to that provider's extractor. Each provider's extractor already filters internally by its own block type, so passing the full list is correct. Regression test added (``test_dispatcher_scans_past_unrecognized_first_blocks``). * **Copilot finding 3** (migration 052 docstring): the previous review-fix wave used sed to rename ``persist_reasoning`` → ``surface_persisted_reasoning`` everywhere, which mangled a historical reference in the migration docstring ("The earlier name ``surface_persisted_reasoning`` was renamed..."). Restored to point at the actual pre-rename name (``persist_reasoning``). * **Copilot finding 4** (sdk/typescript/src/events.ts:26): ``HistoryEvent`` JSDoc still referenced ``persist_reasoning`` — the sed rename only walked ``turnstone/`` and ``tests/``, missing the TypeScript SDK. Updated to ``surface_persisted_reasoning``. Also widened the comment to cover all three reasoning-bearing block types (Anthropic ``thinking``, OpenAI Responses ``reasoning``, synthetic ``reasoning_text``) instead of mentioning only Anthropic. * **github-code-quality finding** (session.py:1120): ``_resolve_server_type`` had a bare ``except Exception: pass``. Replaced with a ``log.debug(..., exc_info=True)`` + explanatory comment. Behaviour unchanged (still returns ``""`` on any lookup failure); failures are now observable under DEBUG triage. Rejected (with rationale) * **github-code-quality finding** (_protocol.py:265): ``extract_reasoning_text``'s body is ``...`` per ``LLMProvider`` Protocol convention. Every method in the file uses ``...`` (PEP 544 idiomatic Protocol style). Changing only this one to ``raise NotImplementedError`` would be inconsistent with the rest of the file. CodeQL's "statement has no effect" warning is technically correct for ``...`` as a standalone expression but ignores the documented Python Protocol convention. No fix. Docs sync * docs/api-reference.md: ``history`` SSE event message-shape table gains the optional ``reasoning`` field. * docs/architecture.md: ``ModelCapabilities`` row in the type table gains ``supports_reasoning_replay``; ``StreamChunk`` and ``CompletionResult`` rows gain the existing ``provider_blocks`` field (was missing pre-PR). New "Per-model reasoning persistence" subsection under the Models config section, documenting the two flags + capability gate + three reasoning paths + cross-provider shape filter. * docs/settings.md: new "Reasoning persistence (per-model)" subsection with the two-flag table and capability-gate note. * docs/diagrams/03-core-engine-classes.puml: ``LLMProvider`` interface adds ``extract_reasoning_text`` + the new ``replay_reasoning_to_model`` kwarg; ``ModelCapabilities`` class adds ``supports_reasoning_replay``. PNG regenerated. Lint + test gate * ruff check + ruff format clean. * mypy clean (191 source files). * pytest -m 'not live' — 6116 passed (3 deselected), +1 net new test (``test_dispatcher_scans_past_unrecognized_first_blocks``).	2026-05-09 02:45:13 -07:00
Patrick Buckley	1873e7a758	feat(reasoning): persist reasoning text on history payload (Phase 1) ... Surface stored Anthropic thinking blocks on /history responses so refreshing the page rehydrates the reasoning bubble. Wire payloads unchanged. Per-model operator knobs added to model_definitions for both UI rehydration and (Phase 2) wire-build replay. Why now: reasoning is already round-tripped via _provider_content for Anthropic-with-thinking turns, but never surfaces on the history wire, so a tab reload showed only the final answer with no rationale. Operators also have no per-model lever to opt out of UI display or to opt in to replay-to-model on subsequent calls. What this change does * Migration 052 adds two boolean columns to model_definitions: persist_reasoning (default 1) controls UI rehydration; replay_ reasoning_to_model (default 0) reserved for Phase 2's wire-build shape filter. Mirrors the enabled column pattern (NOT NULL + integer server_default). * LLMProvider Protocol gains extract_reasoning_text(provider_blocks) with concrete impls on AnthropicProvider (walks type=='thinking' blocks, joins with newline, caps at 64 KiB) and no-op stubs on OpenAIChatCompletionsProvider + OpenAIResponsesProvider. Google inherits the no-op via OpenAIChat. Phase 3 will wire the OpenAI Responses extractor once include=['reasoning.encrypted_content'] is requested. * turnstone.core.history_decoration gains a structural dispatcher extract_reasoning_text_from_provider_content keyed off the first block's type field (Anthropic 'thinking' / OpenAI Responses 'reasoning' / Gemini 'thought' are non-overlapping by API design). Both history surfaces use it: _build_history calls the dispatcher directly (the SSE-replay path builds entry dicts from scratch), and the lifted make_history_handler runs the list-helper variant in the existing to_thread block. * make_history_handler resolves persist_reasoning via three tiers: live session -> workstream_config.model_alias (the same key SessionManager uses to rehydrate the original model after process restart) -> conservative True default. Operator flag-flip takes effect uniformly on both warm and cold workstreams. * Frontend: app.js replayHistory and coordinator.js role==='assistant' branch each call the existing reasoning-bubble construction (for app.js, the document.createElement pattern from the live SSE handler; for coord, the appendMsg('reasoning') helper) when msg.reasoning is non-empty. Reasoning bubbles render before the content bubble, matching live SSE order. * Admin UI: two checkboxes ('Persist reasoning', 'Replay reasoning to model') in the model edit modal, plus override-pill display in the model row when set to non-default values. What is intentionally out of scope * Phase 2 -- ANTHROPIC_VALID_BLOCK_TYPES shape filter at _anthropic.py:312-316, _convert_messages replay_reasoning_to_model parameter, thinking-strip branch, _msg_text_chars token-calibration extension. The replay flag is stored but not consumed on the wire. * Phase 3 -- OpenAI Responses include=['reasoning.encrypted_content'], Gemini include_thoughts spike, ModelCapabilities.supports_ reasoning_replay. * Phase 4 -- Local-model / chat-template reasoning persistence (session.py:3486 reasoning_parts accumulator). Tests * AnthropicProvider.extract_reasoning_text -- 13 unit tests covering None / empty / mixed / multi-block / cap / malformed / non-list inputs plus other-provider no-op verification (real provider instances, no mocks). * extract_reasoning_for_history -- 10 dispatcher tests including block-type discriminator routing (thinking vs reasoning vs unknown), strip-when-flag-false, empty / non-dict guards, and cross-role isolation. * _build_history -- 6 boundary tests through the real Anthropic extractor with stub sessions, including the registry-lookup failure default-True branch. * make_history_handler -- 5 round-trip tests through real storage: the storage layer's reconstruct_messages decodes provider_data into _provider_content, and the helper extracts through the real AnthropicProvider. Includes the live-session flag honoring path, the cold-workstream workstream_config lookup path, and the no-alias default-True fallback path. * Audit-log discipline -- 4 structural mock-and-assert tests that capture every Logger.info / warning / error call across the pipeline (extractor, dispatcher, list-helper, _build_history) and assert no captured payload contains a marker reasoning string. * model_definitions storage -- 6 round-trip tests: default flags, explicit create with both flags, individual update of each flag, and list-includes-flags assertion. * model_registry -- 4 tests: dataclass defaults, dataclass with explicit flags, DB-row-mapping with both flags, and pre-052 legacy-row default-fallback. Edge cases pinned by the test suite * Pre-052 DB rows missing the new columns degrade to dataclass defaults (test_db_reasoning_flags_default_when_absent). * Live session in memory has its flag honored (test_history_handler_ with_persist_flag_false_via_live_session). * Cold workstream resolves the flag via workstream_config + app.state.registry (test_history_handler_cold_workstream_resolves_ via_workstream_config) -- this closes the gap where a process restart would have silently un-honored an operator flag-flip. * Cold workstream without persisted model_alias falls through to default True (test_history_handler_cold_workstream_no_alias_ defaults_true). * Foreign / unknown / missing block types degrade silently to no reasoning field rather than misroute or crash. Lint + test gate * ruff check + ruff format -- clean. * mypy -- no issues across all 191 source files. * pytest -m 'not live' -- 6030 passed (3 deselected).	2026-05-09 02:45:13 -07:00
Patrick Buckley	29b850919f	feat(sse): refresh-resume for mid-stream page reloads ... Refreshing a coordinator or interactive workstream pane while the LLM is mid-stream now restores the partial assistant text + reasoning immediately and flips the composer back to stop-mode, instead of showing nothing until the response completes. Per-turn inflight buffers (`_ws_inflight_content`, `_ws_inflight_reasoning`, `_ws_inflight_seq`) on `SessionUIBase` are kept separate from the existing multi-turn `_ws_turn_content` buffer that drives the dashboard's IDLE-piggyback payload. New `on_turn_start` (top of send-loop, defensive) and `on_turn_committed` (right after `messages.append(assistant_msg)`, primary) lifecycle hooks reset inflight at turn boundaries. The seq counter is monotonic across turns so a long-lived subscriber's `snap_seq` cutoff stays valid for the lifetime of the connection — resetting per-turn would silently drop turn N+1's first M tokens (M = whatever was streamed pre-snapshot in turn N). `snapshot_and_consume_state_payload` also drains inflight at idle/error so cancel and exception paths don't leak stale text. New `register_listener_with_in_progress_snapshot` atomically registers a listener and snapshots the inflight buffers; `make_events_handler` emits a `state_change` event (so the JS busy machine flips to stop-mode) followed by a one-shot `in_progress_snapshot` after the kind-specific replay, then strips the internal `_seq` field from yielded live events while filtering against `snap_seq`. A per-listener shallow `dict` copy in the live drain prevents the multi-tab race where one listener's `del event["_seq"]` would corrupt another listener's filter view. `_synthesize_cancelled_results` now emits synthetic `on_tool_result` events for each cancelled tool so live coord tabs can drop the newly-additive `coord-tool-batch--running` indicator cleanly. The indicator now coexists with `--auto`/`--approved` (applied on `tool_info` and `approval_resolved` approved; removed when every row in the batch has a result), making live tool execution visually parallel to the replay-time orphan rendering. Frontend handlers in `app.js` (interactive) and `coordinator.js` (coord) absorb EventSource auto-reconnect re-replays via a length-based prefix check on the in-progress buffer. New `InProgressSnapshotEvent` + `StateChangeEvent` dataclasses in the Python and TypeScript SDKs with type guards. `_MAX_TURN_CONTENT_CHARS` lifted 256 KiB → 512 KiB (single constant for both buffers — headroom for current commercial models). Regression tests cover race-free composition under concurrent writers, seq-filter dedup invariants, the cross-turn seq monotonic invariant, idle/error inflight drain, synthesized `on_tool_result` on cancel (including UI-hook failure isolation), and the multi-listener shared-dict invariant.	2026-05-08 18:23:38 -07:00
Patrick Buckley	5874159ffd	fix(close): require non-empty body, restore CloseWorkstreamRequest ... Copilot caught three real issues in PR #422 review, all clustered around the close request body contract: 1. The interactive close handler runs with ``supports_close_reason=True``, which calls ``read_json_or_400(request)`` — an empty / non-JSON body returns ``400 {"error": "Invalid JSON body"}``. The previous SDK fix sent NO body via ``json_body=None``, which would 400 against a real server. The mock-transport test silently masked it because the mock answered without inspecting the body. 2. The doc said the body was empty (or ``{}``), with no mention of the optional ``reason`` field, its 512-byte cap, or the credential-redaction guard. 3. The Pydantic schema for close was deleted outright; OpenAPI and SDKs lost their typed shape for the optional ``reason``. Changes: - ``turnstone/api/server_schemas.py``: reintroduce ``CloseWorkstreamRequest`` with a single optional ``reason: str | None = None`` field. Docstring documents the must-be-valid-JSON contract and notes that coord ignores the body (``supports_close_reason=False``). - ``turnstone/api/server_spec.py``: re-import the schema, point the close ``EndpointSpec`` at it via ``request_model=``, restore the ``_ALL_MODELS`` entry. OpenAPI JSON regenerated. - ``turnstone/sdk/server.py``: ``close_workstream`` (sync + async) gains an optional ``reason: str | None = None`` parameter and always sends ``json_body={}`` (or ``{"reason": ...}``) so the body is never empty. Adds a regression test (``test_close_workstream_sends_valid_json_body``) that inspects the raw transport content rather than relying on a path-keyed mock — the kind of check that would have caught this bug pre-merge. - ``sdk/typescript/src/server.ts``: ``closeWorkstream`` gains an optional ``opts.reason`` parameter; reintroduce ``CloseWorkstreamRequest`` interface in ``types.ts`` and re-export from ``index.ts``. - ``docs/api-reference.md``: close section documents the JSON-body requirement, the ``reason`` field, the 512-byte cap, the multibyte-safe behavior, the credential-redaction guard, and the non-string-coercion path. - ``CHANGELOG.md``: amend the 1.5.0 BREAKING block to reflect the schema reintroduction (slim form, ``reason`` optional) instead of the prior "removed outright" claim. 4558 tests passing under ``-m "not live"`` (was 4557 — +1 from the regression test). ruff + mypy clean.	2026-04-26 22:14:22 -07:00
Patrick Buckley	d6e615d324	fix: apply /review feedback on legacy URL cleanup ... Reviewer caught real misses on the consumer-swap claim: - TypeScript SDK still defined and re-exported `CloseWorkstreamRequest` (types.ts + index.ts) — drop both. Now matches the Python-side removal. - Four `tests/test_auth.py` cases (`test_write_full_token_ok`, `test_approve_full_token_ok`, `test_bearer_takes_precedence_over_cookie`, `test_cookie_full_on_write_ok`) were tautological after the legacy URL removal: they posted to `/api/send` / `/api/approve` and asserted `allowed is True`, but those paths now classify as `read` so a read token would also pass — they no longer tested the write/approve scope enforcement. Swap to path-keyed URLs to restore the original intent. - `is_public_path("/api/send")` test renamed + retargeted to a path-keyed URL. Doc-table drift the previous commit missed: - `docs/security.md` path-to-scope mapping rewritten for the path-keyed verb family (write set, DELETE-on-/send dequeue, per-ws_id approve). - `docs/architecture.md` scope-model row text swap from `/api/send` / `/api/approve` to the path-keyed equivalents. - `docs/diagrams/01-system-context.puml` channel→server edge label swap. - `docs/diagrams/15-auth-architecture.puml` scope class swap. Cosmetic comment-only stragglers: - `tests/test_session_worker.py` module docstring URL update. - `tests/test_ratelimit.py` ~11 `/api/send` fixture-key strings retargeted to `/api/workstreams/abc/send` so the URL fixtures reflect the post-1.5 surface (rate limiter is path-agnostic; the swap is purely cosmetic). 4557 tests still passing under -m "not live"; ruff + mypy clean.	2026-04-26 22:14:22 -07:00
Patrick Buckley	3ea6fb30b4	refactor(consumers): swap UI/SDK/console-proxy/channels to path-keyed URLs ... All in-tree consumers of the legacy /v1/api/send | /approve | /cancel | events?ws_id= | /workstreams/close URLs now hit the path-keyed shape under /v1/api/workstreams/{ws_id}/<verb>. Bodies drop ws_id (the path provides it). The SSE event stream URL likewise moves to the path-keyed form; channel adapters drop the params={"ws_id": ...} kwarg on aconnect_sse. Touched: - turnstone/ui/static/app.js: 7 call sites (send×3, dequeue, approve, cancel, close + EventSource SSE URL). - turnstone/sdk/server.py (Python SDK): close_workstream, send, approve, cancel, stream_events, send_and_wait's internal SSE consumer. - sdk/typescript/src/server.ts: closeWorkstream, send, approve, cancel, streamEvents + sendAndWait's internal SSE consumer. - turnstone/sdk/console.py: route_send, route_approve, route_close, route_cancel — proxy URLs swap to /v1/api/route/workstreams/{ws_id}/<verb>. route_plan_feedback / route_command remain body-keyed (out of scope). - turnstone/console/server.py: - Proxy mount table swaps the four legacy /api/route/{send,approve, cancel,workstreams/close} mounts for path-keyed equivalents under /api/route/workstreams/{ws_id}/<verb>; /send accepts both POST and DELETE for dequeue. - route_proxy reads ws_id from path_params (with body-fallback for the surviving plan/command body-keyed mounts), uses client.request(request.method, ...) so DELETE on /send proxies through correctly, and audits DELETE-on-/send as a separate "route.workstream.dequeue" action via _ROUTE_PROXY_AUDIT_ACTIONS. - Internal `method` variable renamed to `verb` to avoid confusion with HTTP method now that the two diverge. - turnstone/channels/_sse.py: SSE URL builder swaps to path-keyed. - turnstone/channels/{discord,slack}/bot.py: docstring URL updates. - turnstone/server.py, turnstone/core/session_worker.py, turnstone/sdk/events.py, turnstone/api/server_spec.py: comment / docstring URL updates only. Test fixtures still reference legacy URLs and will be swapped in step 5 of this PR.	2026-04-26 22:14:22 -07:00
Patrick Buckley	6572437c5d	refactor(server): rename dashboard row id → ws_id for v1 row-shape consistency ... The /v1/api/dashboard endpoint was the last workstream-listing surface keyed on `id` rather than `ws_id`. The Stage 2 list-verb lift converged the active list (`/v1/api/workstreams`) and saved list (`/v1/api/workstreams/saved`) on `ws_id` but explicitly left dashboard alone to keep that PR's diff focused. This lands the same rename on the remaining endpoint so v1 row shape is consistent across the family. Scope kept narrow: - Pydantic `DashboardWorkstream` and TS SDK `DashboardWorkstream` interface both rename `id: str/string` → `ws_id`. - The bundled web UI (`turnstone/ui/static/app.js`) is the only consumer reading `dashboard.workstreams[].id` and is updated atomically. - Console `_fetch_live_block` (cluster-inspect's projection over a remote node's dashboard payload at `turnstone/console/server.py`) flips its `entry.get("id")` lookup to `entry.get("ws_id")`. - Drive-by: stale `id` example in `docs/api-reference.md` for the earlier `/v1/api/workstreams` rename also fixed. `_build_node_snapshot` (the global-events SSE node_snapshot payload consumed by the cluster collector) deliberately stays on `id` — it's part of a separate cluster-row family (collector → cluster_workstreams → console UI) that is internally consistent on `id` and would need its own coordinated sweep. CHANGELOG documents the bounded blast radius. Tests: 4554 passing (-m "not live"). ruff + mypy clean.	2026-04-26 20:00:45 -07:00
Patrick Buckley	d555816016	refactor(core): lift history + detail verb bodies across both kinds (Stage 2 verb lift) ... Last verb-shape lift before v1.5.0 stable can tag. Adds two new factories to ``turnstone/core/session_routes.py``: - ``make_history_handler(cfg)`` — body lifted from coord's ``coordinator_history`` near-verbatim. ``?limit=`` query param defaults to 100, clamps to [1, 500], malformed values fall back to 100. Storage operations (``get_workstream`` on the storage-fallback path, ``load_messages`` for the row read) now run via ``asyncio.to_thread`` (was inline pre-lift on coord). - ``make_detail_handler(cfg)`` — body lifted from coord's ``coordinator_detail``. Lazy-rehydrates a closed/evicted workstream via ``mgr.open()`` on miss; mirrors :func:`make_open_handler`'s exception envelope (``ValueError`` → 503 with the session-factory's remediation text; bare ``Exception`` → correlation_id'd 500 with the per-kind noun via ``cfg.audit_action_prefix``). NO new ``SessionEndpointConfig`` fields — the factories reuse ``permission_gate``, ``manager_lookup``, ``not_found_label``, ``audit_action_prefix``, and (for history's storage-fallback kind check) ``list_kind`` — all already wired by both production lifespans for the list/saved factories. Coord side: ``coordinator_history`` and ``coordinator_detail`` standalone handler bodies removed from ``console/server.py``; ``register_session_routes`` now wires ``history=make_history_handler(coord_endpoint_config)`` and ``detail=make_detail_handler(coord_endpoint_config)``. Interactive side: GAINS both endpoints as a feature gain. Pre-lift interactive had no ``GET /v1/api/workstreams/{ws_id}`` and no ``GET /v1/api/workstreams/{ws_id}/history`` — SDK consumers had to subscribe to ``/events`` SSE just to read display fields or message rows. The same lifted factories are wired with the interactive endpoint config; cross-kind isolation is preserved on both sides (history via ``cfg.list_kind`` storage-fallback gate + fail-loud-on-misconfig 500; detail via ``mgr.open()``'s internal kind check). Pydantic schemas: ``CoordinatorDetailResponse`` / ``CoordinatorHistoryResponse`` removed from ``console_schemas.py``; ``WorkstreamDetailResponse`` / ``WorkstreamHistoryResponse`` added to ``server_schemas.py`` (mirrors the list lift's pattern for ``WorkstreamInfo``). Both server and console OpenAPI specs reference the unified schemas; ``server_spec.py`` gains ``EndpointSpec`` entries for the new interactive endpoints. TS SDK gains both interfaces in ``sdk/typescript/src/types.ts``; ``openapi-{server,console}.json`` regenerated. Tests: 6 new coord regression/parity tests in ``test_coordinator_endpoints.py`` (limit clamping, cross-kind 404 on storage fallback, storage-only history, detail 503 on session-factory misconfig, detail 500 with correlation_id on unexpected rehydrate failure, history swallows ``load_messages`` exception → 200 with empty messages). 10 new interactive parity tests in ``test_workstream_endpoints.py`` (``TestHistoryInteractive`` + ``TestDetailInteractive``). 1 new openapi spec test pinning the server-side ``?limit=`` query param. Total: ``4490 → 4491`` after the new exception-swallow regression test landed. ``ruff check`` clean, ``mypy`` clean on touched files. /review pipeline (4 finders → verify → dedupe) caught 1 Minor defense-in-depth (bug-1/sec-1, merged: ``make_history_handler`` fail-closed gate when ``cfg.list_kind is None``, mirroring ``make_saved_handler``'s same gate) + 1 Minor test-helper rename (q-1: ``_interactive_history_cfg`` → ``_interactive_endpoint_cfg``) + 4 Nits (q-2 unused fixture parameter, q-3 CHANGELOG TS SDK mention, q-4 missing exception-swallow regression test, q-5 misleading test comment) — all addressed in the same commit.	2026-04-26 15:48:26 -07:00
Patrick Buckley	edf52016ac	refactor(core): lift list + saved verb bodies across both kinds (Stage 2 verb lift) ... New ``make_list_handler(cfg)`` and ``make_saved_handler(cfg)`` factories in ``turnstone/core/session_routes.py`` replace four pre-lift bodies (interactive ``list_workstreams`` + ``list_saved_workstreams``; coord ``coordinator_list`` + ``coordinator_saved``). Same factory + capability-flag pattern as the merged cancel / open / events / create lifts. Four new ``SessionEndpointConfig`` fields: - ``list_resolve_titles: ListResolveTitles | None`` — bulk lookup ``(ws_ids) -> {ws_id: title-or-None}``. Interactive wires ``get_workstream_display_names`` (new bulk helper added on the storage layer + memory.py); the lifted body resolves every active row in ONE ``SELECT ... WHERE ws_id IN (...)`` instead of the pre-lift N+1 (one SELECT per row). - ``list_kind: WorkstreamKind | None`` — explicit kind classifier for the saved-list storage filter. Replaces the initial draft's ``audit_action_prefix == "coordinator"`` string compare which would have silently leaked INTERACTIVE rows for any future kind whose audit prefix didn't match. Required when a kind mounts list/saved; misconfig surfaces as a 500 with a clear log line. - ``saved_state_filter: str | None`` — coord wires ``"closed"``; interactive wires ``None``. - ``saved_loaded_lookup: SavedLoadedLookup | None`` — coord-only defence-in-depth filter that excludes ws_ids in the warm pool. Behaviour changes (all observable in CHANGELOG): - **Active-list row shape converges on always-include** ``{ws_id, name, state, kind, parent_ws_id, user_id}``. Interactive renames ``id`` → ``ws_id``; both kinds populate every field (coord adds kind + parent_ws_id; interactive adds user_id). - **Top-level response key converges on ``"workstreams"``** on both endpoints. Coord ``coordinators`` key removed — coord is a 1.5.0aN-only surface (never shipped stable) so the convergence has no compat shim; SDK / frontend consumers swap once. - **Storage + manager-lock work moved off the event loop on interactive**. ``list_workstreams_with_history`` runs through ``asyncio.to_thread`` on both kinds (matches coord's pre-existing perf-2 pattern from the saved-coordinators review); ``mgr.list_all`` + per-row work also offloaded. - **N+1 storage round-trips on /v1/api/workstreams eliminated**. Pre-lift interactive resolved the alias for every active row in a separate SELECT (up to 50 round-trips per dashboard refresh on a saturated node). Lifted body issues one bulk SELECT. Pydantic schemas: ``WorkstreamInfo.id`` renamed → ``ws_id``, ``WorkstreamInfo.user_id`` field added. ``CoordinatorInfo`` and ``CoordinatorListResponse`` removed (folded into the unified ``WorkstreamInfo`` / ``ListWorkstreamsResponse``). OpenAPI spec snapshots regenerated. TS SDK types updated (``WorkstreamInfo`` interface gains ws_id + the always-include fields); TS test mock + assertion updated to match. ``GET /v1/api/dashboard`` is intentionally NOT in this PR's scope and still returns rows keyed on ``id``. Tracked as a separate cleanup PR (tombstone-note added at the dashboard handler). /review pipeline run; the four Major findings + one Minor + six nits all addressed in the same commit: - M1: TS SDK ``WorkstreamInfo`` interface stale (id: string) → renamed + fields added. - M2: TS SDK test masked the type-mismatch with stale mock → updated. - M3: N+1 alias resolution on active list → bulk ``get_workstream_display_names`` helper + ``list_resolve_titles`` bulk cfg hook. - M4: Missing interactive parity regression test for unified row shape → mirror of coord's added in test_server_authz.py. - Mi1: ``audit_action_prefix`` string-compare deriving kind → explicit ``cfg.list_kind: WorkstreamKind`` field. - Six nits: redundant inner asyncio import, forward-ref quotes on Awaitable, duplicated frontend comments, dashboard ``id`` field has no tombstone-note, empty-coord_mgr short-circuit on ``saved_loaded_lookup``. 4512 tests passing; ruff + mypy clean.	2026-04-26 13:11:07 -07:00
Patrick Buckley	7c16b0dfa8	refactor(routing): replace hash-ring rebalancer with rendezvous (HRW)… (#384) ... * refactor(routing): replace hash-ring rebalancer with rendezvous (HRW) hashing Routing was a stored bucket table maintained by a central rebalancer daemon, which shared its liveness primitive (services.last_heartbeat) with the collector — when a heartbeat-fresh node went into a zombie HTTP-handler-broken state, neither the collector nor the rebalancer could self-correct, and the router kept directing traffic at it. Rendezvous hashing makes the route a pure function of (ws_id, live_services) so the heartbeat is the single source of truth and any liveness-eviction propagates to the next route call without a separate state-publication step. The rebalancer's central state has no analogue: the new router computes the per-key node winner on every call, the collector pushes membership updates into the router cache from its discovery thread, and per-route overrides survive on workstream_overrides. Eager workstream migration goes away; in-flight workstreams lazily rehydrate from storage on the new owner — already the dead-node behaviour. * fix(tools): describe rendezvous re-routing on spawn/inspect node_id The first pass overclaimed `node_id` "stays canonical for this workstream's lifetime" — under rendezvous routing the active owner re-derives per-call from live membership, so a node join/drop after spawn can shift it. Tool descriptions now say `node_id` is the spawn-time binding; subsequent ops re-route via rendezvous over the current live-node set; the new owner lazily rehydrates from shared storage; coordinators should re-read with inspect_workstream rather than caching the value.	2026-04-18 19:02:52 -07:00
Patrick Buckley	9826ea15c5	feat(coordinator): phase 7 — governance + skill metadata + cross-cutt… (#383) ... * feat(coordinator): phase 7 — governance + skill metadata + cross-cutting invariants Combines three stacked sub-PRs into a single coordinator phase-7 shipment against the phase-7 plan doc. The sub-PR structure (0 / A / B) preserved on individual branches for reviewer drill-down; this branch is the one reviewers should merge. ## Sub-PR 0 — service-auth boundary invariants Shared helpers and contracts that lock the console ↔ node service-auth boundary so later authz surfaces use them by construction. - ``_effective_user_filter(request)`` in both ``turnstone.console.server`` and ``turnstone.server`` with a shared ``DENY_EMPTY_SUB`` sentinel on ``turnstone.core.auth``. Three-way return — admin/service bypass, scoped caller uid, or fail-closed sentinel on blank sub. Four callsite migrations (``_coordinator_rows``, ``coordinator_children``, ``coordinator_metrics``, ``cluster_ws_live_bulk``). - ``StorageBackend`` class docstring codifies the tenancy contract (every list/count/aggregate method must accept ``user_id: str | None = None`` and push ``WHERE user_id = :user_id`` into SQL) and the ``_mapping`` row-access contract. New ``turnstone.testing.row_contract`` ships ``assert_row_like()``. - ``_verify_collector_service_scope`` probes an upstream node at boot with ``expected_node_id=_scope-probe_``; a 409 proves the scope gate was passed, a 403/401 sets ``collector_scope_error`` and causes ``cluster_snapshot`` / ``cluster_events_sse`` to return 503 with a remediation hint. Probe URL allowlist rejects non-http(s) schemes and 169.254.0.0/16 hosts. - 4xx log-level floor on ``_NodeDashboardCache.get``, ``_fetch_live_block``, and ``_proxy_sse`` — dotted-hierarchy prefixes with bounded body previews. ``_bounded_body_preview`` and ``_bounded_stream_preview`` strip control chars. ## Sub-PR A — coordinator governance core Mid-session governance surface for coordinator workstreams. - **Trusted-session mode.** New ``coordinator.trust.send`` permission (migration 042). ``ChatSession.set_trust_send`` / ``revoke_tools`` methods with a ``_governance_lock``. ``POST /v1/api/coordinator/{ws_id}/trust {send: bool}`` double-gated on ``admin.coordinator`` AND ``coordinator.trust.send`` with ``allow_service_bypass=False`` so service tokens can't escalate. ``_prepare_send_to_workstream`` auto-approves sends whose target is in the coordinator's own subtree; foreign ws_ids still require approval. ``_is_own_subtree`` checks both ``parent_ws_id`` AND ``user_id`` to defend against cross-tenant row corruption. - **Audit-layer credential redaction.** ``record_audit`` walks ``detail`` (dicts, lists, tuples, sets, frozensets; keys too) and routes every string through ``redact_credentials`` + a C0 control-char scrub. New kw-only ``raw_detail=True`` opt-out. ``_has_any_string`` fast-path. Audit action registry extended with the four new governance sub-prefixes. - **Mid-session revocation + cascading stop.** ``POST /v1/api/coordinator/{ws_id}/restrict {revoke: [...]}`` caps 256 entries / 128 chars; ``_prepare_tool`` short-circuits with a tool-error. ``POST /v1/api/coordinator/{ws_id}/stop_cascade`` cancels the coord's in-flight generation then dispatches ``cancel_workstream`` for every direct child in parallel via ``asyncio.gather`` bounded by ``Semaphore(16)``. Per-child outcomes split into ``cancelled`` / ``failed`` / ``skipped`` (404 = already-gone rather than dispatch-broken). Both endpoints apply ``allow_service_bypass=False`` on the admin gate. - **Shared plumbing.** ``_resolve_coord_session`` helper collapses the handler prelude three endpoints shared. ``_emit_coord_audit`` wraps ``record_audit`` in a dedicated ``ThreadPoolExecutor`` (``app.state.audit_executor``) so audit bursts don't starve cancel dispatches. ``_require_json_object`` guards body parsing so non- object JSON returns 400 instead of 500. ## Sub-PR B — skill metadata governance - **Description validator (migration 043).** ``prompt_templates`` rows now require a non-empty ``description``. Existing empty rows get backfilled with a ``"Skill: <name>"`` placeholder on upgrade. The installer (``admin_skill_discover``) and MCP prompt sync both synthesise a placeholder when the upstream description is blank so non-admin write paths satisfy the invariant. - **Skill kind classifier (migration 044).** New ``prompt_templates.kind`` column (``interactive`` / ``coordinator`` / ``any``; defaults to ``any``). New ``turnstone.core.skill_kind.SkillKind`` StrEnum is the single source of truth; Pydantic schemas type ``kind`` as ``SkillKind`` (OpenAPI advertises the enum) and the handler validator catches the ValueError. ``list_skills_filtered`` gains a ``kinds: list[str] | None = None`` SQL filter. ``CoordinatorClient.list_skills`` defaults to ``kinds=["coordinator", "any"]`` so interactive-only skills are hidden from the orchestrator. - **``scan_status`` → ``risk_level`` rename (migration 045).** Lossless column rename to align with ``IntentVerdict.risk_level`` terminology. Swept storage (both backends + schema + protocol), handlers, API schemas, tool JSON, generated OpenAPI specs, TypeScript SDK types, frontend (``governance.js``), tests, and English prose in ``docs/judge.md`` + ``docs/tools.md``. The user-facing on-load warning now reads ``has risk level: {risk_tier}``. Tool JSON's ``risk_level`` enum corrected to the scanner's actual taxonomy (``safe / low / medium / high / critical``; was the never-shipped ``clean / flagged / unscanned / pending``). Historical migration 021 left untouched. ## Migrations 042 (``coordinator.trust.send`` perm — PR A) 043 (description backfill — PR B) 044 (``kind`` column add — PR B) 045 (``scan_status`` → ``risk_level`` rename — PR B) All four use position-anchored permission strings / host-side parse-filter-rejoin on downgrade where SQL ``REPLACE`` could corrupt prefix-overlapping values. ## Verification - ``ruff check turnstone tests`` clean. - ``mypy turnstone`` clean on 165 source files. - ``pytest -m "not live"``: 4431 passed (+85 over the phase-6 baseline). Includes +32 tests in ``tests/test_service_auth_boundary.py`` and +38 in ``tests/test_coordinator_governance.py``; shared fixtures extracted to ``tests/_coord_test_helpers.py``. - Generated OpenAPI JSON (``sdk/typescript/openapi-{console,server}.json``) regenerated via ``sdk/typescript/scripts/generate-types.py``; zero ``scan_status`` occurrences remaining outside the historical migration 021 and the rename migration 045. ## Security reviews Both reviews flagged by the phase-7 plan (items 1 + 5, plus 0a's refuse-to-serve gate) ran through the multi-stage ``/review`` pipeline twice per sub-PR; all confirmed findings landed in-branch. * fixup(phase-7): CI lint + PR #383 review fixups Addresses the lint CI failure (ruff format) plus 12 findings from the two automated PR reviewers. Copilot: - ``_sqlite.list_installed_skill_urls`` / ``_postgresql.list_installed_skill_urls`` used positional row indexing (``r[0]``/``r[1]``/``r[2]``) while this same PR's ``StorageBackend`` class docstring forbids it. Switched both to ``r._mapping["..."]`` access. - ``list_skills.json`` previously advertised ``risk_level=""`` as a filter for unscanned skills, but the implementation treats empty strings as "no filter". Clarified the tool description to say omit the filter entirely to include unscanned rows, and added an explicit ``enum`` on the parameter restricting it to the scanner tiers. ``_prepare_list_skills`` keeps the ``strip() or None`` normalisation — unscanned filtering now has an unambiguous contract. - ``test_storage_skills_filtered.test_risk_level_filter`` used the legacy ``clean`` / ``flagged`` values from the pre-rename column. Rewritten with the scanner's actual taxonomy (``safe`` / ``high``). github-code-quality (CodeQL): - ``test_deny_sentinel_is_singleton`` previously asserted ``cs.DENY_EMPTY_SUB is cs.DENY_EMPTY_SUB`` — an identical-expression comparison. Rewritten as two separate ``from ... import ... as`` aliases (``FIRST_READ`` / ``SECOND_READ``) so the identity check is between distinct bindings. - ``test_restrict_empty_revoke_is_noop_but_audits`` unpacked ``state`` without using it. Renamed to ``_state``. - Mixed import styles in ``test_service_auth_boundary.py`` — the file previously used both ``import turnstone.console.server as cs`` and ``from turnstone.console.server import ...`` for the same module (same story for ``turnstone.core.auth`` and ``turnstone.server``). Consolidated to the ``from X import Y`` style used elsewhere in the file; the ``_fetch_live_block`` test now patches via pytest's ``monkeypatch`` fixture instead of a manual rebind through a module alias. CI: - ``ruff format`` reformatted one line in ``tests/test_coordinator_endpoints.py``. Verification: ruff check + mypy clean (166 files); 4459 non-live pytest pass. * fix(tests): swap asyncio marker for anyio in service-auth boundary tests PR #383 CI caught that the 13 ``@pytest.mark.asyncio`` decorators I added in ``test_service_auth_boundary.py`` are an off-convention choice — the rest of the repo uses ``@pytest.mark.anyio`` (148 sites vs my 13). The CI environment pulls in ``anyio`` but not ``pytest-asyncio``, so every async test in this one file was failing with "async def functions are not natively supported". It passed locally by accident — my dev venv happens to have pytest-asyncio installed ambiently. Swapped all 13 marker sites to ``@pytest.mark.anyio``. No functional change; the tests run under the same default asyncio backend anyio provides. Verification: ruff + mypy clean (166 files); 4459 non-live pytest pass.	2026-04-18 10:20:19 -07:00
Patrick Buckley	6cbd3eb2c1	feat: workstream attachments at creation time + SDK + UI parity (#362) ... * feat: workstream attachments at creation time + SDK + UI parity Closes the two big deferred items from PR #356: attaching files as part of the initial workstream-creation request, and full SDK coverage of the attachment surface. Server: POST /v1/api/workstreams/new now accepts multipart/form-data (meta JSON + 0..N file parts). Files are validated and saved as pending under the new ws; when initial_message is also set the create handler reserves them onto that turn before the dispatch worker fires, mirroring the /v1/api/send pattern. Validation failure rolls back the workstream via delete_workstream so we don't leak orphan rows or emit a phantom ws_created/ws_closed pair on SSE. JSON path is unchanged. Console routing: route_create accepts multipart with ?ws_id=<hex> as a query parameter (the console hashes the id before the body lands). Added /v1/api/route/workstreams/{ws_id}/attachments POST/GET/DELETE + .../{attachment_id}/content GET proxies that forward raw bytes and preserve upstream headers (Content-Disposition, X-Content-Type-Options, CSP sandbox). Python + TypeScript SDKs: AttachmentUpload type, upload_attachment, list_attachments, get_attachment_content, delete_attachment, and send(attachment_ids=...). create_workstream(attachments=...) sends multipart and pre-generates a ws_id client-side so cluster routing works. SDKs reject attachments+target_node combinations since the multipart route doesn't honor target_node. Web UI: dashboard composer refactored to a single unified create flow. Replaced the inconsistent split (Enter created+sent raw, "New Chat" opened a modal) with one rich composer carrying a textarea, paperclip + chip strip, drag-drop, paste-image, and a collapsible Options panel for model/judge_model/skill. Submit button dynamically labels Create vs Send. New-workstream modal also gained the same paperclip + chip strip + first-message field for the tab-bar + entry point. Tests: 30 new tests across server multipart create, console route multipart + attachment proxies, Python + TS SDK attachment surfaces, plus regressions for the three review-flagged bugs (Content-Type boundary preservation, attachments+target_node rejection, no phantom ws_created on validation failure). * fix: address Copilot review feedback on PR #362 - web_helpers: docstring now matches behaviour — read_multipart_create_or_400 does enforce the optional max_per_file_bytes cap as defense-in-depth. - app.js: drop the duplicated _formatAttachSize definition (one already exists earlier for pane chips); add a shared _isAttachmentAllowed helper that mirrors the server's classifier (png/jpeg/gif/webp images, text/* MIMEs, allowlisted application/* MIMEs, known text extensions) and call it from both _newWsAddFiles and _addDashboardFiles so unsupported files fail fast client-side instead of after a server roundtrip. - app.js: dashboardSubmit catch now suppresses the redundant error toast on authFetch's "auth" Error and falls back to a generic message when err.message is undefined, instead of rendering "Connection error: undefined". - SendResponse (Pydantic + TS): document and expose attached_ids, dropped_attachment_ids, priority, and msg_id so attachment-aware SDK callers can detect partial reservations and dequeue queued messages. - test_server_attachments_on_create: drop the dual `import turnstone.server` + `from turnstone.server import` style — use monkeypatch.setattr by dotted path for module-level mutation and `from … import …` for the helpers, keeping a single import style.	2026-04-16 13:30:25 -07:00
Patrick Buckley	87a9af1075	fix: broadcast plan_resolved SSE so other clients dismiss in sync ... Previously, resolving a plan on one client (e.g. phone) cleared the server's pending state and unblocked the worker, but emitted no event to other connected clients. Their plan-approval modal stayed stuck. resolve_plan() now enqueues a plan_resolved frame (mirroring the approval_resolved pattern in resolve_approval) before clearing _pending_plan_review, so a reconnecting client cannot receive both the replayed plan_review and the live plan_resolved. Skips the frame on the cancel-with-no-plan path. Client adds a plan_resolved handler that dismisses the modal without re-firing /v1/api/plan, restores keyboard context (skipped on touch to avoid soft-keyboard pop on mobile), labels the inline plan summary "(synced)" so remote dismissal is unambiguous, announces via the existing aria-live #toast for screen-reader parity, and falls back to an info message if plan_resolved races ahead of plan_review. Adds PlanResolvedEvent to the Python and TypeScript SDKs with deserialization and type-guard tests.	2026-04-16 09:56:17 -07:00
Patrick Buckley	2b93598d68	feat: multi-model health tracking with runtime default and DB-only st… (#304) ... * feat: multi-model health tracking with runtime default and DB-only startup Replace active-probe circuit breaker with passive per-backend health tracking. Backends are marked degraded after consecutive failures and recover when a request succeeds — requests are never blocked. - Add model.default_alias ConfigStore setting for runtime default model - Make load_model_registry CLI args optional for DB-only startup - Per-(provider, base_url) health trackers via HealthTrackerRegistry - Two-pass fallback: prefer healthy backends, then try degraded - Remove BackendHealthMonitor, CircuitState, probe threads, cooldown - Remove circuit_state from API schema, SDK events, metrics, frontends * feat: add "Set Default" button to Model Definitions admin panel Show a "default" badge on the current default model alias and a "set default" action button on all other models. Clicking it writes model.default_alias via the settings API. The list endpoint now includes default_alias in the response so the UI can highlight it. * fix: address review feedback — metric scoping, effective default, session alias - Move turnstone_backend_up metric out of BackendHealthTracker into server callback; only the effective default backend drives the gauge - _build_health_dict resolves effective default via ConfigStore override - session_factory computes selected_alias once before registry.resolve - admin model-definitions endpoint returns effective default (not just override) so UI shows correct badge when ConfigStore is empty - Rename circuitTitle → healthTitle in console JS - Fix ruff SIM117 lint in test * fix: validate effective default against enabled models, degraded label, log normalization - admin model-definitions endpoint validates default_alias against enabled models using same fallback rules as load_model_registry - UI text "backend down" → "backend degraded" to match advisory semantics - Health tracker log uses normalized base_url from key, not raw argument	2026-04-04 23:44:29 -07:00
Patrick Buckley	62d2a0fe6a	fix: remove non-auth support from bootstrap wizard (#274) ... * fix: remove non-auth support from bootstrap wizard Auth is now mandatory for all deployments. Remove the TURNSTONE_AUTH_ENABLED toggle and make JWT_SECRET and AUTH_TOKEN required in the wizard's system prompt. * fix: remove auth disable support from runtime and infra Remove AuthConfig.enabled field — auth is always on. Drop TURNSTONE_AUTH_ENABLED env var, config toggle, and the check_request bypass. Update compose.yaml, Helm chart, Terraform, docs, and tests to match. * feat: deprecate config tokens, require JWT secret, prefer JWT auth Phase 1 of config-token removal: - load_jwt_secret() now exits with error if no secret is configured (was: silently auto-generated ephemeral secret) - _authenticate_token() logs deprecation warning on config token use - CLI /cluster commands use ServiceTokenManager when JWT secret is set - turnstone-admin tls-list uses ServiceTokenManager when JWT secret is set - Update bootstrap wizard, docker.md, security.md to mark TURNSTONE_AUTH_TOKEN as deprecated and JWT_SECRET as required - Console test fixtures use auth token + headers (auth always enforced) * feat: add service scope for inter-service JWT auth Add "service" to VALID_SCOPES and SCOPE_HIERARCHY. Service tokens bypass require_permission() RBAC checks, replacing the old empty-user-id bypass that config tokens relied on. All ServiceTokenManager instances that need admin access now include "service" in their scopes (console proxy, channel gateway, CLI, admin CLI). Read-only services (collector, notification) unchanged. * feat: phase 2 config token deprecation - SDK doc examples now show API tokens (ts_) instead of config tokens - Remove _get_config_token() from admin CLI (dead code) - Block config token exchange in handle_auth_login — only password and API token login allowed - Update login tests to use password-based auth instead of config token exchange * feat: phase 3 — remove config tokens entirely Complete removal of config-file token authentication: - Delete AuthConfig.tokens, check(), _ROLE_TO_SCOPES, hmac dispatch branch, and config token loading from load_auth_config() - Remove auth_config parameter from _authenticate_token() and check_request() — callers updated throughout - Remove TURNSTONE_AUTH_TOKEN from compose.yaml, Helm charts, Terraform, turnstone.example.toml - Remove --auth-token CLI flags from turnstone, turnstone-admin, and turnstone-console - Simplify console main() — always use ServiceTokenManager (no fallback to static tokens) - Delete config-token-specific tests, rewrite check_request and integration tests to use JWT auth with proper audience claims - Remove all config token references from docs (security.md, docker.md, sdk.md, console.md, architecture.md, bootstrap prompt) * fix: address code review findings - Fix 33 broken tests: add JWT auth to test_api_versioning, test_console_routing_proxy, test_tls_admin, test_tls_manager, test_server_live (jwt_secret + audience-scoped auth headers) - Add TestRequirePermissionServiceScope: 4 tests covering the service scope RBAC bypass path - Remove stale comments referencing config tokens in auth.py and console/server.py - Remove dead proxy_auth_token parameter from console create_app() and static token fallback in _proxy_auth_headers() - Remove TURNSTONE_AUTH_TOKEN from env.py scrub list * fix: address Copilot review — JWT audience, compose require secret - CLI /cluster: add audience=JWT_AUD_CONSOLE to ServiceTokenManager (console validates audience, JWTs without it were rejected) - Admin CLI tls-list: same audience fix - compose.yaml: TURNSTONE_JWT_SECRET now uses :? to fail fast if unset - SDK console: fix default port from 8081 to 8090 * test: add auth enforcement tests for TLS admin endpoints 5 new tests: unauthenticated requests return 401 (list, renew, delete), read-only-scoped requests return 403 (renew, delete). Closes the TLS auth enforcement test gap noted in PROGRESS.md. * fix: address remaining Copilot review feedback - Fix token_source="config" → "test" in TLS test fixtures - Fix AuthResult.token_source docstring to include service origins - Require TURNSTONE_JWT_SECRET in cluster compose profile (:?) - Helm: add auth.jwtSecret + auth.existingSecret values, wire TURNSTONE_JWT_SECRET into secret.yaml and both deployments - Terraform: replace auth_token with jwt_secret variable + secret, remove orphaned auth_token resources and IAM reference - Remove [[auth.tokens]] from security.md config example * fix: address full code review — 10 findings Critical: - Terraform: replace concat(common_env, auth_env) with common_env (auth_env local was removed but still referenced) - Channel gateway: remove hmac static token auth from _check_auth(), use JWT-only validation. Remove --auth-token CLI arg from channel - Rebalancer: add token_manager support so migration requests carry JWT auth (was sending unauthenticated POST to /internal/migrate) Major: - Guard _permissions_to_scopes() against "service" privilege escalation from DB role permissions - Remove dead AuthConfig class, load_auth_config(), and all auth_config parameters from create_app() signatures - Helm: inject JWT secret for both inline and existingSecret paths Minor: - Remove dead auth_token param from ClusterCollector - Remove empty TestLoadAuthConfig class - Short JWT secret now exits instead of warning - Compose: add generation command comment above JWT_SECRET - Clean stale config token references from 6 doc files - Clean stale AUTH_TOKEN reference from bootstrap wizard prompt * fix: remove remaining stale config token references from docs - channels.md: remove --auth-token from options table - oidc.md: remove "config-file tokens still work" claim - security.md: remove config token section, fix JWT secret docs (now required/exits, no ephemeral fallback), remove hmac from ASCII diagram, remove --auth-token reference	2026-04-01 19:38:24 -07:00
Patrick Buckley	9df8ab836f	Feat/per pane status bar (#248) ... * feat: per-workstream status bar above input Move the global token counter and model name from the header into a per-pane telemetry strip between messages and the text input. Each workstream pane now independently shows model name, token usage with context percentage, tool calls this turn, and turn count. Backend: add _ws_turn_tool_calls counter (reset per user turn, emitted in SSE status event alongside turn_count). MQ bridge forwards the new fields. SDK and TypeScript types updated. Frontend: build .ws-status-bar DOM in _createDOM, rewrite updateStatus to target per-pane elements, update SSE connect/disconnect handlers. Remove #model-name and #status-bar from global header. Restore console #status-bar CSS in its own stylesheet. Accessibility: aria-atomic, aria-labels on each field, warning symbols (▲/⚠) at 80%/95% context for color-blind users, placeholder text before first status event. Disconnect state uses 2px red border with dimmed stale fields. * fix: emit status event on SSE connect so status bar populates on resume When resuming a workstream, the event_generator only sent connected + history events. The status bar stayed at placeholder values until the next LLM response. Now replays session._last_usage as a synthetic status event right after connected, so token count, tool calls, and turn count render immediately. * fix: address Copilot review — remove dead function, clarify locals Remove updateHeaderForFocusedPane() and its call site (no-op since status moved per-pane). Rename ambiguous ttc/tc locals to turn_tool_calls/turn_count in the status replay block.	2026-03-29 22:22:06 -07:00
Patrick Buckley	42e99d6990	docs: update tools, architecture, SDK for v0.9.2 changes ... - docs/tools.md: batch edit_file (edits array), bash stderr prefix, math sandbox extras, output truncation - docs/judge.md: JSON secret detection in output guard - docs/architecture.md: state_change now sent to per-workstream SSE - README.md: [sandbox] extras group in requirements - TypeScript SDK: StateChangeEvent type, type guard, exports - OpenAPI specs regenerated	2026-03-29 06:06:30 -07:00
Patrick Buckley	76d007d83f	fix: TypeScript SDK DeleteSettingResponse type drift (#209) ... * fix: TypeScript SDK DeleteSettingResponse type drift * fix: export DeleteSettingResponse from SDK index	2026-03-28 23:08:09 -07:00
Patrick Buckley	f74aa2264e	refactor: add is_error to on_tool_result protocol, remove text heuris… (#207) ... * refactor: add is_error to on_tool_result protocol, remove text heuristics Add is_error keyword arg to SessionUI.on_tool_result() so tools report errors structurally. Server and JS client no longer guess from output text prefixes — each tool sets the flag at the source. Bash tool: exit code >= 2 is error, exit code 1 is ambiguous (grep no-match). History reconstruction keeps text heuristic as fallback for pre-migration data. Update SDKs (Python + TypeScript), test mocks, docs, and diagrams. * fix: infinite recursion in _report_tool_result, signal exits, stale docs * fix: add _tool_error_flags to test_load_skill ChatSession stubs	2026-03-28 22:09:52 -07:00
Patrick Buckley	4f6ef13ce9	fix: cancel button race condition with stream abort and force cancel (#202) ... The cancel endpoint emitted a 'cancelled' SSE event before the worker thread terminated. The frontend transitioned to "send" mode prematurely, so the next send got rejected with "Already processing a request." Backend: - Providers expose SDK stream handle via cancel_ref parameter so cancel() can close the HTTP connection and unblock iteration - Generation counter prevents orphaned threads from mutating messages or clearing cancel state after force cancel - _check_cancelled() added between retry attempts in _try_stream - Server polls (async, non-blocking) for cancelled worker to exit - Force cancel (force:true) abandons stuck worker, keeps cancel event set so subprocesses are killed, guards against spurious SSE events Frontend: - 'cancelled' shows "Cancelling..." then escalates to "Force Stop" after 2s for a harder cancel that abandons the worker immediately - 10s safety timeout auto-recovers if stream_end never arrives - busy_error re-enables stop button instead of showing send - Timeout cleanup in disconnectSSE, stream_end, and force .then() - Layout shift prevention (min-width, white-space: nowrap) - aria-label updates for accessibility Tests: - 7 new tests: stream close, error suppression, cancel_ref population, transport error conversion, non-cancel exception propagation, retry cancellation check	2026-03-28 19:26:37 -07:00
Patrick Buckley	d08a57dfc2	feat: SDK TLS support, Docker Compose overlay, TLS docs (#183) ... Python SDK: - ca_cert, client_cert, client_key on all 4 client classes - ValueError if only one of client_cert/client_key provided - Passed to httpx verify=/cert= TypeScript SDK: - TlsOptions type exported (zero runtime code) - Fix picomatch vulnerability (npm audit fix) Docker Compose: - deploy/docker-compose.tls.yml overlay with tls-init bootstrap - Notes it's an overlay requiring a base compose file Documentation: - docs/tls.md: architecture, config, CLI, SDK examples, troubleshooting - Fixed package name (@turnstone/sdk), Node.js 18+ note	2026-03-25 20:43:34 -07:00
Patrick Buckley	04c50568e9	feat: add priority column for skill ordering control (#144) ... * feat: add priority column for skill ordering control Add priority INTEGER DEFAULT 0 column to prompt_templates (migration 024). Skills with activation="default" are now ordered by priority ASC, name ASC instead of name-only. Admins can set priority via create/update API. Lower values run first. Priority is editable on readonly/installed skills. 4 new tests. Python SDK, TypeScript SDK, and Pydantic models updated. * fix: address review — apply priority ordering to list_default_templates list_default_templates() still ordered by name only, so priority had no effect on default skill execution order. Update both SQLite and PostgreSQL backends to order by (priority, name). * fix: address review — regenerate OpenAPI snapshot, add default template ordering test Regenerate openapi-console.json to include priority field on skill models. Add test_list_default_templates_ordered_by_priority to verify the execution path for default skills respects priority ordering.	2026-03-21 00:53:51 -07:00
Patrick Buckley	ec3454ee2e	fix: wire resume_ws through console + expose max_ws in heartbeat (#124) ... * fix: wire resume_ws through console + expose max_ws in heartbeat Console create_workstream handler now reads resume_ws from the request body and passes it to CreateWorkstreamMessage on all three dispatch paths (pool, auto, explicit). Previously resume only worked via channel router and direct CLI — the console layer never plumbed it through. Server /health now includes max_ws from WorkstreamManager. Bridge reads it on startup and includes it in heartbeat metadata so the console's _pick_best_node gets accurate capacity instead of always defaulting to 10. Collector also updates max_ws on subsequent heartbeats (not just discovery). Schemas, Python SDK, TypeScript SDK, and OpenAPI specs updated. Test mocks fixed for new max_workstreams property access in /health. * fix: address PR #124 review — resume_ws tests + max_ws fetch on pre-set node_id Add _fetch_server_metadata() so bridge reads max_ws from /health even when node_id is pre-set (skipping _fetch_node_id). Without this, heartbeats would advertise max_ws=10 regardless of actual server config. Add 3 test cases verifying resume_ws flows through all three console dispatch paths (directed, pool, auto-select).	2026-03-18 14:24:10 -07:00
Patrick Buckley	dc464ac313	feat: Agent Skills standard compliance + frontend spec fields ... Brings skills implementation into full compliance with agentskills.io: Parser: - Read `allowed-tools` (hyphenated, standard) only; stored as `allowed_tools` internally — no underscore fallback - Reject consecutive hyphens in skill names - Extract author/version from standard `metadata:` map with top-level fallback; null-safe (no "None" string for bare YAML keys) - Truncate description at 1024 chars, compatibility at 500 chars (spec caps) with log warnings - Lenient parsing mode (lenient=True) for cross-client import: sanitizes names, returns None on skip, malformed-YAML colon-value retry - Type overloads: strict mode returns ParsedSkill, lenient returns ParsedSkill | None Session: - `<available-skills>` XML catalog in system messages for activation="search" skills (disabled ones filtered out, capped at 30) Tool rename: - `load_skill` tool → `skill` (JSON, session preparers/executors, approval labels, tests, docs) Storage (migration 023): - Add `license` and `compatibility` columns to prompt_templates - skill_license / compatibility params on create_prompt_template across protocol, SQLite, PostgreSQL backends - Add to SKILL_MUTABLE for update_prompt_template API + server: - SkillInfo, CreateSkillRequest, UpdateSkillRequest: license + compatibility fields - Create/update/install endpoints extract and persist both fields - Install endpoint maps parsed.license + parsed.compatibility from imported SKILL.md (previously discarded) - _skill_to_response() includes both fields Admin UI: - Create + edit modals: version, license, compatibility fields - Readonly (imported) skills: "edit" → "view" button, modal title "View Skill", all fields disabled, Save hidden, Cancel → "Close", collapsibles auto-expand, focus on Close button - :disabled CSS for dark-theme modal inputs (bg-highlight, cursor not-allowed, dimmed text) - Fix addEventListener stacking on auto-approve checkboxes → .onchange SDK: license + compatibility on SkillInfo, CreateSkillRequest, UpdateSkillRequest TypeScript interfaces Docs: governance.md, judge.md, tools.md, README, diagram updated	2026-03-17 16:09:06 -07:00
Patrick Buckley	88085c29ff	fix: normalize install response + review fixes ... Address 5 Copilot review items + code review findings: - Normalize install endpoint to always return envelope response: {installed: [...], skipped: [...], total: N} — eliminates dual response shape (single SkillInfo vs batch). Breaking change to install endpoint response, SDKs and OpenAPI spec updated. - Add SkillInstallResponse + SkillInstallSkipped Pydantic models - POST /resources spec now correctly documents response_code=201 - SQLite count_skill_resources_bulk chunks IN clause at 900 to stay under SQLITE_MAX_VARIABLE_NUMBER (999) - Fix installDiscoveredSkill() JS handler for envelope response - Add error key to 409 duplicate response for error handler compat - Update Python SDK install_skill return type (dict, not SkillInfo) - Add TypeScript SkillInstallResponse + SkillInstallSkipped types - Regenerate openapi-console.json - Update all install tests for envelope response shape	2026-03-17 01:26:44 -07:00
Patrick Buckley	8957b9ce0e	feat: batch install skills from multi-skill GitHub repos ... When a GitHub repo URL has no root SKILL.md (monorepo pattern like anthropics/skills), automatically scan the repo tree for all SKILL.md files and install every discovered skill in one operation. - Add fetch_skills_from_github_repo() — scans recursive tree, parses each SKILL.md, collects per-skill resources via shared helpers - Extract _find_resource_files() and _fetch_resource_contents() to eliminate duplication between single and batch fetch paths - Extend admin_skill_install to fall back to batch scanning when single-skill fetch returns 404 - Each skill gets a specific source_url pointing to its subdirectory - Backward compatible: single-skill repos return same response shape - Frontend handles both shapes with contextual toast messages - Filter tree scan to URL path subtree when path is provided - Cap at 50 skills per repo scan Also addresses review feedback: - Fix path prefix check (scripts/ not scriptsX/) - Use count_skill_resources_bulk for single skill GET - Add content field to SkillResourceInfo schema - Fix OpenAPI spec paths ({path} not {path:path}) - Check r.ok on resource upload promises - Preserve / in URL-encoded paths (split/map/join pattern) - URL-encode path in Python SDK delete method - Fix test_install_not_found to mock batch fallback - Fix test_search_empty_results for required q param - Narrow except clause to ValueError in batch parser	2026-03-17 01:26:44 -07:00
Patrick Buckley	28a6b0dd33	feat: skill resources — API, admin UI, runtime injection, and SDK ... Complete the resource surface for skills (scripts/, references/, assets/): - 4 admin API endpoints: list, get, create, delete skill resources - Storage: delete_skill_resource_by_path + count_skill_resources_bulk - Admin UI: resource count badge in skills table, resource sections in create/edit modals with add/delete, readonly guard for installed skills - Runtime: _load_skills populates skill resources, _init_system_messages injects <skill-resources> catalog (inlined if <8KB) - Python SDK: list/create/delete_skill_resource (async + sync) - TypeScript SDK: listSkillResources, createSkillResource, deleteSkillResource - Path traversal protection (normpath + .. rejection + null byte check) - Block empty skill discover searches (frontend toast + backend 400) - Rename MCP "Registry" tab to "Discover" for consistency with skills - Move Skills + MCP Servers into new "Extensions" sidebar group - 25 tests (7 storage, 16 API + 2 security)	2026-03-17 01:26:44 -07:00
Patrick Buckley	c28bfc1e58	feat: skill discovery — search and install skills from external sources (#111) ... * feat: skill discovery — search and install skills from external sources Add discovery UI and API for finding and installing skills from skills.sh registries and GitHub repositories with one-click install, SKILL.md frontmatter parsing, and security scan integration. Core modules: - skill_parser.py: ParsedSkill dataclass, parse_skill_md() with YAML frontmatter support (Anthropic + Hermes tag formats), name validation - skill_sources.py: SkillsShClient (async search + resolve), fetch_skill_from_github (SKILL.md + bundled resource fetching with 256KB cap, text extension filter, GitHub API tree traversal) API: - GET /v1/api/admin/skills/discover — search with installed annotation and scan_status for installed skills - POST /v1/api/admin/skills/install — fetch, parse, duplicate check, create with origin="source" readonly=true, store resources, audit Also fixes pre-existing bug where _skill_to_response omitted scan_status, scan_report, scan_version fields — scan tier badges in the installed skills table were silently empty despite data existing in storage. Admin UI: pill toggle (Installed/Discover), discovery cards with scan tier badges, GitHub import modal with proper focus trap/Escape/backdrop, scoped selectors preventing MCP↔Skills cross-tab state corruption. SDK: discover_skills() + install_skill() on Python (async+sync) and TypeScript console clients. 48 new tests across 3 test files. All 2632 tests pass. * fix: address copilot review — 404 vs 502, O(n) lookups, branch fallback - SkillNotFoundError subclass: install returns 404 when SKILL.md is missing, 502 only for connectivity/upstream errors - get_skill_by_source_url() + list_installed_skill_urls(): indexed storage lookups replace O(n) full-table scans with content blobs - Default branch fallback: tries main then master when URL doesn't specify a branch - Path normalization: strip trailing slash once, remove redundant candidate - SDK install_skill() returns typed SkillInfo with response_model - Tree size guard: skip resource tree if response >2MB	2026-03-16 18:42:32 -07:00
Patrick Buckley	75eda9a096	feat: unified skills system — merge prompt templates + workstream tem… (#106) ... * feat: unified skills system — merge prompt templates + workstream templates Evolves prompt_templates into a first-class skills entity and merges workstream templates into the same model, collapsing two concepts into one. Migration 021: 21 new columns on prompt_templates (skills metadata, security scan fields, session config from WS templates), skill_resources table for bundled files, skill_versions table for auto-snapshot version history. Data migration converts existing WS templates into skills with name collision handling, migrates version history, renames workstreams and scheduled_tasks columns, cleans orphaned permissions, drops old tables. Key changes: - All public interfaces renamed: templates → skills (API, CLI, SDK, UI) - Session config (model, temperature, token_budget, auto_approve, etc.) now lives on the skill and is applied at workstream creation - /skill slash command, set_skill() API, --skill CLI flag - BM25 skill search via SkillSearchManager for activation="search" skills - Admin UI: Skills tab with collapsible Session Config section, description subtitles, activation/origin/MCP badges, pagination - Shared validation helper (_parse_skill_session_config) for DRY CRUD - Version history with auto-snapshot on every edit + API endpoint - Cascade delete (resources + versions) on skill removal - Security: range validation, activation allowlist, fail-closed enabled check, duplicate name 409, readonly guard, JSON validation - 77 new tests across storage, runtime, search, API integration, and migration behavior verification (2521 total) * fix: address Copilot review + rename admin.templates → admin.skills - Skip skill lookup when resume_ws is set (avoids spurious 400) - Fix _applied_skill_version mismatch (1 in both workstreams table and session) - Remove stale template field from MQ protocol diagram - Rename admin.templates permission to admin.skills everywhere (runtime, frontend, tests, docs) with migration step for persisted role data - Fix stale /api/templates references in docs and diagrams - Update docstrings/comments for skills terminology * fix: address Copilot round 2 — skill version lineage + stale doc refs - Compute actual skill version from skill_versions count (not hardcoded 1) - Use same version in both workstreams table and session metadata - Fix response payload example: "templates" → "skills" key - Fix "Each template summary" → "Each skill summary"	2026-03-16 14:47:06 -07:00
Patrick Buckley	80e1924d7f	feat: enable prompt caching for Anthropic and OpenAI providers (#104) ... * feat: enable prompt caching for Anthropic and OpenAI providers Activate automatic prompt caching on both LLM providers to reduce input token costs on multi-turn conversations. Anthropic gets cache_control: ephemeral (90% savings on cache hits), OpenAI GPT-5.x gets 24h extended cache retention (free). Cache metrics flow end-to-end through the entire data pipeline: provider → session → server SSE → MQ protocol → storage → Prometheus metrics → admin Usage tab. - AnthropicProvider: top-level cache_control on all requests, extract cache_creation_input_tokens and cache_read_input_tokens from streaming and non-streaming responses - OpenAIProvider: prompt_cache_retention=24h for GPT-5.x, extract cached_tokens from usage.prompt_tokens_details - UsageInfo: new cache_creation_tokens and cache_read_tokens fields - Migration 020: add cache columns to usage_events table - Storage: record_usage_event and query_usage updated (sqlite + pg) - Metrics: turnstone_tokens_total{type="cache_creation|cache_read"} - Server: on_status passes cache tokens to SSE, storage, and metrics - MQ: StatusEvent carries cache fields through bridge - SDKs: Python and TypeScript StatusEvent types updated - OpenAPI: UsageBreakdownItem schema includes cache fields - Console UI: Usage tab shows cache write/read as secondary readouts with visual separator, dimmed when zero - 16 new tests, docs and 3 diagrams updated * fix: address Copilot review feedback - Fix MQ protocol diagram clipping by switching to vertical package layout (inbound on top, outbound below) with package aliases - Regenerate OpenAPI snapshots to include cache_creation_tokens and cache_read_tokens on UsageBreakdownItem - Replace fragile MagicMock(spec=[]) + del pattern with types.SimpleNamespace in cache metrics missing-attributes test	2026-03-16 01:59:55 -07:00
Patrick Buckley	ef6cac6428	fix: address review feedback and add sync-pending indicator ... Review fixes: - Rename query param from `q` to `search` across endpoint, frontend, SDKs, OpenAPI spec, docs, and tests to match upstream registry API - Validate variables/env/headers are dicts in install endpoint (400 on malformed input instead of 500) - Block javascript: and unsafe URL schemes on repo and website links rendered from registry data (XSS prevention) - Add roving tabindex to Servers/Registry pill toggle for correct keyboard focus behavior - Add noreferrer to website link in detail modal Sync-pending indicator: - "Sync to Nodes" button pulses yellow after create/edit/delete/import to alert admin that nodes have unseen changes - Clears after successful sync - Reduced-motion safe	2026-03-15 21:41:02 -07:00
Patrick Buckley	50544c0d1b	feat: MCP Registry integration — discover and install servers from the official registry ... Backend: standalone MCPRegistryClient (httpx async) queries the official MCP Registry API (registry.modelcontextprotocol.io, v0.1). Two new console admin endpoints: GET /v1/api/admin/mcp-registry/search (proxy with installed-status annotation, dedup, uninstallable server filtering) and POST /v1/api/admin/mcp-registry/install (auto-reloads all cluster nodes). Migration 019 adds registry_name/version/meta columns to mcp_servers with partial unique index. Configurable registry URL via mcp.registry_url setting for enterprise/private registries. resolve_install_config() handles both remote (streamable-http) and package (npm→npx, pypi→uvx) installs. Pydantic models, OpenAPI spec, Python + TypeScript SDK methods. Frontend: unified MCP admin tab with Servers/Registry pill toggle (ARIA tablist). Servers view: tri-state source badges (CONFIG/MANUAL/REGISTRY). Registry view: search bar with type filter (remote/npm/pypi), auto-browse on tab switch, result cards with source-type badges and repo links, one-click install for zero-config remotes, install modal with dynamic form for servers needing env vars/headers/URL variables. Package install warning banner. Post-install status polling with connection/error feedback toasts. Trust notice banner linking to the official registry. Safety: 30s connect timeout on streamablehttp_client and session.initialize() prevents hung connections from blocking the MCP event loop indefinitely. Required-only headers in install config prevents empty auth headers from causing silent 401s. 71 new tests (registry client, API endpoints, storage columns). Docs: dedicated docs/mcp-registry.md, updated api-reference, architecture, console, sdk, settings docs. Updated MCP architecture diagram.	2026-03-15 21:09:27 -07:00
Patrick Buckley	27349e1c13	refactor: move bridge content buffer to server-side single source of truth ... Eliminate dual accumulation by piggybacking assistant response text on the server's ws_state:idle SSE event. The bridge no longer maintains its own _ws_content_buffer — it reads content directly from the idle event and passes it through to TurnCompleteEvent unchanged. Server-side: WebUI accumulates tokens in on_content_token(), joins and includes in the idle broadcast, then resets (with 256 KB cap). Downstream consumers (Discord bidi DM forwarding, catch-up) are unaffected — TurnCompleteEvent.content is still populated.	2026-03-15 15:04:22 -07:00