collavre 0.24.0 → 0.25.0

data/app/controllers/collavre/agent_provisioning_controller.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+module Collavre
+  class AgentProvisioningController < ActionController::Base
+    SKILL_NAME = "collavre"
+    CONFIG_NAME = "collavre"
+    CACHE_CONTROL = "public, max-age=31536000, immutable"
+
+    rate_limit to: 60, within: 1.minute, only: :manifest
+
+    def manifest
+      response.headers["Cache-Control"] = "private, no-store"
+      workspace = find_workspace!
+      skill = Collavre::AgentProvisioning::Archive.collavre_skill
+      config = Collavre::AgentProvisioning::Archive.workspace_config(workspace, base_url: request.base_url)
+
+      render json: {
+        schema: "agent-provisioning/v1",
+        items: [
+          {
+            type: "skill",
+            name: SKILL_NAME,
+            url: absolute_url(agent_provision_skill_path(sha256: digest(skill))),
+            sha256: digest(skill)
+          },
+          {
+            type: "config",
+            name: CONFIG_NAME,
+            url: absolute_url(agent_provision_config_path(
+              agent_id: workspace.agent_id,
+              token: workspace.manifest_token,
+              sha256: digest(config)
+            )),
+            sha256: digest(config)
+          }
+        ]
+      }
+    end
+
+    def skill
+      bytes = Collavre::AgentProvisioning::Archive.collavre_skill
+      return head :not_found unless digest_matches?(bytes)
+
+      send_archive(bytes, "collavre.tar.gz")
+    end
+
+    def config_archive
+      workspace = find_workspace!
+      bytes = Collavre::AgentProvisioning::Archive.workspace_config(workspace, base_url: request.base_url)
+      return head :not_found unless digest_matches?(bytes)
+
+      send_archive(bytes, "collavre-config.tar.gz", cache_control: "private, no-store")
+    end
+
+    private
+
+    def find_workspace!
+      Collavre::AgentWorkspace.find_by_manifest_token!(agent_id: params[:agent_id], token: params[:token])
+    end
+
+    def digest(bytes)
+      Collavre::AgentProvisioning::Archive.sha256(bytes)
+    end
+
+    def absolute_url(path)
+      "#{request.base_url}#{path}"
+    end
+
+    def digest_matches?(bytes)
+      supplied = params[:sha256].to_s
+      supplied.bytesize == 64 && ActiveSupport::SecurityUtils.secure_compare(supplied, digest(bytes))
+    end
+
+    def send_archive(bytes, filename, cache_control: CACHE_CONTROL)
+      response.headers["Cache-Control"] = cache_control
+      send_data bytes, type: "application/gzip", disposition: "inline", filename: filename
+    end
+  end
+end

data/app/controllers/collavre/api/v1/agents_controller.rb

@@ -95,7 +95,7 @@ module Collavre
           # row yet. Drop it up front — keyed by the ending session's id (sent by
           # the plugin, or derived from the required topic) — so this session's
           # own still-live row cannot masquerade as a live sibling and skip the
-          # last-session teardown (which would pin routing_expression on and, if
+          # last-session teardown (which would leave the agent apparently live and, if
           # the WS close is never processed, leave nothing to clear it). Done
           # under the agent row lock to serialize against a concurrent subscribe/
           # unsubscribe on the shared agent — the same lock AgentChannel uses.
@@ -110,14 +110,8 @@ module Collavre
 
             unless sibling_sessions_live?(ai_user)
               last_session = true
-              # Last (or only) session for this agent. Clear routing_expression
-              # FIRST so Orchestration::Matcher#match_by_expression stops
-              # dispatching new comments to this now-clientless agent while we
-              # drain its task graph below; otherwise a comment arriving mid-drain
-              # could enqueue a new task right after we cancelled the last one.
-              # (Routing is reactivated on the next AgentChannel subscribe, not on
-              # re-register.)
-              ai_user.update_column(:routing_expression, nil) if ai_user.routing_expression.present?
+              # Last (or only) session for this agent. Its presence row was just
+              # removed, so Matcher stops dispatching to it before task cleanup.
             end
           end
 
@@ -133,13 +127,13 @@ module Collavre
             # Fail any tasks still delegated to this agent — including dispatches
             # routed to *work* topics outside the registration inbox. With no live
             # session left, agent_id uniquely scopes this agent's delegated work;
-            # scoping by topic_id alone would leak the common case (a /work
-            # dispatch on a project topic) until stuck detection times out.
+            # scoping by topic_id alone would leak the common case (a dispatch on a
+            # project topic) until stuck detection times out.
             cancel_delegated_tasks_for_session(ai_user)
           elsif topic
             # One shared agent fans out to many concurrent sessions (the default
             # AGENT_NAME case). Another session is still LIVE, so agent-wide
-            # cleanup would clear the shared routing_expression and cancel the
+            # cleanup would cancel the
             # sibling's in-flight work — exactly the hazard AgentChannel#unsubscribed
             # guards against via presence. Tear down ONLY this ending session:
             # cancel work on its own topic (whose client is gone, so it would
@@ -162,55 +156,13 @@ module Collavre
             return
           end
 
-          creative = topic.creative&.effective_origin
-          unless creative
-            render json: { error: "Creative not found" }, status: :not_found
-            return
-          end
-
-          unless creative.has_permission?(current_user, :feedback)
-            render json: { error: "Not authorized" }, status: :forbidden
-            return
-          end
-
-          agent = resolve_reply_agent(topic, params[:task_id])
-          unless agent
-            render json: { error: "Not authorized" }, status: :forbidden
-            return
-          end
-
-          # Atomically claim the delegated task BEFORE saving the reply.
-          # Two concurrent /reply requests with the same task_id can both
-          # pass resolve_reply_agent (which is a read-only scope check) and,
-          # without an atomic WHERE status='delegated' transition, both would
-          # save separate comments and both would run completion logic —
-          # producing duplicate linked replies for one dispatch. Claim first,
-          # save second, so the loser sees rows_updated == 0 and bails out
-          # before touching the comments table.
-          claimed_task = claim_delegated_task(agent, topic, params[:task_id])
-          if params[:task_id].present? && claimed_task.nil?
-            render json: { error: "Task already completed or not delegated" }, status: :conflict
-            return
-          end
-
-          comment = creative.comments.build(
-            content: params[:text].to_s,
-            topic: topic,
-            user: agent,
-            skip_default_user: true,
-            skip_dispatch: true
-          )
-
-          if comment.save
-            task_claim_service.finalize(agent: agent, task: claimed_task, comment: comment) if claimed_task
-            dispatch_a2a(agent, comment)
-            render json: { comment_id: comment.id }, status: :created
-          else
-            # Restore the dispatch so the MCP client can retry — the failure
-            # is text-level (validation), not task-level.
-            claimed_task&.update!(status: "delegated")
-            render json: { errors: comment.errors.full_messages }, status: :unprocessable_entity
-          end
+          result = AiAgent::TaskReplyService.new(
+            topic: topic, current_user: current_user, text: params[:text], requested_task_id: params[:task_id],
+            agent_resolver: method(:resolve_reply_agent), task_claimer: method(:claim_delegated_task),
+            claim_service: task_claim_service
+          ).call
+          dispatch_a2a(result.agent, result.comment.reload, task: result.task) if result.comment
+          render json: result.body, status: result.status
         end
 
         # POST /api/v1/agent/notify
@@ -389,7 +341,7 @@ module Collavre
         # Mirrors resolve_reply_agent's task_id-first resolution but never
         # touches the task graph (notify only authorizes, it does not complete).
         # A native permission prompt can be raised during a dispatch that
-        # selected this session via routing_expression on a *work* topic whose
+        # selected this live session on a *work* topic whose
         # primary_agent is unset or a different agent (the case documented on
         # resolve_reply_agent). The echoed active-dispatch task_id authorizes
         # the dispatched session agent directly; without it the topic-
@@ -419,7 +371,7 @@ module Collavre
         # Identify which Claude Channel agent this reply is for.
         #
         # Prefer the echoed task_id from the dispatch payload: the matcher can
-        # route to a Claude Channel agent via routing_expression on a topic
+        # route to a live Claude Channel agent on a topic
         # whose primary_agent is unset or a different agent (e.g. multiple AI
         # agents share a topic, or this agent only has feedback permission on
         # the creative without being the topic's primary). In those cases the
@@ -495,20 +447,9 @@ module Collavre
 
           tracker = Orchestration::ResourceTracker.for(agent)
           tasks.find_each do |task|
-            task.update!(status: "cancelled", pending_tool_call: nil)
-            tracker.release!(task.id)
+            next unless task.cancel_if_active!(statuses: %w[delegated], pending_tool_call: nil)
 
-            if task.parent_task_id.present?
-              begin
-                Collavre::Comments::WorkflowExecutor.new(task.parent_task).fail_subtask!(
-                  task, error_message: "Claude Channel session unregistered before reply"
-                )
-              rescue StandardError => e
-                Rails.logger.error(
-                  "[AgentsController] fail_subtask! failed for task #{task.id}: #{e.message}"
-                )
-              end
-            end
+            tracker.release!(task.id)
 
             Orchestration::AgentOrchestrator.dequeue_next_for_topic(task.topic_id, task.creative_id)
           end
@@ -526,8 +467,6 @@ module Collavre
         # Release the tracker slot defensively for running tasks — release! is
         # idempotent (Set#delete no-ops on missing key) and we don't know from
         # the DB whether AiAgentJob had already reached tracker.reserve!.
-        # Parent subtasks are still failed so workflow executors don't deadlock
-        # waiting for a reply that will never come.
         def cancel_pending_tasks_for_session(agent)
           cancel_pending_tasks(Task.where(agent_id: agent.id, status: %w[queued pending running]), agent)
         end
@@ -538,22 +477,12 @@ module Collavre
           tracker = Orchestration::ResourceTracker.for(agent)
           drained_topics = {}
           tasks.find_each do |task|
-            was_running = task.status == "running"
-            task.update!(status: "cancelled")
+            previous_status = task.cancel_if_active!(statuses: %w[queued pending running])
+            next unless previous_status
+
+            was_running = previous_status == "running"
             tracker.release!(task.id) if was_running
             drained_topics[task.topic_id] ||= task.creative_id
-
-            if task.parent_task_id.present?
-              begin
-                Collavre::Comments::WorkflowExecutor.new(task.parent_task).fail_subtask!(
-                  task, error_message: "Claude Channel session unregistered before dispatch"
-                )
-              rescue StandardError => e
-                Rails.logger.error(
-                  "[AgentsController] fail_subtask! failed for queued task #{task.id}: #{e.message}"
-                )
-              end
-            end
           end
 
           # Drain each affected topic's queue once, AFTER all of this session's
@@ -570,17 +499,36 @@ module Collavre
           end
         end
 
-        def dispatch_a2a(agent, comment)
+        def dispatch_a2a(agent, comment, task:)
           AiAgent::A2aDispatcher.new(
             agent: agent,
             reply_comment: comment,
-            context: {
-              "creative" => { "id" => comment.creative_id },
-              "topic" => { "id" => comment.topic_id }
-            }
+            context: { "creative" => { "id" => comment.creative_id },
+              "topic" => { "id" => comment.topic_id },
+              SystemEvents::Envelope::KEY => task&.trigger_event_payload&.dig(SystemEvents::Envelope::KEY)
+            }.compact,
+            workspace_user: workspace_user_for(task)
           ).dispatch
         end
 
+        def workspace_user_for(task)
+          unless task
+            return current_user unless current_user.ai_user?
+
+            return
+          end
+
+          payload = task.trigger_event_payload || {}
+          user =
+            if payload.key?("workspace_user_id")
+              User.find_by(id: payload["workspace_user_id"])
+            else
+              Comment.find_by(id: payload.dig("comment", "id"))&.user
+            end
+
+          user unless user&.ai_user?
+        end
+
         # Provisions the (agent, topic) identities for a Claude Code
         # registration. Memoized per request; behavior extracted verbatim.
         def session_provisioner

data/app/controllers/collavre/application_controller.rb

@@ -14,7 +14,8 @@ module Collavre
     private
 
     # If the original request was for "/" and the user is signed in,
-    # honor SystemSetting.home_page_path_authenticated by redirecting.
+    # return them to their last readable Creative when the authenticated home
+    # page is the Creative index; otherwise honor the configured home page.
     # The middleware preserves "/" as a stable URL for unauthenticated
     # visitors; authenticated users get a real URL change so the address
     # bar reflects state.
@@ -31,13 +32,23 @@ module Collavre
       return unless request.env["collavre.root_request"]
       return unless authenticated?
 
-      target = SystemSetting.home_page_path_authenticated
+      target = last_visited_creative_path || SystemSetting.home_page_path_authenticated
       return if target.blank?
       return if target == "/"
 
       redirect_to target
     end
 
+    def last_visited_creative_path
+      home_path = HomePagePath.mount_relative(script_name: request.script_name)
+      return unless home_path == "/creatives" || home_path == "/creatives.html"
+
+      creative = Current.user.last_visited_creative
+      return unless creative&.has_permission?(Current.user, :read)
+
+      collavre_engine.creatives_path(id: creative.id, script_name: request.script_name)
+    end
+
     def set_csrf_token_header
       return unless protect_against_forgery?
 

data/app/controllers/collavre/comment_read_pointers_controller.rb

@@ -1,68 +1,97 @@
 module Collavre
   class CommentReadPointersController < ApplicationController
+    LEGACY_TOPIC_WATERMARK_KEY = "_legacy"
+
     def update
       creative = Creative.find(params[:creative_id]).effective_origin
-      last_id = creative.comments.visible_to(Current.user).maximum(:id)
-      pointer = CommentReadPointer.find_or_initialize_by(user: Current.user, creative: creative)
+      topic = params[:topic_id].present? && creative.topics.find_by(id: params[:topic_id])
+      return head :unprocessable_entity if params[:topic_id].present? && !topic
 
-      previous_last_read_id = pointer.last_read_comment_id
-      pointer.last_read_comment_id = last_id
-      pointer.save!
+      last_ids = topic ? topic_last_id(creative, topic) : all_message_last_ids(creative)
+      positions = Comments::ReadPointerWriter.new(creative: creative, user: Current.user).call(last_ids)
+      Comments::ReadReceiptBroadcaster.new(creative: creative).call(positions)
 
-      mark_inbox_items_read(creative, last_id)
       Comment.broadcast_badge(creative, Current.user)
 
-      if previous_last_read_id && previous_last_read_id != last_id
-        broadcast_read_receipts(creative, previous_last_read_id)
-      end
-      broadcast_read_receipts(creative, last_id)
-
       render json: { success: true }
+    rescue Comments::ReadPointerWriter::StaleTopicError
+      head :unprocessable_entity
     end
 
     private
 
-    def broadcast_read_receipts(creative, comment_id)
-      return unless comment_id
-
-      # We map to the nearest PUBLIC comment to avoid leaking the existence/ID of private comments
-      # via the public action cable channel.
-      # Trade-off: Private-only threads (with no preceding public comment) will not get real-time read updates.
-      effective_id = find_nearest_public_comment_id(creative, comment_id)
-      return unless effective_id
+    def topic_last_id(creative, topic)
+      { topic.id => creative.comments.visible_to(Current.user).where(topic: topic).maximum(:id) }
+    end
 
-      users = fetch_users_on_effective_id(creative, effective_id)
+    # All Messages renders Main plus active topics, not archived ones. Do not
+    # advance the retained legacy pointer here: an archived topic without its
+    # own pointer falls back to it, so moving that watermark would silently mark
+    # its hidden comments as read.
+    def all_message_last_ids(creative)
+      visible_comments = creative.comments.visible_to(Current.user)
+      topic_watermarks, legacy_watermark = normalized_topic_watermarks(params[:topic_watermarks])
+      return watermarked_last_ids(creative, visible_comments, topic_watermarks, legacy_watermark) if
+        topic_watermarks.any? || legacy_watermark.positive?
+
+      unwatermarked_last_ids(creative, visible_comments)
+    end
 
-      present_user_ids = CommentPresenceStore.list(creative.id)
+    def normalized_topic_watermarks(rendered_topic_watermarks)
+      raw_watermarks = rendered_topic_watermarks.respond_to?(:to_unsafe_h) ? rendered_topic_watermarks.to_unsafe_h : rendered_topic_watermarks.to_h
+      topic_watermarks = raw_watermarks.filter_map do |topic_id, comment_id|
+        [ topic_id.to_i, comment_id.to_i ] if topic_id.to_i.positive? && comment_id.to_i.positive?
+      end.to_h
 
-      Turbo::StreamsChannel.broadcast_update_to(
-        [ creative, :comments ],
-        target: "read_receipts_comment_#{effective_id}",
-        partial: "collavre/comments/read_receipts",
-        locals: { read_by_users: users, present_user_ids: present_user_ids }
-      )
+      [ topic_watermarks, raw_watermarks[LEGACY_TOPIC_WATERMARK_KEY].to_i ]
     end
 
-    def find_nearest_public_comment_id(creative, comment_id)
-      creative.comments.public_only.where("id <= ?", comment_id).maximum(:id)
+    def watermarked_last_ids(creative, visible_comments, topic_watermarks, legacy_watermark)
+      last_ids = bounded_topic_last_ids(creative, visible_comments, topic_watermarks)
+      return last_ids unless legacy_watermark.positive?
+
+      legacy_last_id = visible_comments.where(topic_id: nil).where("comments.id <= ?", legacy_watermark).maximum(:id)
+      legacy_last_id ? last_ids.merge(nil => legacy_last_id) : last_ids
     end
 
-    def fetch_users_on_effective_id(creative, effective_id)
-      next_public_id = creative.comments.public_only.where("id > ?", effective_id).minimum(:id)
+    # Every rendered topic carries its own bound, so the maxima are OR-ed into a
+    # single grouped query rather than one MAX per topic. Built from relations
+    # rather than a SQL fragment: a hand-built string here would be safe (literal
+    # template, bound values) but unprovably so to a scanner.
+    def bounded_topic_last_ids(creative, visible_comments, topic_watermarks)
+      topic_ids = creative.topics.where(id: topic_watermarks.keys).pluck(:id)
+      return {} if topic_ids.empty?
+
+      scopes = topic_ids.map do |topic_id|
+        Comment.where(creative_id: creative.id, topic_id: topic_id)
+               .where(Comment.arel_table[:id].lteq(topic_watermarks.fetch(topic_id)))
+      end
+      maxima = grouped_topic_maxima(visible_comments, scopes)
+      topic_ids.index_with { |topic_id| maxima[topic_id] }
+    end
 
-      query = CommentReadPointer.where(creative: creative)
-                                .where("last_read_comment_id >= ?", effective_id)
+    def unwatermarked_last_ids(creative, visible_comments)
+      rendered_topic_ids_supplied = params.key?(:topic_ids)
+      topics = rendered_topic_ids_supplied ? creative.topics.where(id: Array(params[:topic_ids])) : creative.topics
+      topic_ids = topics.pluck(:id)
+      maxima = visible_comments.where(topic_id: topic_ids).group(:topic_id).maximum(:id)
+      last_ids = topic_ids.index_with { |topic_id| maxima[topic_id] }
+      return last_ids if rendered_topic_ids_supplied
 
-      query = query.where("last_read_comment_id < ?", next_public_id) if next_public_id
+      legacy_client_last_ids(visible_comments, last_ids)
+    end
 
-      query.includes(user: { avatar_attachment: :blob }).map(&:user)
+    # Clients deployed before topic-scoped watermarks only send creative_id.
+    # Preserve the previous creative-wide endpoint semantics for them: every
+    # named topic, including archived topics, and the retained legacy lane
+    # advance through the visible history.
+    def legacy_client_last_ids(visible_comments, last_ids)
+      legacy_last_id = visible_comments.where(topic_id: nil).maximum(:id)
+      legacy_last_id ? last_ids.merge(nil => legacy_last_id) : last_ids
     end
 
-    # No-op: inbox notifications are now comments on the user's inbox creative.
-    # Reading comments on a creative updates the CommentReadPointer, which
-    # automatically handles the unread count for the inbox badge.
-    def mark_inbox_items_read(_creative, _last_comment_id)
-      # Intentionally empty — kept for backward compatibility during transition.
+    def grouped_topic_maxima(visible_comments, scopes)
+      visible_comments.merge(scopes.reduce { |combined, scope| combined.or(scope) }).group(:topic_id).maximum(:id)
     end
   end
 end