collavre 0.24.0 → 0.25.0

data/app/controllers/collavre/user_creative_preferences_controller.rb

@@ -1,60 +1,244 @@
 module Collavre
   class UserCreativePreferencesController < ApplicationController
+    MAX_LAST_TOPIC_SAVE_SESSIONS = 32
+    # A concurrent collapse can delete the row between the lookup and the lock.
+    # Retrying twice covers that race; beyond it the row is not coming back.
+    MAX_PREFERENCE_LOCK_ATTEMPTS = 3
+
     def toggle
       creative_id = params[:creative_id]
       node_id = params[:node_id].to_s
       expanded = ActiveModel::Type::Boolean.new.cast(params[:expanded])
 
-      record = UserCreativePreference.find_or_initialize_by(creative_id: creative_id, user_id: Current.user.id)
-      state = record.expanded_status || {}
+      with_preference(creative_id) do |record|
+        state = record.expanded_status || {}
 
-      if expanded
-        state[node_id] = true
-      else
-        state.delete(node_id)
-      end
+        if expanded
+          state[node_id] = true
+        else
+          state.delete(node_id)
+        end
 
-      record.expanded_status = state
-      if state.empty? && record.last_topic_id.nil?
-        record.destroy if record.persisted?
-      else
-        record.save!
+        record.expanded_status = state
+        if empty_preference?(record, state)
+          record.destroy!
+        else
+          record.save!
+        end
       end
 
       render json: { success: true }
     end
 
     def update_last_topic
+      return issue_last_topic_save_fence if request.post?
+
       creative = Creative.find(params[:creative_id]).effective_origin
 
-      unless creative.has_permission?(Current.user, :read) || creative.user == Current.user
-        render json: { error: I18n.t("collavre.user_creative_preferences.no_permission") }, status: :forbidden and return
+      return render_forbidden unless readable?(creative)
+
+      result = persist_last_topic_selection(creative)
+      return render_invalid_topic unless result
+
+      record, saved = result
+      broadcast_last_topic(creative, record) if saved
+
+      render json: {
+        success: saved,
+        stale_last_topic_save: !saved,
+        last_topic_revision: [ record.id, record.last_topic_revision ]
+      }
+    end
+
+    # Issue this before sending the PATCH so an older request that is still
+    # running can never commit after a newer selection. The two counters are
+    # deliberately global to this user/creative preference, rather than one
+    # per controller session, so their storage stays bounded.
+    def issue_last_topic_save_fence
+      creative = Creative.find(params[:creative_id]).effective_origin
+
+      return render_forbidden unless readable?(creative)
+
+      fence = with_preference(creative.id) do |record|
+        record.last_topic_save_fence_issued = [
+          record.last_topic_save_fence_issued.to_i,
+          record.last_topic_save_fence_applied.to_i
+        ].max + 1
+        record.save!
+        record.last_topic_save_fence_issued
+      end
+
+      render json: { last_topic_save_fence: fence }
+    end
+
+    private
+
+    def readable?(creative)
+      creative.has_permission?(Current.user, :read) || creative.user == Current.user
+    end
+
+    def empty_preference?(record, state)
+      state.empty? && record.last_topic_id.nil? && record.last_topic_revision.to_i.zero? &&
+        record.last_topic_save_fence_issued.to_i.zero? && record.last_topic_save_fence_applied.to_i.zero?
+    end
+
+    def persist_last_topic_selection(creative)
+      topic_id = params[:last_topic_id].presence
+      return persist_last_topic(creative) unless topic_id
+
+      Topic.transaction do
+        topic = Topic.lock.find_by(id: topic_id)
+        next unless topic&.creative_id == creative.id
+
+        persist_last_topic(creative)
       end
+    end
+
+    def persist_last_topic(creative)
+      with_preference(creative.id) do |record|
+        if stale_last_topic_save?(record)
+          next [ record, false ]
+        end
 
-      # Validate that the topic belongs to this creative
-      if params[:last_topic_id].present?
-        unless creative.topics.exists?(id: params[:last_topic_id])
-          render json: { error: I18n.t("collavre.user_creative_preferences.invalid_topic") }, status: :unprocessable_entity and return
+        record.expanded_status ||= {}
+        record.last_topic_id = params[:last_topic_id].presence
+        record.last_topic_revision = record.last_topic_revision.to_i + 1
+        assign_last_topic_save_order(record)
+        # Retain a cleared preference after it has participated in last-topic
+        # ordering. Its revision lets a reopened client distinguish a newer
+        # Main selection from the empty snapshot that preceded an in-flight save.
+        if empty_preference?(record, record.expanded_status)
+          record.destroy!
+        else
+          record.save!
         end
+        [ record, true ]
+      end
+    end
+
+    # The client id carries a controller session, a monotonically increasing
+    # sequence, and an echo nonce. Older clients still send arbitrary ids, so
+    # only recognized ordering ids take this fencing path.
+    def stale_last_topic_save?(record)
+      fence = last_topic_save_fence
+      if fence
+        return true if fence > record.last_topic_save_fence_issued.to_i
+
+        return record.last_topic_save_fence_applied.to_i >= fence
       end
 
-      record = UserCreativePreference.find_or_initialize_by(creative_id: creative.id, user_id: Current.user.id)
-      record.expanded_status ||= {}
-      record.last_topic_id = params[:last_topic_id].presence
+      session_id, sequence = last_topic_save_order
+      return false unless session_id.present?
+
+      last_topic_save_sequences(record).fetch(session_id, 0).to_i >= sequence
+    end
 
-      if record.expanded_status.empty? && record.last_topic_id.nil?
-        record.destroy if record.persisted?
+    def assign_last_topic_save_order(record)
+      fence = last_topic_save_fence
+      if fence
+        record.last_topic_save_fence_applied = fence
       else
-        record.save!
+        # Any unfenced PATCH can come from a client running the previous bundle.
+        # It supersedes every fence issued before it, so retire them before a
+        # delayed fenced save can overwrite it.
+        record.last_topic_save_fence_applied = record.last_topic_save_fence_issued.to_i
       end
 
-      # Broadcast only to the current user's sessions (not all creative subscribers)
-      TopicsChannel.broadcast_to(
-        "user_#{Current.user.id}_creative_#{creative.id}",
-        { action: "last_topic_changed", last_topic_id: record.last_topic_id }
-      )
+      # Fenced saves must update this too. A same-session fallback PATCH can
+      # outlive an earlier request and must remain ordered behind it.
+      session_id, sequence = last_topic_save_order
+      return unless session_id.present?
 
-      render json: { success: true }
+      sequences = last_topic_save_sequences(record)
+      # Keep recent sessions in insertion order so a preference cannot retain
+      # an unbounded history of tabs that have already gone away.
+      sequences.delete(session_id)
+      sequences[session_id] = sequence
+      sequences.shift while sequences.size > MAX_LAST_TOPIC_SAVE_SESSIONS
+
+      record.last_topic_save_sequences = sequences
+      record.last_topic_save_session_id = session_id
+      record.last_topic_save_sequence = sequence
+    end
+
+    # insert_all uses the unique preference key as the first-insert fence.
+    # A row lock alone cannot serialize two requests that both see no row.
+    def preference_for(creative_id)
+      now = Time.current
+      attributes = { creative_id: creative_id, user_id: Current.user.id, expanded_status: {}, created_at: now, updated_at: now }
+      UserCreativePreference.insert_all([ attributes ], unique_by: :index_user_creative_preferences_on_creative_id_and_user_id)
+      UserCreativePreference.find_by!(creative_id: creative_id, user_id: Current.user.id)
+    end
+
+    # A collapse can remove an empty row after it is found but before with_lock
+    # reloads it. Reacquire by the unique preference key so every save path
+    # shares the same first-insert and deletion-race handling.
+    #
+    # Only the lookup/lock window is retried, and only a bounded number of
+    # times: once the row is locked the block owns the transaction, so a
+    # RecordNotFound it raises itself must propagate rather than replay the
+    # block, and a row that keeps vanishing must surface instead of spinning.
+    def with_preference(creative_id)
+      attempts = 0
+      locked = false
+
+      begin
+        record = preference_for(creative_id)
+        record.with_lock do
+          locked = true
+          yield record
+        end
+      rescue ActiveRecord::RecordNotFound
+        raise if locked
+
+        attempts += 1
+        raise if attempts >= MAX_PREFERENCE_LOCK_ATTEMPTS
+
+        retry
+      end
+    end
+
+    # Preserve the legacy single-session columns while a rolling deploy may
+    # still have records written by the preceding application version.
+    def last_topic_save_sequences(record)
+      sequences = record.last_topic_save_sequences || {}
+      legacy_session_id = record.last_topic_save_session_id
+      return sequences unless legacy_session_id.present?
+
+      legacy_sequence = record.last_topic_save_sequence.to_i
+      sequences.merge(legacy_session_id => [ sequences.fetch(legacy_session_id, 0).to_i, legacy_sequence ].max)
+    end
+
+    def last_topic_save_order
+      match = params[:client_id].to_s.match(/\A([A-Za-z0-9-]+)\.([1-9]\d*)\.[A-Za-z0-9-]+\z/)
+      return [ nil, nil ] unless match
+
+      [ match[1], match[2].to_i ]
+    end
+
+    def last_topic_save_fence
+      value = params[:last_topic_save_fence].to_s
+      return unless value.match?(/\A[1-9]\d*\z/)
+
+      value.to_i
+    end
+
+    def broadcast_last_topic(creative, record)
+      payload = {
+        action: "last_topic_changed",
+        last_topic_id: record.last_topic_id,
+        last_topic_revision: [ record.id, record.last_topic_revision ],
+        client_id: params[:client_id].presence
+      }
+      TopicsChannel.broadcast_to("user_#{Current.user.id}_creative_#{creative.id}", payload)
+    end
+
+    def render_forbidden
+      render json: { error: I18n.t("collavre.user_creative_preferences.no_permission") }, status: :forbidden
+    end
+
+    def render_invalid_topic
+      render json: { error: I18n.t("collavre.user_creative_preferences.invalid_topic") }, status: :unprocessable_entity
     end
   end
 end

data/app/controllers/concerns/collavre/comments/batch_operations.rb

@@ -47,9 +47,7 @@ module Collavre
         visible_scope = @creative.comments.visible_to(Current.user)
         comments = visible_scope.where(id: comment_ids).to_a
 
-        if comments.length != comment_ids.length
-          render json: { error: I18n.t("collavre.comments.batch_delete_not_found") }, status: :not_found and return
-        end
+        return unless valid_merge_selection?(comments, comment_ids)
 
         # All comments must belong to the current user or their AI agents
         my_ai_agent_ids = Current.user.created_ai_users.pluck(:id)
@@ -88,6 +86,20 @@ module Collavre
       rescue ActiveRecord::RecordInvalid => e
         render json: { error: e.record.errors.full_messages.to_sentence }, status: :unprocessable_entity
       end
+
+      private
+
+      def valid_merge_selection?(comments, comment_ids)
+        if comments.length != comment_ids.length
+          render json: { error: I18n.t("collavre.comments.batch_delete_not_found") }, status: :not_found
+          false
+        elsif comments.map(&:topic_id).uniq.size != 1
+          render json: { error: I18n.t("collavre.comments.merge.same_topic_required") }, status: :unprocessable_entity
+          false
+        else
+          true
+        end
+      end
     end
   end
 end

data/app/controllers/concerns/collavre/comments/conversion.rb

@@ -36,7 +36,7 @@ module Collavre
       end
 
       def build_convert_system_message(creative)
-        title = helpers.strip_tags(creative.description).to_s.strip
+        title = Collavre::HtmlText.markdown_label(creative.description)
         title = I18n.t("collavre.comments.convert_system_message_default_title") if title.blank?
         url = creative_path(creative)
         I18n.t("collavre.comments.convert_system_message", title: title, url: url)

data/app/controllers/concerns/collavre/users_controller/ai_user_management.rb

@@ -10,6 +10,8 @@ module Collavre
 
     def new_ai
       @available_tools = load_available_tools
+      @llm_models = Collavre::LlmModel.suggestions
+      @agent_gateways = chat_capable_agent_gateways(Current.user)
 
       if params[:copy_from].present?
         source = Collavre::User.find_by(id: params[:copy_from])
@@ -34,6 +36,7 @@ module Collavre
         llm_model: params[:llm_model],
         llm_api_key: params[:llm_api_key],
         gateway_url: params[:gateway_url],
+        agent_gateway: selected_agent_gateway,
         tools: params[:tools] || [],
         searchable: searchable,
         email_verified_at: Time.current,
@@ -42,35 +45,122 @@ module Collavre
       )
       @user.agent_conf = params[:agent_conf] if @user.respond_to?(:agent_conf=) && params[:agent_conf].present?
 
-      if @user.save
+      saved = Collavre::User.transaction do
+        next false unless @user.save
+
+        remember_llm_model(@user)
         Collavre::Contact.ensure(user: Current.user, contact_user: @user)
         share_ai_agent_to_creative(@user, params[:creative_id])
-        redirect_to user_path(Current.user, tab: "contacts"), notice: I18n.t("collavre.users.create_ai.success")
+        true
+      end
+
+      if saved
+        redirect_to current_user_contacts_path, notice: I18n.t("collavre.users.create_ai.success")
       else
         flash.now[:alert] = @user.errors.full_messages.to_sentence
         @available_tools = load_available_tools
+        @llm_models = Collavre::LlmModel.suggestions
+        @agent_gateways = chat_capable_agent_gateways(Current.user)
         render :new_ai, status: :unprocessable_entity
       end
     end
 
     def edit_ai
       @available_tools = load_available_tools
+      @llm_models = Collavre::LlmModel.suggestions
+      @agent_gateways = editable_agent_gateways(@user)
+      @has_stored_llm_api_key = @user.llm_api_key.present?
+      @return_to = safe_return_to(params[:return_to].presence || request.referer)
     end
 
     def update_ai
-      ai_params = params.require(:user).permit(:name, :system_prompt, :llm_vendor, :llm_model, :llm_api_key, :gateway_url, :searchable, :routing_expression, :agent_conf, tools: [])
+      ai_params = params.require(:user).permit(:name, :system_prompt, :llm_vendor, :llm_model, :llm_api_key, :clear_llm_api_key, :gateway_url, :agent_gateway_id, :searchable, :routing_expression, :agent_conf, tools: [])
+      effective_vendor = ai_params[:llm_vendor].presence || @user.llm_vendor
+      if effective_vendor == "cli_proxy" && ai_params.key?(:agent_gateway_id)
+        gateways = gateway_owner_for(@user).owned_agent_gateways
+        gateway = if ai_params[:agent_gateway_id].to_s == @user.agent_gateway_id.to_s
+          gateways.find_by(id: ai_params[:agent_gateway_id])
+        else
+          gateways.active.find_by(id: ai_params[:agent_gateway_id])
+        end
+        ai_params[:agent_gateway_id] = gateway&.id
+      elsif ai_params.key?(:llm_vendor)
+        ai_params[:agent_gateway_id] = nil
+      end
+      clear_llm_api_key = ActiveModel::Type::Boolean.new.cast(ai_params.delete(:clear_llm_api_key))
+      @has_stored_llm_api_key = @user.llm_api_key.present?
+      @clear_llm_api_key = clear_llm_api_key
+
+      if clear_llm_api_key
+        ai_params[:llm_api_key] = nil
+      elsif ai_params[:llm_api_key].blank?
+        ai_params.delete(:llm_api_key)
+      end
+
+      updated = Collavre::User.transaction do
+        next false unless @user.update(ai_params)
+
+        if @user.saved_change_to_llm_vendor? || @user.saved_change_to_llm_model?
+          remember_llm_model(@user)
+        end
+        true
+      end
 
-      if @user.update(ai_params)
-        redirect_to edit_ai_user_path(@user), notice: I18n.t("collavre.users.update_ai.success")
+      if updated
+        redirect_to update_ai_destination, notice: I18n.t("collavre.users.update_ai.success")
       else
-        @available_tools = load_available_tools
-        flash.now[:alert] = @user.errors.full_messages.to_sentence
-        render :edit_ai, status: :unprocessable_entity
+        render_ai_edit_failure
       end
     end
 
     private
 
+    def current_user_contacts_path
+      user_path(Current.user, tab: "contacts")
+    end
+
+    def render_ai_edit_failure
+      @available_tools = load_available_tools
+      @llm_models = Collavre::LlmModel.suggestions
+      @agent_gateways = editable_agent_gateways(@user)
+      @return_to = safe_return_to(params[:return_to])
+      flash.now[:alert] = @user.errors.full_messages.to_sentence
+      render :edit_ai, status: :unprocessable_entity
+    end
+
+    # Saving should land back on whatever list opened the form (the admin user
+    # list, a profile's contacts tab, the org chart), not a fixed page.
+    def update_ai_destination
+      safe_return_to(params[:return_to]) || current_user_contacts_path
+    end
+
+    def safe_return_to(candidate)
+      path = local_path_for(candidate)
+      return nil if path.nil? || path.split("?").first == edit_ai_user_path(@user)
+
+      path
+    end
+
+    def local_path_for(candidate)
+      return nil if candidate.blank?
+
+      uri = URI.parse(candidate)
+      return nil if uri.host.present? && uri.host != request.host
+      return nil unless uri.path.to_s.start_with?("/") && !uri.path.start_with?("//")
+
+      [ uri.path, uri.query ].compact_blank.join("?")
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def remember_llm_model(user)
+      Collavre::LlmModel.remember!(
+        vendor: user.llm_vendor,
+        name: user.llm_model,
+        creator: Current.user
+      )
+    end
+
     def load_available_tools
       Collavre::McpService.available_tools(Current.user).map do |tool|
         {
@@ -81,6 +171,26 @@ module Collavre
       end
     end
 
+    def selected_agent_gateway
+      return unless params[:llm_vendor] == "cli_proxy"
+
+      Current.user.owned_agent_gateways.active.find_by(id: params[:agent_gateway_id])
+    end
+
+    def gateway_owner_for(agent)
+      agent.creator || Current.user
+    end
+
+    def editable_agent_gateways(agent)
+      gateways = gateway_owner_for(agent).owned_agent_gateways
+      selected_gateway = gateways.find_by(id: agent.agent_gateway_id)
+      (chat_capable_agent_gateways(gateway_owner_for(agent)) + [ selected_gateway ]).compact.uniq.sort_by(&:name)
+    end
+
+    def chat_capable_agent_gateways(owner)
+      owner.owned_agent_gateways.active.order(:name).select(&:chat_capable?)
+    end
+
     def set_user_for_ai_actions
       @user = Collavre::User.find(params[:id])
     end

data/app/controllers/concerns/collavre/users_controller/profile_and_settings.rb

@@ -58,14 +58,6 @@ module Collavre
       end
     end
 
-    def typo_correction
-      @user = Collavre::User.find(params[:id])
-
-      unless @user == Current.user || Current.user.system_admin?
-        redirect_to user_path(Current.user), alert: I18n.t("collavre.users.destroy.not_authorized")
-      end
-    end
-
     def update_password
       @user = Collavre::User.find(params[:id])
       if @user.authenticate(params[:user][:current_password])
@@ -98,13 +90,7 @@ module Collavre
         :calendar_id,
         :timezone,
         :locale,
-        :typo_correction_enabled,
-        :typo_correction_threshold,
-        :typo_correction_on_soft_keyboard,
-        :typo_correction_on_voice,
-        :typo_correction_on_physical_keyboard,
-        :typo_correction_in_chat,
-        :typo_correction_in_editor
+        :creative_workspace_enabled
       ).tap do |p|
         p[:locale] = normalize_supported_locale(p[:locale]) if p.key?(:locale)
       end

data/app/controllers/concerns/collavre/users_controller/registration.rb

@@ -11,7 +11,7 @@ module Collavre
       @user = Collavre::User.new
       if params[:invite_token].present?
         @invitation = Collavre::Invitation.find_by_token_for(:invite, params[:invite_token])
-        @user.email = @invitation&.email
+        @user.email = @invitation.email if @invitation&.email.present?
       end
     end
 
@@ -22,7 +22,7 @@ module Collavre
           invitation = Collavre::Invitation.find_by_token_for(:invite, params[:invite_token])
           if invitation
             @invitation = invitation
-            @user.email = invitation.email
+            @user.email = invitation.email if invitation.email.present?
           end
         end
         if @user.save

data/app/errors/collavre/turn_deadline_error.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Collavre
+  # Raised by AgentLifecycleManager when an agent turn exceeds its wall-clock
+  # deadline (SystemSetting.ai_agent_turn_deadline_seconds).
+  #
+  # Subclasses CancelledError deliberately: AiClient#chat re-raises
+  # CancelledError but swallows every other StandardError into a streamed
+  # "AI Error" message, and the CancelledError rescue chain (AiAgentService,
+  # AiAgentJob) already preserves partial content, keeps the row's terminal
+  # status, releases the resource slot and drains the topic queue.
+  class TurnDeadlineError < CancelledError
+    attr_reader :deadline_seconds
+
+    def initialize(deadline_seconds)
+      @deadline_seconds = deadline_seconds
+      super("Turn exceeded the #{deadline_seconds}s deadline")
+    end
+  end
+end

data/app/helpers/collavre/application_helper.rb

@@ -6,6 +6,7 @@ module Collavre
     COLLAVRE_STYLESHEETS = %w[
       collavre/design_tokens
       collavre/dark_mode
+      collavre/secret_fields
       collavre/gnb
       collavre/creatives
       collavre/actiontext
@@ -14,6 +15,7 @@ module Collavre
       collavre/org_chart
       collavre/popup
       collavre/comments_popup
+      collavre/workspace
       collavre/tables
       collavre/code_highlight
       collavre/comment_versions
@@ -43,6 +45,14 @@ module Collavre
       safe_join(tags, "\n    ")
     end
 
+    def masked_secret_field(form, method, options = {})
+      form.text_field(method, masked_secret_field_options(options))
+    end
+
+    def masked_secret_field_tag(name, value = nil, options = {})
+      text_field_tag(name, value, masked_secret_field_options(options))
+    end
+
     # Returns the body CSS class for the current user's theme.
     # Custom themes get "light-mode" to disable OS dark mode overrides,
     # ensuring the custom theme controls all colors regardless of OS setting.
@@ -60,6 +70,25 @@ module Collavre
       end
     end
 
+    # The creative index is reachable at both "/" (root route) and
+    # "/creatives", so the list filters cannot decide "am I already on the
+    # index?" from the pathname alone — they read this instead.
+    def creative_index_page?
+      controller_path == "collavre/creatives" && action_name == "index"
+    end
+
+    def creative_workspace?
+      Current.user&.creative_workspace_enabled? &&
+        creative_index_page? &&
+        !@auto_fullscreen
+    end
+
+    # Identifies requests made by the packaged Tauri shell. Desktop-only UI
+    # fallbacks should use this rather than attempting platform browser checks.
+    def desktop?
+      request.user_agent.to_s.start_with?("CollavreDesktop/")
+    end
+
     # Renders CSS for admin-configured default themes (light/dark mode)
     # Only applies when the user has no personal theme set
     def default_theme_styles
@@ -97,6 +126,15 @@ module Collavre
 
     private
 
+    def masked_secret_field_options(options)
+      options.merge(
+        autocomplete: "off",
+        autocapitalize: "none",
+        spellcheck: false,
+        class: class_names("masked-secret-field", options[:class])
+      )
+    end
+
     CSS_VARIABLE_KEY_PATTERN = /\A--[a-zA-Z0-9_-]+\z/
     CSS_VARIABLE_VALUE_PATTERN = /\A[^;}{<>"']+\z/
     ALLOWED_COLOR_SCHEMES = %w[light dark].freeze