openclacky 1.5.20 → 1.5.22

data/lib/clacky/server/model_prices.rb

@@ -6,7 +6,8 @@ module Clacky
     # Resolves each model's input/output price (USD per 1M tokens) from
     # Clacky::ModelPricing plus a cost ratio vs the baseline model, so the
     # web UI never hardcodes prices - updating PRICING_TABLE is enough.
-    # Prices are post-promotion; `discount` is present when a rule applied,
+    # Prices are what the platform actually bills: post-promotion rates plus
+    # any lane markup. `discount` is present when a promotion applied,
     # carrying both the rate and its reason ("channel" or "promo") so the UI
     # can pick the right explanation.
     module ModelPrices
@@ -25,12 +26,13 @@ module Clacky
           next unless pricing
           info = Clacky::ModelPricing.discount_info(name)
           rate = info ? info[:rate] : 1.0
+          markup = Clacky::ModelPricing.markup_rate(name)
           # Rates are not powers of two, so the discounted product carries float
           # noise (3.0 * 0.95 == 2.8499999999999996) that would surface verbatim
           # in the picker tooltips. Four decimals is already finer than any
           # listed price.
-          pin  = (pricing[:input][:default] * rate).round(4)
-          pout = (pricing[:output][:default] * rate).round(4)
+          pin  = (pricing[:input][:default] * rate * markup).round(4)
+          pout = (pricing[:output][:default] * rate * markup).round(4)
           entry = { in: pin, out: pout, ratio: (pin + pout) / base_total }
           entry[:discount] = { rate: rate, reason: info[:reason] } if rate < 1.0
           prices[name] = entry

data/lib/clacky/server/pid_files.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+require_relative "../agent_config"
+
+module Clacky
+  module Server
+    # Shared directory policy for master lifecycle and CLI discovery.
+    module PidFiles
+      module_function
+
+      def directory
+        override = ENV["CLACKY_PID_DIR"]
+        configured = if override && !override.strip.empty?
+                       override
+                     else
+                       AgentConfig.load.pid_dir
+                     end
+        return Dir.tmpdir if configured.nil? || configured.strip.empty?
+
+        File.expand_path(configured)
+      end
+    end
+  end
+end

data/lib/clacky/server/preview.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "socket"
 require "timeout"
+require "uri"
 
 module Clacky
   module Server
@@ -47,18 +48,53 @@ module Clacky
         ".ogg"   => "audio/ogg"
       }.freeze
 
-      # Injected into preview HTML responses. The preview iframe is sandboxed
-      # without allow-same-origin, so the host page cannot read its location
-      # (and the iframe's src property does not follow internal navigations).
-      # Each served page therefore announces its own URL to the parent.
-      PREVIEW_NAV_REPORT = '<script>(function(){try{parent.postMessage({__clackyPreview:1,href:location.href},"*")}catch(e){}})()</script>'
+      # Injected into preview HTML responses. The preview iframe is cross-origin
+      # to the host page, so the host cannot read its location (and the iframe's
+      # src property does not follow internal navigations). Each served page
+      # therefore announces its own URL to the parent. Re-reporting is not just
+      # the initial load: Turbo/htmx/React-Router navigations swap the DOM
+      # without a full page load, so the same script also listens for their
+      # events, patches the History API and falls back to a slow poll.
+      PREVIEW_NAV_REPORT = <<~JS.freeze
+        <script>(function(){
+          var last = null;
+          function report(){
+            try {
+              if (location.href === last) return;
+              last = location.href;
+              parent.postMessage({__clackyPreview:1,href:location.href},"*");
+            } catch(e){}
+          }
+          report();
+          ["turbo:load","turbo:render","turbo:frame-load","htmx:afterSwap","pjax:end","DOMContentLoaded"].forEach(function(n){
+            document.addEventListener(n, report);
+          });
+          window.addEventListener("popstate", report);
+          window.addEventListener("hashchange", report);
+          var push = history.pushState, replace = history.replaceState;
+          history.pushState = function(){ push.apply(history, arguments); report(); };
+          history.replaceState = function(){ replace.apply(history, arguments); report(); };
+          setInterval(report, 500);
+        })()</script>
+      JS
+
+
+      # Must match ISOLATED_PREVIEW_HOST in
+      # default_extensions/preview/panels/preview/view.js. Chrome resolves
+      # every *.localhost name to loopback, so the preview frame runs on this
+      # origin while the UI stays on 127.0.0.1/localhost.
+      ISOLATED_PREVIEW_HOST = "preview.localhost"
+
+      # Hostnames a dev server may redirect to with an absolute URL. Only these
+      # are folded back into the proxy prefix; anything else is a deliberate
+      # off-box redirect and is passed through untouched.
+      LOOPBACK_HOSTS = %w[127.0.0.1 localhost ::1].freeze
 
       # Headers dropped when proxying a localhost dev server through the
-      # preview panel. X-Frame-Options is what blocks the sandboxed iframe;
-      # hop-by-hop headers and Set-Cookie must not cross the proxy boundary
-      # (WEBrick recomputes the former, cookies would leak the upstream's
-      # domain into ours). CSP frame-ancestors is handled separately so the
-      # rest of the policy survives.
+      # preview panel. X-Frame-Options is what blocks the sandboxed iframe and
+      # hop-by-hop headers are recomputed by WEBrick. Set-Cookie is handled
+      # separately (see #preview_cookie) because the isolated preview origin
+      # needs the upstream session to survive inside a third-party frame.
       PROXY_SKIP_HEADERS = %w[
         x-frame-options
         transfer-encoding
@@ -70,7 +106,6 @@ module Clacky
         te
         trailer
         upgrade
-        set-cookie
       ].freeze
 
       # Connection-stage failures when dialing the localhost dev server. The
@@ -189,11 +224,8 @@ module Clacky
       # the document start) so the reporter runs before page scripts while a
       # leading <!DOCTYPE> stays first — prepending would flip the document
       # into quirks mode.
-      private def preview_body(abs)
-        body = File.binread(abs)
-        return body unless (PREVIEW_CONTENT_TYPES[File.extname(abs).downcase] || "").start_with?("text/html")
-
-        html = body.force_encoding(Encoding::UTF_8)
+      private def inject_nav_report(html)
+        html = html.force_encoding(Encoding::UTF_8)
         if (m = html.match(/<head[^>]*>/i))
           html[m.end(0), 0] = PREVIEW_NAV_REPORT
         elsif (m = html.match(/<html[^>]*>/i))
@@ -206,6 +238,13 @@ module Clacky
         html
       end
 
+      private def preview_body(abs)
+        body = File.binread(abs)
+        return body unless (PREVIEW_CONTENT_TYPES[File.extname(abs).downcase] || "").start_with?("text/html")
+
+        inject_nav_report(body)
+      end
+
       # Decode %XX escapes in a preview path segment without treating "+" as
       # space: "+" is a legal literal character in file names.
       private def preview_decode_path(seg)
@@ -285,6 +324,15 @@ module Clacky
             next if value.nil? || value.empty?
           end
           next if PROXY_SKIP_HEADERS.include?(down)
+          if down == "set-cookie"
+            cookie = preview_cookie(value)
+            res.cookies << cookie if cookie && isolated_preview_request?(req)
+            next
+          end
+          if down == "location"
+            res[name] = rewrite_preview_location(value, port, req)
+            next
+          end
           if down == "content-type"
             is_html = value.start_with?("text/html")
             is_css  = value.start_with?("text/css")
@@ -300,7 +348,7 @@ module Clacky
         if req.request_method != "HEAD"
           body = resp.body.to_s
           if is_html
-            body = rewrite_preview_paths(body, port)
+            body = inject_nav_report(rewrite_preview_paths(body, port))
           elsif is_css
             body = rewrite_preview_css(body, port)
           end
@@ -319,6 +367,59 @@ module Clacky
         stripped.empty? ? nil : stripped
       end
 
+      # Rewrites an upstream Set-Cookie so it survives inside the preview
+      # frame. The frame is a third-party context for the host UI, where Chrome
+      # drops SameSite=Lax/Strict cookies outright, so the session cookie the
+      # dev server just set would be discarded and every page would look like a
+      # fresh, cookie-less visit. SameSite=None needs Secure, which Chrome
+      # accepts over http for *.localhost because it is a trustworthy origin.
+      # Domain is dropped so the cookie stays pinned to the preview origin and
+      # can never be read by the host UI.
+      private def preview_cookie(value)
+        parts = value.to_s.split(";").map(&:strip).reject(&:empty?)
+        return nil if parts.empty?
+
+        kept = parts[1..-1].reject do |attr|
+          attr =~ /\A(?:domain|samesite)\s*=/i || attr =~ /\Asecure\z/i
+        end
+        ([parts.first] + kept + ["SameSite=None", "Secure"]).join("; ")
+      end
+
+      private def isolated_preview_request?(req)
+        req["Host"].to_s.split(":").first.to_s.downcase == ISOLATED_PREVIEW_HOST
+      end
+
+      # An upstream 3xx points at the dev server root (/dashboard). Inside the
+      # isolated preview frame that resolves against the proxy origin and loses
+      # the /preview/p/<port> prefix, so the redirect lands on a 404 — and the
+      # address bar never sees the new page. Keep root-relative redirects inside
+      # the prefix and fold absolute ones that point back at the same dev
+      # server. Off-box and already-prefixed URLs pass through untouched.
+      private def rewrite_preview_location(value, port, req)
+        return value unless isolated_preview_request?(req)
+
+        prefix = "/preview/p/#{port}"
+        if value.start_with?("/") && !value.start_with?("//")
+          return value if value == prefix || value.start_with?("#{prefix}/", "#{prefix}?")
+
+          return "#{prefix}#{value}"
+        end
+
+        uri = begin
+          URI.parse(value)
+        rescue URI::InvalidURIError
+          return value
+        end
+        return value unless uri.host
+        return value unless LOOPBACK_HOSTS.include?(uri.host.downcase)
+        return value unless uri.port == port
+
+        path = uri.path.to_s.empty? ? "/" : uri.path
+        path += "?#{uri.query}" if uri.query
+        path += "##{uri.fragment}" if uri.fragment
+        "#{prefix}#{path}"
+      end
+
       # Rewrites absolute-path resource URLs (/assets/app.js) in a proxied HTML
       # page to the proxy prefix so the browser resolves them against the dev
       # server instead of the host origin. Protocol-relative (//), already

data/lib/clacky/server/scheduler.rb

@@ -141,13 +141,15 @@ module Clacky
         list_tasks.map do |task_name|
           content  = begin; read_task(task_name); rescue StandardError; ""; end
           schedule = schedule_map[task_name] || {}
+          cron     = schedule["cron"]
           {
             "name"    => task_name,
             "content" => content,
-            "cron"    => schedule["cron"],
+            "cron"    => cron,
             "enabled" => schedule.fetch("enabled", true),
             "scheduled" => !schedule.empty?,
-            "last_run" => last_runs[task_name]
+            "last_run" => last_runs[task_name],
+            "next_run" => cron ? cron_next_run(cron) : nil
           }
         end
       end
@@ -383,6 +385,83 @@ module Clacky
 
       # ── Cron parsing ─────────────────────────────────────────────────────────
 
+      # First time the 5-field cron expression fires strictly after +from+.
+      # Walks day by day (two years max) and only expands the hour/minute grid
+      # for days that match, so a yearly task costs ~365 cheap comparisons.
+      # Returns nil for malformed expressions and impossible ones (Feb 30).
+      private def cron_next_run(expr, from: Time.now)
+        fields = expr.to_s.strip.split(/\s+/)
+        return nil unless fields.size == 5
+
+        sets = [
+          cron_field_values(fields[0], 0, 59),
+          cron_field_values(fields[1], 0, 23),
+          cron_field_values(fields[2], 1, 31),
+          cron_field_values(fields[3], 1, 12),
+          cron_field_values(fields[4], 0, 6)
+        ]
+        return nil if sets.any?(&:nil?)
+
+        minutes, hours, doms, months, dows = sets
+        return nil if minutes.empty? || hours.empty? || doms.empty? || months.empty? || dows.empty?
+
+        # Anchor at noon so a day-step never lands on the wrong date across a
+        # DST boundary (Time#+ is absolute seconds, not calendar days).
+        noon  = Time.local(from.year, from.month, from.day, 12)
+        # Minute-of-day of the first candidate; same-day scans start here.
+        floor = from.hour * 60 + from.min + 1
+
+        (0..731).each do |offset|
+          day = noon + offset * 86_400
+          next unless months.include?(day.month) && doms.include?(day.day) && dows.include?(day.wday)
+
+          limit = offset.zero? ? floor : 0
+          hours.each do |h|
+            next if h * 60 + minutes.last < limit
+
+            minutes.each do |m|
+              next if h * 60 + m < limit
+
+              return Time.local(day.year, day.month, day.day, h, m, 0)
+            end
+          end
+        end
+
+        nil
+      end
+
+      # Concrete values a single cron field can take, mirroring the semantics of
+      # #cron_part_matches?. Returns nil when the field is unparseable.
+      private def cron_field_values(field, min, max)
+        values = []
+        field.to_s.split(",").each do |part|
+          part      = part.strip
+          base, step = part.split("/")
+          step      = step ? step.to_i : 1
+          return nil if step <= 0
+
+          lo, hi = if base == "*"
+                     [min, max]
+                   elsif base.include?("-")
+                     base.split("-").map(&:to_i)
+                   else
+                     value = Integer(base, exception: false)
+                     return nil if value.nil?
+                     [value, value]
+                   end
+          return nil if lo.nil? || hi.nil? || hi < lo
+
+          (lo..hi).each do |v|
+            next unless v.between?(min, max)
+            # `*` steps from zero (matches value % step), ranges step from lo.
+            next unless base == "*" ? (v % step).zero? : ((v - lo) % step).zero?
+
+            values << v
+          end
+        end
+        values.uniq.sort
+      end
+
       # Returns true if the 5-field cron expression matches the given Time.
       # Fields: minute hour day-of-month month day-of-week
       private def cron_matches?(expr, time)

data/lib/clacky/server/server_master.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "socket"
-require "tmpdir"
+require_relative "pid_files"
 require_relative "../banner"
 require_relative "../version"
 require_relative "../agent_config"
@@ -248,13 +248,19 @@ module Clacky
       end
 
       def pid_file_path
-        File.join(Dir.tmpdir, "clacky-master-#{@port}.pid")
+        File.join(pid_directory, "clacky-master-#{@port}.pid")
       end
 
       def write_pid_file
+        FileUtils.mkdir_p(pid_directory)
         File.write(pid_file_path, Process.pid.to_s)
       end
 
+      # Keep cleanup tied to the directory used at startup, even if config changes.
+      private def pid_directory
+        @pid_directory ||= PidFiles.directory
+      end
+
       def remove_pid_file
         # A replacement may already own the port after this master was stopped.
         if File.exist?(pid_file_path) && File.read(pid_file_path).strip == Process.pid.to_s
@@ -318,7 +324,7 @@ module Clacky
       end
 
       private def kill_master_on_port(port)
-        path = File.join(Dir.tmpdir, "clacky-master-#{port}.pid")
+        path = File.join(pid_directory, "clacky-master-#{port}.pid")
         return unless File.exist?(path)
 
         pid = File.read(path).strip.to_i

data/lib/clacky/server/session_registry.rb

@@ -194,7 +194,8 @@ module Clacky
       #   profile: "general"|"coding"|nil
       #            nil = no agent_profile filter
       #   limit:   max sessions to return (applies to NON-PINNED only; see below)
-      #   before:  ISO8601 cursor — only sessions with created_at < before
+      #   before, before_id: cursor — only sessions sorting after (before, before_id)
+      #             in the newest-first order; take it from a row's `cursor`
       #             (also applies to NON-PINNED only; pinned items are a separate
       #             logical section, they should never be paginated away)
       #   include_pinned: when true (default), all matching pinned sessions are
@@ -207,13 +208,13 @@ module Clacky
       #   archived:  false (default) → archived sessions are excluded from the
       #             result; true → ONLY archived sessions are returned. The two
       #             sets are disjoint, so every other caller keeps seeing exactly
-      #             the sessions it saw before archiving existed.
+      #             the sessions it saw before archiving existed. nil → no filter.
       #
       # Ordering of the returned array:
       #   [ ...all_pinned_matching (newest-first), ...non_pinned (newest-first, limited) ]
       #
       # source and profile are orthogonal — either can be nil independently.
-      def list(limit: nil, before: nil, q: nil, q_scope: "name", date: nil, type: nil, exclude_type: nil, include_pinned: true, project_id: nil, exclude_project: false, archived: false)
+      def list(limit: nil, before: nil, before_id: nil, q: nil, q_scope: "name", date: nil, type: nil, exclude_type: nil, include_pinned: true, project_id: nil, exclude_project: false, archived: false)
         return [] unless @session_manager
 
         live = @mutex.synchronize do
@@ -227,6 +228,7 @@ module Clacky
             model: model_info&.dig(:model), model_id: model_info&.dig(:id), name: live_name,
             total_tasks: s[:agent]&.total_tasks, total_cost: s[:agent]&.total_cost,
             cost_source: live_cost_source,
+            permission_mode: s[:agent]&.permission_mode,
             reasoning_effort: s[:agent]&.reasoning_effort,
             latest_latency: s[:agent]&.latest_latency,
             card_model: model_info&.dig(:card_model),
@@ -238,7 +240,7 @@ module Clacky
 
         all = @session_manager.all_sessions  # already sorted newest-first
 
-        all = all.select { |s| archived ? s[:archived_at].to_s != "" : s[:archived_at].to_s == "" }
+        all = all.select { |s| archived ? s[:archived_at].to_s != "" : s[:archived_at].to_s == "" } unless archived.nil?
 
         # ── type filter (replaces old source/profile split) ──────────────────
         # type=coding  → agent_profile == "coding"
@@ -297,9 +299,11 @@ module Clacky
         pinned, non_pinned = all.partition { |s| s[:pinned] }
 
         # `before` cursor ONLY applies to non-pinned (paginated) sessions.
-        # Cursor field must match the sort key in all_sessions (updated_at,
-        # falling back to created_at for legacy rows).
-        non_pinned = non_pinned.select { |s| (s[:updated_at] || s[:created_at] || "") < before } if before
+        # Cursor must match the sort key in all_sessions; the id breaks same-second ties.
+        if before
+          boundary = [before, before_id.to_s]
+          non_pinned = non_pinned.select { |s| (sort_key(s) <=> boundary) < 0 }
+        end
         non_pinned = non_pinned.first(limit) if limit
 
         # Pinned section: only included on the first page (before == nil) so
@@ -343,6 +347,7 @@ module Clacky
             model: model_info&.dig(:model), model_id: model_info&.dig(:id),
             name: live_name, total_tasks: s[:agent]&.total_tasks,
             total_cost: s[:agent]&.total_cost, cost_source: s[:agent]&.cost_source,
+            permission_mode: s[:agent]&.permission_mode,
             reasoning_effort: s[:agent]&.reasoning_effort,
             latest_latency: s[:agent]&.latest_latency,
             card_model: model_info&.dig(:card_model),
@@ -361,6 +366,10 @@ module Clacky
       # Merge a single disk-side session hash with the corresponding live
       # in-memory agent fields (may be nil) into the row shape the frontend
       # consumes.
+      private def sort_key(s)
+        [s[:updated_at] || s[:created_at] || "", s[:session_id].to_s]
+      end
+
       private def build_enriched_row(s, ls)
         id = s[:session_id]
         {
@@ -373,6 +382,7 @@ module Clacky
           raw_message:   ls&.dig(:raw_message),
           model:         ls&.dig(:model),
           model_id:      ls&.dig(:model_id),
+          permission_mode: ls&.dig(:permission_mode) || s.dig(:config, :permission_mode_override) || "confirm_all",
           card_model:    ls&.dig(:card_model),
           sub_model:     ls&.dig(:sub_model),
           sub_model_options: ls&.dig(:sub_model_options) || [],
@@ -395,6 +405,8 @@ module Clacky
           channel_info:  s[:channel_info],
           project_id:    s[:project_id],
           todos:         ls&.dig(:todos) || s[:todos] || [],
+          # Rows report live activity in updated_at; paging needs the on-disk sort key.
+          cursor:        sort_key(s).then { |at, sid| { before: at, before_id: sid } },
         }
       end
 

data/lib/clacky/server/web_ui_controller.rb

@@ -20,7 +20,7 @@ module Clacky
         @broadcaster.call(@session_id, { type: "input_queue", session_id: @session_id, entries: entries })
       end
 
-      attr_reader :session_id
+      attr_reader :session_id, :last_complete
 
       def initialize(session_id, broadcaster)
         @session_id  = session_id
@@ -29,7 +29,6 @@ module Clacky
 
         # Pending confirmation state: { id => ConditionVariable, result => value }
         @pending_confirmations = {}
-        @pending_feedback = nil
 
         # Channel subscribers: array of objects implementing UIInterface.
         # All emitted events are forwarded to each subscriber after WebSocket broadcast.
@@ -69,49 +68,62 @@ module Clacky
         end
       end
 
-      def deliver_feedback(answer, **options)
+      # Use the same contract as the CLI. The server owns the deadline;
+      # typing cancels automatic continuation but keeps the answer wait alive.
+      # Leaving auto mode ends the countdown like an intervention, so the task
+      # finishes as awaiting_feedback instead of blocking while marked running.
+      def request_feedback_with_countdown(seconds: 20)
+        pending = { id: @feedback_request_id || SecureRandom.uuid, cond: ConditionVariable.new,
+                    deadline_ms: (Time.now.to_f * 1000).to_i + seconds * 1000 }
+        pending[:deadline] = Process.clock_gettime(Process::CLOCK_MONOTONIC) + seconds
         @mutex.synchronize do
-          pending = @pending_feedback
-          return false unless pending && !answer.strip.empty?
-          pending[:answer], pending[:resolution], pending[:options] = answer, "human", options
-          pending[:cond].signal
-          true
-        end
-      end
-
-      # The caller supplies a timeout for this wait; nil keeps manual feedback.
-      def wait_for_feedback(timeout_seconds:, question: nil, recommended_label: nil)
-        unless recommended_label && !timeout_seconds.nil?
-          yield
-          return
+          return :intervened if @feedback_permission_mode == :confirm_all
+          @pending_feedback = pending
         end
-        raise ArgumentError, "Invalid feedback timeout" unless timeout_seconds.is_a?(Integer) && timeout_seconds >= 0
-
-        pending = { id: SecureRandom.uuid, cond: ConditionVariable.new }
-        countdown = { request_id: pending[:id], question: question, recommended_label: recommended_label,
-                      deadline_ms: (Time.now.to_f * 1000).to_i + timeout_seconds * 1000,
-                      duration_seconds: timeout_seconds }
-        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout_seconds
-        pending[:countdown] = countdown
-        @mutex.synchronize { @pending_feedback = pending }
-        yield
-        emit("feedback_countdown_started", **countdown)
+        emit("feedback_countdown", request_id: pending[:id], deadline_ms: pending[:deadline_ms])
         @mutex.synchronize do
-          until pending[:answer]
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          until pending[:result]
+            remaining = pending[:deadline] - Process.clock_gettime(Process::CLOCK_MONOTONIC)
             if remaining <= 0
-              pending.merge!(answer: recommended_label, resolution: "timeout")
+              pending[:result] = :timeout
             else
               pending[:cond].wait(@mutex, remaining)
             end
           end
-          [pending[:answer], pending.fetch(:options, {})]
+          pending[:result]
         end
       ensure
-        if pending
-          @mutex.synchronize { @pending_feedback = nil }
-          emit("feedback_countdown_resolved", request_id: pending[:id],
-               resolution: pending[:resolution] || "cancelled", answer: pending[:answer])
+        cleared = @mutex.synchronize do
+          if pending && @pending_feedback.equal?(pending)
+            @pending_feedback = nil
+            true
+          end
+        end
+        if cleared
+          emit("feedback_countdown", request_id: pending[:id], resolved: true,
+               resolution: pending[:result] || :cancelled)
+        end
+      end
+
+      def update_permission_mode(mode)
+        @mutex.synchronize do
+          @feedback_permission_mode = mode.to_sym
+          pending = @pending_feedback
+          if pending && !pending[:result] && mode.to_sym != :auto_approve
+            pending[:result] = :intervened
+            pending[:cond].signal
+          end
+        end
+      end
+
+      def intervene_feedback(request_id)
+        @mutex.synchronize do
+          pending = @pending_feedback
+          return false unless pending && pending[:id] == request_id && !pending[:result]
+          pending[:result] = :intervened
+          pending[:cond].signal
+          emit("feedback_countdown", request_id: pending[:id], deadline_ms: nil)
+          true
         end
       end
 
@@ -124,24 +136,37 @@ module Clacky
         data[:skill_command] = skill_command if skill_command
         data[:skill_command_display] = skill_command_display if skill_command_display
         data[:references] = Array(references) unless Array(references).empty?
-        # Build ev.images for the frontend renderer (history_user_message):
-        #   - Images with data_url → pass the data_url directly (<img> thumbnail)
-        #   - Disk image files (type=="image", has path) → /api/local-image proxy URL
-        #   - Disk files (PDF, doc, etc., no data_url, no image path) → "pdf:name" sentinel
-        rendered = Array(files).filter_map do |f|
+        # Images keep using the lightbox renderer. Other attachments carry their
+        # path separately so the browser can open them through the Files viewer.
+        # A missing path is deliberately omitted: the card remains visible but
+        # is no longer presented as an actionable control.
+        rendered_images = []
+        rendered_attachments = []
+        Array(files).each do |f|
+          next if f[:reference] || f["reference"]
+
           url  = f[:data_url] || f["data_url"]
           name = f[:name]     || f["name"]
           type = f[:type]     || f["type"]
           path = f[:path]     || f["path"]
+          mime = f[:mime_type] || f["mime_type"]
+          image = type.to_s == "image" || mime.to_s.start_with?("image/")
+
           if url
-            url
-          elsif type.to_s == "image" && path && File.exist?(path.to_s)
-            "/api/local-image?path=#{CGI.escape(path.to_s)}&v=#{File.mtime(path.to_s).to_i}"
+            rendered_images << url
+          elsif image && path && File.exist?(path.to_s)
+            rendered_images << "/api/local-image?path=#{CGI.escape(path.to_s)}&v=#{File.mtime(path.to_s).to_i}"
+          elsif image && name
+            rendered_images << "expired:#{name}"
           elsif name
-            "pdf:#{name}"
+            attachment_type = type.to_s.empty? ? (mime || "file") : type
+            attachment = { name: name, type: attachment_type }
+            attachment[:path] = path if path && File.exist?(path.to_s)
+            rendered_attachments << attachment
           end
         end
-        data[:images] = rendered unless rendered.empty?
+        data[:images] = rendered_images unless rendered_images.empty?
+        data[:attachments] = rendered_attachments unless rendered_attachments.empty?
         emit("history_user_message", **data)
         # Only forward to channel subscribers when the message originated from the WebUI,
         # to avoid echoing channel messages back to the same channel.
@@ -176,7 +201,9 @@ module Clacky
           context   = args_data.is_a?(Hash) ? (args_data[:context] || args_data["context"]).to_s : ""
           first     = questions.first || {}
 
+          @feedback_request_id = Clacky::Tools::AskUser.fetch_key(args_data, :request_id)
           emit("request_feedback",
+               request_id: @feedback_request_id,
                question: first[:question].to_s,
                context: context,
                options: first[:options] || [],
@@ -250,6 +277,7 @@ module Clacky
         data[:cache_stats]            = cache_stats         if cache_stats
         data[:awaiting_user_feedback] = awaiting_user_feedback if awaiting_user_feedback
         data[:cost_source]            = cost_source.to_s   if cost_source
+        @last_complete = data
         emit("complete", **data)
         forward_to_subscribers do |sub|
           sub.show_complete(iterations: iterations, cost: cost, duration: duration,
@@ -383,8 +411,11 @@ module Clacky
       # The frontend's appendToolStdout will attach to the last visible .tool-item
       # even when _liveLastToolItem is null (after the tab re-loaded).
       def replay_live_state
-        countdown = @mutex.synchronize { @pending_feedback&.dig(:countdown) }
-        emit("feedback_countdown_started", **countdown) if countdown
+        countdown = @mutex.synchronize do
+          pending = @pending_feedback
+          pending ? { request_id: pending[:id], deadline_ms: pending[:deadline_ms] } : { resolved: true }
+        end
+        emit("feedback_countdown", **countdown)
         return unless @live_progress_state
 
         # Replay complete progress state (not just message).