@lelouchhe/webagent 0.7.0 → 0.9.0

package/lib/routes.js

@@ -4,13 +4,15 @@ import { join, extname, basename } from "node:path";
 import { gzipSync } from "node:zlib";
 import busboy from "busboy";
 import { errorMessage, MessageIngressSchema } from "./types.js";
-import { interruptBashProc } from "./session-manager.js";
+import { interruptBashProc, InvalidSessionDirectoryError, } from "./session-manager.js";
 import { randomUUID } from "node:crypto";
 import { createWriteStream } from "node:fs";
 import { handleShareRoutes } from "./share/routes.js";
+import { handleFileRoutes } from "./files/routes.js";
 import { authenticate, isWhitelistedPath } from "./auth-middleware.js";
 import { enrichStoredEventsForDisplay } from "./attachment-labels.js";
 import { agentCommandToken, resolveAgentCommand } from "./agent-commands.js";
+import { abbreviateHomePath } from "./home-path.js";
 import { log } from "./log.js";
 const rlog = log.scope("routes");
 const plog = rlog.scope("prompt");
@@ -22,6 +24,12 @@ import { readImageDimensions } from "./image-dimensions.js";
 import { HTTP_STATUS } from "./http-status.js";
 const IS_WIN = process.platform === "win32";
 const SAFE_ID = /^[a-zA-Z0-9_-]+$/;
+function broadcastInboxCount(store, sseManager) {
+    sseManager.broadcastGlobal({
+        type: "inbox_count_changed",
+        pendingCount: store.countUnprocessed(),
+    });
+}
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "application/javascript; charset=utf-8",
@@ -397,6 +405,7 @@ async function handleAttachmentUpload(req, res, sessionId, deps) {
 }
 export function createRequestHandler(deps) {
     const { store, sessions, getBridge, sseManager, titleService } = deps;
+    let bootstrapSessionPromise = null;
     // eslint-disable-next-line complexity -- TODO: refactor main route handler into smaller handlers
     return async (req, res) => {
         const url = req.url ?? "/";
@@ -434,6 +443,14 @@ export function createRequestHandler(deps) {
             }))) {
             return;
         }
+        // File viewer — sessionless read-only access to arbitrary local paths.
+        // Claims /api/v1/files/{info,list,content} before the generic /api/v1
+        // branch. info/list use the Bearer gate above; content is whitelisted
+        // only because its handler requires an HMAC-signed URL for headerless
+        // media/download fetches (see src/files/routes.ts).
+        if (await handleFileRoutes(req, res, { secret: deps.attachmentSecret })) {
+            return;
+        }
         // --- API routes ---
         if (url === "/api/v1" || url.startsWith("/api/v1/")) {
             res.setHeader("Content-Type", "application/json");
@@ -444,6 +461,7 @@ export function createRequestHandler(deps) {
                     endpoints: {
                         sessions: "/api/v1/sessions",
                         paths: "/api/v1/recent-paths",
+                        files: "/api/v1/files",
                         config: "/api/v1/config",
                         events_stream: "/api/v1/events/stream",
                         prompt: "/api/beta/prompt",
@@ -481,7 +499,10 @@ export function createRequestHandler(deps) {
                     limit: isNaN(limit) ? 0 : limit,
                     ttlDays,
                 });
-                json(res, HTTP_STATUS.OK, paths);
+                json(res, HTTP_STATUS.OK, paths.map((entry) => ({
+                    ...entry,
+                    cwdDisplay: abbreviateHomePath(entry.cwd),
+                })));
                 return;
             }
             // GET /api/v1/version
@@ -736,37 +757,85 @@ export function createRequestHandler(deps) {
                     json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
                     return;
                 }
-                const bridge = getBridge?.();
-                if (!bridge) {
-                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
-                        error: "Agent not ready yet",
-                    });
-                    return;
-                }
                 const { opId, replayed } = tryReplayClientOp(req, res, store, sessionId);
                 if (replayed)
                     return;
+                const hadAgentPrompt = sessions?.activePrompts.has(sessionId) ?? false;
+                const hadPendingPrompt = sessions?.cancelPendingPromptSubmission(sessionId) ?? false;
+                const hadBash = sessions?.runningBashProcs.has(sessionId) ?? false;
+                if (!hadAgentPrompt && !hadPendingPrompt && !hadBash) {
+                    const idleBody = { ok: true, status: "idle" };
+                    saveClientOpResult(store, opId, sessionId, HTTP_STATUS.OK, idleBody);
+                    json(res, HTTP_STATUS.OK, idleBody);
+                    return;
+                }
+                const cancelledPromptId = hadAgentPrompt
+                    ? (sessions?.state.getState(sessionId).runtime.busy?.promptId ?? null)
+                    : null;
                 // Kill running bash process if any
                 const proc = sessions?.runningBashProcs.get(sessionId);
                 if (proc) {
-                    interruptBashProc(proc);
-                    sessions.runningBashProcs.delete(sessionId);
+                    const force = sessions.interruptedBashProcs.has(proc);
+                    interruptBashProc(proc, force);
+                    sessions.interruptedBashProcs.add(proc);
+                }
+                const bridge = hadAgentPrompt ? getBridge?.() : null;
+                if (hadAgentPrompt && !bridge) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
                 }
-                // Cancel agent prompt
-                if (sessions?.activePrompts.has(sessionId)) {
+                // ACP cancel is a notification, not an acknowledgement. Keep the
+                // prompt active until its prompt response supplies the terminal stop
+                // reason, and allow repeated requests to resend the notification.
+                if (hadAgentPrompt && sessions && bridge) {
+                    const previousCancelStatus = sessions.state.getState(sessionId).runtime.busy?.cancelStatus ??
+                        null;
+                    rlog.info("cancel requested", {
+                        sessionId: sessionId.slice(0, 8),
+                        retry: previousCancelStatus !== null,
+                        previousStatus: previousCancelStatus,
+                    });
                     await bridge.cancel(sessionId);
-                    sessions.activePrompts.delete(sessionId);
+                    const busy = sessions.state.getState(sessionId).runtime.busy;
+                    const stillCancellingSamePrompt = sessions.activePrompts.has(sessionId) &&
+                        busy?.kind === "agent" &&
+                        busy.promptId === cancelledPromptId;
+                    if (stillCancellingSamePrompt) {
+                        sessions.state.markCancelRequested(sessionId);
+                    }
                 }
-                // Arm backend safety net: if prompt_done doesn't arrive within the
-                // configured timeout, force-clear busy so the UI unstalls. Replaces
-                // the old frontend-side cancel timer.
+                // If prompt_done does not arrive, expose the lack of acknowledgement
+                // instead of pretending the prompt stopped.
                 const cancelTimeout = deps.limits.cancel_timeout ?? 0;
-                if (sessions && cancelTimeout > 0)
+                const busyAfterCancel = sessions?.state.getState(sessionId).runtime.busy;
+                const cancelPending = hadAgentPrompt &&
+                    sessions?.activePrompts.has(sessionId) === true &&
+                    busyAfterCancel?.kind === "agent" &&
+                    busyAfterCancel.promptId === cancelledPromptId;
+                if (cancelPending && cancelTimeout > 0)
                     sessions.state.armCancelSafety(sessionId, cancelTimeout);
                 sessions?.syncBusy(sessionId);
-                const okBody = { ok: true };
-                saveClientOpResult(store, opId, sessionId, HTTP_STATUS.OK, okBody);
-                json(res, HTTP_STATUS.OK, okBody);
+                const workPending = cancelPending || hadBash;
+                const replacementPromptActive = hadAgentPrompt &&
+                    ((sessions?.activePrompts.has(sessionId) === true &&
+                        busyAfterCancel?.kind === "agent" &&
+                        busyAfterCancel.promptId !== cancelledPromptId) ||
+                        sessions?.pendingPromptSubmissions.has(sessionId) === true);
+                const status = workPending || replacementPromptActive
+                    ? HTTP_STATUS.ACCEPTED
+                    : HTTP_STATUS.OK;
+                const okBody = {
+                    ok: true,
+                    status: workPending
+                        ? "cancelling"
+                        : replacementPromptActive
+                            ? "superseded"
+                            : "cancelled",
+                };
+                saveClientOpResult(store, opId, sessionId, status, okBody);
+                json(res, status, okBody);
                 return;
             }
             // --- GET /api/v1/sessions/:id/status ---
@@ -834,6 +903,7 @@ export function createRequestHandler(deps) {
                         id: session.id,
                         title: session.title,
                         cwd: session.cwd,
+                        cwdDisplay: abbreviateHomePath(session.cwd),
                         model: session.model,
                         mode: session.mode,
                         createdAt: session.created_at,
@@ -888,11 +958,43 @@ export function createRequestHandler(deps) {
                 const { opId, replayed } = tryReplayClientOp(req, res, store, sessionId);
                 if (replayed)
                     return;
+                const promptSubmissionId = sessions.reservePromptSubmission(sessionId);
+                if (promptSubmissionId === null) {
+                    const busyKind = sessions.getBusyKind(sessionId);
+                    logPromptRejectBeforeSave({
+                        sessionId,
+                        status: HTTP_STATUS.CONFLICT,
+                        reason: "session_busy",
+                        opId,
+                        busyKind: busyKind ?? undefined,
+                    });
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Session is busy",
+                        busyKind,
+                    });
+                    return;
+                }
+                const requestState = { aborted: false };
+                const isRequestAborted = () => requestState.aborted;
+                const abortPromptSubmission = () => {
+                    requestState.aborted = true;
+                    sessions.releasePromptSubmission(sessionId, promptSubmissionId);
+                };
+                res.once("finish", () => {
+                    sessions.releasePromptSubmission(sessionId, promptSubmissionId);
+                });
+                req.once("aborted", abortPromptSubmission);
+                res.once("close", () => {
+                    if (!res.writableEnded)
+                        abortPromptSubmission();
+                });
                 // Ensure session is live in ACP before prompting (awaits in-flight resume)
                 try {
                     await sessions.ensureResumed(bridge, sessionId);
                 }
                 catch (err) {
+                    if (isRequestAborted())
+                        return;
                     logPromptRejectBeforeSave({
                         sessionId,
                         status: HTTP_STATUS.INTERNAL_SERVER_ERROR,
@@ -905,19 +1007,16 @@ export function createRequestHandler(deps) {
                     });
                     return;
                 }
-                // Check if session is busy
-                const busyKind = sessions.getBusyKind(sessionId);
-                if (busyKind) {
+                if (isRequestAborted() ||
+                    sessions.isPromptSubmissionCancelled(promptSubmissionId)) {
                     logPromptRejectBeforeSave({
                         sessionId,
                         status: HTTP_STATUS.CONFLICT,
-                        reason: "session_busy",
+                        reason: "prompt_cancelled_before_start",
                         opId,
-                        busyKind,
                     });
                     json(res, HTTP_STATUS.CONFLICT, {
-                        error: "Session is busy",
-                        busyKind,
+                        error: "Prompt was cancelled before start",
                     });
                     return;
                 }
@@ -926,6 +1025,8 @@ export function createRequestHandler(deps) {
                     body = JSON.parse(await readBody(req));
                 }
                 catch {
+                    if (isRequestAborted())
+                        return;
                     logPromptRejectBeforeSave({
                         sessionId,
                         status: HTTP_STATUS.BAD_REQUEST,
@@ -935,6 +1036,13 @@ export function createRequestHandler(deps) {
                     json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid JSON" });
                     return;
                 }
+                if (isRequestAborted() ||
+                    sessions.isPromptSubmissionCancelled(promptSubmissionId)) {
+                    json(res, HTTP_STATUS.CONFLICT, {
+                        error: "Prompt was cancelled before start",
+                    });
+                    return;
+                }
                 if (!body.text) {
                     logPromptRejectBeforeSave({
                         sessionId,
@@ -1057,8 +1165,15 @@ export function createRequestHandler(deps) {
                         },
                     ];
                 });
+                // A background task can trigger unsolicited Main-agent output after
+                // the foreground ACP prompt has ended. Its chunks remain buffered
+                // until a real protocol boundary arrives; seal them before this user
+                // row so they cannot merge into the next turn's assistant response.
+                sessions.flushBuffers(sessionId);
+                const eventClientOpId = opId ?? randomUUID();
                 store.saveEvent(sessionId, "user_message", {
                     text: body.text,
+                    clientOpId: eventClientOpId,
                     ...(storedAttachments?.length
                         ? { attachments: storedAttachments }
                         : {}),
@@ -1069,6 +1184,7 @@ export function createRequestHandler(deps) {
                     type: "user_message",
                     sessionId,
                     text: body.text,
+                    clientOpId: eventClientOpId,
                     attachments: storedAttachments,
                 };
                 sseManager.broadcast(userMsgEvent);
@@ -1086,14 +1202,21 @@ export function createRequestHandler(deps) {
                     });
                 }
                 // Fire prompt asynchronously (don't await — response is 202)
+                sessions.releasePromptSubmission(sessionId, promptSubmissionId, false);
                 sessions.activePrompts.add(sessionId);
                 sessions.syncBusy(sessionId);
+                const promptId = sessions.state.getState(sessionId).runtime.busy?.promptId ??
+                    undefined;
                 bridge
-                    .prompt(sessionId, agentText, attachments)
+                    .prompt(sessionId, agentText, attachments, promptId)
                     .catch((err) => {
                     plog.error("error", { sessionId, error: err });
                 })
                     .finally(() => {
+                    // A turn that outlived its own supersession must not clear the
+                    // busy state of the turn that replaced it.
+                    if (!sessions.isCurrentPrompt(sessionId, promptId))
+                        return;
                     sessions.activePrompts.delete(sessionId);
                     sessions.syncBusy(sessionId);
                 });
@@ -1327,6 +1450,76 @@ export function createRequestHandler(deps) {
                 json(res, HTTP_STATUS.OK, { title: body.value });
                 return;
             }
+            // POST /api/v1/sessions/bootstrap — atomically return the current
+            // agent's latest session, creating one only when none exists.
+            if (url === "/api/v1/sessions/bootstrap" && req.method === "POST") {
+                const bridge = getBridge?.();
+                if (!bridge) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Agent not ready yet",
+                    });
+                    return;
+                }
+                if (!sessions) {
+                    json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                        error: "Session manager not available",
+                    });
+                    return;
+                }
+                const sessionManager = sessions;
+                bootstrapSessionPromise ??= (async () => {
+                    const existing = store.listSessions().at(0);
+                    if (existing) {
+                        return {
+                            id: existing.id,
+                            cwd: existing.cwd,
+                            cwdDisplay: abbreviateHomePath(existing.cwd),
+                            title: existing.title,
+                            source: existing.source,
+                            configOptions: [],
+                            agentCommands: sessionManager.getAgentCommands(existing.id),
+                            created: false,
+                        };
+                    }
+                    const { sessionId, configOptions } = await sessionManager.createSession(bridge);
+                    const session = store.getSession(sessionId);
+                    const result = {
+                        id: sessionId,
+                        cwd: session?.cwd ?? deps.dataDir,
+                        cwdDisplay: abbreviateHomePath(session?.cwd ?? deps.dataDir),
+                        title: session?.title ?? null,
+                        source: session?.source ?? "auto",
+                        configOptions,
+                        agentCommands: sessionManager.getAgentCommands(sessionId),
+                        created: true,
+                    };
+                    sseManager.broadcast({
+                        type: "session_created",
+                        sessionId,
+                        cwd: result.cwd,
+                        cwdDisplay: result.cwdDisplay,
+                        title: result.title,
+                        configOptions,
+                        agentCommands: result.agentCommands,
+                    });
+                    return result;
+                })().finally(() => {
+                    bootstrapSessionPromise = null;
+                });
+                try {
+                    const result = await bootstrapSessionPromise;
+                    json(res, HTTP_STATUS.OK, {
+                        ...result,
+                        clientOpId: getClientOpId(req) ?? undefined,
+                    });
+                }
+                catch (err) {
+                    json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, {
+                        error: err instanceof Error ? err.message : String(err),
+                    });
+                }
+                return;
+            }
             // --- Session CRUD: /api/v1/sessions/:id ---
             const sessionIdMatch = url.match(/^\/api\/v1\/sessions\/([^/?]+)\/?(\?.*)?$/);
             if (sessionIdMatch) {
@@ -1377,33 +1570,12 @@ export function createRequestHandler(deps) {
                                 });
                             })
                                 .catch(() => { });
-                            // Auto-retry if the last turn was interrupted (must wait for resume)
-                            const hasInterrupted = store.hasInterruptedTurn(sessionId);
-                            if (hasInterrupted) {
-                                // Optimistically mark busy so concurrent POST sees the session as active
-                                sessions.activePrompts.add(sessionId);
-                                sessions.syncBusy(sessionId);
-                                void resumePromise
-                                    .then(() => {
-                                    if (!sessions.autoRetryIfNeeded(bridge, sessionId)) {
-                                        // Retry not needed after all — release the optimistic lock
-                                        sessions.activePrompts.delete(sessionId);
-                                        sessions.syncBusy(sessionId);
-                                    }
-                                })
-                                    .catch(() => {
-                                    sessions.activePrompts.delete(sessionId);
-                                    sessions.syncBusy(sessionId);
-                                });
-                            }
-                            else {
-                                resumePromise.catch((err) => {
-                                    slog.error("background resume failed", {
-                                        sessionId: sessionId.slice(0, 8) + "…",
-                                        error: err,
-                                    });
+                            resumePromise.catch((err) => {
+                                slog.error("background resume failed", {
+                                    sessionId: sessionId.slice(0, 8) + "…",
+                                    error: err,
                                 });
-                            }
+                            });
                         }
                     }
                     // If cache is cold and we kicked off a resume, wait briefly so the
@@ -1445,6 +1617,7 @@ export function createRequestHandler(deps) {
                     json(res, HTTP_STATUS.OK, {
                         id: freshSession.id,
                         cwd: freshSession.cwd,
+                        cwdDisplay: abbreviateHomePath(freshSession.cwd),
                         title: freshSession.title,
                         source: freshSession.source,
                         model: freshSession.model,
@@ -1460,6 +1633,12 @@ export function createRequestHandler(deps) {
                         json(res, HTTP_STATUS.NOT_FOUND, { error: "Session not found" });
                         return;
                     }
+                    if (sessions && sessions.getBusyKind(sessionId) !== null) {
+                        json(res, HTTP_STATUS.CONFLICT, {
+                            error: "Cancel active work before deleting the session",
+                        });
+                        return;
+                    }
                     if (sessions) {
                         sessions.deleteSession(sessionId);
                     }
@@ -1474,6 +1653,7 @@ export function createRequestHandler(deps) {
             }
             // POST /api/v1/sessions (create new session)
             if (url === "/api/v1/sessions" && req.method === "POST") {
+                const clientOpId = getClientOpId(req);
                 const bridge = getBridge?.();
                 if (!bridge) {
                     json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
@@ -1503,9 +1683,13 @@ export function createRequestHandler(deps) {
                         type: "session_created",
                         sessionId,
                         cwd: session?.cwd,
+                        cwdDisplay: session?.cwd
+                            ? abbreviateHomePath(session.cwd)
+                            : undefined,
                         title: session?.title,
                         configOptions,
                         agentCommands: sessions.getAgentCommands(sessionId),
+                        clientOpId: clientOpId ?? undefined,
                     };
                     sseManager.broadcast(sessionCreatedEvent);
                     // ACP's session_created event fires before inheritance runs, so
@@ -1520,15 +1704,19 @@ export function createRequestHandler(deps) {
                     json(res, HTTP_STATUS.CREATED, {
                         id: sessionId,
                         cwd: session?.cwd ?? body.cwd,
+                        cwdDisplay: session?.cwd
+                            ? abbreviateHomePath(session.cwd)
+                            : undefined,
                         title: session?.title ?? null,
                         source: session?.source ?? source,
                         configOptions,
                         agentCommands: sessions.getAgentCommands(sessionId),
+                        clientOpId: clientOpId ?? undefined,
                     });
                 }
                 catch (err) {
                     const msg = err instanceof Error ? err.message : String(err);
-                    if (msg.includes("does not exist")) {
+                    if (err instanceof InvalidSessionDirectoryError) {
                         json(res, HTTP_STATUS.BAD_REQUEST, { error: msg });
                     }
                     else {
@@ -1563,14 +1751,15 @@ export function createRequestHandler(deps) {
                 let streamingThinking = false;
                 let streamingAssistant = false;
                 if (sessions) {
-                    if (sessions.thinkingBuffers.has(sessionId)) {
-                        streamingThinking = true;
-                        sessions.flushThinkingBuffer(sessionId);
-                    }
-                    if (sessions.assistantBuffers.has(sessionId)) {
-                        streamingAssistant = true;
-                        sessions.flushAssistantBuffer(sessionId);
-                    }
+                    const runtimeStreaming = sessions.state.peekStreaming(sessionId);
+                    streamingThinking =
+                        runtimeStreaming.thinking ||
+                            Boolean(sessions.thinkingBuffers.get(sessionId));
+                    streamingAssistant =
+                        runtimeStreaming.assistant ||
+                            Boolean(sessions.assistantBuffers.get(sessionId));
+                    sessions.flushThinkingBuffer(sessionId);
+                    sessions.flushAssistantBuffer(sessionId);
                 }
                 const events = store.getEvents(sessionId, {
                     excludeThinking,
@@ -1653,6 +1842,7 @@ export function createRequestHandler(deps) {
                     type: "connected",
                     clientId,
                     debugLevel: deps.debugLevel ?? "off",
+                    pendingCount: store.countUnprocessed(),
                 });
                 sseManager.writeHeartbeat(client);
                 return;
@@ -1696,6 +1886,7 @@ export function createRequestHandler(deps) {
                     type: "connected",
                     clientId,
                     debugLevel: deps.debugLevel ?? "off",
+                    pendingCount: store.countUnprocessed(),
                 });
                 sseManager.writeHeartbeat(client);
                 // Replay events from Last-Event-ID if provided
@@ -1906,6 +2097,7 @@ export function createRequestHandler(deps) {
                     created_at: Date.now(),
                 });
                 sseManager.broadcast({ type: "message_created", messageId: id });
+                broadcastInboxCount(store, sseManager);
                 if (deps.pushService) {
                     void deps.pushService.sendForMessage({
                         id,
@@ -1937,23 +2129,58 @@ export function createRequestHandler(deps) {
                 const consumeMatch = tail.match(/^([^/?]+)\/consume\/?$/);
                 if (consumeMatch && req.method === "POST") {
                     const id = decodeURIComponent(consumeMatch[1]);
-                    const newSid = randomUUID();
+                    let inheritFromSessionId;
+                    try {
+                        const rawBody = await readBody(req);
+                        if (rawBody) {
+                            const body = JSON.parse(rawBody);
+                            if (body.inheritFromSessionId !== undefined &&
+                                typeof body.inheritFromSessionId !== "string") {
+                                json(res, HTTP_STATUS.BAD_REQUEST, {
+                                    error: "inheritFromSessionId must be a string",
+                                });
+                                return;
+                            }
+                            inheritFromSessionId = body.inheritFromSessionId;
+                        }
+                    }
+                    catch {
+                        json(res, HTTP_STATUS.BAD_REQUEST, { error: "Invalid JSON" });
+                        return;
+                    }
+                    const bridge = getBridge?.();
+                    if (!sessions || !bridge) {
+                        json(res, HTTP_STATUS.SERVICE_UNAVAILABLE, {
+                            error: "Agent not available",
+                        });
+                        return;
+                    }
                     let out;
                     try {
-                        out = store.consumeMessageTx(id, { sessionId: newSid });
+                        out = await sessions.consumeMessage(bridge, id, inheritFromSessionId);
                     }
                     catch (err) {
-                        if (/message not found/.test(errorMessage(err))) {
-                            json(res, HTTP_STATUS.NOT_FOUND, { error: "Message not found" });
+                        if (err instanceof InvalidSessionDirectoryError) {
+                            json(res, HTTP_STATUS.BAD_REQUEST, {
+                                error: err.message,
+                            });
                             return;
                         }
-                        throw err;
+                        json(res, HTTP_STATUS.INTERNAL_SERVER_ERROR, {
+                            error: errorMessage(err),
+                        });
+                        return;
+                    }
+                    if (!out) {
+                        json(res, HTTP_STATUS.NOT_FOUND, { error: "Message not found" });
+                        return;
                     }
                     sseManager.broadcast({
                         type: "message_consumed",
                         messageId: id,
                         sessionId: out.sessionId,
                     });
+                    broadcastInboxCount(store, sseManager);
                     if (!out.alreadyConsumed && deps.pushService) {
                         void deps.pushService.sendClose(id);
                     }
@@ -1980,6 +2207,7 @@ export function createRequestHandler(deps) {
                         return;
                     }
                     sseManager.broadcast({ type: "message_acked", messageId: id });
+                    broadcastInboxCount(store, sseManager);
                     if (deps.pushService)
                         void deps.pushService.sendClose(id);
                     mlog.info("ack", { msg_id: id });
@@ -2034,8 +2262,20 @@ export function createRequestHandler(deps) {
                     return;
                 }
                 const cwd = typeof body.cwd === "string" ? body.cwd : undefined;
-                const { sessionId } = await sessions.createSession(bridge, cwd, undefined, "auto");
+                const { sessionId, configOptions } = await sessions.createSession(bridge, cwd, undefined, "auto");
                 const streamUrl = `/api/v1/sessions/${sessionId}/events/stream`;
+                const session = store.getSession(sessionId);
+                sseManager.broadcast({
+                    type: "session_created",
+                    sessionId,
+                    cwd: session?.cwd,
+                    cwdDisplay: session?.cwd
+                        ? abbreviateHomePath(session.cwd)
+                        : undefined,
+                    title: session?.title,
+                    configOptions,
+                    agentCommands: sessions.getAgentCommands(sessionId),
+                });
                 json(res, HTTP_STATUS.ACCEPTED, { sessionId, streamUrl });
                 // Fire-and-forget: send the prompt asynchronously, tracking busy state
                 sessions.activePrompts.add(sessionId);
@@ -2051,10 +2291,14 @@ export function createRequestHandler(deps) {
                         sseManager.broadcast(titleEvent);
                     });
                 }
+                const betaPromptId = sessions.state.getState(sessionId).runtime.busy?.promptId ??
+                    undefined;
                 bridge
-                    .prompt(sessionId, text)
+                    .prompt(sessionId, text, undefined, betaPromptId)
                     .catch(() => { })
                     .finally(() => {
+                    if (!sessions.isCurrentPrompt(sessionId, betaPromptId))
+                        return;
                     sessions.activePrompts.delete(sessionId);
                     sessions.syncBusy(sessionId);
                 });
@@ -2233,7 +2477,7 @@ export function createRequestHandler(deps) {
             return;
         }
         // --- Static files ---
-        let staticPath = url;
+        let staticPath = url.split("?")[0] ?? url;
         const htmlEntry = HTML_ENTRYPOINTS.find((e) => e.urlPath === staticPath);
         if (htmlEntry)
             staticPath = "/" + htmlEntry.file;