@ljwei-stak/dsh-model-route-bot 0.66.4 → 0.67.0

package/apps/integration-client/composer-draft-host.jsx

@@ -0,0 +1,142 @@
+import { createElement as h, Fragment, useCallback, useEffect, useMemo, useRef, useState } from 'react'
+import { COMPOSER_DRAFT_LIMITS, createComposerDraftStore } from './composer-draft.mjs'
+import { ComposerDraftBound } from './composer-draft-bound.jsx'
+
+/**
+ * The Host namespace, read from the Host, and the slot wrapper the wiring uses.
+ *
+ * Why an adapter at all: a browser origin is not a Host identity. Two Hosts can
+ * serve the same `dsh-app://app` origin, so a namespace minted in the page would
+ * be shared by both and their drafts would mix. The Host therefore mints and
+ * persists its own id, and this component asks for it on every mount:
+ *
+ *   productApi.dispatch('ui.namespace', {}, signal)
+ *     -> { schemaVersion: 1, hostId: 'host-<16 hex>' }
+ *
+ * The Host keeps that value in its own SQLite
+ * (`packages/orchestration/src/ui-host-namespace.mjs`), so it survives restarts
+ * and differs per Host. Nothing here generates a namespace of its own: a read
+ * that fails, times out, is aborted or answers late leaves the drafts switched
+ * off rather than guessing an identity.
+ *
+ * Rules this holds:
+ *   - until a validated namespace arrives, no read, no write, no restore;
+ *   - a Host replacement aborts the read in flight and drops the old store
+ *     before the new one is used, so a late answer cannot overwrite the new
+ *     Host's drafts;
+ *   - a failure is reported, not retried in the background; the caller re-reads
+ *     explicitly by raising `attempt`.
+ */
+
+const NAMESPACE_PATTERN = /^host-[0-9a-f]{16}$/
+
+/** The one shape the Host answers with; anything else is a refusal. */
+export function validateNamespace(value) {
+  if (!value || typeof value !== 'object') throw new Error('宿主没有返回界面存储标识。')
+  if (value.schemaVersion !== 1) throw new Error('宿主界面存储标识版本不被此客户端支持。')
+  if (typeof value.hostId !== 'string' || !NAMESPACE_PATTERN.test(value.hostId)) throw new Error('宿主界面存储标识格式无效。')
+  return value.hostId
+}
+
+const messageOf = error => (error?.message ? String(error.message) : String(error ?? '未知错误'))
+
+/**
+ * Asks the Host for its namespace and renders the draft once it answers.
+ *
+ * @param {object} props
+ * @param {{ dispatch: (action: string, payload: unknown, signal?: AbortSignal) => Promise<unknown> }} props.productApi
+ * @param {number} [props.attempt] raising it re-reads the namespace explicitly
+ * @param {(status: { status: 'pending'|'ready'|'error', hostId: string, error: string }) => void} [props.onStatus]
+ * @param {(store: ReturnType<import('./composer-draft.mjs').createComposerDraftStore> | undefined) => void} [props.onStore]
+ *   the store this Host namespace owns, or undefined while the drafts are off
+ * @param {Record<string, unknown>} [props.storage] defaults to the window's localStorage
+ */
+export function ComposerDraftHost({ productApi, attempt = 0, namespaceTimeoutMs = 8000, onStatus, onStore, storage, children, ...slot }) {
+  const [state, setState] = useState({ status: 'pending', hostId: '', error: '' })
+  const [retry, setRetry] = useState(0)
+  // Effects run after rendering. Never expose A's ready store on the first
+  // render of B, even when the replacement RPC has not started yet.
+  const current = state.api === productApi && state.attempt === attempt && state.retry === retry ? state : { status: 'pending', hostId: '', error: '' }
+  const generation = useRef(0)
+
+  useEffect(() => {
+    const mine = (generation.current += 1)
+    const controller = new AbortController()
+    // A replacement Host retires the old store first: until its own namespace
+    // answers, this window serves no drafts at all, and a late answer for the
+    // Host it replaced cannot install itself.
+    const scope = { api: productApi, attempt, retry }
+    setState({ ...scope, status: 'pending', hostId: '', error: '' })
+    let timer
+    const read = async () => {
+      try {
+        const value = await Promise.race([
+          productApi.dispatch('ui.namespace', {}, controller.signal),
+          new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('读取宿主草稿标识超时，请重试。')), namespaceTimeoutMs) }),
+        ])
+        // A later request (a Host replacement, a remount) owns the answer now.
+        if (generation.current !== mine || controller.signal.aborted) return
+        setState({ ...scope, status: 'ready', hostId: validateNamespace(value), error: '' })
+      } catch (error) {
+        if (generation.current !== mine || controller.signal.aborted) return
+        setState({ ...scope, status: 'error', hostId: '', error: messageOf(error) })
+        controller.abort()
+      } finally {
+        clearTimeout(timer)
+      }
+    }
+    void read()
+    return () => { clearTimeout(timer); controller.abort() }
+  }, [productApi, attempt, retry, namespaceTimeoutMs])
+
+  useEffect(() => {
+    if (typeof onStatus === 'function') onStatus({ status: current.status, hostId: current.hostId, error: current.error })
+  }, [state, onStatus, productApi, attempt, retry])
+  // One store per Host namespace. A replacement flushes what the retired Host
+  // still had pending and lets it go before the new one takes over.
+  const store = useMemo(() => (current.hostId
+    ? createComposerDraftStore({ storage: storage ?? globalThis.localStorage, hostId: current.hostId, limits: COMPOSER_DRAFT_LIMITS })
+    : undefined), [current.hostId, storage])
+  const held = useRef(undefined)
+  useEffect(() => {
+    if (typeof onStore === 'function') onStore(store ?? null)
+  }, [store, onStore])
+  useEffect(() => {
+    const previous = held.current
+    held.current = store
+    if (previous !== undefined && previous !== store) previous.flush()
+  }, [store])
+  useEffect(() => () => { held.current?.flush() }, [])
+
+  if (typeof children === 'function') return children({ store, status: current.status, hostId: current.hostId, error: current.error })
+  return h(Fragment, null, h(ComposerDraftBound, { ...slot, store, hostStatus: current.status }),
+    current.status === 'error' ? h('span', { className: 'bp-draft-recovery' },
+      h('span', { role: 'status' }, '草稿恢复暂不可用'),
+      h('button', { type: 'button', onClick: () => setRetry(value => value + 1) }, '重试草稿恢复')) : null)
+}
+
+/**
+ * The wrapper the wiring puts in the Host's composer slot. It keeps the original
+ * registration's component and its props untouched — the Host still renders the
+ * very component it registered — and adds the draft beside it.
+ *
+ * @param {React.ComponentType} component the component the slot already had
+ * @param {{ productApi: object }} options
+ */
+export function withComposerDraft(component, options = {}) {
+  const { productApi } = options
+  const Wrapped = props => h(Fragment, null,
+    h(component, props),
+    h(ComposerDraftHost, { ...props, ...options, productApi, sessionBinding: options.sessionBindingOf?.(props.sessionId) }),
+  )
+  // Anything that probes the slot for the component it registered still finds it.
+  Wrapped.composerDraftOriginal = component
+  return Wrapped
+}
+
+/** A stable re-read handle for a caller that wants to retry explicitly. */
+export function useNamespaceRetry() {
+  const [attempt, setAttempt] = useState(0)
+  const retry = useCallback(() => setAttempt(value => value + 1), [])
+  return { attempt, retry }
+}

package/apps/integration-client/composer-draft-session.jsx

@@ -0,0 +1,287 @@
+import { createElement as h, useEffect, useRef, useState } from 'react'
+import { threadKeyFromRoster } from './composer-draft.mjs'
+import { matchSubmission, newQueueRows } from './composer-draft-witness.mjs'
+
+/**
+ * The composer draft of one conversation, bound to the Host composer.
+ *
+ * The Host owns the composer: its text lives in the input state a composer slot
+ * receives (`useInput`), and text goes back in through the insertion face the
+ * same slot receives (`inputActions.captureInsertion()` / `insertText()`). Those
+ * are the only two doors used here — the vendor's own composer extras use the
+ * same pair (vendor/ds-bot/src/client/composer.js:70,79 and enter-key.js:18), and
+ * this file adds no DOM query, no hashed class selector and no global
+ * contenteditable lookup, because none of those is a contract.
+ *
+ * What this never does: send. No submit, no turn, no model call, no approval, no
+ * attachment re-add. Restoring a draft fills an empty composer and stops.
+ *
+ * When a draft is dropped, and why nothing else may drop it:
+ *   - the witness says this exact send was accepted — the session's own
+ *     submission identity, read in composer-draft-witness.mjs. That is the only
+ *     "yes" there is;
+ *   - the composer was emptied with no send in flight, which is a person
+ *     deleting what they typed, so nothing may come back later.
+ * A composer that emptied while a send was in flight keeps its draft until the
+ * witness answers, and remembers that a send is still open so a reload asks
+ * again. An unobserved outcome is never a success: no phase, no empty input and
+ * no elapsed time is read as one.
+ *
+ * What the Host has to provide for any of it to work: `useInput` (to read the
+ * draft) and `inputActions` (to put text back). Without the insertion face this
+ * component does nothing at all — it does not read, write or restore — because a
+ * half-wired draft is worse than none.
+ */
+
+const readDraft = state => (typeof state?.draft === 'string' ? state.draft : '')
+const readPhase = state => (typeof state?.phase === 'string' ? state.phase : '')
+/** User-sourced queue rows as one stable string, for a store selector. */
+const readQueue = state => (Array.isArray(state?.queue)
+  ? state.queue.filter(row => row?.source?.kind === 'user').map(row => String(row?.id ?? '')).join(',')
+  : '')
+const readSubmissions = snapshot => {
+  const rows = Array.isArray(snapshot?.pendingSubmissions) ? snapshot.pendingSubmissions : []
+  // One stable string for a store selector, parsed back into the echo shape the
+  // witness helpers read.
+  return JSON.stringify(rows.map(row => ({ requestId: row?.requestId, text: row?.text, time: Number(row?.time ?? 0) })))
+}
+
+/** Phases in which the Host has taken the composer's text for a send. */
+const IN_FLIGHT_PHASES = new Set(['submitting', 'adjudicating', 'claimed'])
+
+const idsOf = value => (typeof value === 'string' && value ? value.split(',') : [])
+
+const partsOf = key => {
+  const thread = key.indexOf(':thread:')
+  if (thread !== -1) {
+    const kind = key.slice(0, key.indexOf(':'))
+    return { kind, ownerId: key.slice(kind.length + 1, thread), threadId: key.slice(thread + ':thread:'.length) }
+  }
+  const colon = key.indexOf(':')
+  return colon === -1 ? null : { kind: key.slice(0, colon), ownerId: key.slice(colon + 1) }
+}
+
+/**
+ * The conversation a mounted session belongs to, as the Host roster names it. A
+ * session the roster does not know (an unowned or an Agent session) has no draft.
+ * `threadOf` maps a session to the stable threadId the Host directory gave it; a
+ * session it does not name is the Bot's default conversation, which every part of
+ * that Bot shares.
+ */
+export function useComposerDraftKey(sessionId, useRoster, threadOf) {
+  return typeof useRoster === 'function'
+    ? useRoster(value => threadKeyFromRoster(sessionId, value, threadOf))
+    : ''
+}
+
+// A Host that publishes no insertion face is a different component, not a
+// different hook order: the vendor's composer slots keep one hook order for a
+// whole mount, and so does this. NoInput touches nothing — no read, no write, no
+// restore, not even the conversation directory.
+const NoInput = ({ onNote }) => {
+  const said = useRef(false)
+  useEffect(() => {
+    if (said.current) return
+    said.current = true
+    if (typeof onNote === 'function') onNote('no-input-face')
+  }, [onNote])
+  return null
+}
+
+const ReadInput = ({ useInput, useSubmissions, ...rest }) => h(DraftBody, {
+  ...rest,
+  draft: useInput(readDraft),
+  phase: useInput(readPhase),
+  queue: useInput(readQueue),
+  submissions: typeof useSubmissions === 'function' ? useSubmissions(readSubmissions) : '',
+})
+
+/**
+ * @param {object} props
+ * @param {ReturnType<import('./composer-draft.mjs').createComposerDraftStore>} [props.store]
+ * @param {string} props.sessionId the mounted part's session
+ * @param {(select: (state: unknown) => unknown) => unknown} [props.useRoster]
+ * @param {(select: (state: unknown) => unknown) => unknown} [props.useInput]
+ * @param {(select: (state: unknown) => unknown) => unknown} [props.useSubmissions]
+ *   the Host's session hook, when this slot carries one; it is what makes a send
+ *   identifiable instead of merely suspicious
+ * @param {{ captureInsertion?: () => unknown, insertText?: (text: string, span: unknown) => unknown }} [props.inputActions]
+ * @param {(context: { text: string, at: number, requestId?: string }) => 'accepted'|'failed'|undefined} [props.witness]
+ * @param {(sessionId: string) => string | undefined} [props.threadOf]
+ * @param {(note: string) => void} [props.onNote]
+ */
+export function ComposerDraft(props) {
+  const face = props.inputActions
+  const usable = typeof face?.captureInsertion === 'function' && typeof face?.insertText === 'function'
+  return usable && typeof props.useInput === 'function' ? h(ReadInput, props) : h(NoInput, props)
+}
+
+function DraftBody({ store, sessionId, useRoster, inputActions, witness, threadOf, onNote, draft, phase, queue, submissions, evidenceRevision }) {
+  const key = useComposerDraftKey(sessionId, useRoster, threadOf)
+  const [status, setStatus] = useState('idle')
+  const shown = useRef('idle')
+  const latest = useRef({ draft, phase, queue, submissions, witness })
+  latest.current = { draft, phase, queue, submissions, witness }
+  const local = useRef({ key: '', revision: 0, seen: '', saved: '', restored: '', queueBefore: '', submissionsBefore: [], foreign: false, flight: null, timer: 0 })
+
+  const note = value => {
+    if (typeof onNote === 'function') onNote(value)
+    if (shown.current === value) return
+    shown.current = value
+    setStatus(value)
+  }
+  const face = useRef(inputActions)
+  face.current = inputActions
+
+  // Dropping one draft. Only a witness that says this send was accepted, or a
+  // deletion this conversation can be held to, gets here.
+  const drop = (parts, row) => {
+    row.flight = null
+    row.revision += 1
+    const dropped = store?.clear({ ...parts, revision: row.revision })
+    note(dropped?.ok ? 'cleared' : `kept:${dropped?.reason}`)
+  }
+
+  // A conversation is mounted: the surface serving it makes its draft reachable,
+  // and an unsent line from this same conversation goes back into an empty
+  // composer. What the person already typed always wins over a stored read.
+  useEffect(() => {
+    const row = local.current
+    if (!key || !store) {
+      row.key = ''
+      return undefined
+    }
+    const parts = partsOf(key)
+    row.key = key
+    row.saved = ''
+    row.restored = ''
+    row.flight = null
+    clearTimeout(row.timer)
+    row.timer = 0
+    row.queueBefore = latest.current.queue
+    row.submissionsBefore = JSON.parse(latest.current.submissions || '[]').map(row => row.requestId)
+    row.seen = latest.current.draft
+    store.see({ ...parts, sessionId })
+    const record = store.read(parts)
+    row.revision = record?.revision ?? 0
+    // Text this conversation never saved — another conversation's, or another
+    // Host's — is not ours to drop when it goes: only a deletion of text we can
+    // attribute to this composer clears this conversation's draft.
+    row.foreign = Boolean(latest.current.draft) && latest.current.draft !== (record?.text ?? '')
+    if (!record?.text) { note('empty'); return () => store.flush() }
+    // A send that was still unanswered when this window closed: the witness gets
+    // the first word, so an accepted send does not come back as text.
+    if (record.pendingAt) {
+      const pending = { text: record.text, at: record.pendingAt, requestId: record.pendingRequestId || undefined }
+      const answer = latest.current.witness?.(pending)
+      if (answer === 'accepted') {
+        row.revision += 1
+        const dropped = store.clear({ ...parts, revision: row.revision })
+        note(dropped?.ok ? 'cleared' : `kept:${dropped?.reason}`)
+        return () => store.flush()
+      }
+      row.flight = pending
+      note('kept-unknown')
+      return () => store.flush()
+    }
+    if (latest.current.draft) { note('kept-typing'); return () => store.flush() }
+    if (face.current.insertText(record.text, face.current.captureInsertion()) === false) {
+      note('restore-refused')
+      return () => store.flush()
+    }
+    row.restored = record.text
+    row.seen = record.text
+    row.revision = record.revision
+    note('restored')
+    return () => { store.flush() }
+  }, [key, store, sessionId])
+
+  // Every change of the composer's text, and every new piece of evidence about
+  // the send that emptied it, lands here.
+  useEffect(() => {
+    const row = local.current
+    if (!row.key || !store) return
+    const parts = partsOf(row.key)
+    if (draft) {
+      if (draft === row.seen) return
+      // Typing again cancels whatever the previous empty might have meant, and
+      // remembers the queue this text was typed beside.
+      row.seen = draft
+      row.foreign = false
+      row.flight = null
+      row.queueBefore = latest.current.queue
+      row.submissionsBefore = JSON.parse(latest.current.submissions || '[]').map(row => row.requestId)
+      clearTimeout(row.timer)
+      row.timer = 0
+      row.revision += 1
+      const stored = store.save({ ...parts, sessionId, text: draft, revision: row.revision })
+      if (stored?.ok) row.saved = draft
+      note(stored?.ok ? 'saved' : `refused:${stored?.reason}`)
+      return
+    }
+    if (row.flight) {
+      // New evidence about a send that is still open.
+      const answer = latest.current.witness?.(row.flight)
+      if (answer === 'accepted') { drop(parts, row); return }
+      if (answer === 'failed') { row.flight = null; note('kept-failed'); return }
+      return
+    }
+    if (draft === row.seen) return
+    const emptied = row.seen
+    row.seen = ''
+    if (!emptied) return
+
+    const at = Date.now()
+    const candidates = JSON.parse(latest.current.submissions || '[]')
+    const echo = matchSubmission(candidates, { text: emptied, at, before: row.submissionsBefore })
+    const tookQueue = newQueueRows(idsOf(latest.current.queue), idsOf(row.queueBefore)).length > 0
+    const inFlight = echo !== null || candidates.some(item => !row.submissionsBefore.includes(item.requestId)) || tookQueue ||
+      (evidenceRevision === undefined && IN_FLIGHT_PHASES.has(latest.current.phase))
+    if (inFlight) {
+      // The Host took the text. Whether it was accepted is the witness's word.
+      row.flight = { text: emptied, at, requestId: echo?.requestId }
+      const answer = latest.current.witness?.(row.flight)
+      if (answer === 'accepted') { drop(parts, row); return }
+      if (answer === 'failed') { row.flight = null; note('kept-failed'); return }
+      // Unknown: keep the text, and remember that a send is still open so a
+      // reload asks again instead of quietly showing the sent line back.
+      row.revision += 1
+      const marked = store.save({ ...parts, sessionId, text: emptied, revision: row.revision, pendingAt: at, pendingRequestId: echo?.requestId })
+      note(marked?.ok ? 'kept-unknown' : `refused:${marked?.reason}`)
+      return
+    }
+    if (row.foreign) { note('kept-foreign'); return }
+    // A person deleted what they typed. Nothing may come back later — but the
+    // deletion is attributed to this conversation first, because a Host that
+    // clears its composer while switching sessions must not take the draft of
+    // the conversation it is leaving down with it.
+    const owner = row.key
+    clearTimeout(row.timer)
+    row.timer = setTimeout(() => {
+      row.timer = 0
+      if (local.current.key !== owner || latest.current.draft) return
+      drop(partsOf(owner), row)
+    }, 0)
+  }, [draft, store, sessionId, queue, submissions, phase, evidenceRevision])
+
+  // A window that goes away writes what is pending before it does.
+  useEffect(() => () => { clearTimeout(local.current.timer); store?.flush() }, [store])
+
+  if (status !== 'kept-unknown') return null
+  const recover = () => {
+    const row = local.current, parts = partsOf(row.key), record = store?.read(parts)
+    if (!record?.text || latest.current.draft) return
+    if (face.current.insertText(record.text, face.current.captureInsertion()) === false) return
+    row.flight = null
+    note('restored')
+  }
+  return h('span', { className: 'bp-draft-recovery' },
+    h('span', { role: 'status' }, '发送结果待确认，草稿已保留'),
+    h('button', { type: 'button', onClick: recover }, '恢复草稿'),
+    h('button', { type: 'button', onClick: () => drop(partsOf(local.current.key), local.current) }, '清除草稿'))
+}
+
+export const COMPOSER_DRAFT_STATUSES = Object.freeze([
+  'idle', 'empty', 'kept-typing', 'no-input-face', 'restore-refused',
+  'restored', 'saved', 'cleared', 'kept-unknown', 'kept-failed', 'kept-foreign',
+])

package/apps/integration-client/composer-draft-witness.mjs

@@ -0,0 +1,115 @@
+/**
+ * Did this exact send reach the Host? The only honest answers are the ones the
+ * session contract already publishes.
+ *
+ * The contract (verified against the installed SDK, not guessed):
+ *   - `ISession.beginSubmission()` registers one local echo in
+ *     `snapshot.pendingSubmissions` synchronously, before the prompt is
+ *     serialized, and mints the `requestId` the prompt must carry.
+ *     `@deepseek-ai/dsh-api-session-controller/lib/types/client/contract/session.d.ts:63-84`
+ *   - `ISession.prompt(content, mode, signal, requestId)` answers
+ *     `{accepted:true}` or the business error, and mirrors a failure into
+ *     `snapshot.promptError` with `op:'send'`.  (same file, 74-84)
+ *   - A pending echo retires with `reason:'observed'` once its durable
+ *     `user/message` event or its host queue occurrence arrived, and with
+ *     `reason:'failed'` when the prompt was rejected, threw, or was aborted
+ *     before acceptance.  (same file, 18-28)
+ *   - `PendingSubmission.requestId` is "the prompt RPC identity; the durable
+ *     `user/message` source echoes it as `rpcId`".
+ *     `.../client/contract/snapshot.d.ts:38-49`
+ *
+ * So the identity of one send is the requestId, and acceptance is that requestId
+ * showing up as a durable user message. Nothing else counts: a composer phase,
+ * an empty input, an elapsed timeout, a historical message with the same text, or
+ * a Bot reply. This module only reads those published fields.
+ *
+ * Everything here is pure and offline; the React side passes the snapshots in.
+ */
+
+/** How long after the composer emptied an echo may still be matched to it. */
+export const SUBMISSION_MATCH_WINDOW_MS = 5000
+
+const textOf = value => (typeof value === 'string' ? value : '')
+
+/**
+ * The echo this send produced, if one is there. The text and the moment only
+ * *find* the echo; the identity that comes back is the requestId, which is what
+ * later evidence has to match. A historical message with the same text is not an
+ * echo: it is not in `pendingSubmissions` at all.
+ *
+ * @param {readonly {requestId?: unknown, text?: unknown, time?: unknown}[]} submissions
+ * @param {{ text: string, at: number, windowMs?: number }} send
+ */
+export function matchSubmission(submissions, { text, at, windowMs = SUBMISSION_MATCH_WINDOW_MS, before = [] }) {
+  const wanted = textOf(text)
+  const moment = Number(at)
+  if (!wanted || !Number.isFinite(moment) || !Array.isArray(submissions)) return null
+  const known = new Set(before)
+  const matches = new Map()
+  for (const echo of submissions) {
+    if (typeof echo?.requestId !== 'string' || !echo.requestId || known.has(echo.requestId)) continue
+    if (textOf(echo?.text) !== wanted) continue
+    const started = Number(echo?.time ?? 0)
+    if (!Number.isFinite(started)) continue
+    // The echo belongs to this send when it began with it, not minutes later.
+    if (started < moment - windowMs || started > moment + windowMs) continue
+    matches.set(echo.requestId, { time: started, requestId: echo.requestId })
+  }
+  if (matches.size !== 1) return null
+  const found = [...matches.values()][0]
+  return { requestId: found.requestId, text: wanted, time: found.time }
+}
+
+/**
+ * The requestIds the durable conversation already carries. A user message node
+ * echoes its prompt identity as `source.rpcId`; a Bot's own reply carries none,
+ * so a reply can never be mistaken for this send.
+ */
+export function observedRequestIds(events) {
+  const seen = new Set()
+  if (!Array.isArray(events)) return seen
+  for (const event of events) {
+    if (event?.type !== 'user/message' || event?.data?.source?.kind !== 'user') continue
+    const rpcId = event.data.source.rpcId
+    if (typeof rpcId === 'string' && rpcId) seen.add(rpcId)
+  }
+  return seen
+}
+
+/** A send failure the session published: `promptError.op === 'send'`. */
+export const sendFailed = promptError => promptError?.op === 'send'
+
+/**
+ * The outcome of one identified send, or `undefined` when the Host has not said.
+ * `undefined` is the common case and it means "keep the draft": an outcome that
+ * was never observed is not a success.
+ *
+ * @param {object} state
+ * @param {{requestId:string}} state.pending the identity captured when the send began
+ * @param {readonly object[]} [state.events] durable conversation events
+ * @param {readonly string[]} [state.acceptedRequestIds] exact durable admissions
+ * @param {readonly string[]} [state.failedRequestIds] identified failure receipts
+ */
+export function readSendOutcome({ pending, events, acceptedRequestIds = [], failedRequestIds = [] } = {}) {
+  if (!pending || typeof pending.requestId !== 'string' || !pending.requestId) return undefined
+  if (observedRequestIds(events).has(pending.requestId) || acceptedRequestIds.includes(pending.requestId)) return 'accepted'
+  // promptError has no request id. A stale send error cannot settle this send.
+  if (failedRequestIds.includes(pending.requestId)) return 'failed'
+  return undefined
+}
+
+/** User-sourced rows the input face reports as queued right now. */
+export function queuedUserRows(queue) {
+  if (!Array.isArray(queue)) return []
+  return queue.filter(row => row?.source?.kind === 'user')
+}
+
+/**
+ * The queue rows this read has that the previous one did not. Used only to decide
+ * "a send is in flight, so do not clear yet" — it never clears anything on its
+ * own, and a queue row is never read as acceptance of a specific send.
+ */
+export function newQueueRows(current, before) {
+  const known = new Set((Array.isArray(before) ? before : []).filter(id => typeof id === 'string'))
+  return (Array.isArray(current) ? current : []).filter(id => typeof id === 'string' && !known.has(id))
+}

package/apps/integration-client/composer-draft.css

@@ -0,0 +1,4 @@
+body[data-bot-product-ui] .bp-draft-recovery { display: flex; align-items: center; gap: 6px; flex-wrap: wrap; max-width: 100%; font-size: 12px; color: var(--bp-chat-muted, #687486); }
+body[data-bot-product-ui] .bp-draft-recovery button { border: 1px solid var(--bp-chat-line-strong, #7f8691); border-radius: 8px; padding: 5px 8px; background: var(--bp-chat-surface, #fff); color: var(--bp-chat-ink, #253247); cursor: pointer; }
+body[data-bot-product-ui] .bp-draft-recovery button:focus-visible { outline: 2px solid var(--bp-chat-accent, #5174a0); outline-offset: 2px; }
+@media (max-width: 600px) { body[data-bot-product-ui] .bp-draft-recovery button { min-height: 40px; } }