npm - @openchambery/web - Versions diffs - 1.19.12 → 1.19.13-beta.2 - Mend

@openchambery/web 1.19.12 → 1.19.13-beta.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (168) hide show

package/dist/index.html CHANGED Viewed

@@ -552,25 +552,28 @@
         opacity: 0.72;
       }
     </style>
-    <script type="module" crossorigin src="/assets/main-Dkg31fRY.js"></script>
+    <script type="module" crossorigin src="/assets/main-DG-k0j8A.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-auth-D66yq6ie.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-switch-LvWDU-SL.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-zIalUnbb.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CuaA8-Hp.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CxOoCv7B.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DdUac14I.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Dc2PS66M.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-T9y0orqa.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-YbQKzHUQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DILvrAok.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-t8asCr3m.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-B4KKLnZ5.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-947l7Ra3.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-DzsGqlGW.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-noa4Cdbh.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C6matIEB.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-B-P5qIBc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D8nJYB-e.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-AA-5nXsF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <!-- Keep the startup layer outside #root. React replaces every child of

package/dist/mini-chat.html CHANGED Viewed

@@ -74,25 +74,28 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-C9QMj8T8.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-BQtYQrsh.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-auth-D66yq6ie.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-switch-LvWDU-SL.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-zIalUnbb.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CuaA8-Hp.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CxOoCv7B.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DdUac14I.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Dc2PS66M.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-T9y0orqa.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-YbQKzHUQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DILvrAok.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-t8asCr3m.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-B4KKLnZ5.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-947l7Ra3.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-DzsGqlGW.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-noa4Cdbh.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C6matIEB.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-B-P5qIBc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D8nJYB-e.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-AA-5nXsF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full">

package/dist/mobile.html CHANGED Viewed

@@ -63,25 +63,28 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-Z_X7CbzB.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-8iyqtXkr.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-C0FnF6B9.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-auth-D66yq6ie.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-switch-LvWDU-SL.js">
+    <link rel="modulepreload" crossorigin href="/assets/runtime-fetch-zIalUnbb.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-base-ui-CnHfUmDN.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-B4dlGEM2.js">
-    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CuaA8-Hp.js">
+    <link rel="modulepreload" crossorigin href="/assets/useUIStore-CxOoCv7B.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-pathe-vBmvQE8f.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DLPElpoQ.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-tanstack-query-core-BWz0ose6.js">
-    <link rel="modulepreload" crossorigin href="/assets/persistence-DdUac14I.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-Dc2PS66M.js">
-    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-T9y0orqa.js">
+    <link rel="modulepreload" crossorigin href="/assets/persistence-YbQKzHUQ.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopHosts-DILvrAok.js">
+    <link rel="modulepreload" crossorigin href="/assets/desktopRelayRestore-t8asCr3m.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-opencode-sdk-C07HQypa.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-aparajita-capacitor-secure-storage-CjQdwfjS.js">
-    <link rel="modulepreload" crossorigin href="/assets/platform-B4KKLnZ5.js">
-    <link rel="modulepreload" crossorigin href="/assets/terminalApi-947l7Ra3.js">
+    <link rel="modulepreload" crossorigin href="/assets/platform-DzsGqlGW.js">
+    <link rel="modulepreload" crossorigin href="/assets/terminalApi-noa4Cdbh.js">
     <link rel="modulepreload" crossorigin href="/assets/types-BuiqMmh_.js">
     <link rel="modulepreload" crossorigin href="/assets/capgoAdapter-DCowZ2ab.js">
-    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-C6matIEB.js">
-    <link rel="stylesheet" crossorigin href="/assets/src-B-P5qIBc.css">
+    <link rel="modulepreload" crossorigin href="/assets/runtimeConfig-D8nJYB-e.js">
+    <link rel="stylesheet" crossorigin href="/assets/src-AA-5nXsF.css">
   </head>
   <body class="h-full bg-background text-foreground">
     <div id="root" class="h-full"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/web",
-  "version": "1.19.12",
+  "version": "1.19.13-beta.2",
   "private": false,
   "type": "module",
   "main": "./server/index.js",

package/server/index.js CHANGED Viewed

@@ -80,6 +80,10 @@ import { createNotificationEmitterRuntime } from './lib/notifications/emitter-ru
 import { createNotificationTriggerRuntime } from './lib/notifications/runtime.js';
 import { createPushRuntime } from './lib/notifications/push-runtime.js';
 import { createApnsRuntime } from './lib/notifications/apns-runtime.js';
+import {
+  createLiveActivityRefreshRuntime,
+  resolveLiveActivityRefreshIntervalMs,
+} from './lib/notifications/live-activity-refresh-runtime.js';
 import { createNotificationTemplateRuntime } from './lib/notifications/template-runtime.js';
 import { createPermissionAutoAcceptRuntime } from './lib/permission-auto-accept/runtime.js';
 import { createGracefulShutdownRuntime } from './lib/opencode/shutdown-runtime.js';
@@ -670,6 +674,17 @@ const maybeSendPushForTrigger = (...args) => notificationTriggerRuntime.maybeSen
 const setAutoAcceptSession = (sessionId, enabled) => permissionAutoAcceptRuntime.setSessionPolicy(sessionId, enabled);
 clearPendingPushBadge = () => notificationTriggerRuntime.clearPendingPushBadge();
+// Keeps Live Activity snapshots fresh for iOS devices whose app iOS suspended
+// or killed: every interval (default 30s) recompute each registered token's
+// snapshot from the authoritative session states and push only real changes.
+// The tick is a no-op (one token-store read) when no device registered.
+const liveActivityRefreshRuntime = createLiveActivityRefreshRuntime({
+  intervalMs: resolveLiveActivityRefreshIntervalMs(),
+  refreshLiveActivityTokens: (...args) => apnsRuntime.refreshLiveActivityTokens(...args),
+  getSessionStateSnapshot: () => sessionRuntime.getSessionStateSnapshot(),
+  resolveSession: (sessionId) => notificationTriggerRuntime.resolveLiveActivitySessionCandidate(sessionId),
+});
 // Single lazy small-model service for all consumers (feature routes, session
 // assist/title/goal, scheduled tasks). Catalog loader is directory-scoped and
 // never requests models.dev.
@@ -1036,6 +1051,7 @@ const scheduledTasksRuntime = createScheduledTasksRuntime({
       }
     }
   },
+  notifyTaskRun: (event) => notificationTriggerRuntime.sendScheduledTaskRunNotification(event),
   logger: console,
 });
@@ -1675,6 +1691,8 @@ async function main(options = {}) {
     console.warn('[ScheduledTasks] Failed to start runtime:', error?.message || error);
   }
+  liveActivityRefreshRuntime.start();
   // Only desktop / SSH-managed remotes (OPENCHAMBER_RUNTIME=desktop|ssh-remote)
   // open a relay host-control socket or poll relay demand. Local `dev` / `web`
   // never reconcile, so they cannot inherit a leftover desktop env and start
@@ -1736,6 +1754,7 @@ async function main(options = {}) {
         console.warn('[message-queue] Failed to close durable database during shutdown');
       }
       realtimeProxyRuntime.stop();
+      liveActivityRefreshRuntime.dispose();
       if (relayReconcileTimer) clearInterval(relayReconcileTimer);
       try {
         relayService.stop();

package/server/lib/assistant-delivery-parts.js CHANGED Viewed

@@ -22,5 +22,23 @@ export const validAssistantDeliveryParts = (parts, { allowAttachmentRefs = false
     }
     const filenameOk = part.filename === undefined
       || (typeof part.filename === 'string' && part.filename.length > 0 && part.filename.length <= MAX_STRING_LENGTH);
-    return part.type === 'file' && typeof part.mime === 'string' && part.mime.length > 0 && part.mime.length <= MAX_STRING_LENGTH && filenameOk && ((allowAttachmentRefs && Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'attachmentID') && typeof part.attachmentID === 'string' && part.attachmentID.length > 0 && part.attachmentID.length <= MAX_STRING_LENGTH) || (Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'url' || key === 'filename') && typeof part.url === 'string' && part.url.length > 0 && part.url.length <= MAX_FILE_URL_LENGTH));
+    const fileKeysOk = allowAttachmentRefs
+      ? Object.keys(part).every((key) => (
+        key === 'type' || key === 'mime' || key === 'attachmentID' || key === 'filename'
+        || key === 'sha256' || key === 'size' || key === 'url'
+      ))
+      : Object.keys(part).every((key) => key === 'type' || key === 'mime' || key === 'url' || key === 'filename');
+    const refOk = allowAttachmentRefs
+      && typeof part.attachmentID === 'string'
+      && part.attachmentID.length > 0
+      && part.attachmentID.length <= MAX_STRING_LENGTH
+      && (part.url === undefined || (typeof part.url === 'string' && part.url.length > 0 && part.url.length <= MAX_FILE_URL_LENGTH));
+    const urlOk = typeof part.url === 'string' && part.url.length > 0 && part.url.length <= MAX_FILE_URL_LENGTH;
+    return part.type === 'file'
+      && typeof part.mime === 'string'
+      && part.mime.length > 0
+      && part.mime.length <= MAX_STRING_LENGTH
+      && filenameOk
+      && fileKeysOk
+      && (refOk || urlOk);
   });

package/server/lib/assistants/DOCUMENTATION.md CHANGED Viewed

@@ -2,6 +2,12 @@
 ## Acceptance criteria
+Worker submission uses one admission path for new and existing sessions.
+Definite rejection cleans up only a session created by that call. Ambiguous
+admission keeps the worker and confirms the exact message ID before reporting
+success. Attachment deduplication uses ordered content digests; reordering
+attachments is a different request.
 The in-app Assistant is an OpenChamber-owned **contact**. OpenCode is only the LLM gateway (`POST /api/openchamber/llm/chat/completions`) using already-connected `{providerID, modelID}`. Composer send runs `@earendil-works/pi-agent-core` with `thinkingLevel: 'off'`. When the assistant has an effective workspace, the harness attaches pi's four coding tools (`read`, `write`, `edit`, `bash`) via `NodeExecutionEnv` in that directory, applies `defaultPrompt`, and merges skills from `~/.claude/skills`, `~/.agents/skills`, plus the project's `.claude/skills` and `.agents/skills` (project wins on name). OpenChamber API tools remain (`new_conversation`, `clear_chat_history`, `list_projects`, `list_sessions`, `create_assistant`, `schedule_task`, `message_assistant`, `assign_session`). It does not use `SessionPrompt` / `promptAsync` as the conversation engine. The LLM gateway throwaway session still denies OpenCode tools (`session.create` PermissionRuleset deny-all + `promptAsync` tools map + hidden `openchamber-llm` agent `permission: { "*": deny }`); file and shell work runs in-process through pi. The contact system prompt includes **full argument schemas** for both pi coding tools and OpenChamber contact tools. Skill directory entries are instructions loaded via `read`, not native/MCP tool names.
 Contact turns retain all eight OpenChamber operation tools alongside the four
@@ -22,15 +28,23 @@ and keep their existing error result handling.
 - `assign_session` is an OpenChamber AgentTool on the contact harness. It creates or reuses a visible OpenCode/OpenChamber session on a **registered project path** (Settings projects / `getAllowedRoots()`), optionally an **existing** Chat worktree/branch via `getWorktrees`, then kicks the coding prompt into that session with `session.create` + `session.promptAsync` (same worker path as `POST /api/openchamber/conversations`).
 - That worker session is the coder. The contact does not code. Assign sessions are **not** archived Assistant bindings and must not use `assistant-workspaces`.
+- **Worker model selection:** optional tool args `providerID` / `modelID` / `model` resolve against the live connected OpenCode catalog (`loadConnectedCatalog` / `GET /provider` + `GET /config/providers`). Explicit selection must match uniquely — missing or ambiguous names fail closed (`model_not_found` / `model_ambiguous`) with **no silent fallback**. Omitting model args keeps the contact assistant's default provider/model for the worker only. Selecting a worker model **never** mutates the contact assistant row.
+- Every contact turn injects a **Connected OpenCode models** block (providerID, modelID, name, acceptsImages) so the model can discover worker targets without a ninth contact tool. Still eight OpenChamber contact tools + four pi coding tools.
+- **Current-turn attachments:** server-authoritative `userParts` file parts from this contact turn are forwarded into worker `promptAsync` parts by default (including “just open a session” intents). The model must not base64-encode or invent local paths. History images are **not** unbounded-forwarded. Image parts require a vision-capable catalog entry (`acceptsImages`); otherwise assign fails with `image_not_supported` before create. Sensitive file bodies are never logged.
+- **Create-then-prompt failure:** if `session.create` succeeds and `promptAsync` fails, assign best-effort `session.delete`s the new worker so empty sessions are not left behind. Reused `sessionID` paths never delete on prompt failure.
 - Successful `assign_session` returns `terminate: true` so the pi agent loop does **not** auto-follow-up the LLM (prevents a looping model from re-assigning dozens of times in one turn). Prerequisite tools (`list_projects` / `list_sessions`) may still run before assign in the same turn; multi-operation user intents remain ordered **across turns** after a successful assign.
-- Same contact-turn assign gate (tools instance lifetime only, not cross-turn): identical args after success replay the cached success result (no second worker); different args after success, or parallel mismatched args, fail closed with a validation error. Failure clears the gate so a corrected retry may run. Parallel identical args share one in-flight promise.
+- Same contact-turn assign gate (tools instance lifetime only, not cross-turn): identical args after success replay the cached success result (no second worker); different args after success, or parallel mismatched args, fail closed with a validation error. The idempotent key includes worker model selection and current-turn attachment scope. Failure clears the gate so a corrected retry may run. Parallel identical args share one in-flight promise.
 - After a successful assign, the service persists the existing session card into the contact transcript (user bubbles first, then the card) and watches that worker session in `assistant_contact_watch`. The user-facing outcome is the session card plus a short confirm bubble.
 - Existing OpenCode SSE on the same `globalEventHub` as notifications (`session.idle`, `session.error`, `session.status`, `question.asked`, `permission.asked`) updates **the same card** (`busy` → `complete` / `error` / `question`) and appends one idempotent settle bubble (`oc.settle.*`). Session-goal settle (`emitGoalNotification`) is wired into that same reporter — not a second scheduler. Idle after `session.error` must not rewrite 失败 as 完成.
 - Restart or a missed `session.idle` cannot leave the watch stuck: boot and the existing 60s reconcile timer `listInFlightWatches` and poll OpenCode `session.get` / `session.messages`. Idle, `time.completed`, or a missing session settles the same card (`busy` → 完成) and appends the existing `oc.settle.complete` bubble. `session.error` or last-assistant `info.error` settles 失败. Transport / non-404 get errors leave the watch in flight (failure is not empty success). One failed watch does not block unrelated watches. Reconcile reuses `reportAssignedSession`, so an error watch is never rewritten as complete.
 - Worker sessions stamp `metadata.openchamber.assigned` (`from: 'contact'`, `assistantID`, `name`). They must **not** use `openchamber.assistant.assistantID` — that marker hides archived Assistant bindings from Chat.
-- `AssistantDTO.assignedSessionIDs` lists in-flight (`busy`/`question`) watches. `AssistantDTO.working` is true only while a watch is `busy` (the Grok-Bot green avatar dot). Question/complete/error settle the running indicator.
+- `AssistantDTO.assignedSessionIDs` lists in-flight (`busy`/`question`) watches for assigned worker sessions. Session-card busy stays on the card; it does **not** drive the list green dot.
+- **Contact active turn (server authoritative):** process-local metadata tracks admission → `queued` → `running` → settled (removed). `AssistantDTO.working` is true only while that assistant has an unsettled contact turn. `AssistantDTO.activeContactTurn` is `{ turnID, messageID, status: 'queued'|'running', admittedAt }` or `null` so APP restart / reconnect can rehydrate list green dots and the contact 3-dot row from the snapshot HTTP GET — local optimistic and SSE preview are temporary only. A server process restart clears in-memory activity (no permanent green; tools are not auto-rerun). Per-assistant lanes isolate turns across assistants/runtimes. Stale `contact-turn-end` for an older `turnID` must not clear a newer active turn.
+- **List latest-message preview (server authoritative):** every `AssistantDTO` path (`snapshot` / `create` / `update` / other `output` rows) carries `latestMessagePreview: { messageID, ordinal, role: 'user'|'assistant', text, fallbackKind: 'image'|'file'|'session'|'assistant'|'schedule'|null } | null`. Source is the contact transcript only (not `defaultPrompt` / `updatedAt`). Order is the same keyset as contact pages: newest `(ordinal DESC, message_id DESC)`. Visible roles are `user`, `assistant`, and `peer` (peer maps to `role: 'user'` because inbound DMs are user-visible). Internal assigned-session settle markers (`oc.settle.*`) are excluded in the SQL candidate probe (and again in `buildContactMessagePreview`). Durable error bubbles keep their real body text. Plain text is sanitized and capped at `CONTACT_PREVIEW_MAX_CHARS` (500) with no data-URL/base64 bodies. File-only rows set `fallbackKind` `image`/`file`; pure cards set `session`/`assistant`/`schedule`. Empty transcript → `null`. **Snapshot cost:** one prepared statement reused per assistant (`assistant_id` + indexed `ORDER BY ordinal DESC, message_id DESC LIMIT candidateLimit`, catalog ≤100) collecting only those bounded candidates, then **one** parts `IN` query — not a window/`ROW_NUMBER` over full multi-assistant history and not HTTP N+1. SQL already drops pure settle tails so they cannot exhaust the LIMIT and hide an older real bubble; remaining non-preview empty rows may still consume a candidate slot within that same LIMIT. Admission, assistant completion, peer DM, card insert, wipe, and clear-memory already bump domain revision / `openchamber:assistants-changed`; clients re-GET snapshot for the new preview. Clear-memory keeps transcript rows so the preview still reflects the last bubble; clear-history / reset remove rows so the preview becomes the wipe confirm (or `null` after a full unbounded wipe with no remaining user).
 - No registered project → clear `project_required` (ask the user to configure a project). Never fall back to managed assistant-workspaces.
 - Assign must not go through the peer DM channel.
+- `assignWork` (service) resolves the worker model via the connected catalog (`capabilities.input.image` preferred), forwards tool `variant` (cross-model drops contact variant), passes AbortSignal into create/prompt/delete/catalog, and supplies `lookupMessage` over real SDK exact lookup (`v2.session.message` → `session.message` → bounded `session.messages`). Ambiguous prompt admission returns `prompt_ambiguous` with `sessionID`/`messageID` and does **not** delete the worker; the contact-turn assign gate retains that identity so a same-args retry reuses the session and cannot blind-create another worker this turn.
 - Share/queue may still use `promptAsync` on Assistant bindings.
 **Registered projects + sessions (this PR)**
@@ -50,12 +64,12 @@ and keep their existing error result handling.
 **Clear memory vs clear chat history (this PR)**
 - `new_conversation` clears **LLM memory only**. It advances the durable per-assistant context boundary in `assistant_contact_context_boundary` (`after_ordinal` watermark). `GET /:id/contact/messages` keeps the full transcript. Later `contactHistoryForLlm` returns only messages with `ordinal > after_ordinal`. Confirms with `NEW_CONVERSATION_CONFIRM_BUBBLE`. Natural language default (safe): 开新对话 / new conversation / 清除记忆 / clear memory / clear chat / start over.
-- `clear_chat_history` **deletes** this assistant's contact transcript via `deleteContactMessages` (messages, parts, watches) and clears the boundary. Confirms with `CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE`. Natural language only when explicit: 清空/清除/删除聊天记录 / clear chat history / delete chat history. Negation (不要清除聊天记录) does not authorize.
-- **Server core authorization**: contact `send` binds `resetContact` only after `userTextAuthorizesClearChatHistory(userText)` on the **real admitted user text** for that turn. A model mis-select of `clear_chat_history` without explicit wipe intent fails the tool, keeps every transcript row, and cannot self-authorize via tool parameters. Direct `POST /api/openchamber/assistants/:id/contact/reset` → `resetContact` remains the intentional wipe API for non-model consumers.
+- `clear_chat_history` **deletes** this assistant's contact transcript via `deleteContactMessages` (messages, parts, watches) and clears the boundary. Confirms with `CLEAR_CHAT_HISTORY_CONFIRM_BUBBLE`. Natural-language tool-selection hint (missed-fence retry): 清空/清除/删除聊天记录 / clear chat history / delete chat history. Negation (不要清除聊天记录) is not a wipe request hint. When the model calls the tool, the wipe **executes** — there is no separate user-text authorization gate and no silent/denied bubble protocol. Real storage failures still surface as tool errors.
+- Tool wipe (`upToOrdinal` = current turn's user ordinal) **keeps only** `role=user` rows with `ordinal >= ceiling` (the wipe request itself + later-admitted queued users) and their parts/`messageID`s. It **deletes all other roles at any ordinal** (prior users, assistant/peer/error/cards) — including late writes from an earlier still-running lane whose ordinal landed after the wipe user — so leftover A replies/cards cannot pollute the transcript or later LLM history. Watches and the context boundary always clear. Keeping the wipe user avoids delete+re-admit reordering queued users before it. Direct `POST /api/openchamber/assistants/:id/contact/reset` → `resetContact` without a ceiling deletes **every** transcript row (existing contract; concurrent in-flight admissions are not preserved on that path).
 - Service also exposes `clearContactMemory` for the watermark path (`new_conversation`). Neither path calls OpenCode `session/new` / `createNew`.
-- Both tools terminate the contact turn. Persist only the matching confirm bubble. Discard leftover assistant text and cards from the same pre-reset generation.
+- Both tools terminate the contact turn (`terminate: true`). Persist only the matching confirm bubble. Discard leftover assistant text and cards from the same pre-reset generation. Application tool result text is preferred for the visible confirm — never paint a denial body.
 - Failed boundary/transcript writes roll back and keep the previous state.
-- Contact send loads `contactHistoryForLlm` when the per-assistant turn lane starts (not at admit-time snapshot), so a prior clear-memory cannot leave a queued turn with stale history. The admitted user row is excluded from that window; `userText` / parts still go to the prompt. The current turn's user `ordinal` is the **upper bound for later-admitted user rows** (`beforeOrdinal`): queued user messages already in SQLite must not be injected into this turn's history. Assistant rows written by a prior completed lane turn after that ordinal still enter the window. Clear-memory watermark uses the **clearing turn's user ordinal** (`upToOrdinal`), not global MAX — otherwise later-admitted queued user rows would be permanently excluded from subsequent LLM windows. Direct API `clearContactMemory` without a turn ceiling still advances to the current max. Both tools set `terminate: true` so the pi agent loop ends immediately after the reset.
+- Contact send loads `contactHistoryForLlm` when the per-assistant turn lane starts (not at admit-time snapshot), so a prior clear-memory cannot leave a queued turn with stale history. The admitted user row is excluded from that window; `userText` / parts still go to the prompt. The current turn's user `ordinal` is the **upper bound for later-admitted user rows** (`beforeOrdinal`): queued user messages already in SQLite must not be injected into this turn's history. Assistant rows written by a prior completed lane turn after that ordinal still enter the window. Clear-memory watermark and tool wipe both use the **clearing turn's user ordinal** (`upToOrdinal`), not global MAX — otherwise later-admitted queued user rows would be permanently excluded (or deleted). Direct API `clearContactMemory` / `resetContact` without a turn ceiling still advance/delete through the current full set.
 **Contact LLM window (this PR)**
@@ -63,9 +77,22 @@ and keep their existing error result handling.
 **Contact attachments (this PR)**
-- Attach is required on the contact composer: images and non-image files via picker, paste, and drag-drop. Same OpenCode file-part convention (`mime` + data `url`, optional `filename`) stored in `assistant_contact_part`. Do not invent a second store or route uploads through SessionPrompt / ChatInput / the message-queue attachment store.
-- User bubbles persist file parts. Images render inline; other files render as a named chip. Refresh hydrates the same parts.
-- The contact harness turn receives those file parts so the OpenChamber Chat Completions / OpenCode provider gateway can show images to the model.
+- Attach is required on the contact composer: images and non-image files via picker, paste, and drag-drop.
+- **Upload (frozen):** `PUT /api/openchamber/assistants/:id/contact/attachments/:uploadID` raw bytes with headers
+  `X-Content-SHA256`, `X-Content-Size`, `Content-Type`, optional `X-Attachment-Filename` (encodeURIComponent).
+  Returns `{ type:'file', attachmentID, sha256, size, mime, filename? }` — never a filesystem path.
+  Same uploadID + same content is idempotent; different content → `idempotency_conflict` (409).
+- **Download (frozen):** `GET …/contact/attachments/:attachmentID` runtime-auth, opaque ID scoped to
+  assistant + live `generation`. Body is raw bytes with `Content-Type`, `Content-Length`, `ETag`,
+  `X-Content-Type-Options: nosniff`. Stale generation after clear-chat → 404.
+- Bytes are content-addressed under `dataDir/prompt-attachments` (shared with Chat prompt uploads).
+  DB metadata stores only controlled `relative_path` + descriptor; client paths/urls are never authority.
+- New uploads capped at **25 MiB**; image magic-byte checks for PNG/JPEG/GIF/WEBP/BMP.
+- Admission accepts `attachmentID` refs (validated ownership) or legacy data URLs (landed to disk then stored as descriptors).
+- Harness + assign materialize descriptors to data URLs **only at execution time**; DB/UI keep descriptors.
+- Clear-memory keeps attachment rows; clear-chat bumps generation so external GETs fail while in-flight
+  materialize (owned read) may still complete for the running turn.
+- Legacy data-URL migration: batch 20 / 50 MiB, write disk first, CAS-replace `part_json`; failure keeps old JSON.
 **Inter-assistant DM (this PR, read-only)**
@@ -77,6 +104,24 @@ and keep their existing error result handling.
 `GET /api/openchamber/assistants/capability` remains the navigation gate.
+**Contact messages page (frozen UI contract)**
+- `GET /api/openchamber/assistants/:id/contact/messages?limit=20[&before=opaque][&messageID=…]`
+  returns `{ messages, nextCursor, complete, generation, revision }`.
+- Default `limit` is **20**, max **100**. The first page is the **newest**
+  window (chat tail); each page's `messages` array is ascending by
+  `(ordinal, messageID)`. Older pages use keyset `before` encoded as base64url
+  JSON `{ v:1, assistantID, generation, ordinal, messageID }`.
+- `generation` starts at **0** and increments **only** on transcript wipe
+  (`clear_chat_history` / `POST …/contact/reset`). `new_conversation` /
+  clear-memory does **not** bump it. A cursor whose generation does not match
+  returns `contact_generation_conflict` (HTTP **409**); clients must refetch
+  from the start. Invalid cursor encoding is `validation_error` (400).
+- `messageID` exact admission is mutually exclusive with `before`. Same page
+  envelope: at most one message for this assistant, `nextCursor: null`,
+  `complete: true`. Missing or other-assistant IDs yield `messages: []`.
+- `revision` is the assistants domain tip (same counter as snapshot).
 ## History coverage
 Snapshots expose the latest 50 `historySessionIDs` in chronological order and `historySessionCount` for the full count. The messages pagination endpoint owns complete history, including the current binding. A successful direct, shared, or queued OpenCode admission writes its user message and provisional parts to the Assistant SQLite mirror before the HTTP operation settles; this covered admission row survives binding replacement, restart, and an unavailable OpenCode history endpoint. Matching live parts replace provisional parts by message ID. Other event mirrors retain raw JSON as uncovered (`covered=0`) provisional fallback rows: they remain visible in archived history until an explicit shrink signal. Authoritative OpenCode backfill upserts covered rows and reconciles authoritative parts, rejects entries whose embedded session ID belongs to another session, and never deletes provisional mirrors merely because a successful page omitted them. Pagination `complete` only records that the OpenCode cursor was exhausted; it does not authorize deleting uncovered event mirrors. The only shrink whitelist is explicit `message.removed`, an authoritative `session.messages` 404 (`session-missing`), or assistant deletion. Late archived `message.updated` / `message.part.updated` and session lifecycle events (`session.idle`, `session.error`, `session.status` busy/retry/idle) call `invalidateBackfill` to reopen that session's cursor/complete without clearing covered flags. `history-state.js` owns the pure backfill reducer (`invalidate` → preserve; `page` → complete iff next cursor empty, always preserve; `session-missing` → discard provisional). Backfill persists the OpenCode `x-next-cursor` header verbatim and derives completion from its presence. A demand request commits up to three upstream pages and returns committed archived mirror rows (covered and provisional) with a stable scan-boundary cursor when more work remains. Startup begins one non-blocking current-binding backfill page. Archived rows preserve their stored directory; a legacy null directory triggers an authoritative session lookup of `data.directory` and `data.project.worktree`, with containment validation before persistence. Unresolved legacy directories remain `null` in persisted and historical response data. Ordinary mirror upserts preserve covered rows and never blanket-invalidate a session; explicit authoritative upserts elevate coverage; session-wide `invalidateCoverage` preserves every already-covered user row, including admitted rows whose local marker was replaced by live OpenCode info, while resetting other coverage on archive/re-archive; message-scoped coverage invalidation runs only after structural part deletes that require re-backfill. Removing an assistant tombstones the row and deletes its session history, message/part mirrors, and backfill state in one transaction. Schema v11 adds the mirror coverage marker.
@@ -90,9 +135,9 @@ Snapshots expose the latest 50 `historySessionIDs` in chronological order and `h
 **Contact send admission + SSE (this PR)**
 - `POST /api/openchamber/assistants/:id/messages` returns **202** `{ messageID, admitted: true, binding }` as soon as the **user row** is persisted (`status: complete`). It does **not** wait for the LLM turn. Validation errors still fail synchronously with 4xx before admit.
-- After admit: bump revision + `openchamber:assistants-changed`, broadcast `openchamber:contact-turn-start` `{ assistantID, turnID, messageID, occurredAt }` (`turnID` = client `messageID`), then kick `runContactTurn` asynchronously (serialized per assistant).
+- After admit: bump revision + `openchamber:assistants-changed`, register active contact turn (`queued`), broadcast `openchamber:contact-turn-start` `{ assistantID, turnID, messageID, occurredAt }` (`turnID` = client `messageID`), then kick `runContactTurn` asynchronously (serialized per assistant). Lane start marks the turn `running`. Lane start marks the turn `running` and bumps revision. Same `messageID`+payload replays admission once (`replayed: true`) without a second lane run; payload mismatch → `idempotency_conflict`. Failures persist a durable assistant `status: error` bubble for query recovery. Catalog/project list loads use a bounded deadline so the lane cannot hang forever.
 - Contact SSE reuses `/api/openchamber/events` (no new endpoint): `openchamber:contact-bubble-delta` `{ assistantID, turnID, bubbleIndex, delta, done, occurredAt }`. Raw completion tokens are **not** painted live — they are often chain-of-thought and would appear then vanish. A short spoken preamble (e.g. 我去找一下) may appear before a tool and is kept. Planning/CoT is stripped. No-tool replies emit each stripped bubble as `{ done:true }` after parse, with a short gap between bubbles so they arrive one beat at a time.
-- Turn end: strip/parse/tools (existing), persist **assistant** bubbles + cards only (never re-insert the user row), bump + assistants-changed, broadcast `openchamber:contact-turn-end` `{ assistantID, turnID, status: 'complete'|'error', error?, occurredAt }`. On failure the admitted user row stays; clients must not spin forever. Completing a contact turn also sends the same completion notification path as a normal contact: SMS-style title (assistant name) + body (spoken bubbles), via desktop / UI SSE / push, gated by `notifyOnCompletion`.
+- Turn end: strip/parse/tools (existing), persist **assistant** bubbles + cards only (never re-insert the user row), clear active contact turn, bump + assistants-changed (error paths bump even without assistant rows), broadcast `openchamber:contact-turn-end` `{ assistantID, turnID, status: 'complete'|'error', error?, occurredAt }`. On failure the admitted user row stays; clients must not spin forever. Completing a contact turn also sends the same completion notification path as a normal contact: SMS-style title (assistant name) + body (spoken bubbles), via desktop / UI SSE / push, gated by `notifyOnCompletion`.
 - In-process tests use `whenContactTurnSettled(messageID)` (not part of the HTTP JSON body).
 - Completions: public `POST /llm/chat/completions` still rejects `stream:true`. In-process contact harness passes `onTextDelta` + `globalEventHub` through `boundCompletion` → `createChatCompletion` → throwaway generate for real tokens only.