@openchambery/web 1.19.12 → 1.19.13-beta.2

package/server/lib/assistants/service.js

@@ -8,19 +8,43 @@ import { reduceBackfillState } from './history-state.js';
 import { getWorktrees as defaultListWorktrees } from '../git/service.js';
 import { contactCardIdentity, parseContactCard, parseContactPart } from './cards.js';
 import {
+  CONTACT_PAGE_DEFAULT_LIMIT,
+  CONTACT_PAGE_MAX_LIMIT,
   CONTACT_SETTLE_TEXT,
+  bumpContactGeneration,
   clearContactMemory as clearContactMemoryStore,
   contactHistoryForLlm,
+  createActiveContactTurn,
   deleteContactMessages,
   ensureContactSchema,
+  contactPartsFingerprint,
+  getContactMessage,
+  getLatestContactMessagePreview,
+  getLatestContactMessagePreviews,
   insertContactMessage,
   listContactMessages,
   listInFlightWatches,
   listWatchesBySession,
   nextContactOrdinal,
+  projectActiveContactTurn,
   updateSessionCardStatus,
   upsertContactWatch,
 } from './contact-store.js';
+import {
+  CONTACT_ATTACHMENT_TURN_BUDGET_BYTES,
+  assertContactAttachmentOwned,
+  assertContactAttachmentReadable,
+  canonicalDescriptorFromRow,
+  ensureContactAttachmentSchema,
+  getContactAttachmentRow,
+  ingestDataUrlFilePart,
+  isSafeInlineImageMime,
+  materializeContactHistory,
+  materializeContactParts,
+  migrateContactDataUrlParts,
+  putContactAttachment,
+  readContactAttachmentBytes,
+} from './contact-attachments.js';
 import {
   ASSIGNED_SESSION_FALLBACK_BUBBLE,
   boundSessionListLimit,
@@ -31,15 +55,25 @@ import {
   filterRegisteredProjects,
   matchesProjectQuery,
   NEW_CONVERSATION_CONFIRM_BUBBLE,
+  normalizeConnectedModels,
   normalizeRegisteredProjects,
   sanitizeRegisteredProject,
-  userTextAuthorizesClearChatHistory,
 } from './contact-tools.js';
-import { AssignError, ASSIGN_CODES, assignSession, resolveAssignDirectory } from './assign.js';
+import {
+  AssignError,
+  ASSIGN_CODES,
+  assignSession,
+  attachmentScopeKey,
+  hasAssignImageParts,
+  resolveAssignDirectory,
+  resolveAssignWorkerModel,
+  sanitizeAssignFileParts,
+} from './assign.js';
 import { runContactTurn as defaultRunContactTurn } from './harness.js';
+import { loadConnectedCatalog } from '../llm/catalog.js';
 
 const require = createRequire(import.meta.url);
-const SCHEMA_VERSION = 11;
+const SCHEMA_VERSION = 12;
 const normalizeSessionDirectory = (value) => {
   if (typeof value !== 'string') return null;
   const trimmed = value.trim();
@@ -92,6 +126,25 @@ const isTransientMessagesFailure = (result, error) => {
 };
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 const promptAdmitted = (result) => !result?.error && (result?.response?.status === 204 || result?.status === 204 || result?.data !== undefined || result?.response?.ok === true);
+/** Bound catalog / project list waits so a contact lane cannot hang forever. */
+export const CONTACT_CATALOG_DEADLINE_MS = 8_000;
+const awaitWithDeadline = async (work, ms = CONTACT_CATALOG_DEADLINE_MS, code = 'upstream_error') => {
+  let timer = null;
+  try {
+    return await Promise.race([
+      Promise.resolve().then(() => work),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => {
+          const error = new Error(code);
+          error.code = code;
+          reject(error);
+        }, ms);
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
 
 export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, getOpenCodeAuthHeaders, getServerId = async () => null, getAllowedRoots = () => [], listProjects = async () => [], listScheduledTasks = null, sessionIndexService = null, upsertScheduledTask = null, syncScheduledTaskProject = null, globalEventHub = null, onRevisionTip = null, onContactTurnEvent = null, onContactTurnComplete = null, clock = () => Date.now(), setIntervalFn = setInterval, clearIntervalFn = clearInterval, setImmediateFn = setImmediate, reconcileIntervalMs = 60_000, clientFactory, createChatCompletion = null, runContactTurn = defaultRunContactTurn, listWorktrees = defaultListWorktrees } = {}) => {
   if (!dbPath || !dataDir) return null;
@@ -100,6 +153,10 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
   const db = new Database(dbPath); db.pragma('journal_mode = WAL'); db.pragma('foreign_keys = ON');
   let closed = false;
   const shareReservations = new Map();
+  // Process-local contact-turn activity. Not durable across server restart —
+  // a new process starts empty so working cannot stick green forever. APP
+  // restart rehydrates from snapshot while this process still holds the turn.
+  const activeContactTurnsByAssistant = new Map();
   db.exec(`CREATE TABLE IF NOT EXISTS assistant_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
     CREATE TABLE IF NOT EXISTS assistant_v2 (assistant_id TEXT PRIMARY KEY, revision INTEGER NOT NULL, enabled INTEGER NOT NULL, name TEXT NOT NULL, default_prompt TEXT NOT NULL, workspace_path TEXT, provider_id TEXT NOT NULL, model_id TEXT NOT NULL, agent TEXT, variant TEXT, mode TEXT NOT NULL DEFAULT 'continuous', current_session_id TEXT, session_generation INTEGER NOT NULL DEFAULT 0, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL, tombstone_at INTEGER);
     CREATE TABLE IF NOT EXISTS assistant_share_operation (operation_id TEXT PRIMARY KEY, assistant_id TEXT NOT NULL, payload_hash TEXT NOT NULL, phase TEXT NOT NULL, session_id TEXT, message_id TEXT, state TEXT NOT NULL, response TEXT, error_code TEXT, attempt INTEGER NOT NULL DEFAULT 0, lease_expires_at INTEGER, created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL);
@@ -124,6 +181,21 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     CREATE INDEX IF NOT EXISTS assistant_scheduled_task_assistant
       ON assistant_scheduled_task(assistant_id, created_at DESC);`);
   ensureContactSchema(db);
+  ensureContactAttachmentSchema(db);
+  // Background legacy data-URL → descriptor migration (cancelable; never touches foreign DBs).
+  const contactAttachmentMigration = { controller: new AbortController(), promise: null };
+  contactAttachmentMigration.promise = Promise.resolve().then(() => migrateContactDataUrlParts({
+    db,
+    dataDir,
+    signal: contactAttachmentMigration.controller.signal,
+    yieldFn: () => new Promise((resolve) => setImmediateFn(resolve)),
+  })).catch((error) => {
+    if (error?.name !== 'AbortError' && !closed) {
+      // Diagnostics only — never throw into boot.
+      console.warn('[assistants] contact attachment migration:', error?.code || error?.message || error);
+    }
+    return { migrated: 0, failed: 0, scanned: 0, failures: [], error: error?.code || error?.message };
+  });
   const historyColumns = new Set(db.prepare("SELECT name FROM pragma_table_info('assistant_session_history')").all().map((column) => column.name));
   if (!historyColumns.has('directory')) db.exec('ALTER TABLE assistant_session_history ADD COLUMN directory TEXT');
   const mirrorColumns = new Set(db.prepare("SELECT name FROM pragma_table_info('assistant_message_mirror')").all().map((column) => column.name));
@@ -168,8 +240,55 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     db.prepare('DELETE FROM assistant_message_backfill WHERE assistant_id=? AND session_id=?').run(assistantID, sessionID);
     db.prepare("UPDATE assistant_message_mirror SET covered=0 WHERE assistant_id=? AND session_id=? AND COALESCE(json_extract(info_json,'$.role'),'')<>'user' AND COALESCE(json_extract(info_json,'$.openchamberAssistantAdmission'),0)<>1").run(assistantID, sessionID);
   };
-  const output = (row) => {
+  const activeContactTurnsFor = (assistantID) => activeContactTurnsByAssistant.get(assistantID) ?? new Map();
+  const rememberActiveContactTurn = (assistantID, input) => {
+    const next = createActiveContactTurn(input);
+    if (!next) return null;
+    const turns = activeContactTurnsFor(assistantID);
+    turns.set(next.turnID, next);
+    activeContactTurnsByAssistant.set(assistantID, turns);
+    return next;
+  };
+  const markActiveContactTurnRunning = (assistantID, turnID) => {
+    const turns = activeContactTurnsFor(assistantID);
+    const current = turns.get(turnID);
+    if (!current) return null;
+    if (current.status === 'running') return current;
+    const next = createActiveContactTurn({ ...current, status: 'running' });
+    if (!next) return null;
+    turns.set(turnID, next);
+    activeContactTurnsByAssistant.set(assistantID, turns);
+    // queued → running must tip snapshot so clients poll authoritative status.
+    bump();
+    return next;
+  };
+  const settleActiveContactTurn = (assistantID, turnID, { bumpRevision = false } = {}) => {
+    const turns = activeContactTurnsFor(assistantID);
+    if (!turns.has(turnID)) {
+      if (bumpRevision) bump();
+      return false;
+    }
+    turns.delete(turnID);
+    if (turns.size === 0) activeContactTurnsByAssistant.delete(assistantID);
+    else activeContactTurnsByAssistant.set(assistantID, turns);
+    // Error paths may not persist assistant rows; still tip the snapshot so
+    // list green dots clear without waiting for a later SQLite write.
+    if (bumpRevision) bump();
+    return true;
+  };
+  const clearActiveContactTurns = (assistantID) => {
+    if (assistantID == null) {
+      activeContactTurnsByAssistant.clear();
+      return;
+    }
+    activeContactTurnsByAssistant.delete(assistantID);
+  };
+  const output = (row, latestMessagePreview) => {
     const watches = listInFlightWatches(db, row.assistant_id);
+    const activeContactTurn = projectActiveContactTurn(activeContactTurnsFor(row.assistant_id));
+    const preview = latestMessagePreview !== undefined
+      ? latestMessagePreview
+      : getLatestContactMessagePreview(db, row.assistant_id);
     return {
       id: row.assistant_id,
       revision: row.revision,
@@ -189,7 +308,13 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
       historySessionIDs: historyIDs(row.assistant_id),
       historySessionCount: historyCount(row.assistant_id),
       assignedSessionIDs: watches.map((watch) => watch.sessionID),
-      working: watches.some((watch) => watch.status === 'busy'),
+      // Grok-Bot list green dot: contact turn only. Assigned-session busy stays
+      // on the session card / assignedSessionIDs and must not keep the avatar lit.
+      working: activeContactTurn != null,
+      activeContactTurn,
+      // Contact-transcript list desc: authoritative last visible bubble (not
+      // defaultPrompt / updatedAt). null when the contact has no list-visible rows.
+      latestMessagePreview: preview ?? null,
       createdAt: row.created_at,
       updatedAt: row.updated_at,
       tombstoneAt: row.tombstone_at,
@@ -242,7 +367,9 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
   const restoreOnce = async (row, expectedSessionID, expectedGeneration) => { for (let attempt = 0; attempt < 3; attempt++) { const current = active(row.assistant_id); if (current.current_session_id !== expectedSessionID || current.session_generation !== expectedGeneration) return binding(current); const created = await createSession(current); const won = replaceBinding(current, created); if (won) return binding(won); } return binding(active(row.assistant_id)); };
   const configuration = (row) => ({ model: { providerID: row.provider_id, modelID: row.model_id }, ...(row.agent ? { agent: row.agent } : {}), ...(row.variant ? { variant: row.variant } : {}), ...(row.default_prompt ? { system: row.default_prompt } : {}) });
   const capturedConfiguration = (target) => ({ model: { providerID: target.providerID, modelID: target.modelID }, ...(target.agent ? { agent: target.agent } : {}), ...(target.variant ? { variant: target.variant } : {}), ...(target.system ? { system: target.system } : target.defaultPrompt ? { system: target.defaultPrompt } : {}) });
-  const validateParts = (parts) => { if (!validAssistantDeliveryParts(parts)) fail('validation_error'); };
+  const validateParts = (parts) => {
+    if (!validAssistantDeliveryParts(parts, { allowAttachmentRefs: true })) fail('validation_error');
+  };
   const migrate = () => {
     if (db.prepare("SELECT value FROM assistant_meta WHERE key='schema_version'").get()?.value === String(SCHEMA_VERSION)) return;
     const v2Info = db.prepare("SELECT name,\"notnull\" AS required FROM pragma_table_info('assistant_v2')").all(); const v2Columns = new Set(v2Info.map((column) => column.name));
@@ -638,13 +765,60 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     if (text) return text;
     return input.parts.some((part) => part?.type === 'file') ? '[attachment]' : '';
   };
-  const userContactParts = (input, userText) => {
+  const userContactParts = async (assistantID, input, userText) => {
     const parts = [];
+    let turnBytes = 0;
     if (Array.isArray(input.parts)) {
       for (const part of input.parts) {
         const parsed = parseContactPart(part);
-        if (parsed?.type === 'text' && parsed.text.trim()) parts.push({ type: 'text', text: parsed.text });
-        if (parsed?.type === 'file') parts.push(parsed);
+        if (parsed?.type === 'text' && parsed.text.trim()) {
+          parts.push({ type: 'text', text: parsed.text });
+          continue;
+        }
+        if (parsed?.type !== 'file') continue;
+        if (parsed.attachmentID) {
+          let row;
+          try {
+            // Admission: current-generation ownership + canonical row rebuild (ignore client meta).
+            row = assertContactAttachmentReadable(db, { attachmentID: parsed.attachmentID, assistantID });
+          } catch (error) {
+            fail(error?.code === 'not_found' ? 'not_found' : 'validation_error', error?.message);
+          }
+          const descriptor = canonicalDescriptorFromRow(row);
+          turnBytes += descriptor.size || 0;
+          if (turnBytes > CONTACT_ATTACHMENT_TURN_BUDGET_BYTES) {
+            fail('validation_error', 'Contact attachment total exceeds 50MiB budget');
+          }
+          parts.push(descriptor);
+          continue;
+        }
+        if (typeof parsed.url === 'string' && parsed.url.startsWith('data:')) {
+          try {
+            const descriptor = await ingestDataUrlFilePart({
+              db,
+              dataDir,
+              assistantID,
+              part: parsed,
+              clock: now,
+              mode: 'admission',
+            });
+            // Re-check generation after await.
+            const row = assertContactAttachmentReadable(db, {
+              attachmentID: descriptor.attachmentID,
+              assistantID,
+            });
+            const canonical = canonicalDescriptorFromRow(row);
+            turnBytes += canonical.size || 0;
+            if (turnBytes > CONTACT_ATTACHMENT_TURN_BUDGET_BYTES) {
+              fail('validation_error', 'Contact attachment total exceeds 50MiB budget');
+            }
+            parts.push(canonical);
+          } catch (error) {
+            fail(error?.code || 'validation_error', error?.message);
+          }
+          continue;
+        }
+        fail('validation_error', 'File parts require attachmentID or data URL');
       }
     }
     if (parts.length === 0 && userText) parts.push({ type: 'text', text: userText });
@@ -672,6 +846,31 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
       throw error;
     }
   };
+  /** Durable failure bubble so APP restart can recover error without SSE. */
+  const persistContactTurnFailure = (assistantID, { userMessageID, turnID, error }) => {
+    const detail = typeof error === 'string' && error.trim() ? error.trim() : 'upstream_error';
+    const failureID = `${userMessageID}:error`;
+    if (getContactMessage(db, failureID)) return;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+      insertContactMessage(db, {
+        messageID: failureID,
+        assistantID,
+        role: 'assistant',
+        turnID,
+        bubbleIndex: 0,
+        createdAt: now(),
+        ordinal: nextContactOrdinal(db, assistantID),
+        status: 'error',
+        parts: [{ type: 'text', text: detail }],
+      });
+      bump();
+      db.exec('COMMIT');
+    } catch (writeError) {
+      db.exec('ROLLBACK');
+      throw writeError;
+    }
+  };
   /** Persist assistant bubbles/cards for an already-admitted user turn (no user row). */
   const persistContactAssistantReply = (assistantID, { userMessageID, bubbles, cards = [], turnID }) => {
     db.exec('BEGIN IMMEDIATE');
@@ -778,17 +977,138 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
   const resolveContactTurnSettlement = (messageID, result) => {
     contactTurnSettlement(messageID).resolve(result);
   };
-  const assignWork = (row, params) => assignSession({
-    ...params,
-    assistant: output(row),
-    defaultProjectPath: row.workspace_path,
-    allowedRoots: getAllowedRoots(),
-    managedWorkspaceRoot: path.resolve(dataDir, 'assistant-workspaces'),
-    listWorktrees,
-    createSession: (created) => client().session.create(created),
-    promptExisting: (prompted) => client().session.promptAsync(prompted),
-    messageID: params?.messageID || `msg_assign_${id()}`,
-  });
+  const loadAssignCatalog = async (signal) => {
+    try {
+      // Catalog owns its 8s AbortSignal deadline; optional parent signal is forwarded.
+      return await loadConnectedCatalog(client(), {
+        timeoutMs: CONTACT_CATALOG_DEADLINE_MS,
+        ...(signal ? { signal } : {}),
+      });
+    } catch (error) {
+      const wrapped = new AssignError(
+        ASSIGN_CODES.UPSTREAM,
+        typeof error?.message === 'string' && error.message.trim()
+          ? error.message.trim()
+          : 'Connected model catalog is unavailable.',
+      );
+      throw wrapped;
+    }
+  };
+  const loadRegisteredProjects = async () => {
+    const listed = await awaitWithDeadline(listProjects(), CONTACT_CATALOG_DEADLINE_MS, 'upstream_error');
+    if (!Array.isArray(listed)) {
+      throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Registered project catalog failed to load.');
+    }
+    return listed;
+  };
+  /**
+   * Confirm whether an assign prompt message was admitted on the worker session.
+   * Prefer SDK exact lookup (v2.session.message → session.message), then bounded messages list.
+   * Returns { found: true|false } for assignSession; throws/unavailable become null via assign.
+   */
+  const lookupAssignMessage = async ({ sessionID, messageID, directory, signal } = {}) => {
+    if (typeof sessionID !== 'string' || !sessionID || typeof messageID !== 'string' || !messageID) {
+      return { found: false };
+    }
+    const api = client();
+    const options = signal ? { signal } : undefined;
+    const identity = (record) => (
+      record?.info?.id || record?.id || record?.messageID || record?.message?.id || null
+    );
+    const viaExact = async (fn, target) => {
+      if (typeof fn !== 'function') return null;
+      try {
+        const result = await fn.call(target, { sessionID, messageID, ...(directory ? { directory } : {}) }, options);
+        const status = result?.error?.status ?? result?.error?.statusCode ?? result?.status ?? result?.response?.status;
+        if (result?.error) {
+          if (status === 404) return { found: false };
+          if (status === 405 || status === 501) return null;
+          return null;
+        }
+        const record = result?.data ?? result;
+        const id = identity(record);
+        return { found: id === messageID };
+      } catch {
+        return null;
+      }
+    };
+    const v2 = await viaExact(api?.v2?.session?.message, api?.v2?.session);
+    if (v2) return v2;
+    const legacy = await viaExact(api?.session?.message, api?.session);
+    if (legacy) return legacy;
+    try {
+      const listed = await api.session.messages({
+        sessionID,
+        ...(directory ? { directory } : {}),
+        limit: 100,
+      }, options);
+      if (listed?.error) return { found: false };
+      const rows = Array.isArray(listed?.data) ? listed.data : (Array.isArray(listed) ? listed : []);
+      const hit = rows.some((row) => identity(row) === messageID);
+      return { found: hit };
+    } catch {
+      return null;
+    }
+  };
+  const assignWork = async (row, params = {}) => {
+    const fileParts = sanitizeAssignFileParts(params.fileParts || params.parts || []);
+    const signal = params.signal;
+    const sdkOptions = signal ? { signal } : undefined;
+    const explicitModel = Boolean(
+      (typeof params.providerID === 'string' && params.providerID.trim())
+      || (typeof params.modelID === 'string' && params.modelID.trim())
+      || (typeof params.model === 'string' && params.model.trim())
+      || (params.model && typeof params.model === 'object'),
+    );
+    const needsCatalog = explicitModel || hasAssignImageParts(fileParts);
+    let catalog = null;
+    if (needsCatalog) {
+      catalog = await loadAssignCatalog(signal);
+    }
+    const workerModel = resolveAssignWorkerModel({
+      providerID: params.providerID,
+      modelID: params.modelID,
+      model: params.model,
+      fallback: { providerID: row.provider_id, modelID: row.model_id },
+      catalog,
+    });
+    let acceptsImages = workerModel.acceptsImages;
+    if (hasAssignImageParts(fileParts) && acceptsImages == null && catalog) {
+      const entry = catalog.models.find((item) => (
+        item?.providerID === workerModel.providerID && item?.modelID === workerModel.modelID
+      ));
+      acceptsImages = entry?.acceptsImages === true;
+    }
+    // Worker model is prompt-only. Never mutate the contact assistant row.
+    // Forward tool variant + AbortSignal; lookupMessage uses real SDK exact/list paths.
+    return assignSession({
+      ...params,
+      fileParts,
+      ...(params.variant !== undefined ? { variant: params.variant } : {}),
+      ...(signal ? { signal } : {}),
+      model: {
+        providerID: workerModel.providerID,
+        modelID: workerModel.modelID,
+        source: workerModel.source,
+        acceptsImages,
+      },
+      acceptsImages,
+      assistant: output(row),
+      defaultProjectPath: row.workspace_path,
+      allowedRoots: getAllowedRoots(),
+      managedWorkspaceRoot: path.resolve(dataDir, 'assistant-workspaces'),
+      listWorktrees,
+      createSession: (created) => client().session.create(created, sdkOptions),
+      promptExisting: (prompted) => client().session.promptAsync(prompted, sdkOptions),
+      deleteSession: (deleted) => (
+        typeof client().session.delete === 'function'
+          ? client().session.delete(deleted, sdkOptions)
+          : undefined
+      ),
+      lookupMessage: (lookup) => lookupAssignMessage({ ...lookup, signal }),
+      messageID: params?.messageID || `msg_assign_${id()}`,
+    });
+  };
   const matchRegisteredProject = async (directory) => {
     const projects = await listProjects();
     const resolved = path.resolve(directory);
@@ -1029,16 +1349,12 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     const messageID = string(input.messageID, 256, true);
     const userText = extractUserText(input);
     if (!userText) fail('validation_error');
-    const userParts = userContactParts(input, userText);
     const row = active(assistantID);
+    const userParts = await userContactParts(row.assistant_id, input, userText);
     if (typeof createChatCompletion !== 'function' && runContactTurn === defaultRunContactTurn) fail('upstream_error');
     let registeredProjects = [];
     try {
-      const listed = await listProjects();
-      if (!Array.isArray(listed)) {
-        throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Registered project catalog failed to load.');
-      }
-      registeredProjects = filterRegisteredProjects(listed);
+      registeredProjects = filterRegisteredProjects(await loadRegisteredProjects());
     } catch (error) {
       if (error instanceof AssignError || error instanceof AssistantError) throw error;
       // Still allow the turn — tools can surface a later catalog failure.
@@ -1046,22 +1362,49 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     }
     const turnID = messageID;
     const assistantSnapshot = output(row);
+    const existingUser = getContactMessage(db, messageID);
+    if (existingUser) {
+      if (existingUser.assistantID !== row.assistant_id || existingUser.role !== 'user') fail('validation_error');
+      const existingFingerprint = contactPartsFingerprint(existingUser.parts);
+      const nextFingerprint = contactPartsFingerprint(
+        Array.isArray(userParts) && userParts.length > 0 ? userParts : [{ type: 'text', text: userText }],
+      );
+      if (existingFingerprint !== nextFingerprint) fail('idempotency_conflict');
+      // Same messageID + payload: replay admission only — never start a second lane turn.
+      return {
+        binding: binding(row),
+        messageID,
+        admitted: true,
+        revision: revision(),
+        replayed: true,
+      };
+    }
     admitContactUser(row.assistant_id, {
       userMessageID: messageID,
       userText,
       userParts,
       turnID,
     });
+    rememberActiveContactTurn(row.assistant_id, {
+      turnID,
+      messageID,
+      status: 'queued',
+      admittedAt: now(),
+    });
     emitContactTurnEvent('openchamber:contact-turn-start', {
       assistantID: row.assistant_id,
       turnID,
       messageID,
     });
     contactTurnSettlement(messageID);
-    // Authorize wipe from this turn's real userText only — not tool args.
-    const clearChatHistoryAuthorized = userTextAuthorizesClearChatHistory(userText);
     const kickTurn = () => {
       void inContactTurnLane(row.assistant_id, async () => {
+        if (closed) {
+          settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
+          resolveContactTurnSettlement(messageID, { status: 'error', error: 'closed' });
+          return;
+        }
+        markActiveContactTurnRunning(row.assistant_id, turnID);
         // Load the LLM window when the lane runs — not at admit time — so a
         // prior turn's clear-memory cannot leave queued work with stale history.
         // Exclude the admitted user row; prompt still receives userText/parts.
@@ -1078,54 +1421,78 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
         const assignedCards = [];
         let contactResetThisTurn = false;
         let contactHistoryClearedThisTurn = false;
-        const tools = createContactTools({
-          assignWork: (params) => assignWork(row, params),
-          createAssistant: (toolInput) => createAssistant(toolInput),
-          scheduleTask: (params) => scheduleWork(row, params),
-          deliverPeerMessage: (toolInput) => deliverPeerMessage(row.assistant_id, toolInput),
-          clearContactMemory: () => {
-            // Cap the watermark at this turn's user ordinal — never global MAX,
-            // or later-admitted queued users are permanently excluded from LLM history.
-            const result = clearContactMemory(row.assistant_id, {
-              upToOrdinal: beforeOrdinal,
-            });
-            contactResetThisTurn = true;
-            return result;
-          },
-          resetContact: () => {
-            // Server core gate: model mis-select cannot self-authorize delete.
-            if (!clearChatHistoryAuthorized) {
-              throw new AssignError(
-                ASSIGN_CODES.VALIDATION,
-                'clear_chat_history requires explicit user wipe intent in this message.',
-              );
-            }
-            const result = resetContact(row.assistant_id);
-            contactResetThisTurn = true;
-            contactHistoryClearedThisTurn = true;
-            return result;
-          },
-          listAssistants: () => db.prepare('SELECT * FROM assistant_v2 WHERE tombstone_at IS NULL ORDER BY created_at').all().map(output),
-          listProjects: async () => {
-            const listed = await listProjects();
-            if (!Array.isArray(listed)) {
-              throw new AssignError(ASSIGN_CODES.UPSTREAM, 'Registered project catalog failed to load.');
-            }
-            return listed;
-          },
-          listSessions: (params) => listSessionsWork(params),
-          currentAssistant: assistantSnapshot,
-          onCard: (card) => assignedCards.push(card),
-        });
+        let connectedModels = [];
         try {
+          const catalog = await loadAssignCatalog(undefined);
+          connectedModels = normalizeConnectedModels(catalog?.models);
+        } catch {
+          // Catalog failure must not block default-model contact turns.
+          // Explicit worker model / image capability checks still fail closed inside assignWork.
+          connectedModels = [];
+        }
+        try {
+          // Materialize inside turn try so failures durable-error + settle working.
+          // DB/UI keep descriptors; harness + assign get execution-time data URLs under budget.
+          const executionHistory = await materializeContactHistory(
+            db,
+            dataDir,
+            row.assistant_id,
+            history,
+            { budgetBytes: CONTACT_ATTACHMENT_TURN_BUDGET_BYTES },
+          );
+          const executionParts = await materializeContactParts(
+            db,
+            dataDir,
+            row.assistant_id,
+            userParts,
+            { budgetBytes: CONTACT_ATTACHMENT_TURN_BUDGET_BYTES },
+          );
+          // Current-turn attachments only — never unbounded history image forwarding.
+          const turnFileParts = sanitizeAssignFileParts(
+            (Array.isArray(executionParts) ? executionParts : []).filter((part) => part?.type === 'file'),
+          );
+          const turnAttachmentScope = attachmentScopeKey(turnFileParts);
+          const tools = createContactTools({
+            assignWork: (params) => assignWork(row, params),
+            createAssistant: (toolInput) => createAssistant(toolInput),
+            scheduleTask: (params) => scheduleWork(row, params),
+            deliverPeerMessage: (toolInput) => deliverPeerMessage(row.assistant_id, toolInput),
+            clearContactMemory: () => {
+              // Cap the watermark at this turn's user ordinal — never global MAX,
+              // or later-admitted queued users are permanently excluded from LLM history.
+              const result = clearContactMemory(row.assistant_id, {
+                upToOrdinal: beforeOrdinal,
+              });
+              contactResetThisTurn = true;
+              return result;
+            },
+            resetContact: () => {
+              // Tool wipe: keep wipe user + later-admitted users only; delete all
+              // other roles at any ordinal (incl. late prior-lane assistant/cards).
+              const result = resetContact(row.assistant_id, {
+                upToOrdinal: beforeOrdinal,
+              });
+              contactResetThisTurn = true;
+              contactHistoryClearedThisTurn = true;
+              return result;
+            },
+            listAssistants: () => db.prepare('SELECT * FROM assistant_v2 WHERE tombstone_at IS NULL ORDER BY created_at').all().map(output),
+            listProjects: async () => loadRegisteredProjects(),
+            listSessions: (params) => listSessionsWork(params),
+            currentAssistant: assistantSnapshot,
+            onCard: (card) => assignedCards.push(card),
+            turnFileParts,
+            turnAttachmentScope,
+          });
           const generated = await runContactTurn({
             assistant: assistantSnapshot,
-            history,
+            history: executionHistory,
             userText,
-            userParts,
+            userParts: executionParts,
             createChatCompletion,
             tools,
             projects: registeredProjects,
+            connectedModels,
             globalEventHub,
             onBubbleDelta: (bubbleIndex, delta, done) => {
               emitContactTurnEvent('openchamber:contact-bubble-delta', {
@@ -1138,6 +1505,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             },
           });
           if (closed) {
+            settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
             resolveContactTurnSettlement(messageID, { status: 'error', error: 'closed' });
             return;
           }
@@ -1159,6 +1527,16 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             ].filter((card, index, list) => list.findIndex((item) => contactCardIdentity(item) === contactCardIdentity(card)) === index);
           if (bubbles.length === 0 && cards.length === 0) {
             const detail = 'Assistant returned no text';
+            try {
+              persistContactTurnFailure(row.assistant_id, {
+                userMessageID: messageID,
+                turnID,
+                error: detail,
+              });
+              settleActiveContactTurn(row.assistant_id, turnID);
+            } catch {
+              settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
+            }
             emitContactTurnEvent('openchamber:contact-turn-end', {
               assistantID: row.assistant_id,
               turnID,
@@ -1175,9 +1553,9 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             resolveContactTurnSettlement(messageID, { status: 'error', error: detail });
             return;
           }
-          // clear_chat_history / resetContact wipe the transcript (including the
-          // admitted user row). Re-admit that user message, then persist only the
-          // confirm bubble. new_conversation keeps rows and only moves the watermark.
+          // clear_chat_history keeps the wipe user row (bounded delete). Re-admit
+          // only if the row is missing (unbounded API wipe / edge). Then persist
+          // only the confirm bubble. new_conversation keeps all rows + watermark.
           if (resetThisTurn) {
             const existingUser = db.prepare('SELECT 1 AS ok FROM assistant_contact_message WHERE message_id=?').get(messageID);
             if (!existingUser) {
@@ -1195,6 +1573,8 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             cards,
             turnID,
           });
+          // persistContactAssistantReply already bumps; clear activity without a second tip.
+          settleActiveContactTurn(row.assistant_id, turnID);
           emitContactTurnEvent('openchamber:contact-turn-end', {
             assistantID: row.assistant_id,
             turnID,
@@ -1214,6 +1594,16 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
             ? error.message.trim()
             : (error?.code || 'upstream_error');
           const statusCode = error?.code === 'no_provider' ? 'no_provider' : (error?.code || 'upstream_error');
+          try {
+            persistContactTurnFailure(row.assistant_id, {
+              userMessageID: messageID,
+              turnID,
+              error: detail,
+            });
+            settleActiveContactTurn(row.assistant_id, turnID);
+          } catch {
+            settleActiveContactTurn(row.assistant_id, turnID, { bumpRevision: true });
+          }
           emitContactTurnEvent('openchamber:contact-turn-end', {
             assistantID: row.assistant_id,
             turnID,
@@ -1234,13 +1624,35 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     };
     // Defer past send() resolution so callers observe admission before assistant rows.
     setImmediateFn(kickTurn);
-    return { binding: binding(row), messageID, admitted: true };
+    return { binding: binding(row), messageID, admitted: true, revision: revision() };
   };
   const contactMessages = (assistantID, query = {}) => {
-    editable(assistantID);
-    const limit = query.limit == null ? 50 : Number(query.limit);
-    if (!Number.isInteger(limit) || limit < 1 || limit > 100) fail('validation_error');
-    return listContactMessages(db, assistantID, { before: query.before, limit });
+    const row = editable(assistantID);
+    const hasBefore = !(query.before == null || query.before === '');
+    const hasExact = !(query.messageID == null || query.messageID === '');
+    if (hasBefore && hasExact) fail('validation_error', 'before and messageID are mutually exclusive');
+    let limit = query.limit == null || query.limit === '' ? CONTACT_PAGE_DEFAULT_LIMIT : Number(query.limit);
+    if (!Number.isInteger(limit) || limit < 1 || limit > CONTACT_PAGE_MAX_LIMIT) fail('validation_error');
+    let page;
+    try {
+      page = listContactMessages(db, row.assistant_id, {
+        before: hasBefore ? query.before : undefined,
+        limit,
+        messageID: hasExact ? query.messageID : undefined,
+      });
+    } catch (error) {
+      if (error?.code === 'contact_generation_conflict' || error?.code === 'validation_error') {
+        fail(error.code, error.message);
+      }
+      throw error;
+    }
+    return {
+      messages: page.messages,
+      nextCursor: page.nextCursor,
+      complete: page.complete,
+      generation: page.generation,
+      revision: revision(),
+    };
   };
   /**
    * Clear LLM memory only: advance the durable context boundary so later
@@ -1267,21 +1679,34 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
   };
   /**
    * Delete this assistant's OpenChamber contact transcript (messages, parts,
-   * watches) and clear the context boundary. Intentional wipe only — also the
-   * POST /contact/reset contract. Does not call OpenCode session/new.
+   * watches) and clear the context boundary. Also the POST /contact/reset
+   * contract. Does not call OpenCode session/new.
+   *
+   * Tool path may pass `upToOrdinal` (wiping turn's user ordinal) so later-
+   * admitted queued rows survive. Direct API without a ceiling deletes every
+   * row (existing contract). Concurrent in-flight admissions already past 202
+   * keep their message IDs only when bounded; unbounded API wipe drops them
+   * and a later same-ID send replays as a fresh admission only if the row is gone.
    */
-  const resetContact = (assistantID) => {
+  const resetContact = (assistantID, options = {}) => {
     const row = editable(assistantID);
+    const upToOrdinal = options && typeof options === 'object' ? options.upToOrdinal : undefined;
     db.exec('BEGIN IMMEDIATE');
     try {
-      deleteContactMessages(db, row.assistant_id);
+      // Generation bumps only on transcript wipe — not on clear-memory.
+      const generation = bumpContactGeneration(db, row.assistant_id);
+      deleteContactMessages(db, row.assistant_id, {
+        ...(upToOrdinal !== undefined ? { upToOrdinal } : {}),
+      });
+      // Active contact turns stay until settle — wipe must not drop the green
+      // dot while the clearing turn is still running.
       bump();
       db.exec('COMMIT');
+      return { assistantID: row.assistant_id, reset: true, historyCleared: true, generation };
     } catch (error) {
       db.exec('ROLLBACK');
       throw error;
     }
-    return { assistantID: row.assistant_id, reset: true, historyCleared: true };
   };
   const appendContactCard = (assistantID, input) => {
     const row = active(assistantID);
@@ -1419,7 +1844,57 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
     operation = db.prepare('SELECT * FROM assistant_share_operation WHERE operation_id=?').get(operationID); if (operation?.phase !== 'reserving') { const claimed = claim(operationID, operation?.state === 'failed'); if (claimed) await submitClaim(claimed); } return shareOperation(operationID); };
   const timer = setIntervalFn(() => { if (!closed) { db.prepare('DELETE FROM assistant_share_operation WHERE updated_at<?').run(now() - SHARE_RETENTION_MS); return reconcile(); } }, reconcileIntervalMs);
   void reconcile();
-  return { capability: async () => ({ supported: true, enabled: enabled(), revision: revision(), serverInstanceID: await getServerId() }), snapshot: () => ({ revision: revision(), enabled: enabled(), assistants: db.prepare('SELECT * FROM assistant_v2 WHERE tombstone_at IS NULL ORDER BY created_at').all().map(output) }), createAssistant, updateAssistant, setEnabled: (input) => { if (!plainObject(input) || typeof input.enabled !== 'boolean' || input.expectedRevision !== revision()) fail('revision_conflict'); db.prepare("UPDATE assistant_meta SET value=? WHERE key='enabled'").run(input.enabled ? '1' : '0'); return { enabled: input.enabled, revision: bump() }; }, removeAssistant: (assistantID, expectedRevision) => {
+  const putAssistantContactAttachment = async (assistantID, uploadID, { stream, headers, signal, storeBytes } = {}) => {
+    const row = editable(assistantID);
+    try {
+      return await putContactAttachment({
+        db,
+        dataDir,
+        assistantID: row.assistant_id,
+        uploadID,
+        stream,
+        headers,
+        clock: now,
+        signal,
+        ...(storeBytes ? { storeBytes } : {}),
+      });
+    } catch (error) {
+      if (error?.code) fail(error.code, error.message);
+      throw error;
+    }
+  };
+  const getAssistantContactAttachment = async (assistantID, attachmentID) => {
+    const row = editable(assistantID);
+    try {
+      return await readContactAttachmentBytes({
+        db,
+        dataDir,
+        assistantID: row.assistant_id,
+        attachmentID,
+        external: true,
+      });
+    } catch (error) {
+      if (error?.code) fail(error.code, error.message);
+      throw error;
+    }
+  };
+  const migrateContactAttachments = async (assistantID = null) => migrateContactDataUrlParts({
+    db,
+    dataDir,
+    assistantID,
+    clock: now,
+  });
+  const snapshot = () => {
+    const rows = db.prepare('SELECT * FROM assistant_v2 WHERE tombstone_at IS NULL ORDER BY created_at').all();
+    // Per-assistant indexed LIMIT probes + one parts batch (catalog ≤100).
+    const previews = getLatestContactMessagePreviews(db, rows.map((row) => row.assistant_id));
+    return {
+      revision: revision(),
+      enabled: enabled(),
+      assistants: rows.map((row) => output(row, previews.get(row.assistant_id) ?? null)),
+    };
+  };
+  return { capability: async () => ({ supported: true, enabled: enabled(), revision: revision(), serverInstanceID: await getServerId() }), snapshot, createAssistant, updateAssistant, setEnabled: (input) => { if (!plainObject(input) || typeof input.enabled !== 'boolean' || input.expectedRevision !== revision()) fail('revision_conflict'); db.prepare("UPDATE assistant_meta SET value=? WHERE key='enabled'").run(input.enabled ? '1' : '0'); return { enabled: input.enabled, revision: bump() }; }, removeAssistant: (assistantID, expectedRevision) => {
     db.exec('BEGIN IMMEDIATE');
     try {
       const result = db.prepare('UPDATE assistant_v2 SET tombstone_at=?,revision=revision+1,updated_at=? WHERE assistant_id=? AND revision=? AND tombstone_at IS NULL').run(now(), now(), assistantID, expectedRevision);
@@ -1430,6 +1905,7 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
       db.prepare('DELETE FROM assistant_message_backfill WHERE assistant_id=?').run(assistantID);
       db.prepare('DELETE FROM assistant_scheduled_task WHERE assistant_id=?').run(assistantID);
       deleteContactMessages(db, assistantID);
+      clearActiveContactTurns(assistantID);
       bump();
       db.exec('COMMIT');
       return { assistantID, tombstoneAt: now() };
@@ -1437,5 +1913,14 @@ export const createAssistantsService = ({ dbPath, dataDir, buildOpenCodeUrl, get
       db.exec('ROLLBACK');
       throw error;
     }
-  }, ensure, createNew, compact, send, whenContactTurnSettled, abort, captureQueueDeliveryTarget, sendWithCapturedConfig, share, shareOperation, historicalMessages, contactMessages, clearContactMemory, resetContact, appendContactCard, deliverPeerMessage, listAssistantScheduledTasks, processEvent, reportAssignedSessionSettle: reportAssignedSession, reconcile, close: () => { if (!closed) { closed = true; unsubscribeEvents?.(); clearIntervalFn(timer); db.close(); } } };
+  }, ensure, createNew, compact, send, whenContactTurnSettled, abort, captureQueueDeliveryTarget, sendWithCapturedConfig, share, shareOperation, historicalMessages, contactMessages, clearContactMemory, resetContact, appendContactCard, deliverPeerMessage, listAssistantScheduledTasks, putAssistantContactAttachment, getAssistantContactAttachment, migrateContactAttachments, processEvent, reportAssignedSessionSettle: reportAssignedSession, reconcile,   close: () => {
+    if (!closed) {
+      closed = true;
+      try { contactAttachmentMigration.controller.abort(); } catch { /* ignore */ }
+      clearActiveContactTurns();
+      unsubscribeEvents?.();
+      clearIntervalFn(timer);
+      db.close();
+    }
+  } };
 };