@semalt-ai/code 1.19.0 → 1.20.0

package/lib/api.js

@@ -76,6 +76,21 @@ function debugDumpMessages(msgs) {
   }
 }
 
+// Strip client-only sibling keys from messages right before the wire. Today
+// that is the Phase 6a `_display` descriptor core (persisted on native tool
+// messages for replay fidelity). Returns the array unchanged when no message
+// carries one, so the common path allocates nothing.
+function stripInternalKeys(messages) {
+  if (!Array.isArray(messages) || !messages.some((m) => m && m._display !== undefined)) return messages;
+  return messages.map((m) => {
+    if (m && m._display !== undefined) {
+      const { _display, ...rest } = m;
+      return rest;
+    }
+    return m;
+  });
+}
+
 // Fit messages into tokenBudget tokens.
 // Uses chars/4 — aligned with estimateTokens; a deliberate under-estimate
 // for token-dense content (code, JSON, HTML) but consistent across the
@@ -415,7 +430,7 @@ function createApiClient({ getConfig, saveConfig, ui }) {
     });
   }
 
-  async function chatStream(messages, { model, temperature, maxTokens, linePrefix = '', showThink = false, onToken = null, silent = false, signal = null, onTrim = null, nativeTools = true } = {}) {
+  async function chatStream(messages, { model, temperature, maxTokens, linePrefix = '', showThink = false, onToken = null, onReasoning = null, silent = false, signal = null, onTrim = null, nativeTools = true } = {}) {
     // nativeTools is plumbed through for downstream use (tools param + tool_calls parsing); no behavior change yet.
     const config = getConfig();
     const resolvedModel = model || config.default_model;
@@ -514,8 +529,10 @@ function createApiClient({ getConfig, saveConfig, ui }) {
       validateToolCallInvariant(msgs);
       // Transform any image-bearing turn into the provider-specific multimodal
       // content[] shape right before the wire (Task 5.4); the internal `images`
-      // field never leaves the client.
-      const wireMsgs = imagesPresent ? buildProviderMessages(msgs, imageFormat) : msgs;
+      // field never leaves the client. The Phase 6a `_display` descriptor sibling
+      // (persisted on native tool messages for replay) is likewise client-only —
+      // strip it here so it is never fed to the model.
+      const wireMsgs = stripInternalKeys(imagesPresent ? buildProviderMessages(msgs, imageFormat) : msgs);
       const reqPayload = { ...payload, messages: wireMsgs };
       // Optional payload augmentations (Task 2.7): reasoning_effort for models
       // that support it, and prompt-caching markers on the stable prefix when
@@ -788,6 +805,14 @@ function createApiClient({ getConfig, saveConfig, ui }) {
               const uiActive = isUIActive();
               if (!inReasoning) {
                 inReasoning = true;
+                // Live-narration safety signal (a): the model demonstrably uses
+                // the structured reasoning_content channel this turn, so any
+                // delta.content that follows is narration, not inlined reasoning.
+                // Fire once per stream so the UI can eager-open its live gate on
+                // the native rail. Failures here must never break the stream.
+                if (typeof onReasoning === 'function') {
+                  try { onReasoning(); } catch { /* UI signal is best-effort */ }
+                }
                 if (showThink && !uiActive) {
                   // audit: allowed — non-TUI thinking output, interleaves with StreamRenderer sync writes.
                   process.stdout.write(`\n  ${FG_DARK}${DIM}⟨thinking⟩${RST}`);

package/lib/commands/chat-session.js

@@ -45,7 +45,12 @@ function createChatSession(ctx) {
       const title = firstUserText.length > 60 ? firstUserText.slice(0, 57) + '...' : firstUserText;
       const resp = await dashboardCreateChat(title, config.dashboard_model_id);
       if (resp && resp.chat && resp.chat.id) ctx.currentChatId = resp.chat.id;
-    } catch {}
+    } catch (err) {
+      // Surface (don't swallow) a creation failure: a silent failure here leaves
+      // currentChatId null, so saveTurnToDashboard early-returns with no warning —
+      // quiet data loss. Non-fatal to the turn; the local session save still runs.
+      msgs.sysWarn(`could not create dashboard chat: ${err && err.message ? err.message : String(err)}`);
+    }
   }
 
   async function saveTurnToDashboard() {
@@ -59,23 +64,180 @@ function createChatSession(ctx) {
         msgs.sysWarn(`history save: ${resp.skipped_count} message(s) skipped by server`);
       }
     } catch (err) {
+      // A 404 means the chat id is stale for the CURRENT token — the chat belongs
+      // to another principal (relogin) or was deleted on the dashboard. Self-heal
+      // ONCE per turn: recreate a fresh chat under the current token and re-save
+      // the SAME pending slice. Scoped strictly to 404 — a transient network/5xx
+      // must NOT recreate the chat (that would spawn duplicates); leave savedUpTo
+      // unadvanced so a later turn retries the same slice naturally.
+      if (err && err.statusCode === 404) {
+        ctx.currentChatId = null;
+        const firstUser = ctx.messages.find((m) => m.role === 'user');
+        const title = firstUser && typeof firstUser.content === 'string' && firstUser.content
+          ? firstUser.content : 'Untitled chat';
+        await createChatIfNeeded(title);   // warns on its own failure (see above)
+        if (ctx.currentChatId === null) return;  // recreation failed; already warned
+        try {
+          const resp = await dashboardSaveMessages(ctx.currentChatId, newMessages);
+          ctx.savedUpTo = ctx.messages.length;   // advance ONLY after re-save succeeds
+          if (resp && typeof resp.skipped_count === 'number' && resp.skipped_count > 0) {
+            msgs.sysWarn(`history save: ${resp.skipped_count} message(s) skipped by server`);
+          }
+        } catch (err2) {
+          msgs.sysWarn(`history save failed: ${err2 && err2.message ? err2.message : String(err2)}`);
+        }
+        return;
+      }
       msgs.sysWarn(`history save failed: ${err && err.message ? err.message : String(err)}`);
     }
   }
 
   function displayLoadedMessages(loadedMessages) {
     chatHistory.clearMessages();
-    for (const m of loadedMessages) {
-      if (m.role !== 'user' && m.role !== 'assistant' && m.role !== 'tool') continue;
+    const cfg = getConfig() || {};
+    const { descriptorFromStored } = require('../ui/tool-operation');
+    const { isWebCore, aggregateWebOps, formatWebSummaryLine } = require('../ui/web-activity');
+    const {
+      isGroupableFileCore, fileSummaryState, formatFileSummaryLine,
+    } = require('../ui/file-activity');
+
+    // Phase 6c-ii — replayed web activity renders as the aggregated `✓ web · …`
+    // committed summary, byte-identical to the live committed line. A web GROUP
+    // is a maximal consecutive run of web ops, so the buffer is LOOP-LEVEL (not
+    // blob-/message-local): a group spans iterations, and those iterations live
+    // in separate {role:'tool'} messages (native rail) or separate
+    // {role:'user'} feedback blobs (XML rail). The live flush triggers
+    // (chat-turn.js) are mirrored below: a non-web tool starting, a terminal
+    // assistant message with content, and turn end (the trailing flushWeb()).
+    // flushWeb() calls ONLY the pure aggregateWebOps/formatWebSummaryLine — it
+    // never instantiates createWebActivityTracker or touches the live region.
+    let webBuf = [];
+    function flushWeb() {
+      if (!webBuf.length) return;
+      const line = formatWebSummaryLine(aggregateWebOps(webBuf), { pending: false });
+      chatHistory.addRawLine(line);
+      webBuf = [];
+    }
+
+    // Parallel re-grouping for consecutive file ops (read_file/list_dir),
+    // mirroring flushWeb but with the live tracker's THRESHOLD applied at the
+    // REPLAY terminal width: a buffered run of ≥3 commits one aggregated summary
+    // (formatFileSummaryLine reads getCols() at flush, so a 200-col session
+    // re-groups correctly in an 80-col terminal); a run of 1–2 commits each op as
+    // its own per-op line via the SAME `_display` render the live path uses —
+    // byte-identical to a fresh per-op commit. read_file and list_dir share ONE
+    // group (mirroring the live merged key): a mixed run re-groups into the same
+    // single summary, with fileSummaryState picking the homogeneous-vs-mixed verb.
+    let fileBuf = [];   // [{ core, ts }]
+    function flushFile() {
+      if (!fileBuf.length) return;
+      const buf = fileBuf;
+      fileBuf = [];
+      if (buf.length >= 3) {
+        const line = formatFileSummaryLine(fileSummaryState(buf.map((e) => e.core)), { pending: false });
+        chatHistory.addRawLine(line);
+      } else {
+        for (const { core, ts } of buf) {
+          chatHistory.addMessage({
+            role: 'tool', tag: 'tool', content: '', ts,
+            _display: core,
+            diffMaxLines: cfg.diff_max_lines,
+            previewLines: cfg.shell_preview_lines || 5,
+          });
+        }
+      }
+    }
+    // pushFile is only reached for groupable file cores (the caller gates on
+    // isGroupableFileCore), and read_file + list_dir now share one group, so every
+    // buffered op belongs to the same run — no key split. A non-groupable op
+    // flushes the buffer via the flushFile() calls on the other branches.
+    function pushFile(core, ts) {
+      fileBuf.push({ core, ts });
+    }
+
+    // A message that carries tool activity for an in-flight iteration: a native
+    // {role:'tool'} result, or an XML {role:'user'} feedback blob. The replay
+    // analogue of "an assistant iteration had tool calls" (live: cleanContent==='')
+    // is "the assistant is immediately followed by tool activity" — rail-agnostic,
+    // and independent of whether `tool_calls` survived the storage round-trip.
+    const isToolActivity = (msg) => !!msg && (
+      msg.role === 'tool' ||
+      (msg.role === 'user' && typeof msg.content === 'string' && msg.content.startsWith('Tool execution results:'))
+    );
+
+    const relevant = loadedMessages.filter(
+      (m) => m.role === 'user' || m.role === 'assistant' || m.role === 'tool',
+    );
+
+    for (let ri = 0; ri < relevant.length; ri++) {
+      const m = relevant[ri];
       const raw = typeof m.content === 'string' ? m.content : '';
       const ts = m.created_at ? new Date(m.created_at) : (m.ts ? new Date(m.ts) : new Date());
 
       if (m.role === 'tool') {
-        chatHistory.addMessage({ role: 'tool', tag: 'tool', content: raw, ts });
+        // Phase 6c-ii — a native web op persists a {v:1,kind:'web',…} core in
+        // `_display`. Buffer it into the current web group (no per-op line) and
+        // continue; the aggregated summary commits when the group flushes. A
+        // non-web tool first ENDS any open web run so its summary lands ABOVE this
+        // line (mirrors chat-turn.js:222), then renders via the 6a path.
+        if (isWebCore(m._display)) { flushFile(); webBuf.push(m._display); continue; }
+        // A groupable file core (read_file/list_dir) buffers into the file group
+        // (flushing any open web run first so its summary lands above); the
+        // aggregated/per-op commit happens when the file group flushes.
+        if (isGroupableFileCore(m._display)) { flushWeb(); pushFile(m._display, ts); continue; }
+        flushWeb(); flushFile();
+        // Phase 6a — forward the persisted display descriptor (native rail) so
+        // chat-history can replay it with full fidelity. `_display` absent →
+        // legacy summarizeToolResult fallback. The budgets match the live path
+        // (diff_max_lines for an edit diff; shell_preview_lines for an output
+        // preview) so a replayed line is byte-identical to a fresh render.
+        chatHistory.addMessage({
+          role: 'tool', tag: 'tool', content: raw, ts,
+          _display: m._display,
+          diffMaxLines: cfg.diff_max_lines,
+          previewLines: cfg.shell_preview_lines || 5,
+        });
         continue;
       }
 
       if (m.role === 'user' && raw.startsWith('Tool execution results:')) {
+        // Phase 6b — XML rail per-call replay parity. The feedback blob folds all
+        // tool results of a turn into one {role:'user'} message; it cannot be
+        // split back by parsing (the \n\n separator appears freely inside result
+        // bodies). When the persisted aligned `_display[]` array is present AND
+        // EVERY slot is a valid core — a normal descriptor core OR (Phase 6c-ii)
+        // a web-op core — replay each in order. The gate stays fail-safe: a single
+        // `null` slot or an unknown core drops the WHOLE blob to the legacy
+        // whole-blob summary below (no partial render), so a web op's activity
+        // never silently vanishes on replay.
+        const displays = Array.isArray(m._display) ? m._display : null;
+        // Phase 6c-ii — flip the 6c-i gate: a web-op core ({v:1,kind:'web',…}) is
+        // now a VALID slot (it aggregates into the web summary) instead of failing
+        // the gate. Normal slots must still pass descriptorFromStored; web slots
+        // must be v:1 web-cores. Any other slot (null / unknown) still fails.
+        if (displays && displays.length > 0 && displays.every(
+          (el) => el && ((isWebCore(el) && el.v === 1) || (!isWebCore(el) && descriptorFromStored(el))),
+        )) {
+          for (const el of displays) {
+            // A web slot buffers into the open web group; a groupable file slot
+            // buffers into the file group; a normal slot first flushes any
+            // preceding grouped run (mirrors a non-grouped tool starting), then
+            // renders.
+            if (isWebCore(el)) { flushFile(); webBuf.push(el); continue; }
+            if (isGroupableFileCore(el)) { flushWeb(); pushFile(el, ts); continue; }
+            flushWeb(); flushFile();
+            chatHistory.addMessage({
+              role: 'tool', tag: 'tool', content: '', ts,
+              _display: el,
+              diffMaxLines: cfg.diff_max_lines,
+              previewLines: cfg.shell_preview_lines || 5,
+            });
+          }
+          continue;
+        }
+        // Gate failed — a preceding grouped run (if any) ends here, then the legacy
+        // whole-blob summary renders (6b/6c-i fail-safe preserved).
+        flushWeb(); flushFile();
         const body = raw
           .replace(/^Tool execution results[^\n]*\n+/, '')
           .replace(/\n+Continue with the task\.[\s\S]*$/, '')
@@ -84,9 +246,30 @@ function createChatSession(ctx) {
         continue;
       }
 
+      // Plain user / assistant message. Empty-content messages never flush (an
+      // intermediate, tool-call-only assistant message between two web iterations
+      // carries empty display content — flushing there would split a cross-
+      // iteration group into two summaries) and are not rendered.
       if (!raw.trim()) continue;
+      if (m.role === 'assistant') {
+        // Flush ONLY on a TERMINAL assistant message — one not immediately
+        // followed by tool activity (the replay analogue of live cleanContent!==''
+        // at chat-turn.js:389-391). An intermediate assistant with content is
+        // still rendered, but does NOT flush, so the open web group survives.
+        if (!isToolActivity(relevant[ri + 1])) { flushWeb(); flushFile(); }
+      } else {
+        // A plain user message starts a NEW turn — close any grouped run left open
+        // by the prior turn (the live per-turn `finally` flush, chat-turn.js).
+        flushWeb(); flushFile();
+      }
       chatHistory.addMessage({ role: m.role, content: raw, ts });
     }
+
+    // Turn-end safety net: a trailing grouped run (turn ended/was interrupted
+    // right after a web or file op, with no terminal assistant) commits here —
+    // mirrors the live per-turn `finally` flush in chat-turn.js.
+    flushWeb();
+    flushFile();
   }
 
   function seedContextFromMessages() {

package/lib/commands/chat-slash.js

@@ -85,6 +85,18 @@ function createSlashHandlers(ctx) {
         statusBar.setContextLimit(ctx.resolvedTokenLimit);
         chatHistory.addMessage({ role: 'system', content: `✓ Model → ${picked.name} (${picked.modelId})` });
       }
+      // Relogin is a principal change: the new token may belong to a different
+      // user, so the surviving currentChatId would otherwise suppress fresh-chat
+      // creation and make saveTurnToDashboard POST to a chat the new user can't
+      // see (404 "Chat not found"). Reset chat context AFTER the new token is
+      // saved (loginFlow) and the model resolved (ensureDefaultModel) so the next
+      // turn's createChatIfNeeded lazily creates a fresh chat under the new token.
+      // Mirror /new's FULL reset (messages + approvals too): retaining the prior
+      // user's messages/approvals across a token change is unsafe. The way back to
+      // an old chat is explicit --resume / /chats.
+      ctx.messages = [];
+      ctx.currentChatId = null; ctx.savedUpTo = 0;
+      permissionManager.clear();
       statusBar.update('idle');
       inputField.setDisabled(false);
     },
@@ -111,6 +123,10 @@ function createSlashHandlers(ctx) {
       if (!config.auth_token) { chatHistory.addMessage({ role: 'system', content: '✗ Not logged in.' }); return; }
       inputField.setDisabled(true);
       statusBar.update('thinking', 'Logging out...');
+      // Defense-in-depth: drop the chat context up front, REGARDLESS of whether
+      // the dashboardLogout HTTP call below succeeds (it early-returns on a
+      // non-401 error), so no later save can target the logged-out user's chat.
+      ctx.currentChatId = null; ctx.savedUpTo = 0;
       try { await dashboardLogout(); } catch (err) { if (err.statusCode !== 401) { chatHistory.addMessage({ role: 'system', content: `✗ ${err.message}`, isError: true }); statusBar.update('idle'); inputField.setDisabled(false); return; } }
       setConfig({ ...config, auth_token: '' });
       chatHistory.addMessage({ role: 'system', content: '✓ Logged out and cleared local CLI token.' });