@songsid/agend 2.3.0-beta.16 → 2.3.0-beta.18

package/dist/web-backend-login.d.ts

@@ -0,0 +1,130 @@
+import type { LoginChat, LoginStartOptions, WebLoginSink } from "./login-controller.js";
+import type { AvailabilityState } from "./backend-availability.js";
+/** How long the dialog's "go ahead" stays valid after the pre-check (chat's buttons expire as stale too). */
+export declare const WEB_LOGIN_CONFIRM_TTL_MS: number;
+/** How long an ended sign-in is still shown (its outcome), then it is gone. */
+export declare const WEB_LOGIN_KEEP_ENDED_MS: number;
+/** How often a running sign-in checks that the session which started it is still a local admin. */
+export declare const WEB_LOGIN_WATCH_MS = 5000;
+/**
+ * The provider hosts a sign-in link may point at to be offered as a link; any other URL is shown as text only. The
+ * CLI's own output is what is matched, and a page that turns whatever it printed into a link is a phishing aid.
+ */
+export declare const LOGIN_LINK_HOSTS: Readonly<Record<string, readonly string[]>>;
+/** An https URL on one of the backend's own hosts (or a subdomain of one). */
+export declare function linkableLoginUrl(backend: string, url: string): boolean;
+/** Whether the dashboard can run this sign-in (the same rule as chat's /login: a reviewed flow, profiles where chat signs them in). */
+export declare function dashboardSignInSupported(backend: string, profile?: string | null): boolean;
+/** One row of Settings → Agents' sign-in list: a backend's default login, or a credential profile one of the agents uses. */
+export interface SignInTarget {
+    backend: string;
+    profile?: string;
+    state: AvailabilityState;
+    /** The dashboard can sign it in (else: `hostCommand`, run on the machine, or nothing to sign in). */
+    signIn: boolean;
+    hostCommand?: string;
+    /** Not installed: the command that installs it. */
+    install?: string;
+    /** Too old: the command that installs the current version over it. */
+    update?: string;
+}
+export interface WebLoginRequester {
+    /** The session's handle (web-session.ts): what the sign-in is bound to. */
+    handle: string;
+    /** Its device label, for the other sessions and the notice. */
+    label: string;
+}
+export interface WebBackendLoginDeps {
+    /** Is the session with this handle live, admin and local right now? */
+    isLocalAdmin(handle: string): boolean;
+    /** LoginController.start for a dashboard requester (FleetManager refuses a CLI that is not installed first). */
+    start(backend: string, chat: LoginChat, opts: LoginStartOptions): Promise<string | null>;
+    accessToken(sink: WebLoginSink): string | null;
+    isActiveFor(sink: WebLoginSink): boolean;
+    /** End the sign-in this sink started (pending or running) and nothing else; true when there was one. */
+    cancelFor(sink: WebLoginSink): Promise<boolean>;
+    /** `/login cancel`: whatever sign-in or install is running. */
+    cancel(): Promise<string>;
+    /** A sign-in started from the dashboard: said where a chat login would be seen (General, or the Log). */
+    notice(info: {
+        shown: string;
+        label: string;
+        handle: string;
+    }): void;
+    /** The current sign-in started, changed phase or went: the pages are told to read it again (no details in the event). */
+    changed?(): void;
+    now?(): number;
+}
+export interface WebLoginConfirm {
+    id: string;
+    backend: string;
+    profile?: string;
+    tokenPresent: boolean;
+    logoutFirst: string | null;
+    publicLink: boolean;
+    deviceAuth: boolean;
+    expiresAt: number;
+}
+/** What one session sees of the current sign-in. The parts after `mine` are present only for the session that started it. */
+export interface WebLoginView {
+    id: string;
+    backend: string;
+    profile?: string;
+    phase: "running" | "ended";
+    ok: boolean | null;
+    startedOn: string;
+    startedAt: number;
+    endedAt: number | null;
+    mine: boolean;
+    lines?: string[];
+    hint?: {
+        url: string;
+        code: string | null;
+        linkable: boolean;
+    } | null;
+    terminal?: {
+        url: string;
+        ttlMinutes: number;
+        command: string;
+        loopback: boolean;
+        public: boolean;
+    } | null;
+    /** The browser terminal's one-time access code, while it is unredeemed. */
+    accessCode?: string | null;
+}
+export declare class WebBackendLogins {
+    private readonly deps;
+    private readonly pending;
+    private run;
+    /** Every admitted sign-in not yet ended — starting (its listener, tunnel or cloudflared still coming) or running. */
+    private readonly live;
+    private seq;
+    private watch;
+    constructor(deps: WebBackendLoginDeps);
+    private now;
+    /** The pre-check: the dialog's question, or the controller's answer (a refusal, "busy", "unsupported"…). */
+    check(who: WebLoginRequester, backendArg: string, profile?: string): Promise<{
+        confirm: WebLoginConfirm;
+    } | {
+        message: string;
+    }>;
+    /** The go-ahead for a pre-check this session was given; `tunnel` only where it offered a public link. */
+    begin(who: WebLoginRequester, confirmId: string, tunnel: boolean): Promise<{
+        login: WebLoginView;
+    } | {
+        message: string;
+    } | {
+        error: "confirm_expired" | "tunnel_not_offered";
+    }>;
+    /** The current sign-in as this session may see it, or null. */
+    view(viewerHandle: string): WebLoginView | null;
+    /** Any local admin may stop it (it only takes something away); a chat-started sign-in or install included. */
+    cancel(): Promise<string>;
+    dispose(): void;
+    private viewOf;
+    private changed;
+    private chatFor;
+    private sweep;
+    private startWatch;
+    private stopWatch;
+}

package/dist/web-backend-login.js

@@ -0,0 +1,225 @@
+/**
+ * #2233: signing a backend in from the web dashboard — the dashboard side of LoginController's `web` requester.
+ *
+ * - Who: a signed-in admin session on the local surface (the route checks it; the controller asks again through the
+ *   sink, and the watchdog below keeps asking while the sign-in runs). Never a guest, a read session or the public link.
+ * - Two steps, as in chat: `check` runs the controller's pre-check and keeps its answer here, server-side, under a
+ *   random id bound to the session that asked (chat keeps it in a nonce button); `begin` with that id starts the
+ *   sign-in through every check again. The client never says whether a token was present.
+ * - What chat sends as a link, a DM or a device code goes to the one session that started it, read back with `view`:
+ *   the browser terminal's URL, the provider's URL and code, and the access token while it is unredeemed. Other admin
+ *   sessions see that a sign-in is running (backend, device, phase) and may cancel it; nothing more.
+ * - A sign-in whose session signs out, expires or is revoked is cancelled (WEB_LOGIN_WATCH_MS).
+ */
+import { randomBytes } from "node:crypto";
+import { LOGIN_BACKEND_ALIASES, LOGIN_FLOWS } from "./login-flows.js";
+import { CHAT_PROFILE_LOGIN_BACKENDS } from "./backend/credential-profile.js";
+/** How long the dialog's "go ahead" stays valid after the pre-check (chat's buttons expire as stale too). */
+export const WEB_LOGIN_CONFIRM_TTL_MS = 5 * 60_000;
+/** How long an ended sign-in is still shown (its outcome), then it is gone. */
+export const WEB_LOGIN_KEEP_ENDED_MS = 10 * 60_000;
+/** How often a running sign-in checks that the session which started it is still a local admin. */
+export const WEB_LOGIN_WATCH_MS = 5_000;
+const MAX_LINES = 20;
+const MAX_LINE_CHARS = 2000;
+/**
+ * The provider hosts a sign-in link may point at to be offered as a link; any other URL is shown as text only. The
+ * CLI's own output is what is matched, and a page that turns whatever it printed into a link is a phishing aid.
+ */
+export const LOGIN_LINK_HOSTS = {
+    "codex": ["openai.com"],
+    "grok": ["x.ai"],
+    "kiro-cli": ["amazonaws.com", "awsapps.com", "aws.amazon.com", "kiro.dev"],
+    "claude-code": ["anthropic.com", "claude.ai", "claude.com"],
+};
+/** An https URL on one of the backend's own hosts (or a subdomain of one). */
+export function linkableLoginUrl(backend, url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "https:" || parsed.username || parsed.password)
+        return false;
+    const host = parsed.hostname.toLowerCase();
+    return (LOGIN_LINK_HOSTS[backend] ?? []).some(domain => host === domain || host.endsWith(`.${domain}`));
+}
+/** Whether the dashboard can run this sign-in (the same rule as chat's /login: a reviewed flow, profiles where chat signs them in). */
+export function dashboardSignInSupported(backend, profile) {
+    const flow = LOGIN_FLOWS[backend];
+    if (!flow || flow.remoteLogin === "unsupported" || flow.noShellEscape !== true)
+        return false;
+    return !profile || CHAT_PROFILE_LOGIN_BACKENDS.has(backend);
+}
+export class WebBackendLogins {
+    deps;
+    pending = new Map();
+    run = null;
+    /** Every admitted sign-in not yet ended — starting (its listener, tunnel or cloudflared still coming) or running. */
+    live = new Set();
+    seq = 0;
+    watch = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    now() { return (this.deps.now ?? Date.now)(); }
+    /** The pre-check: the dialog's question, or the controller's answer (a refusal, "busy", "unsupported"…). */
+    async check(who, backendArg, profile) {
+        const backend = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
+        const asked = { info: null };
+        const sink = {
+            isAdmin: () => this.deps.isLocalAdmin(who.handle),
+            confirm: info => { asked.info = info; },
+            hint: () => { }, terminal: () => { }, ended: () => { },
+        };
+        const lines = [];
+        const message = await this.deps.start(backend, this.chatFor(who, sink, lines), profile !== undefined ? { profile } : {});
+        if (!asked.info)
+            return { message: message ?? lines.join("\n") };
+        this.sweep();
+        for (const [id, p] of this.pending)
+            if (p.handle === who.handle)
+                this.pending.delete(id); // one question per session
+        const id = randomBytes(16).toString("hex");
+        const entry = { id, backend, ...(profile !== undefined ? { profile } : {}), handle: who.handle, ...asked.info, expiresAt: this.now() + WEB_LOGIN_CONFIRM_TTL_MS };
+        this.pending.set(id, entry);
+        const { handle: _handle, ...confirm } = entry;
+        return { confirm };
+    }
+    /** The go-ahead for a pre-check this session was given; `tunnel` only where it offered a public link. */
+    async begin(who, confirmId, tunnel) {
+        this.sweep();
+        const asked = this.pending.get(confirmId);
+        if (!asked || asked.handle !== who.handle)
+            return { error: "confirm_expired" };
+        if (tunnel && !asked.publicLink)
+            return { error: "tunnel_not_offered" };
+        this.pending.delete(confirmId);
+        const run = {
+            id: randomBytes(16).toString("hex"), seq: ++this.seq, backend: asked.backend, ...(asked.profile !== undefined ? { profile: asked.profile } : {}),
+            handle: who.handle, label: who.label, startedAt: this.now(), phase: "running", ok: null, endedAt: null,
+            hint: null, terminal: null, lines: [], sink: null,
+        };
+        run.sink = {
+            isAdmin: () => this.deps.isLocalAdmin(who.handle),
+            confirm: () => { },
+            hint: (url, code) => { run.hint = { url, code, linkable: linkableLoginUrl(run.backend, url) }; },
+            terminal: info => { run.terminal = { ...info }; },
+            ended: result => {
+                run.phase = "ended";
+                run.ok = result.ok;
+                run.endedAt = this.now();
+                this.live.delete(run);
+                if (!this.live.size)
+                    this.stopWatch();
+                if (this.run === run)
+                    this.changed();
+            },
+        };
+        // Watched from admission, not from publication: a session revoked while its listener, tunnel or cloudflared is
+        // still coming up ends its own attempt (cancelFor) — never one that replaced it.
+        this.live.add(run);
+        this.startWatch();
+        const message = await this.deps.start(asked.backend, this.chatFor(who, run.sink, run.lines), {
+            skipAuthCheck: true, tokenPresent: asked.tokenPresent, ...(tunnel ? { tunnel: true } : {}),
+            ...(asked.profile !== undefined ? { profile: asked.profile } : {}),
+        });
+        const running = run.phase === "running" && this.deps.isActiveFor(run.sink);
+        if (!running && run.phase !== "ended") { // refused: nothing ran
+            this.live.delete(run);
+            if (!this.live.size)
+                this.stopWatch();
+            return { message: message ?? "" };
+        }
+        if (message && !running)
+            pushLine(run.lines, message); // ended while starting: why
+        // A start that took longer than a later one (its listener held, then cancelled) never replaces what that one shows.
+        if (this.run && this.run.seq > run.seq)
+            return running ? { login: this.viewOf(run, who.handle) } : { message: message ?? run.lines.join("\n") };
+        this.run = run;
+        this.changed();
+        if (running) {
+            try {
+                this.deps.notice({ shown: asked.profile ? `${asked.backend} (${asked.profile})` : asked.backend, label: who.label, handle: who.handle });
+            }
+            catch { /* a notice never stops a sign-in */ }
+        }
+        return { login: this.viewOf(run, who.handle) };
+    }
+    /** The current sign-in as this session may see it, or null. */
+    view(viewerHandle) {
+        const run = this.run;
+        if (!run)
+            return null;
+        if (run.phase === "ended" && run.endedAt !== null && this.now() - run.endedAt > WEB_LOGIN_KEEP_ENDED_MS) {
+            this.run = null;
+            return null;
+        }
+        return this.viewOf(run, viewerHandle);
+    }
+    /** Any local admin may stop it (it only takes something away); a chat-started sign-in or install included. */
+    cancel() { return this.deps.cancel(); }
+    dispose() { this.stopWatch(); this.pending.clear(); this.live.clear(); }
+    viewOf(run, viewerHandle) {
+        const mine = run.handle === viewerHandle && this.deps.isLocalAdmin(viewerHandle);
+        const base = {
+            id: run.id, backend: run.backend, ...(run.profile !== undefined ? { profile: run.profile } : {}), phase: run.phase, ok: run.ok,
+            startedOn: run.label, startedAt: run.startedAt, endedAt: run.endedAt, mine,
+        };
+        if (!mine)
+            return base;
+        const running = run.phase === "running" && this.deps.isActiveFor(run.sink);
+        return {
+            ...base, lines: [...run.lines], hint: running ? run.hint : null, terminal: running ? run.terminal : null,
+            accessCode: running && run.terminal ? this.deps.accessToken(run.sink) : null,
+        };
+    }
+    changed() { try {
+        this.deps.changed?.();
+    }
+    catch { /* the pages read it on their own next time */ } }
+    chatFor(who, sink, lines) {
+        // The status lines chat would post (done, recovery, a download notice) — this sign-in's own, shown to its session.
+        const adapter = {
+            type: "web", id: "web",
+            sendText: async (_chatId, text) => { pushLine(lines, text); return { chatId: "web", messageId: randomBytes(6).toString("hex") }; },
+        };
+        return { adapter, adapterId: "web", chatId: "web", userId: `web:${who.handle}`, web: sink };
+    }
+    sweep() {
+        const now = this.now();
+        for (const [id, p] of this.pending)
+            if (p.expiresAt <= now)
+                this.pending.delete(id);
+    }
+    startWatch() {
+        if (this.watch)
+            return;
+        this.watch = setInterval(() => {
+            for (const run of [...this.live]) {
+                if (this.deps.isLocalAdmin(run.handle))
+                    continue;
+                // The session that holds the code is gone (signed out, expired, revoked): its own sign-in goes with it.
+                this.live.delete(run);
+                void this.deps.cancelFor(run.sink).catch(() => false);
+            }
+            if (!this.live.size)
+                this.stopWatch();
+        }, WEB_LOGIN_WATCH_MS);
+        this.watch.unref?.();
+    }
+    stopWatch() {
+        if (this.watch) {
+            clearInterval(this.watch);
+            this.watch = null;
+        }
+    }
+}
+function pushLine(lines, text) {
+    lines.push(text.length > MAX_LINE_CHARS ? `${text.slice(0, MAX_LINE_CHARS - 1)}…` : text);
+    if (lines.length > MAX_LINES)
+        lines.splice(0, lines.length - MAX_LINES);
+}
+//# sourceMappingURL=web-backend-login.js.map

package/dist/web-backend-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-backend-login.js","sourceRoot":"","sources":["../src/web-backend-login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAG9E,6GAA6G;AAC7G,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,MAAM,CAAC;AACnD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,MAAM,CAAC;AACnD,mGAAmG;AACnG,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAgD;IAC3E,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE,CAAC,eAAe,EAAE,aAAa,EAAE,gBAAgB,EAAE,UAAU,CAAC;IAC1E,aAAa,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,YAAY,CAAC;CAC5D,CAAC;AAEF,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,GAAW;IAC3D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACtD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC;AAC1G,CAAC;AAED,uIAAuI;AACvI,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,OAAuB;IAC/E,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC7F,OAAO,CAAC,OAAO,IAAI,2BAA2B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAoGD,MAAM,OAAO,gBAAgB;IAQE;IAPZ,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC9C,GAAG,GAAe,IAAI,CAAC;IAC/B,qHAAqH;IACpG,IAAI,GAAG,IAAI,GAAG,EAAO,CAAC;IAC/B,GAAG,GAAG,CAAC,CAAC;IACR,KAAK,GAA0C,IAAI,CAAC;IAE5D,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;IAAG,CAAC;IAElD,GAAG,KAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAE/D,4GAA4G;IAC5G,KAAK,CAAC,KAAK,CAAC,GAAsB,EAAE,UAAkB,EAAE,OAAgB;QACtE,MAAM,OAAO,GAAG,qBAAqB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC5F,MAAM,KAAK,GAA0F,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACpH,MAAM,IAAI,GAAiB;YACzB,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;YACvC,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;SACpD,CAAC;QACF,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAG,2BAA2B;QACvH,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAY,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,wBAAwB,EAAE,CAAC;QAC3K,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,KAAK,CAAC,GAAsB,EAAE,SAAiB,EAAE,MAAe;QACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;QAC/E,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU;YAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAQ;YACf,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChJ,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI;YACtG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAA+B;SAC7E,CAAC;QACF,GAAG,CAAC,IAAI,GAAG;YACT,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YACjD,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;YACjB,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAChG,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;YACjD,KAAK,EAAE,MAAM,CAAC,EAAE;gBACd,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC;gBAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;gBAAC,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAClE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACtC,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG;oBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,CAAC;SACF,CAAC;QACF,+GAA+G;QAC/G,iFAAiF;QACjF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE;YAC3F,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC,CAAqC,uBAAuB;YAClG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAuB,4BAA4B;QACzG,oHAAoH;QACpH,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChJ,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oCAAoC,CAAC,CAAC;QAClM,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC,YAAoB;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,uBAAuB,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACxC,CAAC;IAED,8GAA8G;IAC9G,MAAM,KAAsB,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAExD,OAAO,KAAW,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEtE,MAAM,CAAC,GAAQ,EAAE,YAAoB;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QACjF,MAAM,IAAI,GAAiB;YACzB,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE;YAC9H,SAAS,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI;SAC3E,CAAC;QACF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3E,OAAO;YACL,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YACxG,UAAU,EAAE,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SAC7E,CAAC;IACJ,CAAC;IAEO,OAAO,KAAW,IAAI,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,8CAA8C,CAAC,CAAC,CAAC,CAAC;IAE3G,OAAO,CAAC,GAAsB,EAAE,IAAkB,EAAE,KAAe;QACzE,mHAAmH;QACnH,MAAM,OAAO,GAAG;YACd,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK;YACtB,QAAQ,EAAE,KAAK,EAAE,OAAe,EAAE,IAAY,EAAE,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;SACtH,CAAC;QAC/B,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9F,CAAC;IAEO,KAAK;QACX,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,SAAS;gBACjD,wGAAwG;gBACxG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,KAAK,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACxC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAAC,CAAC;IACnE,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAe,EAAE,IAAY;IAC7C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;QAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAC1E,CAAC"}

package/dist/web-chat-history.d.ts

@@ -95,7 +95,33 @@ export interface WebChatMessage {
      * across a restart is still sent it.
      */
     seenSeq?: number;
+    /**
+     * #2272: the message a person's message replies to — its row (`boot`, `id`) and what the bubble quotes: who wrote it
+     * and its first words, taken by the server from that row when the reply was sent (never from the page). `media`: a
+     * row with files and no text. A person's messages only.
+     */
+    replyTo?: WebChatReplyRef;
 }
+/** #2272: a reply's reference to an earlier message of the same chat (see WebChatMessage.replyTo). */
+export interface WebChatReplyRef {
+    boot: string;
+    id: number;
+    sender: string;
+    text: string;
+    media?: "photo" | "document";
+}
+/** #2272: how much of the quoted message a reply keeps for its bubble (the agent's `reply_to` is longer). */
+export declare const WEB_CHAT_REPLY_SNIPPET_MAX = 160;
+/** #2272: the agent's `(reply_to: "…")` — at most this many characters of the quoted message. */
+export declare const WEB_CHAT_REPLY_TEXT_MAX = 500;
+/** #2272: what a reply quotes from a row: its sender, its first words on one line (a click's label), its files' kind. */
+export declare function webChatReplyRef(row: WebChatMessage): WebChatReplyRef;
+/**
+ * #2272: the quoted message as the agent gets it — `(reply_to: "…")`, like a Discord or Telegram reply: one line (a
+ * newline in it could start a line that reads as another header), its double quotes made typographic so the quote
+ * cannot end early, at most WEB_CHAT_REPLY_TEXT_MAX characters; a message of files only names them.
+ */
+export declare function webChatReplyText(row: WebChatMessage): string;
 export declare function webChatFrom(adapterId: unknown, userId: unknown): string | undefined;
 export interface WebChatClick {
     label: string;
@@ -143,6 +169,8 @@ export interface StoredWebChatMessage {
     from?: string;
     /** #1920: when, in its boot's id sequence, it became the channel's (see WebChatMessage). */
     seenSeq?: number;
+    /** #2272: what a person's reply quotes (see WebChatMessage). */
+    replyTo?: WebChatReplyRef;
 }
 /** #1565: what the history needs of the file ledger (web-upload.ts). */
 export interface WebChatFiles {
@@ -240,6 +268,7 @@ export declare class WebChatHistory {
         links?: unknown;
         channel?: unknown;
         from?: unknown;
+        replyTo?: unknown;
     }): WebChatMessage;
     /** Host-only producer seam. Generic records cannot promote sender/role strings into a Try action. */
     recordEffectTrial(instance: string, offer: unknown, ts: string): WebChatMessage | null;
@@ -263,6 +292,8 @@ export declare class WebChatHistory {
         id: number;
     } | null): WebChatMessage[];
     /** #1920: a kept message by the `message_id` the agent was given (a web message, a web click). */
+    /** #2272: one kept message of an instance's chat by its row (`boot`, `id`), or undefined (never sent, or no longer kept). */
+    find(instance: string, boot: string, id: number): WebChatMessage | undefined;
     findByMessageId(instance: string, messageId: string): WebChatMessage | undefined;
     /** #1920: a kept reply by its buttons' set id. */
     findByButtons(instance: string, buttonsId: string): WebChatMessage | undefined;

package/dist/web-chat-history.js

@@ -67,6 +67,42 @@ function webChatButtons(raw) {
         ...(state === "chosen" && typeof b.by === "string" ? { by: b.by.slice(0, 64) } : {}),
     };
 }
+/** #2272: how much of the quoted message a reply keeps for its bubble (the agent's `reply_to` is longer). */
+export const WEB_CHAT_REPLY_SNIPPET_MAX = 160;
+/** #2272: the agent's `(reply_to: "…")` — at most this many characters of the quoted message. */
+export const WEB_CHAT_REPLY_TEXT_MAX = 500;
+const BOOT_RE = /^[0-9a-f]{1,32}$/;
+/** One line: runs of whitespace (newlines too) become one space. */
+const oneLine = (s) => s.replace(/\s+/g, " ").trim();
+const cut = (s, max) => (s.length > max ? `${s.slice(0, max - 1).trimEnd()}…` : s);
+/** #2272: what a reply quotes from a row: its sender, its first words on one line (a click's label), its files' kind. */
+export function webChatReplyRef(row) {
+    const words = oneLine(row.click?.label ?? row.text);
+    const media = !words && row.attachments?.length ? (row.attachments.some(a => a.kind === "photo") ? "photo" : "document") : undefined;
+    return { boot: row.boot, id: row.id, sender: row.sender.slice(0, 256), text: cut(words, WEB_CHAT_REPLY_SNIPPET_MAX), ...(media ? { media } : {}) };
+}
+/**
+ * #2272: the quoted message as the agent gets it — `(reply_to: "…")`, like a Discord or Telegram reply: one line (a
+ * newline in it could start a line that reads as another header), its double quotes made typographic so the quote
+ * cannot end early, at most WEB_CHAT_REPLY_TEXT_MAX characters; a message of files only names them.
+ */
+export function webChatReplyText(row) {
+    const words = oneLine(row.click?.label ?? row.text);
+    const files = (row.attachments ?? []).map(a => `[${a.kind === "photo" ? "photo" : "file"}: ${oneLine(a.name)}]`).join(" ");
+    return cut((words || files).replace(/"/g, "\u201d"), WEB_CHAT_REPLY_TEXT_MAX);
+}
+/** A stored or sent reply reference, checked field by field (one that fails is dropped, never repaired). */
+function webChatReplyRefOf(raw) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return undefined;
+    const r = raw;
+    if (typeof r.boot !== "string" || !BOOT_RE.test(r.boot) || typeof r.id !== "number" || !Number.isSafeInteger(r.id) || r.id < 1)
+        return undefined;
+    if (typeof r.sender !== "string" || typeof r.text !== "string")
+        return undefined;
+    const media = r.media === "photo" || r.media === "document" ? r.media : undefined;
+    return { boot: r.boot, id: r.id, sender: r.sender.slice(0, 256), text: cut(oneLine(r.text), WEB_CHAT_REPLY_SNIPPET_MAX), ...(media ? { media } : {}) };
+}
 /** #1920: an account as a row names it — the connection id and the user id, one line. */
 const FROM = /^[^\s:]{1,64}:[^\s:]{1,128}$/;
 export function webChatFrom(adapterId, userId) {
@@ -129,7 +165,8 @@ export class WebChatHistory {
     /** #1565: a message as kept on disk: no buttons, no delivery, no message id; a file with the path it is served from. */
     stored(m) {
         const row = { boot: m.boot, id: m.id, instance: m.instance, role: m.role, sender: m.sender, text: m.text, ts: m.ts, ...(m.click ? { click: { label: m.click.label } } : {}), ...(m.links ? { links: m.links } : {}),
-            ...(m.channel ? { channel: true } : {}), ...(m.from ? { from: m.from } : {}), ...(m.channel && m.seenSeq !== undefined ? { seenSeq: m.seenSeq } : {}) };
+            ...(m.channel ? { channel: true } : {}), ...(m.from ? { from: m.from } : {}), ...(m.channel && m.seenSeq !== undefined ? { seenSeq: m.seenSeq } : {}),
+            ...(m.replyTo ? { replyTo: m.replyTo } : {}) };
         if (m.attachments?.length) {
             row.attachments = m.attachments.map((a) => {
                 const base = { kind: a.kind, name: a.name, size: a.size, mime: a.mime };
@@ -279,6 +316,10 @@ export class WebChatHistory {
             entry.channel = true;
         if (entry.role === "user" && typeof msg.from === "string" && FROM.test(msg.from))
             entry.from = msg.from;
+        // #2272: only a person's message replies to another.
+        const replyTo = entry.role === "user" ? webChatReplyRefOf(msg.replyTo) : undefined;
+        if (replyTo)
+            entry.replyTo = replyTo;
         let slot = this.byInstance.get(entry.instance);
         if (!slot) {
             slot = { messages: [], chars: 0 };
@@ -346,6 +387,10 @@ export class WebChatHistory {
         return this.collect((m) => m.boot === cursor.boot && m.seenSeq !== undefined && m.seenSeq > cursor.id);
     }
     /** #1920: a kept message by the `message_id` the agent was given (a web message, a web click). */
+    /** #2272: one kept message of an instance's chat by its row (`boot`, `id`), or undefined (never sent, or no longer kept). */
+    find(instance, boot, id) {
+        return this.byInstance.get(instance)?.messages.find(m => m.boot === boot && m.id === id);
+    }
     findByMessageId(instance, messageId) {
         const messages = this.byInstance.get(instance)?.messages ?? [];
         for (let i = messages.length - 1; i >= 0; i--)
@@ -538,6 +583,9 @@ function restoredRow(raw, instance, thisBoot) {
         message.from = r.from;
     if (message.channel && typeof r.seenSeq === "number" && Number.isSafeInteger(r.seenSeq) && r.seenSeq > r.id)
         message.seenSeq = r.seenSeq;
+    const replyTo = role === "user" ? webChatReplyRefOf(r.replyTo) : undefined;
+    if (replyTo)
+        message.replyTo = replyTo;
     const files = !Array.isArray(r.attachments) ? [] : r.attachments.slice(0, 20).flatMap((a) => {
         if (!a || typeof a !== "object" || Array.isArray(a))
             return [];