@wix/himalaya-cli 0.940.0 → 0.941.0

package/templates/beauty-salon-owner/tier5-src/_shared/aria-chat.ts

@@ -2,8 +2,9 @@
 //
 // Aria is a REAL Wix product surface (the Genie chat-service behind the Owner
 // app's Aria tab), so every app that mounts it wants the same conversation
-// machine: greet, send optimistically, wait for the agent, normalize the reply,
-// surface its action links, and remember the conversation. Only the trimmings
+// machine: greet, send optimistically, wait for the agent, abandon that wait
+// when the owner has heard enough, normalize the reply, surface its action
+// links, and remember the conversation. Only the trimmings
 // differ per app — the service NAME (which `$service:` paths and `_poll.action`
 // are built from), the greeting copy, the suggested prompts, how a link opens,
 // and the storage namespace.
@@ -26,6 +27,7 @@
 import { navigate, type NavDirective, type PollDirective } from "@himalaya/state";
 import {
   ARIA_ORIGIN,
+  abortAssistantMessageGeneration,
   ariaAssistantConfig,
   conversationIdOf,
   createConversation,
@@ -35,10 +37,11 @@ import {
   messagesOf,
   sendMessage,
   triggerAssistantMessage,
+  userMessageIdOf,
   type ConversationMessage,
   type ConversationSummary,
 } from "@himalaya/wix-genie-chat";
-import { proseOfParts, scanEnvelopes } from "./aria-widgets.js";
+import { proseOfParts, scanEnvelopes, stripHidden } from "./aria-widgets.js";
 
 // ---------------------------------------------------------------------------
 // Shapes
@@ -105,10 +108,37 @@ export interface AriaChatState {
    *  stores those words under any normalisation this client cannot match left
    *  "Aria is typing…" on screen forever, beside the answer. */
   _replyAfter: number;
+  /** The id the CURRENT turn's user message was stored under, when the service
+   *  named one.
+   *
+   *  The turn is over when an assistant message sits AFTER this one in the
+   *  transcript — which is exact, where a count is not. Counting says "the
+   *  server holds more assistant turns than it did when we sent", and that is
+   *  satisfiable by an answer to a DIFFERENT turn: stop a turn, let the agent
+   *  finish writing anyway, send again before a tick observes it, and the old
+   *  answer ends the new turn. Ending a turn early clears the typing line and
+   *  hides Stop while the agent is still writing.
+   *
+   *  Empty when the service named no id, and the count rule is the fallback —
+   *  the same rule, with the same imprecision, that applied before. */
+  _turnId: string;
   /** The last counts actually observed from the server, so the two marks above
    *  can be taken at send time without an extra round trip. */
   _srvUsers: number;
   _srvAssistants: number;
+  /** The id of the user turn whose reply is being generated — the ONLY handle
+   *  the abort route accepts. It arrives with the send response and there is no
+   *  route that looks it up afterwards, so a turn whose send did not name one
+   *  simply cannot be stopped. Empty whenever nothing is abortable. */
+  _abortId: string;
+  /** Gate for the descriptor's Stop control, in the polarity the renderers want
+   *  (a `hiddenPath` HIDES when true). Derived from the turn state after every
+   *  action rather than maintained by each one — see `gated`.
+   *
+   *  True unless a reply is outstanding AND we hold the handle to abort it: a
+   *  Stop that cannot stop anything is worse than no Stop, because the owner
+   *  taps it, the answer arrives anyway, and the control is what they blame. */
+  stopHidden: boolean;
   /** Intentionally never true: a `form` submit that returns `ok` makes the host
    *  POP the screen. A chat composer must stay put, so the whole surface leaves
    *  this false and the bound message list simply re-renders. */
@@ -155,6 +185,9 @@ export interface AriaChatLabels {
   typing?: Resolvable<string>;
   /** Status line when the wait ran out without a reply. */
   slow?: Resolvable<string>;
+  /** Status line after the owner stopped a reply. Sits in the NEUTRAL slot:
+   *  they asked for it, so nothing went wrong. */
+  stopped?: Resolvable<string>;
   /** Shown instead of a raw transport error when this HOST cannot reach Wix at
    *  all — it carries no Wix app binding to sign the chat-service call with.
    *  See `isWixAccountUnreachable`, and note what it is NOT: a signed-out user. */
@@ -442,7 +475,11 @@ export function toBubbles(msgs: ConversationMessage[], assistantName: string, yo
       const role = m.role || "ASSISTANT";
       // Only assistant turns carry envelopes; a user's own text is literal, and
       // scanning it would let an owner who typed `<<…>>` erase their own message.
-      const prose = role === "USER" ? raw : proseOfParts(scanEnvelopes(raw, 0, true).parts);
+      // HIDDEN spans go first: the service marks text as transcript-only that
+      // way, and an aborted turn consists of nothing else. Then envelopes, then
+      // the markdown stripper — each stage handing on only what a reader should
+      // actually see.
+      const prose = role === "USER" ? raw : proseOfParts(scanEnvelopes(stripHidden(raw), 0, true).parts);
       return {
         id: m.id || `m${i}`,
         role,
@@ -508,6 +545,51 @@ export function countRole(bubbles: AriaBubble[], role: string): number {
   return n;
 }
 
+/** Has the turn stored under `turnId` been answered?
+ *
+ *  EXACT, where counting is not. The count rule — "the server holds more
+ *  assistant turns than it did when we sent" — is satisfiable by an answer to a
+ *  DIFFERENT turn, and Stop is what makes that reachable: abort a turn, let the
+ *  agent finish writing it anyway, send again before a tick has observed the
+ *  late answer, and that answer ends the NEW turn. The typing line clears and
+ *  Stop disappears while the agent is still writing.
+ *
+ *  Position in the transcript is what settles it: an answer to this turn comes
+ *  after this turn. An empty `turnId` — a service that named none — falls back
+ *  to the caller's count rule, which is exactly what applied before. */
+/** The assistant text that is actually ADDRESSED TO THE OWNER.
+ *
+ *  `<HIDDEN>…</HIDDEN>` is how the service leaves notes for itself — including
+ *  the note it replaces an aborted turn with — and `toBubbles` strips it, so a
+ *  row made only of it paints nothing. Judging "did the turn get an answer?" on
+ *  the RAW text therefore ends the turn on a row the owner never sees: after a
+ *  Stop it erases the "Stopped." line, and mid-turn it clears the typing line and
+ *  hides Stop while the agent is still writing.
+ *
+ *  A widget envelope (`<<{"widget":…}>>`) is deliberately NOT stripped here. That
+ *  IS an answer with nothing to say in prose — the case `countTurns` counts raw
+ *  messages for in the first place — so it must keep reading as non-empty. */
+function answerText(m: ConversationMessage): string {
+  return stripHidden(messageText(m)).trim();
+}
+
+export function repliedTo(msgs: ConversationMessage[], turnId: string): boolean | null {
+  if (!turnId) return null;
+  const at = msgs.findIndex((m) => m.id === turnId);
+  // NOT FOUND is "cannot attribute", not "not answered". A service is free to
+  // normalise, truncate or simply not keep the owner's turn, and one that drops
+  // it would otherwise leave the answer on screen under a permanent "Aria is
+  // typing…" with no recovery but leaving the screen — which is the exact defect
+  // the count rule was introduced to fix. So: fall back to it.
+  if (at < 0) return null;
+  for (let i = at + 1; i < msgs.length; i++) {
+    const m = msgs[i];
+    if ((m.role || "ASSISTANT") !== "ASSISTANT") continue;
+    if (answerText(m)) return true;
+  }
+  return false;
+}
+
 /** How many turns of one role the SERVER holds — the mark the turn is judged
  *  against. Counted over RAW messages, gated on the raw text being non-empty.
  *
@@ -531,7 +613,9 @@ export function countTurns(msgs: ConversationMessage[], role: string): number {
   let n = 0;
   for (const m of msgs) {
     if ((m.role || "ASSISTANT") !== role) continue;
-    if (messageText(m).trim()) n++;
+    // USER rows carry no HIDDEN notes, so `answerText` is a no-op on them and
+    // the two roles stay counted by one rule.
+    if (answerText(m)) n++;
   }
   return n;
 }
@@ -585,7 +669,7 @@ export function turnAnswered(msgs: ConversationMessage[], userMessageId: string)
     // exactly these two, and the two scanners read the same transcript: if they
     // disagree, one of them ends the turn while the other leaves the ladder
     // running at the fast cadence.
-    if (role === "ASSISTANT" && messageText(m).trim()) return true;
+    if (role === "ASSISTANT" && answerText(m)) return true;
   }
   return false;
 }
@@ -666,8 +750,21 @@ export interface AriaChatCore {
    *  draft never reaches the worker cannot be emptied on send — the owner's
    *  sent message just sits there, one tap away from being sent twice. */
   typing(s: AriaChatState, arg?: AriaActionArg): AriaChatState;
-  tick(s: AriaChatState): Promise<AriaChatState>;
+  /** Resolves to the next state, or `undefined` to leave the state UNTOUCHED. A
+   *  tick whose transcript read predates a turn boundary (a Stop, a fresh send,
+   *  or a new chat) must not write its snapshot back — the runtime merges a
+   *  returned object over the CURRENT state, so writing a stale in-progress
+   *  snapshot would resurrect or clobber the turn that boundary just changed.
+   *  `undefined` SPECIFICALLY — not `null`, not `false`. Only `undefined` is
+   *  read as "no opinion" by every host; the web host assigns anything else it
+   *  is handed, so `return null` would store `null` as the service state. */
+  tick(s: AriaChatState): Promise<AriaChatState | undefined>;
   openLink(s: AriaChatState, arg?: AriaActionArg): Promise<AriaChatState>;
+  /** Abandon the reply being generated for the turn in flight. Resolves to
+   *  `undefined` to leave the state UNTOUCHED, on `tick`'s terms: a boundary
+   *  that moved during the abort makes this snapshot stale, and committing it
+   *  would end a turn the owner has since started. */
+  stop(s: AriaChatState): Promise<AriaChatState | undefined>;
 }
 
 const POLL_ID = "aria-turn";
@@ -687,6 +784,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   const you = () => res(o.labels?.you ?? "You");
   const typingText = () => res(o.labels?.typing ?? `${assistant()} is typing…`);
   const slowText = () => res(o.labels?.slow ?? `${assistant()} is taking a while…`);
+  const stoppedText = () => res(o.labels?.stopped ?? "Stopped.");
   // States the fact and stops. It deliberately gives no instruction, because
   // there is none the owner could follow: they are signed in, and the thing that
   // is missing is the app's own Wix binding. "Here" is doing real work — it says
@@ -703,7 +801,8 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   const initialState: AriaChatState = {
     status: "loading", statusText: "", error: "", input: "",
     messages: [], prompts: [], _convId: "", _siteId: "", _pending: "",
-    _pendingAfter: 0, _replyAfter: 0, _srvUsers: 0, _srvAssistants: 0, ok: false,
+    _pendingAfter: 0, _replyAfter: 0, _srvUsers: 0, _srvAssistants: 0,
+    _abortId: "", _turnId: "", stopHidden: true, ok: false,
   };
 
   /** One create at a time, per site.
@@ -759,6 +858,63 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
    *  `turnAnswered` — rather than anything inferred from local counts. */
   let stalledTurn: { convId: string; content: string; userMessageId: string } | null = null;
 
+  /** A monotonic turn epoch, bumped by every TURN BOUNDARY: a successful `stop`,
+   *  the start of a `send`, and a `newChat`.
+   *
+   *  A latch for the same reason `inFlightSend` is one: reducers are pure
+   *  functions of the state handed to them, so a `tick` that is already awaiting
+   *  `getConversationMessages` when the turn changes underneath it holds a
+   *  snapshot from BEFORE that change. The action cannot see that from its own
+   *  argument; this counter is the only place the overlap is visible.
+   *
+   *  It is not enough to bump on `stop` alone. A Stop followed by a fresh send
+   *  starts a NEW turn, and the parked tick — still carrying the old turn's
+   *  snapshot — would then clear the new turn's pending mark and Stop control,
+   *  leaving it running with nothing to stop it. Bumping on the send too makes
+   *  the parked tick recognise it is stale and stand down. */
+  let turnSeq = 0;
+
+  /** Turn epochs with an abort in the air, and how many. Covers the window
+   *  `turnSeq` cannot: `stop` bumps the epoch only AFTER the service accepts
+   *  the abort (a refused one leaves the turn running), so a tick resolving
+   *  during the request passes the epoch check, is applied, and is then
+   *  overwritten by `stop`'s pre-await snapshot — an answer the service already
+   *  wrote vanishing under "Stopped." until the next slow poll.
+   *
+   *  Discarding such a tick is free: `tick` rebuilds wholesale, so the next one
+   *  re-reads it in full, on both the accepted and the refused outcome.
+   *
+   *  Keyed by EPOCH, not counted flat: a flat counter also fenced ticks of a
+   *  turn started after the Stop — which submit deliberately allows — stalling
+   *  the new turn until the old abort settled. Staleness is relative to the
+   *  aborted turn alone. A multiset because nothing serialises two overlapping
+   *  stops on one epoch. */
+  const abortingEpochs = new Map<number, number>();
+
+  /** The composer's draft, and a count of edits to it.
+   *
+   *  `typing` is not a turn boundary, so `turnSeq` never covered it: an owner
+   *  drafting while `stop`'s abort was in flight had it overwritten by the
+   *  pre-await snapshot. Returning only the fields `stop` owns is the obvious
+   *  fix and is WRONG on this platform — a reducer must return a whole state,
+   *  because the hosts disagree about what a patch means. That is general
+   *  Tier-5 knowledge rather than Aria's, so it lives in the tier-5 guide
+   *  (`himi docs tier-5-add-a-screen`, "A reducer must return a WHOLE state").
+   *
+   *  The counter is what keeps `withDraft` honest — see it for why. */
+  let draft = "";
+  let draftSeq = 0;
+
+  /** Raise the fence for one abort of `seq`; returns the lowering half. */
+  const fenceEpoch = (seq: number): (() => void) => {
+    abortingEpochs.set(seq, (abortingEpochs.get(seq) ?? 0) + 1);
+    return () => {
+      const left = (abortingEpochs.get(seq) ?? 1) - 1;
+      if (left > 0) abortingEpochs.set(seq, left);
+      else abortingEpochs.delete(seq);
+    };
+  };
+
   /** Refuse a send that is already on its way. State half + latch half. */
   const duplicate = (s: AriaChatState, content: string): boolean =>
     isDuplicateSend(s, content) || inFlightSend === content;
@@ -826,7 +982,7 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // widget-only reply is, even though it leaves no bubble to inspect. Asking
       // the last BUBBLE stalled this loop on exactly that reply, the same way it
       // stalled `tick`.
-      if (countTurns(raw, "ASSISTANT") > s._replyAfter) {
+      if (repliedTo(raw, s._turnId) ?? countTurns(raw, "ASSISTANT") > s._replyAfter) {
         return { ...s, status: "ready", _convId: convId, messages: bubbles, prompts: [], input: "", statusText: "", error: "", _pending: "", ...observed(raw), ok: false };
       }
     }
@@ -834,12 +990,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
   }
 
   /** Send + wait, by whichever transport this consumer configured. */
+  /** Re-apply the composer's draft to a state built from a pre-await snapshot,
+   *  but ONLY when the owner typed during that await (`since` is the counter
+   *  read before it).
+   *
+   *  Re-applying whenever the latch merely DIFFERS is wrong twice over: the
+   *  latch still holds the text of the message just sent, so a Stop moments
+   *  after a send would put it back in the composer ready to send twice; and
+   *  it would make every one of the five places that deliberately set
+   *  `input: ""` responsible for clearing a latch. */
+  const withDraft = (next: AriaChatState, since: number): AriaChatState =>
+    draftSeq === since || draft === next.input ? next : { ...next, input: draft };
+
   async function send(s: AriaChatState, content: string): Promise<AriaChatState> {
+    // A new turn is a turn boundary: any tick still parked on the PREVIOUS
+    // turn's transcript read must stand down rather than write its snapshot over
+    // this one. Bump before the first await so an in-flight tick is already stale
+    // by the time it resolves.
+    turnSeq += 1;
     // Optimistic first: the owner's message and the typing line are part of the
     // state this action RETURNS, so on the `_poll` path they paint immediately.
     const optimistic: AriaBubble[] = [...s.messages, plainBubble(`u${s.messages.length}`, "USER", you(), content)];
     const base: AriaChatState = {
       ...s, prompts: [], input: "", error: "",
+      // The PREVIOUS turn's handles must not survive into this one: aborting by
+      // a stale id would abandon a reply that has already been read, and waiting
+      // on a stale turn id would look for an answer that already exists. Both
+      // are replaced the moment this send knows its own id.
+      _abortId: "", _turnId: "",
       statusText: typingText(), messages: optimistic, _pending: content,
       // Mark the turn against the LAST COUNTS WE SAW, not against our own
       // message list — the greeting is a local bubble the server never had, so
@@ -913,12 +1091,34 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
           if (turnAnswered(seen, stalled.userMessageId)) stalled = null;
         } catch { /* unknown — keep the latch, see above */ }
       }
+      // The id the turn is STORED under is the only thing the abort route
+      // accepts, and no route hands it back afterwards — so it has to be
+      // captured as the turn is sent, even though everything else about the turn
+      // is read back off the transcript. A service that names none leaves this
+      // turn unstoppable, which `gated` renders as an ABSENT control rather than
+      // a dead one.
+      //
+      // The retry path needs no send to learn it: holding that id is what
+      // `stalledTurn` IS. So a turn recovered from a failed trigger is just as
+      // stoppable as one sent cleanly.
+      let abortId: string;
       if (stalled) {
         retriedId = stalled.userMessageId;
+        abortId = stalled.userMessageId;
         await triggerAssistantMessage(convId, stalled.userMessageId, { origin });
       } else {
-        await sendMessage(convId, content, { origin });
+        abortId = userMessageIdOf(await sendMessage(convId, content, { origin }));
       }
+      // A SECOND boundary bump, and the load-bearing one. The bump at entry only
+      // retires a tick that was already parked when the owner tapped Send. A tick
+      // dispatched DURING the two round trips above read the post-bump epoch, so
+      // it matches, and it is carrying the PRE-send snapshot — it would resolve
+      // after this send commits and put `status: "ready"`, an empty `_pending`
+      // and an empty `_abortId` back, taking the typing line and the Stop control
+      // with them while the reply is still being generated. That is the very
+      // clobber the epoch exists to prevent, one window over. `stop` bumps after
+      // its await for this reason; so must this.
+      turnSeq += 1;
       // Delivered — whatever was stalled is answered or superseded.
       //
       // `retriedId` is cleared with it, and that is not redundant: the legacy
@@ -952,9 +1152,15 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       // first reply would never read as new — the same stranded "typing…" this
       // turn-marking exists to prevent. Reachable when the owner switches
       // business and sends without the screen reloading in between.
-      const sent: AriaChatState = created
+      const marked: AriaChatState = created
         ? { ...base, _pendingAfter: 0, _replyAfter: 0, _srvUsers: 0, _srvAssistants: 0 }
         : base;
+      // `_turnId` and `_abortId` are the same id and NOT the same field.
+      // `_abortId` is "can this still be stopped" and a successful stop clears
+      // it; `_turnId` is "which turn are we waiting on" and has to outlive that,
+      // because that is what tells a late answer to the STOPPED turn apart from
+      // the answer to this one.
+      const sent: AriaChatState = { ...marked, _abortId: abortId, _turnId: abortId };
       inFlightSend = null;
       if (o.poll) {
         // Return NOW. The host owns the clock from here; `tick` merges the
@@ -965,6 +1171,10 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       return busyLoop({ ...sent, _convId: convId, _siteId: site }, convId, optimistic);
     } catch (e) {
       inFlightSend = null;
+      // The same second bump as the success path, for the same reason: a tick
+      // dispatched during the awaits above is carrying the pre-send snapshot, and
+      // this failure state is just as much a commit as a delivered turn.
+      turnSeq += 1;
       // A send that failed AFTER the turn was stored hands back the id it stored
       // under. Remember it, so the owner tapping Send again triggers that turn
       // instead of posting their message a second time. Any other failure clears
@@ -1008,7 +1218,23 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     }
   }
 
-  return {
+  /** Is a reply outstanding right now? True from the moment `send` returns its
+   *  optimistic state until the transcript holds the answer (or the owner stops
+   *  waiting). Read from the state alone — a poll tick and a tap both arrive as
+   *  ordinary reducer calls, with nothing else in scope to ask. */
+  const turnInFlight = (s: AriaChatState): boolean => s.status === "sending" || !!s._pending;
+
+  /** Recompute the Stop gate from the turn state. Applied to the result of every
+   *  action rather than maintained inside each of them: `stopHidden` is a pure
+   *  function of two other fields, and eight reducers each remembering to set it
+   *  is eight chances for the control to be shown when there is nothing to stop
+   *  — or, worse, hidden while a reply the owner wants to abandon runs on. */
+  const gated = (s: AriaChatState): AriaChatState => {
+    const hidden = !(turnInFlight(s) && !!s._abortId);
+    return s.stopHidden === hidden ? s : { ...s, stopHidden: hidden };
+  };
+
+  const impl: AriaChatCore = {
     initialState,
 
     load: async (s) => {
@@ -1076,6 +1302,11 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
 
     typing: (s, arg) => {
       const next = typeof arg === "string" ? arg : (arg?.value ?? arg?.text ?? arg?.message ?? "");
+      // Recorded even when the value is unchanged, because the counter is about
+      // "did an edit happen", and a keystroke that retypes the same character
+      // still happened.
+      draft = next;
+      draftSeq += 1;
       return next === s.input ? s : { ...s, input: next };
     },
 
@@ -1099,6 +1330,9 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
 
     newChat: async (s) => {
       const site = siteOf();
+      // A fresh conversation is a turn boundary too: a tick parked on the OLD
+      // conversation's transcript must not reconcile it over the new greeting.
+      turnSeq += 1;
       // ➕ can land mid-turn, and it abandons that turn: `status` goes back to
       // `ready`, so `tick`'s `wasFast` is false from here on and the FAST
       // ladder the send armed would never be slowed again. A worker cannot
@@ -1111,11 +1345,19 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // NOT `createOnce`: ➕ means "give me a different conversation", so it
         // must never be handed an in-flight one that another caller started.
         const res = await createConversation(assistantConfig, origin);
+        // Bump again now the new conversation exists. The bump above only
+        // retires a tick parked before ➕ was tapped; one dispatched DURING the
+        // create matched the epoch and still holds the OLD conversation's view,
+        // so it would resolve after this and merge `_convId`, the old transcript
+        // and the old observed counts back — the fresh chat snapping back to the
+        // previous one, which reads as ➕ having done nothing.
+        turnSeq += 1;
         return slow({ ...s, status: "ready", _convId: conversationIdOf(res), _siteId: site, input: "", statusText: "", error: "",
-          _pending: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
+          _pending: "", _abortId: "", _turnId: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
       } catch (e) {
+        turnSeq += 1;   // see above — a failed create commits state too
         return slow({ ...s, status: "ready", _convId: "", _siteId: site, input: "", ...failureSlots(e, unavailableText),
-          _pending: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
+          _pending: "", _abortId: "", _turnId: "", messages: greetingOnly(), ...observed([]), prompts: promptList(), ok: false });
       }
     },
 
@@ -1126,14 +1368,38 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
     tick: async (s) => {
       if (!o.poll || !s._convId) return s;
       const wasFast = s.status === "sending";
+      // Read BEFORE the await, compared after: see `turnSeq`.
+      const seq = turnSeq;
       try {
         const gm = await getConversationMessages(s._convId);
         const raw = messagesOf(gm);
+        // A turn boundary crossed while this read was in flight — a Stop, a fresh
+        // send, or a new chat. This tick's ENTIRE view is stale: `s` is the
+        // pre-boundary snapshot, and the runtime would merge whatever we return
+        // over the CURRENT (post-boundary) state. Writing back would either
+        // resurrect the turn the owner just stopped, or clobber the new turn a
+        // send just started — clearing its pending mark and Stop control and
+        // leaving it running with nothing to stop it. Stand down entirely: a
+        // `undefined` return is a no-op (and only `undefined` — see the type),
+        // the post-boundary state stands, and the
+        // next tick (under the new epoch) reconciles the transcript cleanly.
+        //
+        // This guard sits BEFORE every other return in the block on purpose. The
+        // empty-transcript bail below (`return s`) and the reconciled write both
+        // hand `s` back to the runtime, so each is a stale snapshot the instant a
+        // boundary has moved on — guarding only the reconciled write, as this did
+        // originally, still let a boundary-crossing tick that read an empty
+        // transcript clobber the new turn.
+        // An abort is in the air FOR THIS EPOCH (see `abortingEpochs`), so
+        // `stop` holds a snapshot predating this read and will overwrite
+        // whatever we write. A tick of a NEWER epoch is not stale, not fenced.
+        if (turnSeq !== seq || abortingEpochs.has(seq)) return undefined;
         const server = toBubbles(raw, assistant(), you());
         // A transcript that renders to nothing is not necessarily an empty one:
         // a reply made entirely of widgets leaves no bubble behind. So the bail
         // is on the RAW transcript — bailing on the bubbles is what let such a
-        // reply go unnoticed and pinned the ladder fast forever.
+        // reply go unnoticed and pinned the ladder fast forever. Safe to return
+        // `s` here: the guard above proved this tick is still current.
         if (!raw.length) return s;
         const { messages, pending } = reconcile(server, s._pending, s._pendingAfter, you());
         // …but still never PAINT nothing over something. `messages` is only
@@ -1146,7 +1412,8 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // own words came back is a rendering detail, not the answer arriving.
         // Counted over RAW messages, so a widget-only answer still ends the turn
         // instead of pinning the ladder to its fast rung forever (`countTurns`).
-        const replied = countTurns(raw, "ASSISTANT") > s._replyAfter;
+        // Exact when the service named the turn, counted when it did not.
+        const replied = repliedTo(raw, s._turnId) ?? countTurns(raw, "ASSISTANT") > s._replyAfter;
         const next: AriaChatState = {
           ...s,
           status: replied ? "ready" : s.status,
@@ -1159,6 +1426,12 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
         // Slow the ladder the moment the turn is over; leave it alone otherwise.
         return replied && wasFast ? cadence(next, o.poll.idleMs, o.poll.fastMs) : next;
       } catch {
+        // A read that THREW is exactly as stale as one that resolved: if a turn
+        // boundary moved on while it was in flight, returning `s` merges the
+        // pre-boundary snapshot over the current turn — the same clobber the
+        // guard above prevents on the success path. Only a still-current tick
+        // may hold the ladder up by keeping the state as it is.
+        if (turnSeq !== seq || abortingEpochs.has(seq)) return undefined;
         return s;
       }
     },
@@ -1174,6 +1447,84 @@ export function createAriaChat(o: AriaChatOptions): AriaChatCore {
       if (o.openLink) { try { await o.openLink(url); } catch { /* best-effort */ } }
       return s;
     },
+
+    // Abandon the reply being generated. Three things happen, and only the first
+    // is a network call:
+    //
+    //  1. The service is told to stop generating, addressed by the id of the
+    //     user turn that asked. That is the whole of the server-side effect —
+    //     there is no "cancel" for a request already in the air.
+    //  2. The ladder is re-armed SLOW. A worker cannot cancel a poll, so a turn
+    //     that ends early has to be slowed the same way `newChat` slows one it
+    //     interrupted; without this the screen keeps polling at the fast rate
+    //     for as long as it stays open.
+    //  3. The transcript is left ALONE. What the owner stopped is the waiting,
+    //     not the conversation: their own message was persisted and stays, and
+    //     if the service had already finished the answer it lands on the next
+    //     tick and is shown. Hiding a reply the service actually produced would
+    //     make the transcript disagree with the server for the rest of the
+    //     conversation — and the next `tick`, which rebuilds wholesale, would
+    //     bring it back anyway.
+    //
+    // A REFUSED abort leaves the turn exactly as it was — status, pending mark
+    // and fast ladder intact — with the reason in the error slot. Reporting
+    // "Stopped." for a generation that is still running is the one outcome worth
+    // going out of the way to avoid: the answer then arrives after the screen
+    // said it would not.
+    stop: async (s) => {
+      if (!turnInFlight(s) || !s._abortId) return s;
+      const slow = (next: AriaChatState): AriaChatState =>
+        o.poll ? cadence(next, o.poll.idleMs, null) : next;
+      // Read BEFORE the await, compared after, exactly as `tick` does: `stop`
+      // holds a pre-await snapshot too, and a `newChat` or `send` dispatched
+      // during the abort moves the boundary under it.
+      const seq = turnSeq;
+      const typedAt = draftSeq;
+      const unfence = fenceEpoch(seq);
+      // Carried out rather than returned from the catch, so the staleness guard
+      // below runs on the refused path as well as the accepted one.
+      let failure: Partial<AriaChatState> | null = null;
+      try {
+        await abortAssistantMessageGeneration(s._abortId);
+      } catch (e) {
+        const slots = failureSlots(e, unavailableText);
+        // Keep the line that says a reply is coming, because one is. The
+        // ordinary failure path BLANKS `statusText` — right when a send failed
+        // and there is no turn, wrong here, where blanking it would tell the
+        // owner the turn ended while the agent kept writing.
+        failure = { ...slots, statusText: slots.statusText || s.statusText };
+      } finally {
+        // Lowered on BOTH paths, and before either return commits: a refused
+        // abort must leave ticks reporting the still-running turn normally.
+        unfence();
+      }
+      // A boundary moved while the abort was in flight (a send, a new chat,
+      // another stop). Committing `s` over the CURRENT state would end the NEW
+      // turn — `status: "ready"`, empty `_abortId`, the old transcript painted
+      // over it. Stand down, as a stale tick does; the abort already happened
+      // at the service, which is the half that could not be taken back.
+      if (turnSeq !== seq) return undefined;
+      if (failure) return withDraft({ ...s, ...failure }, typedAt);
+      // AFTER the abort is accepted, never before: a refused abort leaves the
+      // turn running, and a tick resolving around it must go on reporting that
+      // turn normally.
+      turnSeq += 1;
+      return slow(withDraft(
+        { ...s, status: "ready", statusText: stoppedText(), error: "", _pending: "", _abortId: "" }, typedAt));
+    },
+  };
+
+  // Every action's result goes through the Stop gate on its way out.
+  return {
+    initialState,
+    load: (s) => impl.load(s).then(gated),
+    submit: (s, arg) => impl.submit(s, arg).then(gated),
+    submitPrompt: (s, arg) => impl.submitPrompt(s, arg).then(gated),
+    newChat: (s) => impl.newChat(s).then(gated),
+    typing: (s, arg) => gated(impl.typing(s, arg)),
+    tick: (s) => impl.tick(s).then((r) => (r ? gated(r) : r)),
+    openLink: (s, arg) => impl.openLink(s, arg).then(gated),
+    stop: (s) => impl.stop(s).then((r) => (r ? gated(r) : r)),
   };
 }
 

package/templates/beauty-salon-owner/tier5-src/_shared/aria-widgets.ts

@@ -68,6 +68,51 @@ function payloadOf(raw: string): WidgetPayload {
   return { name, dataJson, configJson, raw };
 }
 
+/**
+ * Remove every `<HIDDEN>…</HIDDEN>` span.
+ *
+ * The chat-service uses it for text that belongs to the TRANSCRIPT but not to
+ * the screen — machine-facing notes the agent leaves for itself. Aborting a
+ * turn produces exactly one such message and nothing else:
+ *
+ *     <HIDDEN>Request was aborted by user.</HIDDEN>
+ *
+ * (Observed live: abort the turn, re-read the conversation, and that is the
+ * assistant message sitting there.) Painting it would put angle-bracketed
+ * internals in front of an owner who had just pressed Stop — the same class of
+ * leak as the widget envelope this module already lifts out, so it is removed in
+ * the same place and before the same markdown stripper.
+ *
+ * Tolerant of case and of whitespace in the tags, and of an UNCLOSED opener —
+ * which is treated as hiding the remainder, because the alternative is printing
+ * something the service explicitly marked as not for display.
+ */
+const HIDDEN_OPEN = /<\s*HIDDEN\s*>/gi;
+const HIDDEN_CLOSE = /<\s*\/\s*HIDDEN\s*>/gi;
+
+export function stripHidden(text: string): string {
+  if (!text) return text;
+  let out = "";
+  let cursor = 0;
+  for (;;) {
+    // Case- AND whitespace-tolerant, as the docstring promises: the service is
+    // free to emit `< HIDDEN >` or `</ hidden >`, and matching only the exact
+    // literal `<HIDDEN>` let a spaced variant leak the transcript-only note
+    // straight onto the screen — the leak this function exists to stop.
+    HIDDEN_OPEN.lastIndex = cursor;
+    const openM = HIDDEN_OPEN.exec(text);
+    if (!openM) break;
+    out += text.slice(cursor, openM.index);
+    HIDDEN_CLOSE.lastIndex = openM.index + openM[0].length;
+    const closeM = HIDDEN_CLOSE.exec(text);
+    // An UNCLOSED opener hides the remainder — the alternative is printing
+    // something the service explicitly marked as not for display.
+    if (!closeM) return out.trim();
+    cursor = closeM.index + closeM[0].length;
+  }
+  return (out + text.slice(cursor)).trim();
+}
+
 /**
  * Index of the `>>` that actually TERMINATES the envelope opened at `start`, or
  * -1 if there is none yet.