@yadsh/dsh-qa-surface 0.17.0 → 0.19.0

package/lib/client/QaSessionController.js

@@ -36,15 +36,17 @@ const CONFIGURATION_ERROR = "Настройки помощника недост
 const SLASH_CATALOG_STALE_MS = 3_000;
 /**
  * How long a refused retain waits for its row to come into this browser's
- * Session catalog. Short on purpose, and shorter than the adoption timeout: the
- * row arrives either as a Host push or as the answer of the one pull asked for
- * here, so it is a round-trip away — while a whole `timeoutMs` of patience
- * would stack a second window onto the waits that follow and hold a chat that
- * never opens on screen for two of them. A row that misses this window loses
- * the chat, and the plate's «Повторить» re-runs the adoption on a catalog that
- * has had the pull.
+ * Session catalog. Shorter than the adoption timeout, but wide enough for the
+ * way the row actually arrives on a QA deployment: this surface has no
+ * forwarded-event push of its own — the row rides on the account's chat
+ * listing — and a listing that lands right after the create pays for the
+ * Host's shared catalog scan the create itself invalidated, which on a loaded
+ * stand takes longer than a round trip. The interval keeps asking for the
+ * listing while this waits, so the window only has to outlast one slow scan.
+ * A row that misses it loses the chat, and the plate's «Повторить» re-runs
+ * the adoption on a catalog that has had the pull.
  */
-const CATALOG_ROW_PATIENCE_MS = 5_000;
+const CATALOG_ROW_PATIENCE_MS = 15_000;
 /**
  * Spacing of the parked-request poll. A request is answered by a person, so a
  * second of latency is invisible; the poll only runs while a turn runs.
@@ -129,7 +131,10 @@ export class QaSessionController {
     unsubscribeConnection;
     ensuring;
     materializing;
+    /** A successful create survives a failed adoption; retry must not create again. */
+    draftSessionId;
     operationError = null;
+    operationDiagnostic = null;
     admissionPending = false;
     pendingSubmission;
     pendingSequence = 0;
@@ -170,9 +175,9 @@ export class QaSessionController {
      * both a failed adoption and {@link unbind} take it back. The converse does
      * not hold: a held session may name nothing, which is the transcript of an
      * attestation this chat could not pass and whose caller still reads it. So a
-     * chat whose first send fell short keeps its identity while naming no session,
-     * and the retry — which brings a fresh id — stays in the composer the question
-     * was typed into instead of reading as a move to another chat.
+     * chat whose first send fell short keeps its identity while naming no session;
+     * a retry adopts the successful create it already holds and preserves the
+     * composer the question was typed into.
      */
     namedSession = null;
     /**
@@ -193,6 +198,10 @@ export class QaSessionController {
     /** Host-side question requests of the bound chat waiting for the operator. */
     hostQuestions;
     queueRemote;
+    requestRemote;
+    requestWaitStatus = null;
+    requestReadRevision = 0;
+    requestReading = false;
     /** Last send the stand had no room for; drives the request-ceiling dialog. */
     requestQueueNotice = null;
     /** Set while a running turn is polled for parked requests. */
@@ -261,6 +270,7 @@ export class QaSessionController {
         this.hostApprovals = new QaHostApprovalBridge(options.approvalApi);
         this.hostQuestions = new QaHostQuestionBridge(options.questionApi);
         this.queueRemote = options.queueStatus;
+        this.requestRemote = options.requestStatus;
         // Cold account catalogs can outlive one short network round trip.
         // Keep bootstrap bounded without rejecting a valid slow restoration.
         this.timeoutMs = options.timeoutMs ?? 60_000;
@@ -287,6 +297,16 @@ export class QaSessionController {
         this.ensuring = operation;
         return operation;
     }
+    /** Retry opening a failed draft without abandoning its successful create. */
+    async retrySession() {
+        if (this.drafting)
+            await this.materializeDraft();
+        else
+            await this.ensureSession();
+    }
+    failureDiagnostic() {
+        return this.operationError === null ? null : this.operationDiagnostic;
+    }
     /**
      * Select a different capability profile for the next agent. The current
      * agent is never mutated: even a blank materialized chat is abandoned in
@@ -415,7 +435,7 @@ export class QaSessionController {
             // the submission rides exactly the way it always did.
             if (this.disposed || (bound !== undefined && this.session !== bound))
                 return false;
-            if (ceiling !== null && ceiling.full) {
+            if (ceiling !== null && ceiling.full && ceiling.managed !== true) {
                 this.requestQueueNotice = ceiling;
                 this.publish();
                 return false;
@@ -538,10 +558,8 @@ export class QaSessionController {
     /**
      * What the stand answers about its load, or null when it does not answer.
      *
-     * Every failure here sends the question anyway. The ceiling exists to keep a
-     * weak model from drowning, not to be a door a browser cannot open: an
-     * unreadable count says nothing about the load, and refusing a visitor on
-     * that would be a worse answer than the one they would have got.
+     * A failed status read does not bypass the server queue. Submit normally;
+     * the Host owns admission even when the browser cannot read its load.
      */
     async readQueueStatus() {
         if (this.queueRemote === undefined)
@@ -555,6 +573,35 @@ export class QaSessionController {
             return null;
         }
     }
+    async refreshRequestStatus(sessionId, token) {
+        if (this.requestRemote === undefined || this.requestReading)
+            return;
+        this.requestReading = true;
+        const revision = this.requestReadRevision;
+        try {
+            const result = await this.requestRemote(token, sessionId);
+            if (this.disposed ||
+                revision !== this.requestReadRevision ||
+                String(this.session?.sessionId) !== sessionId)
+                return;
+            if (!result.ok)
+                return;
+            const status = result.value.managed === true && result.value.waiting === true
+                ? result.value
+                : null;
+            if (JSON.stringify(status) === JSON.stringify(this.requestWaitStatus))
+                return;
+            this.requestWaitStatus = status;
+            this.publish();
+        }
+        catch {
+            // Keep the last known position during a transient transport failure.
+        }
+        finally {
+            if (revision === this.requestReadRevision)
+                this.requestReading = false;
+        }
+    }
     /**
      * Close the request-ceiling dialog. Nothing is retried and nothing is
      * dropped: the held-back question is still the composer's own text, so asking
@@ -948,6 +995,7 @@ export class QaSessionController {
     enterDraft() {
         this.generation += 1;
         this.materializing = undefined;
+        this.draftSessionId = undefined;
         this.drafting = true;
         if (this.namedSession !== null) {
             this.openChat();
@@ -985,14 +1033,17 @@ export class QaSessionController {
         const attempt = (async () => {
             try {
                 await this.waitForConnection();
-                const id = await createQaSession({
-                    createSession: this.createSessionRemote,
-                    token: this.accounts?.token() ?? "",
-                    subroleId: this.selectedSubrole,
-                    adminPreview: this.adminPreview,
-                });
+                const id = this.draftSessionId ??
+                    (await createQaSession({
+                        createSession: this.createSessionRemote,
+                        token: this.accounts?.token() ?? "",
+                        subroleId: this.selectedSubrole,
+                        adminPreview: this.adminPreview,
+                    }));
                 if (this.disposed || operation !== this.generation)
                     return false;
+                this.draftSessionId = id;
+                this.sessions.rememberAdmitted?.(id);
                 // A step back is not a materialized draft: this adoption never ended up
                 // holding a session, so the draft has to stay a draft. Calling it done
                 // leaves a chat with neither a session nor a draft behind, and every
@@ -1002,6 +1053,7 @@ export class QaSessionController {
                 if (this.disposed || operation !== this.generation)
                     return false;
                 this.drafting = false;
+                this.draftSessionId = undefined;
                 if (this.config.session.policy === "browser-persistent") {
                     this.chats.saveActive(id);
                 }
@@ -1314,7 +1366,36 @@ export class QaSessionController {
         this.emit();
         try {
             await this.waitForConnection();
-            const list = await waitFor(this.sessions.list, (snapshot) => snapshot.phase === "ready", this.timeoutMs);
+            const saved = this.config.session.policy === "browser-persistent"
+                ? this.chats.activeId()
+                : null;
+            let admitted = null;
+            const savedSummary = saved === null
+                ? undefined
+                : this.sessions.list.getSnapshot().byId[saved];
+            if (saved !== null &&
+                this.accounts !== undefined &&
+                this.sharingApi !== undefined &&
+                this.sessions.rememberAdmitted !== undefined &&
+                (savedSummary === undefined || !isDelegatedSession(savedSummary))) {
+                const identity = this.accounts.token();
+                if (identity !== null) {
+                    const access = await this.sharingApi.access(identity, saved);
+                    if (this.disposed ||
+                        operation !== this.generation ||
+                        identity !== this.accounts.token())
+                        return;
+                    if (access.ok && access.value.sessionId === saved) {
+                        // A direct Host read admission is sufficient to reopen this exact
+                        // chat. A cold deployment-wide catalog scan must not gate restore.
+                        this.sessions.rememberAdmitted(saved);
+                        admitted = saved;
+                    }
+                }
+            }
+            const list = admitted === null
+                ? await waitFor(this.sessions.list, (snapshot) => snapshot.phase === "ready", this.timeoutMs)
+                : this.sessions.list.getSnapshot();
             let id = null;
             let restored = false;
             let existing = false;
@@ -1335,8 +1416,8 @@ export class QaSessionController {
                 // falls through to a draft instead of restoring a transcript nobody can
                 // send into.
                 if (stored !== null &&
-                    summary !== undefined &&
-                    !isDelegatedSession(summary)) {
+                    (stored === admitted ||
+                        (summary !== undefined && !isDelegatedSession(summary)))) {
                     id = stored;
                     restored = true;
                     existing = true;
@@ -1603,7 +1684,7 @@ export class QaSessionController {
         // chat: it takes its own identity, so nothing the previous chat was holding
         // — an unsent question, staged attachments, an open drawer — walks into it.
         // A chat that names no session adopts under the identity it already has,
-        // which is what keeps a retried first send — it brings a fresh id — in the
+        // which is what keeps a retried first send in the
         // composer the question was typed into.
         if (this.namedSession !== null && this.namedSession !== id)
             this.openChat();
@@ -1841,6 +1922,9 @@ export class QaSessionController {
         // answers for its own sends.
         this.requestQueueNotice = null;
         this.policyReady = false;
+        this.requestWaitStatus = null;
+        this.requestReadRevision += 1;
+        this.requestReading = false;
         this.inheritedThroughSeq = undefined;
         this.compatibilityReadOnly = false;
         // The catalog belongs to the chat that produced it: another chat has a
@@ -1897,7 +1981,7 @@ export class QaSessionController {
                         ? "reconnecting"
                         : "idle",
                 error: this.operationError,
-                requestQueue: this.requestQueueNotice,
+                requestQueue: this.requestWaitStatus ?? this.requestQueueNotice,
                 canSend: connected && !materializing,
                 pendingMessage: this.pendingSubmission?.message ?? null,
                 chatsRevision: this.chatsRevision,
@@ -1911,7 +1995,7 @@ export class QaSessionController {
                 ...this.state,
                 phase: !connected && this.connectedOnce ? "reconnecting" : this.state.phase,
                 error: this.operationError ?? this.state.error,
-                requestQueue: this.requestQueueNotice,
+                requestQueue: this.requestWaitStatus ?? this.requestQueueNotice,
             };
             this.emit();
             return;
@@ -1949,7 +2033,7 @@ export class QaSessionController {
             // carries its owner's name when an admin reads it.
             author: this.accounts?.messageAuthorOf(sessionId),
             operationError: this.operationError,
-            requestQueue: this.requestQueueNotice,
+            requestQueue: this.requestWaitStatus ?? this.requestQueueNotice,
             policyReady: this.policyReady,
             compatibilityReadOnly: this.compatibilityReadOnly,
             admissionPending: this.admissionPending || this.pendingSubmission !== undefined,
@@ -2124,13 +2208,28 @@ export class QaSessionController {
         this.publish();
     }
     fail(message, error) {
-        // Policy attestation refusals already logged their precise reason; a
-        // second stack trace for the wrapper error is only console noise.
-        if (!(error instanceof QaPolicyAttestationError)) {
-            console.error("dsh-qa-surface: session operation failed", error);
-        }
         if (this.disposed)
             return;
+        const detail = error instanceof Error ? error.message : String(error);
+        const reason = /transport|network|fetch|HTTP|connection|timed? ?out|timeout/iu.test(detail)
+            ? "Не удалось связаться со стендом или дождаться его ответа."
+            : /sessions\.retain|unknown session|catalog/iu.test(detail)
+                ? "Стенд создал чат, но его запись ещё недоступна в истории."
+                : error instanceof QaPolicyAttestationError
+                    ? "Настройки чата не прошли проверку политики стенда."
+                    : "Стенд отклонил операцию. Подробности доступны оператору по коду обращения.";
+        // A diagnostic label, not an authority token. This also works on a LAN
+        // HTTP origin where crypto.randomUUID is unavailable.
+        const id = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+        this.operationDiagnostic = { reason, id };
+        if (error instanceof QaPolicyAttestationError) {
+            // The policy probe already logged the precise refusal without a wrapper
+            // stack. Add only the reference the user sees on the plate.
+            console.info("dsh-qa-surface: policy failure reference", { id });
+        }
+        else {
+            console.error("dsh-qa-surface: session operation failed", error, { id });
+        }
         this.operationError = message;
         this.state = {
             ...QA_SESSION_IDLE_STATE,
@@ -2281,13 +2380,18 @@ export class QaSessionController {
             : false;
         const pending = this.hostApprovals.list().length > 0 ||
             this.hostQuestions.list().length > 0;
-        const wanted = ((running && (approvals || questions)) || pending) &&
+        const queue = this.requestRemote !== undefined &&
+            this.config.session.maxActiveRequests > 0;
+        const wanted = ((running && (approvals || questions || queue)) || pending) &&
             // A subagent watched from the panel is a read-only view of a session the
             // chat owns: its own requests belong to the chat, not to this binding.
             this.viewingSubagent === null &&
             this.session !== undefined;
         if (!wanted) {
             this.stopPendingPolling();
+            this.requestWaitStatus = null;
+            this.requestReadRevision += 1;
+            this.requestReading = false;
             return;
         }
         if (this.pendingTimer !== undefined || this.session === undefined)
@@ -2295,6 +2399,8 @@ export class QaSessionController {
         const sessionId = String(this.session.sessionId);
         const token = this.hostToken();
         const tick = () => {
+            if (queue)
+                void this.refreshRequestStatus(sessionId, token);
             // A seam still on screen is re-read even where its config gate has since
             // closed: the Host is the authority on what it holds, and an empty answer
             // is what takes a settled request off the screen.