@yadsh/dsh-qa-surface 0.2.0 → 0.4.0

package/lib/client/QaSessionController.js

@@ -1,16 +1,18 @@
-function bytesToBase64(bytes) {
-    let binary = "";
-    for (let index = 0; index < bytes.length; index += 0x8000) {
-        binary += String.fromCharCode(...bytes.subarray(index, index + 0x8000));
-    }
-    return btoa(binary);
-}
-import { QaPolicyAttestationError, attestationHint, attestationReasonOf, proofMatchesConfig, } from "./attestation.js";
+import { bytesToBase64 } from "./base64.js";
+import { qaStorageNamespace } from "../shared/session-key.js";
+import { QaPolicyAttestationError } from "./attestation.js";
 import { QaChatIndex } from "./chat-index.js";
+import { SessionAssetRepository } from "./session-assets.js";
+import { createQaSession } from "./create-session.js";
+import { buildQaPromptContent, stageQaFiles } from "./prompt-content.js";
+import { attestQaPolicy } from "./session-admission.js";
+import { QaHostSourceBridge } from "./session-sources.js";
+import { StreamPublisher } from "./stream-publisher.js";
 import { QA_SESSION_IDLE_STATE } from "./types.js";
 import { waitFor } from "./wait-for.js";
-import { projectSources } from "./QaTranscriptAdapter.js";
-import { projectTranscript, QA_REGENERATE_MARKER, } from "./QaTranscriptAdapter.js";
+import { QA_REGENERATE_MARKER } from "./QaTranscriptAdapter.js";
+import { projectBoundSessionState } from "./project-session-state.js";
+import { projectTurnSources } from "./turn-sources.js";
 const CONFIGURATION_ERROR = "Настройки помощника недоступны.";
 /**
  * The only module that couples QA behavior to DSH Session/client APIs. It owns
@@ -20,16 +22,26 @@ const CONFIGURATION_ERROR = "Настройки помощника недост
 export class QaSessionController {
     listeners = new Set();
     sessions;
-    api;
+    createSessionRemote;
+    conversation;
     connection;
     config;
     secureSessionRemote;
+    sourceApi;
     chats;
+    accounts;
+    /** Resolved per send: a page without the upload plugin has no receipts. */
+    fileUpload;
+    /** Per-chat attachment URL cache; blob URLs die with the chat binding. */
+    assets = new SessionAssetRepository();
     timeoutMs;
-    streamIntervalMs;
+    /** Spacing for a running turn's stream frames; the policy lives there. */
+    streamPublisher;
     state = QA_SESSION_IDLE_STATE;
     session;
+    conversationBinding;
     unsubscribeSession;
+    unsubscribeChat;
     unsubscribeConnection;
     ensuring;
     materializing;
@@ -37,7 +49,6 @@ export class QaSessionController {
     admissionPending = false;
     policyReady = false;
     drafting = false;
-    streamFlushTimer;
     /** The chat session to return to when a subagent view closes. */
     chatSessionId = null;
     viewingSubagent = null;
@@ -45,15 +56,30 @@ export class QaSessionController {
     disposed = false;
     generation = 0;
     chatsRevision = 0;
+    /** Host-side provenance of the bound chat, merged into the projection. */
+    hostSources;
     constructor(options) {
         this.sessions = options.sessions;
-        this.api = options.api;
+        this.createSessionRemote = options.createSession;
+        this.conversation = options.conversation;
         this.connection = options.connection;
         this.config = options.config;
         this.secureSessionRemote = options.secureSession;
-        this.chats = new QaChatIndex(options.storage, `${options.config.session.storageKey}:v1:${options.config.route.path}`);
+        this.sourceApi =
+            options.sourceApi ??
+                {
+                    sources: async () => ({ ok: true, value: [] }),
+                    readSourceFile: async () => ({
+                        ok: false,
+                        error: "unavailable",
+                    }),
+                };
+        this.chats = new QaChatIndex(options.storage, qaStorageNamespace(options.config));
+        this.accounts = options.accounts;
+        this.fileUpload = options.fileUpload ?? (() => undefined);
+        this.hostSources = new QaHostSourceBridge(this.sourceApi, () => this.accounts?.token() ?? "");
         this.timeoutMs = options.timeoutMs ?? 15_000;
-        this.streamIntervalMs = options.streamIntervalMs ?? 66;
+        this.streamPublisher = new StreamPublisher(options.streamIntervalMs ?? 66);
         this.connectedOnce = this.connection.getSnapshot() !== undefined;
         this.unsubscribeConnection = this.connection.subscribe(() => {
             if (this.connection.getSnapshot() !== undefined)
@@ -76,9 +102,12 @@ export class QaSessionController {
         this.ensuring = operation;
         return operation;
     }
-    async send(text, images = []) {
+    async send(text, attachments = []) {
         const prompt = text.trim();
-        if ((prompt === "" && images.length === 0) || !this.state.canSend) {
+        // Images ride the prompt inline; files must be staged first, because the
+        // wire carries a receipt rather than bytes.
+        const files = attachments.filter((attachment) => attachment.kind === "file");
+        if ((prompt === "" && attachments.length === 0) || !this.state.canSend) {
             return false;
         }
         if (prompt.startsWith("/")) {
@@ -96,25 +125,49 @@ export class QaSessionController {
             }
         }
         this.operationError = null;
-        let attested = await this.attestPolicy();
-        if (!attested) {
-            attested = await this.recoverForSend();
-            if (!attested)
+        const step = await this.attestPolicy();
+        if (step.kind === "stale") {
+            // The user moved to another chat while the proof was pending; that
+            // binding attests through its own flow and must not receive a prompt
+            // meant for the old one.
+            return false;
+        }
+        let attestedId = step.kind === "ok" ? step.sessionId : null;
+        if (attestedId === null) {
+            attestedId = await this.recoverForSend();
+            if (attestedId === null)
                 return false;
         }
+        // Nothing can interleave between the last await and here, so matching the
+        // attested id proves the prompt rides exactly the session it proved.
+        const target = this.session;
+        if (this.disposed ||
+            target === undefined ||
+            String(target.sessionId) !== attestedId) {
+            return false;
+        }
+        let receipts = new Map();
+        if (files.length > 0) {
+            const outcome = await stageQaFiles(this.fileUpload(), target, files);
+            if (outcome.kind !== "ok") {
+                if (this.session === target) {
+                    this.operationError =
+                        outcome.kind === "unavailable"
+                            ? "Вложения недоступны на этом сервере."
+                            : "Не удалось приложить файл.";
+                    this.publish();
+                }
+                return false;
+            }
+            receipts = outcome.receipts;
+        }
         this.admissionPending = true;
         this.publish();
         try {
-            const content = [
-                ...(prompt === "" ? [] : [{ type: "text", text: prompt }]),
-                ...images.map((image) => ({
-                    type: "image",
-                    mediaType: image.mediaType,
-                    data: image.data,
-                    name: image.name,
-                })),
-            ];
-            const result = await this.session.prompt(content, "queue");
+            const content = buildQaPromptContent(prompt, attachments, receipts);
+            const result = await target.prompt(content, "queue");
+            if (this.session !== target)
+                return false;
             if (!result.ok) {
                 this.admissionPending = false;
                 this.operationError = "Не удалось отправить сообщение.";
@@ -127,8 +180,10 @@ export class QaSessionController {
         catch (error) {
             this.admissionPending = false;
             console.error("dsh-qa-surface: prompt failed", error);
-            this.operationError = "Не удалось отправить сообщение.";
-            this.publish();
+            if (this.session === target) {
+                this.operationError = "Не удалось отправить сообщение.";
+                this.publish();
+            }
             return false;
         }
     }
@@ -143,15 +198,20 @@ export class QaSessionController {
         return this.send(QA_REGENERATE_MARKER);
     }
     async stop() {
-        if (this.session === undefined || !this.state.canStop)
+        const target = this.session;
+        if (target === undefined || !this.state.canStop)
             return;
         try {
-            const result = await this.session.cancel();
+            const result = await target.cancel();
+            if (this.session !== target)
+                return;
             if (!result.ok)
                 this.operationError = "Не удалось остановить ответ.";
         }
         catch (error) {
             console.error("dsh-qa-surface: stop failed", error);
+            if (this.session !== target)
+                return;
             this.operationError = "Не удалось остановить ответ.";
         }
         this.publish();
@@ -200,7 +260,10 @@ export class QaSessionController {
         const attempt = (async () => {
             try {
                 await this.waitForConnection();
-                const id = await this.createSession();
+                const id = await createQaSession({
+                    createSession: this.createSessionRemote,
+                    token: this.accounts?.token() ?? "",
+                });
                 if (this.disposed || operation !== this.generation)
                     return false;
                 await this.bind(id);
@@ -213,6 +276,8 @@ export class QaSessionController {
                 return true;
             }
             catch (error) {
+                if (this.disposed || operation !== this.generation)
+                    return false;
                 this.fail(this.operationError === CONFIGURATION_ERROR
                     ? this.operationError
                     : "Не удалось начать чат.", error);
@@ -267,6 +332,9 @@ export class QaSessionController {
             this.chats.saveActive(sessionId);
         }
         catch (error) {
+            // A newer operation superseded this switch: its own outcome governs.
+            if (this.disposed || operation !== this.generation)
+                return;
             this.fail(this.operationError === CONFIGURATION_ERROR
                 ? this.operationError
                 : "Не удалось открыть этот чат.", error);
@@ -305,6 +373,9 @@ export class QaSessionController {
             await this.bind(id, { attest: false, track: false, report: false });
         }
         catch (error) {
+            // A newer operation superseded this view request: leave its state alone.
+            if (this.disposed || operation !== this.generation)
+                return;
             this.viewingSubagent = null;
             this.fail("Не удалось открыть транскрипт субагента.", error);
         }
@@ -318,9 +389,14 @@ export class QaSessionController {
             return;
         await this.switchTo(chat);
     }
-    /** This browser's indexed chat ids, most recently used first. */
+    /** This browser's chat ids: the owned list when accounts are on, else the
+     * local index. Both intersect the host session list at projection time. */
     chatIds() {
-        return this.chats.chatIds();
+        const owned = this.accounts?.ownedIds() ?? [];
+        if (owned.length === 0)
+            return this.chats.chatIds();
+        const local = this.chats.chatIds();
+        return [...new Set([...owned, ...local])];
     }
     /** The bound session id, or null while no chat is bound. */
     activeSessionId() {
@@ -328,12 +404,21 @@ export class QaSessionController {
     }
     /**
      * Resolve one durable image attachment of the bound session into a
-     * browser-usable URL. The caller caches; failures surface as broken views.
+     * browser-usable URL. Resolutions are cached per chat in the asset
+     * repository (attachment ids repeat across chats) and revoked when the chat
+     * is unbound; failures surface as broken views and retry on demand.
      */
     async readImage(attachmentId) {
         if (this.session === undefined)
             throw new Error("no bound session");
-        const result = await this.session.readAttachment(attachmentId);
+        const sessionId = String(this.session.sessionId);
+        return this.assets.resolve(sessionId, attachmentId, (id) => this.readAttachmentUrl(id));
+    }
+    async readAttachmentUrl(attachmentId) {
+        const session = this.session;
+        if (session === undefined)
+            throw new Error("no bound session");
+        const result = await session.readAttachment(attachmentId);
         if (!result.ok) {
             throw new Error(`${result.error.code}: ${result.error.message}`);
         }
@@ -374,9 +459,10 @@ export class QaSessionController {
             return;
         this.disposed = true;
         this.generation += 1;
-        this.clearStreamFlush();
+        this.streamPublisher.clear();
         this.unsubscribeConnection();
         this.unbind();
+        this.assets.dispose();
         this.listeners.clear();
     }
     async ensureSessionNow() {
@@ -410,7 +496,10 @@ export class QaSessionController {
                 }
             }
             if (id === null) {
-                id = await this.createSession();
+                id = await createQaSession({
+                    createSession: this.createSessionRemote,
+                    token: this.accounts?.token() ?? "",
+                });
             }
             if (this.disposed || operation !== this.generation)
                 return;
@@ -421,6 +510,10 @@ export class QaSessionController {
                 await this.bind(id, { report: !restored });
             }
             catch (error) {
+                // A stale restore must not start its recovery ladder against a newer
+                // operation; rethrow for the generation-guarded outer catch.
+                if (this.disposed || operation !== this.generation)
+                    throw error;
                 if (!restored ||
                     this.config.session.policy !== "browser-persistent" ||
                     !(error instanceof QaPolicyAttestationError)) {
@@ -432,7 +525,10 @@ export class QaSessionController {
                 this.unbind();
                 this.operationError = null;
                 this.chats.clearActive();
-                id = await this.createSession();
+                id = await createQaSession({
+                    createSession: this.createSessionRemote,
+                    token: this.accounts?.token() ?? "",
+                });
                 if (this.disposed || operation !== this.generation)
                     return;
                 await this.bind(id);
@@ -444,6 +540,9 @@ export class QaSessionController {
             }
         }
         catch (error) {
+            // A newer operation superseded this bootstrap: its own outcome governs.
+            if (this.disposed || operation !== this.generation)
+                return;
             this.fail(this.operationError === CONFIGURATION_ERROR
                 ? this.operationError
                 : "Не удалось начать чат.", error);
@@ -456,14 +555,15 @@ export class QaSessionController {
      * re-opening re-materializes it. Step 2 — when that refused session is
      * still blank (it never received the prompt, so there is nothing to lose) —
      * starts a fresh attested session instead. A session with history is left
-     * alone: recreating it would silently drop the conversation.
+     * alone: recreating it would silently drop the conversation. Returns the
+     * attested session id, or null when nothing was attested.
      */
     async recoverForSend() {
         const id = this.session === undefined ? null : String(this.session.sessionId);
         if (id === null ||
             this.disposed ||
             this.config.session.policy === "fixed") {
-            return false;
+            return null;
         }
         const operation = ++this.generation;
         this.unbind();
@@ -476,72 +576,43 @@ export class QaSessionController {
             try {
                 await this.bind(id);
                 if (this.disposed || operation !== this.generation)
-                    return false;
+                    return null;
                 if (this.policyReady)
-                    return true;
+                    return id;
             }
             catch (error) {
                 if (!(error instanceof QaPolicyAttestationError))
                     throw error;
                 if (this.disposed || operation !== this.generation)
-                    return false;
+                    return null;
             }
             if (this.session !== undefined && !this.session.getSnapshot().blank) {
                 this.fail(CONFIGURATION_ERROR, new QaPolicyAttestationError());
-                return false;
+                return null;
             }
             this.unbind();
             this.chats.clearActive();
-            const created = await this.createSession();
+            const created = await createQaSession({
+                createSession: this.createSessionRemote,
+                token: this.accounts?.token() ?? "",
+            });
             if (this.disposed || operation !== this.generation)
-                return false;
+                return null;
             await this.bind(created);
             if (this.disposed || operation !== this.generation)
-                return false;
+                return null;
             this.chats.saveActive(created);
-            return this.policyReady;
+            return this.policyReady ? created : null;
         }
         catch (error) {
+            if (this.disposed || operation !== this.generation)
+                return null;
             this.fail(this.operationError === CONFIGURATION_ERROR
                 ? this.operationError
                 : "Не удалось открыть этот чат.", error);
-            return false;
+            return null;
         }
     }
-    async createSession() {
-        const created = await this.sessions.create({
-            ...(this.config.session.workspaceId !== null
-                ? { workspaceId: this.config.session.workspaceId }
-                : this.config.session.cwd !== null
-                    ? { cwd: this.config.session.cwd }
-                    : {}),
-        });
-        const id = String(created);
-        if (this.config.session.agentPreset !== null) {
-            const selectedPreset = await this.api.selectAgentPreset({
-                sessionId: id,
-                agentPreset: this.config.session.agentPreset,
-            });
-            if (!selectedPreset.result.ok) {
-                throw new Error(selectedPreset.result.error.code);
-            }
-            this.sessions.noteAgentPreset(id, this.config.session.agentPreset);
-        }
-        if (this.config.session.provider !== null &&
-            this.config.session.model !== null) {
-            const selected = await this.api.selectModel({
-                sessionId: id,
-                provider: this.config.session.provider,
-                model: this.config.session.model,
-                ...(this.config.session.reasoningEffort === null
-                    ? {}
-                    : { reasoningEffort: this.config.session.reasoningEffort }),
-            });
-            if (!selected.result.ok)
-                throw new Error(selected.result.error.code);
-        }
-        return id;
-    }
     async bind(id, options = {}) {
         const { report = true, attest = true, track = true } = options;
         this.sessions.open(id);
@@ -554,65 +625,61 @@ export class QaSessionController {
             throw new Error("Session binding is unavailable.");
         this.unbind();
         this.session = binding.session;
+        this.conversationBinding = this.conversation.binding(id);
         this.policyReady = false;
         this.unsubscribeSession = binding.session.subscribe(() => {
             this.admissionPending = false;
             this.operationError = null;
             this.publishSessionUpdate();
         });
+        // Subscribing the Chat target activates it, so the assembled transcript
+        // (nodes, partials, running calls) materializes for the projection.
+        this.unsubscribeChat = this.conversationBinding
+            .target("chat")
+            .subscribe(() => {
+            this.publishSessionUpdate();
+        });
         await waitFor(binding.session, (snapshot) => snapshot.openState === "open" || snapshot.openState === "error", this.timeoutMs);
         if (binding.session.getSnapshot().openState !== "open") {
             throw new Error("Session binding could not be opened.");
         }
-        if (attest && !(await this.attestPolicy(report))) {
-            throw new QaPolicyAttestationError();
+        if (attest) {
+            const step = await this.attestPolicy(report);
+            if (step.kind !== "ok")
+                throw new QaPolicyAttestationError();
         }
         if (track) {
             this.chatSessionId = String(this.session.sessionId);
             this.viewingSubagent = null;
             this.chats.addChat(String(this.session.sessionId));
+            this.accounts?.onSessionCreated(String(this.session.sessionId));
         }
         this.publish();
     }
     unbind() {
-        this.clearStreamFlush();
+        this.streamPublisher.clear();
         this.unsubscribeSession?.();
         this.unsubscribeSession = undefined;
+        this.unsubscribeChat?.();
+        this.unsubscribeChat = undefined;
+        this.conversationBinding = undefined;
+        if (this.session !== undefined) {
+            // Leaving the chat retires its attachment URLs; a later re-bind
+            // re-resolves them from the durable store.
+            this.assets.release(String(this.session.sessionId));
+        }
         this.session = undefined;
+        this.hostSources.reset();
         this.admissionPending = false;
         this.policyReady = false;
     }
     waitForConnection() {
         return waitFor(this.connection, (description) => description !== undefined, this.timeoutMs);
     }
-    /**
-     * Project one session notification. A running turn's frames arrive at
-     * animation-frame cadence, so re-projections are spaced at least
-     * {@link streamIntervalMs} apart: the first frame of a window projects at
-     * once and further frames are absorbed (the memoized render path replays
-     * nothing, so absorbing a frame only defers it). Everything outside a
-     * running turn - phase flips, errors, turn completion - projects
-     * immediately.
-     */
+    /** Project one session notification; the running-turn spacing policy
+     * (first frame at once, further frames absorbed) lives in the publisher. */
     publishSessionUpdate() {
-        if (this.streamIntervalMs <= 0 ||
-            this.session?.getSnapshot().running !== true) {
-            this.clearStreamFlush();
-            this.publish();
-            return;
-        }
-        if (this.streamFlushTimer !== undefined)
-            return;
-        this.publish();
-        this.streamFlushTimer = setTimeout(() => {
-            this.streamFlushTimer = undefined;
-        }, this.streamIntervalMs);
-    }
-    clearStreamFlush() {
-        if (this.streamFlushTimer === undefined)
-            return;
-        clearTimeout(this.streamFlushTimer);
-        this.streamFlushTimer = undefined;
+        this.streamPublisher.publish(this.session?.getSnapshot().running === true, () => this.publish());
     }
     publish() {
         if (this.disposed)
@@ -646,38 +713,29 @@ export class QaSessionController {
             return;
         }
         const snapshot = this.session.getSnapshot();
-        const blocked = snapshot.pending.length > 0;
-        const error = this.operationError ??
-            (blocked
-                ? "Для этого запроса нужно действие, недоступное в режиме помощника."
-                : snapshot.removed || snapshot.openState === "error"
-                    ? "Этот чат больше недоступен."
-                    : null);
-        const phase = !connected
-            ? "reconnecting"
-            : blocked
-                ? "blocked"
-                : snapshot.removed || snapshot.openState === "error"
-                    ? "error"
-                    : snapshot.openState !== "open"
-                        ? "creating"
-                        : snapshot.running || this.admissionPending
-                            ? "running"
-                            : "ready";
-        this.state = {
-            phase,
-            sessionId: String(this.session.sessionId),
-            messages: projectTranscript(snapshot, {
-                showToolActivity: this.config.ui.showToolActivity,
-                showReasoning: this.config.ui.showReasoning,
-            }),
-            error,
-            canSend: connected && phase === "ready" && this.policyReady,
-            canStop: connected && snapshot.running && this.config.ui.showStop && !blocked,
+        const sessionId = String(this.session.sessionId);
+        const conversationSnapshot = this.conversationBinding?.snapshot.getSnapshot();
+        const projectedSourceBundles = projectTurnSources(conversationSnapshot, sessionId, this.config.session.cwd ?? undefined);
+        const sourceBundles = this.hostSources.merge(projectedSourceBundles);
+        if (!snapshot.running) {
+            void this.hostSources.refresh(sessionId, () => this.publish());
+        }
+        this.state = projectBoundSessionState({
+            connected,
+            sessionId,
+            sessionSnapshot: snapshot,
+            conversationSnapshot,
+            sourceBundles,
+            // Ownership is chat-level: every user message of a foreign chat
+            // carries its owner's name when an admin reads it.
+            author: this.accounts?.messageAuthorOf(sessionId),
+            operationError: this.operationError,
+            policyReady: this.policyReady,
+            admissionPending: this.admissionPending,
             chatsRevision: this.chatsRevision,
-            sources: projectSources(snapshot),
             viewingSubagent: this.viewingSubagent,
-        };
+            config: this.config,
+        });
         this.emit();
     }
     fail(message, error) {
@@ -697,48 +755,48 @@ export class QaSessionController {
         };
         this.emit();
     }
+    /**
+     * Attest the currently bound session. `ok` carries the session id the proof
+     * was issued for; `stale` means the binding changed while the request was
+     * in flight, so nothing was written — the newer binding manages its own
+     * attestation; `refused` is a genuine admission refusal of this binding.
+     */
     async attestPolicy(reportFailure = true) {
-        if (this.session === undefined)
-            return false;
+        const session = this.session;
+        if (session === undefined)
+            return { kind: "refused" };
+        const sessionId = String(session.sessionId);
         if (!this.config.lockdown.enabled) {
             this.policyReady = true;
-            return true;
+            return { kind: "ok", sessionId };
         }
         this.policyReady = false;
         this.publish();
-        // One precise console diagnostic per refusal: the coarse Host reason code
-        // plus an operator hint. The QA-facing message stays generic by design.
-        const reject = (reason) => {
-            if (reportFailure) {
-                console.error(`dsh-qa-surface: policy attestation failed (reason: ${reason ?? "unknown"}). ${attestationHint(reason)}`);
-            }
-            this.policyReady = false;
-            this.operationError = CONFIGURATION_ERROR;
-            this.publish();
-            return false;
-        };
-        try {
-            const result = await this.secureSessionRemote(String(this.session.sessionId));
-            if (!result.ok) {
-                return reject(attestationReasonOf(result.error));
-            }
-            if (!proofMatchesConfig(result.value, this.config.lockdown, String(this.session.sessionId))) {
-                return reject("proof-mismatch");
-            }
+        const outcome = await attestQaPolicy({
+            secureSession: this.secureSessionRemote,
+            token: this.accounts?.token() ?? "",
+            sessionId,
+            lockdown: this.config.lockdown,
+            report: reportFailure,
+        });
+        if (this.session !== session)
+            return { kind: "stale" };
+        if (outcome.ok) {
             this.policyReady = true;
             this.operationError = null;
             this.publish();
-            return true;
+            return { kind: "ok", sessionId };
         }
-        catch (error) {
-            if (reportFailure) {
-                console.error("dsh-qa-surface: policy attestation request failed", error);
-            }
-            this.policyReady = false;
-            this.operationError = CONFIGURATION_ERROR;
-            this.publish();
-            return false;
+        if (outcome.authRequired) {
+            // The identity expired or was rotated: back to the gate instead of
+            // the generic configuration error.
+            this.accounts?.onAuthRequired();
+            return { kind: "refused" };
         }
+        this.policyReady = false;
+        this.operationError = CONFIGURATION_ERROR;
+        this.publish();
+        return { kind: "refused" };
     }
     emit() {
         for (const listener of this.listeners)