bunnyquery 1.7.0 → 1.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunnyquery",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Embeddable BunnyQuery AI chat widget + its framework-agnostic chat engine",
   "main": "bunnyquery.js",
   "exports": {

package/src/engine/ai_agent.ts

@@ -0,0 +1,80 @@
+/**
+ * The `ai_agent` service option, parsed and serialized in ONE place.
+ *
+ * Stored on the skapi service record as up to three '#'-delimited segments:
+ *
+ *   none                                  AI chat disabled
+ *   claude                                platform chosen, no model saved yet
+ *   claude#claude-sonnet-4-6              platform + model
+ *   claude#claude-sonnet-4-6#400000       platform + model + context-window override
+ *
+ * The third segment is new and optional, so every value written before it
+ * existed parses unchanged with `contextWindow: null`. Nothing writes a third
+ * segment without a model, because the window is meaningless without one.
+ *
+ * This lived as four separate copies (agent.vue, dbfile.vue, service.vue, and
+ * the widget's index.js), which is how the format drifts. New callers should
+ * import from here rather than re-deriving the split.
+ */
+
+export type AiAgentPlatform = 'claude' | 'openai' | null;
+
+export type ParsedAiAgent = {
+	/** null when unset or explicitly 'none'. */
+	platform: AiAgentPlatform;
+	/** '' when no model has been saved. */
+	model: string;
+	/** Per-project context-window override in tokens, or null to use the model's. */
+	contextWindow: number | null;
+	/** True when a real platform is configured (i.e. not unset and not 'none'). */
+	hasPlatform: boolean;
+};
+
+function normalizePlatform(raw: string): AiAgentPlatform {
+	var p = (raw || '').trim().toLowerCase();
+	return p === 'claude' || p === 'openai' ? p : null;
+}
+
+export function parseAiAgentValue(value: string | null | undefined): ParsedAiAgent {
+	var raw = (value || '').trim();
+	if (!raw || raw.toLowerCase() === 'none') {
+		return { platform: null, model: '', contextWindow: null, hasPlatform: false };
+	}
+
+	// Split into at most three parts so a '#' inside a model id (none today, but
+	// the delimiter should not be load-bearing on the tail) cannot shift fields.
+	var firstHash = raw.indexOf('#');
+	if (firstHash === -1) {
+		var only = normalizePlatform(raw);
+		return { platform: only, model: '', contextWindow: null, hasPlatform: !!only };
+	}
+
+	var platform = normalizePlatform(raw.slice(0, firstHash));
+	var rest = raw.slice(firstHash + 1);
+	var secondHash = rest.indexOf('#');
+	var model = (secondHash === -1 ? rest : rest.slice(0, secondHash)).trim();
+	var windowRaw = secondHash === -1 ? '' : rest.slice(secondHash + 1).trim();
+
+	var parsedWindow = windowRaw ? Number(windowRaw) : NaN;
+	var contextWindow = Number.isFinite(parsedWindow) && parsedWindow > 0
+		? Math.floor(parsedWindow)
+		: null;
+
+	return { platform: platform, model: model, contextWindow: contextWindow, hasPlatform: !!platform };
+}
+
+export function buildAiAgentValue(
+	platform: string | null | undefined,
+	model?: string | null,
+	contextWindow?: number | null,
+): string {
+	var p = (platform || '').trim().toLowerCase();
+	if (!p || p === 'none') return 'none';
+
+	var m = (model || '').trim();
+	if (!m) return p;
+
+	var n = Number(contextWindow);
+	if (!Number.isFinite(n) || n <= 0) return p + '#' + m;
+	return p + '#' + m + '#' + Math.floor(n);
+}

package/src/engine/budget.ts

@@ -7,15 +7,76 @@
 import { sanitizeAttachmentLinksForHistory } from './links';
 
 export var CONTEXT_WINDOW_DEFAULT: Record<string, number> = { claude: 200000, openai: 128000 };
+// Exact model ids first, then family keys (see getContextWindow: a suffixed id
+// falls back to its family rather than to the platform default). Claude figures
+// come from Anthropic's published model table; `max_input_tokens` from
+// /v1/models overrides all of this at runtime when a listing has been seen.
+// 'claude-opus-4-7' read 200000 here, which was wrong by 5x, and the default
+// Claude model 'claude-sonnet-4-6' was absent entirely so it fell through to
+// CONTEXT_WINDOW_DEFAULT.claude. Neither was observable, because the history
+// budget and the Claude per-request cap below bind long before the window does.
 export var CONTEXT_WINDOW_BY_MODEL: Record<string, number> = {
-	'claude-opus-4-7': 200000, 'claude-sonnet-4': 200000, 'gpt-5.4': 128000,
+	// exact ids
+	'claude-opus-5': 1000000, 'claude-opus-4-8': 1000000, 'claude-opus-4-7': 1000000,
+	'claude-sonnet-5': 1000000, 'claude-sonnet-4-6': 1000000, 'claude-sonnet-4': 200000,
+	'claude-haiku-4-5': 200000, 'gpt-5.4': 128000, 'gpt-5.6-luna': 128000,
+	// family keys
+	'claude-opus': 1000000, 'claude-sonnet': 1000000, 'claude-haiku': 200000,
+	'gpt-5.6': 128000, 'gpt-5': 128000,
 };
+
+// Context windows reported by a provider's own models listing, keyed by model id.
+// Anthropic's GET /v1/models returns `max_input_tokens` per model, which is the
+// authoritative context window; OpenAI's listing carries no equivalent field, so
+// OpenAI models resolve from the table above. Populated by
+// registerModelContextWindows() when a client fetches its model list.
+var apiReportedContextWindows: Record<string, number> = {};
+
+/**
+ * Record context windows from a provider models listing. Accepts the raw list
+ * items and reads `max_input_tokens` (Anthropic); items without it are skipped,
+ * so passing an OpenAI listing is a no-op rather than an error.
+ */
+export function registerModelContextWindows(models: Array<{ id?: string; max_input_tokens?: number }> | null | undefined): void {
+	if (!Array.isArray(models)) return;
+	for (var i = 0; i < models.length; i++) {
+		var m = models[i];
+		var id = (m && m.id ? String(m.id) : '').trim().toLowerCase();
+		var reported = m ? Number(m.max_input_tokens) : NaN;
+		if (id && Number.isFinite(reported) && reported > 0) {
+			apiReportedContextWindows[id] = Math.floor(reported);
+		}
+	}
+}
+
+/** Per-project override, keyed by service id. Set from the project settings. */
+var projectContextWindows: Record<string, number> = {};
+
+export function setProjectContextWindow(serviceId: string, tokens: number | null | undefined): void {
+	var key = (serviceId || '').trim();
+	if (!key) return;
+	var n = Number(tokens);
+	if (Number.isFinite(n) && n > 0) projectContextWindows[key] = Math.floor(n);
+	else delete projectContextWindows[key];
+}
+
+export function getProjectContextWindow(serviceId: string): number | null {
+	var key = (serviceId || '').trim();
+	return key && projectContextWindows[key] ? projectContextWindows[key] : null;
+}
 export var OUTPUT_TOKEN_RESERVE = 22000;
 export var TOOL_AND_RESPONSE_BUFFER = 4000;
 export var MIN_INPUT_TOKEN_BUDGET = 8000;
 export var CLAUDE_PER_REQUEST_INPUT_CAP = 28000;
 export var MAX_HISTORY_MESSAGES = 20;
 export var HISTORY_TOKEN_BUDGET = 8000;
+// Ratios that scale the two ceilings above off the resolved context window.
+// Calibrated to reproduce the previous fixed values at the default windows:
+// claude 200000 -> cap 27840 (was 28000, so the 28000 floor holds), and
+// openai 128000 -> history 8160 (~the previous 8000). Both are floored at the
+// old constants, so these can only ever raise a budget, never lower one.
+export var CLAUDE_INPUT_CAP_RATIO = 0.16;
+export var HISTORY_BUDGET_RATIO = 0.08;
 
 export function estimateTextTokens(text: string): number {
 	return Math.ceil((text || '').length / 3);
@@ -25,9 +86,34 @@ export function estimateMessageTokens(msg: { role: string; content: string }): n
 	return estimateTextTokens(msg.content) + estimateTextTokens(msg.role) + 6;
 }
 
-export function getContextWindow(platform: string, model?: string): number {
+/**
+ * Resolve a model's context window, most specific source first:
+ *   1. per-project override (project settings)
+ *   2. the provider's own models listing (Anthropic `max_input_tokens`)
+ *   3. an exact entry in CONTEXT_WINDOW_BY_MODEL
+ *   4. a family entry, by dropping trailing '-' segments off the id
+ *   5. the platform default
+ *
+ * Step 4 is why a new or suffixed id no longer drops straight to the platform
+ * default: 'gpt-5.6-luna' resolves via 'gpt-5.6', and a dated Claude snapshot
+ * such as 'claude-opus-4-7-20260101' resolves via 'claude-opus-4-7'. The walk
+ * stops at the first hit, so a more specific entry always wins over its family.
+ */
+export function getContextWindow(platform: string, model?: string, serviceId?: string): number {
+	var override = serviceId ? getProjectContextWindow(serviceId) : null;
+	if (override) return override;
+
 	var normalized = (model || '').trim().toLowerCase();
-	if (normalized && CONTEXT_WINDOW_BY_MODEL[normalized]) return CONTEXT_WINDOW_BY_MODEL[normalized];
+	if (normalized) {
+		if (apiReportedContextWindows[normalized]) return apiReportedContextWindows[normalized];
+		if (CONTEXT_WINDOW_BY_MODEL[normalized]) return CONTEXT_WINDOW_BY_MODEL[normalized];
+
+		var parts = normalized.split('-');
+		for (var end = parts.length - 1; end > 0; end--) {
+			var family = parts.slice(0, end).join('-');
+			if (CONTEXT_WINDOW_BY_MODEL[family]) return CONTEXT_WINDOW_BY_MODEL[family];
+		}
+	}
 	return CONTEXT_WINDOW_DEFAULT[platform];
 }
 
@@ -46,14 +132,34 @@ export type BoundedChatOptions = {
 };
 
 export function buildBoundedChatMessages(options: BoundedChatOptions) {
-	var contextWindow = getContextWindow(options.platform, options.model);
+	var contextWindow = getContextWindow(options.platform, options.model, options.serviceId);
 	var contextBasedBudget = Math.max(MIN_INPUT_TOKEN_BUDGET,
 		contextWindow - OUTPUT_TOKEN_RESERVE - TOOL_AND_RESPONSE_BUFFER);
+	// Scaling is gated on an EXPLICIT per-project window set from project
+	// settings. Without one, the fixed ceilings apply exactly as before, so every
+	// existing project keeps byte-identical behavior and nobody's token spend
+	// moves because a table value was corrected. With one, the Claude per-request
+	// cap and the history budget scale off the window, so raising it genuinely
+	// sends more history instead of being absorbed by a hardcoded ceiling.
+	// Both derive from contextBasedBudget (pre-Claude-cap) so the two platforms
+	// scale symmetrically rather than the Claude cap compounding the ratio down.
+	var scaled = !!(options.serviceId && getProjectContextWindow(options.serviceId));
+	var claudeInputCap = scaled
+		? Math.max(CLAUDE_PER_REQUEST_INPUT_CAP, Math.round(contextBasedBudget * CLAUDE_INPUT_CAP_RATIO))
+		: CLAUDE_PER_REQUEST_INPUT_CAP;
 	var availableInputBudget = options.platform === 'claude'
-		? Math.min(contextBasedBudget, CLAUDE_PER_REQUEST_INPUT_CAP) : contextBasedBudget;
+		? Math.min(contextBasedBudget, claudeInputCap) : contextBasedBudget;
 	var systemCost = estimateTextTokens(options.systemPrompt) + 12;
-	var budgetForHistory = Math.max(1000, Math.min(HISTORY_TOKEN_BUDGET, availableInputBudget - systemCost));
-	var windowed = options.history.slice(-MAX_HISTORY_MESSAGES);
+	var historyAllowance = scaled
+		? Math.max(HISTORY_TOKEN_BUDGET, Math.round(contextBasedBudget * HISTORY_BUDGET_RATIO))
+		: HISTORY_TOKEN_BUDGET;
+	var budgetForHistory = Math.max(1000, Math.min(historyAllowance, availableInputBudget - systemCost));
+	// The message count scales alongside the token budget; otherwise 20 messages
+	// is a second ceiling that swallows the extra budget on a raised window.
+	var maxHistoryMessages = scaled
+		? Math.max(MAX_HISTORY_MESSAGES, Math.round(MAX_HISTORY_MESSAGES * (budgetForHistory / HISTORY_TOKEN_BUDGET)))
+		: MAX_HISTORY_MESSAGES;
+	var windowed = options.history.slice(-maxHistoryMessages);
 	var latestIndex = windowed.length - 1;
 	var trimmed = windowed.map(function (m, i) {
 		if (i === latestIndex) return m;

package/src/engine/history.ts

@@ -40,6 +40,46 @@ export function extractLastUserTextFromRequest(requestBody: any): string {
 	return '';
 }
 
+/** The two openings an indexing prompt can have. A bg-queue item that starts with
+ *  neither is an ordinary chat that happened to be routed onto that queue. */
+export function isIndexingRequestText(userText: any): boolean {
+	if (typeof userText !== 'string') return false;
+	return userText.indexOf('A new file has just been uploaded') === 0 || userText.indexOf('CONTINUE indexing') === 0;
+}
+
+export type IndexingRequestRef = {
+	name: string;
+	path?: string;
+	mime?: string;
+	size?: number;
+	/** A CONTINUE pass rather than the run's first. */
+	continued: boolean;
+};
+
+/**
+ * The file an indexing prompt is about, read back out of the prompt itself.
+ *
+ * The prompt is the only description of the pass that survives on the server, so
+ * this is how BOTH a history rebuild and a worker-minted pass the client never
+ * dispatched (ChatSession._adoptWorkerIndexingPasses) recover the file. Shared so
+ * the two produce the same `_indexFile`, which is what makes them group together.
+ */
+export function parseIndexingRequestText(userText: any): IndexingRequestRef | null {
+	if (typeof userText !== 'string' || !userText) return null;
+	var nameMatch = userText.match(/^- name: (.+)$/m);
+	if (!nameMatch) return null;
+	var mimeMatch = userText.match(/^- mime type: (.+)$/m);
+	var sizeMatch = userText.match(/^- size \(bytes\): (\d+)$/m);
+	var pathMatch = userText.match(/^- storage path: (.+)$/m);
+	return {
+		name: nameMatch[1].trim(),
+		path: pathMatch ? pathMatch[1].trim() : undefined,
+		mime: mimeMatch ? mimeMatch[1].trim() : undefined,
+		size: sizeMatch ? Number(sizeMatch[1]) : undefined,
+		continued: userText.indexOf('CONTINUE indexing') === 0,
+	};
+}
+
 export type MapHistoryOptions = {
 	clearedAt: number;
 	serviceId: string;
@@ -64,6 +104,13 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 		var assistantText = isPending ? '' : ((extractAssistantText(response) || '').trim() || '');
 		var isErrorResponse = !isPending && (isFailed || isErrorResponseBody(response));
 		var serverItemId = item && typeof item.id === 'string' && item.id ? item.id : undefined;
+		// A USER bubble shows when the request was made (`created`); an ASSISTANT
+		// bubble shows when its response landed (`updated`). Fall back to the other
+		// if one is missing (older records only carried `updated`).
+		var createdTs = Number(item && item.created);
+		var updatedTs = Number(item && item.updated);
+		var userTs = isFinite(createdTs) && createdTs > 0 ? createdTs : (isFinite(updatedTs) && updatedTs > 0 ? updatedTs : undefined);
+		var replyTs = isFinite(updatedTs) && updatedTs > 0 ? updatedTs : (isFinite(createdTs) && createdTs > 0 ? createdTs : undefined);
 
 		if (userText) {
 			var displayContent;
@@ -71,31 +118,21 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 			// alongside the formatted label so grouping never has to parse it back.
 			var indexFile: any = undefined;
 			if (item._isBgTask) {
-				var nameMatch = userText.match(/^- name: (.+)$/m);
-				if (nameMatch) {
-					var mimeMatch = userText.match(/^- mime type: (.+)$/m);
-					var sizeMatch = userText.match(/^- size \(bytes\): (\d+)$/m);
-					var pathMatch = userText.match(/^- storage path: (.+)$/m);
+				var ref = parseIndexingRequestText(userText);
+				if (ref) {
 					// A CONTINUE pass ("CONTINUE indexing …") gets the compact
 					// continuation label; a first pass ("A new file …") gets the full
 					// one. Mirrors agent.vue's mapHistoryListToMessages so a big file's
 					// windows read as progress, not the same task repeating.
-					var isContinuePass = userText.indexOf('CONTINUE indexing') === 0;
 					displayContent = opts.formatIndexingLabel(
-						nameMatch[1].trim(),
-						mimeMatch ? mimeMatch[1].trim() : '',
-						sizeMatch ? Number(sizeMatch[1]) : null,
-						pathMatch ? pathMatch[1].trim() : undefined,
+						ref.name,
+						ref.mime || '',
+						typeof ref.size === 'number' ? ref.size : null,
+						ref.path,
 						false,
-						isContinuePass
+						ref.continued
 					);
-					indexFile = {
-						name: nameMatch[1].trim(),
-						path: pathMatch ? pathMatch[1].trim() : undefined,
-						mime: mimeMatch ? mimeMatch[1].trim() : undefined,
-						size: sizeMatch ? Number(sizeMatch[1]) : undefined,
-						continued: isContinuePass,
-					};
+					indexFile = ref;
 				} else {
 					displayContent = userText;
 				}
@@ -110,6 +147,7 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 			if (indexFile) userMsg._indexFile = indexFile;
 			if (item._isOnBgQueue) userMsg._useBgQueue = true;
 			if (serverItemId !== undefined) userMsg._serverItemId = serverItemId;
+			if (userTs !== undefined) userMsg._ts = userTs;
 			mapped.push(userMsg);
 		}
 		if (isCancelledItem) { /* no assistant bubble */ }
@@ -123,6 +161,7 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 			var em: any = { role: 'assistant', content: getErrorMessage(response), isError: true };
 			if (item._isBgTask) em.isBackgroundTask = true;
 			if (serverItemId !== undefined) em._serverItemId = serverItemId;
+			if (replyTs !== undefined) em._ts = replyTs;
 			mapped.push(em);
 		} else if (assistantText) {
 			// Safe db-only sanitize (forAssistant) so a volatile db url the model
@@ -130,6 +169,7 @@ export function mapHistoryListToMessages(list: any[], platform: 'claude' | 'open
 			var okm: any = { role: 'assistant', content: sanitizeAttachmentLinksForHistory(assistantText, opts.serviceId, true) };
 			if (item._isBgTask) okm.isBackgroundTask = true;
 			if (serverItemId !== undefined) okm._serverItemId = serverItemId;
+			if (replyTs !== undefined) okm._ts = replyTs;
 			mapped.push(okm);
 		}
 	});

package/src/engine/host.ts

@@ -67,6 +67,12 @@ export interface ChatMessage {
 	_localId?: string;
 	_cancelling?: boolean;
 	_cancelError?: string;
+	/** Epoch ms shown as small text under the bubble. From the request history a
+	 *  USER bubble carries the request's `created` time and an ASSISTANT bubble the
+	 *  `updated` (response) time; a live bubble is stamped with the wall clock when
+	 *  it is created, then reconciled to the server value on the next history load.
+	 *  Absent while a turn is still pending, so no time shows on a "Thinking" bubble. */
+	_ts?: number;
 	// History cache key (`serviceId#platform`) this bubble was created under.
 	// Stamped on LOCALLY-created bubbles only (the optimistic user message and
 	// its "Thinking..." placeholder); server-mapped bubbles are identified by

package/src/engine/index.ts

@@ -46,11 +46,20 @@ export * from './prompts';
 export { getErrorMessage, isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError } from './errors';
 export * from './budget';
 export * from './links';
+export * from './time';
+export * from './ai_agent';
 export {
 	filterListByClearHorizon,
 	normalizeTextContent,
 	extractLastUserTextFromRequest,
 	mapHistoryListToMessages,
+	// The indexing-prompt reader. Exported because the prompt is the only record
+	// of what a pass is about, so anything that meets a pass without a bubble
+	// (a history rebuild, an adopted worker pass, agent.vue's own mapper) has to
+	// read it the same way or the two will not group together.
+	isIndexingRequestText,
+	parseIndexingRequestText,
+	type IndexingRequestRef,
 	type MapHistoryOptions,
 } from './history';
 

package/src/engine/indexing_groups.ts

@@ -7,12 +7,34 @@
  * repeating forever, and any real question the user asks in between gets buried.
  *
  * buildChatDisplayList turns the flat message array into a DISPLAY list in which
- * every message belonging to one file (however far apart they sit, and whatever
- * else is interleaved between them) is represented by a single group entry,
- * rendered at the position of that file's NEWEST turn. Newest, not oldest, so:
- *   - a running index sits at the bottom, where the activity is, and
- *   - paging older history in never moves a row that is already on screen
- *     (older passes simply join the group they already belong to).
+ * every message belonging to one run of one file (however far apart the passes
+ * sit, and whatever else is interleaved between them) is represented by a single
+ * group entry, rendered at the position of that run's FIRST loaded pass.
+ *
+ * First, not newest. The message array is ordered by request CREATION time, and
+ * a run's later passes are created one at a time as the previous one resolves —
+ * by the client for the paged text path, and by the WORKER itself for the
+ * rendered-page (PDF) path, which the client only learns about on its next
+ * first-page history fetch. So a pass is routinely created minutes after the
+ * upload, on a queue that runs in parallel with the foreground chat. Anchoring
+ * at the newest pass meant one such late pass dragged the whole run — every
+ * earlier pass with it — below any question the user had asked in the meantime,
+ * and made a run that had visibly finished before the question render after it.
+ * Anchoring at the first pass puts the row where the run actually began, which
+ * is a position no later pass can change:
+ *   - a new pass never relocates the row, so nothing under the reader shifts;
+ *   - a question asked after the upload always renders below the row, which is
+ *     the order it happened in.
+ * The cost is that a long-running index does not follow the conversation to the
+ * bottom: once the user has chatted past the upload, the spinner and the Stop
+ * button sit above their newest turns. That is a scroll away, and the row no
+ * longer lies about when the work started.
+ *
+ * Paging older history is the one thing that CAN move the row: an older page
+ * carrying earlier passes of a run already on screen moves it up into that page.
+ * That happens at most once per run, only for a run whose start was never
+ * loaded (`mayHaveOlder`), and it is the same event that already re-derives
+ * `runKey` — so the view treats it as a new row either way.
  *
  * The group deliberately reports no authoritative pass TOTAL. History is paged
  * newest-first, so any total computed from loaded messages is a lower bound that
@@ -37,9 +59,10 @@ export type IndexingGroup = {
 	 *  Monday and re-indexed on Wednesday is two runs, and collapsing them into
 	 *  one row erased Monday's from Monday's place in the conversation, claimed
 	 *  its passes for Wednesday, and let Monday's failure be overwritten by
-	 *  Wednesday's success. Numbered from the NEWEST run backwards (`#0` is the
-	 *  newest) so paging in older history never renames a row already on screen.
-	 *  This is the render key and the expansion key. */
+	 *  Wednesday's success. Named after the run's FIRST loaded pass (see where it
+	 *  is assigned below), so passes appended to the run and other runs appearing
+	 *  on either side of it never rename a row already on screen. This is the
+	 *  render key and the expansion key. */
 	runKey: string;
 	name: string;
 	path?: string;
@@ -65,8 +88,16 @@ export type IndexingGroup = {
 	/** The file's first pass is not among the loaded messages, so earlier passes
 	 *  exist in history that has not been paged in yet. */
 	mayHaveOlder: boolean;
-	/** Position in the source array this collapsed row renders at. */
+	/** Position in the source array this collapsed row renders at: the index of
+	 *  the run's FIRST loaded pass (see the file docstring for why not the last). */
 	anchorIndex: number;
+	/** Identity of the turn at `anchorIndex` — its server item id, or its local id
+	 *  while it has none, or `''` when it has neither. The views stamp this on the
+	 *  row (`data-row-pos`) so the scroll anchor can tell a row that RELOCATED (an
+	 *  older page moved the run's start) from one that merely gained a pass. They
+	 *  must not re-derive it from `members`: which member the row renders at is
+	 *  this module's decision, and the two silently disagreed once already. */
+	anchorId: string;
 };
 
 export type DisplayEntry =
@@ -230,7 +261,10 @@ export function buildChatDisplayList(
 				cancellableIds: [],
 				cancelling: false,
 				mayHaveOlder: false,
+				// The run's first loaded pass, and never re-stamped: see the file
+				// docstring. `anchorId` is filled in once every member is known.
 				anchorIndex: i,
+				anchorId: '',
 			};
 			order.push(runId);
 		}
@@ -246,7 +280,6 @@ export function buildChatDisplayList(
 			g.passCount++;
 		}
 		g.members.push({ msg: msg, index: i });
-		g.anchorIndex = i;
 		runOfIndex[i] = runId;
 		if (msg._serverItemId) runByItemId[msg._serverItemId] = runId;
 		if (ref && ref.name) keyByName[ref.name] = g.key;
@@ -334,6 +367,12 @@ export function buildChatDisplayList(
 			if (pref && !pref.continued) { sawFirstPass = true; break; }
 		}
 		grp.mayHaveOlder = !sawFirstPass && hasMoreHistory;
+		// Where the row renders, and WHICH turn that is. Derived from the same
+		// member so the two can never drift apart; a group always has a member
+		// (it is created by the first one).
+		var anchor = grp.members[0];
+		grp.anchorIndex = anchor.index;
+		grp.anchorId = anchor.msg._serverItemId || anchor.msg._localId || '';
 	}
 
 	var out: DisplayEntry[] = [];

package/src/engine/links.ts

@@ -183,6 +183,33 @@ export function repairUrlWhitespace(href: string): string {
 	return href.trim().replace(/\s/g, '%20');
 }
 
+/**
+ * A model reproducing a URL sometimes HTML-escapes its `&` query separators as
+ * `&` (or the numeric `&` / `&`). Left in the href that escaping
+ * survives the client's own escapeAttr -> v-html/innerHTML decode round-trip and
+ * reaches the browser LITERALLY, so a presigned S3 URL is navigated with its
+ * parameters named `amp;Signature`, `amp;Expires`, `amp;response-content-type`,
+ * ... — the real params vanish, the signature can't be located, and S3 rejects
+ * it (the "링크가 안되" dead export link). Undo just that entity escaping.
+ *
+ * This is a no-op on a clean URL: a valid link carries a raw `&` between params
+ * and percent-encodes (`%26`) any literal ampersand that is data, so a real URL
+ * never contains `&` to begin with. Mirrors repairUrlWhitespace: it repairs
+ * model damage, not the URL. The loop collapses a doubly-escaped `&` too.
+ */
+export function repairUrlEntities(href: string): string {
+	if (!href || href.indexOf('&') === -1) return href;
+	var out = href, prev = '';
+	while (out !== prev) {
+		prev = out;
+		out = out
+			.replace(/&/gi, '&')
+			.replace(/&#0*38;/g, '&')
+			.replace(/&#x0*26;/gi, '&');
+	}
+	return out;
+}
+
 /**
  * Trim punctuation and unmatched wrappers that cling to a token in prose.
  * `src::a/b.pdf).` -> `src::a/b.pdf`, while a balanced `file (v2).pdf` is kept.
@@ -280,8 +307,11 @@ export function classifyInlineLink(
 		// source into the storage-path branch, where it became a chip pointing at
 		// this project for someone else's file.
 		if (srcIsUrl && !isDbHost(rawPath) && !readExpiredAttachmentHref(rawPath)) {
+			// decode any model-introduced `&` in the URL (tail stays keyed on
+			// the raw match length, so it is left untouched)
+			var srcUrl = repairUrlEntities(rawPath);
 			return {
-				part: { type: 'link', label: truncateLabelForDisplay(rawPath), fullLabel: rawPath, href: rawPath, expired: false },
+				part: { type: 'link', label: truncateLabelForDisplay(srcUrl), fullLabel: srcUrl, href: srcUrl, expired: false },
 				tail: tail,
 			};
 		}
@@ -337,6 +367,10 @@ export function classifyInlineLink(
 	// [label](url) and bare urls.
 	var originalHref = g3 || g6 || '';
 	if (!originalHref) return null;
+	// A model that reproduces the URL may have HTML-escaped its `&` separators;
+	// decode them now so every downstream check and the final href see a clean
+	// URL (otherwise a presigned link navigates with `&` and 403s).
+	originalHref = repairUrlEntities(originalHref);
 	// A bare url swallows the punctuation that ends the sentence it sits in, so
 	// `see https://host/a.pdf.` linked to `a.pdf.` and 404'd. Trim it and hand the
 	// trimmed text back as `tail`, exactly as the src:: branch does.

package/src/engine/prompts/chat_system_prompt.ts

@@ -26,6 +26,9 @@ export function buildChatSystemPrompt(params: ChatSystemPromptParams): string {
 You are a dedicated assistant for the project ID: "${formattedServiceId}".
 Scope: Only answer questions about this project and its data. Do not answer questions about other projects or topics unrelated to this project. When the user refers to "my database", "my data", or "my files", treat those as references to this project's database and file storage.
 Knowledge lookup: Before saying you don't know or that something isn't in the chat history, ALWAYS query this project's database through the available MCP tools to look for the answer. The user's data is the source of truth - the chat transcript is not. Only respond with "I don't know" or "I couldn't find that" after you have actually searched the project's data and come back empty.
+Complete answers over stored data: The database holds one record per spreadsheet row, and each uploaded file becomes many records that usually share a table. So a question about the data almost always spans many records across several files. For any request that counts, sums, totals, lists every match, compares across records, finds which one, or asks whether something is present or ABSENT (for example "how many", "total spent", "which card", "is there any", "없어?", "하나도 없나?"), you MUST read the COMPLETE matching set before answering. Query with fetch_all set to true, or page through getToolResponsePage until pagination.complete is true, across EVERY relevant table and EVERY relevant file. A single default query returns only the first page (about 50 records). That is a SAMPLE. Never treat it as the whole dataset.
+Never assert absence from a partial read. Do not say "there is no X", "none", "not found", or "아니요, 없습니다" until a complete scan has come back empty. If you have not finished scanning every relevant table and file, keep querying instead of guessing. A confident "no" that later turns out wrong is worse than telling the user you are still checking.
+Embedded values: a search term is often stored inside a larger string. A merchant "GODADDY" appears as "DNH*GODADDY#4070277042", and a card as "4140****2941". Server-side index and tag filters match only exact values or leading prefixes, not substrings, so filtering on such a field silently drops rows. When the value you are looking for may be embedded, do not trust a narrow filter to be complete. Fetch the full set with fetch_all and match the substring yourself.
 File attachments: When a user message contains an "Attached files:" section with markdown links, those links point to short-lived signed URLs in this project's db storage and will expire.
 - Image files (.jpg, .jpeg, .png, .gif, .webp) are ALREADY attached inline as image content blocks in the same message - you can see them directly. Do NOT call web_fetch on image URLs; that will fail or return garbage. Just look at the image block and answer.
 - Most attached files (office documents like .docx/.xlsx/.pptx/.hwp/.hwpx/.ods, and text/data/code files like .csv/.tsv/.json/.xml/.txt/.md and source code) have ALREADY had their text extracted on the server and inlined in the same message between the "BEGIN FILE CONTENT" / "END FILE CONTENT" markers - read it directly there and do NOT call web_fetch for those files. A "[skapi: ...]" note in that block means the file could not be extracted.

package/src/engine/requests.ts

@@ -833,8 +833,16 @@ export const INDEXING_COMPLETE_MARKER = 'INDEXING_COMPLETE';
 // a small cap suffices.
 export const MAX_INDEXING_RESUME_PASSES = 6;
 
+/**
+ * `queue` narrows the fetch to one processing chain; `status` narrows it to items
+ * in one state. Passing both is how the client asks "is there still unresolved
+ * work on the background-indexing queue?" without pulling a page of chat history
+ * (see ChatSession._adoptWorkerIndexingPasses) — the server answers that from a
+ * status-keyed index, so the reply carries only the live items, not the bodies of
+ * everything already finished.
+ */
 export async function getChatHistory(
-	params: { service?: string; owner?: string; platform: 'claude' | 'openai'; queue?: string },
+	params: { service?: string; owner?: string; platform: 'claude' | 'openai'; queue?: string; status?: 'pending' | 'running' | 'resolved' | 'failed' },
 	fetchOptions: Record<string, any>,
 ) {
 	const url =
@@ -848,10 +856,11 @@ export async function getChatHistory(
 		},
 		{ service: params.service, owner: params.owner },
 		params.queue ? { queue: params.queue } : {},
+		params.status ? { status: params.status } : {},
 	);
 
 	return chatEngineConfig().clientSecretRequestHistory(
-		p as { url: string; method: 'POST'; queue?: string },
+		p as { url: string; method: 'POST'; queue?: string; status?: string },
 		Object.assign({ ascending: false }, fetchOptions),
 	);
 }