bunnyquery 1.9.1 → 1.9.5

package/src/engine/session.ts

@@ -46,7 +46,7 @@ import { isErrorResponseBody, isAuthExpiredError, isNonRetryableRequestError, ge
 import { buildBoundedChatMessages } from './budget';
 import { createInlineLinkRegex, sanitizeAttachmentLinksForHistory } from './links';
 import { markImagePreviewStale } from './image_preview';
-import { mapHistoryListToMessages, extractLastUserTextFromRequest, isIndexingRequestText, parseIndexingRequestText, probeBgQueue, BG_PROBE_TTL_MS, getSplitChatHistory, shouldRescueInFlightMessage } from './history';
+import { chatCacheKey, indexScopeKey, mapHistoryListToMessages, extractLastUserTextFromRequest, isIndexingRequestText, parseIndexingRequestText, probeBgQueue, BG_PROBE_TTL_MS, getSplitChatHistory, shouldRescueInFlightMessage } from './history';
 import { wallClockNow } from './time';
 import { parseAttachmentContent } from './attachment_parsers';
 import type { ChatHost, ChatState, ChatMessage, ChatIdentity, PinnedDispatchContext } from './host';
@@ -325,7 +325,8 @@ export class ChatSession {
 	/** Storage paths are project-relative, and one ChatSession serves every
 	 *  project, so a claim has to be scoped the way a stop is (_indexKeyOf). */
 	private _indexClaimKey(storagePath: string): string {
-		return this.getHistoryCacheKey() + '|' + storagePath;
+		var id = this.host.getIdentity();
+		return indexScopeKey(id.projectId, id.platform) + '|' + storagePath;
 	}
 
 	/**
@@ -798,10 +799,22 @@ export class ChatSession {
 		return 'lid_' + this._lidSeq;
 	}
 
+	/**
+	 * The key every per-chat cache hangs off: the restored message cache, the
+	 * hydrated-body memo, the live-index key and the per-file storage-path key.
+	 *
+	 * It carries the IDENTITY as well as the project and platform. A single
+	 * browser can hold more than one conversation on one project without a
+	 * reload — an anonymous visitor who signs in, or a dashboard user who logs
+	 * out and back in as someone else — and with an identity-free key the
+	 * previous conversation stayed in the cache and was re-rendered, and written
+	 * back, as the new one's. `userId` is the same value the request queue is
+	 * named after, so two identities that share a queue share a cache, which is
+	 * exactly right.
+	 */
 	getHistoryCacheKey(): string {
 		var id = this.host.getIdentity();
-		if (!id.projectId || id.platform === 'none') return '';
-		return id.projectId + '#' + id.platform;
+		return chatCacheKey(id.projectId, id.platform, id.userId);
 	}
 
 	// ─── compact-stub hydration ─────────────────────────────────────────────
@@ -1059,9 +1072,17 @@ export class ChatSession {
 			if (projectId === undefined) projectId = id.projectId;
 			if (owner === undefined) owner = id.owner;
 		}
+		// Read LIVE, unlike projectId/owner above, and deliberately: this decides
+		// which MCP endpoint the turn's tools point at, and a retry after the
+		// visitor signed in should use the authenticated one rather than the
+		// project-scoped anonymous route it was composed under. Getting it wrong
+		// costs a failed turn, never a wider read: the anonymous route is
+		// read-only and public-records-only whoever calls it.
+		var liveId = this.host.getIdentity();
+		var mcpScope = { anonymous: liveId.anonymous, publicProjectId: liveId.publicProjectId };
 		return platform === 'openai'
-			? callOpenAIWithPublicMcp(prompt, projectId, owner, messages, system, model, userId, extractContent, fileUrls)
-			: callClaudeWithPublicMcp(prompt, projectId, owner, messages, system, model, userId, extractContent, fileUrls);
+			? callOpenAIWithPublicMcp(prompt, projectId, owner, messages, system, model, userId, extractContent, fileUrls, undefined, undefined, mcpScope)
+			: callClaudeWithPublicMcp(prompt, projectId, owner, messages, system, model, userId, extractContent, fileUrls, undefined, undefined, mcpScope);
 	}
 
 	dispatchAgentRequest(params: any) {
@@ -1461,7 +1482,7 @@ export class ChatSession {
 		// getIdentity()/getHistoryCacheKey() to the new project) can't
 		// misattribute this turn's bubbles to that project.
 		// (platform === 'none' already returned above, so projectId is the only gate)
-		var key = !id.projectId ? '' : id.projectId + '#' + id.platform;
+		var key = chatCacheKey(id.projectId, id.platform, id.userId);
 		// True when the pinned chat is NOT the one currently on screen. Then
 		// state.messages belongs to a different project and MUST NOT be touched:
 		// the turn is staged in the pinned chat's cache instead and shows up when
@@ -2138,7 +2159,8 @@ export class ChatSession {
 		if (!group || !group.key) return;
 		// The group belongs to the chat on screen, so scope its key the same way
 		// _indexKeyOf scopes a queued task's.
-		var scoped = this.getHistoryCacheKey() + '|' + group.key;
+		var idn = this.host.getIdentity();
+		var scoped = indexScopeKey(idn.projectId, idn.platform) + '|' + group.key;
 		this.cancelledIndexKeys.add(scoped);
 		// Remember WHICH RUN was stopped, by the ids of the passes it is made of.
 		// Everything else here stops the work without leaving any mark on the
@@ -2688,7 +2710,7 @@ export class ChatSession {
 		if (!entry) return '';
 		var file = entry.storagePath || entry.filename;
 		if (!file) return '';
-		return entry.projectId + '#' + entry.platform + '|' + file;
+		return indexScopeKey(entry.projectId, entry.platform) + '|' + file;
 	}
 
 	/**
@@ -3414,7 +3436,7 @@ export class ChatSession {
 		// request is built from. The rescue below compares against this rather
 		// than a live getHistoryCacheKey(), so a project switch mid-fetch can't
 		// make another chat's in-flight bubbles look local.
-		var loadKey = (!id.projectId || id.platform === 'none') ? '' : id.projectId + '#' + id.platform;
+		var loadKey = chatCacheKey(id.projectId, id.platform, id.userId);
 		if (token === undefined) token = this.state.gateRefreshToken;
 		if ((this.state.loadingHistory && this.state.historyRequestToken === token) || id.platform === 'none' || !id.projectId) {
 			return Promise.resolve();
@@ -3443,7 +3465,16 @@ export class ChatSession {
 		// stubs, tiled to the surface page's time window with module-level
 		// state (buffering + retry safety) — see getSplitChatHistory. Returns
 		// the exact single-fetch shape; startKeyHistory is bookkeeping only.
-		var fetchHistory = function () { return getSplitChatHistory({ service: projectId, owner: owner, platform: platform, userId: id.userId }, options); };
+		var fetchHistory = function () {
+			return getSplitChatHistory({
+				service: projectId, owner: owner, platform: platform, userId: id.userId,
+				// An anonymous visitor's history is scoped server side by
+				// ip + "(" + user_agent + ")", which two devices behind one NAT
+				// share. Read this device's own queue instead. See
+				// scopeSurfaceToQueue.
+				scopeSurfaceToQueue: !!id.anonymous,
+			}, options);
+		};
 
 		return Promise.resolve().then(fetchHistory).catch(function (err: any) {
 			if (isAuthExpiredError(err) && !isNonRetryableRequestError(err)) return self.host.refreshSession().then(fetchHistory);
@@ -3468,6 +3499,10 @@ export class ChatSession {
 			var mapped = mapHistoryListToMessages(list, platform, {
 				clearedAt: self.host.getClearedAt(),
 				projectId: id.projectId,
+				// So the `_ownerKey` stamped on server history matches loadKey and
+				// the cache key. Without it every mapped bubble carries a
+				// two-segment stamp that no comparison can ever match.
+				userId: id.userId,
 				formatIndexingLabel: self.host.formatIndexingLabel,
 			}).messages;
 			// Re-apply any previously-hydrated compact bodies: a refresh maps
@@ -3761,6 +3796,7 @@ export class ChatSession {
 					var m2 = mapHistoryListToMessages(sorted, platform, {
 						clearedAt: self.host.getClearedAt(),
 						projectId: id.projectId,
+						userId: id.userId,
 						formatIndexingLabel: self.host.formatIndexingLabel,
 					}).messages;
 					self.applyHydratedBodies(m2);
@@ -4071,6 +4107,17 @@ export class ChatSession {
 							size: member.file.size,
 						})).catch(function () { });
 					});
+					// The access group the host actually recorded this file at. Read
+					// AFTER ensureFileIndexRecord so the value here is the one the
+					// "src::" record really carries, never a second guess at it.
+					var accessGroup: 'public' | 'authorized' | 'private' | undefined;
+					preIndex = preIndex.then(function () {
+						if (alreadyIndexing) return;
+						if (typeof self.host.uploadAccessGroup !== 'function') return;
+						return Promise.resolve(self.host.uploadAccessGroup(member.storagePath))
+							.then(function (g) { accessGroup = g || undefined; })
+							.catch(function () { });
+					});
 					// Run a client-side attachment parser (e.g. .hwp) if one matches; its
 					// output is inlined into the indexing request (falls back to office
 					// extraction / web_fetch when no parser matches or it yields nothing).
@@ -4092,6 +4139,7 @@ export class ChatSession {
 						attachment: {
 							name: member.file.name, storagePath: member.storagePath,
 							mime: mime || undefined, size: member.file.size, url: url,
+							accessGroup: accessGroup,
 						},
 						parsedContent: parsedContent || undefined,
 					}).then(function (ack: any) {

package/src/widget.css

@@ -1013,6 +1013,39 @@
 }
 .bq-overwrite-applyall input { cursor: pointer; margin: 0; }
 
+/* Access-group chooser (who may read a file once it is indexed). A radio list
+   rather than a row of buttons: the three answers are not equally weighted and
+   the hint under each is what actually distinguishes them. */
+.bq-access-options {
+    display: flex;
+    flex-direction: column;
+    gap: 0.15rem;
+    margin: 0 0 1rem;
+}
+.bq-access-option {
+    display: grid;
+    grid-template-columns: auto 1fr;
+    align-items: baseline;
+    column-gap: 0.5rem;
+    padding: 0.5rem 0.6rem;
+    border: 1px solid transparent;
+    cursor: pointer;
+    user-select: none;
+}
+.bq-access-option:hover { background: var(--bq-hover-bg); }
+.bq-access-option input { cursor: pointer; margin: 0; }
+.bq-access-option-label {
+    font-size: 0.88rem;
+    color: var(--bq-ink);
+}
+.bq-access-option-hint {
+    grid-column: 2;
+    font-size: 0.76rem;
+    line-height: 1.35;
+    color: var(--bq-muted);
+    margin-top: 0.15rem;
+}
+
 /* ============================================================================
  * RESPONSIVE
  * ==========================================================================*/