conductor-oss 0.3.4 → 0.4.0

package/web/.next/standalone/packages/web/src/features/sessions/SessionPageClient.tsx

@@ -2,6 +2,7 @@
 
 import { useEffect, useMemo, useState } from "react";
 import { useParams, useRouter } from "next/navigation";
+import { useResponsiveSidebarState } from "@/hooks/useResponsiveSidebarState";
 import { AppShell } from "@/components/layout/AppShell";
 import { TopBar } from "@/components/layout/TopBar";
 import { WorkspaceSidebarPanel } from "@/components/layout/WorkspaceSidebarPanel";
@@ -16,16 +17,14 @@ export default function SessionPageClient() {
   const { projects } = useConfig();
   const { sessions, refresh } = useSessions();
   const dashboardSessions = sessions as unknown as DashboardSession[];
-  const [sidebarOpen, setSidebarOpen] = useState(true);
+  const {
+    mobileSidebarOpen,
+    desktopSidebarOpen,
+    toggleSidebar,
+    closeSidebarOnMobile,
+  } = useResponsiveSidebarState();
   const [selectedProjectId, setSelectedProjectId] = useState<string | null>(null);
 
-  useEffect(() => {
-    if (typeof window === "undefined") return;
-    if (window.innerWidth < 1024) {
-      setSidebarOpen(false);
-    }
-  }, []);
-
   const selectedSession = useMemo(
     () => dashboardSessions.find((session) => session.id === params.id) ?? null,
     [dashboardSessions, params.id],
@@ -52,14 +51,6 @@ export default function SessionPageClient() {
     }
   }, [projects, selectedProjectId, selectedSession?.projectId]);
 
-  const toggleSidebar = () => setSidebarOpen((prev) => !prev);
-
-  const closeSidebarOnMobile = () => {
-    if (typeof window !== "undefined" && window.innerWidth < 1024) {
-      setSidebarOpen(false);
-    }
-  };
-
   async function handleArchiveSession(sessionId: string) {
     let res = await fetch(`/api/sessions/${encodeURIComponent(sessionId)}/archive`, {
       method: "POST",
@@ -101,7 +92,8 @@ export default function SessionPageClient() {
 
   return (
     <AppShell
-      sidebarOpen={sidebarOpen}
+      mobileSidebarOpen={mobileSidebarOpen}
+      desktopSidebarOpen={desktopSidebarOpen}
       onToggleSidebar={toggleSidebar}
       sidebar={
         <WorkspaceSidebarPanel

package/web/.next/standalone/packages/web/src/hooks/useAgents.ts

@@ -5,6 +5,7 @@ import type { RuntimeAgentModelCatalog } from "@/lib/runtimeAgentModelsShared";
 
 export interface Agent {
   name: string;
+  label?: string;
   description: string;
   installed?: boolean;
   configured?: boolean;
@@ -13,6 +14,10 @@ export interface Agent {
   model?: string;
   homepage?: string;
   iconUrl?: string;
+  installHint?: string | null;
+  installUrl?: string | null;
+  setupUrl?: string | null;
+  version?: string | null;
   runtimeModelCatalog?: RuntimeAgentModelCatalog | null;
 }
 

package/web/.next/standalone/packages/web/src/hooks/usePreferences.ts

@@ -6,9 +6,8 @@ export interface UserPreferencesResponse {
   onboardingAcknowledged: boolean;
   codingAgent: string;
   ide: string;
-  remoteSshHost: string;
-  remoteSshUser: string;
   markdownEditor: string;
+  markdownEditorPath: string;
   notifications: {
     soundEnabled: boolean;
     soundFile: string | null;
@@ -33,15 +32,12 @@ function normalizePreferences(value: unknown): UserPreferencesResponse {
     ide: typeof payload["ide"] === "string" && payload["ide"].trim().length > 0
       ? payload["ide"].trim()
       : "vscode",
-    remoteSshHost: typeof payload["remoteSshHost"] === "string" && payload["remoteSshHost"].trim().length > 0
-      ? payload["remoteSshHost"].trim()
-      : "",
-    remoteSshUser: typeof payload["remoteSshUser"] === "string" && payload["remoteSshUser"].trim().length > 0
-      ? payload["remoteSshUser"].trim()
-      : "",
     markdownEditor: typeof payload["markdownEditor"] === "string" && payload["markdownEditor"].trim().length > 0
       ? payload["markdownEditor"].trim()
       : "obsidian",
+    markdownEditorPath: typeof payload["markdownEditorPath"] === "string"
+      ? payload["markdownEditorPath"].trim()
+      : "",
     notifications: {
       soundEnabled: notifications["soundEnabled"] !== false,
       soundFile: soundFileRaw === null

package/web/.next/standalone/packages/web/src/hooks/useResponsiveSidebarState.ts

@@ -0,0 +1,46 @@
+"use client";
+
+import { useCallback, useState } from "react";
+
+const DESKTOP_BREAKPOINT_PX = 1024;
+
+function isDesktopViewport(): boolean {
+  return typeof window !== "undefined" && window.innerWidth >= DESKTOP_BREAKPOINT_PX;
+}
+
+export function useResponsiveSidebarState() {
+  const [mobileSidebarOpen, setMobileSidebarOpen] = useState(false);
+  const [desktopSidebarOpen, setDesktopSidebarOpen] = useState(true);
+
+  const toggleSidebar = useCallback(() => {
+    if (isDesktopViewport()) {
+      setDesktopSidebarOpen((current) => !current);
+      return;
+    }
+
+    setMobileSidebarOpen((current) => !current);
+  }, []);
+
+  const closeSidebarOnMobile = useCallback(() => {
+    if (!isDesktopViewport()) {
+      setMobileSidebarOpen(false);
+    }
+  }, []);
+
+  const syncSidebarForViewport = useCallback(() => {
+    if (isDesktopViewport()) {
+      setDesktopSidebarOpen(true);
+      return;
+    }
+
+    setMobileSidebarOpen(false);
+  }, []);
+
+  return {
+    mobileSidebarOpen,
+    desktopSidebarOpen,
+    toggleSidebar,
+    closeSidebarOnMobile,
+    syncSidebarForViewport,
+  };
+}

package/web/.next/standalone/packages/web/src/hooks/useSessionFeed.ts

@@ -3,6 +3,7 @@
 import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import type { NormalizedChatEntry } from "@/lib/chatFeed";
 import { subscribeToSnapshotEvents } from "@/lib/liveEvents";
+import type { SessionRuntimeStatus } from "@/lib/sessionRuntimeStatus";
 import { TERMINAL_STATUSES, type SSESnapshotEvent } from "@/lib/types";
 const ACTIVE_POLL_INTERVAL_MS = 4_000;
 const HIDDEN_POLL_INTERVAL_MS = 15_000;
@@ -11,11 +12,13 @@ const TERMINAL_POLL_INTERVAL_MS = 30_000;
 interface SessionFeedResponse {
   entries?: NormalizedChatEntry[];
   sessionStatus?: string | null;
+  error?: string | null;
   parserState?: {
     kind?: string | null;
     message?: string | null;
     command?: string | null;
   } | null;
+  runtimeStatus?: SessionRuntimeStatus | null;
 }
 
 export interface SessionParserState {
@@ -30,6 +33,7 @@ interface UseSessionFeedResult {
   error: string | null;
   sessionStatus: string | null;
   parserState: SessionParserState | null;
+  runtimeStatus: SessionRuntimeStatus | null;
   refresh: () => Promise<void>;
 }
 
@@ -90,6 +94,11 @@ function normalizeParserState(value: SessionFeedResponse["parserState"]): Sessio
   return { kind, message, command };
 }
 
+function normalizeRuntimeStatus(value: SessionFeedResponse["runtimeStatus"]): SessionRuntimeStatus | null {
+  if (!value || typeof value !== "object") return null;
+  return value;
+}
+
 async function fetchFeed(sessionId: string): Promise<SessionFeedResponse> {
   const response = await fetch(`/api/sessions/${encodeURIComponent(sessionId)}/feed`, {
     cache: "no-store",
@@ -108,6 +117,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
   const [error, setError] = useState<string | null>(null);
   const [sessionStatus, setSessionStatus] = useState<string | null>(null);
   const [parserState, setParserState] = useState<SessionParserState | null>(null);
+  const [runtimeStatus, setRuntimeStatus] = useState<SessionRuntimeStatus | null>(null);
   const terminalRef = useRef(false);
   const mountedRef = useRef(true);
   const inFlightRef = useRef(false);
@@ -132,7 +142,17 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
       }
       return next;
     });
-    setError(null);
+    setRuntimeStatus((current) => {
+      const next = normalizeRuntimeStatus(payload.runtimeStatus);
+      if (JSON.stringify(current) === JSON.stringify(next)) {
+        return current;
+      }
+      return next;
+    });
+    const nextError = typeof payload.error === "string" && payload.error.trim().length > 0
+      ? payload.error.trim()
+      : null;
+    setError(nextError);
     setLoading(false);
   }, []);
 
@@ -143,6 +163,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
       setError(null);
       setSessionStatus(null);
       setParserState(null);
+      setRuntimeStatus(null);
       return;
     }
 
@@ -165,6 +186,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
           setEntries([]);
           setSessionStatus(null);
           setParserState(null);
+          setRuntimeStatus(null);
         }
         setError(message);
         setLoading(false);
@@ -185,6 +207,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
     setEntries([]);
     setSessionStatus(null);
     setParserState(null);
+    setRuntimeStatus(null);
     setError(null);
     setLoading(true);
     void refresh();
@@ -208,6 +231,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
     };
     window.addEventListener("focus", handleWindowFocus);
     document.addEventListener("visibilitychange", handleVisibilityChange);
+    let eventSource: EventSource | null = null;
 
     let pollTimeoutId: number | null = null;
 
@@ -233,6 +257,35 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
     };
 
     startPolling();
+    if (typeof EventSource !== "undefined") {
+      eventSource = new EventSource(
+        `/api/sessions/${encodeURIComponent(sessionId)}/feed/stream`,
+      );
+
+      eventSource.onmessage = (event) => {
+        if (!mountedRef.current) return;
+        try {
+          const payload = JSON.parse(event.data as string) as SessionFeedResponse;
+          applyPayload(payload);
+          startPolling();
+        } catch {
+          // Ignore malformed session feed events.
+        }
+      };
+
+      eventSource.addEventListener("refresh", () => {
+        if (!mountedRef.current) return;
+        void refresh();
+        startPolling();
+      });
+
+      eventSource.onerror = () => {
+        if (!mountedRef.current) return;
+        void refresh();
+        startPolling();
+      };
+    }
+
     const unsubscribe = subscribeToSnapshotEvents((payload: SSESnapshotEvent) => {
       if (!mountedRef.current) return;
       const matchingSession = payload.sessions.find((value) => value.id === sessionId);
@@ -256,6 +309,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
     return () => {
       mountedRef.current = false;
       stopPolling();
+      eventSource?.close();
       unsubscribe();
       window.removeEventListener("focus", handleWindowFocus);
       document.removeEventListener("visibilitychange", handleVisibilityChange);
@@ -263,7 +317,7 @@ export function useSessionFeed(sessionId: string | null | undefined): UseSession
   }, [refresh, sessionId]);
 
   return useMemo(
-    () => ({ entries, loading, error, sessionStatus, parserState, refresh }),
-    [entries, error, loading, parserState, refresh, sessionStatus],
+    () => ({ entries, loading, error, sessionStatus, parserState, runtimeStatus, refresh }),
+    [entries, error, loading, parserState, refresh, runtimeStatus, sessionStatus],
   );
 }

package/web/.next/standalone/packages/web/src/lib/auth.test.ts

@@ -0,0 +1,98 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { NextRequest } from "next/server";
+import { clearRemoteAccessRuntimeState } from "./remoteAccessRuntime";
+import { getDashboardAccess, guardApiActionAccess } from "./auth";
+
+const originalConfigPath = process.env.CO_CONFIG_PATH;
+const originalWorkspace = process.env.CONDUCTOR_WORKSPACE;
+const originalRequireAuth = process.env.CONDUCTOR_REQUIRE_AUTH;
+
+function resetDashboardAuthEnv(): void {
+  process.env.CO_CONFIG_PATH = "/tmp/conductor-auth-test-config-does-not-exist.yaml";
+  process.env.CONDUCTOR_WORKSPACE = "";
+  process.env.CONDUCTOR_REQUIRE_AUTH = "";
+  clearRemoteAccessRuntimeState();
+}
+
+test.afterEach(() => {
+  resetDashboardAuthEnv();
+});
+
+test.after(() => {
+  if (originalConfigPath === undefined) {
+    delete process.env.CO_CONFIG_PATH;
+  } else {
+    process.env.CO_CONFIG_PATH = originalConfigPath;
+  }
+
+  if (originalWorkspace === undefined) {
+    delete process.env.CONDUCTOR_WORKSPACE;
+  } else {
+    process.env.CONDUCTOR_WORKSPACE = originalWorkspace;
+  }
+
+  if (originalRequireAuth === undefined) {
+    delete process.env.CONDUCTOR_REQUIRE_AUTH;
+  } else {
+    process.env.CONDUCTOR_REQUIRE_AUTH = originalRequireAuth;
+  }
+
+  clearRemoteAccessRuntimeState();
+});
+
+test("getDashboardAccess keeps loopback access available when remote auth is required", async () => {
+  resetDashboardAuthEnv();
+  process.env.CONDUCTOR_REQUIRE_AUTH = "true";
+
+  const access = await getDashboardAccess(new Request("http://127.0.0.1:3000/api/access"));
+
+  assert.equal(access.ok, true);
+  assert.equal(access.provider, "local");
+  assert.equal(access.role, "admin");
+  assert.equal(access.email, "local");
+});
+
+test("getDashboardAccess still denies non-local requests without remote identity", async () => {
+  resetDashboardAuthEnv();
+  process.env.CONDUCTOR_REQUIRE_AUTH = "true";
+
+  const access = await getDashboardAccess(new Request("https://dashboard.example.com/api/access"));
+
+  assert.equal(access.ok, false);
+  assert.equal(access.reason, "Authentication is required for non-local dashboard access");
+});
+
+test("guardApiActionAccess allows tunneled same-origin unlock requests via forwarded host", () => {
+  const request = new NextRequest("http://127.0.0.1:3000/api/auth/session", {
+    method: "POST",
+    headers: {
+      origin: "https://dashboard.example.com",
+      referer: "https://dashboard.example.com/unlock",
+      host: "127.0.0.1:3000",
+      "x-forwarded-host": "dashboard.example.com",
+      "x-forwarded-proto": "https",
+      "sec-fetch-site": "same-origin",
+    },
+  });
+
+  const denied = guardApiActionAccess(request);
+  assert.equal(denied, null);
+});
+
+test("guardApiActionAccess still blocks mismatched origins", () => {
+  const request = new NextRequest("http://127.0.0.1:3000/api/auth/session", {
+    method: "POST",
+    headers: {
+      origin: "https://evil.example.com",
+      host: "127.0.0.1:3000",
+      "x-forwarded-host": "dashboard.example.com",
+      "x-forwarded-proto": "https",
+      "sec-fetch-site": "cross-site",
+    },
+  });
+
+  const denied = guardApiActionAccess(request);
+  assert.ok(denied);
+  assert.equal(denied?.status, 403);
+});

package/web/.next/standalone/packages/web/src/lib/auth.ts

@@ -2,11 +2,12 @@ import { existsSync, statSync } from "node:fs";
 import { basename, resolve } from "node:path";
 import { findConfigFile, loadConfig } from "@conductor-oss/core";
 import type { DashboardAccessConfig, DashboardRole, OrchestratorConfig } from "@conductor-oss/core/types";
-import { cookies, headers } from "next/headers";
+import { headers } from "next/headers";
 import { NextRequest, NextResponse } from "next/server";
 import { resolveRoleForEmail, roleMeetsRequirement, isLoopbackHost } from "@/lib/accessControl";
 import { verifyTrustedEdgeIdentity } from "@/lib/edgeAuth";
-import { BUILTIN_REMOTE_SESSION_COOKIE, isBuiltinRemoteAuthEnabled, verifyBuiltinRemoteSession } from "@/lib/remoteAuth";
+import { readRemoteAccessRuntimeState } from "@/lib/remoteAccessRuntime";
+import { sanitizeRedirectTarget } from "@/lib/remoteAuth";
 
 const clerkConfigured = Boolean(
   process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY && process.env.CLERK_SECRET_KEY,
@@ -14,8 +15,8 @@ const clerkConfigured = Boolean(
 
 type DashboardIdentityProvider =
   | "local"
-  | "builtin"
   | "clerk"
+  | "tailscale"
   | "trusted-header"
   | "cloudflare-access";
 
@@ -28,7 +29,7 @@ export interface DashboardAccess {
   reason?: string;
 }
 
-type DashboardConfigSnapshot = {
+export type DashboardConfigSnapshot = {
   access: DashboardAccessConfig | null;
   dashboardUrl: string | null;
 };
@@ -215,6 +216,15 @@ function loadDashboardConfigSnapshot(): DashboardConfigSnapshot {
   }
 }
 
+export function getDashboardConfigSnapshot(): DashboardConfigSnapshot {
+  return loadDashboardConfigSnapshot();
+}
+
+export function allowBuiltinRemoteAccess(access: DashboardAccessConfig | null | undefined): boolean {
+  void access;
+  return false;
+}
+
 function getDefaultRole(access: DashboardAccessConfig | null): DashboardRole | null {
   const configured = process.env.CONDUCTOR_ACCESS_DEFAULT_ROLE?.trim().toLowerCase();
   if (configured === "viewer" || configured === "operator" || configured === "admin") {
@@ -300,36 +310,34 @@ async function resolveTrustedHeaderAccess(
   };
 }
 
-async function resolveBuiltinRemoteAccess(): Promise<DashboardAccess | null> {
-  if (!isBuiltinRemoteAuthEnabled()) return null;
-
-  const cookieStore = await cookies();
-  const session = cookieStore.get(BUILTIN_REMOTE_SESSION_COOKIE)?.value ?? null;
-  if (!session) {
-    return {
-      ok: false,
-      authenticated: false,
-      reason: "Remote sign-in required",
-      provider: "builtin",
-    };
+async function resolveTailscaleAccess(
+  request: Request | undefined,
+  access: DashboardAccessConfig | null,
+  loopbackRequest: boolean,
+): Promise<DashboardAccess | null> {
+  const runtimeState = readRemoteAccessRuntimeState();
+  if (runtimeState?.provider !== "tailscale" || runtimeState.status !== "ready") {
+    return null;
   }
 
-  const validSession = await verifyBuiltinRemoteSession(session);
-  if (!validSession) {
+  const headerStore = await currentHeaders(request);
+  const login = headerStore.get("Tailscale-User-Login")?.trim().toLowerCase() ?? "";
+  if (!login) {
+    if (loopbackRequest) {
+      return null;
+    }
     return {
       ok: false,
       authenticated: false,
-      reason: "Remote sign-in required",
-      provider: "builtin",
+      provider: "tailscale",
+      reason: "Private network sign-in required",
     };
   }
 
+  const resolved = resolveRoleForAuthenticatedEmail(login, access);
   return {
-    ok: true,
-    authenticated: true,
-    role: "admin",
-    email: "builtin",
-    provider: "builtin",
+    ...resolved,
+    provider: "tailscale",
   };
 }
 
@@ -400,30 +408,27 @@ export async function getDashboardAccess(request?: Request): Promise<DashboardAc
   const dashboardConfig = loadDashboardConfigSnapshot();
   const access = dashboardConfig.access;
   const host = await currentHost(request);
+  const loopbackRequest = isLoopbackHost(host);
+  const localAccess: DashboardAccess = {
+    ok: true,
+    authenticated: false,
+    role: "admin",
+    email: "local",
+    provider: "local",
+  };
 
   const trustedHeaderAccess = await resolveTrustedHeaderAccess(request, access);
   if (trustedHeaderAccess) return trustedHeaderAccess;
 
-  const builtinAccess = await resolveBuiltinRemoteAccess();
-  if (builtinAccess) return builtinAccess;
+  const tailscaleAccess = await resolveTailscaleAccess(request, access, loopbackRequest);
+  if (tailscaleAccess) return tailscaleAccess;
 
   const clerkAccess = await resolveClerkAccess(access);
   if (clerkAccess) return clerkAccess;
 
   const requireAuth = access?.requireAuth === true || envRequiresAuth() || hasLegacyAllowListConfigured();
 
-  // Trust the configured dashboardUrl host (for remote access via tunnels like ngrok).
-  let isTrustedDashboardHost = false;
-  if (dashboardConfig.dashboardUrl) {
-    try {
-      const dashboardHost = new URL(dashboardConfig.dashboardUrl).hostname.toLowerCase();
-      isTrustedDashboardHost = host.toLowerCase() === dashboardHost;
-    } catch {
-      // Ignore malformed dashboard URLs and continue with default host checks.
-    }
-  }
-
-  if (!isLoopbackHost(host) && !isTrustedDashboardHost) {
+  if (!loopbackRequest) {
     return {
       ok: false,
       authenticated: false,
@@ -431,21 +436,9 @@ export async function getDashboardAccess(request?: Request): Promise<DashboardAc
     };
   }
 
-  if (requireAuth) {
-    return {
-      ok: false,
-      authenticated: false,
-      reason: "Authentication required",
-    };
-  }
+  if (requireAuth) return localAccess;
 
-  return {
-    ok: true,
-    authenticated: false,
-    role: "admin",
-    email: "local",
-    provider: "local",
-  };
+  return localAccess;
 }
 
 export async function guardApiAccess(
@@ -486,8 +479,24 @@ function matchesHost(value: string, expectedHost: string, allowedHosts: Set<stri
   return equivalentHost(parsed.host, expectedHost);
 }
 
+function resolveExpectedActionHost(request: NextRequest): string {
+  const forwardedHost = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim();
+  if (forwardedHost) {
+    const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim().toLowerCase();
+    const parsed = parseHostParts(
+      `${forwardedProto === "http" || forwardedProto === "https" ? forwardedProto : "https"}://${forwardedHost}`,
+      request.nextUrl.host,
+    );
+    if (parsed?.host) {
+      return parsed.host;
+    }
+  }
+
+  return request.headers.get("host")?.trim() || request.nextUrl.host;
+}
+
 function guardActionOrigin(request: NextRequest): NextResponse | null {
-  const expectedHost = request.nextUrl.host;
+  const expectedHost = resolveExpectedActionHost(request);
   if (!expectedHost) return null;
   const allowedHosts = getAllowedActionHosts(expectedHost);
 
@@ -531,3 +540,28 @@ function guardActionOrigin(request: NextRequest): NextResponse | null {
 export function guardApiActionAccess(request: NextRequest): NextResponse | null {
   return guardActionOrigin(request);
 }
+
+export async function resolveDashboardPageRedirect(
+  currentPath: string,
+  requiredRole: DashboardRole = "viewer",
+): Promise<string | null> {
+  const access = await getDashboardAccess();
+  if (access.ok && access.role && roleMeetsRequirement(access.role, requiredRole)) {
+    return null;
+  }
+
+  const nextPath = sanitizeRedirectTarget(currentPath);
+  if (access.provider === "clerk" && !access.authenticated) {
+    const params = new URLSearchParams();
+    if (nextPath !== "/") {
+      params.set("redirect_url", nextPath);
+    }
+    return params.size > 0 ? `/sign-in?${params.toString()}` : "/sign-in";
+  }
+
+  const params = new URLSearchParams({ error: "unavailable" });
+  if (nextPath !== "/") {
+    params.set("next", nextPath);
+  }
+  return `/unlock?${params.toString()}`;
+}

package/web/.next/standalone/packages/web/src/lib/chatFeed.ts

@@ -33,7 +33,7 @@ const ANSI_PATTERN = /\u001B\[[0-?]*[ -/]*[@-~]/g;
 const OSC_PATTERN = /\u001B\][^\u0007]*(?:\u0007|\u001B\\)/g;
 const CONTROL_PATTERN = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g;
 
-function normalizeText(value: string): string {
+export function normalizeChatText(value: string): string {
   return value
     .replace(OSC_PATTERN, "")
     .replace(ANSI_PATTERN, "")
@@ -85,7 +85,7 @@ function stripLeadingPromptEcho(output: string, conversation: StoredConversation
 
   if (!lastUserText) return output;
 
-  const normalizedPrompt = normalizeText(lastUserText);
+  const normalizedPrompt = normalizeChatText(lastUserText);
   if (!normalizedPrompt) return output;
 
   if (output.startsWith(normalizedPrompt)) {
@@ -110,7 +110,7 @@ function createAssistantEntry(
   output: string,
   sessionStatus: string | null | undefined,
 ): NormalizedChatEntry | null {
-  const normalizedOutput = normalizeText(output);
+  const normalizedOutput = normalizeChatText(output);
   if (!normalizedOutput) return null;
 
   return {
@@ -161,7 +161,7 @@ export function buildNormalizedChatFeed({
   const feed: NormalizedChatEntry[] = conversation
     .filter((entry) => typeof entry?.text === "string" && entry.text.trim().length > 0)
     .map((entry) => {
-      const normalizedText = normalizeText(entry.text ?? "");
+      const normalizedText = normalizeChatText(entry.text ?? "");
       const stableKey = entry.id?.trim() || `${entry.kind ?? "entry"}:${entry.createdAt ?? normalizedText}`;
       return {
         id: makeStableId("entry", stableKey),