heaplens-cli 0.1.1 → 0.1.2

package/runtime/browser-ui/build/index.html

@@ -1857,9 +1857,10 @@ body {
                 <span class="tree-shallow" style="font-weight:bold;">Shallow</span>
                 <span class="tree-size" style="font-weight:bold;">Retained</span>
                 <span class="tree-bar-wrap"></span>
-                <span class="tree-pct" style="font-weight:bold;">%</span>
+                <span class="tree-pct" style="font-weight:bold;" title="Retained size divided by reachable heap. Nested retained sets overlap.">% reachable</span>
                 <span class="tree-actions"><span class="tree-action-alive"></span><span class="tree-action-icon"></span><span class="tree-action-icon"></span><span class="tree-action-icon"></span></span>
             </div>
+            <p class="histogram-percentage-note">Percentages use reachable heap, not the sum of these rows. Nested entries can retain the same objects; percentages need not sum to 100%. N/A means unavailable.</p>
         </div>
         <p class="dominator-hint">Top retained entry points from analysis; expand for immediately dominated children. Percentages use reachable heap. Nested rows overlap and must not be added together.</p><div id="dominator-status" role="status" aria-live="polite"></div><div id="dominator-tree"><div class="loading">Waiting for analysis...</div></div>
         <div id="sunburst-chart"></div>
@@ -2056,6 +2057,7 @@ body {
             <div class="chat-input-row">
                 <textarea class="chat-input" id="chat-input" placeholder="Ask about your heap dump..." rows="1"></textarea>
                 <button class="chat-send" id="chat-send">Send</button>
+                <button class="chat-clear" id="chat-stop" title="Stop the current AI investigation">Stop</button>
                 <button class="chat-clear" id="chat-clear" title="Clear chat history">Clear</button>
             </div>
             <p class="chat-privacy-note">AI sends heap metadata and your messages to the configured provider. Automatic string previews and primitive values are omitted. Names and anything you type may still be sensitive; do not paste secrets.</p>
@@ -2090,6 +2092,11 @@ body {
         return request;
     }
     window.heaplensSend = send;
+    window.addEventListener('pagehide',()=>{
+        // Best effort immediately; a per-view host lease handles lost unload requests.
+        void fetch('/api/command',{method:'POST',keepalive:true,credentials:'omit',headers:{'X-HeapLens-Token':token,'X-HeapLens-View':view,'Content-Type':'application/json'},
+            body:JSON.stringify({session,message:{command:'aiStop'}})}).catch(()=>{});
+    });
     document.getElementById('browser-telemetry').onclick=async()=>{
         const selected=await choice('Telemetry','Telemetry is enabled by default (usage and errors). Disable it here for this running host, or launch with --telemetry off to keep it disabled from startup. Filtered records go to HeapLens Azure Application Insights. No paths, source/query/dump text, keys or stable IDs. Network services may process IP addresses. Disabling clears pending delivery.',[['Disable telemetry','off'],['Review local diagnostics','review'],['Cancel',null]]);
         if(selected)send({command:selected==='off'?'telemetryOff':'reviewDiagnostics'});
@@ -2450,7 +2457,8 @@ document.querySelectorAll('.tab-btn').forEach(b => {
         function escapeHtml(str) {
             var div = document.createElement('div');
             div.textContent = str;
-            return div.innerHTML;
+            // Also safe inside double-quoted attributes; heap names are untrusted.
+            return div.innerHTML.replace(/"/g, '&quot;').replace(/'/g, '&#39;');
         }
 
         function renderMarkdown(raw) {
@@ -2847,8 +2855,8 @@ document.querySelectorAll('.tab-btn').forEach(b => {
             var section = document.getElementById('diagnosis-section');
             if (!data.summary || !data.classHistogram) { section.innerHTML = ''; return; }
 
-            var totalHeap = data.summary.reachable_heap_size || data.summary.total_heap_size;
-            if (totalHeap === 0) { section.innerHTML = ''; return; }
+            var totalHeap = data.summary.reachable_heap_size;
+            if (!Number.isFinite(totalHeap) || totalHeap <= 0) { section.innerHTML = ''; return; }
 
             var findings = [];
             var suspects = data.leakSuspects || [];
@@ -2862,6 +2870,7 @@ document.querySelectorAll('.tab-btn').forEach(b => {
 
             var histogram = data.classHistogram || [];
             histogram.forEach(function(entry) {
+                if (!Number.isFinite(entry.retained_size) || entry.retained_size < 0) return;
                 var pct = (entry.retained_size / totalHeap) * 100;
                 var cn = entry.class_name;
                 var cnLower = cn.toLowerCase();
@@ -3786,7 +3795,7 @@ function buildIncidentReport(data, hprofPath) {
         lines.push('## Heap Summary');
         lines.push('');
         lines.push(`- **Total Heap Size:** ${fmt(s.total_heap_size)}`);
-        lines.push(`- **Reachable Heap Size:** ${fmt(s.reachable_heap_size || s.total_heap_size)}`);
+        lines.push(`- **Reachable Heap Size:** ${typeof s.reachable_heap_size === 'number' && Number.isFinite(s.reachable_heap_size) && s.reachable_heap_size >= 0 ? fmt(s.reachable_heap_size) : 'Not calculated'}`);
         lines.push(`- **Objects:** ${s.total_instances.toLocaleString()}`);
         lines.push(`- **Classes:** ${s.total_classes.toLocaleString()}`);
         lines.push(`- **Arrays:** ${s.total_arrays.toLocaleString()}`);
@@ -3922,6 +3931,9 @@ onMessage=function(command,handler) {
     });
 };
 function dispatchHost(message) {
+    // Explicit Stop keeps the request fence until its matching terminal event resets the UI.
+    // Navigation retirement is separate: its old panel must not accept a late reply.
+    if(message.command==='stopAi') {hostSend({command:'cancelAiAssistance'});return;}
     if(message.command==='copyReport') {
         if(!objectReady || !analysisData) return;
         hostSend({command:'copyReportText',text:buildIncidentReport(analysisData,analysisData.displayName || 'Heap dump')});return;
@@ -3945,7 +3957,8 @@ function dispatchHost(message) {
             document.querySelectorAll('.suspect-explain-link').forEach(function(link){link.textContent='Explain';});
             return;
         }
-        if(channel!=='fix' && !(message.command==='explainLeakSuspect' && message.objectId===undefined) &&
+        var exactExplainId = channel==='explain' && typeof message.objectId==='string' && /^[1-9][0-9]{0,19}$/.test(message.objectId) && BigInt(message.objectId)<=18446744073709551615n;
+        if(channel!=='fix' && !exactExplainId && !(message.command==='explainLeakSuspect' && message.objectId===undefined) &&
             (!Number.isSafeInteger(message.objectId) || message.objectId<(channel==='flame'?0:1))) {
             localStatus('This object ID is unsupported; no request was sent.');return;
         }
@@ -4066,10 +4079,14 @@ document.addEventListener('click',function(e){
         // Self-contained: owns explain-object streaming buffer.
 
         var _explainObjectBuffer = '';
+        var _explainObjectSelection = null;
 
         function openInspector(objectId, className, shallowSize, retainedSize) {
+            if (_explainObjectSelection !== null) vscode.postMessage({command:'stopAi'});
+            _explainObjectSelection = null; _explainObjectBuffer = '';
             var panel = document.getElementById('inspector-panel');
             panel.dataset.objectId = objectId;
+            panel.dataset.exactObjectId = (typeof objectId === 'string' && /^[1-9][0-9]{0,19}$/.test(objectId) || typeof objectId === 'number' && Number.isSafeInteger(objectId) && objectId > 0) ? String(objectId) : '';
             panel.dataset.className = className;
             panel.dataset.shallowSize = shallowSize;
             panel.dataset.retainedSize = retainedSize;
@@ -4082,6 +4099,8 @@ document.addEventListener('click',function(e){
         }
 
         function closeInspector() {
+            if (_explainObjectSelection !== null) vscode.postMessage({command:'stopAi'});
+            _explainObjectSelection = null; _explainObjectBuffer = '';
             var panel = document.getElementById('inspector-panel');
             panel.classList.remove('visible');
             panel.innerHTML = '';
@@ -4090,6 +4109,7 @@ document.addEventListener('click',function(e){
         function renderInspectorFields(objectId, fields) {
             var panel = document.getElementById('inspector-panel');
             if (!panel.classList.contains('visible')) return;
+            if (String(objectId) !== panel.dataset.objectId) return;
 
             var body = panel.querySelector('.inspector-loading');
             if (!body) return;
@@ -4147,13 +4167,12 @@ document.addEventListener('click',function(e){
                     explainArea.textContent = '';
 
                     var panel = document.getElementById('inspector-panel');
+                    if (!panel.dataset.exactObjectId) { explainArea.textContent = 'Object identity is not exact. This object cannot be sent to AI.'; explainBtn.disabled = false; return; }
+                    _explainObjectSelection = panel.dataset.exactObjectId;
                     vscode.postMessage({
                         command: 'explainObject',
-                        objectId: parseInt(panel.dataset.objectId),
-                        className: panel.dataset.className,
-                        shallowSize: parseInt(panel.dataset.shallowSize),
-                        retainedSize: parseInt(panel.dataset.retainedSize),
-                        fields: fields
+                        objectId: panel.dataset.exactObjectId,
+                        className: panel.dataset.className
                     });
                 });
             }
@@ -4175,6 +4194,8 @@ document.addEventListener('click',function(e){
         });
 
         onMessage('explainChunk', function(msg) {
+            var panel = document.getElementById('inspector-panel');
+            if (!_explainObjectSelection || String(msg.objectId) !== _explainObjectSelection || panel.dataset.objectId !== _explainObjectSelection) return;
             _explainObjectBuffer += msg.text;
             var area = document.getElementById('inspector-explain-area');
             if (area) {
@@ -4183,21 +4204,30 @@ document.addEventListener('click',function(e){
             }
         });
 
-        onMessage('explainDone', function() {
+        onMessage('explainDone', function(msg) {
+            var panel = document.getElementById('inspector-panel');
+            if (!_explainObjectSelection || String(msg.objectId) !== _explainObjectSelection || panel.dataset.objectId !== _explainObjectSelection) return;
             var area = document.getElementById('inspector-explain-area');
             if (area) {
                 area.classList.remove('streaming');
                 area.classList.add('rendered');
-                area.innerHTML = renderMarkdown(_explainObjectBuffer);
+                if (msg.safeEvidenceAnswer) {
+                    area.innerHTML = renderMarkdown(_explainObjectBuffer); // Escapes HTML; never executes model output.
+                    attachInvestigationEvidence(area, msg.evidence);
+                } else { area.innerHTML = renderMarkdown(_explainObjectBuffer); }
                 area.scrollTop = 0;
             }
             _explainObjectBuffer = '';
+            _explainObjectSelection = null;
             var btn = document.getElementById('inspector-explain-btn');
             if (btn) { btn.textContent = 'Explain this object'; btn.disabled = false; }
         });
 
         onMessage('explainError', function(msg) {
+            var panel = document.getElementById('inspector-panel');
+            if (!_explainObjectSelection || String(msg.objectId) !== _explainObjectSelection || panel.dataset.objectId !== _explainObjectSelection) return;
             _explainObjectBuffer = '';
+            _explainObjectSelection = null;
             var area = document.getElementById('inspector-explain-area');
             if (area) {
                 area.classList.remove('streaming');
@@ -4742,7 +4772,9 @@ const onTabMessage = (tab, command, handler) => listenTab(tab, command, message
             row.setAttribute('tabindex', '-1');
             if (!leaf) row.setAttribute('aria-expanded', 'false');
 
-            var pct = _reachableHeap !== null ? ((obj.retained_size / _reachableHeap) * 100) : null;
+            var pct = _reachableHeap !== null && Number.isFinite(obj.retained_size) && obj.retained_size >= 0
+                ? ((obj.retained_size / _reachableHeap) * 100) : null;
+            if (!Number.isFinite(pct)) pct = null;
             var pctStr = pct === null ? 'N/A' : pct.toFixed(1) + '%';
             var barWidth = pct === null ? 0 : Math.max(1, Math.min(100, pct));
             var displayName = obj.class_name || obj.node_type;
@@ -4763,7 +4795,7 @@ const onTabMessage = (tab, command, handler) => listenTab(tab, command, message
                 '<span class="tree-shallow">' + fmt(obj.shallow_size) + '</span>' +
                 '<span class="tree-size">' + fmt(obj.retained_size) + '</span>' +
                 '<span class="tree-bar-wrap"><div class="tree-bar" style="width:' + barWidth + '%"></div></span>' +
-                '<span class="tree-pct">' + pctStr + '</span>' +
+                '<span class="tree-pct" title="Retained size as a percentage of reachable heap. Nested entries can overlap.">' + pctStr + '</span>' +
                 '<span class="tree-actions">' +
                 '<span class="tree-action-slot tree-action-alive">' + (showPin ? '<button class="why-alive-btn" title="Show GC root path">Why alive?</button>' : '') + '</span>' +
                 '<span class="tree-action-slot tree-action-icon">' + (showInspect ? '<span class="tree-inspect" role="button" aria-label="Inspect fields for ' + escapeHtml(displayName) + '" title="Inspect fields">\uD83D\uDD0D</span>' : '') + '</span>' +
@@ -4870,6 +4902,16 @@ const onTabMessage = (tab, command, handler) => listenTab(tab, command, message
         }
 
         // ---- Self-register ----
+        function retireDominatorPercentage() {
+            _reachableHeap = null;
+            _treeData = [];
+            document.getElementById('dominator-tree').innerHTML = '';
+            document.getElementById('domtree-header').style.display = 'none';
+            document.getElementById('reset-tree-btn').style.display = 'none';
+        }
+        ['analysisStarting', 'analysisCancelled', 'analysisFailed', 'serverCrashed'].forEach(function(command) {
+            onMessage(command, retireDominatorPercentage);
+        });
         onTabMessage('domtree', 'analysisComplete', function(msg) {
             renderDominatorTree(msg.topLayers || [], msg.summary && msg.summary.reachable_heap_size);
         });
@@ -5426,7 +5468,7 @@ const onMessage = (command, handler) => {
     handler(message);
     aiStatus.textContent = command === "chatChunk" ? "Receiving AI response…" : command === "chatDone" ? "Response complete. Verify suggestions before acting." : (message.message || "AI request failed.");
     if (command !== "chatChunk") finishAi();
-  }); else if (command === "restoreChatHistory") listen("aiHistory", handler);
+  }); else if (command === "restoreChatHistory") listen("aiHistory", handler); else listen(command, handler);
 };
 
         // ---- Tab 9: AI Chat ----
@@ -5440,6 +5482,105 @@ const onMessage = (command, handler) => {
         var _isChatStreaming = false;
         var _chatStreamBuffer = '';
         var _pendingChatQuery = null; // { bubble, codeBlock } when waiting for query result
+        var _chatQuerySequence = 0;
+        var _chatQueryEpoch = 0;
+        var _chatQueryReady = false;
+        var chatQuerySegments = function chatQuerySegments(answer) {
+    if (answer.length > 65536)
+        return [{ text: answer }];
+    const text = answer;
+    const found = [];
+    const fences = [];
+    const candidate = (raw) => {
+        const query = raw.trim();
+        if (!query || query.length > 32000)
+            return;
+        if (/^:(?:info|path|refs|children)\s+(?:0x[0-9a-f]+|[0-9]+)\s*$/i.test(query))
+            return query;
+        if (!/^SELECT\b/i.test(query))
+            return;
+        // Ignore quoted literals when recognizing table names and statement boundaries.
+        let masked = '', quote = '';
+        for (let i = 0; i < query.length; i++) {
+            const ch = query[i];
+            if (quote) {
+                if (ch === '\\') {
+                    i++;
+                    masked += '  ';
+                    continue;
+                }
+                if (ch === quote) {
+                    if (query[i + 1] === quote) {
+                        i++;
+                        masked += '  ';
+                        continue;
+                    }
+                    quote = '';
+                }
+                masked += ' ';
+            }
+            else if (ch === "'" || ch === '"') {
+                quote = ch;
+                masked += ' ';
+            }
+            else
+                masked += ch;
+        }
+        if (quote || /--|\/\*|\*\/|\b(?:INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|TRUNCATE|ATTACH|PRAGMA|EXEC|CALL|INTO)\b/i.test(masked))
+            return;
+        if (masked.replace(/;\s*$/, '').includes(';'))
+            return;
+        const tables = [...masked.matchAll(/\bFROM\s+([A-Za-z_][A-Za-z0-9_]*)/gi)].map(m => m[1].toLowerCase());
+        if (!tables.length || tables.some(t => !['instances', 'class_histogram', 'dominator_tree', 'leak_suspects'].includes(t)))
+            return;
+        // SQL-style terminal delimiters are presentation, not supported HeapQL tokens.
+        return query.endsWith(';') ? query.slice(0, -1).trimEnd() : query;
+    };
+    const add = (start, end, raw) => { const query = candidate(raw); if (query && found.length < 16)
+        found.push({ start, end, query }); };
+    // Exclude every fenced language from prose scanning, including shell/Java/JavaScript.
+    const fence = /^ {0,3}(`{3,}|~{3,})([A-Za-z0-9_-]*)[ \t]*\r?\n([\s\S]*?)^ {0,3}\1[ \t]*\r?(?=\n|$)/gm;
+    for (const match of text.matchAll(fence)) {
+        const start = match.index, end = start + match[0].length;
+        fences.push({ start, end });
+        if (/^(?:heapql|sql)?$/i.test(match[2]))
+            add(start, end, match[3]);
+    }
+    for (const match of text.matchAll(/^ {0,3}(?:`{3,}|~{3,})[^\n]*$/gm)) {
+        if (!fences.some(span => match.index >= span.start && match.index < span.end)) {
+            fences.push({ start: match.index, end: text.length });
+            break;
+        }
+    }
+    fences.sort((a, b) => a.start - b.start);
+    const scan = (start, end) => {
+        const chunk = text.slice(start, end);
+        for (const match of chunk.matchAll(/`([^`\n]+)`/g))
+            add(start + match.index, start + match.index + match[0].length, match[1]);
+        for (const match of chunk.matchAll(/[^\n]+(?:\n(?![ \t\r]*\n)[^\n]+)*/g))
+            add(start + match.index, start + match.index + match[0].length, match[0]);
+    };
+    let offset = 0;
+    for (const span of fences) {
+        scan(offset, span.start);
+        offset = span.end;
+    }
+    scan(offset, text.length);
+    found.sort((a, b) => a.start - b.start || b.end - a.end);
+    const segments = [];
+    offset = 0;
+    for (const span of found) {
+        if (span.start < offset)
+            continue;
+        if (span.start > offset)
+            segments.push({ text: text.slice(offset, span.start) });
+        segments.push({ text: text.slice(span.start, span.end), query: span.query });
+        offset = span.end;
+    }
+    if (offset < text.length || !segments.length)
+        segments.push({ text: text.slice(offset) });
+    return segments;
+};
 
         function addChatBubble(role, text) {
             if (_chatPlaceholder) _chatPlaceholder.style.display = 'none';
@@ -5482,30 +5623,49 @@ const onMessage = (command, handler) => {
             }
         });
 
-        function attachHeapqlButtons(bubble) {
-            var codeBlocks = bubble.querySelectorAll('code.language-heapql');
-            codeBlocks.forEach(function(codeEl) {
-                var pre = codeEl.closest('pre');
-                if (!pre) return;
-                var query = codeEl.textContent.trim();
-                if (!query) return;
+        function updateChatQueryButtons() {
+            _chatMessages.querySelectorAll('.chat-run-query-btn').forEach(function(button) {
+                button.disabled = !_chatQueryReady || !!_pendingChatQuery || button.dataset.expired === 'true';
+            });
+        }
+        function renderChatAnswer(bubble, text) {
+            bubble.textContent = '';
+            chatQuerySegments(text).forEach(function(segment) {
+                if (!segment.query) { var prose=document.createElement('div');prose.innerHTML=renderMarkdown(segment.text);bubble.appendChild(prose);return; }
+                var query=segment.query;
+                var pre=document.createElement('pre');pre.className='md-code-block';
+                var code=document.createElement('code');code.className='language-heapql';code.textContent=query;pre.appendChild(code);bubble.appendChild(pre);
                 var btn = document.createElement('button');
                 btn.className = 'chat-run-query-btn';
                 btn.textContent = 'Run Query';
+                var epoch=_chatQueryEpoch;
                 btn.addEventListener('click', function() {
+                    if (!_chatQueryReady || epoch!==_chatQueryEpoch || _pendingChatQuery || !bubble.isConnected) return;
                     btn.disabled = true;
                     btn.textContent = 'Running...';
-                    _pendingChatQuery = { bubble: bubble, codeBlock: pre, button: btn };
-                    vscode.postMessage({ command: 'executeQuery', query: query });
+                    var requestId='chat-query-'+(++_chatQuerySequence);
+                    _pendingChatQuery = { bubble: bubble, codeBlock: pre, button: btn, query:query, requestId:requestId };
+                    updateChatQueryButtons();
+                    vscode.postMessage({ command: 'executeQuery', query: query, requestId:requestId });
                 });
-                pre.insertAdjacentElement('afterend', btn);
+                bubble.appendChild(btn);
             });
+            bubble.classList.add('rendered');
+            updateChatQueryButtons();
         }
 
-        function renderChatQueryResult(pre, btn, result) {
+        function retireChatQueries() {
+            _chatQueryReady=false;_chatQueryEpoch++;_pendingChatQuery=null;
+            _chatMessages.querySelectorAll('.chat-run-query-btn').forEach(function(button){button.dataset.expired='true';button.disabled=true;});
+        }
+        ['analysisStarting','analysisRetrying','serverCrashed','analysisCancelled'].forEach(function(command){onMessage(command,retireChatQueries);});
+        onMessage('analysisProgress',function(msg){if(msg.stage==='loading')retireChatQueries();});
+        onMessage('analysisComplete',function(){_chatQueryReady=true;updateChatQueryButtons();});
+
+        function renderChatQueryResult(pre, btn, result, query) {
             // Remove any existing result for this block
-            var existing = pre.parentElement.querySelector('.chat-query-result');
-            if (existing) existing.remove();
+            var existing = btn.nextElementSibling;
+            if (existing && existing.classList.contains('chat-query-result')) existing.remove();
 
             var container = document.createElement('div');
             container.className = 'chat-query-result';
@@ -5545,7 +5705,7 @@ const onMessage = (command, handler) => {
             }
 
             var timeMs = result.execution_time_ms !== undefined ? result.execution_time_ms : '?';
-            html += '<div class="chat-query-status">' + rows.length + ' rows (' + timeMs + 'ms)</div>';
+            html += '<div class="chat-query-status">' + rows.length + ' rows (' + escapeHtml(String(timeMs)) + 'ms)</div>';
 
             container.innerHTML = html;
             btn.insertAdjacentElement('afterend', container);
@@ -5558,17 +5718,85 @@ const onMessage = (command, handler) => {
                 link.addEventListener('click', function() {
                     var queryTab = document.querySelector('.tab-btn[data-tab="query"]');
                     if (queryTab) queryTab.click();
+                    if (typeof query==='string') {
+                        var input=document.getElementById('query-input');var run=document.getElementById('query-run-btn');
+                        if(input && run){input.value=query;input.dispatchEvent(new Event('input'));run.click();}
+                    }
                 });
             }
 
             _chatMessages.scrollTop = _chatMessages.scrollHeight;
         }
 
-        onMessage('chatDone', function() {
+        function attachInvestigationEvidence(area, evidence) {
+            var answerText = area.textContent || '';
+            var seen = new Set();
+            var cited = (Array.isArray(evidence) ? evidence : []).slice(0, 32).filter(function(record) {
+                if (!record || typeof record.id !== 'string' || !/^E[a-f0-9]{12}_[1-9][0-9]{0,3}$/.test(record.id)
+                    || answerText.indexOf('[' + record.id + ']') < 0 || seen.has(record.id)) return false;
+                seen.add(record.id); return true;
+            });
+            if (cited.length) {
+                var note = document.createElement('small');
+                note.style.display = 'block'; note.style.marginTop = '8px';
+                note.textContent = 'AI interpretation may be wrong. Evidence below is engine metadata, not proof of a cause or repair.';
+                area.appendChild(note);
+            }
+            cited.forEach(function(record) {
+                var button = document.createElement('button');
+                button.className = 'chat-clear';
+                button.textContent = 'View evidence: ' + record.operation;
+                button.addEventListener('click', function() { vscode.postMessage({command:'openAiEvidence', id:record.id}); });
+                area.appendChild(button);
+            });
+        }
+        // Native/browser hosts scope chat in an IIFE; object views share only this safe renderer.
+        window.attachInvestigationEvidence = attachInvestigationEvidence;
+        function retireInvestigationViewer() {
+            var viewer=document.getElementById('heaplens-ai-evidence');
+            if(viewer){if(viewer.open)viewer.close();viewer.remove();}
+        }
+        ['analysisStarting','analysisRetrying','serverCrashed','analysisCancelled','aiReset'].forEach(function(command){onMessage(command,retireInvestigationViewer);});
+        onMessage('analysisProgress',function(msg){if(msg.stage==='loading')retireInvestigationViewer();});
+
+        onMessage('aiEvidenceResult', function(msg) {
+            var viewer = document.getElementById('heaplens-ai-evidence');
+            if (!viewer) { viewer = document.createElement('dialog'); viewer.id = 'heaplens-ai-evidence'; document.body.appendChild(viewer); }
+            viewer.textContent = '';
+            var close = document.createElement('button'); close.textContent = 'Close evidence'; close.addEventListener('click',function(){viewer.close();});viewer.appendChild(close);
+            var content = document.createElement('pre'); content.style.whiteSpace = 'pre-wrap';
+            content.textContent = msg.error || (msg.record ? 'Evidence ' + msg.record.id + ' — ' + msg.record.operation + '\n' + JSON.stringify(msg.record.data, null, 2) : 'Evidence unavailable.');
+            viewer.appendChild(content);if (!viewer.open) viewer.showModal();
+        });
+
+        onMessage('aiInvestigationProgress', function(msg) {
+            var areas = [];
+            if (msg.channel === 'chat' && _currentBubble) areas.push(_currentBubble);
+            if (msg.channel === 'explain') { var inspector = document.getElementById('inspector-explain-area'); var panel = document.getElementById('inspector-panel'); if (inspector && panel && panel.dataset.objectId === String(msg.objectId)) areas.push(inspector); }
+            if (msg.channel === 'explainLeak' && typeof msg.className === 'string') {
+                var target = msg.objectId ? 'explain-obj-' + leakEvidenceKey(msg.className,msg.objectId) : 'explain-' + leakEvidenceKey(msg.className);
+                var targetArea = document.getElementById(target); if(targetArea)areas.push(targetArea);
+            }
+            areas.forEach(function(area) {
+                area.textContent = msg.message || 'Investigating…';
+                if (msg.channel !== 'chat') {
+                    var stop = document.createElement('button'); stop.textContent = 'Stop investigation';
+                    stop.addEventListener('click', function() { vscode.postMessage({command:'stopAi',channel:msg.channel}); }); area.appendChild(stop);
+                }
+            });
+        });
+
+        var _chatStop = document.getElementById('chat-stop');
+        if (_chatStop) _chatStop.addEventListener('click', function() { vscode.postMessage({command:'stopAi'}); });
+
+        onMessage('chatDone', function(msg) {
             if (_currentBubble && _chatStreamBuffer) {
-                _currentBubble.innerHTML = renderMarkdown(_chatStreamBuffer);
-                _currentBubble.classList.add('rendered');
-                attachHeapqlButtons(_currentBubble);
+                if (msg.safeEvidenceAnswer) {
+                    renderChatAnswer(_currentBubble, _chatStreamBuffer);
+                    attachInvestigationEvidence(_currentBubble, msg.evidence);
+                } else {
+                    renderChatAnswer(_currentBubble, _chatStreamBuffer);
+                }
             }
             _isChatStreaming = false;
             _chatSend.disabled = false;
@@ -5577,6 +5805,10 @@ const onMessage = (command, handler) => {
         });
 
         onMessage('chatError', function(msg) {
+            if (_currentBubble && _chatStreamBuffer) {
+                _currentBubble.textContent = 'Incomplete AI answer — not a completed diagnosis.\n\n' + _chatStreamBuffer;
+                _currentBubble.classList.add('error');
+            }
             _isChatStreaming = false;
             _chatSend.disabled = false;
             _currentBubble = null;
@@ -5584,27 +5816,37 @@ const onMessage = (command, handler) => {
             addChatBubble('error', msg.message || 'An error occurred');
         });
 
-        onMessage('queryResult', function(msg) {
-            if (_pendingChatQuery) {
-                renderChatQueryResult(_pendingChatQuery.codeBlock, _pendingChatQuery.button, msg.result);
+        onMessage('chatQueryResult', function(msg) {
+            if (_pendingChatQuery && msg.requestId===_pendingChatQuery.requestId) {
+                renderChatQueryResult(_pendingChatQuery.codeBlock, _pendingChatQuery.button, msg.result, _pendingChatQuery.query);
                 _pendingChatQuery = null;
+                updateChatQueryButtons();
                 return true;
             }
             return false;
         });
 
+        onMessage('chatQueryError', function(msg) {
+            if (!_pendingChatQuery || msg.requestId!==_pendingChatQuery.requestId) return false;
+            var pending=_pendingChatQuery;_pendingChatQuery=null;
+            pending.button.textContent='Run Query';
+            var previous=pending.button.nextElementSibling;if(previous && previous.classList.contains('chat-query-result'))previous.remove();
+            var error=document.createElement('div');error.className='chat-query-result error';error.textContent=msg.error || 'Query failed. Check its syntax and retry.';
+            pending.button.insertAdjacentElement('afterend',error);updateChatQueryButtons();return true;
+        });
+
         onMessage('restoreChatHistory', function(msg) {
             var messages = msg.messages || [];
             if (messages.length === 0) return;
             if (_chatPlaceholder) _chatPlaceholder.style.display = 'none';
+            addChatBubble('system', 'Previous local conversation. Its evidence links have expired and are not reused by this analysis.');
             messages.forEach(function(m) {
                 if (m.role === 'user') {
                     addChatBubble('user', m.content);
                 } else if (m.role === 'assistant') {
                     var bubble = addChatBubble('assistant', '');
-                    bubble.innerHTML = renderMarkdown(m.content);
-                    bubble.classList.add('rendered');
-                    attachHeapqlButtons(bubble);
+                    bubble.textContent = m.content;
+                    bubble.style.whiteSpace = 'pre-wrap';
                 }
             });
         });
@@ -5612,6 +5854,11 @@ const onMessage = (command, handler) => {
         var _chatClear = document.getElementById('chat-clear');
         if (_chatClear) {
             _chatClear.addEventListener('click', function() {
+                _isChatStreaming = false;
+                _chatSend.disabled = false;
+                _currentBubble = null;
+                _chatStreamBuffer = '';
+                _pendingChatQuery = null;
                 _chatMessages.innerHTML = '';
                 if (_chatPlaceholder) {
                     _chatPlaceholder.style.display = 'block';
@@ -5639,6 +5886,8 @@ function aiControls() {
 function acceptsAi(message) {return aiReady && aiPending && message.requestId===aiPending;}
 function finishAi() {aiPending=null;_isChatStreaming=false;aiControls();}
 function requestAi(message) {
+    if(message.command==='openAiEvidence') {send(message);return;}
+    if(message.command==='stopAi') {send({command:message.channel && message.channel!=='chat'?'cancelAiAssistance':'aiStop'});return;}
     if(message.command==='executeQuery') {
         if(!aiReady || chatQueryId || typeof message.query!=='string' || message.query.length>32000) {
             if(_pendingChatQuery) {_pendingChatQuery.button.disabled=false;_pendingChatQuery.button.textContent='Run Query';_pendingChatQuery=chatQueryContext;}
@@ -5679,13 +5928,7 @@ listen('aiConfiguration',function(message) {
 listen('aiReset',function(message) {clearAiUi(message.message || 'Chat cleared.');});
 listen('aiQueryResult',function(message){
     if(!aiReady || message.requestId!==chatQueryId || !_pendingChatQuery)return;
-    renderChatQueryResult(_pendingChatQuery.codeBlock,_pendingChatQuery.button,message.result);
-    var link=_pendingChatQuery.codeBlock.parentElement.querySelector('.chat-query-link');
-    if(link)link.addEventListener('click',function(){
-        document.getElementById('query-input').value=message.query;
-        document.getElementById('query-input').dispatchEvent(new Event('input'));
-        document.getElementById('query-run-btn').click();
-    });
+    renderChatQueryResult(_pendingChatQuery.codeBlock,_pendingChatQuery.button,message.result,message.query);
     chatQueryId=null;chatQueryContext=null;_pendingChatQuery=null;
     _chatMessages.querySelectorAll('.chat-run-query-btn').forEach(function(button){button.disabled=false;});
 });
@@ -5713,6 +5956,12 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
         // Self-contained: owns explain-leak streaming buffers, rendering, pagination, threshold filtering.
 
         var _explainLeakBuffers = {};
+        function leakEvidenceKey(className, objectId) {
+            var text = JSON.stringify([String(className), objectId === undefined ? '' : String(objectId)]);
+            var key = ''; for(var i=0;i<text.length;i++)key += text.charCodeAt(i).toString(16).padStart(4,'0');
+            return key;
+        }
+        window.leakEvidenceKey = leakEvidenceKey;
         var _leakPage = 0;
         var LEAK_PAGE_SIZE = 10;
         var _leakSuspectsData = [];
@@ -5800,7 +6049,7 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
                 var inspectLink = s.object_id
                     ? ' <button class="why-alive-btn inspect-obj-link" data-object-id="' + s.object_id + '" data-class-name="' + escapeHtml(s.class_name) + '" data-shallow="' + (s.shallow_size || 0) + '" data-retained="' + s.retained_size + '">Inspect</button>'
                     : '';
-                var sanitizedId = (s.class_name + '_' + s.object_id).replace(/[^a-zA-Z0-9]/g, '_');
+                var sanitizedId = leakEvidenceKey(s.class_name,s.object_id);
                 var explainLink = ' | <a class="suspect-explain-link" data-class="' + escapeHtml(s.class_name) +
                     '" data-object-id="' + (s.object_id || '') +
                     '" data-retained="' + s.retained_size +
@@ -5899,7 +6148,7 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
                     : '';
                 var cachedDep = depInfoCache[s.class_name];
                 var depBadge = cachedDep ? makeBadgeHtml(cachedDep.tier, cachedDep.dependency) : '';
-                var sanitizedId = s.class_name.replace(/[^a-zA-Z0-9]/g, '_');
+                var sanitizedId = leakEvidenceKey(s.class_name);
                 var explainLink = ' | <a class="suspect-explain-link" data-class="' + escapeHtml(s.class_name) +
                     '" data-retained="' + s.retained_size +
                     '" data-pct="' + s.retained_percentage +
@@ -5984,7 +6233,7 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
                         description: link.dataset.desc
                     };
                     if (link.dataset.objectId) {
-                        msgPayload.objectId = parseInt(link.dataset.objectId, 10);
+                        msgPayload.objectId = link.dataset.objectId;
                     }
                     vscode.postMessage(msgPayload);
                 });
@@ -6024,16 +6273,16 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
         });
 
         onMessage('explainLeakChunk', function(msg) {
-            var classSanitized = msg.className.replace(/[^a-zA-Z0-9]/g, '_');
+            var classSanitized = leakEvidenceKey(msg.className);
             // For object-level suspects, the explain area ID includes the objectId
-            var objSanitized = msg.objectId ? (msg.className + '_' + msg.objectId).replace(/[^a-zA-Z0-9]/g, '_') : classSanitized;
+            var objSanitized = msg.objectId ? leakEvidenceKey(msg.className,msg.objectId) : classSanitized;
             var bufferKey = msg.objectId ? objSanitized : classSanitized;
             if (!_explainLeakBuffers[bufferKey]) _explainLeakBuffers[bufferKey] = '';
             _explainLeakBuffers[bufferKey] += msg.text;
             // Try object-view first when objectId is present, then class-view
             var area = msg.objectId
-                ? (document.getElementById('explain-obj-' + objSanitized) || document.getElementById('explain-' + classSanitized))
-                : (document.getElementById('explain-' + classSanitized) || document.getElementById('explain-obj-' + objSanitized));
+                ? document.getElementById('explain-obj-' + objSanitized)
+                : document.getElementById('explain-' + classSanitized);
             if (area) {
                 area.textContent = _explainLeakBuffers[bufferKey];
                 area.scrollTop = area.scrollHeight;
@@ -6059,53 +6308,61 @@ const vscode={postMessage:send};const depInfoCache=Object.create(null);const isR
         }
 
         onMessage('explainLeakDone', function(msg) {
-            var classSanitized = msg.className.replace(/[^a-zA-Z0-9]/g, '_');
-            var objSanitized = msg.objectId ? (msg.className + '_' + msg.objectId).replace(/[^a-zA-Z0-9]/g, '_') : classSanitized;
+            var classSanitized = leakEvidenceKey(msg.className);
+            var objSanitized = msg.objectId ? leakEvidenceKey(msg.className,msg.objectId) : classSanitized;
             var bufferKey = msg.objectId ? objSanitized : classSanitized;
             // Try class-view explain area
-            var classArea = document.getElementById('explain-' + classSanitized);
+            var classArea = !msg.objectId && document.getElementById('explain-' + classSanitized);
             if (classArea) {
                 classArea.classList.remove('streaming');
                 classArea.classList.add('rendered');
-                classArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || '');
+                if (msg.safeEvidenceAnswer) {
+                    classArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || '');
+                    attachInvestigationEvidence(classArea, msg.evidence);
+                } else { classArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || ''); }
                 classArea.scrollTop = 0;
                 addExplainCloseBtn(classArea);
             }
             // Try object-view explain area
-            var objArea = document.getElementById('explain-obj-' + objSanitized);
+            var objArea = msg.objectId && document.getElementById('explain-obj-' + objSanitized);
             if (objArea) {
                 objArea.classList.remove('streaming');
                 objArea.classList.add('rendered');
-                objArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || '');
+                if (msg.safeEvidenceAnswer) {
+                    objArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || '');
+                    attachInvestigationEvidence(objArea, msg.evidence);
+                } else { objArea.innerHTML = renderMarkdown(_explainLeakBuffers[bufferKey] || ''); }
                 objArea.scrollTop = 0;
                 addExplainCloseBtn(objArea);
             }
             delete _explainLeakBuffers[bufferKey];
-            document.querySelectorAll('.suspect-explain-link[data-class="' + msg.className + '"]').forEach(function(link) {
+            document.querySelectorAll('.suspect-explain-link').forEach(function(link) {
+                if (link.dataset.class !== msg.className) return;
                 link.textContent = 'Explain';
             });
         });
 
         onMessage('explainLeakError', function(msg) {
-            var classSanitized = msg.className.replace(/[^a-zA-Z0-9]/g, '_');
-            var objSanitized = msg.objectId ? (msg.className + '_' + msg.objectId).replace(/[^a-zA-Z0-9]/g, '_') : classSanitized;
+            var classSanitized = leakEvidenceKey(msg.className);
+            var objSanitized = msg.objectId ? leakEvidenceKey(msg.className,msg.objectId) : classSanitized;
             var bufferKey = msg.objectId ? objSanitized : classSanitized;
             delete _explainLeakBuffers[bufferKey];
             // Try class-view explain area
-            var classArea = document.getElementById('explain-' + classSanitized);
+            var classArea = !msg.objectId && document.getElementById('explain-' + classSanitized);
             if (classArea) {
                 classArea.classList.remove('streaming');
                 classArea.classList.add('error', 'visible');
                 classArea.textContent = msg.message || 'An error occurred';
             }
             // Try object-view explain area
-            var objArea = document.getElementById('explain-obj-' + objSanitized);
+            var objArea = msg.objectId && document.getElementById('explain-obj-' + objSanitized);
             if (objArea) {
                 objArea.classList.remove('streaming');
                 objArea.classList.add('error', 'visible');
                 objArea.textContent = msg.message || 'An error occurred';
             }
-            document.querySelectorAll('.suspect-explain-link[data-class="' + msg.className + '"]').forEach(function(link) {
+            document.querySelectorAll('.suspect-explain-link').forEach(function(link) {
+                if(link.dataset.class !== msg.className)return;
                 link.textContent = 'Explain';
             });
         });
@@ -6125,7 +6382,9 @@ function leakReply(message,done,error) {
     if(message.text)leakAnswer+=message.text;
     area.classList.add('visible');
     if(error){area.textContent=message.message || 'AI request failed.';area.classList.add('error');}
-    else area.innerHTML=renderMarkdown(leakAnswer);
+    else if(done && !message.safeEvidenceAnswer)area.innerHTML=renderMarkdown(leakAnswer);
+    else {area.textContent=leakAnswer;area.style.whiteSpace='pre-wrap';}
+    if(done && message.safeEvidenceAnswer)window.attachInvestigationEvidence(area,message.evidence);
     if(done || error){area.classList.remove('streaming');link.textContent='Explain';addExplainCloseBtn(area);leakAnswer='';}
 }
 listen('explainLeakChunk',function(m){leakReply(m,false,false);});