The copyText switch's default arm calls assertNever, the closed-union
backstop that the per-file 100% coverage gate cannot reach without a
forged row kind. The assertNever function itself already carries the
v8 ignore; mark the switch arm that reaches it the same way, matching
TodoPanel's StatusGlyph default arm.
Review follow-ups on the presentation intent.
The card claimed any single-question request declaring the intent, then sent one
of two labels — so a producer offering a third option, or a multi-select batch,
lost answers the generic flow would have shown. That contradicts the intent's
own contract, so `planReviewOf` now claims only a binary single choice and
leaves everything else to the flow that can express it.
`ask()` also rejects a plan-review intent on a question with no `detail`: the
intent declares detail IS the plan, and without one a honouring UI asks the
user to approve something invisible. The client keeps its own fallback — it sits
downstream of a wire boundary — but the misconfiguration now fails at the asker.
`planReviewOf` stops being a value export of the client contract face (client
export discipline: pure helpers stay internal; the tests already import it
relatively), and the ui-question README fallback list, both languages, now
states every condition the code enforces.
- DetailsPanel: render the flattened result content below the web card, so a
web_fetch's fetched body (and a search's answer/source markdown) stays
visible on the panel's single-call reading surface — the card is a summary.
- WebBlock: the collapsed source tail keeps each source's original citation
number via <li value>, and the expand control is a marker-less <li> so the
<ol> is valid HTML; an empty-hostname URL (file:/data:) falls back to the raw
URL so a label is never blank.
- web-row / GenericToolCard: both spread WebBlock uniformly with maxSources
(fetch ignores it, like TerminalBlock's maxLines), dropping the duplicated
per-kind conditional.
- Docs: WebBlock added to the ui-primitives README (both languages) with a Web
retrieval section; the ui-conversation README's "inline licensed for this
intent alone" claim de-absolutized and a web-card paragraph added; the Agent
Note's safe-link description corrected to the http(s) subset of MarkdownText's
allowlist (mailto excluded). Fixture source comment aligned with its data.
- Tests: ol numbering + marker-less expander, empty-hostname label fallback,
the fetched body visible in the panel.
The review named this call site with the other two, and the previous pass
missed it: the editor card's mount-time `credentials.describe` had only a
fulfillment handler, so a transport failure reached the browser as an
unhandled rejection.
The probe is a placeholder hint ("already configured"), never a precondition
for editing, so it now renders without the hint rather than failing. Covered
by a test that fails without the handler.
The remaining P1 from the #939 review, plus the P2 it shares a mechanism with.
Nothing carried a version, so two tabs editing one namespace silently
overwrote each other — reproduced as tab B's `reasoning` lost to tab A's
older draft. The seam's per-namespace write queue orders writes; it cannot
tell a fresh writer from one replaying a snapshot a predecessor superseded.
Each namespace now carries a monotonic `revision` over its RAW section. A
write may send `expectedRevision`, checked at the FRONT of the queue (not at
call time, which would race the very predecessor it guards against); a
mismatch rejects with `SettingsConflictError` → `settings-conflict` on the
wire, carrying both revisions. The editor captures the revision it opened at
and, on conflict, asks the user to reopen rather than replaying its snapshot.
The same counter fixes the missing broadcast. `settings/updated` is gated on
the resolved value — correct for consumers, wrong for configuration surfaces:
storing an override equal to the composition base leaves the resolved value
alone while changing what the document says (the field is now overridden, not
inherited) and moving every open editor's revision. `settings/document-updated
(ns, revision)` fires on any raw-section change, in-process or external, and
`host/settings-changed` now rides it.
That event also closes the stale model picker: editing a provider's `models`
changes no route, so `llm/adapters-updated` never fired and an open picker
kept serving the old catalog. A change to an exposed provider namespace now
emits `host/models-changed` too — that namespace holds the catalog.
Docs: both sides of the five touched README pairs, a type-equiv block for
`SettingsPathOp`, and an Agent Note recording what the plane exposes and who
may overwrite what. The deferred wire-redaction gaps (secrets behind
union/intersection/transform, `.default(...)` in the served envelope, schema
text in rejection messages, `new Function` rehydration, pi-ai's `headers`) are
recorded as TODO(settings-wire-redaction) and in Known Limitations rather than
half-fixed.
The lane boots the host spine through the shared scaffold, so it belongs to
tsconfig.host.json and must stay out of the client-registered apps/web project
— one program cannot hold both sides of the cordis Context merges.
The Web composer now renders a request that declares the `plan-review` intent
as its own surface: the waiting-approval card language — amber "Plan review"
strip, the plan as the scrolling markdown body, the question as the card's
accessible name — over one decision row of Chat about it / Refuse / Approve.
Gone from that surface are the 1/1 pager, the numbered radio rows, the custom
answer row, and Skip/Submit, which made approving a plan read as sitting an
exam.
Approve and Refuse answer with the asker's own option labels and keep its
descriptions as tooltips; Chat about it cancels the request so the composer
returns and the user can simply say what they want. Copy is bilingual under the
existing `question` namespace.
The shape choice lives inside the single composer entry rather than a second
chain registration, so the two surfaces cannot race the same carrier, and
`planReviewOf` falls back to the generic flow for any request it cannot render
as a card — the client sits downstream of a wire boundary and every request
must stay answerable.
A question may now carry `intent`, a tagged declaration that it IS a decision
of a known shape, so a UI that recognises the tag can present it as such
instead of as a generic option list. The one member is
`{ kind: 'plan-review', approve }`, which plan-mode sets on the exit_plan_mode
review.
An intent shapes presentation only: a UI honouring it answers with the same
option labels a generic UI would send, so the tool reads one answer shape
either way, and a UI that does not know the tag renders the generic flow.
`approve` names the affirmative option rather than relying on option order;
since no type can tie that label to the question's own option list, `ask()`
rejects a mismatch as BAD_INTENT, and the wire schema rejects an unknown tag
outright rather than silently rendering generic.
plan-mode also stops reporting a dismissed review as "the user cancelled
ask_user_question" — a tool it never called. A dismissal now tells the model
the user took the turn back to speak, and to stay in plan mode and wait; every
other ask failure keeps its own message.
web_fetch now projects presentationMeta ({url, statusCode, truncated}) onto its
tool/result, so the web-fetch scenario carries that meta; cordis-inspect-jsdoc
shifts with the widened ToolResultView type surface. Model-facing text is
unchanged. Refreshed keyless.
A read result now carries card:'read', but render()'s genericContent gate was
card==='generic' only, so the read body kept its text yet lost the dim-Markdown
dimBody treatment the generic card gave it. Admit card:'read' to that gate so
its content fallback takes the same dim path, restoring read's TUI rendering to
what it was before the read card existed. Refresh the parallel-file-reads TUI
golden accordingly and correct the Note's TUI claim on both language sides.
The read tool now projects presentationMeta ({path, lines, totalLines}) onto
its tool/result, so every scenario with a read call carries that meta; the
cordis-inspect snapshot's embedded type surface gains ReadResultView /
ReadFileLine / the widened ToolResultView. Model-facing text is unchanged.
Refreshed keyless via test:snapshot:refresh. The unrelated goal.snapshot
SQLite ExperimentalWarning failure is pre-existing on clean master.
Review follow-ups on the approval takeover:
The scroll region is now a tab stop (tabIndex + named role="group"). The
question composer's scroll body needs none — its option rows are focusable and
pull the container along — but this one holds nothing but text, so a
keyboard-only user could reach the buttons and never the command's tail, and
approve what they could not finish reading.
The action row's padding reproduces the 14px gap it had inside the body: the
flex gap of 6 plus its 8px top margin, neither of which reaches it now that the
row sits outside the scroll region. The resting card is unchanged again.
- DiffBlock: an empty side contributes zero lines and a trailing newline is a
terminator, so a create ending in a newline draws one added line (not a
phantom empty one) and a full deletion draws no phantom + line.
- diffCardModel: narrow the wire diffs payload (card is the only validated
field) so a malformed diff card falls back to the generic path instead of
throwing inside DiffBlock.
- FileMutationRow: surface the result text when an errored mutation has no diff
card, so a failed edit/write is more than a red dot.
- copyText ends its closed union on assertNever.
- Docs: drop the "bridge relativizes" claim, record the file-count divergence
from the TUI footer, correct the built-boot overclaim, note why the row title
outranks the view title, and make fixture turn 67 args self-consistent.
- Tests: terminator/empty-side/interior-blank rows, wire-narrowing null arms,
the error-text arm and its name/code fallback, stopped state, no-path summary,
and the registration/disposal shape.
Five findings from the #939 review, each reproduced before being fixed.
**Configuration reads are as privileged as writes.** `settings.describe`
returns every exposed namespace's configuration and `credentials.describe`
reports whether an arbitrary environment-variable name is configured and from
where — reconnaissance no anonymous caller should have. Both join
PRIVILEGED_METHODS, so the whole configuration plane is loopback-only until
real authentication exists; `trustedHosts` was never authentication. The model
catalog stays reachable: it carries no endpoints or key state, and a LAN
client's model picker legitimately needs it. Asserted over a real HTTP server,
because the Host header a browser actually sends is what decides this.
**The proxy serves only namespaces a registered model provider addresses.**
The settings seam is general — any plugin may register one — but the Web
configuration plane is the model-provider surface. Without the gate, every
future `settings.register()` would silently become remotely readable and
writable configuration. An unregistered namespace and an unexposed one answer
identically, so no caller can enumerate the registry one probe at a time.
**Path-addressed writes replace the redacted-document rebuild.** The editor
reads the REDACTED descriptor, so rebuilding a section from it and replacing
wholesale deleted every literal secret the wire never returned — reproduced as
`{baseURL, reasoning}` in, stored `apiKey` gone out. `settings.mutate` applies
set/unset ops to the section as it stands at the front of the seam's write
queue, and the client names only fields it can see, so an unseen secret is
untouched by construction rather than by care.
P2s in the same pass: `llm/adapters-updated` now contains async listener
rejections (an uncontained one escaped as unhandledRejection, contradicting
the documented "observer failures are contained"); llm-deepseek's retry-policy
swap uses the atomic `registration.replace` instead of dispose-then-register,
which published `[]` then `["deepseek-official"]` so an observer saw the
provider disappear and come back; and a transport rejection no longer strands
the page in `loading` or a card in `busy`, with removal failures surfaced on
the page banner instead of swallowed.
The answered-transcript golden captured the OS's own refusal of the denied
first attempt — "bash: notes.txt: Operation not permitted" on macOS against
"bash: line 1: notes.txt: Read-only file system" on Linux — so it passed
locally and failed the Linux snapshot lane.
The scenario now keeps one golden (the waiting panel, platform-neutral) and
asserts the answered state on the world instead: the decided outcome, the file
the escalated command actually wrote, DONE, the panel gone, and the composer
re-enabled. The file assertion is stronger evidence than the transcript dump
it replaces — it proves the grant reached the executor.
