Files
hermes-webui/static/outline.js
T
b470793473 Release: msg_limit ceiling + row-loss-safe pagination (#6152 + #6154, @rh-id) (#6213)
* fix(routes): clamp GET /api/session msg_limit to a server-side ceiling

Memory: ?msg_limit= had no upper bound — a client could request
msg_limit=1000000 (or the frontend's msg_limit=9999 outline-jump path) and
force the server to assemble and serialize an unbounded message payload. The
frontend's real pagination grows windows by ~30 at a time (initial load 30,
load-older +30, msg_before paging 30), so only the outline-jump and
pathological/hostile cases ask for huge values.

Add _MAX_MSG_LIMIT (500) and clamp at the query-parse site
(max(1, min(int(_msg_limit), _MAX_MSG_LIMIT))). The ceiling is generous — far
above any legitimate visible-row window — so real pagination is unaffected. The
existing _messages_truncated signal already covers the clamped case: when the
request exceeds the ceiling, _message_window_for_display returns
_messages_offset > 0 and the client learns more rows exist (load-older still
works). The bare no-msg_limit path is intentionally unchanged — it is the
documented "give me everything" escape hatch used by branch/undo/jump-to-start
flows that need the full transcript for correct global indices.

Test: tests/test_session_msg_limit_ceiling.py — the ceiling constant is
reasonable (100..2000), an over-ceiling request is clamped and signals
truncation, and legit sizes (5/30/60/100) are unaltered. Existing window/tail
tests (19) unchanged.

Contract Routing
- Task type: memory-bound fix (unbounded msg_limit request payload).
- Touched areas: GET /api/session query parsing (api/routes.py).
- Relevant public docs: AGENTS.md, CONTRIBUTING.md, docs/CONTRACTS.md.
- State layer mutated: none (read-only endpoint response shaping).
- Contract change (additive): ?msg_limit=N is now clamped to _MAX_MSG_LIMIT=500.
  Compatibility: the only frontend caller above the ceiling is outline.js's
  msg_limit=9999, which now receives up to 500 rows + _messages_truncated=true
  (load-older still works). All other callers (30/60) are unaffected. The bare
  no-msg_limit path is unchanged.

Release note: GET /api/session now caps ?msg_limit at 500 rows server-side,
bounding the worst-case payload for oversized requests.

Model Used: builtin:zai-coding-plan/GLM-5.2 (ZCode agent).

* fix(frontend): route msg_limit-heavy paths around the server ceiling

PR #6152 clamps GET /api/session ?msg_limit= to a max of 500 server-side. Two
frontend paths relied on unbounded msg_limit and silently broke for sessions
> 500 visible rows:

1. outline.js _jumpToMessage sent msg_limit=9999 as a "give me everything" hack
   so it could scroll to any message by absolute index (msg-user-<rawIdx>).
   Clamped to 500, the target row's DOM id doesn't exist for early messages in
   long sessions, and the jump silently no-ops (line 119 `if (r)` is falsy).
   Fix: drop msg_limit=9999 — use the bare messages=1 path, which #6152 left
   unbounded precisely for callers that need the full transcript. This restores
   exact pre-#6152 behavior for outline jumps.

2. sessions.js _loadOlderMessages grows msg_limit by +_INITIAL_MSG_LIMIT each
   load (30 -> 60 -> ... -> 500 -> clamped). Past 500 the server returns the
   same clamped tail, olderMsgs shrinks to 0, and endless-scroll / "Load
   earlier" silently stalls — the head becomes unreachable. Fix: once the grown
   requestedLimit meets/exceeds the new _MSG_LIMIT_MAX mirror (500), switch the
   primary fetch to msg_before paging (a fixed _INITIAL_MSG_LIMIT backward page
   keyed off _oldestIdx) — the same bounded paging the existing race-fallback
   uses, so the head stays reachable for arbitrarily long transcripts. The
   response is handled by the existing prepend path (tailMatches is naturally
   false for a page, so the !tailMatches branch reuses the fetched data).

Added _MSG_LIMIT_MAX = 500 constant in sessions.js mirroring backend
_MAX_MSG_LIMIT, documented as kept-in-sync.

Verification: node --check passes on both files; the backend window-contract
tests (test_session_tail_payload, test_session_message_window_renderable_tail,
19 tests) still pass. No JS test harness exists in this repo (vanilla JS,
manual browser verification per TESTING.md) — manual verification needed: open a
> 500-message session, (a) click an outline entry for an early message and
confirm it scrolls+flashes, (b) scroll up past 500 loaded rows and confirm
"Load earlier" keeps producing older messages without stalling.

Contract Routing
- Task type: frontend follow-up to a backend memory fix (#6152).
- Touched areas: outline jump-to-message (static/outline.js), endless-scroll /
  load-older (static/sessions.js _loadOlderMessages).
- Relevant public docs: AGENTS.md, CONTRIBUTING.md, docs/CONTRACTS.md.
- State layer mutated: client-side S.messages (the active-session transcript),
  same as the existing load-older path. No backend state change.
- Scope boundaries: does not weaken the #6152 clamp. The bare messages=1 path
  (outline) was intentionally left unbounded by #6152; the msg_before paging
  path (load-older) is bounded by _INITIAL_MSG_LIMIT and never hits the ceiling.

Release note: fixes outline jump-to-message and endless scroll silently
breaking on sessions longer than 500 messages after the server-side msg_limit
ceiling (companion to #6152).

Model Used: builtin:zai-coding-plan/GLM-5.2 (ZCode agent).

* test(frontend): update static-source assertion for refactored _loadOlderMessages fetch

The static-source test test_session_message_loads_keep_explicit_longer_timeouts
asserted the exact multi-line shape of the _loadOlderMessages fetch strings.
The #6154 refactor wrapped them in a useBeforePaging ternary (tail-growth vs
msg_before paging), reindenting them — the contract the test guards (both
fetches keep timeoutMs:120000 for large state.db loads) is preserved, but the
literal source shape changed, so the assertion failed on shard 0.

Updated the assertions to match the new source shape while keeping the test's
intent: assert each fetch URL + its {timeoutMs:120000} survive in sessions.js.

Model Used: builtin:zai-coding-plan/GLM-5.2 (ZCode agent).

* test(msg-limit): stopgap drift guard for _MSG_LIMIT_MAX === _MAX_MSG_LIMIT

Reviewer guidance (#6154 round-2): the stopgap drift-test belongs in THIS PR
(#6152) because _MAX_MSG_LIMIT is defined here. The frontend _MSG_LIMIT_MAX
mirror lives on #6154 (not master yet), so the assertion SKIPS when the JS
constant is absent and activates automatically once both branches land on master.

The guard: extract _MAX_MSG_LIMIT from api/routes.py and _MSG_LIMIT_MAX from
static/sessions.js via regex; assert equality when both present. If they drift,
load-older silently stalls at the wrong value (the exact regression #6154 fixed).
Retired by #6177 (metadata-exposure), which removes the mirror entirely.

Verified: on this branch the cross-check SKIPS (_MSG_LIMIT_MAX absent, as
expected — #6154 not landed) and the backend-existence test PASSES. Extraction
logic confirmed correct against simulated match (500==500 passes) and drift
(999!=500 fails) cases.

Model Used: builtin:zai-coding-plan/GLM-5.2 (ZCode agent).

* fix(session): prevent silent row-loss in msg_limit ceiling paging (gate follow-up)

Adversarial review of #6152/#6154 reproduced two silent row-loss regressions in
static/sessions.js; both fixed here, plus a stale source-string assertion update
and the CHANGELOG entry:

1. _loadOlderMessages: gate the suffix-continuity heuristic on !useBeforePaging so
   a raw-row-heavy msg_before cursor page whose visible text repeats the current
   tail can't be misclassified as the cumulative tail and wholesale-replace it
   (previously dropped 470 of 940 rows). msg_before pages are always prepended.

2. loadSession same-session refresh: only apply the width-hint msg_limit when it
   is <= _MSG_LIMIT_MAX; above the ceiling the backend would clamp and silently
   shrink an already-loaded >500-row transcript to the last 500. Over-ceiling
   reloads now use the bare full-transcript path (no msg_limit / no expand_renderable).

3. tests/test_webui_external_refresh_frontend.py: update the reloadLimitParam
   source assertion to the boundedReloadLimit form.

Re-gate: Codex adversarial SAFE TO SHIP (940/940 rows retained on cursor paging,
1000/1000 on refresh, no seam duplication, small sessions still use the fast tail
window); targeted + sessions/pagination/regression suites green.

Co-authored-by: Ruby Hartono <rh-id@users.noreply.github.com>

* test: fix two node-harness tests broken by the boundedReloadLimit change

- test_issue3162_ensure_messages_loaded: replace the brittle fixed 4500-char
  window (which the boundedReloadLimit lines pushed the carry-forward past) with
  robust brace-balance function-body extraction.
- test_cross_session_message_load_isolation: define _MSG_LIMIT_MAX=500 in the node
  harness env; _ensureMessagesLoaded now references it, and an undefined value made
  boundedReloadLimit=null -> the fetch URL dropped msg_limit/expand_renderable and
  mismatched the ordered api() harness -> stall/timeout.

---------

Co-authored-by: Ruby Hartono <58564005+rh-id@users.noreply.github.com>
Co-authored-by: nesquena-hermes <agent@nesquena-hermes>
Co-authored-by: Ruby Hartono <rh-id@users.noreply.github.com>
2026-07-17 20:15:40 -07:00

302 lines
11 KiB
JavaScript

// ── Conversation Outline Panel (#2124) ───────────────────────────────────────
// Floating panel listing user messages as jump targets.
// _outlineSid guards against stale renders when the user switches sessions.
'use strict';
(function() {
let _outlineSid = null; // session id the panel was last built for
let _panelOpen = false; // whether the panel is currently visible
let _outlineResizeObserver = null;
let _outlineWorkspaceObserver = null;
// Returns the current session id, or null if no session is loaded.
function _currentSid() {
return (S && S.session && S.session.session_id) || null;
}
function _outlineAllowed() {
const compact = window.matchMedia && window.matchMedia('(max-width:900px)').matches;
// The outline is a chat-view affordance only — never show the toggle or panel
// while another MAIN panel (settings, tasks, insights, …) is active. _currentPanel
// is owned by panels.js; treat an undefined/absent value as the chat default.
// 'todos' is a sidebar-only panel that leaves the chat transcript in <main>, so
// the outline stays valid there too (and switching to it emits no <main> class
// mutation for the observer, so allowing it keeps the toggle stable).
const panel = (typeof _currentPanel === 'undefined') ? 'chat' : (_currentPanel || 'chat');
const onChatView = panel === 'chat' || panel === 'todos';
return window._showConversationOutline === true && !compact && onChatView;
}
function _syncOutlinePosition() {
const root = document.documentElement;
const panel = document.querySelector('.rightpanel');
const open = root.dataset.workspacePanel === 'open';
const width = open && panel ? Math.max(0, Math.round(panel.offsetWidth || 0)) : 0;
root.style.setProperty('--outline-workspace-offset', width + 'px');
}
function applyConversationOutlinePreference() {
const toggle = document.getElementById('outlineToggleBtn');
const wrapper = document.getElementById('outlinePanelWrapper');
const enabled = _outlineAllowed();
document.documentElement.dataset.conversationOutline = enabled ? 'enabled' : 'disabled';
_syncOutlinePosition();
if (toggle) toggle.hidden = !enabled;
if (!enabled) {
_panelOpen = false;
if (wrapper) wrapper.hidden = true;
}
}
function _expandOutlineRenderWindow() {
if (typeof _currentMessageRenderWindowSize !== 'function' ||
typeof _messageRenderableMessageCount !== 'function' ||
typeof _messageRenderWindowSize === 'undefined') return;
_messageRenderWindowSize = Math.max(
_currentMessageRenderWindowSize(),
_messageRenderableMessageCount()
);
}
function _ensureOutlineMessagesLoaded(sid) {
if (!sid || S.busy || S.activeStreamId) return Promise.resolve(false);
if (typeof _messagesTruncated === 'undefined' || !_messagesTruncated) {
return Promise.resolve(false);
}
if (typeof _ensureAllMessagesLoaded !== 'function') return Promise.resolve(false);
return _ensureAllMessagesLoaded().then(function() {
if (!S.session || S.session.session_id !== sid) return false;
_expandOutlineRenderWindow();
return true;
}).catch(function() {
return false;
});
}
// Extracts the first 60 visible characters from a message content value.
function _excerptText(content) {
let text = '';
if (Array.isArray(content)) {
text = content
.filter(p => p && p.type === 'text')
.map(p => p.text || p.content || '')
.join(' ');
} else {
text = String(content || '');
}
text = text.trim().replace(/\s+/g, ' ');
return text.length > 60 ? text.slice(0, 60) + '…' : text;
}
// Scrolls to a user message row identified by its rawIdx and flashes it.
function _jumpToMessage(rawIdx) {
const sid = _currentSid();
if (!sid) return;
const rowId = 'msg-user-' + rawIdx;
const row = document.getElementById(rowId);
if (row) {
row.scrollIntoView({ block: 'center', behavior: 'smooth' });
_flashRow(row);
return;
}
// Row is outside the render window — reload the full session and retry.
// Use the bare messages=1 path (no msg_limit) so the server returns the
// COMPLETE transcript: the target row is addressed by absolute index
// (msg-user-<rawIdx>), so a bounded tail window would miss early rows.
// (A previous version sent msg_limit=9999 as a "give me everything" hack,
// but the server now clamps msg_limit, so the bare path is the correct way
// to request the full transcript here.)
if (typeof api !== 'function') return;
if (S.busy || S.activeStreamId) return;
api('/api/session?session_id=' + encodeURIComponent(sid) +
'&messages=1&resolve_model=0')
.then(function(data) {
if (!data || !data.session) return;
if (!S.session || S.session.session_id !== sid) return; // session switched
S.messages = data.session.messages || []; // populate S
_expandOutlineRenderWindow();
if (typeof renderMessages === 'function') renderMessages({ preserveScroll: true });
window.setTimeout(function() {
if (!S.session || S.session.session_id !== sid) return;
const r = document.getElementById('msg-user-' + rawIdx);
if (r) { r.scrollIntoView({ block: 'center', behavior: 'smooth' }); _flashRow(r); }
}, 120);
})
.catch(function() {});
}
// Brief highlight flash on a message row after jumping.
function _flashRow(row) {
if (!row) return;
row.classList.remove('outline-jump-flash');
void row.offsetWidth; // reflow to restart animation
row.classList.add('outline-jump-flash');
window.setTimeout(function() { row.classList.remove('outline-jump-flash'); }, 1200);
}
// Builds the list of user messages from S.messages.
// Returns [{rawIdx, label, excerpt}, …] for every user message with content.
function _buildEntries() {
const msgs = (S && S.messages) || [];
const entries = [];
let userN = 0;
for (let i = 0; i < msgs.length; i++) {
const m = msgs[i];
if (!m || m.role !== 'user') continue;
const text = _excerptText(m.content);
if (!text) continue;
userN++;
entries.push({ rawIdx: i, label: userN, excerpt: text });
}
return entries;
}
// Renders the panel body. Called every time the panel opens or session changes.
function _renderPanel() {
const panel = document.getElementById('outlinePanel');
if (!panel) return;
const sid = _currentSid();
// Session-scoped staleness guard.
if (!sid) {
panel.innerHTML = '<p class="outline-empty">' + t('outline_empty') + '</p>';
_outlineSid = null;
return;
}
if (!S.messages) {
panel.innerHTML = '<p class="outline-empty">' + t('outline_loading') + '</p>';
_outlineSid = sid;
return;
}
_outlineSid = sid;
const entries = _buildEntries();
if (!entries.length) {
panel.innerHTML = '<p class="outline-empty">' + t('outline_empty') + '</p>';
return;
}
const items = entries.map(function(e) {
return '<button class="outline-entry" type="button" ' +
'onclick="window._outlineJump(' + e.rawIdx + ')">' +
'<span class="outline-entry-num">' + e.label + '</span>' +
'<span class="outline-entry-text">' + _escHtml(e.excerpt) + '</span>' +
'</button>';
});
panel.innerHTML = items.join('');
}
// Simple HTML-escape for entry text.
function _escHtml(str) {
return String(str)
.replace(/&/g, '&amp;')
.replace(/</g, '&lt;')
.replace(/>/g, '&gt;')
.replace(/"/g, '&quot;');
}
// Opens or closes the outline panel.
function toggleOutlinePanel() {
if (!_outlineAllowed()) {
applyConversationOutlinePreference();
return;
}
_panelOpen = !_panelOpen;
const wrapper = document.getElementById('outlinePanelWrapper');
if (!wrapper) return;
if (_panelOpen) {
_syncOutlinePosition();
wrapper.hidden = false;
const sid = _currentSid();
const panel = document.getElementById('outlinePanel');
if (panel) panel.innerHTML = '<p class="outline-empty">' + t('outline_loading') + '</p>';
_ensureOutlineMessagesLoaded(sid).then(function() {
if (!_panelOpen || _currentSid() !== sid) return;
_renderPanel();
// Keep rendered data fresh after every renderMessages() call.
_outlineSid = _currentSid();
});
} else {
wrapper.hidden = true;
}
}
// Jump target exposed on window so inline onclick handlers can reach it.
window._outlineJump = _jumpToMessage;
window.applyConversationOutlinePreference = applyConversationOutlinePreference;
// Re-render after renderMessages() if the panel is open and the session
// changed or new messages arrived since the last render.
(function _hookRenderMessages() {
if (typeof window._outlineRenderHooked !== 'undefined') return;
const _orig = window.renderMessages;
if (typeof _orig !== 'function') {
// renderMessages may not be defined yet — retry after DOMContentLoaded.
if (!window._outlineRenderHookPending) {
window._outlineRenderHookPending = true;
document.addEventListener('DOMContentLoaded', _hookRenderMessages, { once: true });
}
return;
}
window._outlineRenderHooked = true;
window._outlineRenderHookPending = false;
window.renderMessages = function() {
const result = _orig.apply(this, arguments);
if (_panelOpen) {
const sid = _currentSid();
if (sid && (sid !== _outlineSid || (S.messages || []).length > 0)) {
_renderPanel();
}
}
return result;
};
})();
// Expose public API.
window.toggleOutlinePanel = toggleOutlinePanel;
document.addEventListener('DOMContentLoaded', function() {
applyConversationOutlinePreference();
const root = document.documentElement;
const rightPanel = document.querySelector('.rightpanel');
if (rightPanel && typeof ResizeObserver !== 'undefined' && !_outlineResizeObserver) {
_outlineResizeObserver = new ResizeObserver(_syncOutlinePosition);
_outlineResizeObserver.observe(rightPanel);
}
if (!_outlineWorkspaceObserver) {
_outlineWorkspaceObserver = new MutationObserver(applyConversationOutlinePreference);
_outlineWorkspaceObserver.observe(root, {
attributes: true,
attributeFilter: ['data-workspace-panel']
});
// Also re-evaluate when the active main panel changes. switchPanel() is a
// global function declaration (called via inline onclick), so it can't be
// reliably wrapped from this script; instead we watch the `showing-<panel>`
// class it toggles on <main>. The outline is a chat-only affordance, so this
// hides the toggle + closes the panel when leaving chat (settings, tasks,
// insights, …) and restores the toggle on return to chat. _outlineAllowed()
// reads _currentPanel for the actual gate; this observer just triggers it.
const mainEl = document.querySelector('main.main');
if (mainEl) {
_outlineWorkspaceObserver.observe(mainEl, {
attributes: true,
attributeFilter: ['class']
});
}
}
});
window.addEventListener('resize', applyConversationOutlinePreference);
})();