Bound silent chat RPCs and validate Mac send recovery

[Open-Squilla]

Scope

Scope boundary: Recover from response-silent CLI chat RPCs without replaying ambiguous sends, make rejected browser credentials actionable, and add Mac/background and same-session send acceptance coverage.

CLI chat admission, abort and subscription requests now have a response deadline and clean up pending futures on timeout, cancellation or close. Unsubscribe releases its ordering lock before awaiting the reply. Synchronous compaction and Cron runs use their server execution budgets plus a response margin; five explicitly listed maintenance operations without an aggregate server deadline retain their existing waits and support an explicit deadline override. The retired memory.repair.run method uses the ordinary bounded deadline.

The browser shows an actionable Token required state for explicit authentication rejection, focuses the existing credential field, preserves typing while retries are paused, and connects on Enter. Legal guest access and ordinary permission/policy denials keep their distinct behavior. Managed desktop credential controls remain managed.

Non-goals: Automatically retrying ambiguous sends, changing server authorization, adding stream-idle deadlines, implementing offline auto-send, or accepting the original Windows #1601 scenario.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: Fixes #1157, fixes #1048, fixes #958, fixes #1507. Refs #1217, #1292, #1601 and #1515.

• [Bug]: 会存在偶发的输入内容但是无法发送 #1157: Current source passes native Mac hide/disconnect for 65 seconds, activate, retained-draft send and a real Gateway/local synthetic provider response. Additional browser coverage advances two hours with healthy and half-open connections. This verifies current-source recovery; it is not a physical host-sleep, packaged-installer or Windows acceptance claim.
• [Feature]: 发送按钮不生效 #1048: Success, failure and cancellation permit another send in the same session; a real Gateway also completes two consecutive turns with the first reply in second-turn history.
• [Feature]: Prompt for the auth token in the Web UI instead of looping on connection errors #958 and GatewayClient RPCs have no response timeout: a silent gateway hangs the chat forever and deadlocks all subsequent turns #1507: New regression cases fail before their respective fixes and pass afterward.
• [Bug]: Web UI does not reconnect after business session authorization expires #1217 remains open: Current guest authority survives seven days of simulated wall time. A real none-to-token transition instead exposes a distinct session-ownership mismatch: a fresh Chat draft uses a non-guest key and guest policy correctly rejects its subscription/snapshot. Reconnecting alone does not change that key. The original deployment's alleged expiry trigger is not established.
• [Feature] Send robustness — loading state, error feedback, and WebSocket auto-reconnect #1292 remains open because its bundled request includes offline queue/automatic send behavior not implemented here. [Bug]:总是提示要恢复实时更新 #1601 still needs the original Windows environment and scenario.

Release Note

Release note: CLI chat now reports unanswered Gateway requests instead of indefinitely blocking later turns. Browser authentication rejection provides stable, focused token entry. Mac idle-return and consecutive-send recovery have permanent regression coverage.

Tests

Ruff: Updated CLI source, its regression file, and workflow tests passed after integration with current main. The wider source/tests check also passed before the rebase.

Pytest after synchronizing current main and its locked dependencies: CLI keepalive plus workflow preflight, 201 passed; additional CLI and WebSocket/auth/guest-policy files, 80 passed; provider stream lifecycle and WebSocket request concurrency, 42 passed. After removing the retired memory repair timeout exception, all four CLI Gateway files passed again (70 tests); its new deadline case failed before the correction.

Build: WebUI npm run build passed, including type checking, architecture/i18n checks, bundle verification and Gateway asset staging. Targeted Python mypy passed.

Regression tests: added

Notes:

• Focused frontend RPC/authentication/connection/settings/workspace/history tests after integration: 474 passed across 10 files. Existing send/event regressions passed before the rebase.
• Chromium integration after rebuilding: all 19 cases across the four added browser specs and main's provider-error/newline specs passed with two workers and zero retries. Coverage includes real authentication, two real Gateway turns, idle recovery and same-session send lifecycle.
• Native macOS Electron source acceptance before the dependency refresh passed with --connection-faults --flow-control --idle-send --background-ms=65000: 65,000 ms hidden, 1,665 ms from activation to send readiness, one accepted send, one local provider request, rendered reply, retained renderer/composer, and clean shutdown without force. The preceding full CI also passed this scenario on its first attempt (65,034 ms hidden, 2,754 ms recovery). Fresh required CI must validate the updated main and Electron dependency before merge.
• Simulated clocks cover slow compaction/Cron/maintenance completion, silent deadlines and lost-send-receipt behavior without sleeping through execution budgets.
• The Desktop CI command is executed under macOS system Bash 3.2 with strict shell options for Mac, Linux and Windows argument combinations. A baseline control reproduces the empty-array failure; the compatible positional-argument form passes.
• The new browser cases and the Mac native acceptance mode are registered in CI, together with main's provider-error/newline cases and fresh dependency security audit. Local validation was targeted; required repository CI remains the merge gate.

The default test path remains offline, deterministic, credential-free, and safe for forks. Browser/native checks use synthetic data and isolated profiles; the provider is a local keyless fixture. Shared client logic is platform-neutral; native acceptance here was macOS only.

Maintainer Live Check

Maintainer live check: yes

Surface: browser, gateway

Maintainer-only note: Real local Electron, Gateway and browser checks were run on macOS with synthetic fixtures. No external provider credentials or release verification were needed.

Safety

No secrets, real prompts/transcripts, private runtime data, local paths, test artifacts or diagnostic logs are committed. Permission checks remain enforced. A lost acceptance receipt never causes an automatic resend. Slow maintenance operations are not silently forced into the ordinary 30-second request budget.

Third-Party Origin

Third-party origin: adapted/ported

Details if non-none: The CLI pending-future/deadline and unsubscribe-ordering work adapts ptterjgf's PR #1515, commit f764d686ef9b61ffdeebbaee4c4a1d11b52cb6f3, from this Apache-2.0-licensed repository. Attribution is retained with a Co-authored-by trailer. Additional operation-budget compatibility and regressions were added during review; no external dependency or vendored package is introduced.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: success — run 35204359704, attempt 1.
Tested queue candidate: 19e19fc995ff682ab3457ee72c1be855242ea586. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.