- Sanitize user-facing error messages (no raw API/DB errors)
- Remove dead try/catch from Chat.tsx handleSendMessage
- Add onError callback for persistence errors in useChat
- Add console.error logging to loadConversation
- Guard minimize/toggleMinimize against closed overlay state
- Improve error dedup bucketing for non-DOMException errors
- Add tests: non-Error throws, updateConversation failure,
minimize/toggleMinimize guards
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Port high-value features from work/m4-llm branch into develop's
security-hardened codebase:
- Separate LLM vs persistence error handling in useChat (shows
assistant response even when save fails)
- Add structured error context logging with errorType, messagePreview,
messageCount fields for debugging
- Enforce state invariant in useChatOverlay: cannot be minimized when
closed
- Add onStorageError callback with user-friendly messages and
per-error-type deduplication
- Add error logging to Chat imperative handle methods
- Create Chat.test.tsx with loadConversation failure mode tests
Skipped from work/m4-llm (superseded by develop):
- AbortSignal timeout (develop has centralized client timeout)
- Custom toast system (duplicates @mosaic/ui)
- ErrorBoundary (develop has its own)
- WebSocket typed events (develop's ref-based pattern is superior)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add runtime type validation after all JSON.parse calls in the web app to
prevent runtime crashes from corrupted or tampered storage data. Creates a
shared safeJsonParse utility with type guard functions for each data shape
(Message[], ChatOverlayState, LayoutConfigRecord). All four affected
callsites now validate parsed data and fall back to safe defaults on
mismatch.
Files changed:
- apps/web/src/lib/utils/safe-json.ts (new utility)
- apps/web/src/lib/utils/safe-json.test.ts (25 tests)
- apps/web/src/hooks/useChat.ts (deserializeMessages)
- apps/web/src/hooks/useChat.test.ts (3 new corruption tests)
- apps/web/src/hooks/useChatOverlay.ts (loadState)
- apps/web/src/hooks/useChatOverlay.test.ts (3 new corruption tests)
- apps/web/src/components/chat/ConversationSidebar.tsx (ideaToConversation)
- apps/web/src/lib/hooks/useLayout.ts (layout loading)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add messagesRef to track current messages and prevent stale closures
- Use functional updates for all setMessages calls
- Remove messages from sendMessage dependency array
- Add comprehensive tests verifying rapid sends don't lose messages
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Use useRef to store callbacks, preventing stale closures
- Remove callback functions from useEffect dependencies
- Only workspaceId and token trigger reconnects now
- Callback changes update the ref without causing reconnects
- Add 5 new tests verifying no reconnect on callback changes
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Create centralized config module (apps/web/src/lib/config.ts) exporting:
- API_BASE_URL: Main API server URL from NEXT_PUBLIC_API_URL
- ORCHESTRATOR_URL: Orchestrator service URL from NEXT_PUBLIC_ORCHESTRATOR_URL
- Helper functions for building full URLs
- Update client.ts to import from central config
- Update LoginButton.tsx to use API_BASE_URL from config
- Update useWebSocket.ts to use API_BASE_URL from config
- Update AgentStatusWidget.tsx to use ORCHESTRATOR_URL from config
- Update TaskProgressWidget.tsx to use ORCHESTRATOR_URL from config
- Update useGraphData.ts to use API_BASE_URL from config
- Fixed wrong default port (was 8000, now uses correct 3001)
- Add comprehensive tests for config module
- Update useWebSocket tests to properly mock config module
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add validateWebSocketSecurity() to warn when using ws:// in production
- Add connect_error event handler to capture connection failures
- Expose connectionError state to consumers via hook and provider
- Add comprehensive tests for WSS enforcement and error handling
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Replace raw fetch() with apiPost/apiPatch/apiDelete in:
- ImportExportActions.tsx: POST for file imports
- KanbanBoard.tsx: PATCH for task status updates
- ActiveProjectsWidget.tsx: POST for widget data fetches
- useLayouts.ts: POST/PATCH/DELETE for layout management
- Add apiPostFormData() method to API client for FormData uploads
- Ensures CSRF token is included in all state-changing requests
- Update tests to mock CSRF token fetch for API client usage
Refs #338
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Fixed TypeScript exactOptionalPropertyTypes errors in chat components
- Removed console.error statements (errors are handled via state)
- Fixed type compatibility issues with undefined vs null values
- All chat-related files now pass strict TypeScript checks
- Created API clients for LLM chat (/api/llm/chat) and Ideas (/api/ideas)
- Implemented useChat hook for conversation state management
- Connected Chat component to backend with full CRUD operations
- Integrated ConversationSidebar with conversation fetching
- Added automatic conversation persistence after each message
- Integrated WebSocket for connection status
- Used existing better-auth for authentication
- All TypeScript strict mode compliant (no any types)
Deliverables:
✅ Working chat interface at /chat route
✅ Conversations save to database via Ideas API
✅ Real-time WebSocket connection
✅ Clean TypeScript (no errors)
✅ Full conversation loading and persistence
See CHAT_INTEGRATION_SUMMARY.md for detailed documentation.
- BaseWidget wrapper with loading/error states
- WidgetRegistry for central widget management
- WidgetGrid with react-grid-layout integration
- TasksWidget, CalendarWidget, QuickCaptureWidget
- useLayouts hooks for layout persistence
- Comprehensive test suite (TDD approach)
