fix(web): close P3 chat re-review findings

apps/web/src/spa/pages/chat-error-boundary.spec.tsx

@@ -2,7 +2,16 @@ import { act } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { createMemoryRouter, RouterProvider, type RouteObject } from 'react-router-dom';
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
-import { ChatRouteErrorBoundary } from './chat-error-boundary';
+
+const { useSessionMock } = vi.hoisted(() => ({
+  useSessionMock: vi.fn(),
+}));
+
+vi.mock('@/lib/auth-client', () => ({
+  useSession: useSessionMock,
+}));
+
+import { routes } from '@/routes';
 
 beforeAll(() => {
   Object.defineProperty(globalThis, 'IS_REACT_ACT_ENVIRONMENT', {
@@ -19,6 +28,25 @@ function Boom(): never {
   throw new Error('render blew up');
 }
 
+/** Recursively clones the real exported route table, replacing only the
+ * `/chat` route's `element` with `<Boom />` — every other route (including
+ * the real `AuthGuard` nesting and the real `/chat` `errorElement`) is left
+ * exactly as exported. This is what makes the test fail if a future change
+ * removes the real route's `errorElement`, unlike a hand-built independent
+ * route tree that could drift from production undetected. */
+function replaceChatElementWithBoom(nodes: RouteObject[]): RouteObject[] {
+  return nodes.map((node) => {
+    const cloned: RouteObject = { ...node };
+    if (cloned.path === '/chat') {
+      cloned.element = <Boom />;
+    }
+    if (cloned.children) {
+      cloned.children = replaceChatElementWithBoom(cloned.children);
+    }
+    return cloned;
+  });
+}
+
 let root: Root | null;
 let container: HTMLElement;
 
@@ -28,13 +56,14 @@ afterEach(async () => {
   });
   document.body.replaceChildren();
   root = null;
+  useSessionMock.mockReset();
 });
 
 describe('ChatRouteErrorBoundary', () => {
   it('renders a recoverable, non-blank fallback when the /chat route element throws during render', async () => {
-    const routeObjects: RouteObject[] = [
-      { path: '/chat', element: <Boom />, errorElement: <ChatRouteErrorBoundary /> },
-    ];
+    useSessionMock.mockReturnValue({ data: { user: { id: 'user-1' } }, isPending: false });
+
+    const routeObjects = replaceChatElementWithBoom(routes);
     const router = createMemoryRouter(routeObjects, { initialEntries: ['/chat'] });
 
     container = document.createElement('div');

apps/web/src/spa/pages/chat.spec.tsx

@@ -2,6 +2,7 @@ import { act } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createFakeChatSocket } from '@/spa/chat/test-support/fake-chat-socket';
+import { MAX_MANIFEST_ITEMS } from '@/spa/chat/limits';
 
 const { getSocketMock, destroySocketMock } = vi.hoisted(() => ({
   getSocketMock: vi.fn(),
@@ -233,7 +234,7 @@ describe('ChatPage', () => {
     });
   });
 
-  it('shows visible alert surfaces for a server error and a stable failure copy for a failed command result', async () => {
+  it('shows visible alert surfaces for a server error and the structured contract reason for a failed command result', async () => {
     await act(async () => {
       fake.serverEmit('message:ack', { conversationId: 'c1', messageId: 'm1' });
       fake.serverEmit('error', { conversationId: 'c1', error: 'The model is unavailable' });
@@ -241,16 +242,52 @@ describe('ChatPage', () => {
         conversationId: 'c1',
         command: 'model',
         success: false,
-        message: 'raw internal detail: stack trace at line 42',
+        message: 'Unknown model',
       });
     });
 
     const alerts = [...container.querySelectorAll('[role="alert"]')];
     const alertText = alerts.map((node) => node.textContent).join(' ');
     expect(alertText).toContain('The model is unavailable');
-    // Sanitized client copy, not the raw server-provided detail.
+    // The structured, contract-provided denial reason is visibly rendered.
+    expect(alertText).toContain('Unknown model');
+  });
+
+  it('falls back to a stable "Command failed." copy when a failed command result has no usable message', async () => {
+    await act(async () => {
+      fake.serverEmit('message:ack', { conversationId: 'c1', messageId: 'm1' });
+      fake.serverEmitRaw('command:result', {
+        conversationId: 'c1',
+        command: 'model',
+        success: false,
+        message: { bad: 'object' },
+      });
+    });
+
+    const alerts = [...container.querySelectorAll('[role="alert"]')];
+    const alertText = alerts.map((node) => node.textContent).join(' ');
     expect(alertText).toContain('Command failed.');
-    expect(alertText).not.toContain('raw internal detail');
+  });
+
+  it('caps availableThinkingLevels before storing and rendering a hostile session payload', async () => {
+    const hostileLevels = Array.from({ length: MAX_MANIFEST_ITEMS + 50 }, (_, i) => `level-${i}`);
+
+    await act(async () => {
+      fake.serverEmit('message:ack', { conversationId: 'c1', messageId: 'm1' });
+      fake.serverEmit('session:info', {
+        conversationId: 'c1',
+        provider: 'anthropic',
+        modelId: 'claude',
+        thinkingLevel: 'level-0',
+        availableThinkingLevels: hostileLevels,
+      });
+    });
+
+    const select = container.querySelector(
+      'select[aria-label="Thinking level"]',
+    ) as HTMLSelectElement;
+    expect(select).toBeTruthy();
+    expect(select.options.length).toBeLessThanOrEqual(MAX_MANIFEST_ITEMS);
   });
 
   it('renders a safe fallback when session:info arrives with a malformed (non-array) availableThinkingLevels, without throwing', async () => {