chore: merge feat/query-safety-tri-11165 (prompt re-send guard)

Author: kathiekiwi

apps/webapp/app/components/dashboard-agent/DashboardAgentPanel.tsx

@@ -191,10 +191,18 @@ export function DashboardAgentPanel({
   // Bumped on each open so a slower earlier open can't overwrite a newer one.
   const openChatRequestSeq = useRef(0);
 
+  // Bound to its chat, which remounts with a fresh guard ref on every switch.
+  const [sendRequest, setSendRequest] = useState<
+    { text: string; seq: number; chatId: string } | undefined
+  >(undefined);
+
   // The one way the panel changes chat: it invalidates any in-flight open and abandons a
   // half-configured watch card, which would otherwise be submitted against the new chat.
   const claimChatSlot = useCallback(() => {
     dispatchWatchCard({ type: "chat-changed" });
+    // A request belongs to the chat it was made in: the remounting chat has a fresh guard ref,
+    // so a kept request would be sent a second time.
+    setSendRequest(undefined);
     return ++openChatRequestSeq.current;
   }, []);
 
@@ -345,10 +353,6 @@ export function DashboardAgentPanel({
     onUnreadWorkChange?.(unreadWorkCount(chats, active?.chatId));
   }, [chats, chatsLoaded, active?.chatId, onUnreadWorkChange]);
 
-  // Bound to its chat, which remounts with a fresh guard ref on every switch.
-  const [sendRequest, setSendRequest] = useState<
-    { text: string; seq: number; chatId: string } | undefined
-  >(undefined);
   const handledRequestSeq = useRef<number | undefined>(undefined);
   useEffect(() => {
     if (!requestedMessage || handledRequestSeq.current === requestedMessage.seq) return;

apps/webapp/app/components/dashboard-agent/explicit-prompt.test.ts

@@ -55,6 +55,22 @@ describe("the panel sends every explicit prompt", () => {
     expect(chat).not.toMatch(/prefill/i);
   });
 
+  it("carries a first prompt on the new chat itself, not on a request that a switch clears", () => {
+    const effect = panel.slice(panel.indexOf("const target = explicitPromptTarget({"));
+    expect(effect.indexOf("void createChat(requestedMessage.text);")).toBeLessThan(
+      effect.indexOf("setSendRequest({ ...requestedMessage")
+    );
+    expect(panel).toContain("pendingFirstMessage: data.headStarted ? undefined : text,");
+  });
+
+  it("drops the request when the chat slot changes, so switching back cannot re-send it", () => {
+    const claim = panel.slice(
+      panel.indexOf("const claimChatSlot = useCallback(() => {"),
+      panel.indexOf("const openChat = useCallback(")
+    );
+    expect(claim).toContain("setSendRequest(undefined);");
+  });
+
   it("submits the request in the chat rather than typing it into the composer", () => {
     expect(chat).toContain("submit(sendRequest.text);");
     expect(chat).not.toContain("setInput(sendRequest.text)");

apps/webapp/app/components/dashboard-agent/watch-card-state.test.ts

@@ -94,10 +94,13 @@ describe("every chat change goes through one door", () => {
   it("bumps the open sequence in exactly one place, next to the card reset", () => {
     const bumps = panel.match(/openChatRequestSeq\.current\s*(\+\+|\+=)|\+\+openChatRequestSeq/g);
     expect(bumps).toHaveLength(1);
-    // Whitespace-tolerant: the formatter is free to reindent or rewrap these two lines.
-    expect(panel).toMatch(
-      /dispatchWatchCard\(\{\s*type:\s*"chat-changed",?\s*\}\);\s*return \+\+openChatRequestSeq\.current;/
+    const claim = panel.slice(
+      panel.indexOf("const claimChatSlot = useCallback(() => {"),
+      panel.indexOf("const openChat = useCallback(")
     );
+    // Whitespace-tolerant: the formatter is free to reindent or rewrap the call.
+    expect(claim).toMatch(/dispatchWatchCard\(\{\s*type:\s*"chat-changed",?\s*\}\);/);
+    expect(claim).toContain("return ++openChatRequestSeq.current;");
   });
 
   it("claims a slot before every setActive that lands in a different chat", () => {