Repository navigation
feat(webui): restore sessions from display replay - #567
Merged
Merged
Conversation
Contributor
📝 WalkthroughWalkthroughThis PR extends the coding agent WebUI with deterministic session history reconnection, multi-session management with resume mode, and interactive approval handling. Backend changes add session-level authorization checks and record approval decisions to the runtime wire. Frontend introduces session list UI, timeline history replay, and a reworked main App component supporting streaming, reconnection, and session mode selection. ChangesBackend Session Authorization & Approval Persistence
Frontend Type System & API Implementation
Frontend Timeline Event & History Handling
Frontend UI Components
Frontend App Session Management & Streaming
Testing Infrastructure & Integration Tests
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add session list, durable display-event replay, resume streaming, markdown assistant rendering, and lightweight diff panel. Verification: pnpm typecheck; pnpm test; pnpm build; pnpm peers check; browser flow create session, reload, restore via runs replay, continue via /resume.
delete-cloud
force-pushed
the
feat/webui-session-recovery
branch
from
June 12, 2026 01:52
14f7705 to
35bbcc2
Compare
delete-cloud
marked this pull request as ready for review
June 12, 2026 04:45
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
coding-agent/src/coding_agent/server/http_server.py (1)
3136-3145:⚠️ Potential issue | 🟠 Major | ⚡ Quick winOwner scoping is still bypassable through the legacy
/sessions/{session_id}/eventsstream.This change protects
/display-events, but/eventsjust above still exposes the live wire stream after only API-key/session checks. A caller who correctly gets a 404 from_get_visible_session()can still subscribe to/sessions/{session_id}/eventsand read another owner's session data through the legacy SSE path.Suggested fix
`@app.get`("/sessions/{session_id}/events") `@limiter.limit`(RateLimits.EVENTS) async def get_events( request: Request, session_id: str, api_key: str | None = Depends(verify_api_key), + auth_context: AuthContext | None = Depends(auth_context_from_headers), ) -> EventSourceResponse: """Persistent SSE event stream (fan-out supported).""" - try: - await session_manager.get_session_async(session_id) - except KeyError as exc: - raise HTTPException(status_code=404, detail=_key_error_detail(exc)) from exc + del request, api_key + _ = await _get_visible_session(session_id, auth_context) try: await session_manager.authorize_event_stream(session_id)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/src/coding_agent/server/http_server.py` around lines 3136 - 3145, The legacy SSE handler for /sessions/{session_id}/events currently bypasses owner scoping; update that handler (the legacy events endpoint function, e.g., get_session_events) to call and enforce the same visibility check used by get_session_display_events by invoking _get_visible_session(session_id, auth_context) (or reuse its guard logic) before opening the wire stream, and remove any path that allows subscribing after only API-key/session checks so both endpoints share identical owner-scoping behavior.
🧹 Nitpick comments (1)
coding-agent/webui/app/package.json (1)
10-10: Re-check dependency security + version recency (react-markdown/vitest/jsdom)
react-markdown@^10.1.0: no direct security advisories were found for the 10.1.0 release; still runnpm audit/Snyk on the full dependency tree since issues often land in transitive deps.vitest@^2.1.9: latest stable as of June 2026 isvitest@4.1.8; consider upgrading if compatibility allows.jsdom@^29.1.1: already on the latest stable (29.1.1as of June 2026).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@coding-agent/webui/app/package.json` at line 10, Update package.json dependency versions and audit the dependency tree: run npm audit and Snyk against the repo, bump vitest from ^2.1.9 to a compatible newer version (consider ^4.1.8), confirm react-markdown@^10.1.0 has no transitive advisories or upgrade if needed, and verify jsdom remains at ^29.1.1; after changing versions update the lockfile (npm install / npm ci), run the "test" script (vitest run) and the full test suite, and fix any compatibility issues introduced by upgrades in files calling vitest/react-markdown/jsdom.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@coding-agent/src/coding_agent/server/http_server.py`:
- Around line 3136-3145: The legacy SSE handler for
/sessions/{session_id}/events currently bypasses owner scoping; update that
handler (the legacy events endpoint function, e.g., get_session_events) to call
and enforce the same visibility check used by get_session_display_events by
invoking _get_visible_session(session_id, auth_context) (or reuse its guard
logic) before opening the wire stream, and remove any path that allows
subscribing after only API-key/session checks so both endpoints share identical
owner-scoping behavior.
---
Nitpick comments:
In `@coding-agent/webui/app/package.json`:
- Line 10: Update package.json dependency versions and audit the dependency
tree: run npm audit and Snyk against the repo, bump vitest from ^2.1.9 to a
compatible newer version (consider ^4.1.8), confirm react-markdown@^10.1.0 has
no transitive advisories or upgrade if needed, and verify jsdom remains at
^29.1.1; after changing versions update the lockfile (npm install / npm ci), run
the "test" script (vitest run) and the full test suite, and fix any
compatibility issues introduced by upgrades in files calling
vitest/react-markdown/jsdom.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6af4da43-d883-48b6-b66e-40a3f2724b6f
⛔ Files ignored due to path filters (1)
coding-agent/webui/app/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (16)
coding-agent/docs/web-client-api-contract.mdcoding-agent/src/coding_agent/server/http_server.pycoding-agent/src/coding_agent/server/session_manager.pycoding-agent/tests/ui/test_http_server.pycoding-agent/tests/ui/test_session_manager_runtime.pycoding-agent/webui/app/package.jsoncoding-agent/webui/app/src/App.test.tsxcoding-agent/webui/app/src/App.tsxcoding-agent/webui/app/src/components/DiffPanel.tsxcoding-agent/webui/app/src/components/SessionList.tsxcoding-agent/webui/app/src/components/Timeline.tsxcoding-agent/webui/app/src/index.csscoding-agent/webui/app/src/lib/api.tscoding-agent/webui/app/src/lib/timeline.test.tscoding-agent/webui/app/src/lib/timeline.tscoding-agent/webui/app/src/lib/types.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/promptfor completed restored sessions, reserve/resumefor latest interrupted runs, and guard session-load/create/reconnect races so stale async work cannot overwrite the active sessionwire.ApprovalResponseruntime events so restored history replaysapproval_resultand does not resurrect approved prompts as pending/sessions/{id}/display-eventsand legacy/sessions/{id}/eventsstreams with the same owner-scoped visibility check used by replay endpointsVerification
bash_run-> approval card -> approve -> tool result/final answer -> reload tab -> restore from session list via display-events -> approval card replayed as-> approvedwithout buttons -> continued conversation uses/prompt?event_format=displayb684fa5confirmed the previous direct-call P2 is fixed and found no new P1/P2 findings; earlier local and CodeRabbit owner-scope findings were fixed and re-reviewed cleanNotes