Skip to content

fix: enable prompts for managed sessions - #517

Merged
pedronauck merged 2 commits into
mainfrom
issue-507
Sep 1, 2026
Merged

pedronauck merged 2 commits into
mainfrom
issue-507

Conversation

@pedronauck

@pedronauck pedronauck commented Sep 1, 2026 •

Copy link
Copy Markdown
Member

What & why

Fixes #507.

The Web composer now follows prompt authority instead of user-owned lifecycle authority. Public user, system, coordinator, and spawned sessions can be prompted when active or stopped; active sessions expose Queue, Steer, Interrupt, and Stop generation. Stopped managed sessions resume under the same durable session ID and transcript.

Managed sessions still cannot be renamed, cleared, attached, archived, deleted, or stopped as a whole. Dream, maintenance, archived, transitional, and unrecoverable sessions remain read-only.

The first PR run also reproduced an existing Linux CI failure from main: [email protected] was declared without its required emojibase peer. The two direct consumer workspaces now declare [email protected], which makes the clean Bun dependency graph complete.

Codex co-wrote this change; I reviewed the diff and verified it locally and through a real provider-backed browser walk.

How you verified it

  • make gate — PASS at fingerprint 469392316bd6225af372af2afae61d4047dda89d (go-lint, race-enabled go-test, all-workspace JS lint/typecheck/test)
  • make codegen-check — PASS after the peer-dependency repair
  • React Doctor — 100/100, no issues
  • Monorepo Bun lint, typecheck, and test — PASS
  • Focused Web suites — 38 tests passed across session controls, window wiring, and topbar authority
  • Real Codex QA — RT-018 and RT-019 passed through Web, runtime, provider, CLI, and API; the managed and user sessions both resumed under their original IDs after Stop generation
  • Strict QA evidence audit — PASS, 0 blockers, 0 warnings
  • QA teardown — clean: true, no surviving processes

Durable QA report: docs/qa/reports/2026-09-01-issue-507-managed-session-prompts.md.

Impact

  • Web: composer and busy-input controls now cover every public session type; managed lifecycle actions remain absent.
  • Docs: session lifecycle docs and the official Compozy runtime-operations skill describe the new prompt boundary.
  • Build: web and packages/ui declare the peer required by their existing emojibase-data development dependency; no runtime package or version changes.
  • CLI / HTTP / UDS / OpenAPI / storage / config: no contract or lifecycle changes; existing prompt, cancellation, queue, steer, interrupt, transcript, and workspace-scoped paths are reused.
  • Native tools: no descriptor, schema, digest, risk, or capability-gate change; existing session prompt/cancel/input tools remain authoritative.
  • Extensibility and hooks: no extension, hook, registry, bridge SDK, MCP, capability, or config.toml change.
  • Workspace data isolation: no new data; existing workspace/session IDs, scoped query keys, transcript/SSE paths, and queue invalidation are preserved and exercised in QA.

  • make gate passes locally; this PR is delivered only after its required CI checks are green
  • New or changed behavior is covered by tests, or I explained above why not
  • If an agent wrote or co-wrote this, I named it above and verified the result myself

Summary by CodeRabbit

  • New Features
    • Public session types can now receive prompts when their session state allows it.
    • Session controls are restricted to user-controllable sessions.
    • Canceling a prompt no longer stops the session.
  • Bug Fixes
    • Prevented lifecycle actions and management menus from appearing for managed sessions.
    • Improved handling of prompt eligibility for archived, starting, stopping, and special session types.
  • Tests
    • Expanded coverage for prompt eligibility, lifecycle controls, and session toolbar visibility.

@vercel

vercel Bot commented Sep 1, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
compozy-site Ready Ready Preview Sep 1, 2026 2:35pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 360555dd-a036-4af6-b79b-7da950c8a451

📥 Commits

Reviewing files that changed from the base of the PR and between ed2561c and 605dc74.

⛔ Files ignored due to path filters (11)
  • .codex/audits/issue-507-compozy-skill-audit.md is excluded by !**/*.md, !.codex/**
  • bun.lock is excluded by !**/*.lock, !**/*.lock
  • docs/qa/charters/CH-managed-session-intervention.md is excluded by !**/*.md
  • docs/qa/journeys/J-13-follow-a-live-run.md is excluded by !**/*.md
  • docs/qa/reports/2026-09-01-issue-507-managed-session-prompts.md is excluded by !**/*.md
  • docs/qa/scenarios/RT-018.md is excluded by !**/*.md
  • docs/qa/scenarios/RT-019.md is excluded by !**/*.md
  • packages/site/content/docs/sessions/lifecycle.mdx is excluded by !**/*.mdx
  • packages/ui/package.json is excluded by !**/*.json
  • skills/compozy/references/runtime-operations.md is excluded by !**/*.md
  • web/package.json is excluded by !**/*.json
📒 Files selected for processing (7)
  • web/src/hooks/routes/__tests__/use-session-page-controls.test.tsx
  • web/src/hooks/routes/use-session-page-controls.ts
  • web/src/systems/os/apps/session/__tests__/session-window-content.test.tsx
  • web/src/systems/os/apps/session/session-window-content.tsx
  • web/src/systems/session/hooks/__tests__/use-session-topbar-slot.test.tsx
  • web/src/systems/session/hooks/use-session-topbar-slot.tsx
  • web/src/systems/session/lib/session-running.ts

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.


Walkthrough

Changes

Session prompt eligibility now supports public session types: user, system, coordinator, and spawned. Lifecycle mutations remain limited to user-controllable sessions. Prompt cancellation no longer stops a session. The session top bar hides lifecycle actions for managed sessions.

Session control eligibility

Layer / File(s) Summary
Public session prompt eligibility
web/src/systems/session/lib/session-running.ts, web/src/hooks/routes/use-session-page-controls.ts, web/src/hooks/routes/__tests__/use-session-page-controls.test.tsx
Public session types can prompt when session state permits it. Tests cover allowed and rejected session types.
Lifecycle mutation and cancellation controls
web/src/hooks/routes/use-session-page-controls.ts, web/src/hooks/routes/__tests__/use-session-page-controls.test.tsx
Stop, resume, unarchive, delete, rename, and clear handlers reject managed sessions. Stopping a user session calls the stop mutation without prompt cancellation.
Session view action wiring and visibility
web/src/systems/os/apps/session/session-window-content.tsx, web/src/systems/os/apps/session/__tests__/session-window-content.test.tsx, web/src/systems/session/hooks/use-session-topbar-slot.tsx, web/src/systems/session/hooks/__tests__/use-session-topbar-slot.test.tsx
Prompt cancellation uses handleCancelPrompt. Managed sessions omit stop and overflow actions from the top bar.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 605dc

The Web now permits prompts for eligible managed sessions while keeping destructive lifecycle actions restricted and preserving existing workspace-scoped validation. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Out of Scope Changes check ⚠️ Warning The PR objectives include adding emojibase peer-dependency declarations in web/package.json and packages/ui/package.json. These maintenance changes are unrelated to issue #507. Both files are excluded… Remove the unrelated emojibase dependency changes from this PR, or link them to a separate issue and submit them separately. If they must remain, provide reviewable evidence for the excluded package.json files and explain their direct conne…
Docstring Coverage ⚠️ Warning Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 7 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the primary change: enabling prompts for managed sessions.
Linked Issues check ✅ Passed The changes support issue #507 by allowing prompts for public managed sessions and preserving read-only behavior for unsupported lifecycle states. The prompt-control tests cover active and stopped ses…
Full details: Linked Issues check

Explanation

The changes support issue #507 by allowing prompts for public managed sessions and preserving read-only behavior for unsupported lifecycle states. The prompt-control tests cover active and stopped session behavior, including managed session types.

Full details: Out of Scope Changes check

Explanation

The PR objectives include adding emojibase peer-dependency declarations in web/package.json and packages/ui/package.json. These maintenance changes are unrelated to issue #507. Both files are excluded by path filters, so the exact dependency diff cannot be verified.

Resolution

Remove the unrelated emojibase dependency changes from this PR, or link them to a separate issue and submit them separately. If they must remain, provide reviewable evidence for the excluded package.json files and explain their direct connection to issue #507.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch issue-507

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@github-actions

github-actions Bot commented Sep 1, 2026 •

Copy link
Copy Markdown
Contributor

React Doctor found no new issues. 🎉

Reviewed by React Doctor for commit 605dc74.

@pedronauck
pedronauck marked this pull request as ready for review September 1, 2026 14:31
@pedronauck
pedronauck marked this pull request as draft September 1, 2026 14:32
@pedronauck
pedronauck marked this pull request as ready for review September 1, 2026 14:32
@greptile-apps

greptile-apps Bot commented Sep 1, 2026

Copy link
Copy Markdown

Greptile Summary

The PR changes Web session controls to follow prompt authority independently of lifecycle authority, allowing eligible public managed sessions to use the composer and turn-level controls while retaining user-only lifecycle actions.

  • Expands prompt eligibility to active and stopped system, coordinator, and spawned sessions alongside user sessions.
  • Separates Stop generation from whole-session stopping and guards managed sessions from lifecycle mutations.
  • Hides managed-session lifecycle actions in the topbar and adds focused regression coverage.
  • Updates lifecycle documentation, QA artifacts, and the runtime-operations skill.
  • Adds the exact emojibase peer dependency to its two direct consumer workspaces.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or independently actionable non-blocking issue identified.

The changed prompt-authority checks, cancellation wiring, and lifecycle guards are internally consistent and covered across route controls, session-window wiring, and topbar behavior.

Important Files Changed

Filename Overview
web/src/systems/session/lib/session-running.ts Defines explicit public-session prompt eligibility while retaining read-only handling for transitional, archived, dream, and unrecoverable sessions.
web/src/hooks/routes/use-session-page-controls.ts Broadens prompt and busy-input controls to eligible managed sessions while adding user-authority guards to lifecycle mutations.
web/src/systems/os/apps/session/session-window-content.tsx Rewires composer Stop generation to cancel only the active prompt rather than stopping the entire session.
web/src/systems/session/hooks/use-session-topbar-slot.tsx Restricts lifecycle primary and overflow actions to user-controllable sessions.
web/package.json Adds the exact peer package required by the existing emojibase-data development dependency.
packages/ui/package.json Adds the same exact peer dependency for the shared UI workspace.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  S[Public session] --> T{Session type}
  T -->|user| P[Prompt controls]
  T -->|system / coordinator / spawned| P
  T -->|dream / maintenance / missing| R[Read-only]
  P --> A{Lifecycle authority}
  A -->|user| L[Rename / clear / attach / archive / delete / stop session]
  A -->|managed| N[Lifecycle actions unavailable]
  P --> B[Send / queue / steer / interrupt / stop generation]
Loading

Reviews (1): Last reviewed commit: "build: declare emojibase peer dependency" | Re-trigger Greptile

@pedronauck
pedronauck merged commit 3d2e5f9 into main Sep 1, 2026
38 of 39 checks passed
@pedronauck
pedronauck deleted the issue-507 branch September 1, 2026 14:54
This was referenced Sep 27, 2026

This branch was successfully deployed

1 active deployment
Preview — 605dc74e Deployed Sep 1, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Web UI has no way to prompt a session, so a stopped session can only be revived from the CLI

1 participant