fix(chat): restore artifact open actions ("Open in editor") broken by provider scoping

src-tauri/capabilities/session-window.json

@@ -28,7 +28,34 @@
       "identifier": "opener:allow-open-path",
       "allow": [
         {
-          "path": "$DOWNLOAD"
+          "path": "$HOME/**"
+        },
+        {
+          "path": "$HOME/.goose/**"
+        },
+        {
+          "path": "$TEMP/**"
+        },
+        {
+          "path": "/Volumes/**"
+        },
+        {
+          "path": "/mnt/**"
+        },
+        {
+          "path": "/workspace/**"
+        },
+        {
+          "path": "/workspaces/**"
+        },
+        {
+          "path": "/opt/**"
+        },
+        {
+          "path": "/srv/**"
+        },
+        {
+          "path": "*:/**"
         }
       ]
     },

src-tauri/gen/schemas/capabilities.json

@@ -1 +1 @@
-{"default":{"identifier":"default","description":"Capability for the main window","local":true,"windows":["main"],"permissions":["core:default","core:window:allow-start-dragging","core:window:allow-toggle-maximize","core:window:allow-show","core:window:allow-close","core:window:allow-set-size","core:window:allow-set-min-size","deep-link:default","opener:default",{"identifier":"opener:allow-open-url","allow":[{"url":"linear://*"},{"url":"https://linear.app/*"}]},{"identifier":"opener:allow-open-path","allow":[{"path":"$HOME/**"},{"path":"$HOME/.goose/**"},{"path":"$TEMP/**"},{"path":"/Volumes/**"},{"path":"/mnt/**"},{"path":"/workspace/**"},{"path":"/workspaces/**"},{"path":"/opt/**"},{"path":"/srv/**"},{"path":"*:/**"}]},"window-state:allow-restore-state","window-state:allow-save-window-state","dialog:allow-open","dialog:allow-save","clipboard-manager:allow-write-text","app-test-driver:default","berdctl:default","updater:default","process:allow-restart","notification:default"]},"session-window":{"identifier":"session-window","description":"Capability for popped-out chat session windows","local":true,"windows":["session:*"],"permissions":["core:default","core:window:allow-start-dragging","core:window:allow-show","core:window:allow-close","core:window:allow-set-focus","core:window:allow-set-size","core:window:allow-set-min-size","opener:default",{"identifier":"opener:allow-open-url","allow":[{"url":"linear://*"},{"url":"https://linear.app/*"}]},{"identifier":"opener:allow-open-path","allow":[{"path":"$DOWNLOAD"}]},"dialog:allow-open","dialog:allow-save","berdctl:allow-status"],"platforms":["macOS"]},"voice-buddy":{"identifier":"voice-buddy","description":"Capability for the always-on-top voice conversation buddy","local":true,"windows":["voice-buddy"],"permissions":["core:default","core:window:allow-start-dragging"]}}
+{"default":{"identifier":"default","description":"Capability for the main window","local":true,"windows":["main"],"permissions":["core:default","core:window:allow-start-dragging","core:window:allow-toggle-maximize","core:window:allow-show","core:window:allow-close","core:window:allow-set-size","core:window:allow-set-min-size","deep-link:default","opener:default",{"identifier":"opener:allow-open-url","allow":[{"url":"linear://*"},{"url":"https://linear.app/*"}]},{"identifier":"opener:allow-open-path","allow":[{"path":"$HOME/**"},{"path":"$HOME/.goose/**"},{"path":"$TEMP/**"},{"path":"/Volumes/**"},{"path":"/mnt/**"},{"path":"/workspace/**"},{"path":"/workspaces/**"},{"path":"/opt/**"},{"path":"/srv/**"},{"path":"*:/**"}]},"window-state:allow-restore-state","window-state:allow-save-window-state","dialog:allow-open","dialog:allow-save","clipboard-manager:allow-write-text","app-test-driver:default","berdctl:default","updater:default","process:allow-restart","notification:default"]},"session-window":{"identifier":"session-window","description":"Capability for popped-out chat session windows","local":true,"windows":["session:*"],"permissions":["core:default","core:window:allow-start-dragging","core:window:allow-show","core:window:allow-close","core:window:allow-set-focus","core:window:allow-set-size","core:window:allow-set-min-size","opener:default",{"identifier":"opener:allow-open-url","allow":[{"url":"linear://*"},{"url":"https://linear.app/*"}]},{"identifier":"opener:allow-open-path","allow":[{"path":"$HOME/**"},{"path":"$HOME/.goose/**"},{"path":"$TEMP/**"},{"path":"/Volumes/**"},{"path":"/mnt/**"},{"path":"/workspace/**"},{"path":"/workspaces/**"},{"path":"/opt/**"},{"path":"/srv/**"},{"path":"*:/**"}]},"dialog:allow-open","dialog:allow-save","berdctl:allow-status"],"platforms":["macOS"]},"voice-buddy":{"identifier":"voice-buddy","description":"Capability for the always-on-top voice conversation buddy","local":true,"windows":["voice-buddy"],"permissions":["core:default","core:window:allow-start-dragging"]}}

src/features/chat/hooks/ArtifactPolicyContext.tsx

@@ -420,7 +420,15 @@ export function ArtifactPolicyProvider({
         return;
       }
       lastOpenAtByPathRef.current.set(key, now);
-      await openPath(resolvedTarget);
+      try {
+        await openPath(resolvedTarget);
+      } catch (error) {
+        // A failed hand-off must not consume the debounce window: the user
+        // should be able to retry immediately (e.g. after fixing whatever the
+        // OS rejected) instead of having the retry silently absorbed.
+        lastOpenAtByPathRef.current.delete(key);
+        throw error;
+      }
     },
     [filesAreRemote, remoteHost, resolveOpenTarget, normalizedSessionCwd, t],
   );

src/features/chat/ui/ArtifactViewer.tsx

@@ -158,6 +158,10 @@ export function ArtifactViewer({
   const [diskStatus, setDiskStatus] = useState<DiskStatus>("checking");
   const diskStatusRef = useRef<DiskStatus>(diskStatus);
   const [divergedKind, setDivergedKind] = useState<FileStatErrorKind>("other");
+  // Known-gone from disk (initial load or polling verdict). Gates every
+  // affordance that targets the file itself: the error body's "Open in
+  // editor" and both OS hand-offs in the ⋯ menu.
+  const fileIsMissing = diskStatus === "diverged" && divergedKind === "missing";
   const divergenceStrikesRef = useRef(0);
   const [imageDiskRevision, setImageDiskRevision] = useState(0);
   const imageDiskRevisionRef = useRef(0);
@@ -598,7 +602,14 @@ export function ArtifactViewer({
                 />
               </DropdownMenuTrigger>
               <DropdownMenuContent align="end">
+                {/* Both OS hand-offs target the file itself, so a deleted
+                    file makes them guaranteed dead clicks (the editor can't
+                    open it; revealItemInDir receives the missing path and
+                    its rejection is swallowed). Disable rather than hide so
+                    the menu shape stays stable; polling keeps watching the
+                    path and re-enables both if the file reappears. */}
                 <DropdownMenuItem
+                  disabled={fileIsMissing}
                   onSelect={() => {
                     void openResolvedPath(artifact.resolvedPath).catch(
                       () => {},
@@ -609,6 +620,7 @@ export function ArtifactViewer({
                   {t("artifactViewer.openExternally")}
                 </DropdownMenuItem>
                 <DropdownMenuItem
+                  disabled={fileIsMissing}
                   onSelect={() => {
                     void revealInFileManager(artifact.resolvedPath).catch(
                       () => {},
@@ -694,6 +706,10 @@ export function ArtifactViewer({
           <MarkdownBody
             markdownView={markdownView}
             textState={renderedTextState}
+            // A deleted file cannot be handed to an editor; the "file
+            // deleted" strip above is the whole answer (mirrors the strip
+            // hiding its Reload button for the same reason).
+            fileIsMissing={fileIsMissing}
             onOpenExternally={() => {
               void openResolvedPath(artifact.resolvedPath).catch(() => {});
             }}
@@ -776,10 +792,13 @@ function ImageBody({
 function MarkdownBody({
   markdownView,
   textState,
+  fileIsMissing = false,
   onOpenExternally,
 }: {
   markdownView: MarkdownView;
   textState: TextState;
+  /** The file is gone from disk, so opening it externally cannot succeed. */
+  fileIsMissing?: boolean;
   onOpenExternally: () => void;
 }) {
   const { t } = useTranslation("chat");
@@ -797,9 +816,16 @@ function MarkdownBody({
         <p className="text-center text-sm text-muted-foreground">
           {t("artifactViewer.loadError")}
         </p>
-        <Button variant="outline" size="sm" onClick={onOpenExternally}>
-          {t("artifactViewer.openExternally")}
-        </Button>
+        {/* "Open in editor" is an escape hatch for files Berd can't render
+            itself (encoding, size, permissions) — but a DELETED file can't be
+            opened by anything, so offering it would be a guaranteed dead
+            click. Polling keeps watching; if the file reappears the view
+            heals and the action returns. */}
+        {!fileIsMissing ? (
+          <Button variant="outline" size="sm" onClick={onOpenExternally}>
+            {t("artifactViewer.openExternally")}
+          </Button>
+        ) : null}
       </div>
     );
   }

src/features/chat/ui/ChatTranscriptSurface.tsx

@@ -11,7 +11,6 @@ import type { Persona } from "@/shared/types/agents";
 import type { Message } from "@/shared/types/messages";
 import { scheduleAfterNextPaint } from "@/app/lib/scheduleAfterNextPaint";
 import { useChatStore } from "@/features/chat/stores/chatStore";
-import { ArtifactPolicyProvider } from "@/features/chat/hooks/ArtifactPolicyContext";
 import type { TranscriptSearchBackend } from "@/features/chat/lib/transcriptSearchBackend";
 import { useSessionFeedbackSurvey } from "../response-feedback/useSessionFeedbackSurvey";
 import { ChatLoadingSkeleton } from "./ChatLoadingSkeleton";
@@ -162,30 +161,29 @@ export function ChatTranscriptSurface({
     </div>
   );
 
+  // No ArtifactPolicyProvider here: exactly one provider is mounted per
+  // rendered session boundary, owned by the surface that composes the
+  // transcript with its siblings (ChatView's chat row, ChatCanvasCard).
+  // Two providers for one visible session would derive artifact inventory
+  // twice and split the per-path open debounce across surfaces.
   return (
-    <ArtifactPolicyProvider
-      messages={timelineMessages}
-      sessionCwd={sessionCwd ?? null}
+    <VirtualMessageTimelineGate
       sessionId={sessionId}
-    >
-      <VirtualMessageTimelineGate
-        sessionId={sessionId}
-        messages={timelineMessages}
-        streamingMessageId={streamingMessageId}
-        sessionFeedbackSurvey={sessionFeedbackSurvey}
-        scrollTargetMessageId={scrollTargetMessageId}
-        scrollTargetQuery={scrollTargetQuery}
-        onScrollTargetHandled={onScrollTargetHandled}
-        searchContentRef={searchContentRef}
-        searchBackendRef={searchBackendRef}
-        showPlaceholder={showLoading}
-        placeholder={placeholder}
-        startContent={startContent}
-        footer={footer}
-        footerStatus={footerStatus}
-        rendererPolicy={rendererPolicy}
-        {...callbacks}
-      />
-    </ArtifactPolicyProvider>
+      messages={timelineMessages}
+      streamingMessageId={streamingMessageId}
+      sessionFeedbackSurvey={sessionFeedbackSurvey}
+      scrollTargetMessageId={scrollTargetMessageId}
+      scrollTargetQuery={scrollTargetQuery}
+      onScrollTargetHandled={onScrollTargetHandled}
+      searchContentRef={searchContentRef}
+      searchBackendRef={searchBackendRef}
+      showPlaceholder={showLoading}
+      placeholder={placeholder}
+      startContent={startContent}
+      footer={footer}
+      footerStatus={footerStatus}
+      rendererPolicy={rendererPolicy}
+      {...callbacks}
+    />
   );
 }

src/features/chat/ui/ChatView.tsx

@@ -20,6 +20,7 @@ import {
   CONVERSATION_MIN_WIDTH_WITH_VIEWER,
 } from "./ArtifactViewerPanel";
 import { useOpenArtifact } from "../stores/artifactViewerStore";
+import { ArtifactPolicyProvider } from "../hooks/ArtifactPolicyContext";
 import { ArtifactAutoOpenMount } from "./ArtifactAutoOpenMount";
 import {
   CP_TOTAL_W,
@@ -124,7 +125,6 @@ export function ChatView({
 }: ChatViewProps) {
   const { t } = useTranslation("chat");
   useRegisterSecurityConfirmationSurface(sessionId);
-  const isArtifactViewerOpen = useOpenArtifact(sessionId) !== null;
   const mountStart = useRef(performance.now());
   const terminalRootRef = useRef<HTMLDivElement | null>(null);
   const chatColumnRef = useRef<HTMLDivElement | null>(null);
@@ -201,6 +201,14 @@ export function ChatView({
   ]);
   const workspaceRepository = useWorkspaceRepository();
   const effectiveSession = controller.session ?? activeSession ?? null;
+  // The effective session identity: during session replacement or
+  // reconciliation the requested sessionId can briefly disagree with the
+  // snapshot the controller serves. Every artifact-store read/write and
+  // every layout decision derived from viewer state must use THIS id, so
+  // the panel, the policy provider, and the width math all describe the
+  // same store entry. (Audited: all useOpenArtifact call sites in ChatView.)
+  const timelineSessionId = effectiveSession?.id ?? sessionId;
+  const isArtifactViewerOpen = useOpenArtifact(timelineSessionId) !== null;
   const isReadOnly = Boolean(readOnlyStatus);
   // A remote session's cwd and artifact paths live on its SSH host: the
   // in-chat terminal (a local PTY), local folder pickers, and local file
@@ -728,7 +736,6 @@ export function ChatView({
     </div>
   );
 
-  const timelineSessionId = effectiveSession?.id ?? sessionId;
   const messageTimeline = (
     <ChatTranscriptSurface
       sessionId={timelineSessionId}
@@ -793,11 +800,28 @@ export function ChatView({
   });
 
   return (
-    <>
+    // The single artifact policy owner for this session boundary. It must
+    // wrap the whole chat row because the transcript AND its siblings
+    // consume the context: ArtifactViewerPanel ("Open in editor"), the
+    // right rail's ArtifactsWidget (row opens), and ArtifactAutoOpenMount
+    // (the artifact list). ChatTranscriptSurface intentionally does NOT own
+    // artifact policy — a nested provider would derive a second artifact
+    // inventory and split the per-path open debounce (enforced by the
+    // provider-boundary tests). Consumers outside the provider get the
+    // inert default context and silently no-op.
+    // The identity, messages, and cwd must describe one session snapshot:
+    // timelineSessionId (the controller's effective session) rather than the
+    // raw requested sessionId, which can briefly disagree with
+    // controller.messages during session replacement or reconciliation.
+    <ArtifactPolicyProvider
+      messages={controller.messages}
+      sessionCwd={controller.sessionArtifactCwd}
+      sessionId={timelineSessionId}
+    >
       <ArtifactAutoOpenMount
         // Remote artifacts cannot be read locally, so never auto-open the
         // viewer for them; a null session absorbs appearances silently.
-        sessionId={sessionIsRemote ? null : sessionId}
+        sessionId={sessionIsRemote ? null : timelineSessionId}
         isHistoryLoading={controller.isLoadingHistory}
         sessionCwd={controller.sessionArtifactCwd}
       />
@@ -943,7 +967,9 @@ export function ChatView({
         </div>
 
         {sessionId && !isAgentBuilderSession ? (
-          <ArtifactViewerPanel sessionId={sessionId} />
+          // Keyed by the same effective identity the providers use, so the
+          // panel reads the viewer-store entry that openInApp writes.
+          <ArtifactViewerPanel sessionId={timelineSessionId} />
         ) : null}
 
         <ChatRightRail
@@ -979,6 +1005,6 @@ export function ChatView({
           }
         />
       </div>
-    </>
+    </ArtifactPolicyProvider>
   );
 }