fix(webui): three crashes the suite could not reach, and a doc that promised a release that does not happen

[modacker]

Base: f56b26f. Found by reviewing the 23 merged PRs that carry no review at all (14 of them self-submitted and self-merged), then clicking through the real UI.

None of the four code fixes is caught by a test. Three were found by hand, and each one replaced the whole app tree with the error page.

The crashes

1 · attachments was the one field the message normalizer missed (#17)

normalizeWebuiClientMessage strips and re-adds ten fields so its guards are authoritative. attachments was in neither list, so it rode through ...remainder and projectMessageAttachments ran a bare for...of over it. Measured on f56b26f:

attachments={"a":1}  -> TypeError: attachments is not iterable
attachments=42       -> TypeError: attachments is not iterable
attachments=true     -> TypeError: attachments is not iterable

#17's title claims the malformed-field crash class is gone. It was gone for ten fields and present in the eleventh.

2 · listing?.entries.length — the ?. stopped one level too early

The ?. guarded listing; .entries was bare. A body with no entries threw Cannot read properties of undefined (reading 'length'). It reads as safe, which is why it survived review. Fixed at the door instead of the use site: the browseWorkspaceDirs result is normalised before it reaches state.

3 · The sign-in panel was stored with no validation at all

getSigninPanel()'s resolved value went straight into setSignin({ panel }) and SigninProgress does [...days].sort(...) unguarded. A body without days threw days is not iterable. The server does validate here (validateSigninPanel throws), so this is defence at the boundary — worth having because the blast radius is the whole UI, not one row.

4 · The forced reconnect never reported the channel down (#26)

reconnectWhenAvailable — tab back into view, network back — cleared socket then called previous.close(). The close handler guards on socket !== ws, always true on that path, so markWebuiEventWatcherDown was skipped and the banner read 已连接 for the whole reconnect window. That file had zero dispatchEvent calls before this.

The doc that was lying

gh secret list is empty — the repo has no NPM_TOKEN secret — so HAS_NPM_TOKEN is false and the publish step never runs. docs/releasing-webui-npm.md still promised 「Publishing is fully automatic」. The job is also not a merge gate (protection is 404) and #15 relaxed the step from failing to a ::warning::, so "no credential" and "published" are the same colour. The doc now says what is true and what turning it back on costs.

The fixture could not open three surfaces

fixture.mjs answered every unknown operation with return {}, which is why 93 specs passed while a human could not get through the app. Added getSigninPanel, browseWorkspaceDirs and a real setPermissionMode — the last one because changePermissionMode writes and then reads back to verify, and no-op write + constant read meant every mode but default raised 「授权模式未能保存，请重试」. That read-back is the correct pattern and is left untouched; the fixture was what could not satisfy it.

Tests

• message-parts.test.ts — a non-array attachments no longer throws; a real array still renders
• connection-health.test.ts — a forced reconnect marks the channel down, driven through the online listener
• recovered-surfaces.spec.mjs (new, 3 browser specs) — the sign-in row, the workspace picker and the permission-mode write all reach the page without tripping the error boundary

Verified locally on f56b26f + this branch

gate	result
typecheck:webui server / client / test + root	all EXIT=0
test:webui	1753 passed (1750 before, +3 new)
test:capabilities	5181 passed, 17 skipped
test:status-contract	9 passed
Playwright	96 passed (93 before, +3 new)

Built before the browser run, per #14's own finding that the harness only proves the process is right, never the artifact.

Not in this PR

Deliberately left, because they are not bugs in the same sense and each needs a call:

• fix(webui): label each MCP server's connection state on the plugin row (D-3) #27's MCP badge has no data source at all — configuredSummary returns no status/error, so it is permanently 未知状态. Wiring that means changing the local-runtime-v2 contract, not fixing a client guard.
• feat(webui): 关闭 roadmap C 模块，并修正报告里标错的地方 #2/feat(webui): 关闭 roadmap C 模块,并修掉 webui 基线上两个红门 #8's retry button is withheld on a new session's first turn (SessionComposer.tsx:1811) — a real defect, but the fix touches session-identity bookkeeping.
• fix(webui): 让 webui 的类型检查与仓库其余部分用同一套标准 #4 silenced 36 real webui errors for a green gate, and its target: ES2024 is ahead of esbuild's es2022. Restoring them will turn the gate red again.
• test(webui): make the browser suite fail on the wrong build instead of passing quietly #14 has no artifact-freshness check — the build step before the browser suite is an array-order accident, not an assertion.