fix(assistant): stop cross-user conversation access, bricked threads and lost sessions (#1209)

* fix(assistant): stop cross-user conversation access, bricked threads and lost sessions

Hotfix batch (PR1 of the assistant UI makeover, dev_docs/assistant_redesign_plan.md
section 7). No visual change; each of these is wrong today regardless of which
design lands, and three are unrecoverable per incident.

/api/agent/invoke never checked who owns a resumed conversation_id. RLS on
agent_conversations/agent_messages is company-scoped, not user-scoped
(20260517204000), so a member could post a colleague's conversation id, have
their history loaded into the prompt and read it back, while their own turns
were appended to that thread. The conversations list route filters on user_id
for exactly this reason. Also pins company and intent: resuming a thread from
another company would mix ledgers, and resuming under a different intent would
swap the tool whitelist under history the model has already seen.

A turn persists the assistant message carrying tool_use blocks before the tools
run, and their results only after the batch finishes. Dying in between (client
disconnect terminating the function, a deploy, a slow tool) left history ending
on an unanswered tool_use, which the Messages API rejects on replay: every later
turn 400s, and agent_messages is append-only for the BFL trail, so nothing could
repair it. History is now patched on read by synthesizing is_error tool_results,
leaving the stored trail untouched.

check_and_increment_agent_quota is SECURITY DEFINER in public with a
caller-chosen p_user_id, so any authenticated user could drain a colleague's
minute/day budget and lock them out of every agent endpoint. A plain REVOKE
would break the limiter (all three callers use the user's RLS client) and, as it
fails open, silently remove the spend cap: the function now refuses to act for
anyone but the caller, while service-role connections keep passing an explicit
id.

The single reject route re-read status and then wrote unguarded, so losing the
race with commit's atomic pending -> committing claim stamped `rejected` over an
operation that had already posted a verifikat, invisible to the committing-state
recovery sweep. Guarded on status like bulk-reject already is; a lost race is
now a 409.

The sheet's Escape handler listened on window with no defaultPrevented or target
check while the sheet is deliberately non-modal, so pressing Esc to dismiss the
reject-reason Select inside an approval card, the command palette or any dialog
unmounted the sheet and discarded the conversation, the streaming turn and the
un-actioned proposal. It now yields to open overlays and to focus outside the
sheet.

Verified: 9526 unit tests pass, lint clean on touched files, guards pass, and
the new pg-real test proves the quota guard against real Postgres (attacker
raises 42501, victim counters stay at 0). The four unrelated pg-real failures on
this machine reproduce identically with these changes stashed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(assistant): close anon path on the quota RPC, order the ownership check ahead of writes

Review follow-ups on the hotfix batch.

The caller guard used auth.uid() alone, which is NULL for the `anon` role just
as it is for backend roles, so an unauthenticated caller holding the public anon
key (it ships in the browser bundle) could still pick any p_user_id and drain
that user's quota. The guard now keys on the request role: anon and
authenticated may only ever spend their own quota, backend roles keep passing an
explicit id. The default PUBLIC execute grant is revoked as a second layer, with
execute granted only to authenticated and service_role. Covered by a new pg test
for the anon path.

The ownership check ran after the onboarding.intake stamp, so a request that was
about to be rejected could still write intake_completed_at. It now sits directly
after the capability gate, ahead of every side effect and ahead of the company
and profile reads, which also makes a rejected request cheaper.

The tool-result repair matched ids anywhere in the history, but the API needs
results in the message IMMEDIATELY after the tool_use. A result persisted after
an intervening turn (two turns racing on one conversation) left a shape that
still 400s. The repair is now positional, and orphaned or late-duplicate
tool_results are dropped, since an unmatched tool_result is rejected just as an
unanswered tool_use is.

The Escape guard matched the Radix popper wrapper, which stays mounted when a
popper is force-mounted; it now requires data-state="open" so a closed popper
cannot block Escape for the rest of the session.

Both new route errors are Swedish, per the user-facing error rule.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

components/agent/AgentSheet.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { useEffect, useState } from 'react'
+import { useEffect, useRef, useState } from 'react'
 import { X, Expand, Shrink, PanelRightClose, Eraser, History, ChevronLeft, Loader2 } from 'lucide-react'
 import AgentChat, { normalizeStoredMessages, type ChatMessage } from './AgentChat'
 import AgentAvatar from './AgentAvatar'
@@ -68,12 +68,39 @@ export default function AgentSheet({
   const sheetTitle = intentToTitle(intentId, agentName)
   const displayTitle = loaded ? (loaded.title ?? intentToTitle(loaded.intentId, agentName)) : sheetTitle
   const activeConversationId = loaded?.id ?? conversationId
+  const sheetRef = useRef<HTMLDivElement | null>(null)
 
   // Esc: back out of the session list first, otherwise close. Never while
   // collapsed (the sheet is hidden off-screen, so Esc belongs elsewhere).
+  //
+  // The sheet is deliberately non-modal, so this listener sits on window while
+  // the rest of the page stays interactive: it must therefore only claim the
+  // key when nothing nearer the user wants it. Closing the sheet discards the
+  // whole in-memory conversation, so an Esc meant for a dropdown inside an
+  // approval card, the command palette, or any dialog used to destroy the
+  // session outright. Three guards, cheapest first:
+  //   - defaultPrevented: a Radix popover/dialog that handled Esc marks it.
+  //   - an open overlay anywhere on the page (Radix marks these on the body
+  //     and on the overlay elements themselves) means the key isn't ours.
+  //   - focus sitting outside the sheet means the user is working elsewhere.
   useEffect(() => {
     const onKey = (e: KeyboardEvent) => {
       if (collapsed || e.key !== 'Escape') return
+      if (e.defaultPrevented) return
+
+      if (typeof document !== 'undefined') {
+        // Match on data-state="open", not on the popper wrapper itself: a
+        // force-mounted popper stays in the DOM while closed, and keying off
+        // the wrapper alone would then block Escape for the rest of the session.
+        const overlayOpen = document.querySelector(
+          '[data-radix-popper-content-wrapper] [data-state="open"], [role="dialog"][data-state="open"], [role="alertdialog"][data-state="open"], [role="listbox"][data-state="open"], [data-radix-menu-content][data-state="open"], [data-radix-select-content][data-state="open"]',
+        )
+        if (overlayOpen) return
+
+        const active = document.activeElement
+        if (active && sheetRef.current && !sheetRef.current.contains(active)) return
+      }
+
       if (view === 'list') setView('chat')
       else onClose()
     }
@@ -135,6 +162,7 @@ export default function AgentSheet({
 
   return (
     <div
+      ref={sheetRef}
       role="dialog"
       aria-label={displayTitle}
       // z-[60] sits above the mobile bottom nav (z-50) so on phones the sheet