feat(signing): tool_signing_expired SSE event + greyed SignTxCard#278
Merged
Conversation
Implements Spec 2 from the docs/superpowers/specs follow-up bundle.
Closes the "ghost card" UX: today's 5-min promise-gate TTL silently
rejects the awaiting promise without notifying the active SSE stream,
so SignTxCards stay in "pending sign" state indefinitely and late
signs hit 404 confirm routes.
Server emits a new SSEToolSigningExpired event the instant the TTL
fires (via the existing externalQueue path that sentinel_pause uses),
BEFORE the rejecter runs — so the active SSE client receives the
event in-band. The frontend marks the matching message expired and
SignTxCard renders a greyed-out, dismiss-only state.
Backend changes:
- pending-signing: new optional onExpire(flagId) callback on
CreatePendingSigningParams, invoked before rejecter, with throws
suppressed so emission failure never blocks the reject path
- agent.ts: new SSEToolSigningExpired interface, added to the SSEEvent
union and to both externalQueue type widths (SigningWrapperOptions
+ chatStream's local + streamPiAgent generic). wrapWithSigning's
createPendingSigning call now passes an onExpire that pushes onto
externalQueue and wakes the bridge
- core/types: tool_signing_expired added to ResponseChunk.type union
plus a new expired field (parallel structure to pause/signing)
- core/agent-core: new case in streamMessage switch — yields the new
chunk shape
- adapters/web: new case in chunkToSSE switch — emits SSE wire format
assertNever fired exactly as Spec 1 designed during implementation —
adding SSEToolSigningExpired to the SSEEvent union surfaced two
compile errors at the agent-core and web adapter switches before any
test ran, forcing the lockstep three-layer update. First real
follow-up PR proving the guard works.
Frontend changes:
- app store: new expired? field on ChatMessage + markMessageExpired
action with idempotency + race guards (no-op when no match, skip
dismissed/already-expired, skip non-signing kinds even with
matching flagId)
- ChatSidebar: new SSE handler case calling markMessageExpired,
passes expired prop down to SignTxCard
- SignTxCard: new expired prop (default false). When true: skips the
unmount /reject beacon (server has already reaped the flag — would
404), renders an opacity-50 region with just a Dismiss button.
onResolved union widened from confirm|reject → confirm|reject|dismiss
Tests: 13 new (1573 → 1576 agent, 558 → 571 app)
- pending-signing: 4 (fires with flagId; not on resolve/reject;
rejection still fires on onExpire throw)
- SignTxCard: 6 (no Sign/Cancel buttons; expired hint; original
display preserved; onResolved("dismiss"); beacon suppressed;
region aria-label changes)
- app store: 6 (marks matching by flagId; no-op on miss; skips
non-signing kinds; skips dismissed; idempotent; siblings untouched)
- ChatSidebar: 1 (SSE event triggers store update for the matching
message)
- agent: 4 — already included in earlier verification (1576 → 1580)
Spec deviation: spec proposed reusing existing dismissMessage(id);
implementation already uses that path via onResolved("dismiss") →
dismissMessage. The widened ChatMessage.expired field + dedicated
markMessageExpired action is per spec.
Out of scope:
- Reconnection recovery: client that was disconnected when TTL fired
has no way to discover the expiry on reconnect. Spec 2 explicitly
defers; tracked as follow-up (GET /api/tool-signing/pending route)
- Configurable per-tool TTL — today's 5-min applies uniformly
Spec: docs/superpowers/specs/2026-05-15-tool-signing-expired-sse-design.md
Stacked atop: PR #277 (assertNever, merged) — required for the
typecheck guarantee that demoed during this implementation.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements Spec 2 from PR #276. Closes the silent-expiration "ghost card" UX — today's 5-min promise-gate TTL silently rejects the awaiting promise without notifying the active SSE stream, so SignTxCards stay in "pending sign" state indefinitely and late signs hit 404 confirm routes.
Server now emits a new
SSEToolSigningExpiredevent the instant the TTL fires (via the sameexternalQueuepath thatsentinel_pauseuses), BEFORE the rejecter runs. The frontend marks the matching message expired andSignTxCardrenders a greyed-out, dismiss-only state.assertNever working as designed
Adding
SSEToolSigningExpiredto theSSEEventunion immediately surfaced two compile errors at thestreamMessageandchunkToSSEswitches — before any test ran, the typecheck told me exactly where the cross-file plumbing fanout needed to land. This is the first real follow-up PR proving the Spec 1 guard.Changes
Backend (5 source + 1 test file)
packages/agent/src/sentinel/pending-signing.ts— new optionalonExpire(flagId)callback, invoked before rejecter, with throws suppressedpackages/agent/src/agent.ts— newSSEToolSigningExpiredinterface, added toSSEEventunion + bothexternalQueuewidths.wrapWithSigningpassesonExpirecallback atcreatePendingSigningcall sitepackages/agent/src/core/types.ts—tool_signing_expiredadded toResponseChunk.type+ newexpired?fieldpackages/agent/src/core/agent-core.ts— new case instreamMessageswitchpackages/agent/src/adapters/web.ts— new case inchunkToSSEswitchFrontend (3 source + 3 test files)
app/src/stores/app.ts— newexpired?field onChatMessage+markMessageExpired(flagId)action with idempotency + race guardsapp/src/components/ChatSidebar.tsx— SSE handler case fortool_signing_expired, passesexpiredprop downapp/src/components/SignTxCard.tsx— newexpiredprop (default false). When true: skips unmount/rejectbeacon (server already reaped the flag), rendersopacity-50region with just a Dismiss button.onResolvedunion widened to'confirm' | 'reject' | 'dismiss'Test plan
cd packages/agent && pnpm exec tsc --noEmitcleancd app && pnpm exec tsc --noEmitcleanTest coverage detail
pending-signing.test.ts(+4):onExpirefires withflagIdwhen timeout hitsonExpireNOT called whenresolvePendingSigningruns firstonExpireNOT called whenrejectPendingSigningruns firstonExpirethrows (suppressed)SignTxCard.test.tsx(+6, in newdescribe('expired state')block):onResolved("dismiss")fires on Dismiss clickapp.test.ts(+6, in newdescribe('markMessageExpired')block):ChatSidebar.test.tsx(+1):tool_signing_expiredevent triggers store update for matching messageOut of scope (deferred per spec)
GET /api/tool-signing/pendingrouteSpec reference + dependency chain
Stacked atop PR #277 (Spec 1 assertNever — merged). The compile-time guard proved its value during this build: it caught the missing switch cases before tests ran.
Spec:
docs/superpowers/specs/2026-05-15-tool-signing-expired-sse-design.mdDemo-day relevance
This PR has visible UX polish — if a recording demonstrates a SignTxCard sitting beyond the 5-min TTL, the greyed-out + Dismiss state is a polished detail judges may notice. Even without that scenario, the integration-soundness signal (proper cross-layer SSE event propagation + typed exhaustiveness guards firing in CI) is judge-positive.