🤖 Artifacts: follow-ups from the stack review

[ThomasK33]

Tracking follow-ups for the Artifacts experiment stack (#5422 – #5430). Everything is behind the Artifacts experiment (off by default).

Deferred from Codex review (round 1)

• Rewrite relative url() references in inlined stylesheets (fonts, background images) so HTML artifacts that link a stylesheet render its assets. (🤖 feat: rich renderers for the Artifacts tab #5424 review)
• Batch artifact asset reads into one artifacts.readMany IPC call (HTML asset inlining and canvas readers issue one call per asset today; capped at 32 assets). (🤖 feat: rich renderers for the Artifacts tab #5424, 🤖 feat: artifact interactions, canvas and annotations #5429 review)
• Restore project shelves for projects imported or origin-matched during a settings-backup restore (the shelf restore runs before project import). (🤖 feat: cross-workspace artifact shelf and its settings backup #5428 review)

Deferred from Codex review (round 2)

• Pass experiment tool availability into scoped tool-instruction extraction (artifact_list; memory, timeline and advisor have the same gap). (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422 review)
• Keyboard shortcut for the PDF Open action (with the download shortcut below). (🤖 feat: rich renderers for the Artifacts tab #5424 review)
• Pass the app palette tokens (e.g. flexoki) to artifact frames instead of only light/dark. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425 review)
• Render boards for existing paused/completed goals when the Artifacts experiment is turned on (needs an experiment-change event). (🤖 feat: goal status board and agent-browser self-check for artifacts #5425 review)
• Forward the annotate shortcut (C) from inside sandboxed frames without stealing plain keys from the artifact. (🤖 feat: artifact interactions, canvas and annotations #5429 review)
• Separate opt-in for backing up pinned project artifacts (round 2 only clarifies the label). (🤖 fix: Artifacts review fixes, security hardening and docs #5430 review)

Deferred from Codex review (round 3)

• Bound artifact_list output by serialized size, not only entry count. (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422)
• Keep the JSON tree/raw mode when entering fullscreen; shortcut for the toggle. (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422)
• Scope MCP App result records by message (providers may reuse tool-call IDs). (🤖 feat: MCP Apps views in the Artifacts tab #5426)
• Keep deleted-artifact selections at latest version while the runtime is offline. (🤖 feat: artifact versions, the artifact tool and pinned files #5427)
• Expand ~ in pin paths per runtime. (🤖 feat: artifact versions, the artifact tool and pinned files #5427)
• Batch pinned-file metadata reads on remote runtimes (with the readMany item). (🤖 feat: artifact versions, the artifact tool and pinned files #5427)
• Make 8–10 MiB shelf entries readable from restore safety snapshots. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428)
• A malformed project shelf record should not block a global-only restore. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428)
• Shelf readers can see a torn entry for one poll during a swap (reader locking). (🤖 feat: cross-workspace artifact shelf and its settings backup #5428)
• Track artifact send progress per artifact (two concurrent sends). (🤖 feat: artifact interactions, canvas and annotations #5429)
• Preserve original send options for startup replay of pending artifact sends. (🤖 feat: artifact interactions, canvas and annotations #5429)

Deferred from Codex review (round 4)

• Valid but rare: a same-size replacement that also preserves mtime keeps the preview until R reloads it, and distinguishing it needs a new ctime/version field in both host and runtime listings. (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422, oQf7d)
• Correct that host reads ignore the request signal (remote runtime reads are already aborted, L2); (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422, oQf7g)
• Valid cost concern: the portable sh walk forks one stat per file, bounded by the 5,000-visit budget. (🤖 feat: Artifacts scratch dir and reads on SSH, Docker and devcontainer runtimes #5423, oQgVe)
• Valid: JSON.parse has already materialized the whole value (bounded by the 10 MB read cap), so this is linear extra validation work, not unbounded growth. (🤖 feat: rich renderers for the Artifacts tab #5424, oQgTH)
• Valid hardening: Mermaid artifacts take the same uncapped path as Mermaid blocks in chat messages today. (🤖 feat: rich renderers for the Artifacts tab #5424, oQgTQ)
• Valid: editing only a referenced sibling does not rebuild the preview until Reload or a parent edit. (🤖 feat: rich renderers for the Artifacts tab #5424, oQgTV)
• Valid gap, but fail-closed: CSP blocks the unrewritten srcset candidate, so nothing leaks; (🤖 feat: rich renderers for the Artifacts tab #5424, oQgTY)
• Valid but bounded: each read carries the 5 MiB per-asset cap server-side and at most 32 assets are read, so in-flight bytes stay under 160 MiB. (🤖 feat: rich renderers for the Artifacts tab #5424, oQkhC)
• Confirmed: the board is event-driven, so CI or review changes after the last goal event are not re-rendered (the board's Updated time shows when it was generated). (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oQgu3)
• Confirmed: for multi-project workspaces the probe runs in the primary checkout, while agent bash runs at the shared workspace root. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oQgu8)
• Confirmed: if the null refresh never lands (crash or failed write), a restarted service suppresses null observations and the old board stays until the next goal. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oQgu-)
• Valid but narrow: it needs a file literally named mcp-app: while that exact view is open, and the effect is only that the app keeps showing instead of the file until the view is closed. (🤖 feat: MCP Apps views in the Artifacts tab #5426, oQiQT)
• Reproduced (a pinned file whose size changes within the same mtime second is not re-read until the next mtime change or Reload), but it is a transient stale preview, not a blocker at this stage; (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oQjU5)
• Confirmed: the Open as artifact control renders for multi-project workspaces while the backend refuses pinning there with a clear error. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oQjU9)
• Valid as hardening, not a reachable OOM: the buffered bytes are the user's own local entries that the restore replaces, which a repository writer cannot grow (incoming files stay capped at 64 MiB). (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQhmC)
• Confirmed: the shelf unpin resets the selection without the reread the pinned-file unpin does. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh0k)
• Confirmed: a text-kind pin holding NUL bytes is decoded and returned (capped at 100k characters). (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh0r)
• Confirmed: NFC and NFD spellings of one name both pass readShelfBackup. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh0v)
• Confirmed: applyShelfRestore refuses a symlinked artifacts/global after the settings are restored. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh08)
• Valid UX gap: copies kept as name~2 show the same label in the picker. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh1E)
• Valid as hardening: the shelf grows only by explicit pins (a repin replaces its own entry) and each refresh aborts the previous listing request. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oQh1N)
• Valid narrow race: only when getState resolves before listVersions, the frame sends on load, and a new version lands before Send; (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYR)
• Valid: mixing an artifact send with a typed message in one queue loses the artifact marker, but the confirmed text is restored as a normal draft, not lost. (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYU)
• Needs the pending-file delete to fail after the row is durable; (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYY)
• Valid UX gap for malformed agent-written canvases; (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYc)
• Valid on narrow layouts where the hidden sidebar panel stays mounted under the dialog (dialog from L6); (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYg)
• Valid but minor: the stale pick reappears visibly and still needs a typed comment and a click to submit. (🤖 feat: artifact interactions, canvas and annotations #5429, oQjYm)
• Valid: project shelves follow includeProjects in the L7 backup adapters, so masking needs the separate includeProjectArtifacts option already (🤖 fix: Artifacts review fixes, security hardening and docs #5430, oQfax)

Deferred from Codex review (round 5)

• Valid: the probe checks test -d, so a mount the container user cannot write (UID mismatch with updateRemoteUserUID off) is still exported and shown, and agent writes then fail with a visible permiss (🤖 feat: Artifacts scratch dir and reads on SSH, Docker and devcontainer runtimes #5423, oRvhm)
• Valid rendering gap: an inlined relative stylesheet loses its media constraint. (🤖 feat: rich renderers for the Artifacts tab #5424, oRw2c)
• Valid gap: reference-style images are not inlined, so they render broken. (🤖 feat: rich renderers for the Artifacts tab #5424, oRw2j)
• Valid: republishing identical bytes with a new kind updates the latest version's kind, so an older card opens with the newer renderer. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oRzZa)
• Valid on Windows: an absolute path differing only in case from the configured root is refused with an error (it fails closed; (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oRzZu)
• Valid: without XUM_SCRATCH_DIR, artifact_list is not registered, so artifact_read has no listing to name its entries. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oRxzQ)
• Valid: usedDirs also takes segment 1 of global/ paths. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oRxzV)
• Valid: the stored pin request is reported in later results while only an explicit pin copies a version, so the shelf keeps the earlier copy, labeled with its version. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oRxzb)
• Valid but narrow: only the last state set within 250 ms of tearing the frame down is lost, and the round-2 coalescing already replaced the host drops that lost the final save more often. (🤖 feat: artifact interactions, canvas and annotations #5429, oRxyw)
• Valid hardening: it needs an agent-written canvas with millions of tiny rows inside the read size limit and only slows the renderer. (🤖 feat: artifact interactions, canvas and annotations #5429, oRxy2)
• Valid edge: only when listVersions fails or is still refreshing does a comment get version 0 or the previous version; (🤖 feat: artifact interactions, canvas and annotations #5429, oRxzD)
• Valid: artifact comments show up in the git-review sidebar list without a working jump; (🤖 feat: artifact interactions, canvas and annotations #5429, oRxzH)
• Valid: without a result record (older or pruned calls) the card's display key is still used, so servers whose configured key has whitespace runs or exceeds 80 characters cannot open input-only views. (🤖 feat: MCP Apps views in the Artifacts tab #5426, oR3oZ)
• Valid cosmetic edge: only a narrow card with an MCP badge and a long unbroken tool name can push the header past the edge; (🤖 feat: MCP Apps views in the Artifacts tab #5426, oR3oq)
• Include file size in the changed-artifact marker (size-only rewrite with preserved mtime shows no dot). (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422, oRtbz)

Deferred from Codex review (round 6)

• Valid: in the narrow dialog an Escape bridged from the preview is ignored, as it has been since the dialog was added (the round-4 change kept the Escape branch unchanged, so this is not a regression). (🤖 feat: rich renderers for the Artifacts tab #5424, oTbxC)
• Valid, executed: mapMarkdownImageUrls rewrites an image inside an inline code span (![logo](img.png) becomes a data URL). (🤖 feat: rich renderers for the Artifacts tab #5424, oTbxE)
• Valid hardening: an HTML artifact near the 10 MB read cap can be slow to parse. (🤖 feat: rich renderers for the Artifacts tab #5424, oTbxF)
• Valid gap, but it fails closed: img-src data: blob: blocks the unresolved relative SVG reference, so nothing is fetched and the image just does not show. (🤖 feat: rich renderers for the Artifacts tab #5424, oTbxL)
• Valid: a version read does not check the blob against its stored size and hash. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oTasQ)
• Confirmed: artifact_list reports diagram.txt published as Mermaid with the extension kind (text). (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oTasU)
• Valid only when two backends share one Xum home (the desktop app alongside xum server, or XUM_ALLOW_MULTIPLE_INSTANCES); (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oTasl)
• Only the in-process ACP path awaits startup housekeeping; (🤖 feat: artifact interactions, canvas and annotations #5429, oTa4u)
• Nothing is lost: the confirmed record stays on disk and is delivered when Artifacts is turned on again. (🤖 feat: artifact interactions, canvas and annotations #5429, oTa44)
• Valid but needs the user to reassign an existing server key to a different server and then reopen a view recorded before the change; (🤖 feat: MCP Apps views in the Artifacts tab #5426, oTax-)
• Valid test-coverage gap with no product impact: McpAppViewPhone reuses the file's shared PHONE preset (viewport global only, Pixel disabled), so CI runs its play at desktop width. (🤖 feat: MCP Apps views in the Artifacts tab #5426, oTayC)
• Confirmed: a path whose flattened name exceeds 255 characters fails to pin with a misleading error. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oTZjl)
• Valid, but this predates the PR: on main, bash and terminal env already merge secrets after xumEnv, so a user-defined secret can shadow any XUM_* variable, XUM_SCRATCH_DIR included (this PR does not t (🤖 feat: Artifacts tab for files in $XUM_SCRATCH_DIR/artifacts (experiment) #5422, oR7ut)

Deferred from Codex review (round 7)

• We could not reproduce this: the host effect runs right after the commit that mounts the frame, while the srcdoc document is created by an asynchronous navigation, so the listener is in place before t (🤖 feat: MCP Apps views in the Artifacts tab #5426, oUJ8D)
• Valid narrow race: a view request already in flight when its workspace is archived or removed can reach the MCP manager without the teardown admission that prompt discovery uses (the cold-start path a (🤖 feat: MCP Apps views in the Artifacts tab #5426, oUJ8W)
• Valid: a failed shelf listing leaves the previous value in place. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oUK4J)
• Confirmed that padding bypasses the field bounds, but the cost is capped by the 64 MiB restore limit (about 40 ms per poll for 56 MiB in a probe), it needs a user-run restore from a tampered repositor (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oUL8h)
• Valid race: a live frame's write can land on a version published moments earlier, so that version starts with the previous frame's state; (🤖 feat: artifact interactions, canvas and annotations #5429, oULZq)
• No product path writes a record for another workspace: records are written only under the workspace they name, and forks do not copy the pending file. (🤖 feat: artifact interactions, canvas and annotations #5429, oULZv)
• Needs a state file edited outside Xum; (🤖 feat: artifact interactions, canvas and annotations #5429, oULZ4)
• Valid gap, but it fails closed: only the entry module is inlined, and its relative imports are blocked by the frame CSP, so nothing outside the artifact folder is fetched; (🤖 feat: rich renderers for the Artifacts tab #5424, oUKVt)
• Valid: the Table/Tree/Raw switch has no dedicated shortcut (the buttons are keyboard-focusable). (🤖 feat: rich renderers for the Artifacts tab #5424, oUKVy)
• Valid wording gap: outside the desktop app, HTML artifacts show escaped source with a desktop-only notice, which is the intended fail-closed behavior. (🤖 feat: rich renderers for the Artifacts tab #5424, oUKV4)
• Valid availability concern; (🤖 feat: rich renderers for the Artifacts tab #5424, oUMWj)
• Reproduced: a same-prefix colliding pair is found in about 3 s, and the second path's publish is appended to the first path's history. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oUMU8)
• Reproduced on a Linux dev container host: after the container swaps a pinned file's parent for a symlink, the pinned-files list shows the size and mtime of the host file it points to. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oUMVB)
• Valid: ArtifactViewer derives the image MIME type from the extension only, so an extensionless file published with kind "image" shows "This image cannot be displayed." It fails closed with a notice an (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oUMVD)
• Valid: artifact_list awaits the live listing before it reads the version indexes, so an unreachable runtime returns an error instead of the stored versions. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oUMVE)
• Valid: a non-ENOENT read error on one index rejects the whole scan. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oUMVH)

Deferred from Codex review (round 8)

• Valid: while the workspace runtime is unreachable, the live-listing error hides shelf selections too. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oU-UW)
• Valid, and already The skipped entries are listed and stay in the backup, so a restore after the import brings them back. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oU-Ub)
• Valid hardening: the artifact can replace the pick under an open comment box, but the new quote is shown in the popover before the user submits. (🤖 feat: artifact interactions, canvas and annotations #5429, oVAPB)
• Valid: an agent-written canvas with a deeply nested x value trips the Artifacts error boundary instead of reporting a bad point; (🤖 feat: artifact interactions, canvas and annotations #5429, oVAPG)
• Valid edge: saved state can be overwritten only when reading it fails while the following write succeeds, for example a brief IPC drop. (🤖 feat: artifact interactions, canvas and annotations #5429, oVAPL)
• Valid but not a blocker: the race can only leave an empty scratch directory behind (the pre-write guard still blocks the board write), so nothing is lost or exposed. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oU_Dp)

Deferred from Codex review (round 9)

• Valid but not a blocker: a transient tool_env lookup failure can cache false, which only keeps the agent-browser warning on HTML artifacts until restart; (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oVPBi)
• Valid: a stored Markdown/HTML/SVG version resolves its relative assets through the live artifacts route, so an older version can render with today's image or stylesheet. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oVQ9J)
• Valid: malformed persisted UI-only metadata renders an enabled Open in Artifacts button whose click fails an assertion. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oVQ9Z)
• Valid: if the host clock moves backward after a publish, turn-end snapshots are skipped until wall time passes that publish. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oVQ9i)
• Valid only for an entry edited by hand: pins always write exactly one content file plus meta.json, and a content file named meta.json in any case is refused. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oVP0j)
• Valid: a non-missing lstat error on the backup's shelf folder is treated as no shelf backup. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oVP0n)
• Valid: two overlapping pins of different versions of one artifact can land in either order. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oVP0u)
• Valid: a non-missing read error on a shelf scope exports that scope as empty without a notice. (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oVP0x)
• Valid hardening: a canvas packed with millions of tiny entries is fully validated before the 500-block cap applies. (🤖 feat: artifact interactions, canvas and annotations #5429, oVSMt)
• Needs a pending file Xum did not write: live sends validate depth and size before recording. (🤖 feat: artifact interactions, canvas and annotations #5429, oVSM5)
• Needs a chat.jsonl row Xum did not write: artifact data is validated before the message is sent. (🤖 feat: artifact interactions, canvas and annotations #5429, oVSNA)
• Needs two backends on the same session data, which Xum does not support by default. (🤖 feat: artifact interactions, canvas and annotations #5429, oVSNI)
• Valid gap: state of a deleted artifact is still stored but not shown in artifact_list; (🤖 feat: artifact interactions, canvas and annotations #5429, oVSNi)
• Valid at this layer: the experiment gate moved down to L2, but the corrected docs row arrives with L9 of this stack ("SSH, Docker and devcontainer workspaces get one only when the Artifacts experiment (🤖 feat: Artifacts scratch dir and reads on SSH, Docker and devcontainer runtimes #5423, oVOkX)

Deferred from Codex review (round 10)

• Valid: the panel's positive probe never expires, so a deleted SSH dir shows as an empty folder and a devcontainer rebuilt without the mount keeps showing the host folder until restart. (🤖 feat: Artifacts scratch dir and reads on SSH, Docker and devcontainer runtimes #5423, oWlVO)
• Valid edge case: a pre-1970 mtime makes stat print a negative value and the SSH/Docker listing drops that file. (🤖 feat: Artifacts scratch dir and reads on SSH, Docker and devcontainer runtimes #5423, oWlVc)
• Valid hardening: a canvas with millions of inline chart rows is fully validated before the 1,000-row display cap. (🤖 feat: artifact interactions, canvas and annotations #5429, oWpTf)
• Valid: a deleted artifact opened at its implicit latest version is classed as a live selection, so if the runtime later becomes unreachable the listing error replaces its stored preview. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oWlDs)
• Valid on Windows: a relative path with backslashes is refused with an error, while forward slashes and absolute paths work. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oWlDx)
• Valid: attaching an empty SVG inside the artifacts folder records an (empty, accurate) version before the tool reports failure, which also counts as that turn's publish. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oWlD2)
• Valid: stale SSH/Docker pinned reads are not cancelled and can run until the 30 s exec timeout. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oWlD7)
• Valid UX nit: the generated goal board gets the same 'Not checked by the agent' label as agent-written HTML when agent-browser is missing. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oWe5T)

Deferred from Codex review (round 11)

• Valid cost issue: with Artifacts as the hidden active tab, the narrow dialog mounts a second panel, so polling and any HTML frame are duplicated. (🤖 feat: rich renderers for the Artifacts tab #5424, oXkMJ)
• Valid fidelity gap: an inlined async classic script runs at its original position instead of asynchronously. (🤖 feat: rich renderers for the Artifacts tab #5424, oXkMc)
• Valid but not a blocker: the agent-browser hint can stay stale after a trust toggle until the viewer remounts. (🤖 feat: goal status board and agent-browser self-check for artifacts #5425, oXkiO)
• Valid on case-insensitive filesystems: publishing Report.md and then report.md keeps two histories for one file, and the non-listed spelling shows as deleted. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oXmfi)
• Valid: a home-relative file-tool path such as ~/checkout/report.md cannot be pinned from Open as artifact and gets a refusal (it fails closed); (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oXmfq)
• Valid: a same-size, mtime-preserving rewrite (cp -p) keeps the preview's read key, so the open preview stays stale until Reload or the next metadata change. (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oXmgj)
• Valid: Stop puts a queued artifact send's internal envelope text into the composer instead of dropping it; (🤖 feat: artifact interactions, canvas and annotations #5429, oXjW6)

Deferred from Codex review (after the final push)

• Refresh cached state before remounting artifact frames (src/browser/features/RightSidebar/ArtifactsTab/useArtifactInteractions.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oaNqu)
• Disable dismissal while an artifact send is in flight (src/browser/features/RightSidebar/ArtifactsTab/ArtifactSendStrip.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oaNqx)
• Preserve the shelf sidecar across downgraded pushes (src/node/services/backup/adapters.ts) (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oaJRh)
• Report I/O failures instead of succeeding at unpin (src/node/services/artifactShelf.ts) (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oZ5Z7)
• Reuse an existing source entry before a free slot (src/node/services/artifactShelf.ts) (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oZ5aE)
• Count sparse array slots in the JSON work budget (src/common/constants/artifactInteractions.ts) (🤖 feat: artifact interactions, canvas and annotations #5429, oZ5JD)
• Add scoped shortcuts for confirming and dismissing sends (src/browser/features/RightSidebar/ArtifactsTab/ArtifactSendStrip.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oZ5JI)
• Evict obsolete assets when canvas references change (src/browser/features/RightSidebar/ArtifactsTab/CanvasArtifact.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oZ5JO)
• Rebuild the sandbox when artifact identity changes (src/browser/features/RightSidebar/ArtifactsTab/SandboxedArtifactFrame.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oZ5JU)
• Escape tool names before displaying consent (src/browser/features/RightSidebar/ArtifactsTab/McpAppFrame.tsx) (🤖 feat: MCP Apps views in the Artifacts tab #5426, oY3xy)
• Permit local blob assets in app views (src/browser/features/RightSidebar/ArtifactsTab/mcpAppCsp.ts) (🤖 feat: MCP Apps views in the Artifacts tab #5426, oY3x2)
• Keep pinned previews visible when artifact listing fails (src/browser/features/RightSidebar/ArtifactsTab/ArtifactsPanel.tsx) (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oY4w_)
• Preserve source bytes when registering attachments (src/node/services/tools/attach_file.ts) (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oY4xC)
• Treat bare tilde prefixes as relative filenames (src/node/services/artifactVersionsOperations.ts) (🤖 feat: artifact versions, the artifact tool and pinned files #5427, oY4xE)
• Keep extended entries restorable from safety snapshots (src/node/services/backup/artifactShelfBackup.ts) (🤖 feat: cross-workspace artifact shelf and its settings backup #5428, oYzu4)
• Validate canvas button payloads before opening the send strip (src/browser/features/RightSidebar/ArtifactsTab/CanvasArtifact.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oY2JV)
• Track send progress separately for each artifact (src/browser/features/RightSidebar/ArtifactsTab/useArtifactInteractions.tsx) (🤖 feat: artifact interactions, canvas and annotations #5429, oY2Ja)
• Preserve valid replacement characters in downloadable text (src/browser/features/RightSidebar/ArtifactsTab/ArtifactsPanel.tsx) (🤖 feat: rich renderers for the Artifacts tab #5424, oY1m4)

Known follow-ups from the stack

• Version store size caps
• Forks do not copy artifact versions
• Background writers vs workspace removal
• Serial startup replay of pending artifact interactions
• Keyboard shortcuts for download and the send strip; document shelf shortcuts (p, Shift+P, u)
• Full VS Code webview support
• Remote images in Markdown artifacts
• Browser/server mode: close the residual window where a sandboxed frame can start a navigation before the guard reacts (desktop blocks subframe navigation outright)

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $107.80

[ThomasK33]

Picked up by the issue coordinator: workspace workspace-66 (ce2f2e6ddb), branch fix/artifacts-5446-followups

Plan: verify every item against current main and post a triage table here, then fix the consent tool-name escaping, the sparse-array JSON budget and the send-strip shortcuts first, then a few cheap P2s (at most 3 PRs, each "Refs #5446"). This issue stays open for the rest.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $0.00

[ThomasK33]

Triage against main (d5a6ea6)

I checked every checklist item against the code on main. Classes:

• A: small fix, no new persisted field, one backend.
• B: needs two backends sharing one Xum home (parked).
• C: new persisted field, on-disk format or subsystem (needs an owner decision first).
• D: low priority, cosmetic, fail-closed hardening, or feature-sized.
• E: already fixed on main.

Totals over 153 items: 85 A, 2 B, 12 C, 51 D, 3 E. "L" is the line number in this issue body. Size estimates in parentheses are changed lines including tests; some are unverified.

Now: L162 (consent tool name escaping) and L158 (sparse array budget) in PR 1; L159 + L177 (send strip shortcuts), L154 (no Dismiss while sending) and the shelf shortcut docs in PR 2; a few cheap A items in PR 3. Every PR says "Refs #5446".

Deferred from Codex review, rounds 1–3 (L4–L27)

L	Item	Class	Evidence / note
4	Rewrite relative url() in inlined stylesheets	A (~120)	artifactDocument.ts:139-160 inlines CSS verbatim
5	Batch asset reads (artifacts.readMany)	D	perf only, 32-asset cap
6	Restore project shelves for projects imported in the same restore	D	imports run after the shelf restore on purpose (backupService.ts); skipped entries are reported
9	Pass experiment tool flags into tool-instruction extraction	A (~15)	systemMessage.ts:294-342 passes only agentReport/reviewPane
10	Shortcut for PDF Open (and Download)	A (~50)	no keybind; overlaps L177
11	App palette tokens for artifact frames	D	bridge contract change, cosmetic
12	Boards for existing goals when the experiment turns on	D	needs an experiment-change event
13	Forward annotate key (C) from sandboxed frames	D	frames own their plain keys (design question)
14	Separate opt-in for backing up pinned project artifacts	C	new persisted backup setting
17	Bound artifact_list by serialized size	A (~40)	artifact_list.ts:118-158 caps by count only
18	Keep JSON tree/raw mode in fullscreen, toggle shortcut	A (~60)	mode is local useState in JsonArtifact.tsx
19	Scope MCP App result records by message	C	on-disk key/file name change (mcpAppResultStore.ts)
20	Deleted-artifact selection at latest version while offline	A (~40)	ArtifactsPanel.tsx:304-307,1002
21	Expand ~ in pin paths per runtime	A (~30)	pinnedArtifactFiles.ts:244-258
22	Batch pinned-file metadata reads on remote runtimes	D	perf, tied to L5
23	8–10 MiB shelf entries readable from safety snapshots	A (~30)	readShelfBackup 8 MiB per-file cap vs 10 MiB shelf files
24	Malformed project record blocks a global-only restore	A (~30)	whole-manifest safeParse before scope filtering
25	Torn shelf entry during a swap	A (~15)	readers take no scope lock (process-local fix only)
26	Track send progress per artifact	A (~30)	one sendState slot (useArtifactInteractions.tsx); same as L169
27	Keep original send options for startup replay	C	pending record stores no options

Round 4 (L30–L57)

L	Item	Class	Evidence / note
30	Same-size, same-mtime replacement keeps preview	D	needs ctime/version listing field
31	Host reads ignore the request signal	A (~30)	artifactsOperations.ts:262 drops abortSignal
32	sh walk forks one stat per file	D	perf, bounded at 5,000 visits
33	JSON table validates all rows	D	linear, capped by 10 MB read
34	Mermaid artifacts uncapped	D	Mermaid's own maxTextSize/maxEdges defaults apply
35	Sibling asset edit does not rebuild the preview	A (~100)	asset revisions not in the frame key
36	srcset not rewritten	A (~20)	fails closed under CSP
37	32×5 MiB reads in flight	D	bounded at 160 MiB
38	Goal board not refreshed on CI/review changes	D	needs polling, feature-sized
39	Capability probe uses the primary checkout (multi-project)	D	hint only
40	Stale board when the null refresh is lost	A (~30)	workspaceGoalService.ts:822-827
41	mcp-app: prefix can collide with a file name	A (~15)	views are in-memory only
42	Pinned read key lacks size	A (~15)	ArtifactsPanel.tsx:389
43	Open as artifact shown in multi-project workspaces	A (~20)	OpenAsArtifactButton.tsx:33
44	Restore buffers displaced shelf files	D	user's own local bytes
45	Shelf unpin resets a newer selection	A (~10)	ArtifactsPanel.tsx:517-531
46	Text-kind pin with NUL bytes returned	A (~15)	tools/artifact_read.ts:44-50
47	NFC/NFD shelf names both accepted	A (~15)	artifactShelfBackup.ts:340,343
48	Symlinked artifacts/global refused only after settings restore	A (~50)	preflight reads only the sidecar
49	name~2 copies share one picker label	A (~10)	cosmetic
50	Shelf listing unbounded	D	grows only by explicit pins
51	getState version discarded (race)	A (~20)	useArtifactInteractions.tsx:56,78
52	Mixed queue drops the artifact marker	A (~60)	messageQueue.ts:997; estimate unverified
53	onAccepted cleanup failure reports an error	A (~20)	artifactInteractions.ts:247
54	Canvas buttons with unsendable payloads	A (~20)	same as L168
55	Hidden sidebar panel and dialog both run interactions	A/D (~80)	mount ownership; unverified
56	Stale annotation pick reappears	A (~10)	ArtifactsPanel.tsx:581-582
57	Project shelves not masked when Artifacts is off	C	needs includeProjectArtifacts; an A-sized skip-when-off alternative exists

Rounds 5–7 (L60–L107)

L	Item	Class	Evidence / note
60	Devcontainer probe checks test -d, not writability	A (~20)	runtimeScratchDir.ts:173
61	Inlined stylesheet loses media	A (~15)	artifactDocument.ts:153
62	Reference-style images not inlined	A (~60)	markdownImages.ts inline-only regex
63	Same bytes with a new kind rewrite the latest kind	A (~25)	artifactVersionStore.ts:183-205
64	Windows case-different absolute root refused	A (~25)	fails closed; needs a platform seam
65	No artifact_list without XUM_SCRATCH_DIR	A (~40)	tools.ts:938-952
66	usedDirs takes segment 1 of global/ paths	A (~15)	artifactShelfBackup.ts:246
67	Stored pin request reported in later results	A (~15)	tools/artifact.ts:49,86
68	Last setState within 250 ms of teardown lost	D	narrow
69	Canvas with millions of tiny rows	D	renderer slowdown only
70	Comment gets version 0 when listVersions fails	D	comment kept
71	Artifact comments in the git-review list without a jump	A (~20)	ReviewPanel.tsx:1029
72	Display key used without a result record	C	raw key must be persisted in the card
73	MCP badge + long tool name overflows the header	D	cosmetic
74	Changed-artifact dot ignores size	A (~25)	in-memory seen map
77	Narrow dialog ignores bridged Escape	A (~25)	handleFrameKey handles fullscreen only
78	Image inside an inline code span rewritten	A (~30)	markdownImages.ts:36; fix with L62
79	HTML near the 10 MB cap parses slowly	D	bounded by read cap
80	Relative SVG reference unresolved	D	fails closed
81	Version read skips blob size/hash check	A (~20)	needs outside corruption
82	artifact_list reports the extension kind, not the published kind	A (~15)	tools/artifact_list.ts:87-148
83	Two backends share one Xum home	B	parked
84	In-process ACP awaits replay housekeeping	D	needs crash + hung send
85	Replay held while the experiment is off	D	nothing lost
86	Server key reassigned, old view reopened	C	needs a config fingerprint in the record
87	McpAppViewPhone play runs at desktop width	D	test coverage only
88	Flattened name >255 chars: misleading pin error	A (~25)	artifactShelf.ts:141-151
89	Secrets can shadow XUM_* env vars	A (~20)	predates Artifacts; behavior change, needs its own issue
92	Frame listener registration race	D	not reproduced
93	In-flight view request skips teardown admission	D	narrow race
94	Failed shelf listing keeps the old value	A (~15)	ArtifactsPanel.tsx:270-278
95	Padding bypasses restore field bounds	D	64 MiB cap, tampered backup
96	Live write lands on a just-published version	A (~30)	useArtifactInteractions.tsx:83-110
97	Record for another workspace	D	no product path
98	State file edited outside Xum	D	hardening
99	Module imports not inlined	D	fails closed, feature-sized
100	No shortcut for Table/Tree/Raw	A (~40)	JsonArtifact.tsx:95; with L18
101	HTML guidance not marked desktop-only	A (~2)	tool description wording
102	Frame can block the app event loop	D	site isolation not verified
103	40-bit artifact ID collision	A (~15)	refuse when existing.path !== relPath; longer hash is C
104	Devcontainer pinned stat follows symlinks	D	local metadata only
105	Extensionless kind:"image" not shown	A (~35)	fails closed with a notice
106	Live listing failure hides stored versions	A (~30)	tools/artifact_list.ts:72-94
107	One non-ENOENT index error rejects the scan	A (~15)	artifactVersionStore.ts:310-314

Rounds 8–11 (L110–L150)

L	Item	Class	Evidence / note
110	Listing error hides shelf selections	A (~30)	ArtifactsPanel.tsx:1002,1044; same fix as L137, L164
111	Skipped shelf entries come back only on a second restore	D	ordering rule in backupService.ts
112	Frame can replace the pick under an open comment box	D	new quote is shown before submit
113	Deeply nested chart x value trips the error boundary	A (~25)	unguarded JSON.stringify in canvasSpec.ts
114	getState failure mounts the frame as no-state	A (~40)	useArtifactInteractions.tsx:56-60
115	Race leaves an empty scratch dir	D	nothing lost
118	Failed tool_env lookup caches agent-browser=false	D	cosmetic until restart
119	Stored versions load today's relative assets	C	needs versioned assets
120	Malformed ui_only.artifact gives a button that asserts	A (~20)	toolOutputUiOnly.ts:108-114
121	Clock moving backward skips turn-end snapshots	D	proper fix needs a monotonic persisted marker (C)
122	Hand-edited shelf entry with case-colliding files	D	hand-edited state
123	Non-missing lstat error reads as "no shelf backup"	A (~20)	artifactShelfBackup.ts:311
124	Overlapping pins of two versions land in either order	A (~40)	low value
125	Unreadable shelf scope exports as empty	A (~30)	artifactShelfBackup.ts:114-120; a push can then record a deletion
126	Huge blocks array validated before the 500 cap	D	linear after JSON.parse
127	Pending replay records skip depth/size limits	D	needs a file Xum did not write
128	Malformed artifact data in chat.jsonl	D	needs a row Xum did not write
129	Pending sends not coordinated across backends	B	parked (with L83)
130	artifact_list omits state of deleted artifacts	A (~40)	artifact_list.ts:103-107
131	Docs row for the remote scratch experiment gate	E	docs/hooks/environment-variables.mdx:18
134	Positive scratch probe never expires	A (~40)	artifactsOperations.ts:69,125-155
135	Pre-1970 mtime drops the file (SSH/Docker)	A (~15)	artifactRuntimeStore.ts:109 regex
136	Huge inline chart data validated before the 1,000-row cap	D	same as L126
137	Deleted artifact at implicit latest version counts as live	A (~25)	with L110
138	Windows relative path with backslashes refused	A (~15)	artifactVersionsOperations.ts:86-108
139	Empty SVG records a version before the tool fails	A (~25)	attach_file.ts:77,97
140	Stale remote pinned reads not aborted	A (~30)	router.ts:1579 ignores signal
141	Goal board gets the "Not checked" label	D	cosmetic
144	Narrow dialog mounts a second panel	D	cost only
145	Inlined async script runs in place	D	fidelity
146	agent-browser hint stale after a trust toggle	D	cosmetic
147	Case-insensitive FS splits histories	C	changes artifact ID derivation
148	~/… tool path cannot be pinned	A (~40)	fails closed; needs runtime home
149	cp -p same-size rewrite keeps the preview	D	needs a new listing field
150	Stop restores a queued artifact send's envelope into the composer	A (~30)	messageQueue.ts:1035-1045

After the final push (L153–L170) and known follow-ups (L173–L180)

L	Item	Class	Evidence / note
153	Refresh cached state before remounting frames	A (~20)	setState never updates loadedState
154	Disable Dismiss while a send is in flight	A (~15)	PR 2
155	Preserve the shelf sidecar across downgraded pushes	C	needs a new backup-repo layout
156	Report I/O failures at unpin	A (~30)	artifactShelf.ts:160-169,482
157	Reuse an existing source entry before a free slot	A (~25)	artifactShelf.ts:253
158	Count sparse array slots in the JSON budget (P1)	A	PR 1
159	Send strip shortcuts (P1)	A	PR 2
160	Evict obsolete canvas assets	E	viewer remounts on key={currentRead.key} (ArtifactsPanel.tsx:690)
161	Rebuild the sandbox when artifact identity changes	E	same remount; the frame's own check is still path-blind
162	Escape tool names before displaying consent (security)	A	PR 1
163	Permit blob: assets in app views	A (~10)	mcpAppCsp.ts:96-97
164	Keep pinned previews visible when listing fails	A (~20)	with L110
165	Preserve source bytes when registering attachments	A (~25)	attach_file.ts:41-43
166	Treat bare ~name as a relative file name	A (~10)	artifactVersionsOperations.ts:99
167	Extended entries restorable from safety snapshots	D	no build writes extra files
168	Validate canvas button payloads before the strip	A (~30)	CanvasArtifact.tsx:311
169	Track send progress per artifact	A (~30)	same as L26
170	Keep valid U+FFFD in downloadable text	A (~60)	needs a read-result flag (IPC only)
173	Version store size caps	C	new policy/subsystem
174	Forks do not copy artifact versions	C	needs a fork-semantics decision first
175	Background writers vs workspace removal	C	needs use-lease integration
176	Serial startup replay of pending interactions	A (~20)	serviceContainer.ts:633-638
177	Shortcuts for download and the send strip; document p, Shift+P, u	A	PR 2 (send strip + docs); download with L10
178	Full VS Code webview support	D	feature-sized
179	Remote images in Markdown artifacts	D	feature-sized, privacy/CSP design
180	Browser mode: residual frame navigation window	D	desktop already blocks it

The C items (L14, L19, L27, L57, L72, L86, L119, L147, L155, L173, L174, L175) need an owner decision before work starts.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $6.06

[ThomasK33]

Done (all merged to main; "L" is the line number in this issue body, as in the triage comment):

L	Item	PR	Merge commit
162	Escape tool names in the MCP consent question (bidi, C0/C1 controls, U+2028/U+2029, backslashes)	#5511	c5a0b5a
158	Count sparse array slots in the artifact JSON work budget	#5511	c5a0b5a
159	Scoped shortcuts for the send strip: Send Ctrl+Enter, Dismiss Ctrl+Backspace	#5513	f7feeb4
154	Disable Dismiss while an artifact send is in flight	#5513	f7feeb4
177 (part)	Send strip shortcuts and the shelf shortcuts P / Shift+P / U in the docs (the download shortcut is still open, with L10)	#5513	f7feeb4
166	~draft.md is a relative file name; only ~ and ~/ mean home	#5514	766ff87
135	Keep files with a pre-1970 mtime in SSH/Docker listings	#5514	766ff87
46	artifact_read refuses text-kind shelf entries with NUL bytes	#5514	766ff87
66	Shelf backup manifest lists only projects with project/ entries	#5514	766ff87

New follow-ups from the final checks:

• The consent tool-name escape does not cover invisible format characters (U+200B, U+2060, U+FEFF, U+00AD, tag characters U+E0000–E007F), so two names can still look alike. Widen mcpServerIdentity.ts UNSAFE_TEXT to match. (🤖 fix: escape MCP consent tool names and bound sparse artifact arrays #5511 final check)
• The send strip's shortcut tooltips do not open while their button is disabled (Button has disabled:pointer-events-none), so the Send hint is hidden for the first 750 ms and Dismiss's hint during a send. (🤖 fix: keyboard shortcuts for the artifact send strip #5513 final check)

Everything else stays open here as triaged. The C items (L14, L19, L27, L57, L72, L86, L119, L147, L155, L173, L174, L175) are parked by the coordinator: no new persisted field or subsystem for an off-by-default experiment right now. B (L83, L129) and D items stay in backlog.

---

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $13.85