fix: harden credentials, sessions, uploads, and retrieval

[bigint]

Saved chat keys could be redirected to a caller-selected endpoint, slow provider streams could lose tokens at heartbeat ticks, and late browser responses could cross session transitions. This PR binds saved keys to their verified destination, preserves pending token reads, fixes unsafe SDK retries and shared-session analytics concurrency, and gives browser chat/auth/upload work explicit ownership. Password changes clear the cookie and local state directly. Truncated answers remain visible with an interruption error.

Uploads now inspect failed/canceled file responses even when HTTP succeeds. Validation failures retain their status, missing files after closure reach a terminal state once accepted work finishes, and new file requests reject closed sessions. The UI closes after all attempts, recognizes cancellation, and keeps issue panels visible with accurate warnings.

Evaluation previously gave repeated hits for one relevant document an nDCG of 2.1309. Each relevant ID now earns credit only at its first original rank, keeping nDCG within [0, 1] while preserving hit IDs, recall, MRR, and scores for unique rankings. Explicit null now clears collection default_min_score or metadata_schema; omission preserves them, and zero/empty objects remain valid. Both SDK update contracts and API docs match. Existing cached evaluation responses are not rewritten.

API-key PATCH now distinguishes omitted expiration from explicit null: omission preserves the date, null removes expiration, and a timestamp replaces it. The existing admin-session authorization, key identity/secret, permissions, active state, principal invalidation and audit recording remain intact. Clearing an active expired key restores expiration eligibility; inactive keys stay inactive. Existing nullable models and both SDKs already support this contract, so no schema or SDK change is needed. No actual key or deployed account was changed.

Failed upload retries no longer subtract bytes that were already excluded from the session-size sum, so over-cap retries reject while exact-cap retries remain valid. Studio blocks saving zero file types, preserves the existing unrestricted [] value when all types are selected, and identifies the filter as Studio-only. Usage labels and docs separate query-window activity from current stored-document token/cost estimates, explain model-name pricing and unpriced zero values, and leave API numbers and rates unchanged.

Single and batch uploads now apply their configured size caps to file bytes. Previously, multipart framing caused valid near-limit and exact-limit uploads to return 413. The handlers retain the streaming per-file/aggregate counters, 100-file cap, authorization, validation, audit and cleanup. Docs define the byte units and equality behavior. This removes a check after multipart parsing; it adds no wire-body or proxy policy.

Studio now uses computed, session-only credential readiness for browser chat and question generation, allowing an eligible instance key without claiming a personal key was saved. The GET returns a private/no-store three-field configuration DTO, shares credential selection and destination guards with actual chat, and makes no provider or DNS request. Both SDKs expose typed auth methods. The browser gates actual send/generation/retry, blocks stale readiness through key changes and refetch, preserves Stop/history/key controls, and ignores retired-account request/cache/toast callbacks. An owned-request wrapper combines cancellation and cleans up listeners without requiring native AbortSignal.any; the full checks and browser scenarios were repeated with it disabled. Unexpected operational failures remain errors; ordinary missing/blocked/decryption-unavailable configuration is explicit.

Webhook updates now honor explicit collections: null to clear the collection filter, matching the existing nullable API/database/SDK contract. Omission preserves the current filter; populated and empty lists retain their existing behavior. Existing session-admin authorization, destination validation, event/active settings, persistence, cache invalidation and audit recording remain in place. The docs show the clearing payload. No actual webhook configuration or delivery was changed during verification.

Both SDKs now expose the collection/document endpoints’ existing cursor pagination. Ordinary list methods forward opaque cursors and response types allow optional nullable next_cursor. Existing offset iterators retain their behavior; TypeScript explicitly suppresses unexpected cursor-bearing runtime inputs. SDK/API documentation explains continuation filters/order, nullable totals, and the created_at-only document cursor contract. No server pagination, authentication, tenant, retry, or ranking behavior changes.

Existing saved chat keys must be saved again to establish the destination binding. Unowned legacy upload tracking is discarded; same-account reloads retain new tracking. No schema, reindex, tenant provisioning, deployment, replay-authorization implementation, or removed test runner is included. AUDIT.md preserves the original 36 findings and adds the verified multipart-size and SDK cursor-contract findings, with evidence, remaining work, and recovery checkpoints. docs/audit/authorization-options.md presents proposed replay/tenant policies for coordination; those policies are not implemented. docs/audit/chat-context-options.md records the held finding 33 choice: preserve exactly two system/user messages, move context before the verbatim question in user, and append a fixed source-data instruction to default/custom system prompts. This intentionally changes prompt behavior and awaits explicit approval; no prompt implementation is included. Finding 35 remains deferred after an actual in-memory ORM counterexample showed fresh aggregate counts can disagree with stale cached item state. Docker-context work remains in PR #77, and Journal remains with its separate coordinator.

Validation through batch 9: the final full pnpm check passes, covering lint/format, workspace typechecks, app/SDK/docs builds, and API compile. Python SDK lint/format and wheel/source-distribution build pass. All ten batches received independent review and external mocked runtime checks. Batch 4 adds 25 checks plus 364 ranking cases; an independent oracle verified 43,688 ranking/label combinations, 520 unchanged unique rankings, handler output/ranks, explicit-null field presence, both real SDK serializers with mocked transports, and the public TypeScript null contract. Browser checks cover interrupted streams, stop/resend, password change, login, account switching with late mutations, expiry, rejected file responses, missing files, and canceled-file panels. Batch 5 adds an actual-router synthetic null-clearing failure before the fix, 48 independently checked state/payload combinations, 14 denied requests, and root reruns. Its full pnpm check passed with unchanged route/docs hashes at final review. Batch 6 adds actual-body failed-retry byte checks (11 root cases and 8 independent cases), 20 rendered file-filter states, 11 actual save cases, 10 usage cases with unchanged numeric/API behavior, synthetic usage SQL/provenance checks, and built-UI browser checks for subset/all reloads, keyboard selection, query windows and mobile containment. Batch 7 adds 36 actual SDK-encoding/handler/helper cases after 12 expected baseline failures, 27 independent handler cases plus five helper cases, root reruns, minimal module-AST equivalence and complete four-file review. Batch 8 adds 31 root service/ASGI checks, 56 independent backend/differential checks, 69 independent UI synthetic plus seven real TanStack lifecycle checks and 15 fresh owned-request checks with native AbortSignal.any disabled, root reruns, four checks per real SDK with mocked transports, and eight built-UI browser scenarios for readiness/instance generation/send, key pending/save/clear, blocked/error/manual retry, Stop and error refresh; mobile/desktop screenshots were visually checked. Batch 9 adds 39 baseline checks reproducing the null bug, 82 baseline/current ASGI checks, 16 independent model/route/dispatcher cases, eight mocked transport checks per real SDK, and 51 read-only message construction/forwarding checks. Its full pnpm check passed after four identical duplicate generated documentation type files were preserved outside the checkout; no source/typecheck configuration change was needed. Fresh complete four-file review reran all batch 9 fixtures and both actual ORM polling counterexample cases, found no blocker, and confirmed the complete webhook module changes only at that guard while supporting auth/SDK/replay/context/polling contracts remain HEAD-identical. Source/docs hashes match the full pnpm check. Pre-commit hooks and diff checks pass.

Batch 10 adds the exact recovered 13-file SDK/docs candidate, verified against all 781 repository blobs on the cloud computer. Cloud lint/format, all workspace typechecks, app/SDK/docs builds, Python SDK sdist/wheel build and API compilation pass. The initial full pnpm check reached the docs build before exit 137; the unchanged docs build passed with child CPU affinity limited to two CPUs, and API compilation passed separately. No source or build configuration was changed to accommodate the environment. Configured pre-commit hooks pass. Fresh cloud smoke checks pass 53 assertions against Python source and the built wheel, 57 against the compiled TypeScript SDK, and a public TypeScript cursor type probe. Independent review passes 101 current/76 baseline Python assertions and 302 assertions against compiled current/baseline TypeScript SDKs, covering encoding, optional response tokens, immutable inputs, offset iteration, auth headers, typed errors, retries and timeouts. It independently confirms the exact changed/unchanged blob inventory and finds no blocker. Transport checks are mocked and establish no live database/API progression or concurrency guarantee. All six GitHub CI jobs pass on batch-10 commit 3c5c02de8709b363708ac38ef3e49d39dae68db4, including the full root pnpm check and website build.

Independent review found binding/cleanup and browser auth races that were fixed and re-reviewed. Replay authorization and tenant isolation remain open. No live credential/provider/vector/database or exploitation calls were used. Browser cancellation cannot undo accepted server work; cross-tab cookie races and concurrent server upload serialization/capacity reservation remain outside this change. Findings 12, 26 and 34 remain partial: concurrent admission, server file-policy differences, and provider-measured historical usage are not resolved.