Changeset 0.37.14 (#226)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,188 @@
 # Changelog
 
+## [0.37.14.23] — 2026-03-23
+
+### Summary
+
+Extension surface user menu fix + roadmap workflow integration. The ICD Runner
+(and all extension surfaces) now mount the Preact UserMenu via `sw.userMenu()`
+instead of relying on the dead Go template hydration.
+
+### Fixed
+
+- **Extension surface "? User" label:** extension template included static
+  `{{template "user-menu"}}` which rendered placeholder HTML ("? User") since
+  the legacy hydration script was removed in v0.37.13. Removed the dead
+  template inclusion. (`server/pages/templates/surfaces/extension.html`)
+- **Extension surface user menu click does nothing:** ICD Runner never called
+  `sw.userMenu()` to mount the Preact UserMenu component. Added topbar with
+  `sw.userMenu(topbar, { flyout: 'down' })` in `renderShell`. Also uses
+  `sw.auth.user` instead of dead `window.__USER__` for header display.
+  (`packages/icd-test-runner/js/ui.js`, `packages/icd-test-runner/js/main.js`)
+
+### Changed
+
+- **Roadmap:** added v0.37.15 reference to `DESIGN-0.37.15.md` workflow design
+  doc, added v0.38.x Workflow Product Maturity section referencing
+  `ROADMAP-0.38.md`. Trimmed completed version descriptions.
+
+---
+
+## [0.37.14.22] — 2026-03-23
+
+### Summary
+
+Thinking tags persistence + deleteMessage endpoint. Two features that close
+out the v0.37.14 pane audit. Also fixes an S9 latent bug (messages paginated
+response not unwrapped) and a SQLite NULL scan crash in GetByID.
+
+### Added
+
+- **deleteMessage server endpoint** — `DELETE /channels/:id/messages/:msgId`
+  with soft-delete, channel access check, and `message.deleted` WS broadcast
+  to other participants. (`server/handlers/messages.go`, `server/main.go`)
+- **`message.deleted` event type** — registered as `DirToClient` for
+  cross-tab message removal. (`server/events/types.go`)
+- **`deleteMessage` SDK method** — `rc.del(...)` in channels namespace.
+  (`src/js/sw/sdk/api-domains.js`)
+- **`message.deleted` WS handler** — filters by active channel, removes
+  message from state. (`src/js/sw/components/chat-pane/use-chat.js`)
+- **`onDelete` wired in ChatPane** — delete button now visible on all
+  messages. (`src/js/sw/components/chat-pane/index.js`)
+- **`extractThinking` / `hydrateThinking` helpers** — parse `<think>` blocks
+  from message content on the load path (switchChannel, loadMore, WS
+  message.created). (`src/js/sw/components/chat-pane/use-chat.js`)
+
+### Fixed
+
+- **Thinking tags lost on refresh:** `<think>` content rendered correctly
+  during streaming (via SSE `reasoning_content`) but spilled as raw text
+  after page reload. Now extracted on the load path and rendered in the
+  collapsible `<details>` block. Frontend-only fix, no DB migration.
+- **S9 messages unwrap bug:** messages endpoint returns paginated response
+  with 5 sibling keys, so `_unwrap` preserves the full object. `resp || []`
+  produced an object, not an array. Changed to `resp.data || resp || []`.
+- **SQLite NULL scan crash:** `GetByID` fails on user messages where `model`
+  and `tokens_used` are NULL (struct uses `string`/`int`, not pointers).
+  Delete handler now uses a direct `EXISTS` query instead.
+
+---
+
+## [0.37.14.21] — 2026-03-23
+
+### Summary
+
+Double-unwrap cleanup + API envelope normalization. Eliminated 93 defensive
+`resp.data || resp || []` patterns across the frontend by fixing `_unwrap` to
+preserve sibling fields and normalizing all Go handlers to use `{data: [...]}`
+standard envelopes. Three latent bugs fixed (roles, provider types, audit).
+
+### Changed
+
+- `src/js/sw/sdk/rest-client.js` — `_unwrap` now only strips `{data: [...]}` when
+  `data` is the sole key (`Object.keys(json).length === 1`). Responses with siblings
+  (e.g. `{data: [...], total: N}`) pass through intact.
+- **15 Go handlers** normalized from named keys (`users`, `configs`, `models`,
+  `channels`, `participants`, `tools`, `folders`, `messages`, `values`, `packages`)
+  to standard `{data: [...]}` envelope:
+  - `server/handlers/admin.go` — ListUsers, ListGlobalConfigs, ListModelConfigs,
+    ListArchivedChannels
+  - `server/handlers/apiconfigs.go` — ListConfigs, ListModels
+  - `server/handlers/channel_models.go` — List, Add, Update, Delete
+  - `server/handlers/participants.go` — List, Add, Update, Remove
+  - `server/handlers/presence.go` — SearchUsers
+  - `server/handlers/completion.go` — ListTools
+  - `server/handlers/folders.go` — List
+  - `server/handlers/notes.go` — ListFolders
+  - `server/handlers/messages.go` — GetActivePath, SetCursor
+  - `server/handlers/teams.go` — ListAvailableModels
+  - `server/handlers/team_providers.go` — ListTeamProviderModels
+  - `server/handlers/packages.go` — UpdatePackageSettings
+  - `server/handlers/package_registry.go` — BrowseRegistry
+  - `server/handlers/roles.go` — ListRoles (bare map → wrapped in `{data: map}`)
+- **~45 frontend files** — simplified all double-unwrap patterns:
+  - Sole-key endpoints (unwrapped): `resp || []`
+  - Sibling endpoints (not unwrapped): `resp.data || []`, `resp.total || 0`
+  - Roles map: `r.data || {}` + `Object.entries()` for iteration
+- Go integration + live provider tests updated for new envelope keys
+- Frontend contract + policy-gating tests updated
+
+### Fixed
+
+- **Admin → Roles always empty:** `ListRoles` returned a raw map; `r.roles`
+  was undefined on it. Now wrapped in `{data: map}`, frontend iterates via
+  `Object.entries(roles)`.
+- **Admin → Provider Types dropdown always empty:** `GetProviderTypes` returned
+  `{data: types}`, `_unwrap` stripped it to bare array, `t.types` was undefined.
+  Now correctly uses `t || []`.
+- **Admin → Audit entries always empty:** `_unwrap` stripped `{data, total}` to
+  just the array, losing `total`. Now preserved because of sibling-aware `_unwrap`.
+
+### Design Notes
+
+- **Envelope contract:** All list endpoints now return `{data: [...]}` or
+  `{data: [...], ...metadata}`. No more `{users: [...]}`, `{models: [...]}`, etc.
+- **`_unwrap` contract:** sole-key `{data: [...]}` → bare array;
+  sibling keys present → full object (frontend accesses `.data` and siblings).
+- **Editor package skipped:** `packages/editor/js/main.js` uses `API._get` which
+  bypasses `_unwrap`; defensive patterns intentionally preserved.
+
+---
+
+## [0.37.14] — 2026-03-22
+
+### Summary
+
+Scorched Earth IV + Pane Audit — fourth dead-code purge. 4 files deleted (~−1,672 lines).
+The old global layer (`sb.js`, `events.js`, `switchboard-sdk.js`, `workflow-surfaces.js`)
+is fully removed. Two survivors (`debug.js`, `repl.js`) cleaned of all old-layer dependencies
+and now stand alone with direct `window.*` exports.
+
+### Removed
+
+- `src/js/sb.js` (133 LOC) — global action registry (`window.sb`); onclick handlers
+  in base.html rewritten to direct function calls
+- `src/js/events.js` (361 LOC) — event bus + WebSocket bridge (`window.Events`);
+  WebSocket auth called deleted `API` global; new SDK (`sw/sdk/events.js`) is the
+  sole event system
+- `src/js/switchboard-sdk.js` (~697 LOC) — composition layer (`window.Switchboard`);
+  `window.sw` was immediately overwritten by Preact SDK `boot()`; most methods
+  referenced deleted globals (`API`, `UI`)
+- `src/js/workflow-surfaces.js` (481 LOC) — workflow stage surface registry; loaded
+  deleted `ui-primitives.js` as dependency (already broken at runtime since v0.37.13)
+- `base.html`: removed 3 script tags, removed `Switchboard.init()` block
+  (including dead `handleLogout` referencing deleted `Events`/`API`)
+
+### Changed
+
+- `src/js/debug.js` — replaced `sb.ns()`/`sb.register()` with direct `window.*`
+  exports; replaced dead `API`/`App`/`Events`/`Extensions` state snapshot with
+  Preact SDK `window.sw` introspection; diagnostics use `sw.auth.token` and
+  `sw.events.connected`; fixed `copyDebugLog` referencing deleted `UI.toast`
+- `src/js/repl.js` — replaced `sb.ns()` with `window.REPL`; admin gate uses
+  `window.sw.auth.user.role` instead of deleted `API.user.role`; injected globals
+  reduced to `sw` + `DebugLog`; removed dead event label tab-completion
+- `server/pages/templates/base.html` — 11 `sb.call()` onclick handlers rewritten
+  to direct function calls
+- `server/pages/templates/workflow.html` — broken custom surface loader replaced
+  with graceful error message
+- `src/sw.js` — removed 3 entries from SHELL_FILES (sb.js, events.js,
+  switchboard-sdk.js)
+- `packages/icd-test-runner/js/tier-sdk.js` — boot tests updated from
+  `Switchboard.init()` to Preact SDK `boot()`; identity tests use `sw.auth.user`;
+  theme test uses `sw.emit()`; removed extension compat shim test
+- `src/js/sw/sdk/index.js` — SDK version marker updated to 0.37.14
+
+### Design Notes
+
+- **2 old JS files survive:** `debug.js` (debug modal + diagnostics) and `repl.js`
+  (admin REPL console). Both are standalone with zero old-layer dependencies.
+  Scheduled for Preact rewrite at v0.37.17.
+- **Cumulative scorched earth:** 53 files deleted, ~−19,382 lines across four
+  passes (v0.37.10, v0.37.12, v0.37.13, v0.37.14).
+
+---
+
 ## [0.37.13] — 2026-03-22
 
 ### Summary