[ynadge]

Primary change type

• Bug fix

Problem and motivation

An unfinished Continue child was hidden from Assistant history but still appeared in /api/state and /api/sessions, where the UI could offer Terminal activation before native preparation completed.

Summary and scope

Apply the durable receipt visibility check to general session projections and direct session routes, including Start Terminal. Hydrate hidden allocations before accepting requests and omit their runtime/lifecycle and session-status events. Keep internal registry rows available for exact operation recovery.

Related work

Related issue: https://linear.app/sapiom/issue/SAP-3292

Depends on #1032. Native stack target: main.

Validation

pnpm --filter @sapiom/harness exec vitest run src/server/assistant-lifecycle-wiring.test.ts src/core/assistant-state-projection.test.ts src/server/rest.test.ts src/server/assistant-records.test.ts — 135 tests passed.

Server TypeScript, scoped ESLint, formatting and diff checks passed. Before the fix, both new visibility regressions failed. The assembled server now verifies hidden state/list/direct-action behavior before and after reboot, while prepared children remain discoverable.

Tests and documentation

Extends the actual server composition fixture and adds private runtime/lifecycle projection coverage. Updated assistant-history.md. Increment: 163 changed lines including tests/docs/changeset; SDK pr:size is absent.

Compatibility and release impact

• Unfinished children now return the existing session-not-found response to direct public actions. Prepared children and ordinary sessions retain their existing routes.
• Changeset: @sapiom/harness patch.
• Fix-forward: correct visibility or admission in a focused follow-up while retaining durable private allocation recovery.

Security

• No secrets, credentials, private data, or unsanitized logs included.
• No suspected vulnerability disclosed publicly.

AI assistance

• AI assistance used: Codex implemented and reviewed the change with the validation described above.

Checklist

• CONTRIBUTING.md read; maintainer-authorized issue work.
• One focused increment, checks, documentation and release impact addressed.
• I can explain and maintain the submitted changes.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: f716023b-b524-4b1d-8b30-a3cfa786d047

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

🔍 WebSocket visibility remains implicit

/ws/terminal trusts internal session rows without checking continuation visibility. Pending children currently lack PTYs, but future runtime changes can bypass the shared boundary.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟥 Pending children bypass action admission

A caller knowing a pending child ID can invoke macro and canvas actions. Those routers bypass isSessionVisible and trust the private registry row.

---

Was this helpful? React with 👍 or 👎 to provide feedback.