feat(wave1): stop the bleeding — data integrity, security, destructive guards

[vikranthreddimasu]

Context

This is Wave 1 of 5 from the UX/UI/Tech rebuild plan. Full plan and audit context:

• PLAN.md — 5-wave rebuild roadmap
• ux-audit.md — 78 UX findings across 12 flows
• tech-audit.md — 39 tech findings

The audits found 117 issues. Wave 1 closes the 13 that can silently corrupt data, leak files, compromise security, or ship a blank-screen production build. Nothing cosmetic in this PR — every change is load-bearing.

What changes

Data integrity

• Message ids replace positional indices. updateMessageAt(index, …) was a silent-corruption bug: mid-stream notebook switch + array mutation could write the assistant delta into the wrong slot. Messages now carry a stable UUID assigned at add time; store exposes updateMessage(id, patch), removeMessage(id), setMessages(msgs).
• Abort is a real abort now. User clicks stop → stream tears down, partial message is either marked aborted or removed if empty, and we do NOT fall through to the non-streaming endpoint (which used to deliver the full reply anyway). AbortError detection uses controller.signal.aborted + an explicit userAborted flag.
• Stream is canceled on notebook switch. A useEffect cleanup in useChat aborts the controller when activeNotebookId changes. Previously a mid-stream notebook switch would keep streaming into the old conversation while the UI showed a new notebook.
• clearMessages is decomposed. The single action was called for 4 different intents — new chat, clear chat, notebook switch, conversation load — each with identical but mostly wrong side effects (e.g., always wiping activeSources). Replaced with newChat(), resetMessagesOnly(), setMessages(). Callers now say what they mean.
• Conversation load fetches before clearing. A network error no longer nukes the current context. Messages swap in one setMessages() call (no N re-renders that looked like streaming). Historical sources are restored from the last message that actually had them, with document_name populated the same way the stream path does.
• Ingestion source_count accumulates. complete_ingestion used SET source_count = ? with per-job count → a 6th upload set the counter to 1. Now source_count = source_count + ?. Regression test added.

Security

• CORS locked down. allow_origin_regex=\".*\" + allow_credentials=True was a localhost-CSRF footgun (any browser tab on the machine could hit /api/* with credentials and exfiltrate notebooks). Only the explicit dev origins + Electron's null origin now, credentials off.
• Document preview path-traversal hardened. The old path-resolution had 4 fallback strategies; strategy 4 iterated every notebook subdirectory and served the first filename match, so notebook A could serve files from notebook B. Now resolution is scoped to uploads/{notebook_id}/, with Path.relative_to() as the final guard. Response also sets Content-Disposition: attachment.
• app:openExternal validates scheme. Only https?:// and mailto: pass; a renderer-side XSS through markdown can't pivot to file:// or javascript: handlers.

Reliability / cleanup

• Cascade delete notebook. DELETE /notebooks/:id previously removed the SQLite row but left the Chroma chunk + summary collections and the uploads directory behind — storage grew without bound. Now drops all three. New VectorStoreManager.delete_notebook_collections() helper.
• Vite base: './' . Without it, packaged Electron loads absolute /assets/... paths from file:// and renders a blank white screen. Bug that only manifested in production.
• ConfirmDialog for notebook and conversation deletes. One misclick on an overflow menu used to delete an entire notebook (all documents, embeddings, conversations) with zero guard. Now Escape-to-cancel, focus on Cancel by default, Enter only fires on confirm button.
• CommandPalette Rules of Hooks. useState(selectedIndex) was below an early return. Worked today; would break under React compiler or StrictMode.

Verification

• `npm run build` clean (tsc + vite, 269 modules, 850ms)
• `uv run ruff check .` clean
• `uv run pytest -q` 30 passed, 1 skipped (includes new `test_complete_ingestion_accumulates_counts_across_jobs`)

What's intentionally NOT in this PR

• Citation trust layer resurrection (Wave 2)
• Rename notebook, delete document, real upload progress (Wave 3)
• Backend crash recovery, API timeouts, OOM guards, WAL mode (Wave 4)
• Design-polish + a11y items (Wave 5)

Each wave is its own PR on green CI. This one is the foundation.

🤖 Generated with Claude Code