feat(ai-chat): agent workspace phases 1 to 3, assistant mode, approval floor, session isolation

.github/macos-ui-test-quarantine.txt

@@ -43,3 +43,36 @@ InspectorToolbarPlacementUITests/testTheInspectorToggleHoldsTheTrailingEdgeThrou
 #     `.any` removes the walk. That needs one CI run to confirm the types, which is why it is not
 #     in this release.
 WindowExecutionIndicatorUITests/testTheExecutingIndicatorAppearsWhileAQueryRunsAndClearsAfterIt()
+
+# --- Opens a modal licence alert instead of the window, and then holds the runner in it.
+#     Every case goes through `launchAndOpenCompareSync()`, which clicks
+#     Database > Compare > "Compare & Sync Databases…" and waits for a window titled
+#     "Compare & Sync". `CompareSyncLauncher.open` gates on
+#     `LicenseManager.isFeatureAvailable(.compareSync)` and, with no licence, calls
+#     `NSAlert.runModal()` instead. `UITestCase.launchApp()` hands the app a throwaway
+#     container, so there is never a licence: the window the tests wait for is never opened and
+#     all five time out.
+#
+#     The suite guards for this with `guard item.isEnabled else { throw XCTSkip(...) }`, and the
+#     guard cannot fire: the gate is in the launcher, not in menu validation, so the item is
+#     enabled whatever the licence says.
+#
+#     The modal is why this is quarantined rather than left to fail. `runModal()` holds the main
+#     thread, so the alert is still up when the runner moves on, and the cases after it in the
+#     same shard fail on unrelated assertions: "The sample database never finished opening" and
+#     "Not hittable" have both been seen this way. One licence gate takes several unrelated tests
+#     with it.
+#
+#     These have never been green. They arrived with the window in 3848a21a1 and fail identically
+#     on upstream main (run 32631046978), on this branch's CI, and locally.
+#
+#     Getting it back: give the sandbox a licence for the feature, the way the tests that need one
+#     will have to. Making the menu item validate against the licence would also fire the existing
+#     XCTSkip, but a paid feature's menu item is meant to stay enabled and explain itself, so that
+#     would be trading a visible skip for worse discoverability. Either way the launcher should not
+#     reach for a modal on a path a test can drive.
+CompareSyncUITests/testCompareSyncOpensFromFileMenu()
+CompareSyncUITests/testBannerStatesNothingHasBeenWrittenBeforeAnyRun()
+CompareSyncUITests/testCompareIsDisabledUntilBothEndpointsAreChosen()
+CompareSyncUITests/testTargetPickerStartsWithNoConnectionChosen()
+CompareSyncUITests/testSwapIsDisabledWhenNoEndpointIsChosen()

AGENTS.md

@@ -0,0 +1,13 @@
+# AGENTS.md
+
+## Cursor Cloud specific instructions
+
+TablePro is a native macOS/iOS application (SwiftUI + AppKit) built with Xcode and XcodeGen. It **cannot be built, tested, or run on the Linux Cloud Agent VM**:
+
+- Building requires macOS 14+, Xcode 26+, and `xcodebuild`, none of which exist on (or can be installed on) Linux. See "How to Build" in `README.md` and the build/test/lint commands in `CLAUDE.md`.
+- The app and its SwiftPM packages (`Packages/TableProCore`, `Packages/TableProOracle`) import Apple-only frameworks (AppKit, SwiftUI, CloudKit) and declare only `.macOS`/`.iOS` platforms, so `swift build` / `swift test` do not work on Linux either.
+- `Libs/` and `Libs/ios/` are prebuilt macOS/iOS binaries fetched by `scripts/download-libs.sh`; they are not usable without Xcode.
+
+Because there is no Linux dependency-install/update step for this codebase, no Cloud Agent update script is configured. Do lint/build/test/run work on a macOS host with Xcode, following `README.md` and `CLAUDE.md`.
+
+Note: an experimental native Linux client (Rust) exists only on the `linux` branch under `linux/` and is a prototype ("nothing to install yet" per `README.md`). It is separate from this branch's macOS/iOS codebase.

CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Assistant mode for the connection window, with the conversation at full width.
+- Confirm Writes floor while Assistant mode is active.
+- Several AI sessions at once, each with its own approvals, transcript and status.
+- Session rail listing every session with its connection, including sessions whose window is closed.
+- Result pane in Assistant mode with proposed SQL, steps taken, query results and schema changes.
+- `explain_query` chat tool, so the assistant can ask for a query plan without running the statement.
+- Start an AI session from the welcome window, with running and stopped sessions listed there.
+- Outside MCP servers as tool sources for AI sessions, allowlisted per connection.
+
+### Fixed
+
+- Tool approvals resolved by a decision made in another chat session.
+- AI tool calls evaluated against the chat's own connection instead of the one the statement targets.
+- AI tool calls reaching a connection the chat session is not attached to.
+- Writes running unchecked when a message was sent before the chat panel had laid out.
+- Stop Generating cancelling tool approvals awaiting a decision in other chat sessions.
+- "Always for this connection" overriding a Safe Mode floor the user did not set.
+- The managed `minimumSafeModeLevel` floor not reaching AI-proposed writes.
+- A connection's AI policy and Safe Mode level not reaching an open chat panel until relaunch.
+- "Always for this connection" writing a stale connection record back over newer changes.
+- A new chat session adopting the most recent conversation from another connection.
+- Two chat sessions overwriting each other's saved transcript.
+- Clearing one chat session's conversation deleting every conversation in the app.
+- One chat session's New Conversation resetting the server-side conversation of another.
+- The chat tool mode being shared by every session instead of belonging to one.
+- A registered chat tool being able to take the name of a built-in one.
+- Closing a window, disconnecting, or losing a session erasing that connection's chat transcript.
+- Explain with AI and Fix Error doing nothing until the chat panel had been opened once.
+- The last turn of a chat lost when the app quit mid-reply.
+- Approving any tool call but the first in a turn doing nothing, leaving the reply parked.
+- Every proposed tool call taking `Return`, so the key acted on whichever button AppKit reached first.
+- VoiceOver reading the Browse and Assistant control as its SF Symbol names.
+
+### Security
+
+- Outside MCP tools always require approval and are audited per call, with the payload's size and hash but not its contents.
+
 ## [0.68.1] - 2026-08-26
 
 ### Changed

TablePro/AppDelegate.swift

@@ -95,6 +95,10 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         PluginNotificationService.shared.setUp()
         OperationCompletionReporter.shared.setUp()
         ChatToolBootstrap.register()
+        /// Sessions are listed again before any window asks for one, so a session whose window was
+        /// closed last run is in the rail from the start rather than appearing once its connection
+        /// happens to be opened.
+        Task { await AgentSessionRegistry.shared.restore() }
 
         NSWorkspace.shared.notificationCenter.addObserver(
             self, selector: #selector(handleSystemDidWake),
@@ -192,6 +196,10 @@ class AppDelegate: NSObject, NSApplicationDelegate {
 
     func applicationWillTerminate(_ notification: Notification) {
         persistOpenConnectionsForRecovery()
+        /// Nothing used to persist AI state at quit, so a session killed mid-stream came back with
+        /// its last turn missing and no record that it had been working. Written synchronously: an
+        /// actor hop here may never be scheduled before the process exits.
+        AgentSessionRegistry.shared.persistAtTerminate()
         LinkedFolderWatcher.shared.stop()
         SQLFolderWatcher.shared.stop()
         SSHTunnelManager.shared.terminateAllProcessesSync()

TablePro/Core/AI/AIProviderFactory.swift

@@ -47,24 +47,36 @@ enum AIProviderFactory {
         cacheLock.withLock { $0.removeValue(forKey: configID) }
     }
 
-    static func resetCopilotConversation() {
+    /// Resets the Copilot conversation held by one provider configuration.
+    ///
+    /// The unscoped form walked the whole cache, so one session starting a new conversation threw
+    /// away the server-side conversation id of every other session on every other provider.
+    static func resetCopilotConversation(configId: UUID) {
         cacheLock.withLock { cache in
-            for (_, entry) in cache {
-                if let copilot = entry.provider as? CopilotChatProvider {
-                    copilot.resetConversation()
-                }
-            }
+            guard let copilot = cache[configId]?.provider as? CopilotChatProvider else { return }
+            copilot.resetConversation()
         }
     }
 
-    static func copilotDeleteLastTurn() {
+    static func copilotDeleteLastTurn(configId: UUID) {
         cacheLock.withLock { cache in
-            for (_, entry) in cache {
-                if let copilot = entry.provider as? CopilotChatProvider {
-                    copilot.deleteLastTurn()
-                }
-            }
+            guard let copilot = cache[configId]?.provider as? CopilotChatProvider else { return }
+            copilot.deleteLastTurn()
+        }
+    }
+
+    /// Which configuration a session streams on. An override that names no live provider falls back
+    /// to the active one, so anything keyed by "the configuration this session uses" has to ask here
+    /// rather than recompute the choice, or the two answers diverge the moment a provider is deleted.
+    static func resolveConfig(
+        settings: AISettings,
+        overrideProviderId: UUID? = nil
+    ) -> AIProviderConfig? {
+        if let overrideProviderId,
+           let match = settings.providers.first(where: { $0.id == overrideProviderId }) {
+            return match
         }
+        return settings.activeProvider
     }
 
     static func resolve(
@@ -73,14 +85,9 @@ enum AIProviderFactory {
         overrideModel: String? = nil
     ) -> ResolvedProvider? {
         guard settings.enabled else { return nil }
-        let config: AIProviderConfig?
-        if let overrideProviderId,
-           let match = settings.providers.first(where: { $0.id == overrideProviderId }) {
-            config = match
-        } else {
-            config = settings.activeProvider
+        guard let config = resolveConfig(settings: settings, overrideProviderId: overrideProviderId) else {
+            return nil
         }
-        guard let config else { return nil }
         let apiKey: String?
         switch config.type.authStyle {
         case .apiKey, .optionalApiKey:

TablePro/Core/AI/Chat/AssistantSafeModeFloor.swift

@@ -0,0 +1,94 @@
+//
+//  AssistantSafeModeFloor.swift
+//  TablePro
+//
+
+import Foundation
+
+/// Assistant mode promises that a write the assistant proposes waits for a human. On a connection
+/// left at `.silent`, which is the default in both the initializer and the decoder, that promise
+/// was false: `requiresConfirmation` is `false` there, so the approval path returned `.approved`
+/// for a `.write` tool with no user interaction at all.
+///
+/// The floor is applied where the level is read, not by mutating the stored connection. Nothing is
+/// written to `ConnectionStorage`, so nothing syncs, nothing has to be restored after a crash, and
+/// the user's own level is still their own level the moment they leave the mode.
+internal enum AssistantSafeModeFloor {
+    /// Confirm Writes. High enough that every proposed write stops for a human, low enough that it
+    /// adds no authentication step the user did not ask for.
+    internal static let floor: SafeModeLevel = .alert
+
+    /// Pure, so the rule is testable without a window, a connection record or UserDefaults.
+    ///
+    /// Both floors are composed here, in one place. An administrator's
+    /// `com.TablePro.policy.minimumSafeModeLevel` is a floor with exactly the same shape, and every
+    /// other execution path already applies it through `ExecutionGateProvider`. The chat tools hand
+    /// the gate `.confirmationPreCleared`, so the gate's confirmation arm is skipped for them and
+    /// this is the only place a managed Alert floor can still be enforced on an AI-proposed write.
+    /// Reading the raw level here left a managed "confirm every write" as a no-op for the assistant.
+    internal static func effectiveLevel(
+        stored: SafeModeLevel,
+        assistantModeActive: Bool,
+        policy: any ManagedPolicyReading = ManagedPolicyReader.shared
+    ) -> SafeModeLevel {
+        let managed = ManagedPolicyResolver.effectiveSafeModeLevel(
+            connectionLevel: stored,
+            policy: policy
+        )
+        guard assistantModeActive else { return managed }
+        return managed.raised(toFloor: floor)
+    }
+
+    /// Whether a floor, rather than the user's own choice, is what is asking for the confirmation.
+    /// The approval path needs this separately from the level itself: a grant the user made for
+    /// their own level must not silently switch off a floor they did not set.
+    internal static func floorRaisedLevel(
+        stored: SafeModeLevel,
+        assistantModeActive: Bool,
+        policy: any ManagedPolicyReading = ManagedPolicyReader.shared
+    ) -> Bool {
+        effectiveLevel(stored: stored, assistantModeActive: assistantModeActive, policy: policy) != stored
+    }
+
+    /// `WorkspaceContentModeStore` is the single record of which surface a connection is on, and it
+    /// is written on every mode change, so it answers this without a second registry to keep in
+    /// step. A connection no window is hosting still reads whatever it was last left in, which errs
+    /// toward the floor being on: there is no session to gate in that case, and a floor that is on
+    /// when it need not be costs a confirmation, while one that is off when it should be on costs
+    /// the user their data.
+    @MainActor
+    internal static func isActive(
+        for connectionId: UUID,
+        store: WorkspaceContentModeStore = .shared
+    ) -> Bool {
+        store.mode(connectionId: connectionId) == .assistant
+    }
+
+    @MainActor
+    internal static func effectiveLevel(
+        live: SafeModeLevel,
+        connectionId: UUID,
+        store: WorkspaceContentModeStore = .shared,
+        policy: any ManagedPolicyReading = ManagedPolicyReader.shared
+    ) -> SafeModeLevel {
+        effectiveLevel(
+            stored: live,
+            assistantModeActive: isActive(for: connectionId, store: store),
+            policy: policy
+        )
+    }
+
+    @MainActor
+    internal static func floorRaisedLevel(
+        live: SafeModeLevel,
+        connectionId: UUID,
+        store: WorkspaceContentModeStore = .shared,
+        policy: any ManagedPolicyReading = ManagedPolicyReader.shared
+    ) -> Bool {
+        floorRaisedLevel(
+            stored: live,
+            assistantModeActive: isActive(for: connectionId, store: store),
+            policy: policy
+        )
+    }
+}

TablePro/Core/AI/Chat/ChatToolArgumentDecoder.swift

@@ -59,11 +59,26 @@ enum ChatToolArgumentDecoder {
 
 enum ChatToolArgumentError: Error, LocalizedError {
     case missingOrInvalid(key: String, expected: String)
+    /// The model named a connection this session does not own, or named one when the session owns
+    /// none. Both are refused rather than resolved, because a session's connection is what every
+    /// approval and Safe Mode check downstream is evaluated against.
+    case connectionOutsideSession(requested: UUID, session: UUID?)
 
     var errorDescription: String? {
         switch self {
         case .missingOrInvalid(let key, let expected):
             return "Argument '\(key)' is missing or not a \(expected)"
+        case .connectionOutsideSession(let requested, let session):
+            guard let session else {
+                return """
+                Connection '\(requested)' cannot be used: this chat session is not attached to a \
+                connection. Open the connection and start a session there.
+                """
+            }
+            return """
+            Connection '\(requested)' is not this session's connection. Use '\(session)', or start \
+            a separate session on the other connection.
+            """
         }
     }
 }

TablePro/Core/AI/Chat/ChatToolBootstrap.swift

@@ -15,14 +15,15 @@ enum ChatToolBootstrap {
 
     static func register() {
         let registry = ChatToolRegistry.shared
-        registry.register(ListConnectionsChatTool())
-        registry.register(GetConnectionStatusChatTool())
-        registry.register(ListDatabasesChatTool())
-        registry.register(ListSchemasChatTool())
-        registry.register(ListTablesChatTool())
-        registry.register(DescribeTableChatTool())
-        registry.register(GetTableDDLChatTool())
-        registry.register(ExecuteQueryChatTool())
-        registry.register(ConfirmDestructiveOperationChatTool())
+        registry.registerBuiltIn(ListConnectionsChatTool())
+        registry.registerBuiltIn(GetConnectionStatusChatTool())
+        registry.registerBuiltIn(ListDatabasesChatTool())
+        registry.registerBuiltIn(ListSchemasChatTool())
+        registry.registerBuiltIn(ListTablesChatTool())
+        registry.registerBuiltIn(DescribeTableChatTool())
+        registry.registerBuiltIn(GetTableDDLChatTool())
+        registry.registerBuiltIn(ExecuteQueryChatTool())
+        registry.registerBuiltIn(ExplainQueryChatTool())
+        registry.registerBuiltIn(ConfirmDestructiveOperationChatTool())
     }
 }

TablePro/Core/AI/Chat/ChatToolContext+Helpers.swift

@@ -6,9 +6,25 @@
 import Foundation
 
 extension ChatToolContext {
+    /// The connection a tool call acts on, pinned to the session's own.
+    ///
+    /// `connection_id` is a model-fillable input on eight of the nine chat tools, and this used to
+    /// prefer the model's value over the session's. `list_connections` is read-only, so it is
+    /// auto-approved and can enumerate every connection's id first: a session could be told to read
+    /// or write a connection the user never opened, at that connection's Safe Mode level rather
+    /// than at the one on screen.
+    ///
+    /// A session with no connection refuses rather than falling back to the model's value. No
+    /// connection means no query, not an unchecked query on whichever one was named.
     func resolveConnectionId(_ input: JsonValue) throws -> UUID {
-        if let connectionId = try? ChatToolArgumentDecoder.requireUUID(input, key: "connection_id") {
-            return connectionId
+        if let requested = try? ChatToolArgumentDecoder.requireUUID(input, key: "connection_id") {
+            guard requested == connectionId else {
+                throw ChatToolArgumentError.connectionOutsideSession(
+                    requested: requested,
+                    session: connectionId
+                )
+            }
+            return requested
         }
         if let active = connectionId {
             return active

TablePro/Core/AI/Chat/ChatToolContext.swift

@@ -14,4 +14,22 @@ struct ChatToolContext: Sendable {
     let connectionId: UUID?
     let bridge: MCPConnectionBridge
     let authPolicy: MCPAuthPolicy
+
+    /// Which session is making the call. Only the outside-MCP path reads it, and it reads it because
+    /// an audit entry for a call that left the machine has to name the session that made it: the
+    /// registry entry for a remote tool is shared by every session whose connection allows that
+    /// server, so the tool itself cannot know.
+    let sessionId: UUID?
+
+    init(
+        connectionId: UUID?,
+        bridge: MCPConnectionBridge,
+        authPolicy: MCPAuthPolicy,
+        sessionId: UUID? = nil
+    ) {
+        self.connectionId = connectionId
+        self.bridge = bridge
+        self.authPolicy = authPolicy
+        self.sessionId = sessionId
+    }
 }