feat(console): add safe session controls

[MachineLearning-Nerd]

What

Adds collapsible session navigation and safe session deletion to the Clearance Console.

Root cause

The session list consumes recording space, while the pinned UI only exposes deletion when its adapter implements deleteSession. Published evidence sessions must remain available for live receipt verification.

Fix

• compose the pinned TrueForge UI adapter with SDK-backed session deletion
• hide deletion for the five published evidence sessions and retain a rejecting console-adapter guard
• mirror theme variables to portaled menus so the delete action remains readable
• add accessible hide/show controls with persistent ARIA targets and focus transfer
• keep one frozen evidence-ID list and verify it against all five published bundles
• refresh the public test total and replace stale hard-coded PR counts with durable wording

The safeguard is deliberately console-scoped; direct administrative TrueForge API access is documented as outside it. The merged empty-toast fix remains intact. No agent prompt, manifest, contract, approval, verifier, or evidence bundle is changed.

Verification

• npm test: 26 test files passed, 365 tests passed
• npm run build in console/: TypeScript and Vite build passed
• targeted Biome check and git diff --check: passed
• browser deletion check: a disposable session returned HTTP 404; a published evidence session remained HTTP 200 and exposed no delete action
• browser accessibility check: the controlled target exists while hidden; focus moves to Show sessions on collapse and back to Hide sessions on reopen
• browser regression check: the empty toast stack retained zero border, zero padding, and zero height
• secret and forbidden-claim scans: no findings
• internal quality gate: READY FOR QODO
• rules compliance: GREEN

[MachineLearning-Nerd]

/review

[qodo-code-review]

PR Summary by Qodo

Add protected session deletion and collapsible console navigation

✨ Enhancement 🧪 Tests 🐞 Bug fix 🕐 20-40 Minutes

AI Description

• Add SDK-backed deletion for ordinary console sessions.
• Protect published evidence sessions in both UI and server adapter.
• Add accessible session controls, portal styling, and deterministic deletion tests.

Diagram

graph TD
  U["Console user"] --> R["Thread row"] --> P{"Deletion allowed?"} -->|Yes| D["Deletion adapter"] --> T["TrueForge client"]
  P -->|No| E["Evidence protected"]
  U --> L["Console layout"] --> S["Session sidebar"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Backend-managed protection metadata

• ➕ Centralizes deletion policy for every client
• ➕ Avoids hard-coded evidence IDs in the console
• ➕ Supports dynamically published evidence sessions
• ➖ Requires backend and API contract changes
• ➖ Expands scope beyond console session controls
• ➖ Needs UI support for new session metadata

Recommendation: The shared client-side policy plus rejecting adapter guard is the best scoped approach for a fixed published evidence set: it hides unsafe actions and prevents bypass within the console without changing contracts. Move protection to backend-managed metadata if the evidence set becomes dynamic or additional clients gain deletion controls.

Files changed (5) +148 / -11

Enhancement (4) +115 / -11

App.tsxCompose deletion-capable server with protected thread actions +22/-2

Compose deletion-capable server with protected thread actions

• Builds the TrueForge UI server with an SDK-backed 'deleteSession' implementation. Overrides thread rows to suppress actions for published evidence sessions while retaining adapter-level enforcement.

console/src/App.tsx

Layout.tsxAdd accessible session sidebar collapse controls +34/-9

Add accessible session sidebar collapse controls

• Tracks sidebar visibility and renders labeled hide/show buttons with 'aria-controls' and 'aria-expanded'. The conversation and evidence rail remain available when session navigation is collapsed.

console/src/Layout.tsx

console.cssStyle session toggles and portaled action menus +37/-0

Style session toggles and portaled action menus

• Adds responsive brand and sidebar toggle styling. Mirrors theme variables onto 'body' so portaled session action menus remain readable while preserving the existing empty-toast reset.

console/src/console.css

sessionDeletion.tsGuard published evidence sessions from deletion +22/-0

Guard published evidence sessions from deletion

• Defines the five evidence session IDs required for live receipt verification. Exposes a shared eligibility check and rejects protected deletions before invoking the SDK callback.

console/src/sessionDeletion.ts

Tests (1) +33 / -0

console-session-deletion.test.tsVerify protected and ordinary deletion behavior +33/-0

Verify protected and ordinary deletion behavior

• Tests every published evidence ID for rejection without delegation. Confirms an ordinary session is passed to the deletion callback exactly once.

scripts/console-session-deletion.test.ts

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Pinned sessions remain API-deletable ✗ Dismissed 🐞 Bug ☼ Reliability

Description

The evidence-session check wraps only the console's browser-side deleteSession callback, so direct
API clients or the bundled TrueForge UI can still delete the same protected sessions. Because
published receipt verification refetches those sessions, such a deletion permanently breaks live
verification despite this guard.

Code

console/src/App.tsx[R26-27]

+  deleteSession: ({ sessionId }: { sessionId: string }) =>
+    deleteConsoleSession(sessionId, (id) => client.sessions.delete(id)),

Relevance

●● Moderate

No close rejection precedent; backend enforcement is architectural and evidence only shows
frontend-focused review patterns.

PR-#9
PR-#14

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The adapter calls the SDK client only after running the local check, but both pieces execute in the
console frontend. Repository documentation explicitly says this console adds no backend and that the
bundled UI accesses the same server and sessions, while live verification fetches the receipt's
session from that backend; therefore this wrapper cannot protect deletion requests arriving through
another client.

console/src/App.tsx[21-28]
console/src/sessionDeletion.ts[14-22]
console/README.md[29-34]
src/verify/live.ts[43-60]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The evidence-session deletion policy is enforced only in the console's client-side adapter and is bypassable through other clients of the shared TrueForge backend.

## Issue Context
The console explicitly adds no backend, and the bundled UI and console operate on the same sessions. Published evidence sessions must remain fetchable for live receipt verification.

## Fix Focus Areas
- console/src/App.tsx[23-28]
- console/src/sessionDeletion.ts[1-22]
- console/README.md[29-34]

Implement the allow/deny policy at the authoritative backend deletion endpoint (or make the protected sessions immutable there). Keep the UI hiding as defense in depth, and add an integration test that attempts deletion directly against the backend and verifies the session remains retrievable.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Collapse drops keyboard focus ✓ Resolved 🐞 Bug ≡ Correctness

Description

Activating the hide button unmounts the focused button and the entire console-sessions target
without moving focus to the replacement opener. Keyboard users lose their focus position, and the
closed opener's aria-controls references an element that no longer exists.

Code

console/src/Layout.tsx[R24-25]

+              onClick={() => setSessionsOpen(false)}
+              aria-controls="console-sessions"

Relevance

●● Moderate

Focus restoration is a valid accessibility concern, but history has mixed collapse-related feedback
without a close match.

PR-#13
PR-#14

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The aside carrying id="console-sessions" and the focused hide button exist only in the true
branch. Its click handler switches to the false branch, which removes both and renders an opener
that still points aria-controls at the absent ID; there is no ref or focus-management code.

console/src/Layout.tsx[13-45]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Collapsing the session sidebar removes the focused control and its ARIA-controlled target, leaving keyboard focus unmanaged and `aria-controls` unresolved.

## Issue Context
The close button is nested inside the conditionally rendered aside; the alternate opener appears only after that subtree has been removed.

## Fix Focus Areas
- console/src/Layout.tsx[13-45]

Keep a persistent element with `id="console-sessions"` in the DOM while collapsed, and explicitly transfer focus between the hide and show buttons using refs after each toggle. Add a keyboard-focused component test covering focus and the `aria-controls` relationship in both states.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

Review mode: ⚖️ Balanced: The push changes runtime session-deletion behavior and interactive layout/accessibility across multiple code paths, creating real correctness risk beyond a purely localized cosmetic edit.

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[Copilot]

🟡 Changes recommended

The collapsed sidebar toggle currently references an ARIA-controlled element that is not present in the DOM, which is an accessibility correctness issue.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adds safe, UI-visible session controls to the Clearance Console, including session sidebar hide/show behavior and guarded session deletion that blocks deletion of published evidence sessions while delegating deletion of ordinary sessions to the SDK client.

Changes:

• Introduces a shared session-deletion guard (sessionCanBeDeleted) and a safe deletion wrapper (deleteConsoleSession) with tests covering protected vs. ordinary sessions.
• Updates the console app server wiring to support SDK-backed session deletion and hides the delete action for protected sessions.
• Adds a collapsible sessions sidebar control plus CSS tweaks to keep portaled menu actions readable.

File summaries

File	Description
scripts/console-session-deletion.test.ts	Adds deterministic tests for protected evidence sessions vs. ordinary deletion delegation.
console/src/sessionDeletion.ts	Implements evidence-session guard and safe deletion wrapper.
console/src/Layout.tsx	Adds hide/show control for the sessions sidebar.
console/src/console.css	Mirrors theme variables to body for portaled menus; styles sidebar toggle controls.
console/src/App.tsx	Composes SDK client deletion into the UI server and conditionally hides row actions for protected sessions.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[MachineLearning-Nerd]

/review

[qodo-code-review]

Code review by qodo was updated up to the latest commit 1e81ef6

[MachineLearning-Nerd]

/review

[qodo-code-review]

Code review by qodo was updated up to the latest commit 1a5b615

[Copilot]

🟢 Approval recommended

The deletion safeguard is enforced in both UI (action hidden) and adapter logic (guarded delete), and the evidence ID list is verified against published bundles with automated tests.

Review details

• Files reviewed: 8/8 changed files
• Comments generated: 0 new
• Review effort level: Lite