tmimmanuel b78295b4dd fix(ui): hide sender metadata in control chat (#78790) ...

Summary:
- Strip untrusted sender metadata from Control UI live stream and transcript rendering.
- Preserve canvas preview anchors while suppressing metadata-only render items.
- Stop operator UI clients from injecting internal client IDs as sender identity while preserving external channel attribution.

Verification:
- pnpm exec oxfmt --check --threads=1 CHANGELOG.md ui/src/ui/chat/build-chat-items.ts ui/src/ui/chat/build-chat-items.test.ts ui/src/ui/chat/message-normalizer.ts ui/src/ui/chat/message-normalizer.test.ts src/gateway/server-methods/chat.ts src/gateway/server-methods/chat.directive-tags.test.ts
- pnpm check:changelog-attributions
- git diff --check
- pnpm test ui/src/ui/chat/build-chat-items.test.ts ui/src/ui/chat/message-normalizer.test.ts -- --reporter=verbose
- pnpm test src/gateway/server-methods/chat.directive-tags.test.ts -- --reporter=verbose -t 'operator UI client sender context'
- GitHub PR checks green on a67ab34fbe

Fixes #78739.
Thanks @tmimmanuel, @guguangxin-eng, @hclsys, and @BunsDev.

2026-05-08 04:10:21 -05:00

..

public

feat: add Control UI PWA web push support (#44590)

2026-04-25 05:03:00 -05:00

src

fix(ui): hide sender metadata in control chat (#78790)

2026-05-08 04:10:21 -05:00

AGENTS.md

docs(agents): split scoped workflow guidance (#65241)

2026-04-12 09:09:50 +01:00

CLAUDE.md

docs(agents): split scoped workflow guidance (#65241)

2026-04-12 09:09:50 +01:00

index.html

fix: contain iOS standalone viewport (#76072)

2026-05-02 13:46:41 +01:00

package.json

build(deps): update workspace dependencies

2026-05-01 21:58:26 +01:00

vite.config.ts

gateway: trim control UI bootstrap payload (#57727)

2026-03-30 15:08:19 +01:00

vitest.config.ts

test: make suites safe without isolation (#78834)

2026-05-07 08:43:29 +01:00

vitest.node.config.ts

test: make suites safe without isolation (#78834)

2026-05-07 08:43:29 +01:00