Merge U2: compose/reply/send, undo, Sync-now button, Summarize chip in the app

Author: mannasdev

Package.swift

@@ -41,12 +41,12 @@ let package = Package(
         .testTarget(name: "SyncEngineTests", dependencies: ["SyncEngine"]),
         .target(
             name: "HudsonUI",
-            dependencies: ["GmailKit", "Store", "SyncEngine",
+            dependencies: ["GmailKit", "Store", "SyncEngine", "Outbox", "AIKit",
                            .product(name: "GRDB", package: "GRDB.swift")],
             resources: [.process("Resources")]
         ),
         .executableTarget(name: "HudsonApp", dependencies: ["HudsonUI"]),
-        .testTarget(name: "HudsonUITests", dependencies: ["HudsonUI", "Store"]),
+        .testTarget(name: "HudsonUITests", dependencies: ["HudsonUI", "Store", "AIKit"]),
         // MIME building + send state machine (spec §7). Depends on GmailKit
         // for the `SentMessage`/`SendTransport` shapes SendService sends
         // through, and Store for the `send_jobs` durable queue it persists to.

Sources/HudsonUI/Model/AIBootstrap.swift

@@ -0,0 +1,111 @@
+import AIKit
+import Foundation
+import GmailKit
+import Store
+
+/// Builds a `Summarize` from whatever `ai_config` + Keychain hold for
+/// `account` — the UI-side seam `SummaryModel` runs the Summarize chip
+/// through, mirroring `SendBootstrap`/`SyncBootstrap`'s "Keychain → engine"
+/// shape. Fail-closed by construction: if the feature isn't opted in this
+/// returns `nil` and no provider is ever built, so the chip degrades to a
+/// "turn AI on" banner instead of egressing.
+///
+/// This duplicates a handful of lines from `HudsonCLI`'s `AIRuntime.bootstrap`
+/// rather than sharing them: `HudsonUI` cannot depend on `HudsonCLI`
+/// (dependencies only run executable → library, never the reverse) — the same
+/// reason `SyncBootstrap`/`SendBootstrap` re-derive their own `GmailClient`
+/// wiring. `hudson ai config` (CLI) stays the SOLE writer of `ai_config`, and
+/// the source of truth for the `base_url` provider encoding decoded below.
+enum AIBootstrap {
+    /// Reads `summarize`'s `ai_config` row and, only if it is opted in,
+    /// assembles the provider (`base_url` names which — see
+    /// `SummarizeProviderSelection`), the stored API key
+    /// (`KeychainLLMKeyStore`, keyed by provider kind), an `EgressGuard` over
+    /// that provider, and the `Summarize` on top. Returns `nil` when the
+    /// feature has no row or `opt_in != true` — the fail-closed default that
+    /// matches `EgressGuard`'s own gate, so a not-opted-in feature can't even
+    /// reach a built provider.
+    ///
+    /// `keyStore`/`http` default to the real Keychain/URLSession seams in
+    /// production but are injectable so tests exercise the opt-in gating
+    /// without touching the macOS Keychain or the network (spec §6.3, the
+    /// same rule every other `LLMKeyStore` consumer follows).
+    static func makeSummarize(
+        database: HudsonDatabase,
+        account: String,
+        keyStore: any LLMKeyStore = KeychainLLMKeyStore(),
+        http: any LLMHTTP = URLSessionLLMHTTP()
+    ) async -> Summarize? {
+        // Fail closed on ANY read failure too, not just a missing/opt-out row:
+        // a Store error must never be the reason content leaks, so `try?` +
+        // the `optIn` guard both have to hold before a provider is built.
+        guard
+            let config = try? await database.aiConfig(
+                feature: AIFeature.summarize.rawValue, account: account),
+            config.optIn
+        else { return nil }
+
+        let selection = SummarizeProviderSelection.decode(config.baseURL)
+        // A keyless local provider (Ollama/LM Studio) is valid: an absent
+        // Keychain entry degrades to "", never a thrown error — matching
+        // `AIRuntime.bootstrap`'s "tolerate an empty key" contract.
+        let apiKey = (try? keyStore.key(provider: selection.keychainProvider)) ?? ""
+        let provider = selection.buildProvider(http: http, apiKey: apiKey)
+        let egressGuard = EgressGuard(provider: provider, database: database, account: account)
+        return Summarize(guard: egressGuard, database: database, account: account)
+    }
+}
+
+/// Which LLM backend a stored `ai_config` row selects, decoded from the
+/// `base_url` column. No AIKit feature reads `base_url`, so `hudson ai config`
+/// repurposes it as an opaque `"<kind>"` / `"<kind>|<url>"` encoding of
+/// "which provider, and any base-URL override" (see `AICommands`'
+/// `AIProviderConfig`, the encoder). HudsonUI can't import HudsonCLI to reuse
+/// that decoder (see `AIBootstrap`'s doc comment), so the read side is
+/// mirrored here — deliberately lenient: anything unrecognized or hand-edited
+/// falls back to `.anthropic` with no override, an inert default that can't
+/// itself cause egress (the opt-in gate, not this decode, is what blocks it).
+private enum SummarizeProviderSelection {
+    case anthropic
+    case openAICompat(baseURL: URL?)
+
+    private static let separator: Character = "|"
+
+    static func decode(_ raw: String?) -> SummarizeProviderSelection {
+        guard let raw, !raw.isEmpty else { return .anthropic }
+        let parts = raw.split(separator: Self.separator, maxSplits: 1)
+        guard let kind = parts.first else { return .anthropic }
+        switch String(kind) {
+        case "openai-compat":
+            let override = parts.count > 1 ? URL(string: String(parts[1])) : nil
+            return .openAICompat(baseURL: override)
+        default:
+            // "anthropic" or any stale/hand-edited value — inert default.
+            return .anthropic
+        }
+    }
+
+    /// The `provider` key `KeychainLLMKeyStore` filed this backend's API key
+    /// under (`ai config` writes it keyed by this same raw value).
+    var keychainProvider: String {
+        switch self {
+        case .anthropic: return "anthropic"
+        case .openAICompat: return "openai-compat"
+        }
+    }
+
+    /// Builds the live provider. Construction is pure (no I/O — see the
+    /// providers' own doc comments), so building one for a feature that turns
+    /// out not to egress is harmless. `.anthropic` never honors a base-URL
+    /// override (there is none to pass); `.openAICompat` uses the configured
+    /// URL when present, else the provider's OpenAI default.
+    func buildProvider(http: any LLMHTTP, apiKey: String) -> any LLMProvider {
+        switch self {
+        case .anthropic:
+            return AnthropicProvider(http: http, apiKey: apiKey)
+        case .openAICompat(let baseURL):
+            guard let baseURL else { return OpenAICompatProvider(http: http, apiKey: apiKey) }
+            return OpenAICompatProvider(http: http, apiKey: apiKey, baseURL: baseURL)
+        }
+    }
+}

Sources/HudsonUI/Model/AppModel.swift

@@ -3,8 +3,9 @@ import Store
 
 /// The root of the app's object graph. Owns the open database, the active
 /// account, and every child view model (`inbox`/`thread`/`command`/
-/// `search`), plus the app-level presentation state (which overlay is
-/// showing) and keyboard routing (`apply(_:)`, driven by `KeyboardMonitor`).
+/// `search`/`composer`), plus the app-level presentation state (which
+/// overlay is showing) and keyboard routing (`apply(_:)`, driven by
+/// `KeyboardMonitor`).
 /// `@MainActor` because every view model in Hudson is main-actor — SwiftUI
 /// reads them on the main thread and Store access is via async APIs, so
 /// nothing here ever blocks a cooperative-pool thread.
@@ -18,6 +19,13 @@ public final class AppModel {
     public let thread: ThreadModel
     public let command: CommandModel
     public let search: SearchModel
+    public let composer: ComposerModel
+
+    /// The Summarize chip's view model for the OPEN thread. Reset on every
+    /// `openThread` so it never carries one thread's summary over to another,
+    /// and driven ONLY by `summarizeOpenThread()` — the explicit tap. Per
+    /// Privacy #1 it never runs on its own (no summarize-on-open).
+    public let summary: SummaryModel
 
     /// The sidebar's "LABELS" section — a one-shot read at launch (Store has
     /// no `observeLabels` twin the way inbox rows/split rules do, and this
@@ -41,6 +49,12 @@ public final class AppModel {
     public var isPaletteVisible = false
     /// Whether the ⌘F/`/` search overlay is showing.
     public var isSearchVisible = false
+    /// Whether the compose sheet (`ComposerView`, bound to `composer`) is
+    /// showing — opened by `composeNew()`/`replyToOpenThread()`, and closed
+    /// either by the sheet's own Cancel/Esc (`RootView` sets this back to
+    /// `false` directly) or by a SUCCESSFUL send, via `composer.onClose`
+    /// (wired in both initializers below) — see `wireComposerDismissal`.
+    public var isComposerVisible = false
 
     /// A user-visible strip for app-level sync state (offline, no account
     /// connected, a failed pass) — `nil` when there's nothing to show.
@@ -66,10 +80,13 @@ public final class AppModel {
         self.thread = ThreadModel(database: database, account: email)
         self.command = CommandModel()
         self.search = SearchModel(database: database, account: email)
+        self.composer = ComposerModel(database: database, account: account)
+        self.summary = SummaryModel(database: database, account: email)
         await inbox.start()
         await refreshLabels()
         subscribeToPendingCount()
         subscribeToUnreadCount()
+        wireComposerDismissal()
     }
 
     /// Direct-injection initializer for tests and previews (seeded
@@ -87,11 +104,14 @@ public final class AppModel {
         self.thread = ThreadModel(database: database, account: email)
         self.command = CommandModel()
         self.search = SearchModel(database: database, account: email)
+        self.composer = ComposerModel(database: database, account: account)
+        self.summary = SummaryModel(database: database, account: email)
         let inbox = self.inbox
         Task { await inbox.start() }
         Task { [weak self] in await self?.refreshLabels() }
         subscribeToPendingCount()
         subscribeToUnreadCount()
+        wireComposerDismissal()
     }
 
     /// The demo mailbox's account — matches `DemoData.seed`'s default so
@@ -172,6 +192,25 @@ public final class AppModel {
         labels = (try? await database.labels(account: account.email)) ?? []
     }
 
+    /// Lets a successful send dismiss the compose sheet from HERE, not from
+    /// the view: `ComposerModel.send()` fires `onClose?()` synchronously
+    /// right after enqueueing (see its doc comment), so wiring that straight
+    /// to `isComposerVisible = false` is the same "model owns the dismissal"
+    /// shape `togglePalette`/`toggleSearch` already use for the other two
+    /// overlays. Called once, at the end of each initializer, after every
+    /// stored property (including `composer` itself) has a value — matches
+    /// `subscribeToPendingCount`/`subscribeToUnreadCount`'s own established
+    /// "capture self weakly once fully initialized" convention, just for a
+    /// callback assignment rather than a `Task`.
+    ///
+    /// The compose sheet closing does NOT drop the just-sent draft's undo
+    /// affordance — `ComposerModel.justSentUndoJobID` deliberately outlives
+    /// `onClose` firing, so `RootView` renders that toast independently of
+    /// whether the sheet itself is still mounted (see `RootView.assembled`).
+    private func wireComposerDismissal() {
+        composer.onClose = { [weak self] in self?.isComposerVisible = false }
+    }
+
     // MARK: - Navigation
 
     /// Selects `threadID` in the inbox list and loads it into the reading
@@ -181,9 +220,56 @@ public final class AppModel {
     /// first emission either (see its doc comment), so this doesn't need to.
     public func openThread(_ threadID: String) {
         inbox.selectedThreadID = threadID
+        // Drop the previous thread's summary so the chip resets to its
+        // untapped state — a summary is per-thread and must never bleed across
+        // a switch. This clears local state only; it never triggers a new
+        // summarize (that stays an explicit tap — Privacy #1, no auto-run).
+        summary.reset()
         Task { await thread.open(threadID: threadID) }
     }
 
+    /// Runs the Summarize chip for whichever thread is open
+    /// (`inbox.selectedThreadID`, the same id the reading pane shows) —
+    /// `ThreadView`'s chip funnels through here. This is the explicit user
+    /// action the `.summarize` `Invocation` stands for; it egresses ONLY if
+    /// the feature is opted in (the gate lives under `SummaryModel` →
+    /// `AIBootstrap`/`EgressGuard`). A no-op, defensively, when nothing is
+    /// selected. Synchronous like the other chrome actions: `summarize` is
+    /// async, so it runs in its own `Task`.
+    public func summarizeOpenThread() {
+        guard let threadID = inbox.selectedThreadID else { return }
+        Task { [weak self] in await self?.summary.summarize(threadID: threadID) }
+    }
+
+    // MARK: - Compose / reply (see `ComposerModel`; ⌘N and the reply bar both funnel here)
+
+    /// Opens the compose sheet with a blank draft — the ⌘N shortcut
+    /// (`KeyAction.composeNew`) funnels through here. Synchronous:
+    /// `ComposerModel.startNew()` does no async work (see its doc comment),
+    /// so there's nothing to await before showing the sheet.
+    public func composeNew() {
+        composer.startNew()
+        isComposerVisible = true
+    }
+
+    /// Opens the compose sheet pre-filled as a reply to whichever thread is
+    /// currently open (`inbox.selectedThreadID` — the same id `openThread(_:)`
+    /// sets and `ThreadView`'s reading pane is showing) — `ThreadView`'s
+    /// Reply bar funnels through here. A no-op, defensively, if nothing is
+    /// selected: `RootView` only mounts the Reply bar once a thread is open,
+    /// but this doesn't trust that invariant rather than risk showing an
+    /// untethered sheet. `ComposerModel.startReply` is async (it reads the
+    /// thread to build the real threading scaffold via `ReplyBuilder`), so
+    /// the sheet is shown only AFTER it resolves — the draft is already
+    /// fully prefilled the instant it appears, no empty-to-populated flash.
+    public func replyToOpenThread() {
+        guard let threadID = inbox.selectedThreadID else { return }
+        Task { [weak self] in
+            await self?.composer.startReply(threadID: threadID)
+            self?.isComposerVisible = true
+        }
+    }
+
     // MARK: - Palette / search presentation
 
     /// Opens the palette (reloading its command list for the CURRENT split
@@ -270,18 +356,15 @@ public final class AppModel {
         case .clearSelection: inbox.selectedThreadID = nil
         case .togglePalette: togglePalette()
         case .toggleSearch: toggleSearch()
+        case .composeNew: composeNew()
         }
     }
 
     // MARK: - Sync (the ONLY network path in the app — see Privacy #1: user-initiated, never automatic)
 
-    /// TODO(sync-wire): nothing in this milestone's UI calls this yet — the
-    /// sidebar's settings gear is still a placeholder (Task 9's doc
-    /// comment), and per Privacy #1 sync must stay user-initiated, so it's
-    /// deliberately never called automatically (e.g. on launch) either. The
-    /// implementation below is real and tested at the "no account/no
-    /// credentials" guard (`AppModelTests`); a future task wires an actual
-    /// "Sync now" affordance to call it.
+    /// Wired to the sidebar footer's "Sync now" button (`RootView` ->
+    /// `SidebarView.onSyncNow`) — per Privacy #1 this stays the ONLY way
+    /// sync ever runs; it is never called automatically (e.g. on launch).
     ///
     /// Best-effort and fully guarded: builds the network stack from the
     /// Keychain (mirrors `HudsonCLI/Runtime.bootstrap()`, via