fix(desktop): settle pasted recipients within the source draft visit

Capture recipients after clipboard verification without borrowing a newer authored draft. Preserve ordinary post-capture destination-bound sends. Align inherited revocation tests with fail-closed publication, and pin actual recipients in the detached duplicate-wake test.

Signed-off-by: Logan Johnson <loganj@squareup.com>

Author: loganj

desktop/src/features/messages/ui/useMentionSendFlow.cancellation.test.mjs

@@ -473,19 +473,23 @@ test("ordinary send may clean its untouched source even if navigation preceded o
     s.calls.push(["mark-sent", ...args]);
   const gate = deferred();
   s.control.publish = gate;
+  // Hold destination preparation AFTER clipboard settlement has captured the
+  // source selections; navigation during settlement now cancels before capture.
+  const preparation = deferred();
+  s.options.onPrepareSendChannel = () => preparation.promise;
   s.rerender();
   let send;
-  s.act(() => {
+  await s.act(async () => {
     send = s.result.current.sendMessageWithMentionFlow({
-      capturedChannelId: "general",
+      capturedChannelId: null,
       pendingImeta: [],
       trimmed: TEXT,
       recoveryDraftKey: "thread:a",
       sentDraftKey: "thread:a",
     });
-    // Preparation yields before completeSend can clear the composer.
-    s.navigate("thread:b");
   });
+  s.navigate("thread:b");
+  preparation.resolve("general");
   await s.flush();
   assert.equal(s.events("publish").length, 1);
   assert.equal(s.store.get("thread:a").content, TEXT);
@@ -520,3 +524,83 @@ for (const upload of [false, true]) {
     assert.equal(s.result.current.isPreparingMentionSend, false);
   });
 }
+
+// Clipboard verification is the only pre-capture await. Later preparation
+// consumes a snapshot; this await must instead fence the maps before reading.
+test("settled paste supplies exact recipient and recovery refs before preparation", async () => {
+  const s = await setup({ lifecycle: true });
+  s.dismiss();
+  const gate = deferred();
+  const pastedRefs = [
+    { displayName: "RemoteScout", pubkey: "c".repeat(64), isAgent: true },
+  ];
+  s.options.mentions.settlePendingMentionBindings = async () => {
+    await gate.promise;
+    s.control.currentRefs = pastedRefs;
+  };
+  s.options.mentions.extractMentionPubkeys = () =>
+    s.control.currentRefs.map((ref) => ref.pubkey);
+  s.rerender();
+  let sending;
+  await s.act(async () => {
+    sending = s.result.current.sendMessageWithMentionFlow({
+      capturedChannelId: "general",
+      trimmed: TEXT,
+      pendingImeta: [],
+    });
+  });
+  await s.finish(gate);
+  await sending;
+  await s.invite();
+  assert.deepEqual(Array.from(s.events("SEND")[0][2]), [pastedRefs[0].pubkey]);
+});
+
+for (const action of ["edit", "delete", "navigation", "return", "unmount"]) {
+  test(`paste settlement after ${action} cannot read another draft or publish`, async () => {
+    const s = await setup({ lifecycle: true });
+    s.dismiss();
+    const gate = deferred();
+    s.options.mentions.settlePendingMentionBindings = () => gate.promise;
+    s.rerender();
+    let sending;
+    await s.act(async () => {
+      sending = s.result.current.sendMessageWithMentionFlow({
+        capturedChannelId: "general",
+        trimmed: TEXT,
+        pendingImeta: [],
+      });
+    });
+    const otherRefs = [
+      { displayName: "RemoteScout", pubkey: "c".repeat(64), isAgent: true },
+    ];
+    if (action === "edit") s.edit(TEXT, otherRefs);
+    if (action === "delete") s.edit("");
+    if (action === "navigation" || action === "return") {
+      s.store.set("thread:b", {
+        content: TEXT,
+        channelId: "general",
+        pendingImeta: [],
+        spoileredAttachmentUrls: [],
+        mentionRefs: otherRefs,
+      });
+      s.navigate("thread:b");
+      if (action === "return") s.navigate("thread:a");
+    }
+    if (action === "unmount") s.unmount();
+    let reads = 0;
+    s.options.mentions.getDraftMentionRefs = () => {
+      reads++;
+      return otherRefs;
+    };
+    await s.finish(gate);
+    await sending;
+    assert.equal(reads, 0);
+    assert.equal(s.events("add").length, 0);
+    assert.equal(s.events("persona").length, 0);
+    assert.equal(s.events("SEND").length, 0);
+    assert.equal(s.result.current.nonMemberPromptProps.open, false);
+    if (action === "delete") assert.equal(s.options.contentRef.current, "");
+    if (action === "edit" || action === "navigation")
+      assert.deepEqual(s.control.currentRefs, otherRefs);
+  });
+}

desktop/src/features/messages/ui/useMentionSendFlow.ts

@@ -741,13 +741,9 @@ export function useMentionSendFlow({
       }
       isMentionSendPendingRef.current = true;
       setIsMentionSendPending(true);
-      // Capture exact selections before any async preparation can navigate the
-      // reused editor to another draft (possibly with identical display text).
+      // Bind settlement to this authored visit before reading its recipients.
       claimDraftSend(effectiveDraftKey);
       const composerRevision = getComposerRevision();
-      const savedMentionRefs = mentions.getDraftMentionRefs(trimmed).slice();
-      const selectedMentionPubkeys = mentions.extractMentionPubkeys(trimmed);
-      const selectedPersonas = mentions.extractMentionPersonas(trimmed);
       const isSendCancelled = () =>
         preparedLinkPreviews?.signal.aborted === true;
       let sendPromoted = false;
@@ -762,7 +758,18 @@ export function useMentionSendFlow({
         // publish a readable `@Label` with no `p` tag. Bounded inside, so a
         // lookup that never answers delays the send rather than blocking it.
         await mentions.settlePendingMentionBindings();
-        if (isSendCancelled()) return;
+        // Settlement may outlive an edit or A → B → A navigation. In that
+        // case the live mention maps no longer belong to this send.
+        if (
+          isSendCancelled() ||
+          !isMountedRef.current ||
+          sourceOwnerRef.current !== sourceOwner ||
+          getComposerRevision() !== composerRevision
+        )
+          return;
+        const savedMentionRefs = mentions.getDraftMentionRefs(trimmed).slice();
+        const selectedMentionPubkeys = mentions.extractMentionPubkeys(trimmed);
+        const selectedPersonas = mentions.extractMentionPersonas(trimmed);
         const dmThreadAgentMentionErrorMessage = dmThreadAgentMentionError({
           trimmed,
           isThreadReply: capturedThreadContext != null,

desktop/tests/e2e/mentions.spec.ts

@@ -2204,7 +2204,7 @@ test("deferred-upload sends revalidate agent authorization at the publish bounda
   page,
 }) => {
   // A background media upload can hold the publish open for arbitrarily long —
-  // authorization revoked during that window must still strip the p tag. This
+  // authorization revoked during that window must block publication. This
   // pins the publish-boundary revalidation on the deferred path.
   await installMockBridge(page, {
     deferredComposerUploads: true,
@@ -2289,24 +2289,29 @@ test("deferred-upload sends revalidate agent authorization at the publish bounda
   });
 
   const outgoingContent = `@quinn hello\n![video](https://mock.relay/media/${"c".repeat(64)}.mp4)`;
-  await expect
-    .poll(() => readOutgoingMentionPubkeys(page, outgoingContent))
-    .not.toBeNull();
-  await expect
-    .poll(() => readOutgoingMentionPubkeys(page, outgoingContent))
-    .not.toContain(ALLOWLIST_RELAY_AGENT_PUBKEY);
+  await expect(
+    page.getByText("Could not authorize a mentioned agent.", { exact: false }),
+  ).toBeVisible();
+  expect(await readOutgoingMentionPubkeys(page, outgoingContent)).toBeNull();
+  await expect(input).toHaveText("@quinn hello");
+  await expect(
+    page.getByTestId("composer-queued-media-attachment"),
+  ).toBeVisible();
   const commands = await readCommandLog(page);
   expect(commandCount(commands, "revalidate_relay_agents")).toBe(
     commandCount(baselineCommands, "revalidate_relay_agents") + 2,
   );
+  expect(commandCount(commands, "start_managed_agent")).toBe(
+    commandCount(baselineCommands, "start_managed_agent"),
+  );
 });
 
 test("sends that attach a mentioned agent revalidate at the publish boundary", async ({
   page,
 }) => {
   // The awaited membership write for a non-member managed agent is a relay
   // round-trip between the pre-side-effect authorization pass and the publish
-  // — authorization revoked during that window must still strip the p tag.
+  // — authorization revoked during that window must block publication.
   await installMockBridge(page, {
     managedAgents: [
       {
@@ -2385,15 +2390,13 @@ test("sends that attach a mentioned agent revalidate at the publish boundary", a
     window.__BUZZ_E2E__.mock.relayAgentRevalidationRevokedPubkeys = [pubkey];
   }, ALLOWLIST_RELAY_AGENT_PUBKEY);
 
-  await expect
-    .poll(() => readOutgoingMentionPubkeys(page, "@quinn @fizz hello"))
-    .not.toBeNull();
-  const outgoingPubkeys = await readOutgoingMentionPubkeys(
-    page,
-    "@quinn @fizz hello",
-  );
-  expect(outgoingPubkeys).toContain(OUT_OF_CHANNEL_MANAGED_AGENT_PUBKEY);
-  expect(outgoingPubkeys).not.toContain(ALLOWLIST_RELAY_AGENT_PUBKEY);
+  await expect(
+    page.getByText("Could not authorize a mentioned agent.", { exact: false }),
+  ).toBeVisible();
+  expect(
+    await readOutgoingMentionPubkeys(page, "@quinn @fizz hello"),
+  ).toBeNull();
+  await expect(input).toHaveText("@quinn @fizz hello");
   const commands = await readCommandLog(page);
   expect(commandCount(commands, "revalidate_relay_agents")).toBe(
     commandCount(baselineCommands, "revalidate_relay_agents") + 2,
@@ -2403,6 +2406,9 @@ test("sends that attach a mentioned agent revalidate at the publish boundary", a
   expect(commandCount(commands, "update_managed_agent")).toBe(
     commandCount(baselineCommands, "update_managed_agent"),
   );
+  expect(commandCount(commands, "start_managed_agent")).toBe(
+    commandCount(baselineCommands, "start_managed_agent"),
+  );
 });
 
 test("sends that enroll agents into an active huddle revalidate at the publish boundary", async ({
@@ -2477,7 +2483,7 @@ test("a send held open by a no-write step still revalidates at the publish bound
   // here the only thing separating the authorization pass from the publish is
   // the huddle sync — which with no active huddle writes nothing to the relay
   // — and the revocation is released with zero further hold. A revocation
-  // landing in any admission-to-publish gap must strip the p tag; this is the
+  // landing in any admission-to-publish gap must block publication; this is the
   // reviewer's sub-threshold probe of the since-removed elapsed-time bound,
   // which deliberately accepted this very staleness.
   await installMockBridge(page, {
@@ -2551,12 +2557,11 @@ test("a send held open by a no-write step still revalidates at the publish bound
     )
     .toBeGreaterThan(0);
 
-  await expect
-    .poll(() => readOutgoingMentionPubkeys(page, "@quinn hello"))
-    .not.toBeNull();
-  await expect
-    .poll(() => readOutgoingMentionPubkeys(page, "@quinn hello"))
-    .not.toContain(ALLOWLIST_RELAY_AGENT_PUBKEY);
+  await expect(
+    page.getByText("Could not authorize a mentioned agent.", { exact: false }),
+  ).toBeVisible();
+  expect(await readOutgoingMentionPubkeys(page, "@quinn hello")).toBeNull();
+  await expect(input).toHaveText("@quinn hello");
 
   const commands = await readCommandLog(page);
   expect(commandCount(commands, "revalidate_relay_agents")).toBe(
@@ -3048,7 +3053,9 @@ test("a second mention while the first wake is in flight does not start the agen
   await input.fill("Hey @fizz");
   await expect(dropdown.getByText("fizz")).toBeVisible();
   await input.press("Enter");
-  await page.keyboard.type(" do X");
+  await expect(input.locator(".mention-chip")).toHaveText("fizz");
+  await page.keyboard.type("do X");
+  await expect(input).toHaveText("Hey @fizz do X");
   await page.getByTestId("send-message").click();
   await expect(
     page.getByTestId("message-row").filter({ hasText: "do X" }),
@@ -3062,14 +3069,22 @@ test("a second mention while the first wake is in flight does not start the agen
   await input.fill("Hey @fizz");
   await expect(dropdown.getByText("fizz")).toBeVisible();
   await input.press("Enter");
-  await page.keyboard.type(" also Y");
+  await expect(input.locator(".mention-chip")).toHaveText("fizz");
+  await page.keyboard.type("also Y");
+  await expect(input).toHaveText("Hey @fizz also Y");
   await page.getByTestId("send-message").click();
 
   // The second message publishes on its own — suppression is of the wake, not
   // of the send; the composer is never gated on a pending start again.
   await expect(
     page.getByTestId("message-row").filter({ hasText: "also Y" }),
   ).toBeVisible();
+  expect(await readOutgoingMentionPubkeys(page, "Hey @fizz do X")).toContain(
+    IN_CHANNEL_MANAGED_AGENT_PUBKEY,
+  );
+  expect(await readOutgoingMentionPubkeys(page, "Hey @fizz also Y")).toContain(
+    IN_CHANNEL_MANAGED_AGENT_PUBKEY,
+  );
   // One wake serves both messages: its replay floor predates the first
   // message, and the floor is a lower bound, so one harness boot covers both.
   expect(commandCount(await readCommandLog(page), "start_managed_agent")).toBe(

docs/remote-mention-routing.md

@@ -66,7 +66,11 @@ completion cannot revive that recovery or release a newer attempt's latch.
 The editor's authored revision distinguishes an intentional edit → clear from an
 optimistic empty composer. Programmatic send clear/recovery runs inside the draft
 lifecycle's restoration boundary, so it does not mark the source as authoritatively
-deleted. Exact selected mention refs are captured before asynchronous preparation.
+deleted. Pending clipboard identity verification settles before exact selected
+mention refs are captured. The source visit and authored revision are captured
+before that wait: an edit, navigation (including A → B → A), or unmount cancels
+rather than reading the new draft's maps. Subsequent asynchronous preparation
+consumes the captured selections.
 Persona preparation similarly consumes captured selections and returns resolved
 refs, writing them into the editor only while the original visit/revision remains
 current. Normal persona creation/reuse and ordinary destination-bound background