From e9540f9b2077ae2243782b866482acf97a8a3b0a Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:47:27 +0100
Subject: [PATCH 01/57] Convert Echo provider layer to multi-turn messages

---
 .../plugins/echo/provider/http_streaming.rb   | 10 ++-
 .../models/dradis/plugins/echo/provider.rb    | 17 +++-
 .../dradis/plugins/echo/provider/anthropic.rb |  6 +-
 .../dradis/plugins/echo/provider/gemini.rb    | 10 ++-
 .../dradis/plugins/echo/provider/ollama.rb    |  7 +-
 .../dradis/plugins/echo/provider/open_ai.rb   |  4 +-
 .../plugins/echo/provider/anthropic_spec.rb   | 13 +++-
 .../plugins/echo/provider/gemini_spec.rb      | 20 ++++-
 .../echo/provider/http_streaming_spec.rb      | 30 +++++++
 .../plugins/echo/provider/ollama_spec.rb      | 78 ++++++++++++-------
 .../plugins/echo/provider/open_ai_spec.rb     | 11 ++-
 11 files changed, 157 insertions(+), 49 deletions(-)

diff --git a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
index 21ac06696..463744e61 100644
--- a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
+++ b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
@@ -16,13 +16,17 @@ module Provider::HttpStreaming
     # Without a block: accumulates all chunks and returns the complete response
     # as a string once the API finishes, for use outside a streaming context.
     #
+    # Accepts a multi-turn messages: array ([{ role:, content: }]) or the
+    # prompt: sugar for a single user message.
+    #
     # Subclasses must implement: #build_uri, #build_headers, #build_body,
     # #extract_text. Optionally override #end_of_stream_marker.
-    def generate(prompt:, model: nil, &block)
+    def generate(messages: nil, prompt: nil, model: nil, &block)
       resolved_model = model.presence || self.model
+      resolved_messages = resolve_messages(messages, prompt)
       uri = build_uri(resolved_model)
       headers = build_headers
-      body = build_body(prompt: prompt, model: resolved_model)
+      body = build_body(messages: resolved_messages, model: resolved_model)
 
       buffer = block ? nil : +''
 
@@ -93,7 +97,7 @@ def build_headers
     end
 
     # Returns the request body hash for the provider's API.
-    def build_body(prompt:, model:)
+    def build_body(messages:, model:)
       raise NotImplementedError, "#{self.class.name} must implement #build_body"
     end
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
index 29bcd7f9c..bf181d5b9 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
@@ -40,7 +40,7 @@ def self.inherited(subclass)
 
     # -- Instance Methods -----------------------------------------------------
 
-    def generate(prompt:, model: nil, &block)
+    def generate(messages: nil, prompt: nil, model: nil, &block)
       raise NotImplementedError, "#{self.class.name} must implement #generate"
     end
 
@@ -55,5 +55,20 @@ def requires_api_key?
     def type_name
       self.class.name.demodulize
     end
+
+    private
+
+    # Normalizes the two ways to call #generate into a messages array. Callers
+    # pass either a multi-turn messages: array or the prompt: sugar, which wraps
+    # a single string into one user message.
+    def resolve_messages(messages, prompt)
+      if messages
+        messages
+      elsif prompt
+        [{ role: 'user', content: prompt }]
+      else
+        raise ArgumentError, '#generate requires either messages: or prompt:'
+      end
+    end
   end
 end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
index def48e118..f0708a1a2 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
@@ -9,10 +9,10 @@ class Provider::Anthropic < Provider
 
     private
 
-    def build_body(prompt:, model:)
+    def build_body(messages:, model:)
       {
         max_tokens: DEFAULT_MAX_TOKENS,
-        messages: [{ role: 'user', content: prompt }],
+        messages: messages,
         model: model,
         stream: true
       }
@@ -21,7 +21,7 @@ def build_body(prompt:, model:)
     def build_headers
       {
         'anthropic-version' => API_VERSION,
-        'x-api-key'         => api_key
+        'x-api-key' => api_key
       }
     end
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
index dad2990a1..fec20c2a4 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
@@ -4,12 +4,18 @@ class Provider::Gemini < Provider
 
     DEFAULT_ADDRESS = 'https://generativelanguage.googleapis.com/v1beta/models'.freeze
     DEFAULT_MODEL = 'gemini-2.5-flash'.freeze
+    ROLE_MAP = { 'assistant' => 'model' }.freeze
 
     private
 
-    def build_body(prompt:, model:)
+    # Gemini names the assistant role "model" and wraps content in a parts
+    # array, so map each message into its contents structure.
+    def build_body(messages:, model:)
       {
-        contents: [{ role: 'user', parts: [{ text: prompt }] }]
+        contents: messages.map { |message|
+          { role: ROLE_MAP.fetch(message[:role], message[:role]),
+            parts: [{ text: message[:content] }] }
+        }
       }
     end
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
index 51879da98..d2333ffb1 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
@@ -7,14 +7,15 @@ def requires_api_key?
       false
     end
 
-    def generate(prompt:, model: nil, &block)
+    def generate(messages: nil, prompt: nil, model: nil, &block)
       resolved_model = model.presence || self.model
+      resolved_messages = resolve_messages(messages, prompt)
       buffer = block_given? ? nil : +''
 
-      client.generate({ model: resolved_model, prompt: prompt }) do |event, _raw|
+      client.chat({ model: resolved_model, messages: resolved_messages }) do |event, _raw|
         next if event['done']
 
-        chunk = event['response'].to_s
+        chunk = event.dig('message', 'content').to_s
         next if chunk.empty?
 
         chunk = chunk.sub('<think>', '{thinking}').sub('</think>', '{/thinking}')
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/open_ai.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/open_ai.rb
index ec462f443..a6a797467 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/open_ai.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/open_ai.rb
@@ -8,10 +8,10 @@ class Provider::OpenAI < Provider
 
     private
 
-    def build_body(prompt:, model:)
+    def build_body(messages:, model:)
       {
         model: model,
-        messages: [{ role: 'user', content: prompt }],
+        messages: messages,
         stream: true
       }
     end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
index 359f5507b..41f08117e 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
@@ -34,10 +34,15 @@
   end
 
   describe '#build_body' do
-    it 'builds a streaming messages request' do
-      body = provider.send(:build_body, prompt: 'Hello', model: 'claude-sonnet-4-6')
+    it 'passes the multi-turn messages through unchanged' do
+      messages = [
+        { role: 'user', content: 'Hello' },
+        { role: 'assistant', content: 'Hi there' },
+        { role: 'user', content: 'How are you?' }
+      ]
+      body = provider.send(:build_body, messages: messages, model: 'claude-sonnet-4-6')
       expect(body[:model]).to eq('claude-sonnet-4-6')
-      expect(body[:messages]).to eq([{ role: 'user', content: 'Hello' }])
+      expect(body[:messages]).to eq(messages)
       expect(body[:stream]).to be true
       expect(body[:max_tokens]).to eq(described_class::DEFAULT_MAX_TOKENS)
     end
@@ -46,7 +51,7 @@
   describe '#extract_text' do
     it 'extracts text from content_block_delta events' do
       payload = {
-        'type'  => 'content_block_delta',
+        'type' => 'content_block_delta',
         'delta' => { 'type' => 'text_delta', 'text' => 'Hello' }
       }
       expect(provider.send(:extract_text, payload)).to eq('Hello')
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/gemini_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/gemini_spec.rb
index 33d599084..67e47bcd6 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/gemini_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/gemini_spec.rb
@@ -33,10 +33,26 @@
   end
 
   describe '#build_body' do
-    it 'wraps the prompt in the Gemini content structure' do
-      body = provider.send(:build_body, prompt: 'Hello', model: 'gemini-2.0-flash')
+    it 'wraps a single user message in the Gemini content structure' do
+      body = provider.send(:build_body,
+                           messages: [{ role: 'user', content: 'Hello' }],
+                           model: 'gemini-2.0-flash')
       expect(body[:contents]).to eq([{ role: 'user', parts: [{ text: 'Hello' }] }])
     end
+
+    it 'maps the assistant role to model and keeps user turns' do
+      messages = [
+        { role: 'user', content: 'Hello' },
+        { role: 'assistant', content: 'Hi there' },
+        { role: 'user', content: 'How are you?' }
+      ]
+      body = provider.send(:build_body, messages: messages, model: 'gemini-2.0-flash')
+      expect(body[:contents]).to eq([
+        { role: 'user', parts: [{ text: 'Hello' }] },
+        { role: 'model', parts: [{ text: 'Hi there' }] },
+        { role: 'user', parts: [{ text: 'How are you?' }] }
+      ])
+    end
   end
 
   describe '#extract_text' do
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
index 53d7ea726..b9afa2326 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
@@ -95,5 +95,35 @@ def stub_http(body:, code: '200')
       expect(chunks).to eq(['Hello'])
       expect(result).to be_nil
     end
+
+    it 'streams a multi-turn messages array' do
+      delta_event = { 'type' => 'content_block_delta', 'delta' => { 'type' => 'text_delta', 'text' => 'Hello' } }
+      sse_body = "data: #{JSON.generate(delta_event)}\n\n"
+      stub_http(body: sse_body)
+
+      messages = [
+        { role: 'user', content: 'Hi' },
+        { role: 'assistant', content: 'Hello' },
+        { role: 'user', content: 'Again' }
+      ]
+      expect(provider).to receive(:build_body)
+        .with(messages: messages, model: 'claude-sonnet-4-6').and_call_original
+
+      expect(provider.generate(messages: messages)).to eq('Hello')
+    end
+
+    it 'wraps the prompt: sugar into a single user message' do
+      stub_http(body: '')
+
+      expect(provider).to receive(:build_body)
+        .with(messages: [{ role: 'user', content: 'test' }], model: 'claude-sonnet-4-6')
+        .and_call_original
+
+      provider.generate(prompt: 'test')
+    end
+
+    it 'raises when neither messages: nor prompt: is given' do
+      expect { provider.generate }.to raise_error(ArgumentError)
+    end
   end
 end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
index 23ab78171..843d326eb 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
@@ -10,61 +10,66 @@
     allow(provider).to receive(:client).and_return(client)
   end
 
-  def stub_events(*events)
-    allow(client).to receive(:generate) do |_payload, &block|
+  def stub_chat(*events)
+    allow(client).to receive(:chat) do |_payload, &block|
       events.each { |event| block.call(event, nil) }
     end
   end
 
+  # Ollama's chat endpoint nests each chunk under message.content.
+  def content_event(content, done: false)
+    { 'message' => { 'content' => content }, 'done' => done }
+  end
+
   describe '#generate' do
     it 'concatenates response chunks into the buffer' do
-      stub_events(
-        { 'response' => 'Hello ', 'done' => false },
-        { 'response' => 'world', 'done' => false },
-        { 'response' => '', 'done' => true }
+      stub_chat(
+        content_event('Hello '),
+        content_event('world'),
+        content_event('', done: true)
       )
 
       expect(provider.generate(prompt: 'hi')).to eq('Hello world')
     end
 
     it 'preserves whitespace-only chunks, such as standalone line breaks' do
-      stub_events(
-        { 'response' => '1. First item.', 'done' => false },
-        { 'response' => "  \n", 'done' => false },
-        { 'response' => '2. Second item.', 'done' => false },
-        { 'response' => '', 'done' => true }
+      stub_chat(
+        content_event('1. First item.'),
+        content_event("  \n"),
+        content_event('2. Second item.'),
+        content_event('', done: true)
       )
 
       expect(provider.generate(prompt: 'hi')).to eq("1. First item.  \n2. Second item.")
     end
 
-    it 'skips events with an empty response, such as thinking-only chunks' do
-      stub_events(
-        { 'response' => '', 'thinking' => 'Reasoning...', 'done' => false },
-        { 'response' => 'Answer', 'done' => false },
-        { 'response' => '', 'done' => true }
+    it 'skips events with empty content, such as thinking-only chunks' do
+      stub_chat(
+        { 'message' => { 'content' => '', 'thinking' => 'Reasoning...' }, 'done' => false },
+        content_event('Answer'),
+        content_event('', done: true)
       )
 
       expect(provider.generate(prompt: 'hi')).to eq('Answer')
     end
 
     it 'replaces think tags embedded in the response text' do
-      stub_events(
-        { 'response' => '<think>', 'done' => false },
-        { 'response' => 'reasoning', 'done' => false },
-        { 'response' => '</think>', 'done' => false },
-        { 'response' => 'Answer', 'done' => false },
-        { 'response' => '', 'done' => true }
+      stub_chat(
+        content_event('<think>'),
+        content_event('reasoning'),
+        content_event('</think>'),
+        content_event('Answer'),
+        content_event('', done: true)
       )
 
       expect(provider.generate(prompt: 'hi')).to eq('{thinking}reasoning{/thinking}Answer')
     end
 
     it 'yields each chunk to the given block instead of buffering' do
-      stub_events(
-        { 'response' => 'Hello ', 'done' => false },
-        { 'response' => 'world', 'done' => false },
-        { 'response' => '', 'done' => true }
+      stub_chat(
+        content_event('Hello '),
+        content_event('world'),
+        content_event('', done: true)
       )
 
       chunks = []
@@ -72,5 +77,26 @@ def stub_events(*events)
 
       expect(chunks).to eq(['Hello ', 'world'])
     end
+
+    it 'sends a multi-turn messages array to the chat endpoint' do
+      messages = [
+        { role: 'user', content: 'Hi' },
+        { role: 'assistant', content: 'Hello' },
+        { role: 'user', content: 'Again' }
+      ]
+      expect(client).to receive(:chat)
+        .with(hash_including(messages: messages))
+        .and_yield(content_event('ok'), nil)
+
+      expect(provider.generate(messages: messages)).to eq('ok')
+    end
+
+    it 'wraps the prompt: sugar into a single user message' do
+      expect(client).to receive(:chat)
+        .with(hash_including(messages: [{ role: 'user', content: 'hi' }]))
+        .and_yield(content_event('ok'), nil)
+
+      provider.generate(prompt: 'hi')
+    end
   end
 end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/open_ai_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/open_ai_spec.rb
index 8ea0aab33..ff94090ad 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/open_ai_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/open_ai_spec.rb
@@ -31,10 +31,15 @@
   end
 
   describe '#build_body' do
-    it 'builds a streaming chat completions request' do
-      body = provider.send(:build_body, prompt: 'Hello', model: 'gpt-4o')
+    it 'passes the multi-turn messages through unchanged' do
+      messages = [
+        { role: 'user', content: 'Hello' },
+        { role: 'assistant', content: 'Hi there' },
+        { role: 'user', content: 'How are you?' }
+      ]
+      body = provider.send(:build_body, messages: messages, model: 'gpt-4o')
       expect(body[:model]).to eq('gpt-4o')
-      expect(body[:messages]).to eq([{ role: 'user', content: 'Hello' }])
+      expect(body[:messages]).to eq(messages)
       expect(body[:stream]).to be true
     end
   end

From 4ae1500256c5aecb7175e2d747ffa183501429ee Mon Sep 17 00:00:00 2001
From: Daniel Martin <53006+etdsoft@users.noreply.github.com>
Date: Wed, 22 Jul 2026 14:39:27 +0200
Subject: [PATCH 02/57] Apply suggestion from @aapomm

Co-authored-by: Aaron Manaloto <aaronpomanaloto@gmail.com>
---
 .../app/models/dradis/plugins/echo/provider/gemini.rb    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
index fec20c2a4..e97f4658a 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
@@ -12,9 +12,12 @@ class Provider::Gemini < Provider
     # array, so map each message into its contents structure.
     def build_body(messages:, model:)
       {
-        contents: messages.map { |message|
-          { role: ROLE_MAP.fetch(message[:role], message[:role]),
-            parts: [{ text: message[:content] }] }
+        contents: messages.map do |message|
+          {
+            role: ROLE_MAP.fetch(message[:role], message[:role]),
+            parts: [{ text: message[:content] }]
+          }
+        end
         }
       }
     end

From 2c59ba73a1d872a38a2326801a94c8a862c4e4b8 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 14:29:44 +0100
Subject: [PATCH 03/57] Echo: fix dangling brace left by the applied gemini.rb
 do...end suggestion

---
 .../app/models/dradis/plugins/echo/provider/gemini.rb            | 1 -
 1 file changed, 1 deletion(-)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
index e97f4658a..f4a4304fb 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/gemini.rb
@@ -18,7 +18,6 @@ def build_body(messages:, model:)
             parts: [{ text: message[:content] }]
           }
         end
-        }
       }
     end
 

From ae0ab4f4d38da553a94641e9165df39a89555620 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 17:51:27 +0100
Subject: [PATCH 04/57] Echo: add Session and Message persistence

Persist Echo agent conversations. Sessions hang off a polymorphic record
(Note/Issue) and an agent; messages record the multi-turn exchange. Deleting a
user preserves history by nullifying authorship; deleting a record cleans up its
sessions.
---
 db/schema.rb                                  |  36 ++++++-
 .../app/models/dradis/plugins/echo/message.rb |  41 +++++++
 .../app/models/dradis/plugins/echo/session.rb |  47 ++++++++
 .../sessions/messages/_message.html.erb       |  22 ++++
 ...001_create_dradis_plugins_echo_sessions.rb |  17 +++
 ...002_create_dradis_plugins_echo_messages.rb |  22 ++++
 .../lib/dradis/plugins/echo/engine.rb         |  14 +++
 .../dradis-echo/spec/factories/messages.rb    |  13 +++
 .../dradis-echo/spec/factories/sessions.rb    |   7 ++
 .../dradis/plugins/echo/message_spec.rb       |  83 ++++++++++++++
 .../dradis/plugins/echo/session_spec.rb       | 102 ++++++++++++++++++
 11 files changed, 403 insertions(+), 1 deletion(-)
 create mode 100644 engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
 create mode 100644 engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
 create mode 100644 engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
 create mode 100644 engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
 create mode 100644 engines/dradis-echo/spec/factories/messages.rb
 create mode 100644 engines/dradis-echo/spec/factories/sessions.rb
 create mode 100644 engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
 create mode 100644 engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb

diff --git a/db/schema.rb b/db/schema.rb
index cbce9e5bf..45148c0b7 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[8.0].define(version: 2026_05_21_000001) do
+ActiveRecord::Schema[8.0].define(version: 2026_07_14_000002) do
   create_table "active_storage_attachments", force: :cascade do |t|
     t.string "name", null: false
     t.string "record_type", null: false
@@ -118,6 +118,21 @@
     t.index ["provider_id"], name: "index_dradis_plugins_echo_agents_on_provider_id"
   end
 
+  create_table "dradis_plugins_echo_messages", force: :cascade do |t|
+    t.integer "session_id", null: false
+    t.integer "parent_id"
+    t.integer "user_id"
+    t.integer "role", default: 0, null: false
+    t.integer "status", default: 0, null: false
+    t.text "content"
+    t.text "metadata"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["parent_id"], name: "index_dradis_plugins_echo_messages_on_parent_id"
+    t.index ["session_id"], name: "index_dradis_plugins_echo_messages_on_session_id"
+    t.index ["user_id"], name: "index_dradis_plugins_echo_messages_on_user_id"
+  end
+
   create_table "dradis_plugins_echo_prompts", force: :cascade do |t|
     t.string "title", null: false
     t.string "icon", null: false
@@ -140,6 +155,20 @@
     t.datetime "updated_at", null: false
   end
 
+  create_table "dradis_plugins_echo_sessions", force: :cascade do |t|
+    t.integer "agent_id", null: false
+    t.integer "user_id"
+    t.string "record_type", null: false
+    t.integer "record_id", null: false
+    t.integer "status", default: 0, null: false
+    t.string "title"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["agent_id"], name: "index_dradis_plugins_echo_sessions_on_agent_id"
+    t.index ["record_type", "record_id"], name: "index_dradis_plugins_echo_sessions_on_record"
+    t.index ["user_id"], name: "index_dradis_plugins_echo_sessions_on_user_id"
+  end
+
   create_table "evidence", force: :cascade do |t|
     t.integer "node_id"
     t.integer "issue_id"
@@ -301,7 +330,12 @@
   add_foreign_key "comments", "inline_threads"
   add_foreign_key "comments", "users", on_delete: :nullify
   add_foreign_key "dradis_plugins_echo_agents", "dradis_plugins_echo_providers", column: "provider_id"
+  add_foreign_key "dradis_plugins_echo_messages", "dradis_plugins_echo_messages", column: "parent_id"
+  add_foreign_key "dradis_plugins_echo_messages", "dradis_plugins_echo_sessions", column: "session_id"
+  add_foreign_key "dradis_plugins_echo_messages", "users", on_delete: :nullify
   add_foreign_key "dradis_plugins_echo_prompts", "users"
+  add_foreign_key "dradis_plugins_echo_sessions", "dradis_plugins_echo_agents", column: "agent_id"
+  add_foreign_key "dradis_plugins_echo_sessions", "users", on_delete: :nullify
   add_foreign_key "inline_threads", "users"
   add_foreign_key "inline_threads", "users", column: "resolved_by_id"
   add_foreign_key "mapping_fields", "mappings"
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
new file mode 100644
index 000000000..22bfb3b76
--- /dev/null
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
@@ -0,0 +1,41 @@
+module Dradis::Plugins::Echo
+  class Message < ApplicationRecord
+    enum :role, %i[user assistant]
+    enum :status, %i[complete streaming failed], default: :complete
+
+    store :metadata, coder: JSON
+
+    # -- Relationships --------------------------------------------------------
+    belongs_to :parent, class_name: 'Dradis::Plugins::Echo::Message', optional: true
+    belongs_to :session
+    belongs_to :user, optional: true
+
+    # -- Callbacks ------------------------------------------------------------
+    # User messages are authored in full, so they're never mid-stream.
+    before_validation :complete_user_messages
+
+    after_create_commit :broadcast_created
+
+    # -- Validations ----------------------------------------------------------
+    validates :content, presence: true, if: :complete?
+    # Assistant messages are generated by the agent, never a user.
+    validates :user_id, absence: true, if: :assistant?
+
+    # -- Instance Methods -----------------------------------------------------
+
+    private
+
+    def broadcast_created
+      broadcast_append_to(
+        [session, :messages],
+        target: 'echo-messages',
+        partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+        locals: { message: self }
+      )
+    end
+
+    def complete_user_messages
+      self.status = :complete if user?
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
new file mode 100644
index 000000000..060e7e447
--- /dev/null
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -0,0 +1,47 @@
+module Dradis::Plugins::Echo
+  class Session < ApplicationRecord
+    enum :status, %i[idle generating], default: :idle
+
+    # -- Relationships --------------------------------------------------------
+    belongs_to :agent
+    belongs_to :record, polymorphic: true
+    belongs_to :user, optional: true
+    has_many :messages, dependent: :destroy
+
+    # -- Scopes ---------------------------------------------------------------
+    scope :for_record, ->(record) {
+      where(record_type: record_type_for(record), record_id: record.id)
+    }
+
+    # -- Class Methods --------------------------------------------------------
+
+    # Mirrors the record= override below: Issues are stored as 'Issue' even
+    # though they descend from Note, so scopes must resolve the same type.
+    def self.record_type_for(record)
+      record.is_a?(Issue) ? 'Issue' : record.class.base_class.name
+    end
+
+    # -- Instance Methods -----------------------------------------------------
+    def project
+      record.project
+    end
+
+    def to_provider_messages
+      messages.order(:created_at, :id).map do |message|
+        { role: message.role, content: message.content }
+      end
+    end
+
+    # Because Issue descends from Note but doesn't use STI, Rails's default
+    # polymorphic setter stores 'Note' when you assign an Issue. Force 'Issue'
+    # here so the record loads back as the right class. Mirrors
+    # Comment#commentable= (app/models/comment.rb).
+    #
+    # FIXME - ISSUE/NOTE INHERITANCE
+    def record=(new_record)
+      super
+      self.record_type = 'Issue' if new_record.is_a?(Issue)
+      new_record
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
new file mode 100644
index 000000000..07404f4af
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -0,0 +1,22 @@
+<%# locals: (message:) -%>
+<%# Minimal render — Slice 5 restyles. Must render from `render partial:` with %>
+<%# only `message:` in locals, so no controller-context helpers here. %>
+<div id="<%= dom_id(message) %>" class="echo-message echo-message-<%= message.role %>" data-status="<%= message.status %>">
+  <p class="echo-message-author">
+    <% if message.assistant? %>
+      <%= message.session.agent.name %>
+    <% elsif message.user %>
+      <%= message.user.name %>
+    <% else %>
+      Deleted user
+    <% end %>
+  </p>
+
+  <div class="echo-message-content"><%= message.content %></div>
+
+  <% if message.streaming? %>
+    <span class="echo-message-spinner" data-behavior="echo-message-spinner"></span>
+  <% elsif message.failed? %>
+    <p class="echo-message-error">Something went wrong generating this response.</p>
+  <% end %>
+</div>
diff --git a/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb b/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
new file mode 100644
index 000000000..285eeeebe
--- /dev/null
+++ b/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
@@ -0,0 +1,17 @@
+class CreateDradisPluginsEchoSessions < ActiveRecord::Migration[8.0]
+  def change
+    create_table :dradis_plugins_echo_sessions do |t|
+      t.references :agent, null: false,
+        foreign_key: { to_table: :dradis_plugins_echo_agents }
+      t.references :user, null: true,
+        foreign_key: { to_table: :users, on_delete: :nullify }
+      t.references :record, polymorphic: true, null: false
+
+      # 0 maps to the :idle enum value
+      t.integer :status, default: 0, null: false
+      t.string :title
+
+      t.timestamps
+    end
+  end
+end
diff --git a/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb b/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
new file mode 100644
index 000000000..7547b29ef
--- /dev/null
+++ b/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
@@ -0,0 +1,22 @@
+class CreateDradisPluginsEchoMessages < ActiveRecord::Migration[8.0]
+  def change
+    create_table :dradis_plugins_echo_messages do |t|
+      t.references :session, null: false,
+        foreign_key: { to_table: :dradis_plugins_echo_sessions }
+      # Self-referential parent, dormant until Slice 3 branches conversations.
+      t.references :parent, null: true,
+        foreign_key: { to_table: :dradis_plugins_echo_messages }
+      t.references :user, null: true,
+        foreign_key: { to_table: :users, on_delete: :nullify }
+
+      # 0 maps to the :user role
+      t.integer :role, default: 0, null: false
+      # 0 maps to the :complete status
+      t.integer :status, default: 0, null: false
+      t.text :content
+      t.text :metadata
+
+      t.timestamps
+    end
+  end
+end
diff --git a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
index ce8cb5911..9cfe838aa 100644
--- a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
+++ b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
@@ -32,6 +32,20 @@ class Engine < ::Rails::Engine
     initializer 'echo.extend_user_model' do
       ActiveSupport.on_load :user_model do
         ::User.send(:has_many, :prompts, class_name: 'Dradis::Plugins::Echo::Prompt', dependent: :destroy)
+        # Keep a deleted user's sessions and messages around (attributed to a
+        # 'Deleted user') rather than destroying the conversation history.
+        ::User.send(:has_many, :echo_sessions, class_name: 'Dradis::Plugins::Echo::Session', dependent: :nullify)
+        ::User.send(:has_many, :echo_messages, class_name: 'Dradis::Plugins::Echo::Message', dependent: :nullify)
+      end
+    end
+
+    initializer 'echo.extend_note_model' do
+      ActiveSupport.on_load :note_model do
+        # Sessions hang off a polymorphic record (a Note or Issue). Clean them
+        # up when the record is destroyed. Inherited by Issue < Note.
+        ::Note.send(:before_destroy) do
+          Dradis::Plugins::Echo::Session.for_record(self).destroy_all
+        end
       end
     end
 
diff --git a/engines/dradis-echo/spec/factories/messages.rb b/engines/dradis-echo/spec/factories/messages.rb
new file mode 100644
index 000000000..5a06146d0
--- /dev/null
+++ b/engines/dradis-echo/spec/factories/messages.rb
@@ -0,0 +1,13 @@
+FactoryBot.define do
+  factory :echo_message, class: 'Dradis::Plugins::Echo::Message' do
+    association :session, factory: :echo_session
+    role { :user }
+    content { 'Hello, Echo.' }
+
+    factory :assistant_message do
+      role { :assistant }
+      user { nil }
+      content { 'Hello back.' }
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/factories/sessions.rb b/engines/dradis-echo/spec/factories/sessions.rb
new file mode 100644
index 000000000..47c18ca56
--- /dev/null
+++ b/engines/dradis-echo/spec/factories/sessions.rb
@@ -0,0 +1,7 @@
+FactoryBot.define do
+  factory :echo_session, class: 'Dradis::Plugins::Echo::Session' do
+    agent
+    association :record, factory: :note
+    status { :idle }
+  end
+end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
new file mode 100644
index 000000000..6ee3f2c65
--- /dev/null
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
@@ -0,0 +1,83 @@
+require 'rails_helper'
+require File.expand_path('../../../../factories/providers', __dir__)
+require File.expand_path('../../../../factories/agents', __dir__)
+require File.expand_path('../../../../factories/sessions', __dir__)
+require File.expand_path('../../../../factories/messages', __dir__)
+
+describe Dradis::Plugins::Echo::Message do
+  describe 'relationships' do
+    it { should belong_to(:session) }
+    it { should belong_to(:parent).class_name('Dradis::Plugins::Echo::Message').optional }
+    it { should belong_to(:user).optional }
+  end
+
+  describe 'enums' do
+    it { should define_enum_for(:role).with_values(%i[user assistant]) }
+    it { should define_enum_for(:status).with_values(%i[complete streaming failed]) }
+
+    it 'defaults status to complete' do
+      expect(build(:echo_message).status).to eq('complete')
+    end
+  end
+
+  describe 'validations' do
+    it 'requires content when complete' do
+      message = build(:echo_message, status: :complete, content: nil)
+      expect(message).not_to be_valid
+      expect(message.errors[:content]).to be_present
+    end
+
+    it 'allows blank content while streaming' do
+      message = build(:assistant_message, status: :streaming, content: nil)
+      expect(message).to be_valid
+    end
+
+    it 'rejects a user on an assistant message' do
+      message = build(:assistant_message, user: create(:user))
+      expect(message).not_to be_valid
+      expect(message.errors[:user_id]).to be_present
+    end
+  end
+
+  describe 'user messages' do
+    it 'are forced to complete' do
+      message = create(:echo_message, role: :user, status: :streaming)
+      expect(message.status).to eq('complete')
+    end
+  end
+
+  describe 'metadata' do
+    it 'is stored as JSON' do
+      message = create(:echo_message, metadata: { 'model' => 'qwen2.5:14b' })
+      expect(message.reload.metadata).to eq('model' => 'qwen2.5:14b')
+    end
+  end
+
+  # Acceptance: the partial must render from `render partial:` with only a
+  # message: local — no controller context.
+  describe 'the _message partial' do
+    def render_message(message)
+      ApplicationController.render(
+        partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+        locals: { message: message }
+      )
+    end
+
+    it 'names the agent for assistant messages' do
+      message = create(:assistant_message)
+      expect(render_message(message)).to include(message.session.agent.name)
+    end
+
+    it 'names the author for user messages' do
+      user = create(:user)
+      message = create(:echo_message, user: user)
+      expect(render_message(message)).to include(user.name)
+    end
+
+    it "falls back to 'Deleted user' when the author is gone" do
+      message = create(:echo_message, user: create(:user))
+      message.update_column(:user_id, nil)
+      expect(render_message(message.reload)).to include('Deleted user')
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
new file mode 100644
index 000000000..e9ea98ca2
--- /dev/null
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -0,0 +1,102 @@
+require 'rails_helper'
+require File.expand_path('../../../../factories/providers', __dir__)
+require File.expand_path('../../../../factories/agents', __dir__)
+require File.expand_path('../../../../factories/sessions', __dir__)
+require File.expand_path('../../../../factories/messages', __dir__)
+
+describe Dradis::Plugins::Echo::Session do
+  describe 'relationships' do
+    it { should belong_to(:agent) }
+    it { should belong_to(:record) }
+    it { should belong_to(:user).optional }
+    it { should have_many(:messages).dependent(:destroy) }
+  end
+
+  describe 'enum' do
+    it 'defaults to idle' do
+      expect(build(:echo_session).status).to eq('idle')
+    end
+
+    it { should define_enum_for(:status).with_values(%i[idle generating]) }
+  end
+
+  # Issue descends from Note without STI, so the default polymorphic setter
+  # would store 'Note'. See Session#record= and Comment#commentable=.
+  describe 'record=' do
+    it 'stores an Issue as record_type Issue' do
+      issue = create(:issue)
+      session = create(:echo_session, record: issue)
+
+      expect(session.reload.record_type).to eq('Issue')
+      expect(session.record).to eq(issue)
+    end
+
+    it 'stores a Note as record_type Note' do
+      note = create(:note)
+      session = create(:echo_session, record: note)
+
+      expect(session.reload.record_type).to eq('Note')
+    end
+  end
+
+  describe '#project' do
+    it 'delegates to the record' do
+      note = create(:note)
+      session = create(:echo_session, record: note)
+
+      expect(session.project).to eq(note.project)
+    end
+  end
+
+  describe '#to_provider_messages' do
+    it 'returns role/content hashes ordered by creation' do
+      session = create(:echo_session)
+      create(:echo_message, session: session, role: :user, content: 'First')
+      create(:assistant_message, session: session, content: 'Second')
+
+      expect(session.to_provider_messages).to eq([
+        { role: 'user', content: 'First' },
+        { role: 'assistant', content: 'Second' }
+      ])
+    end
+  end
+
+  describe '.for_record' do
+    it 'matches an Issue by its forced Issue type' do
+      issue = create(:issue)
+      session = create(:echo_session, record: issue)
+      create(:echo_session, record: create(:note))
+
+      expect(described_class.for_record(issue)).to eq([session])
+    end
+  end
+
+  describe 'destroying the user' do
+    it 'nullifies the user on its sessions and messages' do
+      user = create(:user)
+      session = create(:echo_session, user: user)
+      message = create(:echo_message, session: session, user: user)
+
+      user.destroy
+
+      expect(session.reload.user_id).to be_nil
+      expect(message.reload.user_id).to be_nil
+    end
+  end
+
+  describe 'destroying the record' do
+    it 'destroys sessions attached to a destroyed Note' do
+      note = create(:note)
+      session = create(:echo_session, record: note)
+
+      expect { note.destroy }.to change { described_class.exists?(session.id) }.to(false)
+    end
+
+    it 'destroys sessions attached to a destroyed Issue' do
+      issue = create(:issue)
+      session = create(:echo_session, record: issue)
+
+      expect { issue.destroy }.to change { described_class.exists?(session.id) }.to(false)
+    end
+  end
+end

From cf09934cb92d4b9b58c36867b8e3dc92880e6483 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:04:36 +0100
Subject: [PATCH 05/57] Echo: align migration foreign_key hash keys for rubocop

Layout/HashAlignment: the foreign_key: continuation must align under the
first hash key (null:), or the Lint CI job fails.
---
 .../20260714000001_create_dradis_plugins_echo_sessions.rb   | 4 ++--
 .../20260714000002_create_dradis_plugins_echo_messages.rb   | 6 +++---
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb b/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
index 285eeeebe..54850df83 100644
--- a/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
+++ b/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
@@ -2,9 +2,9 @@ class CreateDradisPluginsEchoSessions < ActiveRecord::Migration[8.0]
   def change
     create_table :dradis_plugins_echo_sessions do |t|
       t.references :agent, null: false,
-        foreign_key: { to_table: :dradis_plugins_echo_agents }
+                           foreign_key: { to_table: :dradis_plugins_echo_agents }
       t.references :user, null: true,
-        foreign_key: { to_table: :users, on_delete: :nullify }
+                          foreign_key: { to_table: :users, on_delete: :nullify }
       t.references :record, polymorphic: true, null: false
 
       # 0 maps to the :idle enum value
diff --git a/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb b/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
index 7547b29ef..3c31ed180 100644
--- a/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
+++ b/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
@@ -2,12 +2,12 @@ class CreateDradisPluginsEchoMessages < ActiveRecord::Migration[8.0]
   def change
     create_table :dradis_plugins_echo_messages do |t|
       t.references :session, null: false,
-        foreign_key: { to_table: :dradis_plugins_echo_sessions }
+                             foreign_key: { to_table: :dradis_plugins_echo_sessions }
       # Self-referential parent, dormant until Slice 3 branches conversations.
       t.references :parent, null: true,
-        foreign_key: { to_table: :dradis_plugins_echo_messages }
+                            foreign_key: { to_table: :dradis_plugins_echo_messages }
       t.references :user, null: true,
-        foreign_key: { to_table: :users, on_delete: :nullify }
+                          foreign_key: { to_table: :users, on_delete: :nullify }
 
       # 0 maps to the :user role
       t.integer :role, default: 0, null: false

From 4969d63819de655b423226af59e5176beea820f3 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 01:03:36 +0100
Subject: [PATCH 06/57] Echo: cascade session cleanup via Sessionable concern
 not a Note monkeypatch

---
 .../dradis/plugins/echo/sessionable.rb        | 28 +++++++++++++++++++
 .../lib/dradis/plugins/echo/engine.rb         |  9 +++---
 .../dradis/plugins/echo/session_spec.rb       | 12 ++++++++
 3 files changed, 44 insertions(+), 5 deletions(-)
 create mode 100644 engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb

diff --git a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb
new file mode 100644
index 000000000..14ef80b1a
--- /dev/null
+++ b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb
@@ -0,0 +1,28 @@
+module Dradis::Plugins::Echo
+  # Gives a record (a Note, and by inheritance an Issue) an Echo sessions
+  # association that is cleaned up when the record is destroyed. Included into
+  # ::Note via the engine's on_load(:note_model) hook so Issue < Note inherits
+  # it; adding sessions to ContentBlock/Evidence later is a one-line include.
+  #
+  # Mirrors app/models/concerns/commentable.rb.
+  module Sessionable
+    extend ActiveSupport::Concern
+
+    included do
+      has_many :echo_sessions, as: :record,
+                               class_name: 'Dradis::Plugins::Echo::Session', dependent: :destroy
+
+      # FIXME - ISSUE/NOTE INHERITANCE
+      # Mirror Note's Comment/InlineThread/Subscription sweep (note.rb): when an
+      # Issue row is destroyed while loaded as a Note (e.g. a Pro project.notes
+      # cascade), it loads as Note so the polymorphic `dependent: :destroy` above
+      # misses its record_type: 'Issue' sessions. Do NOT guard on is_a?(Issue) --
+      # the loaded-as-Note case is exactly what this catches, and it is harmless
+      # for a genuine Note (a notes-row id is a Note-row or an Issue-row, never
+      # both). A genuine Issue is already covered by dependent: :destroy.
+      after_destroy do
+        Dradis::Plugins::Echo::Session.where(record_type: 'Issue', record_id: id).destroy_all
+      end
+    end
+  end
+end
diff --git a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
index 9cfe838aa..a951cc306 100644
--- a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
+++ b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
@@ -41,11 +41,10 @@ class Engine < ::Rails::Engine
 
     initializer 'echo.extend_note_model' do
       ActiveSupport.on_load :note_model do
-        # Sessions hang off a polymorphic record (a Note or Issue). Clean them
-        # up when the record is destroyed. Inherited by Issue < Note.
-        ::Note.send(:before_destroy) do
-          Dradis::Plugins::Echo::Session.for_record(self).destroy_all
-        end
+        # Sessions hang off a polymorphic record (a Note or Issue). The
+        # Sessionable concern owns the association and destroy cleanup;
+        # Issue < Note inherits it.
+        ::Note.include Dradis::Plugins::Echo::Sessionable
       end
     end
 
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index e9ea98ca2..ba8e3a18a 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -98,5 +98,17 @@
 
       expect { issue.destroy }.to change { described_class.exists?(session.id) }.to(false)
     end
+
+    # The gap the after_destroy sweep exists for: an Issue row destroyed while
+    # loaded as a Note (e.g. a Pro project.notes cascade). Loaded as Note, the
+    # polymorphic dependent: :destroy queries record_type 'Note' and misses the
+    # session, so the record_type 'Issue' sweep has to catch it.
+    it 'destroys record_type Issue sessions when the Issue row is destroyed loaded as a Note' do
+      issue = create(:issue)
+      session = create(:echo_session, record: issue)
+      note = Note.find(issue.id)
+
+      expect { note.destroy }.to change { described_class.exists?(session.id) }.to(false)
+    end
   end
 end

From c972bb447579a3063dad1ba443983262970285bb Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 15:57:54 +0100
Subject: [PATCH 07/57] Echo: apply PR #1649 Slice-2 review resolutions
 (aapomm)

Move the record_type 'Issue' after_destroy sweep out of the shared Sessionable
concern and into the Note-only on_load(:note_model) wiring in engine.rb, right
after ::Note.include Sessionable. Hardcoding 'Issue' in the shared concern would
let a future host (Evidence/ContentBlock, independent id sequences) delete an
unrelated Issue #N's sessions on destroy.

- Message: before_validation :complete_user_messages, if: :user? (drop the
  internal user? guard).
- Session#project: delegate :project, to: :record.
- Session.for_record: comment why where(record: record) misses forced 'Issue'
  rows.
- Specs: keep the loaded-as-Note sweep coverage (now against the relocated
  callback) and add a guard proving a non-Note Sessionable host destroy leaves
  unrelated Issue sessions intact.
---
 .../dradis/plugins/echo/sessionable.rb        | 12 --------
 .../app/models/dradis/plugins/echo/message.rb |  4 +--
 .../app/models/dradis/plugins/echo/session.rb |  9 +++---
 .../lib/dradis/plugins/echo/engine.rb         | 18 +++++++++--
 .../dradis/plugins/echo/session_spec.rb       | 30 ++++++++++++++++---
 5 files changed, 49 insertions(+), 24 deletions(-)

diff --git a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb
index 14ef80b1a..977adaebd 100644
--- a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb
+++ b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/sessionable.rb
@@ -11,18 +11,6 @@ module Sessionable
     included do
       has_many :echo_sessions, as: :record,
                                class_name: 'Dradis::Plugins::Echo::Session', dependent: :destroy
-
-      # FIXME - ISSUE/NOTE INHERITANCE
-      # Mirror Note's Comment/InlineThread/Subscription sweep (note.rb): when an
-      # Issue row is destroyed while loaded as a Note (e.g. a Pro project.notes
-      # cascade), it loads as Note so the polymorphic `dependent: :destroy` above
-      # misses its record_type: 'Issue' sessions. Do NOT guard on is_a?(Issue) --
-      # the loaded-as-Note case is exactly what this catches, and it is harmless
-      # for a genuine Note (a notes-row id is a Note-row or an Issue-row, never
-      # both). A genuine Issue is already covered by dependent: :destroy.
-      after_destroy do
-        Dradis::Plugins::Echo::Session.where(record_type: 'Issue', record_id: id).destroy_all
-      end
     end
   end
 end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
index 22bfb3b76..bfd297a9c 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
@@ -12,7 +12,7 @@ class Message < ApplicationRecord
 
     # -- Callbacks ------------------------------------------------------------
     # User messages are authored in full, so they're never mid-stream.
-    before_validation :complete_user_messages
+    before_validation :complete_user_messages, if: :user?
 
     after_create_commit :broadcast_created
 
@@ -35,7 +35,7 @@ def broadcast_created
     end
 
     def complete_user_messages
-      self.status = :complete if user?
+      self.status = :complete
     end
   end
 end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 060e7e447..a8b4102f6 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -8,7 +8,12 @@ class Session < ApplicationRecord
     belongs_to :user, optional: true
     has_many :messages, dependent: :destroy
 
+    delegate :project, to: :record
+
     # -- Scopes ---------------------------------------------------------------
+    # Can't use where(record: record): Rails builds record_type from the
+    # polymorphic_name ('Note') for an Issue, missing the forced 'Issue' rows.
+    # See record_type_for / the record= override below.
     scope :for_record, ->(record) {
       where(record_type: record_type_for(record), record_id: record.id)
     }
@@ -22,10 +27,6 @@ def self.record_type_for(record)
     end
 
     # -- Instance Methods -----------------------------------------------------
-    def project
-      record.project
-    end
-
     def to_provider_messages
       messages.order(:created_at, :id).map do |message|
         { role: message.role, content: message.content }
diff --git a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
index a951cc306..91e45a90d 100644
--- a/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
+++ b/engines/dradis-echo/lib/dradis/plugins/echo/engine.rb
@@ -42,9 +42,23 @@ class Engine < ::Rails::Engine
     initializer 'echo.extend_note_model' do
       ActiveSupport.on_load :note_model do
         # Sessions hang off a polymorphic record (a Note or Issue). The
-        # Sessionable concern owns the association and destroy cleanup;
-        # Issue < Note inherits it.
+        # Sessionable concern owns the association; Issue < Note inherits it.
         ::Note.include Dradis::Plugins::Echo::Sessionable
+
+        # FIXME - ISSUE/NOTE INHERITANCE
+        # Mirror Note's Comment/InlineThread/Subscription sweep (note.rb): when an
+        # Issue row is destroyed while loaded as a Note (e.g. a Pro project.notes
+        # cascade), it loads as Note so the polymorphic `dependent: :destroy` on the
+        # Sessionable association misses its record_type: 'Issue' sessions. Do NOT
+        # guard on is_a?(Issue) -- the loaded-as-Note case is exactly what this
+        # catches, and it is harmless for a genuine Note (a notes-row id is a
+        # Note-row or an Issue-row, never both). A genuine Issue is already covered
+        # by dependent: :destroy. This lives here, on Note only, rather than in the
+        # shared Sessionable concern: a future host (Evidence/ContentBlock, with its
+        # own id sequence) must not delete an unrelated Issue #N's sessions.
+        ::Note.after_destroy do
+          Dradis::Plugins::Echo::Session.where(record_type: 'Issue', record_id: id).destroy_all
+        end
       end
     end
 
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index ba8e3a18a..97f1b4357 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -99,10 +99,10 @@
       expect { issue.destroy }.to change { described_class.exists?(session.id) }.to(false)
     end
 
-    # The gap the after_destroy sweep exists for: an Issue row destroyed while
-    # loaded as a Note (e.g. a Pro project.notes cascade). Loaded as Note, the
-    # polymorphic dependent: :destroy queries record_type 'Note' and misses the
-    # session, so the record_type 'Issue' sweep has to catch it.
+    # The gap the Note-only after_destroy sweep (engine.rb) exists for: an Issue
+    # row destroyed while loaded as a Note (e.g. a Pro project.notes cascade).
+    # Loaded as Note, the polymorphic dependent: :destroy queries record_type
+    # 'Note' and misses the session, so the record_type 'Issue' sweep catches it.
     it 'destroys record_type Issue sessions when the Issue row is destroyed loaded as a Note' do
       issue = create(:issue)
       session = create(:echo_session, record: issue)
@@ -110,5 +110,27 @@
 
       expect { note.destroy }.to change { described_class.exists?(session.id) }.to(false)
     end
+
+    # Guards the bug fix: the Issue sweep lives on Note only (engine.rb), not in
+    # the shared Sessionable concern. A future host with its own id sequence must
+    # not delete an unrelated Issue #N's sessions. Model that host on the
+    # categories table, sharing an id with a real Issue so the old in-concern
+    # sweep would have wrongly deleted the Issue's session.
+    it 'leaves unrelated Issue sessions alone when a non-Note Sessionable host is destroyed' do
+      issue = create(:issue)
+      issue_session = create(:echo_session, record: issue)
+
+      host_class = Class.new(ApplicationRecord) do
+        self.table_name = 'categories'
+        def self.name = 'EchoSessionableTestHost'
+        include Dradis::Plugins::Echo::Sessionable
+      end
+      # Force the host to share the Issue's id: the old in-concern sweep keyed on
+      # record_id: id, so a same-id host would have wrongly deleted the session.
+      host_class.where(id: issue.id).delete_all
+      host = host_class.create!(id: issue.id, name: 'echo-sessionable-host')
+
+      expect { host.destroy }.not_to change { described_class.exists?(issue_session.id) }
+    end
   end
 end

From 03498bf1669ebf5bb5fea8c202cc3d6320452b32 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 12:37:04 +0100
Subject: [PATCH 08/57] Echo: apply caitmich Slice-2 review (SEC-571 Part A)

- Message: require user_id on user messages (symmetric to the
  assistant absence rule) so a nil user_id means a genuine delete;
  dependent: :nullify bypasses it via update_all.
- Session#record=: reuse record_type_for as the single source of
  truth, guarded on new_record (record_type_for(nil) raises).
- Reorder the record= FIXME above its explanation; trim the
  _message locals note; migration parent note -> dormant.
- Rename migrations to CreateSessions / CreateMessages (files and
  classes; timestamps unchanged) and drop the redundant null: true
  on the user references.
- Add the user association to the base echo_message factory.
---
 .../dradis-echo/app/models/dradis/plugins/echo/message.rb  | 3 +++
 .../dradis-echo/app/models/dradis/plugins/echo/session.rb  | 6 +++---
 .../echo/projects/sessions/messages/_message.html.erb      | 2 +-
 ..._echo_sessions.rb => 20260714000001_create_sessions.rb} | 5 ++---
 ..._echo_messages.rb => 20260714000002_create_messages.rb} | 7 +++----
 engines/dradis-echo/spec/factories/messages.rb             | 1 +
 6 files changed, 13 insertions(+), 11 deletions(-)
 rename engines/dradis-echo/db/migrate/{20260714000001_create_dradis_plugins_echo_sessions.rb => 20260714000001_create_sessions.rb} (70%)
 rename engines/dradis-echo/db/migrate/{20260714000002_create_dradis_plugins_echo_messages.rb => 20260714000002_create_messages.rb} (70%)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
index bfd297a9c..997b75065 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
@@ -20,6 +20,9 @@ class Message < ApplicationRecord
     validates :content, presence: true, if: :complete?
     # Assistant messages are generated by the agent, never a user.
     validates :user_id, absence: true, if: :assistant?
+    # A user message with no user_id was genuinely deleted, so require it on
+    # create; a later nullify (dependent: :nullify) is what marks the deletion.
+    validates :user_id, presence: true, if: :user?
 
     # -- Instance Methods -----------------------------------------------------
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index a8b4102f6..5d1b13251 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -33,15 +33,15 @@ def to_provider_messages
       end
     end
 
+    # FIXME - ISSUE/NOTE INHERITANCE
+    #
     # Because Issue descends from Note but doesn't use STI, Rails's default
     # polymorphic setter stores 'Note' when you assign an Issue. Force 'Issue'
     # here so the record loads back as the right class. Mirrors
     # Comment#commentable= (app/models/comment.rb).
-    #
-    # FIXME - ISSUE/NOTE INHERITANCE
     def record=(new_record)
       super
-      self.record_type = 'Issue' if new_record.is_a?(Issue)
+      self.record_type = self.class.record_type_for(new_record) if new_record
       new_record
     end
   end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index 07404f4af..9554bedcf 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -1,5 +1,5 @@
 <%# locals: (message:) -%>
-<%# Minimal render — Slice 5 restyles. Must render from `render partial:` with %>
+<%# Minimal render. Must render from `render partial:` with %>
 <%# only `message:` in locals, so no controller-context helpers here. %>
 <div id="<%= dom_id(message) %>" class="echo-message echo-message-<%= message.role %>" data-status="<%= message.status %>">
   <p class="echo-message-author">
diff --git a/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb b/engines/dradis-echo/db/migrate/20260714000001_create_sessions.rb
similarity index 70%
rename from engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
rename to engines/dradis-echo/db/migrate/20260714000001_create_sessions.rb
index 54850df83..448504391 100644
--- a/engines/dradis-echo/db/migrate/20260714000001_create_dradis_plugins_echo_sessions.rb
+++ b/engines/dradis-echo/db/migrate/20260714000001_create_sessions.rb
@@ -1,10 +1,9 @@
-class CreateDradisPluginsEchoSessions < ActiveRecord::Migration[8.0]
+class CreateSessions < ActiveRecord::Migration[8.0]
   def change
     create_table :dradis_plugins_echo_sessions do |t|
       t.references :agent, null: false,
                            foreign_key: { to_table: :dradis_plugins_echo_agents }
-      t.references :user, null: true,
-                          foreign_key: { to_table: :users, on_delete: :nullify }
+      t.references :user, foreign_key: { to_table: :users, on_delete: :nullify }
       t.references :record, polymorphic: true, null: false
 
       # 0 maps to the :idle enum value
diff --git a/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb b/engines/dradis-echo/db/migrate/20260714000002_create_messages.rb
similarity index 70%
rename from engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
rename to engines/dradis-echo/db/migrate/20260714000002_create_messages.rb
index 3c31ed180..57e335732 100644
--- a/engines/dradis-echo/db/migrate/20260714000002_create_dradis_plugins_echo_messages.rb
+++ b/engines/dradis-echo/db/migrate/20260714000002_create_messages.rb
@@ -1,13 +1,12 @@
-class CreateDradisPluginsEchoMessages < ActiveRecord::Migration[8.0]
+class CreateMessages < ActiveRecord::Migration[8.0]
   def change
     create_table :dradis_plugins_echo_messages do |t|
       t.references :session, null: false,
                              foreign_key: { to_table: :dradis_plugins_echo_sessions }
-      # Self-referential parent, dormant until Slice 3 branches conversations.
+      # Self-referential parent, dormant.
       t.references :parent, null: true,
                             foreign_key: { to_table: :dradis_plugins_echo_messages }
-      t.references :user, null: true,
-                          foreign_key: { to_table: :users, on_delete: :nullify }
+      t.references :user, foreign_key: { to_table: :users, on_delete: :nullify }
 
       # 0 maps to the :user role
       t.integer :role, default: 0, null: false
diff --git a/engines/dradis-echo/spec/factories/messages.rb b/engines/dradis-echo/spec/factories/messages.rb
index 5a06146d0..9dd84c641 100644
--- a/engines/dradis-echo/spec/factories/messages.rb
+++ b/engines/dradis-echo/spec/factories/messages.rb
@@ -1,6 +1,7 @@
 FactoryBot.define do
   factory :echo_message, class: 'Dradis::Plugins::Echo::Message' do
     association :session, factory: :echo_session
+    user
     role { :user }
     content { 'Hello, Echo.' }
 

From cf88f494e505c5860a684c8558e30be5a6817302 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:21:05 +0100
Subject: [PATCH 09/57] Echo: replace InteractionJob with ReplyJob and
 generation state machine

ReplyJob streams an assistant reply into a persisted message, strips thinking blocks, records model/provider metadata, then serialises: re-enqueue if the user spoke again mid-generation, else flip the session idle and broadcast the composer state. Session#request_reply! is the idle->generating lock gate with stuck-generation recovery.
---
 .../dradis/plugins/echo/interaction_job.rb    |  32 -----
 .../app/jobs/dradis/plugins/echo/reply_job.rb | 113 ++++++++++++++++++
 .../app/models/dradis/plugins/echo/session.rb |  57 +++++++++
 .../sessions/_composer_state.html.erb         |  11 ++
 .../sessions/messages/_message.html.erb       |   3 +-
 5 files changed, 183 insertions(+), 33 deletions(-)
 delete mode 100644 engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
 create mode 100644 engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb

diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
deleted file mode 100644
index 0a358f50e..000000000
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-module Dradis::Plugins::Echo
-  class InteractionJob < ApplicationJob
-    queue_as :dradis_project
-
-    def perform(agent_id:, prompt:, interaction_id:, response_id:)
-      agent = Agent.find(agent_id)
-      raise "Agent '#{agent.name}' is not enabled" unless agent.enabled?
-
-      spinner_shown = true
-
-      agent.provider.generate(prompt: prompt, model: agent.model_override) do |chunk|
-        if spinner_shown
-          Turbo::StreamsChannel.broadcast_remove_to [interaction_id, 'prompts'], target: "#{response_id}_spinner"
-          spinner_shown = false
-        end
-
-        Turbo::StreamsChannel.broadcast_append_to(
-          [interaction_id, 'prompts'],
-          target: response_id,
-          content: ERB::Util.html_escape(chunk)
-        )
-      end
-
-      Turbo::StreamsChannel.broadcast_append_to [interaction_id, 'prompts'], target: 'messages', html: '<p>Done.</p>'
-    rescue => e
-      msg = '<div class="alert alert-danger m-0">'
-      msg << ERB::Util.html_escape(e.message)
-      msg << '</div>'
-      Turbo::StreamsChannel.broadcast_update_to [interaction_id, 'prompts'], target: response_id, html: msg
-    end
-  end
-end
diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
new file mode 100644
index 000000000..e219e22e6
--- /dev/null
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
@@ -0,0 +1,113 @@
+module Dradis::Plugins::Echo
+  class ReplyJob < ApplicationJob
+    queue_as :dradis_project
+
+    # Generates one assistant reply for a session: it streams the provider
+    # response into a `streaming` message, persists the final text as
+    # `complete` with model/provider metadata, then serializes — re-enqueueing
+    # itself if the user spoke again mid-generation, or flipping the session
+    # back to `idle`. Session#request_reply! owns the idle->generating gate.
+    def perform(session)
+      agent = session.agent
+      raise "Agent '#{agent.name}' is not enabled" unless agent.enabled?
+
+      cutoff_id = session.messages.maximum(:id).to_i
+      context = session.to_provider_messages
+      message = session.messages.create!(role: :assistant, status: :streaming)
+
+      text, duration_ms = stream_reply(agent, session, message, context)
+
+      complete(agent, message, text, duration_ms)
+      serialize(session, cutoff_id)
+    rescue => e
+      fail_message(session, message, e)
+    end
+
+    private
+
+    def stream_reply(agent, session, message, context)
+      buffer = +''
+      started = clock
+
+      agent.provider.generate(messages: context, model: agent.model_override) do |chunk|
+        buffer << chunk
+        broadcast_chunk(session, message, chunk)
+      end
+
+      [buffer, ((clock - started) * 1000).round]
+    end
+
+    def broadcast_chunk(session, message, chunk)
+      Turbo::StreamsChannel.broadcast_append_to(
+        [session, :messages],
+        target: ActionView::RecordIdentifier.dom_id(message, :content),
+        content: ERB::Util.html_escape(chunk)
+      )
+    end
+
+    def complete(agent, message, text, duration_ms)
+      message.update!(
+        content: strip_thinking(text),
+        status: :complete,
+        metadata: message.metadata.merge(
+          'duration_ms' => duration_ms,
+          'model' => agent.model_override.presence || agent.provider.model,
+          'provider' => agent.provider.type_name
+        )
+      )
+      broadcast_message(message)
+    end
+
+    # Providers surface their reasoning either as raw <think></think> tags or,
+    # for Ollama, as the {thinking}{/thinking} markers Provider::Ollama swaps
+    # them for. Neither belongs in the persisted answer, so drop the blocks
+    # and any stray markers before saving.
+    def strip_thinking(text)
+      text
+        .gsub(/\{thinking\}.*?\{\/thinking\}/m, '')
+        .gsub(/<think>.*?<\/think>/m, '')
+        .gsub(/\{\/?thinking\}/, '')
+        .gsub(/<\/?think>/, '')
+        .strip
+    end
+
+    # Under a lock so it can't race the controller flipping idle<->generating:
+    # if a user message landed after the reply started (id past the cutoff),
+    # answer it too by re-enqueueing; otherwise release the session to idle.
+    def serialize(session, cutoff_id)
+      session.with_lock do
+        if session.messages.where(role: :user).where('id > ?', cutoff_id).exists?
+          self.class.perform_later(session)
+        else
+          session.update!(status: :idle)
+          session.broadcast_composer_state
+        end
+      end
+    end
+
+    def fail_message(session, message, error)
+      if message
+        message.update!(
+          status: :failed,
+          metadata: message.metadata.merge('error' => error.message)
+        )
+        broadcast_message(message)
+      end
+
+      session.with_lock { session.update!(status: :idle) }
+      session.broadcast_composer_state
+    end
+
+    def broadcast_message(message)
+      message.broadcast_replace_to(
+        [message.session, :messages],
+        partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+        locals: { message: message }
+      )
+    end
+
+    def clock
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 5d1b13251..74f4f9f0f 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -1,5 +1,9 @@
 module Dradis::Plugins::Echo
   class Session < ApplicationRecord
+    # Beyond the provider read timeout a still-streaming message can only be the
+    # debris of a crashed job, so we allow this much slack before reclaiming it.
+    STUCK_MARGIN = 30.seconds
+
     enum :status, %i[idle generating], default: :idle
 
     # -- Relationships --------------------------------------------------------
@@ -27,6 +31,42 @@ def self.record_type_for(record)
     end
 
     # -- Instance Methods -----------------------------------------------------
+    # Broadcasts the composer partial so the browser reflects the current
+    # idle/generating state. Called on every idle<->generating transition.
+    def broadcast_composer_state
+      broadcast_replace_to(
+        [self, :composer_state],
+        target: ActionView::RecordIdentifier.dom_id(self, :composer_state),
+        partial: 'dradis/plugins/echo/projects/sessions/composer_state',
+        locals: { session: self }
+      )
+    end
+
+    def project
+      record.project
+    end
+
+    # The gate in front of ReplyJob: flips idle->generating and enqueues exactly
+    # one job. A no-op while already generating, so repeated calls (a user
+    # sending several messages) never double-enqueue — the running job re-checks
+    # for newer messages when it finishes. A generation whose streaming message
+    # has gone stale is treated as dead and reclaimed first.
+    def request_reply!
+      enqueue = false
+
+      with_lock do
+        reclaim_stuck_generation! if generating?
+
+        if idle?
+          update!(status: :generating)
+          broadcast_composer_state
+          enqueue = true
+        end
+      end
+
+      ReplyJob.perform_later(self) if enqueue
+    end
+
     def to_provider_messages
       messages.order(:created_at, :id).map do |message|
         { role: message.role, content: message.content }
@@ -44,5 +84,22 @@ def record=(new_record)
       self.record_type = self.class.record_type_for(new_record) if new_record
       new_record
     end
+
+    private
+
+    # A crashed ReplyJob leaves the session locked in `generating` with an
+    # orphaned streaming message. Once that message hasn't been touched past the
+    # provider read timeout (plus a margin), fail it and release the session so
+    # the next request_reply! can start fresh.
+    def reclaim_stuck_generation!
+      threshold = Provider::HttpStreaming::READ_TIMEOUT.seconds.ago - STUCK_MARGIN
+      stuck = messages.where(role: :assistant, status: :streaming).where(updated_at: ..threshold)
+      return unless stuck.exists?
+
+      stuck.find_each do |message|
+        message.update!(status: :failed, metadata: message.metadata.merge('error' => 'interrupted'))
+      end
+      update!(status: :idle)
+    end
   end
 end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
new file mode 100644
index 000000000..68db682c4
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -0,0 +1,11 @@
+<%# locals: (session:) -%>
+<%# Broadcast on every idle<->generating transition (Session#broadcast_composer_state). %>
+<%# Route-free and locals-only so it renders from ReplyJob. Slice 4 wires the %>
+<%# composer form; here we only reflect whether a reply is in flight. %>
+<div id="<%= dom_id(session, :composer_state) %>" data-behavior="echo-composer-state" data-generating="<%= session.generating? %>">
+  <% if session.generating? %>
+    <span class="echo-composer-status" data-behavior="echo-composer-generating">Generating…</span>
+  <% else %>
+    <span class="echo-composer-status" data-behavior="echo-composer-idle">Ready</span>
+  <% end %>
+</div>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index 9554bedcf..5cbf37b2f 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -12,7 +12,8 @@
     <% end %>
   </p>
 
-  <div class="echo-message-content"><%= message.content %></div>
+  <%# ReplyJob streams chunks into this container by dom_id(message, :content). %>
+  <div id="<%= dom_id(message, :content) %>" class="echo-message-content"><%= message.content %></div>
 
   <% if message.streaming? %>
     <span class="echo-message-spinner" data-behavior="echo-message-spinner"></span>

From e659993a27a4d50f67f0e7f732b777950528465b Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Tue, 14 Jul 2026 18:21:05 +0100
Subject: [PATCH 10/57] Echo: spec ReplyJob and Session#request_reply! locking

---
 .../plugins/echo/interaction_job_spec.rb      |  70 ---------
 .../dradis/plugins/echo/reply_job_spec.rb     | 140 ++++++++++++++++++
 .../dradis/plugins/echo/session_spec.rb       |  51 +++++++
 3 files changed, 191 insertions(+), 70 deletions(-)
 delete mode 100644 engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
 create mode 100644 engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb

diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
deleted file mode 100644
index 9827e9a81..000000000
--- a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
+++ /dev/null
@@ -1,70 +0,0 @@
-require 'rails_helper'
-require File.expand_path('../../../../factories/agents', __dir__)
-require File.expand_path('../../../../factories/providers', __dir__)
-
-describe Dradis::Plugins::Echo::InteractionJob do
-  let(:interaction_id) { 'project-1' }
-  let(:response_id)    { 'response-1' }
-  let(:prompt)         { 'Summarise this issue.' }
-  let(:agent)          { create(:system_agent) }
-
-  def perform
-    described_class.perform_now(
-      agent_id: agent.id,
-      prompt: prompt,
-      interaction_id: interaction_id,
-      response_id: response_id
-    )
-  end
-
-  before do
-    allow(Turbo::StreamsChannel).to receive(:broadcast_append_to)
-    allow(Turbo::StreamsChannel).to receive(:broadcast_remove_to)
-    allow(Turbo::StreamsChannel).to receive(:broadcast_update_to)
-  end
-
-  describe 'when agent is not enabled' do
-    before { agent.update!(enabled: false) }
-
-    it 'broadcasts a user-friendly error' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
-        expect(kwargs[:html]).to include('is not enabled')
-      end
-    end
-  end
-
-  describe 'error message sanitisation' do
-    it 'HTML-escapes the error message before broadcasting' do
-      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
-        .to receive(:generate).and_raise('<script>alert(1)</script>')
-
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
-        expect(kwargs[:html]).to include('&lt;script&gt;')
-        expect(kwargs[:html]).not_to include('<script>')
-      end
-    end
-  end
-
-  describe 'successful streaming' do
-    before do
-      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
-        .to receive(:generate).and_yield('Hello ').and_yield('world')
-    end
-
-    it 'removes the spinner on the first chunk' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_remove_to)
-        .with([interaction_id, 'prompts'], target: "#{response_id}_spinner")
-    end
-
-    it 'broadcasts each chunk to the response target' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([interaction_id, 'prompts'], target: response_id, content: 'Hello ')
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([interaction_id, 'prompts'], target: response_id, content: 'world')
-    end
-  end
-end
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
new file mode 100644
index 000000000..0f1ed52f6
--- /dev/null
+++ b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
@@ -0,0 +1,140 @@
+require 'rails_helper'
+require File.expand_path('../../../../factories/providers', __dir__)
+require File.expand_path('../../../../factories/agents', __dir__)
+require File.expand_path('../../../../factories/sessions', __dir__)
+require File.expand_path('../../../../factories/messages', __dir__)
+
+describe Dradis::Plugins::Echo::ReplyJob do
+  let(:agent) { create(:agent) }
+  let(:session) { create(:echo_session, agent: agent) }
+
+  def stub_stream(*chunks)
+    allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+      .to receive(:generate) do |_provider, **_kwargs, &block|
+        chunks.each { |chunk| block.call(chunk) }
+      end
+  end
+
+  def perform
+    described_class.perform_now(session)
+  end
+
+  before do
+    create(:echo_message, session: session, role: :user, content: 'Summarise this issue.')
+    allow(Turbo::StreamsChannel).to receive(:broadcast_append_to)
+    allow(Turbo::StreamsChannel).to receive(:broadcast_replace_to)
+    allow_any_instance_of(Dradis::Plugins::Echo::Session).to receive(:broadcast_composer_state)
+  end
+
+  describe 'a successful reply' do
+    before { stub_stream('Hello ', 'world') }
+
+    it 'creates an assistant message and persists the streamed text as complete' do
+      expect { perform }.to change { session.messages.assistant.count }.by(1)
+
+      message = session.messages.assistant.last
+      expect(message).to be_complete
+      expect(message.content).to eq('Hello world')
+    end
+
+    it 'records model and provider metadata' do
+      perform
+      metadata = session.messages.assistant.last.metadata
+
+      expect(metadata['model']).to eq(agent.provider.model)
+      expect(metadata['provider']).to eq('Ollama')
+      expect(metadata['duration_ms']).to be_a(Integer)
+    end
+
+    it 'streams each chunk to the message content target' do
+      perform
+      target = ActionView::RecordIdentifier.dom_id(session.messages.assistant.last, :content)
+
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
+        .with([session, :messages], target: target, content: 'Hello ')
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
+        .with([session, :messages], target: target, content: 'world')
+    end
+
+    it 'releases the session back to idle' do
+      perform
+      expect(session.reload).to be_idle
+    end
+
+    it 'broadcasts the composer state when it returns to idle' do
+      expect_any_instance_of(Dradis::Plugins::Echo::Session)
+        .to receive(:broadcast_composer_state)
+      perform
+    end
+  end
+
+  describe 'stripping reasoning blocks' do
+    it "removes Ollama's {thinking} markers from the persisted content" do
+      stub_stream('{thinking}I should be brief.{/thinking}', 'The answer is 42.')
+      perform
+      expect(session.messages.assistant.last.content).to eq('The answer is 42.')
+    end
+
+    it 'removes raw <think> blocks' do
+      stub_stream('<think>reasoning</think>Final.')
+      perform
+      content = session.messages.assistant.last.content
+      expect(content).to eq('Final.')
+      expect(content).not_to include('think')
+    end
+  end
+
+  describe 'serialising a mid-generation message' do
+    before { stub_stream('Answer.') }
+
+    it 're-enqueues itself once when a user message arrived after the cutoff' do
+      allow(described_class).to receive(:perform_later)
+      # request_reply! has already flipped the session to generating.
+      session.update!(status: :generating)
+
+      # Simulate the user speaking again while the reply streamed.
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate) do |_provider, **_kwargs, &block|
+          create(:echo_message, session: session, role: :user, content: 'And again?')
+          block.call('Answer.')
+        end
+
+      perform
+
+      expect(described_class).to have_received(:perform_later).with(session).once
+      # Stays generating (no idle flip) so the re-enqueued job keeps the lock.
+      expect(session.reload).to be_generating
+    end
+  end
+
+  describe 'when the agent is not enabled' do
+    before { agent.update!(enabled: false) }
+
+    it 'does not create an assistant message and resets to idle' do
+      session.update!(status: :generating)
+      expect { perform }.not_to change { session.messages.assistant.count }
+      expect(session.reload).to be_idle
+    end
+  end
+
+  describe 'when the provider raises' do
+    before do
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate).and_raise('provider exploded')
+      session.update!(status: :generating)
+    end
+
+    it 'marks the assistant message failed with the error in metadata' do
+      perform
+      message = session.messages.assistant.last
+
+      expect(message).to be_failed
+      expect(message.metadata['error']).to eq('provider exploded')
+    end
+
+    it 'resets the session to idle' do
+      perform
+      expect(session.reload).to be_idle
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index 97f1b4357..d5b901fea 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -84,6 +84,57 @@
     end
   end
 
+  describe '#request_reply!' do
+    let(:session) { create(:echo_session) }
+
+    before do
+      allow(Dradis::Plugins::Echo::ReplyJob).to receive(:perform_later)
+      allow_any_instance_of(described_class).to receive(:broadcast_composer_state)
+    end
+
+    it 'flips an idle session to generating and enqueues one reply' do
+      expect { session.request_reply! }
+        .to change { session.reload.status }.from('idle').to('generating')
+      expect(Dradis::Plugins::Echo::ReplyJob)
+        .to have_received(:perform_later).with(session).once
+    end
+
+    it 'broadcasts the composer state on the idle->generating transition' do
+      expect(session).to receive(:broadcast_composer_state)
+      session.request_reply!
+    end
+
+    it 'does not double-enqueue while already generating' do
+      session.request_reply!
+      session.request_reply!
+      expect(Dradis::Plugins::Echo::ReplyJob).to have_received(:perform_later).once
+    end
+
+    context 'with a stale generating lock' do
+      let(:read_timeout) { Dradis::Plugins::Echo::Provider::HttpStreaming::READ_TIMEOUT.seconds }
+
+      before { session.update!(status: :generating) }
+
+      it 'reclaims a streaming message stuck past the read timeout and re-enqueues' do
+        stale = create(:assistant_message, session: session, status: :streaming, content: nil)
+        stale.update_column(:updated_at, (read_timeout + described_class::STUCK_MARGIN + 1.minute).ago)
+
+        session.request_reply!
+
+        expect(session.reload).to be_generating
+        expect(stale.reload).to be_failed
+        expect(stale.metadata['error']).to eq('interrupted')
+        expect(Dradis::Plugins::Echo::ReplyJob).to have_received(:perform_later).once
+      end
+
+      it 'leaves a fresh generating lock alone' do
+        create(:assistant_message, session: session, status: :streaming, content: nil)
+        session.request_reply!
+        expect(Dradis::Plugins::Echo::ReplyJob).not_to have_received(:perform_later)
+      end
+    end
+  end
+
   describe 'destroying the record' do
     it 'destroys sessions attached to a destroyed Note' do
       note = create(:note)

From a93d4de04d4d74378f04457549cdb4d7a7d8b788 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 11:53:14 +0100
Subject: [PATCH 11/57] Echo: keep InteractionJob alongside ReplyJob this slice

InteractionsController#create is a live, UI-wired route that still calls InteractionJob, so deleting it here 500s the shipping Roslin panel. Per CTO plan rev 7 (Path C), Slice 3 ships ReplyJob additively; the interactions teardown + provider prompt: sugar removal move to SEC-498, sequenced behind the Slice 5 replacement panel.
---
 .../dradis/plugins/echo/interaction_job.rb    | 32 +++++++++
 .../plugins/echo/interaction_job_spec.rb      | 70 +++++++++++++++++++
 2 files changed, 102 insertions(+)
 create mode 100644 engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
 create mode 100644 engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb

diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
new file mode 100644
index 000000000..0a358f50e
--- /dev/null
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
@@ -0,0 +1,32 @@
+module Dradis::Plugins::Echo
+  class InteractionJob < ApplicationJob
+    queue_as :dradis_project
+
+    def perform(agent_id:, prompt:, interaction_id:, response_id:)
+      agent = Agent.find(agent_id)
+      raise "Agent '#{agent.name}' is not enabled" unless agent.enabled?
+
+      spinner_shown = true
+
+      agent.provider.generate(prompt: prompt, model: agent.model_override) do |chunk|
+        if spinner_shown
+          Turbo::StreamsChannel.broadcast_remove_to [interaction_id, 'prompts'], target: "#{response_id}_spinner"
+          spinner_shown = false
+        end
+
+        Turbo::StreamsChannel.broadcast_append_to(
+          [interaction_id, 'prompts'],
+          target: response_id,
+          content: ERB::Util.html_escape(chunk)
+        )
+      end
+
+      Turbo::StreamsChannel.broadcast_append_to [interaction_id, 'prompts'], target: 'messages', html: '<p>Done.</p>'
+    rescue => e
+      msg = '<div class="alert alert-danger m-0">'
+      msg << ERB::Util.html_escape(e.message)
+      msg << '</div>'
+      Turbo::StreamsChannel.broadcast_update_to [interaction_id, 'prompts'], target: response_id, html: msg
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
new file mode 100644
index 000000000..b7e3cf0ad
--- /dev/null
+++ b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
@@ -0,0 +1,70 @@
+require 'rails_helper'
+require File.expand_path('../../../../factories/agents', __dir__)
+require File.expand_path('../../../../factories/providers', __dir__)
+
+describe Dradis::Plugins::Echo::InteractionJob do
+  let(:interaction_id) { 'project-1' }
+  let(:response_id) { 'response-1' }
+  let(:prompt) { 'Summarise this issue.' }
+  let(:agent) { create(:system_agent) }
+
+  def perform
+    described_class.perform_now(
+      agent_id: agent.id,
+      prompt: prompt,
+      interaction_id: interaction_id,
+      response_id: response_id
+    )
+  end
+
+  before do
+    allow(Turbo::StreamsChannel).to receive(:broadcast_append_to)
+    allow(Turbo::StreamsChannel).to receive(:broadcast_remove_to)
+    allow(Turbo::StreamsChannel).to receive(:broadcast_update_to)
+  end
+
+  describe 'when agent is not enabled' do
+    before { agent.update!(enabled: false) }
+
+    it 'broadcasts a user-friendly error' do
+      perform
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
+        expect(kwargs[:html]).to include('is not enabled')
+      end
+    end
+  end
+
+  describe 'error message sanitisation' do
+    it 'HTML-escapes the error message before broadcasting' do
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate).and_raise('<script>alert(1)</script>')
+
+      perform
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
+        expect(kwargs[:html]).to include('&lt;script&gt;')
+        expect(kwargs[:html]).not_to include('<script>')
+      end
+    end
+  end
+
+  describe 'successful streaming' do
+    before do
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate).and_yield('Hello ').and_yield('world')
+    end
+
+    it 'removes the spinner on the first chunk' do
+      perform
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_remove_to)
+        .with([interaction_id, 'prompts'], target: "#{response_id}_spinner")
+    end
+
+    it 'broadcasts each chunk to the response target' do
+      perform
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
+        .with([interaction_id, 'prompts'], target: response_id, content: 'Hello ')
+      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
+        .with([interaction_id, 'prompts'], target: response_id, content: 'world')
+    end
+  end
+end

From 8231ce16005ebde7ce155d71682cfe0463cc2414 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:22:08 +0100
Subject: [PATCH 12/57] Echo: send only completed turns and sanitise failed
 replies

Applies PR #1655 review findings on the slice that introduced ReplyJob:

- Poison-pill (#1): Session#to_provider_messages now replays only
  completed turns, so a failed or still-streaming row never sends a
  content: nil turn to a provider.
- Liveness (#2): ReplyJob throttle-touches the streaming message while
  chunks arrive, so a slow-but-live stream isn't reclaimed as stuck.
- Orphaned lock (#3): reclaim_stuck_generation! also releases a
  generating session that has no streaming message once it is stale.
- Exception handling (#5): narrow the rescue to
  Provider::HttpStreaming::Error so genuine bugs and the disabled-agent
  raise propagate to the failed queue; log class/message/backtrace.
- Error leakage (#6): store a generic Message::GENERIC_ERROR string and
  never persist the provider's raw response.
- Enable discard_on ActiveJob::DeserializationError so a job whose
  session was destroyed mid-queue is discarded, not failed-queue noise.

Adds a failed-reply-then-retry regression spec proving the retry sends
only complete turns and the session unlocks.
---
 CHANGELOG                                     |  2 +
 app/jobs/application_job.rb                   |  2 +-
 .../app/jobs/dradis/plugins/echo/reply_job.rb | 24 +++++++-
 .../plugins/echo/provider/http_streaming.rb   | 19 +++++-
 .../app/models/dradis/plugins/echo/message.rb |  5 ++
 .../app/models/dradis/plugins/echo/session.rb | 33 ++++++----
 .../dradis/plugins/echo/reply_job_spec.rb     | 60 +++++++++++++++++--
 .../echo/provider/http_streaming_spec.rb      |  2 +-
 .../dradis/plugins/echo/session_spec.rb       | 38 +++++++++++-
 9 files changed, 163 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index cb2f9d721..843410918 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -37,6 +37,8 @@ v5.2.0 (July 2026)
     - Echo:
       - Preserve line breaks in streamed Ollama responses for models that emit them as standalone tokens
       - Remove a stray leading blank line from streamed responses
+      - Send only completed conversation turns to the AI provider, so a failed or in-progress reply can no longer break the next one
+      - Show a generic message when a reply fails instead of surfacing the provider's raw error
 
 v5.1.0 (May 2026)
   - DataTables: add sticky table toolbar that tracks below the navigation bar when scrolling
diff --git a/app/jobs/application_job.rb b/app/jobs/application_job.rb
index f4d1ec5b9..a44b0c36c 100644
--- a/app/jobs/application_job.rb
+++ b/app/jobs/application_job.rb
@@ -3,7 +3,7 @@ class ApplicationJob < ActiveJob::Base
   # retry_on ActiveRecord::Deadlocked
 
   # Most jobs are safe to ignore if the underlying records are no longer available
-  # discard_on ActiveJob::DeserializationError
+  discard_on ActiveJob::DeserializationError
 
   before_perform do |job|
     ActiveRecord::Base.connection_handler.clear_active_connections!
diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
index e219e22e6..c62632acc 100644
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
@@ -2,6 +2,11 @@ module Dradis::Plugins::Echo
   class ReplyJob < ApplicationJob
     queue_as :dradis_project
 
+    # How often, at most, to touch the streaming message so Session's stuck-
+    # generation reclaim can tell a live-but-slow stream from a dead one without
+    # a database write per chunk.
+    TOUCH_INTERVAL = 5
+
     # Generates one assistant reply for a session: it streams the provider
     # response into a `streaming` message, persists the final text as
     # `complete` with model/provider metadata, then serializes — re-enqueueing
@@ -19,7 +24,10 @@ def perform(session)
 
       complete(agent, message, text, duration_ms)
       serialize(session, cutoff_id)
-    rescue => e
+    rescue Provider::HttpStreaming::Error => e
+      # A genuine provider/transport failure: surface it to the user as a failed
+      # message. Anything else (a disabled agent, a bug in our code) is left to
+      # propagate so it reaches Resque's failed queue instead of being hidden.
       fail_message(session, message, e)
     end
 
@@ -28,10 +36,17 @@ def perform(session)
     def stream_reply(agent, session, message, context)
       buffer = +''
       started = clock
+      last_touch = started
 
       agent.provider.generate(messages: context, model: agent.model_override) do |chunk|
         buffer << chunk
         broadcast_chunk(session, message, chunk)
+
+        # Throttled liveness signal for Session#reclaim_stuck_generation!.
+        if clock - last_touch >= TOUCH_INTERVAL
+          message.touch
+          last_touch = clock
+        end
       end
 
       [buffer, ((clock - started) * 1000).round]
@@ -86,10 +101,15 @@ def serialize(session, cutoff_id)
     end
 
     def fail_message(session, message, error)
+      Rails.logger.error(
+        "#{self.class.name} failed: #{error.class}: #{error.message}\n" \
+        "#{Array(error.backtrace).join("\n")}"
+      )
+
       if message
         message.update!(
           status: :failed,
-          metadata: message.metadata.merge('error' => error.message)
+          metadata: message.metadata.merge('error' => Message::GENERIC_ERROR)
         )
         broadcast_message(message)
       end
diff --git a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
index 463744e61..9f13233a2 100644
--- a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
+++ b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
@@ -1,5 +1,6 @@
 require 'net/http'
 require 'json'
+require 'openssl'
 require 'uri'
 
 module Dradis::Plugins::Echo
@@ -8,6 +9,20 @@ module Provider::HttpStreaming
 
     READ_TIMEOUT = 120
 
+    # Raised for any provider/transport failure (non-2xx responses, timeouts,
+    # dropped connections). Callers rescue this to tell a genuine provider
+    # problem apart from a bug in our own code, which must not be swallowed.
+    class Error < StandardError; end
+
+    # Low-level transport failures we translate into Error so callers only ever
+    # have to rescue Provider::HttpStreaming::Error.
+    NETWORK_ERRORS = [
+      Errno::ECONNREFUSED, Errno::ECONNRESET, Errno::EHOSTUNREACH, Errno::ETIMEDOUT,
+      EOFError, IOError, SocketError,
+      Net::OpenTimeout, Net::ReadTimeout, Net::WriteTimeout, Net::HTTPBadResponse,
+      OpenSSL::SSL::SSLError
+    ].freeze
+
     # Sends prompt to the provider and returns the response.
     #
     # With a block: yields each text chunk as it arrives, enabling streaming UX
@@ -65,7 +80,7 @@ def parse_sse_response(uri, headers:, body:, &block)
         unless response.is_a?(Net::HTTPSuccess)
           error_body = +''
           response.read_body { |chunk| error_body << chunk }
-          raise "#{self.class.name} API error (#{response.code}): #{error_body}"
+          raise Error, "#{self.class.name} API error (#{response.code}): #{error_body}"
         end
 
         response.read_body do |chunk|
@@ -83,6 +98,8 @@ def parse_sse_response(uri, headers:, body:, &block)
           end
         end
       end
+    rescue *NETWORK_ERRORS => e
+      raise Error, e.message
     end
 
     # Returns the URI for the provider's API endpoint.
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
index 997b75065..68a10408f 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
@@ -1,5 +1,10 @@
 module Dradis::Plugins::Echo
   class Message < ApplicationRecord
+    # User-facing text stored on a failed message. Deliberately generic so we
+    # never persist a provider's raw response body, hostname, or status line;
+    # the real error is logged server-side instead.
+    GENERIC_ERROR = "Roslin couldn't finish this response.".freeze
+
     enum :role, %i[user assistant]
     enum :status, %i[complete streaming failed], default: :complete
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 74f4f9f0f..7c7e107ec 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -67,8 +67,11 @@ def request_reply!
       ReplyJob.perform_later(self) if enqueue
     end
 
+    # Only completed turns are safe to replay to a provider: a streaming row has
+    # no content yet, and a failed one carries a nil/partial body. Sending either
+    # would poison the next request with a `content: nil` turn.
     def to_provider_messages
-      messages.order(:created_at, :id).map do |message|
+      messages.where(status: :complete).order(:created_at, :id).map do |message|
         { role: message.role, content: message.content }
       end
     end
@@ -87,19 +90,29 @@ def record=(new_record)
 
     private
 
-    # A crashed ReplyJob leaves the session locked in `generating` with an
-    # orphaned streaming message. Once that message hasn't been touched past the
-    # provider read timeout (plus a margin), fail it and release the session so
-    # the next request_reply! can start fresh.
+    # A crashed ReplyJob leaves the session locked in `generating`. Two shapes:
+    #
+    #   1. An orphaned streaming message. ReplyJob touches the streaming row as
+    #      chunks arrive (a throttled liveness signal), so a message untouched
+    #      past the read timeout plus a margin is genuinely dead — not a slow but
+    #      live stream. Fail it and release the session.
+    #   2. No streaming message at all: enqueue raised after the status commit,
+    #      the worker was hard-killed before messages.create!, or the job was
+    #      lost from the queue. Here the session's own updated_at is the liveness
+    #      signal — once it's past the threshold, release the orphaned lock.
     def reclaim_stuck_generation!
       threshold = Provider::HttpStreaming::READ_TIMEOUT.seconds.ago - STUCK_MARGIN
-      stuck = messages.where(role: :assistant, status: :streaming).where(updated_at: ..threshold)
-      return unless stuck.exists?
+      streaming = messages.where(role: :assistant, status: :streaming)
+      stuck = streaming.where(updated_at: ..threshold)
 
-      stuck.find_each do |message|
-        message.update!(status: :failed, metadata: message.metadata.merge('error' => 'interrupted'))
+      if stuck.exists?
+        stuck.find_each do |message|
+          message.update!(status: :failed, metadata: message.metadata.merge('error' => Message::GENERIC_ERROR))
+        end
+        update!(status: :idle)
+      elsif streaming.none? && updated_at <= threshold
+        update!(status: :idle)
       end
-      update!(status: :idle)
     end
   end
 end
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
index 0f1ed52f6..e55297bf7 100644
--- a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
+++ b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
@@ -110,26 +110,28 @@ def perform
   describe 'when the agent is not enabled' do
     before { agent.update!(enabled: false) }
 
-    it 'does not create an assistant message and resets to idle' do
+    it 'raises so the failure reaches the job queue and creates no assistant message' do
       session.update!(status: :generating)
-      expect { perform }.not_to change { session.messages.assistant.count }
-      expect(session.reload).to be_idle
+      expect { perform }.to raise_error(/is not enabled/)
+      expect(session.messages.assistant).to be_empty
     end
   end
 
   describe 'when the provider raises' do
     before do
       allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
-        .to receive(:generate).and_raise('provider exploded')
+        .to receive(:generate)
+        .and_raise(Dradis::Plugins::Echo::Provider::HttpStreaming::Error, 'API error (500): secret-host internal body')
       session.update!(status: :generating)
     end
 
-    it 'marks the assistant message failed with the error in metadata' do
+    it 'marks the assistant message failed with a generic, sanitised error' do
       perform
       message = session.messages.assistant.last
 
       expect(message).to be_failed
-      expect(message.metadata['error']).to eq('provider exploded')
+      expect(message.metadata['error']).to eq(Dradis::Plugins::Echo::Message::GENERIC_ERROR)
+      expect(message.metadata['error']).not_to include('secret-host')
     end
 
     it 'resets the session to idle' do
@@ -137,4 +139,50 @@ def perform
       expect(session.reload).to be_idle
     end
   end
+
+  describe 'when our own code raises a non-provider error' do
+    before do
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate).and_raise(ArgumentError, 'genuine bug')
+      session.update!(status: :generating)
+    end
+
+    it 're-raises so the bug reaches the failed queue instead of being swallowed' do
+      expect { perform }.to raise_error(ArgumentError, 'genuine bug')
+    end
+  end
+
+  describe 'retrying after a failed reply' do
+    it 'sends only complete turns on the retry, recovers, and unlocks the session' do
+      session.update!(status: :generating)
+
+      # First attempt: the provider fails, leaving a failed assistant row with
+      # no content — exactly the turn that must never be replayed.
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate)
+        .and_raise(Dradis::Plugins::Echo::Provider::HttpStreaming::Error, 'boom')
+      perform
+
+      failed = session.messages.assistant.last
+      expect(failed).to be_failed
+      expect(failed.content).to be_nil
+
+      # Retry: capture the context handed to the provider.
+      sent_context = nil
+      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+        .to receive(:generate) do |_provider, **kwargs, &block|
+          sent_context = kwargs[:messages]
+          block.call('Recovered answer.')
+        end
+      session.update!(status: :generating)
+      perform
+
+      # The failed, nil-content turn is excluded — no poison-pill.
+      expect(sent_context.map { |turn| turn[:content] }).to all(be_present)
+      expect(sent_context).not_to include(a_hash_including(content: nil))
+
+      expect(session.reload).to be_idle
+      expect(session.messages.assistant.complete.last.content).to eq('Recovered answer.')
+    end
+  end
 end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
index b9afa2326..4b43c28a7 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
@@ -32,7 +32,7 @@ def stub_http(body:, code: '200')
                       URI('https://api.anthropic.com/v1/messages'),
                       headers: {},
                       body: {})
-      end.to raise_error(RuntimeError, /API error \(401\)/)
+      end.to raise_error(Dradis::Plugins::Echo::Provider::HttpStreaming::Error, /API error \(401\)/)
     end
 
     it 'parses SSE lines and yields text chunks' do
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index d5b901fea..f152cfa8e 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -59,6 +59,17 @@
         { role: 'assistant', content: 'Second' }
       ])
     end
+
+    it 'excludes streaming and failed turns so no nil-content turn is replayed' do
+      session = create(:echo_session)
+      create(:echo_message, session: session, role: :user, content: 'First')
+      create(:assistant_message, session: session, status: :streaming, content: nil)
+      create(:assistant_message, session: session, status: :failed, content: nil)
+
+      expect(session.to_provider_messages).to eq([
+        { role: 'user', content: 'First' }
+      ])
+    end
   end
 
   describe '.for_record' do
@@ -123,7 +134,7 @@
 
         expect(session.reload).to be_generating
         expect(stale.reload).to be_failed
-        expect(stale.metadata['error']).to eq('interrupted')
+        expect(stale.metadata['error']).to eq(Dradis::Plugins::Echo::Message::GENERIC_ERROR)
         expect(Dradis::Plugins::Echo::ReplyJob).to have_received(:perform_later).once
       end
 
@@ -132,6 +143,31 @@
         session.request_reply!
         expect(Dradis::Plugins::Echo::ReplyJob).not_to have_received(:perform_later)
       end
+
+      it 'leaves a live stream touched within the threshold alone' do
+        stale = create(:assistant_message, session: session, status: :streaming, content: nil)
+        stale.update_column(:updated_at, (read_timeout - 1.minute).ago)
+
+        session.request_reply!
+
+        expect(stale.reload).to be_streaming
+        expect(Dradis::Plugins::Echo::ReplyJob).not_to have_received(:perform_later)
+      end
+
+      it 'reclaims a generating session that has no streaming message once it is stale' do
+        session.update_column(:updated_at, (read_timeout + described_class::STUCK_MARGIN + 1.minute).ago)
+
+        session.request_reply!
+
+        expect(session.reload).to be_generating
+        expect(Dradis::Plugins::Echo::ReplyJob).to have_received(:perform_later).once
+      end
+
+      it 'leaves a freshly generating session with no streaming message alone' do
+        session.touch
+        session.request_reply!
+        expect(Dradis::Plugins::Echo::ReplyJob).not_to have_received(:perform_later)
+      end
     end
   end
 

From aa5800b962749e6f99e7159428d67b7ded004311 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 15:57:54 +0100
Subject: [PATCH 13/57] Echo: apply PR #1649 Slice-2 review resolutions
 (aapomm)

Move the record_type 'Issue' after_destroy sweep out of the shared Sessionable
concern and into the Note-only on_load(:note_model) wiring in engine.rb, right
after ::Note.include Sessionable. Hardcoding 'Issue' in the shared concern would
let a future host (Evidence/ContentBlock, independent id sequences) delete an
unrelated Issue #N's sessions on destroy.

- Message: before_validation :complete_user_messages, if: :user? (drop the
  internal user? guard).
- Session#project: delegate :project, to: :record.
- Session.for_record: comment why where(record: record) misses forced 'Issue'
  rows.
- Specs: keep the loaded-as-Note sweep coverage (now against the relocated
  callback) and add a guard proving a non-Note Sessionable host destroy leaves
  unrelated Issue sessions intact.
---
 engines/dradis-echo/app/models/dradis/plugins/echo/session.rb | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 7c7e107ec..e476a2bcf 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -42,10 +42,6 @@ def broadcast_composer_state
       )
     end
 
-    def project
-      record.project
-    end
-
     # The gate in front of ReplyJob: flips idle->generating and enqueues exactly
     # one job. A no-op while already generating, so repeated calls (a user
     # sending several messages) never double-enqueue — the running job re-checks

From 19b458f8ff563afa80e83debebd69f0f862c5a22 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 24 Jul 2026 17:17:59 +0100
Subject: [PATCH 14/57] =?UTF-8?q?Echo:=20apply=20PR=20#1650=20review=20?=
 =?UTF-8?q?=E2=80=94=20array=20Turbo=20targets,=20model=5Foverride.presenc?=
 =?UTF-8?q?e?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adopt the reviewer's dom_id simplification: pass `[record, :prefix]` as the
Turbo broadcast target so turbo-rails computes the dom_id, instead of calling
ActionView::RecordIdentifier.dom_id ourselves (identical output). Pass
`agent.model_override.presence` at the generate call to mirror the metadata
line; the provider already falls back via `.presence`, so an empty override
resolves to the provider default either way.
---
 .../dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb   | 4 ++--
 .../dradis-echo/app/models/dradis/plugins/echo/session.rb   | 2 +-
 .../spec/jobs/dradis/plugins/echo/reply_job_spec.rb         | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
index c62632acc..5708369c6 100644
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
@@ -38,7 +38,7 @@ def stream_reply(agent, session, message, context)
       started = clock
       last_touch = started
 
-      agent.provider.generate(messages: context, model: agent.model_override) do |chunk|
+      agent.provider.generate(messages: context, model: agent.model_override.presence) do |chunk|
         buffer << chunk
         broadcast_chunk(session, message, chunk)
 
@@ -55,7 +55,7 @@ def stream_reply(agent, session, message, context)
     def broadcast_chunk(session, message, chunk)
       Turbo::StreamsChannel.broadcast_append_to(
         [session, :messages],
-        target: ActionView::RecordIdentifier.dom_id(message, :content),
+        target: [message, :content],
         content: ERB::Util.html_escape(chunk)
       )
     end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index e476a2bcf..bd1f0be92 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -36,7 +36,7 @@ def self.record_type_for(record)
     def broadcast_composer_state
       broadcast_replace_to(
         [self, :composer_state],
-        target: ActionView::RecordIdentifier.dom_id(self, :composer_state),
+        target: [self, :composer_state],
         partial: 'dradis/plugins/echo/projects/sessions/composer_state',
         locals: { session: self }
       )
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
index e55297bf7..7a2cdbf5e 100644
--- a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
+++ b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
@@ -48,12 +48,12 @@ def perform
 
     it 'streams each chunk to the message content target' do
       perform
-      target = ActionView::RecordIdentifier.dom_id(session.messages.assistant.last, :content)
+      message = session.messages.assistant.last
 
       expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([session, :messages], target: target, content: 'Hello ')
+        .with([session, :messages], target: [message, :content], content: 'Hello ')
       expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([session, :messages], target: target, content: 'world')
+        .with([session, :messages], target: [message, :content], content: 'world')
     end
 
     it 'releases the session back to idle' do

From c8b66282edcabe2d7f53f2ecc288214a02fadf29 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 13:55:12 +0100
Subject: [PATCH 15/57] =?UTF-8?q?Echo:=20apply=20caitmich=20Slice-3=20revi?=
 =?UTF-8?q?ew=20=E2=80=94=20resolved=5Fmodel,=20drop=20dead=20project=20de?=
 =?UTF-8?q?legate?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add Agent#resolved_model (model_override.presence || provider.model) and use it
at both ReplyJob call sites so the override-vs-default resolution lives in one
place. Drop Session's unused `delegate :project, to: :record` (the authorize
path uses session.record.project; only its own spec exercised the delegation)
and its spec. Simplify the _composer_state header comment.
---
 .../app/jobs/dradis/plugins/echo/reply_job.rb            | 4 ++--
 .../dradis-echo/app/models/dradis/plugins/echo/agent.rb  | 8 ++++++++
 .../app/models/dradis/plugins/echo/session.rb            | 2 --
 .../echo/projects/sessions/_composer_state.html.erb      | 3 +--
 .../spec/models/dradis/plugins/echo/session_spec.rb      | 9 ---------
 5 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
index 5708369c6..dc514fac7 100644
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
@@ -38,7 +38,7 @@ def stream_reply(agent, session, message, context)
       started = clock
       last_touch = started
 
-      agent.provider.generate(messages: context, model: agent.model_override.presence) do |chunk|
+      agent.provider.generate(messages: context, model: agent.resolved_model) do |chunk|
         buffer << chunk
         broadcast_chunk(session, message, chunk)
 
@@ -66,7 +66,7 @@ def complete(agent, message, text, duration_ms)
         status: :complete,
         metadata: message.metadata.merge(
           'duration_ms' => duration_ms,
-          'model' => agent.model_override.presence || agent.provider.model,
+          'model' => agent.resolved_model,
           'provider' => agent.provider.type_name
         )
       )
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/agent.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/agent.rb
index 5edab2595..0b2390992 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/agent.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/agent.rb
@@ -19,6 +19,14 @@ class Agent < ApplicationRecord
 
     # -- Instance Methods -----------------------------------------------------
 
+    # The model actually sent to the provider: the agent's override when set,
+    # otherwise the provider's default. Keeps the override-vs-default resolution
+    # in one place instead of repeating `model_override.presence || ...` at every
+    # call site.
+    def resolved_model
+      model_override.presence || provider.model
+    end
+
     private
 
     # The engine provisions system agents (e.g. Roslin), and they must not be deleted.
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index bd1f0be92..aadf1e268 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -12,8 +12,6 @@ class Session < ApplicationRecord
     belongs_to :user, optional: true
     has_many :messages, dependent: :destroy
 
-    delegate :project, to: :record
-
     # -- Scopes ---------------------------------------------------------------
     # Can't use where(record: record): Rails builds record_type from the
     # polymorphic_name ('Note') for an Issue, missing the forced 'Issue' rows.
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
index 68db682c4..91b53a617 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -1,7 +1,6 @@
 <%# locals: (session:) -%>
 <%# Broadcast on every idle<->generating transition (Session#broadcast_composer_state). %>
-<%# Route-free and locals-only so it renders from ReplyJob. Slice 4 wires the %>
-<%# composer form; here we only reflect whether a reply is in flight. %>
+<%# Route-free and locals-only so it renders from ReplyJob. %>
 <div id="<%= dom_id(session, :composer_state) %>" data-behavior="echo-composer-state" data-generating="<%= session.generating? %>">
   <% if session.generating? %>
     <span class="echo-composer-status" data-behavior="echo-composer-generating">Generating…</span>
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index f152cfa8e..4d271c545 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -39,15 +39,6 @@
     end
   end
 
-  describe '#project' do
-    it 'delegates to the record' do
-      note = create(:note)
-      session = create(:echo_session, record: note)
-
-      expect(session.project).to eq(note.project)
-    end
-  end
-
   describe '#to_provider_messages' do
     it 'returns role/content hashes ordered by creation' do
       session = create(:echo_session)

From a630e9b41886917315b45023463bd71ae7e7e6dd Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 14:02:09 +0100
Subject: [PATCH 16/57] Echo: keep Session#project as the authorization seam

Restore `delegate :project, to: :record` (reverting its removal). It reads as
dead code in this slice alone, but it's the seam SessionsChannel#authorize
should use: record is polymorphic, so callers ask the session for its project
rather than reaching through session.record.project. Slice 4 routes the authz
check through it.
---
 .../app/models/dradis/plugins/echo/session.rb            | 5 +++++
 .../spec/models/dradis/plugins/echo/session_spec.rb      | 9 +++++++++
 2 files changed, 14 insertions(+)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index aadf1e268..1e7e95c14 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -12,6 +12,11 @@ class Session < ApplicationRecord
     belongs_to :user, optional: true
     has_many :messages, dependent: :destroy
 
+    # The session's project comes via its record today, but record is polymorphic
+    # (other scopes may join later), so callers ask the session — not the record —
+    # for its project. This is the authorization seam (SessionsChannel#authorized?).
+    delegate :project, to: :record
+
     # -- Scopes ---------------------------------------------------------------
     # Can't use where(record: record): Rails builds record_type from the
     # polymorphic_name ('Note') for an Issue, missing the forced 'Issue' rows.
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index 4d271c545..b223a339f 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -39,6 +39,15 @@
     end
   end
 
+  describe '#project' do
+    it 'delegates to the record (the authorization seam)' do
+      note = create(:note)
+      session = create(:echo_session, record: note)
+
+      expect(session.project).to eq(note.project)
+    end
+  end
+
   describe '#to_provider_messages' do
     it 'returns role/content hashes ordered by creation' do
       session = create(:echo_session)

From 4f71959394ecd432767303a58d0d0765a495b28d Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:17:45 +0100
Subject: [PATCH 17/57] Echo: stop ReplyJob shadowing ActiveJob#serialize so it
 can enqueue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A private serialize(session, cutoff_id) overrode ActiveJob::Core#serialize, which every queue adapter calls when enqueuing. perform_later — and so Session#request_reply! — raised NoMethodError at runtime. Rename the private method to finalize and cover the enqueue path.
---
 .../dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb  | 6 +++---
 .../spec/jobs/dradis/plugins/echo/reply_job_spec.rb        | 7 +++++++
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
index dc514fac7..a0fc45e24 100644
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
+++ b/engines/dradis-echo/app/jobs/dradis/plugins/echo/reply_job.rb
@@ -9,7 +9,7 @@ class ReplyJob < ApplicationJob
 
     # Generates one assistant reply for a session: it streams the provider
     # response into a `streaming` message, persists the final text as
-    # `complete` with model/provider metadata, then serializes — re-enqueueing
+    # `complete` with model/provider metadata, then finalizes — re-enqueueing
     # itself if the user spoke again mid-generation, or flipping the session
     # back to `idle`. Session#request_reply! owns the idle->generating gate.
     def perform(session)
@@ -23,7 +23,7 @@ def perform(session)
       text, duration_ms = stream_reply(agent, session, message, context)
 
       complete(agent, message, text, duration_ms)
-      serialize(session, cutoff_id)
+      finalize(session, cutoff_id)
     rescue Provider::HttpStreaming::Error => e
       # A genuine provider/transport failure: surface it to the user as a failed
       # message. Anything else (a disabled agent, a bug in our code) is left to
@@ -89,7 +89,7 @@ def strip_thinking(text)
     # Under a lock so it can't race the controller flipping idle<->generating:
     # if a user message landed after the reply started (id past the cutoff),
     # answer it too by re-enqueueing; otherwise release the session to idle.
-    def serialize(session, cutoff_id)
+    def finalize(session, cutoff_id)
       session.with_lock do
         if session.messages.where(role: :user).where('id > ?', cutoff_id).exists?
           self.class.perform_later(session)
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
index 7a2cdbf5e..86cc457df 100644
--- a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
+++ b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/reply_job_spec.rb
@@ -26,6 +26,13 @@ def perform
     allow_any_instance_of(Dradis::Plugins::Echo::Session).to receive(:broadcast_composer_state)
   end
 
+  # Guards against a private method shadowing ActiveJob::Core#serialize, which
+  # every queue adapter calls when enqueuing — a collision there breaks
+  # perform_later (and so Session#request_reply!) at runtime.
+  it 'can be serialized for enqueuing' do
+    expect { described_class.new(session).serialize }.not_to raise_error
+  end
+
   describe 'a successful reply' do
     before { stub_stream('Hello ', 'world') }
 

From 002e235ec90ea801d5c17aae0702bf499f59926e Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:17:59 +0100
Subject: [PATCH 18/57] Echo: add session controllers, routes and
 re-authorizing sockets channel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Purely additive Slice 4. Adds project-scoped Sessions/Messages controllers (Prompt read only at the controller boundary, no FK; Prompt::SCOPES whitelist honoured via set_type), their routes and index/show views, and SessionsChannel — a custom Turbo Streams channel that re-checks :use on the session's project at subscribe time and rejects revoked users, closing the non-expiring signed-stream-name hole. InteractionsController is untouched.
---
 .../dradis/plugins/echo/sessions_channel.rb   | 44 +++++++++
 .../dradis/plugins/echo/record_scoping.rb     | 17 ++++
 .../projects/sessions/messages_controller.rb  | 29 ++++++
 .../echo/projects/sessions_controller.rb      | 76 +++++++++++++++
 .../echo/projects/sessions/index.html.erb     | 47 +++++++++
 .../echo/projects/sessions/show.html.erb      | 34 +++++++
 engines/dradis-echo/config/routes.rb          |  4 +
 .../plugins/echo/sessions_channel_spec.rb     | 47 +++++++++
 .../echo/projects/sessions/messages_spec.rb   | 53 ++++++++++
 .../plugins/echo/projects/sessions_spec.rb    | 96 +++++++++++++++++++
 10 files changed, 447 insertions(+)
 create mode 100644 engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
 create mode 100644 engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
 create mode 100644 engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
 create mode 100644 engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
 create mode 100644 engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb

diff --git a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
new file mode 100644
index 000000000..9ce9e26de
--- /dev/null
+++ b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
@@ -0,0 +1,44 @@
+module Dradis::Plugins::Echo
+  # Custom Turbo Streams channel for Echo sessions. Turbo's default channel
+  # trusts any client holding a validly-signed stream name for the lifetime of
+  # that name — which never expires — so a user who loses project access keeps
+  # receiving the transcript. We re-check authorization at subscribe time
+  # instead: resolve the session behind the signed name and only stream if the
+  # subscriber may still :use its project, otherwise reject.
+  #
+  # Follows the documented turbo-rails custom-channel pattern
+  # (Turbo::StreamsChannel).
+  class SessionsChannel < ApplicationCable::Channel
+    extend Turbo::Streams::Broadcasts, Turbo::Streams::StreamName
+    include Turbo::Streams::StreamName::ClassMethods
+
+    def subscribed
+      session = session_from_stream_name
+
+      if session && authorized?(session)
+        stream_from verified_stream_name_from_params
+      else
+        reject
+      end
+    end
+
+    private
+
+    def authorized?(session)
+      Ability.new(current_user).can?(:use, session.record.project)
+    end
+
+    # The signed name encodes `[session, :messages]`, i.e.
+    # "<session-gid-param>:messages". A tampered name fails verification and
+    # yields nil, which we treat as unauthorized.
+    def session_from_stream_name
+      name = verified_stream_name_from_params
+      return unless name
+
+      record = GlobalID::Locator.locate(name.split(':').first)
+      record if record.is_a?(Session)
+    rescue StandardError
+      nil
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
new file mode 100644
index 000000000..3791c5370
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
@@ -0,0 +1,17 @@
+module Dradis::Plugins::Echo
+  # Shared record scoping for the session controllers. A session is always
+  # anchored to a record (an Issue or a Note) that must live inside the current
+  # project; resolving it through the project's collections gives us
+  # cross-project/record isolation for free — an out-of-scope id raises
+  # ActiveRecord::RecordNotFound, mirroring Projects::GrammarController.
+  module RecordScoping
+    extend ActiveSupport::Concern
+
+    private
+
+    def scoped_record(record)
+      collection = record.is_a?(Issue) ? current_project.issues : current_project.notes
+      collection.find(record.id)
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
new file mode 100644
index 000000000..99fdfb492
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
@@ -0,0 +1,29 @@
+module Dradis::Plugins::Echo
+  class Projects::Sessions::MessagesController < AuthenticatedController
+    include ProjectScoped
+    include RecordScoping
+    layout false
+
+    before_action :set_session
+
+    # Appends a user turn and re-opens the reply gate. The new message
+    # broadcasts itself into the transcript, so there's nothing to render back.
+    def create
+      message = @session.messages.build(content: params[:content], role: :user, user: current_user)
+
+      if message.save
+        @session.request_reply!
+        head :ok
+      else
+        head :unprocessable_entity
+      end
+    end
+
+    private
+
+    def set_session
+      @session = Session.find(params[:session_id])
+      scoped_record(@session.record)
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
new file mode 100644
index 000000000..9f62c3d6d
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -0,0 +1,76 @@
+module Dradis::Plugins::Echo
+  class Projects::SessionsController < AuthenticatedController
+    include EventPublisher
+    include ProjectScoped
+    include RecordScoping
+    layout false
+
+    before_action :set_type
+    before_action :set_record, only: [:index, :create]
+    before_action :check_turbo_config, only: [:show, :create]
+    before_action :set_session, only: [:show]
+
+    def index
+      @sessions = Session.for_record(@record).order(created_at: :desc)
+
+      Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
+      @prompts = current_user.prompts.for(@type)
+    end
+
+    def show; end
+
+    # Starts a conversation from a saved prompt. The Prompt is read only here, at
+    # the controller boundary — we copy its title and never store a FK, so a
+    # later edit or deletion of the template can't rewrite history. Scoping the
+    # lookup through `for(@type)` honours the Prompt::SCOPES whitelist. The first
+    # user Message carries the (Liquid-rendered, possibly edited) prompt text.
+    def create
+      prompt = current_user.prompts.for(@type).find(params[:prompt_id])
+
+      @session = Session.new(
+        agent: Agents::Roslin.instance,
+        record: @record,
+        title: prompt.title,
+        user: current_user
+      )
+      @session.messages.build(content: params[:prompt], role: :user, user: current_user)
+      @session.save!
+
+      @session.request_reply!
+      publish_event('echo_session.created', session: { id: @session.id })
+
+      render :show
+    end
+
+    private
+
+    def check_turbo_config
+      @turbo_status = begin
+        ActionCable.server.pubsub.redis_connection_for_subscriptions.ping
+        true
+      rescue
+        false
+      end
+    end
+
+    def record_params
+      params.permit(:id, :prompt, :prompt_id, :project_id, :record, :type)
+    end
+
+    def set_record
+      raise ActiveRecord::RecordNotFound if @type.blank?
+
+      @record = current_project.send(@type.to_s.pluralize).find(record_params[:record])
+    end
+
+    def set_session
+      @session = Session.find(record_params[:id])
+      @record = scoped_record(@session.record)
+    end
+
+    def set_type
+      allowed = Prompt::SCOPES.map(&:to_s)
+      @type = allowed.include?(record_params[:type]) ? record_params[:type].to_sym : nil
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
new file mode 100644
index 000000000..144cda73f
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
@@ -0,0 +1,47 @@
+<% if Dradis::Plugins::Echo::Agents::Roslin.enabled? %>
+  <% if @prompts.any? %>
+    <% if @sessions.any? %>
+      <div class="list-group mb-3" id="echo-sessions" data-behavior="echo-sessions">
+        <% @sessions.each do |session| %>
+          <%= link_to session.title.presence || "Session ##{session.id}",
+                echo.project_session_path(current_project, session, type: @type, record: @record.id),
+                id: dom_id(session),
+                class: 'list-group-item list-group-item-action',
+                data: { turbo_frame: dom_id(@record, :echo) } %>
+        <% end %>
+      </div>
+    <% end %>
+
+    <p>
+      Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
+      <%= link_to 'saved prompt', echo.prompts_path, data: { turbo_frame: '_top' } %> to start a session for this Issue.
+    </p>
+    <p>
+      You can edit the prompt before sending it, any changes are one-off and
+      won't affect the saved prompt template.
+    </p>
+  <% else %>
+    <%= render 'shared/empty_state',
+      actions_partial: 'dradis/plugins/echo/prompts/empty_state_actions',
+      docs_link: 'https://dradis.com/support/guides/echo/prompts.html',
+      name: 'prompt',
+      text: 'Create reusable prompts to standardize how your team analyzes findings, writes reports, summarizes vulnerabilities, and more. Save time by building a library of prompts that anyone on your team can use for consistent results.'
+    %>
+  <% end %>
+<% else %>
+  <div class="alert alert-warning">
+    <% if !current_user.respond_to?(:role?) || current_user.role?(:admin) %>
+      The Roslin agent is not enabled.
+      <%= link_to 'Enable it', echo.agents_path, data: { turbo_frame: '_top' } %>
+      to allow LLM interactions for AI-assisted writing.
+    <% else %>
+      <i class="fa-solid fa-robot me-1"></i>Roslin is not enabled. Ask an
+      admin to enable it to allow LLM interactions.
+    <% end %>
+  </div>
+  <p>
+    Think of Roslin as an editor or writing companion. It allows you to interact
+    with different LLM providers to help enhance your findings' readability
+    or adapt them to your audience.
+  </p>
+<% end %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
new file mode 100644
index 000000000..364c02f56
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -0,0 +1,34 @@
+<turbo-frame id="<%= dom_id(@record, :echo) %>">
+  <% unless @turbo_status %>
+    <div class="alert alert-danger">
+      There was an error contacting Redis: please make sure the Redis server is running.
+    </div>
+  <% end %>
+
+  <%# Live transcript + composer state. Slice 5 adds `channel: SessionsChannel` %>
+  <%# so the socket re-authorizes on subscribe. %>
+  <%= turbo_stream_from [@session, :messages] %>
+  <%= turbo_stream_from [@session, :composer_state] %>
+
+  <div id="echo-messages" data-behavior="echo-messages">
+    <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+               collection: @session.messages.order(:created_at, :id), as: :message %>
+  </div>
+
+  <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
+
+  <%= form_with url: echo.project_session_messages_path(current_project, @session), method: :post do |f| %>
+    <div class="input-group">
+      <%=
+        f.text_area :content,
+          class: 'form-control field-sizing-content',
+          placeholder: 'Message Roslin…',
+          rows: 3
+      %>
+    </div>
+
+    <div class="form-actions sticky pt-1">
+      <%= f.submit 'Send', class: 'btn btn-primary mt-2' %>
+    </div>
+  <% end %>
+</turbo-frame>
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index 7d72c30fc..a74dcfb3b 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -10,6 +10,10 @@
 
       resources :grammar_corrections, only: [:create], controller: 'projects/grammar_corrections'
       resources :grammar_suggestions, only: [:create], controller: 'projects/grammar_suggestions'
+
+      resources :sessions, only: [:index, :show, :create], controller: 'projects/sessions' do
+        resources :messages, only: [:create], controller: 'projects/sessions/messages'
+      end
     end
 
     resources :prompts, except: [:show]
diff --git a/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
new file mode 100644
index 000000000..3c26051b3
--- /dev/null
+++ b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
@@ -0,0 +1,47 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+describe Dradis::Plugins::Echo::SessionsChannel, type: :channel do
+  let(:user) { create(:user) }
+  let(:agent) { create(:agent) }
+  let(:session) { create(:echo_session, agent: agent) }
+
+  let(:signed_name) { Turbo::StreamsChannel.signed_stream_name([session, :messages]) }
+  let(:stream_name) { Turbo::StreamsChannel.verified_stream_name(signed_name) }
+
+  before { stub_connection(current_user: user) }
+
+  it 'accepts the subscription and streams the transcript for an authorized user' do
+    subscribe(signed_stream_name: signed_name)
+
+    expect(subscription).to be_confirmed
+    expect(subscription).to have_stream_from(stream_name)
+  end
+
+  it 'rejects a user whose :use on the record project is denied' do
+    allow_any_instance_of(Ability).to receive(:can?).and_return(false)
+
+    subscribe(signed_stream_name: signed_name)
+
+    expect(subscription).to be_rejected
+  end
+
+  # Re-authorizes at subscribe time: the same signed name is accepted while the
+  # user may :use the project and rejected once that permission is revoked.
+  it 'flips between accept and reject as authorization changes' do
+    subscribe(signed_stream_name: signed_name)
+    expect(subscription).to be_confirmed
+
+    allow_any_instance_of(Ability).to receive(:can?).and_return(false)
+
+    subscribe(signed_stream_name: signed_name)
+    expect(subscription).to be_rejected
+  end
+
+  it 'rejects a tampered stream name that fails verification' do
+    subscribe(signed_stream_name: 'not-a-valid-signed-stream-name')
+
+    expect(subscription).to be_rejected
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
new file mode 100644
index 000000000..d12c41614
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
@@ -0,0 +1,53 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+describe 'Echo session messages' do
+  include ActiveJob::TestHelper
+
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let(:agent) { create(:agent, enabled: true) }
+  let(:issue) { create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi") }
+  let(:session) { create(:echo_session, agent: agent, record: issue) }
+
+  describe 'POST /addons/echo/projects/:project_id/sessions/:session_id/messages' do
+    it 'appends a user message and triggers a reply' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/messages",
+          params: { content: 'What is the impact?' }
+      }.to change { session.messages.count }.by(1)
+        .and have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
+
+      expect(response).to have_http_status(:ok)
+
+      message = session.messages.order(:id).last
+      expect(message.role).to eq('user')
+      expect(message.user).to eq(user)
+      expect(message.content).to eq('What is the impact?')
+    end
+
+    it 'rejects a blank message without enqueuing a reply' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/messages",
+          params: { content: '' }
+      }.not_to change(Dradis::Plugins::Echo::Message, :count)
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
+    it 'denies a session whose record is outside the current project scope' do
+      other_session = create(:echo_session, agent: agent, record: create(:issue, node: create(:node)))
+
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{other_session.id}/messages",
+          params: { content: 'Hello' }
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
new file mode 100644
index 000000000..e820cfda5
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -0,0 +1,96 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+describe 'Echo sessions' do
+  include ActiveJob::TestHelper
+
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
+  end
+
+  let(:prompt) do
+    user.prompts.create!(
+      title: 'Summarise the finding',
+      prompt: 'Summarise {{ issue.title }}',
+      scope: 'issue',
+      visibility: :user
+    )
+  end
+
+  let(:issue) do
+    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
+  end
+
+  describe 'GET /addons/echo/projects/:project_id/sessions' do
+    it 'lists the sessions for the record' do
+      session = create(:echo_session, agent: roslin, record: issue)
+
+      get "/addons/echo/projects/#{@project.id}/sessions", params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include(session.title.to_s) if session.title.present?
+    end
+  end
+
+  describe 'POST /addons/echo/projects/:project_id/sessions' do
+    let(:params) do
+      { type: 'issue', record: issue.id, prompt_id: prompt.id, prompt: 'Summarise the SQLi finding' }
+    end
+
+    it 'creates a session with the first user message and triggers a reply' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions", params: params
+      }.to change(Dradis::Plugins::Echo::Session, :count).by(1)
+        .and change(Dradis::Plugins::Echo::Message, :count).by(1)
+        .and have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
+
+      session = Dradis::Plugins::Echo::Session.last
+      expect(session.title).to eq(prompt.title)
+      expect(session.user).to eq(user)
+      expect(session.record).to eq(issue)
+
+      message = session.messages.first
+      expect(message.role).to eq('user')
+      expect(message.content).to eq('Summarise the SQLi finding')
+    end
+
+    it 'responds with the session turbo frame' do
+      post "/addons/echo/projects/#{@project.id}/sessions", params: params
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include("id=\"#{ActionView::RecordIdentifier.dom_id(issue, :echo)}\"")
+    end
+
+    it 'copies the title without storing a prompt FK' do
+      post "/addons/echo/projects/#{@project.id}/sessions", params: params
+
+      session = Dradis::Plugins::Echo::Session.last
+      expect(session.attributes).not_to have_key('prompt_id')
+      expect(session.title).to eq(prompt.title)
+    end
+
+    it 'honours the Prompt::SCOPES whitelist' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions",
+          params: params.merge(type: 'node')
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
+    it 'denies a record outside the current project scope' do
+      other_issue = create(:issue, node: create(:node))
+
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions",
+          params: params.merge(record: other_issue.id)
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+end

From 1f5e42f1ed9cfbb4843369a55445d951d6ce7150 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 20:26:04 +0100
Subject: [PATCH 19/57] Echo: defer initial reply generation until the client
 subscribes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On initial session creation SessionsController#create called request_reply!
before render :show, so ReplyJob's streaming-container broadcast raced ahead of
the browser's SessionsChannel subscription; the container append was missed and
the later chunk/replace broadcasts hit a non-existent node, so the reply only
appeared on reload (SEC-506 Bug 4).

Restore the invariant "the streaming container is broadcast only to a listening
socket": create no longer starts generation. It renders show in the new
Session#reply_pending? state and a dedicated RepliesController#create (POST
sessions/:id/reply) starts generation, to be driven from the session Stimulus
controller once it has connected. reply_pending? (idle + newest message is a
user turn) guards the trigger so reconnects and extra viewers can't spawn an
unsolicited reply. Follow-up messages are unchanged — the client is already
subscribed there.

Refs SEC-506.
---
 .../projects/sessions/replies_controller.rb   | 28 +++++++++++
 .../echo/projects/sessions_controller.rb      |  8 ++-
 .../app/models/dradis/plugins/echo/session.rb | 11 +++++
 engines/dradis-echo/config/routes.rb          |  1 +
 .../dradis/plugins/echo/session_spec.rb       | 25 ++++++++++
 .../echo/projects/sessions/replies_spec.rb    | 49 +++++++++++++++++++
 .../plugins/echo/projects/sessions_spec.rb    |  9 +++-
 7 files changed, 128 insertions(+), 3 deletions(-)
 create mode 100644 engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
new file mode 100644
index 000000000..220ef6fb0
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
@@ -0,0 +1,28 @@
+module Dradis::Plugins::Echo
+  class Projects::Sessions::RepliesController < AuthenticatedController
+    include ProjectScoped
+    include RecordScoping
+    layout false
+
+    before_action :set_session
+
+    # Starts generation for a freshly-created session. The session Stimulus
+    # controller POSTs here from `connect`, i.e. after the browser has subscribed
+    # to the SessionsChannel, so the streaming container ReplyJob broadcasts lands
+    # on a listening socket (SEC-506 Bug 4). Guarded by reply_pending? so a
+    # reconnect, a second viewer, or a stray POST on an already-answered session
+    # can never spawn an unsolicited reply — request_reply! only fires while a
+    # reply is genuinely owed.
+    def create
+      @session.request_reply! if @session.reply_pending?
+      head :ok
+    end
+
+    private
+
+    def set_session
+      @session = Session.find(params[:session_id])
+      scoped_record(@session.record)
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 9f62c3d6d..d9f50fdec 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -24,6 +24,13 @@ def show; end
     # later edit or deletion of the template can't rewrite history. Scoping the
     # lookup through `for(@type)` honours the Prompt::SCOPES whitelist. The first
     # user Message carries the (Liquid-rendered, possibly edited) prompt text.
+    #
+    # We deliberately do NOT call request_reply! here: on initial creation the
+    # browser hasn't subscribed to the SessionsChannel yet, so an immediate
+    # generation would broadcast the streaming container before the socket is
+    # listening and the reply would never render live (SEC-506 Bug 4). Instead we
+    # render `show` in the reply_pending? state and let the session Stimulus
+    # controller POST to RepliesController once it has connected.
     def create
       prompt = current_user.prompts.for(@type).find(params[:prompt_id])
 
@@ -36,7 +43,6 @@ def create
       @session.messages.build(content: params[:prompt], role: :user, user: current_user)
       @session.save!
 
-      @session.request_reply!
       publish_event('echo_session.created', session: { id: @session.id })
 
       render :show
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 1e7e95c14..37a6a886b 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -66,6 +66,17 @@ def request_reply!
       ReplyJob.perform_later(self) if enqueue
     end
 
+    # True when a reply is owed but generation hasn't started yet: the session is
+    # idle and the newest message is a user turn. `create` renders `show` in this
+    # state and lets the freshly-subscribed client trigger request_reply!, so the
+    # streaming container is only broadcast once the socket is listening (SEC-506
+    # Bug 4). It flips back to false the moment ReplyJob flips the session to
+    # `generating` or an assistant reply lands, which makes the client trigger
+    # idempotent across reconnects and multiple viewers.
+    def reply_pending?
+      idle? && messages.order(:created_at, :id).last&.user?
+    end
+
     # Only completed turns are safe to replay to a provider: a streaming row has
     # no content yet, and a failed one carries a nil/partial body. Sending either
     # would poison the next request with a `content: nil` turn.
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index a74dcfb3b..ae64f62bd 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -12,6 +12,7 @@
       resources :grammar_suggestions, only: [:create], controller: 'projects/grammar_suggestions'
 
       resources :sessions, only: [:index, :show, :create], controller: 'projects/sessions' do
+        resource :reply, only: [:create], controller: 'projects/sessions/replies'
         resources :messages, only: [:create], controller: 'projects/sessions/messages'
       end
     end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
index b223a339f..bd22b25fb 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/session_spec.rb
@@ -171,6 +171,31 @@
     end
   end
 
+  describe '#reply_pending?' do
+    let(:session) { create(:echo_session) }
+
+    it 'is true when idle and the newest message is a user turn' do
+      create(:echo_message, session: session, role: :user, content: 'Hello')
+      expect(session).to be_reply_pending
+    end
+
+    it 'is false once an assistant reply is the newest message' do
+      create(:echo_message, session: session, role: :user, content: 'Hello')
+      create(:assistant_message, session: session, content: 'Hi there')
+      expect(session).not_to be_reply_pending
+    end
+
+    it 'is false while the session is already generating' do
+      create(:echo_message, session: session, role: :user, content: 'Hello')
+      session.update!(status: :generating)
+      expect(session).not_to be_reply_pending
+    end
+
+    it 'is false with no messages yet' do
+      expect(session).not_to be_reply_pending
+    end
+  end
+
   describe 'destroying the record' do
     it 'destroys sessions attached to a destroyed Note' do
       note = create(:note)
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
new file mode 100644
index 000000000..99e1da2a1
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
@@ -0,0 +1,49 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+describe 'Echo session replies' do
+  include ActiveJob::TestHelper
+
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let(:agent) { create(:agent, enabled: true) }
+  let(:issue) { create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi") }
+  let(:session) { create(:echo_session, agent: agent, record: issue) }
+
+  describe 'POST /addons/echo/projects/:project_id/sessions/:session_id/reply' do
+    it 'enqueues a reply when one is pending (the newest message is a user turn)' do
+      create(:echo_message, session: session, role: :user, content: 'What is the impact?', user: user)
+
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/reply"
+      }.to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob).with(session)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'does not enqueue a reply once the session has already been answered' do
+      create(:echo_message, session: session, role: :user, content: 'What is the impact?', user: user)
+      create(:assistant_message, session: session, content: 'It is high.')
+
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/reply"
+      }.not_to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
+
+      expect(response).to have_http_status(:ok)
+    end
+
+    it 'denies a session whose record is outside the current project scope' do
+      other_session = create(:echo_session, agent: agent, record: create(:issue, node: create(:node)))
+
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions/#{other_session.id}/reply"
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index e820cfda5..2d119cd78 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -45,17 +45,22 @@
       { type: 'issue', record: issue.id, prompt_id: prompt.id, prompt: 'Summarise the SQLi finding' }
     end
 
-    it 'creates a session with the first user message and triggers a reply' do
+    it 'creates a session with the first user message but defers the reply to the subscribed client' do
       expect {
         post "/addons/echo/projects/#{@project.id}/sessions", params: params
       }.to change(Dradis::Plugins::Echo::Session, :count).by(1)
         .and change(Dradis::Plugins::Echo::Message, :count).by(1)
-        .and have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
+
+      # The reply is triggered by the session Stimulus controller once it has
+      # subscribed, not by create — otherwise the streaming container broadcasts
+      # before the socket is listening and never renders live (SEC-506 Bug 4).
+      expect(Dradis::Plugins::Echo::ReplyJob).not_to have_been_enqueued
 
       session = Dradis::Plugins::Echo::Session.last
       expect(session.title).to eq(prompt.title)
       expect(session.user).to eq(user)
       expect(session.record).to eq(issue)
+      expect(session).to be_reply_pending
 
       message = session.messages.first
       expect(message.role).to eq('user')

From ecfd8c4b8237ed2b554e404179cc6c5e546ac06e Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:28:25 +0100
Subject: [PATCH 20/57] =?UTF-8?q?Echo:=20harden=20session=20controller=20?=
 =?UTF-8?q?=E2=80=94=20blank=20prompt,=20dead=20index,=20cable=20check?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Applies PR #1655 review findings on the session controllers slice:

- Blank-prompt 500 (#7): sessions#create now saves without a bang and
  returns 422 on an invalid (blank) prompt, mirroring the messages
  endpoint, instead of raising RecordInvalid.
- Dead index (#9): drop the unused sessions#index action and route;
  nothing links to it (the back-link and lazy frame use the interactions
  path). The dead index view is removed in the views slice.
- check_turbo_config (#10): extract a shared TurboConfigCheck concern
  that pings only the Redis adapter and memoizes, so async/test adapters
  no-op silently — no spurious 'can't contact Redis' alert, no
  per-request round-trip.
- SessionsChannel (#11): tighten the class comment to say re-auth guards
  new subscriptions only (comment-only).
---
 CHANGELOG                                     |  1 +
 .../dradis/plugins/echo/sessions_channel.rb   | 10 +++---
 .../dradis/plugins/echo/turbo_config_check.rb | 31 +++++++++++++++++
 .../echo/projects/sessions_controller.rb      | 29 +++++-----------
 engines/dradis-echo/config/routes.rb          |  2 +-
 .../plugins/echo/turbo_config_check_spec.rb   | 34 +++++++++++++++++++
 .../plugins/echo/projects/sessions_spec.rb    | 20 +++++------
 7 files changed, 90 insertions(+), 37 deletions(-)
 create mode 100644 engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
 create mode 100644 engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb

diff --git a/CHANGELOG b/CHANGELOG
index 843410918..c47454b76 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -39,6 +39,7 @@ v5.2.0 (July 2026)
       - Remove a stray leading blank line from streamed responses
       - Send only completed conversation turns to the AI provider, so a failed or in-progress reply can no longer break the next one
       - Show a generic message when a reply fails instead of surfacing the provider's raw error
+      - Return a graceful error instead of a server error when a chat session is started with a blank prompt
 
 v5.1.0 (May 2026)
   - DataTables: add sticky table toolbar that tracks below the navigation bar when scrolling
diff --git a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
index 9ce9e26de..b88d60010 100644
--- a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
+++ b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
@@ -1,10 +1,12 @@
 module Dradis::Plugins::Echo
   # Custom Turbo Streams channel for Echo sessions. Turbo's default channel
   # trusts any client holding a validly-signed stream name for the lifetime of
-  # that name — which never expires — so a user who loses project access keeps
-  # receiving the transcript. We re-check authorization at subscribe time
-  # instead: resolve the session behind the signed name and only stream if the
-  # subscriber may still :use its project, otherwise reject.
+  # that name — which never expires — so a user who loses project access could
+  # subscribe and keep receiving the transcript. We re-check authorization when
+  # a subscription is established: resolve the session behind the signed name
+  # and only stream if the subscriber may still :use its project, otherwise
+  # reject. Note this guards *new* subscriptions only; a connection opened while
+  # still authorized keeps streaming until it is torn down.
   #
   # Follows the documented turbo-rails custom-channel pattern
   # (Turbo::StreamsChannel).
diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
new file mode 100644
index 000000000..0cc2a2edf
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
@@ -0,0 +1,31 @@
+module Dradis::Plugins::Echo
+  # Shared `check_turbo_config` before_action for the streaming controllers.
+  # Turbo Streams only work if Action Cable can reach its backend, so the view
+  # can warn the user when it can't.
+  #
+  # Only the Redis adapter needs a reachable external server, so we ping just
+  # that one and memoize the result. Every other adapter (async in development,
+  # test in specs) is always treated as healthy — no spurious "can't contact
+  # Redis" alert and no per-request Redis round-trip.
+  module TurboConfigCheck
+    extend ActiveSupport::Concern
+
+    private
+
+    def check_turbo_config
+      return @turbo_status if defined?(@turbo_status)
+
+      @turbo_status = turbo_backend_reachable?
+    end
+
+    def turbo_backend_reachable?
+      adapter = ActionCable.server.pubsub
+      return true unless adapter.is_a?(ActionCable::SubscriptionAdapter::Redis)
+
+      adapter.redis_connection_for_subscriptions.ping
+      true
+    rescue StandardError
+      false
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index d9f50fdec..9874bf1aa 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -3,20 +3,14 @@ class Projects::SessionsController < AuthenticatedController
     include EventPublisher
     include ProjectScoped
     include RecordScoping
+    include TurboConfigCheck
     layout false
 
     before_action :set_type
-    before_action :set_record, only: [:index, :create]
+    before_action :set_record, only: [:create]
     before_action :check_turbo_config, only: [:show, :create]
     before_action :set_session, only: [:show]
 
-    def index
-      @sessions = Session.for_record(@record).order(created_at: :desc)
-
-      Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
-      @prompts = current_user.prompts.for(@type)
-    end
-
     def show; end
 
     # Starts a conversation from a saved prompt. The Prompt is read only here, at
@@ -41,24 +35,17 @@ def create
         user: current_user
       )
       @session.messages.build(content: params[:prompt], role: :user, user: current_user)
-      @session.save!
-
-      publish_event('echo_session.created', session: { id: @session.id })
 
-      render :show
+      if @session.save
+        publish_event('echo_session.created', session: { id: @session.id })
+        render :show
+      else
+        head :unprocessable_entity
+      end
     end
 
     private
 
-    def check_turbo_config
-      @turbo_status = begin
-        ActionCable.server.pubsub.redis_connection_for_subscriptions.ping
-        true
-      rescue
-        false
-      end
-    end
-
     def record_params
       params.permit(:id, :prompt, :prompt_id, :project_id, :record, :type)
     end
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index ae64f62bd..5071f3bab 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -11,7 +11,7 @@
       resources :grammar_corrections, only: [:create], controller: 'projects/grammar_corrections'
       resources :grammar_suggestions, only: [:create], controller: 'projects/grammar_suggestions'
 
-      resources :sessions, only: [:index, :show, :create], controller: 'projects/sessions' do
+      resources :sessions, only: [:show, :create], controller: 'projects/sessions' do
         resource :reply, only: [:create], controller: 'projects/sessions/replies'
         resources :messages, only: [:create], controller: 'projects/sessions/messages'
       end
diff --git a/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb b/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb
new file mode 100644
index 000000000..119856bca
--- /dev/null
+++ b/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb
@@ -0,0 +1,34 @@
+require 'rails_helper'
+
+describe Dradis::Plugins::Echo::TurboConfigCheck do
+  subject(:controller) do
+    Class.new { include Dradis::Plugins::Echo::TurboConfigCheck }.new
+  end
+
+  describe '#check_turbo_config' do
+    it 'reports healthy without pinging when the adapter is not Redis' do
+      adapter = double('non-redis adapter')
+      allow(ActionCable.server).to receive(:pubsub).and_return(adapter)
+      expect(adapter).not_to receive(:redis_connection_for_subscriptions)
+
+      expect(controller.send(:check_turbo_config)).to be(true)
+    end
+
+    it 'pings and reports healthy for a reachable Redis adapter' do
+      redis = double('redis', ping: 'PONG')
+      adapter = ActionCable::SubscriptionAdapter::Redis.allocate
+      allow(adapter).to receive(:redis_connection_for_subscriptions).and_return(redis)
+      allow(ActionCable.server).to receive(:pubsub).and_return(adapter)
+
+      expect(controller.send(:check_turbo_config)).to be(true)
+    end
+
+    it 'reports unhealthy when the Redis ping fails' do
+      adapter = ActionCable::SubscriptionAdapter::Redis.allocate
+      allow(adapter).to receive(:redis_connection_for_subscriptions).and_raise(StandardError)
+      allow(ActionCable.server).to receive(:pubsub).and_return(adapter)
+
+      expect(controller.send(:check_turbo_config)).to be(false)
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 2d119cd78..50559eeb9 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -29,17 +29,6 @@
     create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
   end
 
-  describe 'GET /addons/echo/projects/:project_id/sessions' do
-    it 'lists the sessions for the record' do
-      session = create(:echo_session, agent: roslin, record: issue)
-
-      get "/addons/echo/projects/#{@project.id}/sessions", params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include(session.title.to_s) if session.title.present?
-    end
-  end
-
   describe 'POST /addons/echo/projects/:project_id/sessions' do
     let(:params) do
       { type: 'issue', record: issue.id, prompt_id: prompt.id, prompt: 'Summarise the SQLi finding' }
@@ -82,6 +71,15 @@
       expect(session.title).to eq(prompt.title)
     end
 
+    it 'returns 422 for a blank prompt instead of raising a 500' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/sessions",
+          params: params.merge(prompt: '')
+      }.not_to change(Dradis::Plugins::Echo::Session, :count)
+
+      expect(response).to have_http_status(:unprocessable_entity)
+    end
+
     it 'honours the Prompt::SCOPES whitelist' do
       expect {
         post "/addons/echo/projects/#{@project.id}/sessions",

From 86d6d25c7a202484cc2c76c6dfbb3124794e410b Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 15:51:53 +0100
Subject: [PATCH 21/57] Echo: convert request-spec brace blocks to do...end for
 Style/BlockDelimiters

---
 .../echo/projects/sessions/messages_spec.rb      | 12 ++++++------
 .../echo/projects/sessions/replies_spec.rb       | 12 ++++++------
 .../plugins/echo/projects/sessions_spec.rb       | 16 ++++++++--------
 3 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
index d12c41614..e9bf492ad 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
@@ -18,10 +18,10 @@
 
   describe 'POST /addons/echo/projects/:project_id/sessions/:session_id/messages' do
     it 'appends a user message and triggers a reply' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/messages",
           params: { content: 'What is the impact?' }
-      }.to change { session.messages.count }.by(1)
+      end.to change { session.messages.count }.by(1)
         .and have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
 
       expect(response).to have_http_status(:ok)
@@ -33,10 +33,10 @@
     end
 
     it 'rejects a blank message without enqueuing a reply' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/messages",
           params: { content: '' }
-      }.not_to change(Dradis::Plugins::Echo::Message, :count)
+      end.not_to change(Dradis::Plugins::Echo::Message, :count)
 
       expect(response).to have_http_status(:unprocessable_entity)
     end
@@ -44,10 +44,10 @@
     it 'denies a session whose record is outside the current project scope' do
       other_session = create(:echo_session, agent: agent, record: create(:issue, node: create(:node)))
 
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{other_session.id}/messages",
           params: { content: 'Hello' }
-      }.to raise_error(ActiveRecord::RecordNotFound)
+      end.to raise_error(ActiveRecord::RecordNotFound)
     end
   end
 end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
index 99e1da2a1..f8ed626eb 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
@@ -20,9 +20,9 @@
     it 'enqueues a reply when one is pending (the newest message is a user turn)' do
       create(:echo_message, session: session, role: :user, content: 'What is the impact?', user: user)
 
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/reply"
-      }.to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob).with(session)
+      end.to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob).with(session)
 
       expect(response).to have_http_status(:ok)
     end
@@ -31,9 +31,9 @@
       create(:echo_message, session: session, role: :user, content: 'What is the impact?', user: user)
       create(:assistant_message, session: session, content: 'It is high.')
 
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/reply"
-      }.not_to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
+      end.not_to have_enqueued_job(Dradis::Plugins::Echo::ReplyJob)
 
       expect(response).to have_http_status(:ok)
     end
@@ -41,9 +41,9 @@
     it 'denies a session whose record is outside the current project scope' do
       other_session = create(:echo_session, agent: agent, record: create(:issue, node: create(:node)))
 
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{other_session.id}/reply"
-      }.to raise_error(ActiveRecord::RecordNotFound)
+      end.to raise_error(ActiveRecord::RecordNotFound)
     end
   end
 end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 50559eeb9..148ca6c14 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -35,9 +35,9 @@
     end
 
     it 'creates a session with the first user message but defers the reply to the subscribed client' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions", params: params
-      }.to change(Dradis::Plugins::Echo::Session, :count).by(1)
+      end.to change(Dradis::Plugins::Echo::Session, :count).by(1)
         .and change(Dradis::Plugins::Echo::Message, :count).by(1)
 
       # The reply is triggered by the session Stimulus controller once it has
@@ -72,28 +72,28 @@
     end
 
     it 'returns 422 for a blank prompt instead of raising a 500' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions",
           params: params.merge(prompt: '')
-      }.not_to change(Dradis::Plugins::Echo::Session, :count)
+      end.not_to change(Dradis::Plugins::Echo::Session, :count)
 
       expect(response).to have_http_status(:unprocessable_entity)
     end
 
     it 'honours the Prompt::SCOPES whitelist' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions",
           params: params.merge(type: 'node')
-      }.to raise_error(ActiveRecord::RecordNotFound)
+      end.to raise_error(ActiveRecord::RecordNotFound)
     end
 
     it 'denies a record outside the current project scope' do
       other_issue = create(:issue, node: create(:node))
 
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/sessions",
           params: params.merge(record: other_issue.id)
-      }.to raise_error(ActiveRecord::RecordNotFound)
+      end.to raise_error(ActiveRecord::RecordNotFound)
     end
   end
 end

From c6b658351b60be290d9ce6ea8a34802f7209e44f Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 24 Jul 2026 17:21:31 +0100
Subject: [PATCH 22/57] Echo: apply Slice-4 review resolutions (channel rescue,
 record scoping, index)

---
 .../dradis/plugins/echo/sessions_channel.rb   |  7 ++--
 .../dradis/plugins/echo/record_scoping.rb     | 12 +++++--
 .../projects/sessions/messages_controller.rb  |  2 +-
 .../projects/sessions/replies_controller.rb   |  2 +-
 .../echo/projects/sessions_controller.rb      | 24 +++++++++----
 engines/dradis-echo/config/routes.rb          |  2 +-
 .../plugins/echo/projects/sessions_spec.rb    | 34 +++++++++++++++++++
 7 files changed, 68 insertions(+), 15 deletions(-)

diff --git a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
index b88d60010..aaa34a8b1 100644
--- a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
+++ b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
@@ -32,14 +32,17 @@ def authorized?(session)
 
     # The signed name encodes `[session, :messages]`, i.e.
     # "<session-gid-param>:messages". A tampered name fails verification and
-    # yields nil, which we treat as unauthorized.
+    # yields nil (never reaching locate), so the only raise path left is a
+    # session deleted between signing and subscribe — RecordNotFound, which we
+    # treat as unauthorized. Narrower than a blanket rescue so genuine bugs
+    # (NoMethodError etc.) still surface.
     def session_from_stream_name
       name = verified_stream_name_from_params
       return unless name
 
       record = GlobalID::Locator.locate(name.split(':').first)
       record if record.is_a?(Session)
-    rescue StandardError
+    rescue ActiveRecord::RecordNotFound
       nil
     end
   end
diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
index 3791c5370..15d8f0fa1 100644
--- a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
@@ -4,14 +4,20 @@ module Dradis::Plugins::Echo
   # project; resolving it through the project's collections gives us
   # cross-project/record isolation for free — an out-of-scope id raises
   # ActiveRecord::RecordNotFound, mirroring Projects::GrammarController.
+  #
+  # We read the session's stored record_type/record_id directly rather than
+  # loading session.record: the association would fire a polymorphic query just
+  # to re-scope through the project. Issues are persisted as 'Issue' even though
+  # they descend from Note (see Session#record=), so the comparison matches the
+  # column exactly.
   module RecordScoping
     extend ActiveSupport::Concern
 
     private
 
-    def scoped_record(record)
-      collection = record.is_a?(Issue) ? current_project.issues : current_project.notes
-      collection.find(record.id)
+    def scoped_record(session)
+      collection = session.record_type == 'Issue' ? current_project.issues : current_project.notes
+      collection.find(session.record_id)
     end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
index 99fdfb492..8a354c649 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
@@ -23,7 +23,7 @@ def create
 
     def set_session
       @session = Session.find(params[:session_id])
-      scoped_record(@session.record)
+      scoped_record(@session)
     end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
index 220ef6fb0..651ef31a8 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
@@ -22,7 +22,7 @@ def create
 
     def set_session
       @session = Session.find(params[:session_id])
-      scoped_record(@session.record)
+      scoped_record(@session)
     end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 9874bf1aa..856ad53a9 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -6,11 +6,19 @@ class Projects::SessionsController < AuthenticatedController
     include TurboConfigCheck
     layout false
 
-    before_action :set_type
-    before_action :set_record, only: [:create]
+    before_action :set_type, only: [:create, :index]
+    before_action :set_record, only: [:create, :index]
     before_action :check_turbo_config, only: [:show, :create]
     before_action :set_session, only: [:show]
 
+    # Lists the record's past sessions plus the prompts available to start a new
+    # one. Roslin-disabled and prompts empty-state warnings are handled by the
+    # view.
+    def index
+      @sessions = Session.for_record(@record)
+      @prompts = current_user.prompts.for(@type)
+    end
+
     def show; end
 
     # Starts a conversation from a saved prompt. The Prompt is read only here, at
@@ -51,19 +59,21 @@ def record_params
     end
 
     def set_record
-      raise ActiveRecord::RecordNotFound if @type.blank?
-
       @record = current_project.send(@type.to_s.pluralize).find(record_params[:record])
     end
 
     def set_session
       @session = Session.find(record_params[:id])
-      @record = scoped_record(@session.record)
+      @record = scoped_record(@session)
     end
 
+    # Whitelists the record type against Prompt::SCOPES before it reaches a
+    # dynamic `current_project.send(@type.pluralize)` dispatch. An unknown type
+    # is an out-of-scope request, not a 500 — raise the same RecordNotFound the
+    # scoped lookups do.
     def set_type
-      allowed = Prompt::SCOPES.map(&:to_s)
-      @type = allowed.include?(record_params[:type]) ? record_params[:type].to_sym : nil
+      @type = record_params[:type]&.to_sym
+      raise ActiveRecord::RecordNotFound unless Prompt::SCOPES.include?(@type)
     end
   end
 end
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index 5071f3bab..ae64f62bd 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -11,7 +11,7 @@
       resources :grammar_corrections, only: [:create], controller: 'projects/grammar_corrections'
       resources :grammar_suggestions, only: [:create], controller: 'projects/grammar_suggestions'
 
-      resources :sessions, only: [:show, :create], controller: 'projects/sessions' do
+      resources :sessions, only: [:index, :show, :create], controller: 'projects/sessions' do
         resource :reply, only: [:create], controller: 'projects/sessions/replies'
         resources :messages, only: [:create], controller: 'projects/sessions/messages'
       end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 148ca6c14..8e2fc8b73 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -29,6 +29,40 @@
     create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
   end
 
+  describe 'GET /addons/echo/projects/:project_id/sessions' do
+    it 'lists the record-scoped sessions and prompts' do
+      prompt # a prompt must exist for the sessions list to render
+      session = Dradis::Plugins::Echo::Session.create!(
+        agent: roslin, record: issue, title: 'Existing session', user: user
+      )
+
+      get "/addons/echo/projects/#{@project.id}/sessions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Existing session')
+      expect(response.body).to include(
+        ActionView::RecordIdentifier.dom_id(session)
+      )
+    end
+
+    it 'honours the Prompt::SCOPES whitelist' do
+      expect do
+        get "/addons/echo/projects/#{@project.id}/sessions",
+          params: { type: 'node', record: issue.id }
+      end.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
+    it 'denies a record outside the current project scope' do
+      other_issue = create(:issue, node: create(:node))
+
+      expect do
+        get "/addons/echo/projects/#{@project.id}/sessions",
+          params: { type: 'issue', record: other_issue.id }
+      end.to raise_error(ActiveRecord::RecordNotFound)
+    end
+  end
+
   describe 'POST /addons/echo/projects/:project_id/sessions' do
     let(:params) do
       { type: 'issue', record: issue.id, prompt_id: prompt.id, prompt: 'Summarise the SQLi finding' }

From 7bc671b991aec80b2fc704e65799098be3c9916a Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 14:03:07 +0100
Subject: [PATCH 23/57] Echo: authorize socket subscriptions via
 session.project

Ask the session for its project instead of reaching through
session.record.project. record is polymorphic, so the delegation is the right
seam for the authorization check and keeps callers decoupled from where a
session's project currently comes from.
---
 .../app/channels/dradis/plugins/echo/sessions_channel.rb        | 2 +-
 .../spec/channels/dradis/plugins/echo/sessions_channel_spec.rb  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
index aaa34a8b1..b91fff5bd 100644
--- a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
+++ b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
@@ -27,7 +27,7 @@ def subscribed
     private
 
     def authorized?(session)
-      Ability.new(current_user).can?(:use, session.record.project)
+      Ability.new(current_user).can?(:use, session.project)
     end
 
     # The signed name encodes `[session, :messages]`, i.e.
diff --git a/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
index 3c26051b3..b33227e7f 100644
--- a/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
+++ b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
@@ -19,7 +19,7 @@
     expect(subscription).to have_stream_from(stream_name)
   end
 
-  it 'rejects a user whose :use on the record project is denied' do
+  it "rejects a user whose :use on the session's project is denied" do
     allow_any_instance_of(Ability).to receive(:can?).and_return(false)
 
     subscribe(signed_stream_name: signed_name)

From 6c4141e745c719dc52d91cc4513b5b6a645f5f20 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 15:27:51 +0100
Subject: [PATCH 24/57] =?UTF-8?q?Echo:=20apply=20caitmich=20review=20?=
 =?UTF-8?q?=E2=80=94=20only:=20Session,=20role=20callback,=20generalized?=
 =?UTF-8?q?=20scoping,=20duck-typed=20cable=20check?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../dradis/plugins/echo/sessions_channel.rb        |  3 +--
 .../concerns/dradis/plugins/echo/record_scoping.rb |  7 +++----
 .../dradis/plugins/echo/turbo_config_check.rb      | 11 ++++++-----
 .../app/models/dradis/plugins/echo/message.rb      | 10 ++++++++++
 .../dradis/plugins/echo/turbo_config_check_spec.rb |  5 ++++-
 .../models/dradis/plugins/echo/message_spec.rb     | 14 ++++++++++++++
 6 files changed, 38 insertions(+), 12 deletions(-)

diff --git a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
index b91fff5bd..faa9d7c84 100644
--- a/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
+++ b/engines/dradis-echo/app/channels/dradis/plugins/echo/sessions_channel.rb
@@ -40,8 +40,7 @@ def session_from_stream_name
       name = verified_stream_name_from_params
       return unless name
 
-      record = GlobalID::Locator.locate(name.split(':').first)
-      record if record.is_a?(Session)
+      GlobalID::Locator.locate(name.split(':').first, only: Session)
     rescue ActiveRecord::RecordNotFound
       nil
     end
diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
index 15d8f0fa1..e87712766 100644
--- a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/record_scoping.rb
@@ -8,16 +8,15 @@ module Dradis::Plugins::Echo
   # We read the session's stored record_type/record_id directly rather than
   # loading session.record: the association would fire a polymorphic query just
   # to re-scope through the project. Issues are persisted as 'Issue' even though
-  # they descend from Note (see Session#record=), so the comparison matches the
-  # column exactly.
+  # they descend from Note (see Session#record=), so record_type maps straight
+  # onto the matching project collection (issues, notes, ...).
   module RecordScoping
     extend ActiveSupport::Concern
 
     private
 
     def scoped_record(session)
-      collection = session.record_type == 'Issue' ? current_project.issues : current_project.notes
-      collection.find(session.record_id)
+      current_project.public_send(session.record_type.underscore.pluralize).find(session.record_id)
     end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
index 0cc2a2edf..92982ff97 100644
--- a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/turbo_config_check.rb
@@ -3,10 +3,11 @@ module Dradis::Plugins::Echo
   # Turbo Streams only work if Action Cable can reach its backend, so the view
   # can warn the user when it can't.
   #
-  # Only the Redis adapter needs a reachable external server, so we ping just
-  # that one and memoize the result. Every other adapter (async in development,
-  # test in specs) is always treated as healthy — no spurious "can't contact
-  # Redis" alert and no per-request Redis round-trip.
+  # Only a Redis-backed adapter needs a reachable external server, so we ping
+  # just those (duck-typed on the subscription connection) and memoize the
+  # result. Every other adapter (async in development, test in specs) is always
+  # treated as healthy — no spurious "can't contact Redis" alert and no
+  # per-request Redis round-trip.
   module TurboConfigCheck
     extend ActiveSupport::Concern
 
@@ -20,7 +21,7 @@ def check_turbo_config
 
     def turbo_backend_reachable?
       adapter = ActionCable.server.pubsub
-      return true unless adapter.is_a?(ActionCable::SubscriptionAdapter::Redis)
+      return true unless adapter.respond_to?(:redis_connection_for_subscriptions)
 
       adapter.redis_connection_for_subscriptions.ping
       true
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
index 68a10408f..4b3660e4b 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/message.rb
@@ -16,6 +16,12 @@ class Message < ApplicationRecord
     belongs_to :user, optional: true
 
     # -- Callbacks ------------------------------------------------------------
+    # The author is the source of truth for a user turn, so controllers don't
+    # repeat `role: :user` on every build. ReplyJob still sets `role: :assistant`
+    # explicitly (assistant messages carry no user). Runs before the predicate
+    # callbacks below so `user?` sees the derived role.
+    before_validation :set_role_from_user
+
     # User messages are authored in full, so they're never mid-stream.
     before_validation :complete_user_messages, if: :user?
 
@@ -45,5 +51,9 @@ def broadcast_created
     def complete_user_messages
       self.status = :complete
     end
+
+    def set_role_from_user
+      self.role ||= :user if user.present?
+    end
   end
 end
diff --git a/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb b/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb
index 119856bca..1a5173083 100644
--- a/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb
+++ b/engines/dradis-echo/spec/controllers/concerns/dradis/plugins/echo/turbo_config_check_spec.rb
@@ -7,9 +7,12 @@
 
   describe '#check_turbo_config' do
     it 'reports healthy without pinging when the adapter is not Redis' do
+      # A plain double doesn't respond_to :redis_connection_for_subscriptions,
+      # so the duck-typed guard returns healthy without a ping. (Stubbing the
+      # method here would make respond_to? true and defeat the check — an
+      # unexpected call would instead raise, still failing the example.)
       adapter = double('non-redis adapter')
       allow(ActionCable.server).to receive(:pubsub).and_return(adapter)
-      expect(adapter).not_to receive(:redis_connection_for_subscriptions)
 
       expect(controller.send(:check_turbo_config)).to be(true)
     end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
index 6ee3f2c65..cd17dde56 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
@@ -46,6 +46,20 @@
     end
   end
 
+  describe 'role derivation' do
+    it 'derives the user role from the author when none is given' do
+      message = build(:echo_message, role: nil)
+      message.valid?
+      expect(message.role).to eq('user')
+    end
+
+    it 'leaves an explicit assistant role untouched' do
+      message = build(:assistant_message)
+      message.valid?
+      expect(message.role).to eq('assistant')
+    end
+  end
+
   describe 'metadata' do
     it 'is stored as JSON' do
       message = create(:echo_message, metadata: { 'model' => 'qwen2.5:14b' })

From 7c178fac666cfcab147ab17355b741b784e01ab4 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 15:27:56 +0100
Subject: [PATCH 25/57] Echo: extract HasSession concern, scope routes under
 projects module, expect content param

---
 .../dradis/plugins/echo/has_session.rb        | 21 +++++++++++++++++++
 .../projects/sessions/messages_controller.rb  | 13 ++----------
 .../projects/sessions/replies_controller.rb   | 11 +---------
 .../echo/projects/sessions_controller.rb      |  8 +++++--
 engines/dradis-echo/config/routes.rb          | 20 +++++++++++-------
 .../echo/projects/sessions/messages_spec.rb   |  7 +++++--
 6 files changed, 47 insertions(+), 33 deletions(-)
 create mode 100644 engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/has_session.rb

diff --git a/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/has_session.rb b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/has_session.rb
new file mode 100644
index 000000000..98d97b358
--- /dev/null
+++ b/engines/dradis-echo/app/controllers/concerns/dradis/plugins/echo/has_session.rb
@@ -0,0 +1,21 @@
+module Dradis::Plugins::Echo
+  # Loads the URL-nested session for the message/reply controllers and re-scopes
+  # it through the current project, so an out-of-scope session_id raises
+  # ActiveRecord::RecordNotFound rather than leaking another project's session.
+  # Pulls in RecordScoping for the scoped lookup; consumers only include this.
+  module HasSession
+    extend ActiveSupport::Concern
+    include RecordScoping
+
+    included do
+      before_action :set_session
+    end
+
+    private
+
+    def set_session
+      @session = Session.find(params[:session_id])
+      scoped_record(@session)
+    end
+  end
+end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
index 8a354c649..8c5f31ccb 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/messages_controller.rb
@@ -1,15 +1,13 @@
 module Dradis::Plugins::Echo
   class Projects::Sessions::MessagesController < AuthenticatedController
+    include HasSession
     include ProjectScoped
-    include RecordScoping
     layout false
 
-    before_action :set_session
-
     # Appends a user turn and re-opens the reply gate. The new message
     # broadcasts itself into the transcript, so there's nothing to render back.
     def create
-      message = @session.messages.build(content: params[:content], role: :user, user: current_user)
+      message = @session.messages.build(content: params.expect(:content), user: current_user)
 
       if message.save
         @session.request_reply!
@@ -18,12 +16,5 @@ def create
         head :unprocessable_entity
       end
     end
-
-    private
-
-    def set_session
-      @session = Session.find(params[:session_id])
-      scoped_record(@session)
-    end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
index 651ef31a8..e4cef5c30 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
@@ -1,11 +1,9 @@
 module Dradis::Plugins::Echo
   class Projects::Sessions::RepliesController < AuthenticatedController
+    include HasSession
     include ProjectScoped
-    include RecordScoping
     layout false
 
-    before_action :set_session
-
     # Starts generation for a freshly-created session. The session Stimulus
     # controller POSTs here from `connect`, i.e. after the browser has subscribed
     # to the SessionsChannel, so the streaming container ReplyJob broadcasts lands
@@ -17,12 +15,5 @@ def create
       @session.request_reply! if @session.reply_pending?
       head :ok
     end
-
-    private
-
-    def set_session
-      @session = Session.find(params[:session_id])
-      scoped_record(@session)
-    end
   end
 end
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 856ad53a9..10c3e1a91 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -19,7 +19,9 @@ def index
       @prompts = current_user.prompts.for(@type)
     end
 
-    def show; end
+    def show
+      @messages = @session.messages.order(:created_at, :id)
+    end
 
     # Starts a conversation from a saved prompt. The Prompt is read only here, at
     # the controller boundary — we copy its title and never store a FK, so a
@@ -34,6 +36,8 @@ def show; end
     # render `show` in the reply_pending? state and let the session Stimulus
     # controller POST to RepliesController once it has connected.
     def create
+      return head :unprocessable_entity if params[:prompt].blank?
+
       prompt = current_user.prompts.for(@type).find(params[:prompt_id])
 
       @session = Session.new(
@@ -42,7 +46,7 @@ def create
         title: prompt.title,
         user: current_user
       )
-      @session.messages.build(content: params[:prompt], role: :user, user: current_user)
+      @session.messages.build(content: params[:prompt], user: current_user)
 
       if @session.save
         publish_event('echo_session.created', session: { id: @session.id })
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index ae64f62bd..3800bcf1a 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -4,16 +4,20 @@
     resources :providers, except: [:show]
 
     resources :projects, only: [] do
-      resources :interactions, only: [:index, :show, :create], controller: 'projects/interactions' do
-        get :preview, on: :member
-      end
+      scope module: 'projects' do
+        resources :interactions, only: [:index, :show, :create] do
+          get :preview, on: :member
+        end
 
-      resources :grammar_corrections, only: [:create], controller: 'projects/grammar_corrections'
-      resources :grammar_suggestions, only: [:create], controller: 'projects/grammar_suggestions'
+        resources :grammar_corrections, only: [:create]
+        resources :grammar_suggestions, only: [:create]
 
-      resources :sessions, only: [:index, :show, :create], controller: 'projects/sessions' do
-        resource :reply, only: [:create], controller: 'projects/sessions/replies'
-        resources :messages, only: [:create], controller: 'projects/sessions/messages'
+        resources :sessions, only: [:index, :show, :create] do
+          scope module: 'sessions' do
+            resource :reply, only: [:create]
+            resources :messages, only: [:create]
+          end
+        end
       end
     end
 
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
index e9bf492ad..cca74a084 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
@@ -33,12 +33,15 @@
     end
 
     it 'rejects a blank message without enqueuing a reply' do
+      # params.expect(:content) treats a blank required scalar as missing and
+      # raises ParameterMissing (a 400 in production, before the reply gate is
+      # ever reached) rather than persisting an invalid message.
       expect do
         post "/addons/echo/projects/#{@project.id}/sessions/#{session.id}/messages",
           params: { content: '' }
-      end.not_to change(Dradis::Plugins::Echo::Message, :count)
+      end.to raise_error(ActionController::ParameterMissing)
 
-      expect(response).to have_http_status(:unprocessable_entity)
+      expect(session.messages.count).to eq(0)
     end
 
     it 'denies a session whose record is outside the current project scope' do

From 4bd83cf84af7a7a76c627e9efbf72c9419d0a9d2 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 15:28:01 +0100
Subject: [PATCH 26/57] Echo: extract session messages partial, drop redundant
 session-link params

---
 .../plugins/echo/projects/sessions/_messages.html.erb    | 7 +++++++
 .../dradis/plugins/echo/projects/sessions/index.html.erb | 2 +-
 .../dradis/plugins/echo/projects/sessions/show.html.erb  | 9 +++------
 3 files changed, 11 insertions(+), 7 deletions(-)
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb

diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb
new file mode 100644
index 000000000..60935049b
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb
@@ -0,0 +1,7 @@
+<%# locals: (messages:) -%>
+<%# The live transcript container. ReplyJob and Message#broadcast_created append %>
+<%# new turns into #echo-messages, so its id must stay stable across renders. %>
+<div id="echo-messages" data-behavior="echo-messages">
+  <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+             collection: messages, as: :message %>
+</div>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
index 144cda73f..5bc6007a9 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
@@ -4,7 +4,7 @@
       <div class="list-group mb-3" id="echo-sessions" data-behavior="echo-sessions">
         <% @sessions.each do |session| %>
           <%= link_to session.title.presence || "Session ##{session.id}",
-                echo.project_session_path(current_project, session, type: @type, record: @record.id),
+                echo.project_session_path(current_project, session),
                 id: dom_id(session),
                 class: 'list-group-item list-group-item-action',
                 data: { turbo_frame: dom_id(@record, :echo) } %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
index 364c02f56..d176a89a4 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -5,15 +5,12 @@
     </div>
   <% end %>
 
-  <%# Live transcript + composer state. Slice 5 adds `channel: SessionsChannel` %>
-  <%# so the socket re-authorizes on subscribe. %>
+  <%# Live transcript + composer state. A later slice wires the custom %>
+  <%# SessionsChannel (`channel:`) so the socket re-authorizes on subscribe. %>
   <%= turbo_stream_from [@session, :messages] %>
   <%= turbo_stream_from [@session, :composer_state] %>
 
-  <div id="echo-messages" data-behavior="echo-messages">
-    <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
-               collection: @session.messages.order(:created_at, :id), as: :message %>
-  </div>
+  <%= render 'dradis/plugins/echo/projects/sessions/messages', messages: @messages %>
 
   <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
 

From 6acb91246775d02390dcb5e7d97938bd83de5620 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:48:58 +0100
Subject: [PATCH 27/57] Echo: build the session conversation views and message
 styling

Slice 5a of Echo Sessions (SEC-477), built against the accepted UX
design (SEC-476). The interactions index now surfaces the record's
existing conversations above the prompt picker, the picker starts a
session (POST to sessions#create), and sessions#show renders the live
transcript over the re-authorizing SessionsChannel plus a composer whose
Send button reflects the broadcast generating state. The _message and
_composer_state partials are restyled to the design; new sessions.scss
replaces the old 50vh inline style with a content-driven flex layout.

Turbo Stream broadcasts render _message (with avatar_image) outside a
request, so test env now resolves assets lazily instead of failing the
strict precompiled-asset check that only applies in production.
---
 config/environments/test.rb                   |   6 +
 .../dradis/plugins/echo/manifests/hera.scss   |   1 +
 .../dradis/plugins/echo/sessions.scss         | 265 ++++++++++++++++++
 .../echo/projects/interactions_controller.rb  |   1 +
 .../projects/interactions/_prompt.html.erb    |   7 +-
 .../projects/interactions/_response.html.erb  |  30 --
 .../echo/projects/interactions/index.html.erb |  34 +++
 .../echo/projects/interactions/show.html.erb  |  20 --
 .../sessions/_composer_state.html.erb         |  25 +-
 .../sessions/messages/_message.html.erb       |  56 ++--
 .../echo/projects/sessions/show.html.erb      |  45 ++-
 11 files changed, 395 insertions(+), 95 deletions(-)
 create mode 100644 engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
 delete mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_response.html.erb
 delete mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/show.html.erb

diff --git a/config/environments/test.rb b/config/environments/test.rb
index 380306bbe..07977b3af 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -62,6 +62,12 @@
 
   config.assets.precompile += %w( hera/test.css hera/test.js )
 
+  # Turbo Stream broadcasts render partials outside a request (e.g. Echo's live
+  # session transcript), where the Sprockets middleware environment isn't in
+  # scope. With assets compiled on demand in test, resolve them lazily instead
+  # of failing the strict "precompiled?" check that only makes sense in prod.
+  config.assets.check_precompiled_asset = false
+
   # Raises error for missing translations.
   # config.i18n.raise_on_missing_translations = true
 
diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/manifests/hera.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/manifests/hera.scss
index a2f13d24a..a5ef8223e 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/manifests/hera.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/manifests/hera.scss
@@ -1,3 +1,4 @@
 //= require dradis/plugins/echo/grammar
 //= require dradis/plugins/echo/prompts
 //= require dradis/plugins/echo/providers
+//= require dradis/plugins/echo/sessions
diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
new file mode 100644
index 000000000..6d6e060e9
--- /dev/null
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -0,0 +1,265 @@
+// Echo Sessions — session list, message list, composer.
+// Ships in Slice 5. Add `//= require dradis/plugins/echo/sessions` to the engine
+// hera.scss manifest. Replaces the inline `style="height: 50vh"` in the old
+// interactions/show.html.erb. Tokens only (var(--*)); no hardcoded colors,
+// no ID selectors, no !important, no inline styles. px only for borders.
+
+// ---- Session list (interactions#index, above the prompt picker) ----
+.echo-section-label {
+  color: var(--text-muted);
+  font-size: 0.75rem;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  margin-bottom: 0.5rem;
+  text-transform: uppercase;
+}
+
+.echo-session-list {
+  margin-bottom: 1.5rem;
+}
+
+.echo-session-item {
+  align-items: center;
+  border: 1px solid var(--border-color);
+  border-radius: 0.375rem;
+  color: var(--text-default);
+  display: flex;
+  gap: 0.75rem;
+  margin-bottom: 0.5rem;
+  padding: 0.6rem 0.85rem;
+  text-decoration: none;
+  transition: background-color 0.12s ease-in-out;
+
+  &:hover {
+    background-color: var(--secondary-bg);
+  }
+
+  .echo-session-chevron {
+    color: var(--text-muted);
+    margin-left: auto;
+  }
+
+  .echo-session-icon {
+    color: var(--text-muted);
+    text-align: center;
+    width: 1.1rem;
+  }
+
+  .echo-session-meta {
+    color: var(--text-muted);
+    font-size: 0.75rem;
+  }
+
+  .echo-session-title {
+    font-weight: 600;
+  }
+}
+
+.echo-session-empty {
+  color: var(--text-muted);
+  font-size: 0.9rem;
+  padding: 0.5rem 0.25rem 1rem;
+}
+
+.echo-session-generating {
+  align-items: center;
+  color: var(--text-link);
+  display: inline-flex;
+  font-size: 0.75rem;
+  font-weight: 600;
+  gap: 0.35rem;
+  margin-left: auto;
+}
+
+// ---- Conversation surface (sessions#show) ----
+// Flex column: scrolling message list + pinned composer. Content-driven height
+// with a sensible ceiling — no viewport-locked 50vh.
+.echo-conversation {
+  display: flex;
+  flex-direction: column;
+  // A content-driven ceiling: track 70vh but never below 20rem or above 40rem.
+  // clamp() passes through SassC untouched, whereas a bare min()/max() is a Sass
+  // built-in that errors comparing vh and rem. With the min-height floor below,
+  // this is equivalent to `max-height: min(70vh, 40rem)`.
+  max-height: clamp(20rem, 70vh, 40rem);
+  min-height: 20rem;
+}
+
+.echo-conversation-header {
+  align-items: center;
+  border-bottom: 1px solid var(--border-color);
+  display: flex;
+  flex: 0 0 auto;
+  gap: 0.5rem;
+  margin-bottom: 0.25rem;
+  padding-bottom: 0.6rem;
+
+  .echo-back-link {
+    color: var(--text-link);
+    font-size: 0.85rem;
+    text-decoration: none;
+    white-space: nowrap;
+
+    &:hover {
+      color: var(--text-link-hover);
+    }
+  }
+
+  .echo-conversation-agent {
+    color: var(--text-muted);
+    font-size: 0.8rem;
+    font-weight: 400;
+  }
+
+  .echo-conversation-title {
+    color: var(--text-default);
+    font-weight: 600;
+    margin: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+}
+
+.echo-messages {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
+  padding: 0.25rem 0.5rem 0.25rem 0.25rem;
+}
+
+// ---- Message row ----
+.echo-message {
+  border-bottom: 1px solid var(--border-color);
+  display: flex;
+  gap: 0.6rem;
+  padding: 0.85rem 0.25rem;
+
+  &:last-child {
+    border-bottom: none;
+  }
+
+  .echo-message-body {
+    min-width: 0;
+    width: 100%;
+  }
+
+  // v1: plain text with preserved whitespace. No markdown/Textile pipeline.
+  // Content is HTML-escaped server-side before rendering/broadcasting.
+  .echo-message-content {
+    color: var(--text-default);
+    margin-top: 0.25rem;
+    white-space: break-spaces;
+    word-break: break-word;
+  }
+
+  .time {
+    color: var(--text-muted);
+    font-size: 0.75rem;
+    margin-left: 0.4rem;
+  }
+
+  .user {
+    color: var(--text-default);
+    font-weight: 600;
+  }
+}
+
+// Assistant (Roslin) — brand accent + tint so the single LLM reads distinctly
+// from N human participants. Keyed off role, not user presence.
+.echo-message-assistant {
+  background-color: var(--secondary-bg-subtle);
+  border-left: 3px solid var(--brand-bg);
+  border-radius: 0 0.35rem 0.35rem 0;
+  padding-left: 0.75rem;
+}
+
+.echo-avatar-agent {
+  align-items: center;
+  background-color: var(--brand-bg);
+  border-radius: 50%;
+  color: #fff;
+  display: flex;
+  flex: 0 0 auto;
+  height: 35px;
+  justify-content: center;
+  width: 35px;
+}
+
+// Streaming state — spinner + caption under the (possibly partial) content.
+.echo-message-streaming {
+  .echo-streaming-caption {
+    align-items: center;
+    color: var(--text-muted);
+    display: inline-flex;
+    font-size: 0.8rem;
+    font-style: italic;
+    gap: 0.4rem;
+    margin-top: 0.25rem;
+  }
+}
+
+.spinner-border-xs {
+  border-width: 0.15em;
+  height: 0.85rem;
+  width: 0.85rem;
+}
+
+// Failed state — persisted; a reload still shows what went wrong.
+.echo-message-failed {
+  border-left-color: var(--text-error);
+
+  .echo-avatar-agent {
+    background-color: var(--text-error);
+  }
+
+  .echo-error-hint {
+    color: var(--text-muted);
+    font-size: 0.8rem;
+    margin-top: 0.15rem;
+  }
+
+  .echo-error-line {
+    align-items: baseline;
+    color: var(--text-error);
+    display: flex;
+    gap: 0.4rem;
+    margin-top: 0.25rem;
+  }
+}
+
+// Deleted (nullified) user — author line falls back to "Deleted user".
+.echo-message-deleted {
+  .user {
+    color: var(--text-muted);
+    font-style: italic;
+  }
+}
+
+// ---- Composer ----
+.echo-composer {
+  border-top: 1px solid var(--border-color);
+  flex: 0 0 auto;
+  margin-top: 0.25rem;
+  padding-top: 0.75rem;
+
+  textarea.form-control {
+    resize: none;
+  }
+
+  .echo-composer-actions {
+    align-items: center;
+    display: flex;
+    gap: 0.75rem;
+    justify-content: space-between;
+    margin-top: 0.5rem;
+  }
+
+  .echo-composer-hint {
+    align-items: center;
+    color: var(--text-muted);
+    display: inline-flex;
+    font-size: 0.75rem;
+    gap: 0.4rem;
+  }
+}
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
index 141c9b7b7..317c74837 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
@@ -12,6 +12,7 @@ def index
       Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
 
       @prompts = current_user.prompts.for(@type)
+      @sessions = Session.for_record(@record).order(updated_at: :desc)
     end
 
     def preview; end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_prompt.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_prompt.html.erb
index 7264bdf26..ca7b39722 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_prompt.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_prompt.html.erb
@@ -1,7 +1,10 @@
-<%= form_with url: echo.project_interaction_path(current_project, prompt.id), method: :get,
+<%# Starts a new session from the selected prompt. The response renders sessions#show %>
+<%# into the Echo record frame, replacing the picker with the live conversation. %>
+<%= form_with url: echo.project_sessions_path(current_project), method: :post,
               data: { turbo_frame: dom_id(@record, :echo) } do |f| %>
   <%= f.hidden_field :type, value: @type %>
   <%= f.hidden_field :record, value: @record.id %>
+  <%= f.hidden_field :prompt_id, value: prompt.id %>
 
   <div class="input-group">
     <%=
@@ -9,7 +12,7 @@
         value: liquid_parse(prompt.prompt),
         class: 'form-control field-sizing-content',
         placeholder: 'Enter your prompt here...',
-        rows: 30
+        rows: 6
     %>
   </div>
 
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_response.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_response.html.erb
deleted file mode 100644
index 36f2857be..000000000
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/_response.html.erb
+++ /dev/null
@@ -1,30 +0,0 @@
-<div class="echo-response mb-3">
-  <div class="accordion" id="accordionEcho">
-    <div class="accordion-item">
-      <h2 class="accordion-header" id="promptHeading">
-        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#collapsePrompt" aria-expanded="false" aria-controls="collapsePrompt">
-          <i class="fa-solid <%= @prompt.icon %> me-2"></i> <%= @prompt.title %> Prompt
-        </button>
-      </h2>
-      <div id="collapsePrompt" class="accordion-collapse collapse" aria-labelledby="promptHeading" data-bs-parent="#accordionEcho">
-        <div id="prompt_content" class="accordion-body">
-          <div class="echo-content"><%= @prompt_content %></div>
-        </div>
-      </div>
-    </div>
-
-    <div class="accordion-item">
-      <h2 class="accordion-header" id="responseHeading">
-        <button class="accordion-button" type="button" data-bs-toggle="collapse" data-bs-target="#collapseResponse" aria-expanded="true" aria-controls="collapseResponse">
-          <i class="fa-solid fa-wifi me-2"></i>Echo Response
-        </button>
-      </h2>
-      <div id="collapseResponse" class="accordion-collapse" aria-labelledby="responseHeading" data-bs-parent="#accordionEcho">
-        <%# Keep the spinner div on the same line as its container: .echo-content uses
-            white-space: break-spaces, so a whitespace text node left behind after the
-            spinner is removed would render as a visible blank line before the response. %>
-        <div id="<%= @response_id %>" class="accordion-body echo-content"><div id="<%= "#{@response_id}_spinner" %>"><%= spinner_tag %></div></div>
-      </div>
-    </div>
-  </div>
-</div>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index bd1d0e459..98dd4fd21 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -6,6 +6,40 @@
 
 <% if Dradis::Plugins::Echo::Agents::Roslin.enabled? %>
   <% if @prompts.any? %>
+    <%# The record's existing conversations, surfaced above the picker (Serial-position %>
+    <%# effect). Each row loads sessions#show into the Echo record frame. %>
+    <div class="echo-session-list" data-behavior="echo-sessions">
+      <div class="echo-section-label">Conversations</div>
+      <% if @sessions.any? %>
+        <% @sessions.each do |session| %>
+          <%= link_to echo.project_session_path(current_project, session, type: @type, record: @record.id),
+                id: dom_id(session),
+                class: 'echo-session-item',
+                data: { turbo_frame: dom_id(@record, :echo) } do %>
+            <i class="echo-session-icon fa-solid fa-comments"></i>
+            <span>
+              <span class="echo-session-title"><%= session.title.presence || "Session ##{session.id}" %></span><br>
+              <span class="echo-session-meta">
+                Started by <%= session.user&.name || 'a removed user' %> ·
+                updated <%= local_time_ago(session.updated_at) %> ·
+                <%= pluralize(session.messages.size, 'message') %>
+              </span>
+            </span>
+            <% if session.generating? %>
+              <span class="echo-session-generating"><span class="spinner-border spinner-border-xs" role="status"></span> Roslin is responding</span>
+            <% else %>
+              <i class="echo-session-chevron fa-solid fa-chevron-right"></i>
+            <% end %>
+          <% end %>
+        <% end %>
+      <% else %>
+        <div class="echo-session-empty">
+          <i class="fa-regular fa-comments me-1"></i> No conversations on this Issue yet — start one below.
+        </div>
+      <% end %>
+    </div>
+
+    <div class="echo-section-label">Start a new conversation</div>
     <p>
       Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
       <%= link_to 'saved prompt', echo.prompts_path, data: { turbo_frame: '_top' } %> to use with this Issue.
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/show.html.erb
deleted file mode 100644
index d2eb3952b..000000000
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/show.html.erb
+++ /dev/null
@@ -1,20 +0,0 @@
-<turbo-frame id="<%= dom_id(@record, :echo) %>">
-  <div
-    data-controller="dradis--plugins--echo--prompt"
-    data-dradis--plugins--echo--prompt-interaction-id-value="<%= @interaction_id %>"
-    data-dradis--plugins--echo--prompt-prompt-value="<%= @prompt_content %>"
-    data-dradis--plugins--echo--prompt-response-id-value="<%= @response_id %>"
-    data-dradis--plugins--echo--prompt-url-value="<%= project_interactions_path %>"
-  >
-
-    <p>Dradis Echo interaction #<%= @interaction_id.truncate(12) %></p>
-
-    <%# Subscribe to main channel for real-time updates via ActionCable %>
-    <%= turbo_stream_from @interaction_id, 'prompts' %>
-
-    <%# Here is where we will stream the responses from the LLM %>
-    <div id="messages" class="my-2" style="height: 50vh; overflow-y: auto">
-      <%= render partial: 'dradis/plugins/echo/projects/interactions/response' %>
-    </div>
-  </div>
-</turbo-frame>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
index 91b53a617..3c8167915 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -1,10 +1,19 @@
 <%# locals: (session:) -%>
 <%# Broadcast on every idle<->generating transition (Session#broadcast_composer_state). %>
-<%# Route-free and locals-only so it renders from ReplyJob. %>
-<div id="<%= dom_id(session, :composer_state) %>" data-behavior="echo-composer-state" data-generating="<%= session.generating? %>">
-  <% if session.generating? %>
-    <span class="echo-composer-status" data-behavior="echo-composer-generating">Generating…</span>
-  <% else %>
-    <span class="echo-composer-status" data-behavior="echo-composer-idle">Ready</span>
-  <% end %>
-</div>
+<%# Route-free and locals-only so it renders from ReplyJob. Carries the Send button %>
+<%# and the multiplayer hint; the session_controller reads data-generating to keep %>
+<%# the textarea disabled in step with the (server-rendered) button. %>
+<% generating = session.generating? %>
+<%= tag.div id: dom_id(session, :composer_state),
+      data: { behavior: 'echo-composer-state', generating: generating } do %>
+  <div class="echo-composer-actions">
+    <% if generating %>
+      <span class="echo-composer-hint"><i class="fa-solid fa-lock"></i> Roslin is responding — you can send once it finishes.</span>
+    <% else %>
+      <span class="echo-composer-hint">Anyone on this project can join the conversation.</span>
+    <% end %>
+    <button type="submit" class="btn btn-primary"<%= ' disabled'.html_safe if generating %>>
+      <i class="fa-solid fa-paper-plane me-1"></i> Send
+    </button>
+  </div>
+<% end %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index 5cbf37b2f..4dc372f8b 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -1,23 +1,39 @@
 <%# locals: (message:) -%>
-<%# Minimal render. Must render from `render partial:` with %>
-<%# only `message:` in locals, so no controller-context helpers here. %>
-<div id="<%= dom_id(message) %>" class="echo-message echo-message-<%= message.role %>" data-status="<%= message.status %>">
-  <p class="echo-message-author">
-    <% if message.assistant? %>
-      <%= message.session.agent.name %>
-    <% elsif message.user %>
-      <%= message.user.name %>
-    <% else %>
-      Deleted user
-    <% end %>
-  </p>
+<%# Restyled per the accepted UX design (SEC-476). Renders from `render partial:` %>
+<%# with only `message:` in locals, so no controller-context helpers here. Author %>
+<%# line is keyed off `role`, never off user presence. %>
+<% assistant = message.assistant? %>
+<%= tag.div id: dom_id(message),
+      class: ['echo-message', assistant ? 'echo-message-assistant' : 'echo-message-user',
+              ('echo-message-streaming' if assistant && message.streaming?),
+              ('echo-message-failed'    if assistant && message.failed?),
+              ('echo-message-deleted'   if !assistant && message.user.nil?)].compact,
+      data: { status: message.status } do %>
+  <% if assistant %>
+    <span class="echo-avatar-agent">
+      <i class="fa-solid <%= message.failed? ? 'fa-triangle-exclamation' : 'fa-robot' %>"></i>
+    </span>
+  <% else %>
+    <%= avatar_image(message.user, size: 35) %>
+  <% end %>
 
-  <%# ReplyJob streams chunks into this container by dom_id(message, :content). %>
-  <div id="<%= dom_id(message, :content) %>" class="echo-message-content"><%= message.content %></div>
+  <div class="echo-message-body">
+    <div>
+      <span class="user"><%= assistant ? message.session.agent.name : (message.user&.name || 'Deleted user') %></span>
+      <span class="time"><%= local_time_ago(message.created_at) %></span>
+    </div>
 
-  <% if message.streaming? %>
-    <span class="echo-message-spinner" data-behavior="echo-message-spinner"></span>
-  <% elsif message.failed? %>
-    <p class="echo-message-error">Something went wrong generating this response.</p>
-  <% end %>
-</div>
+    <% if assistant && message.failed? %>
+      <div class="echo-error-line"><i class="fa-solid fa-circle-exclamation"></i><span>Roslin couldn&rsquo;t finish this response.</span></div>
+      <div class="echo-error-hint"><%= message.metadata['error'].to_s.presence || 'The request could not be completed.' %> Send another message to try again.</div>
+    <% else %>
+      <%# ReplyJob streams chunks into this container by dom_id(message, :content). Keep the
+          spinner caption OUTSIDE it so appended chunks never overwrite the caption, and keep
+          the container on one line — .echo-message-content uses white-space: break-spaces. %>
+      <div id="<%= dom_id(message, :content) %>" class="echo-message-content"><%= message.content %></div>
+      <% if assistant && message.streaming? %>
+        <div class="echo-streaming-caption"><span class="spinner-border spinner-border-xs" role="status"></span> Roslin is responding&hellip;</div>
+      <% end %>
+    <% end %>
+  </div>
+<% end %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
index d176a89a4..18d94cfb9 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -5,27 +5,42 @@
     </div>
   <% end %>
 
-  <%# Live transcript + composer state. A later slice wires the custom %>
-  <%# SessionsChannel (`channel:`) so the socket re-authorizes on subscribe. %>
-  <%= turbo_stream_from [@session, :messages] %>
-  <%= turbo_stream_from [@session, :composer_state] %>
+  <%# Live transcript + composer state, both over the re-authorizing SessionsChannel %>
+  <%# (Slice 4): the socket re-checks project access on every subscribe. %>
+  <%= turbo_stream_from [@session, :messages], channel: Dradis::Plugins::Echo::SessionsChannel %>
+  <%= turbo_stream_from [@session, :composer_state], channel: Dradis::Plugins::Echo::SessionsChannel %>
 
-  <%= render 'dradis/plugins/echo/projects/sessions/messages', messages: @messages %>
+  <div class="echo-conversation" data-controller="dradis--plugins--echo--session">
+    <div class="echo-conversation-header">
+      <%= link_to echo.project_interactions_path(current_project, type: @type, record: @record.id),
+            class: 'echo-back-link' do %>
+        <i class="fa-solid fa-arrow-left"></i> Conversations
+      <% end %>
+      <h5 class="echo-conversation-title">
+        <%= @session.title.presence || "Session ##{@session.id}" %>
+        <span class="echo-conversation-agent">· with <%= @session.agent.name %></span>
+      </h5>
+    </div>
 
-  <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
+    <%# Broadcasts append to the literal `echo-messages` target (Message#broadcast_created), %>
+    <%# so this id must stay verbatim; only one session view is mounted per Echo frame. %>
+    <div id="echo-messages" class="echo-messages"
+         data-dradis--plugins--echo--session-target="messages">
+      <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+                 collection: @session.messages.order(:created_at, :id), as: :message %>
+    </div>
 
-  <%= form_with url: echo.project_session_messages_path(current_project, @session), method: :post do |f| %>
-    <div class="input-group">
+    <%= form_with url: echo.project_session_messages_path(current_project, @session), method: :post,
+          class: 'echo-composer',
+          data: { action: 'submit->dradis--plugins--echo--session#send' } do |f| %>
       <%=
         f.text_area :content,
           class: 'form-control field-sizing-content',
           placeholder: 'Message Roslin…',
-          rows: 3
+          rows: 2,
+          data: { 'dradis--plugins--echo--session-target': 'input' }
       %>
-    </div>
-
-    <div class="form-actions sticky pt-1">
-      <%= f.submit 'Send', class: 'btn btn-primary mt-2' %>
-    </div>
-  <% end %>
+      <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
+    <% end %>
+  </div>
 </turbo-frame>

From 774069d90805d3776bbce868d95ab08003892337 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 18:53:51 +0100
Subject: [PATCH 28/57] Echo: make the Echo tab frame mechanism consistently
 native

The Echo tab loaded interactions#index via a data-behavior=fetch div that
injected the response as inner HTML, so index rendered frameless. But
sessions/show.html.erb wraps itself in a native <turbo-frame> and its
back-link navigates that frame to interactions#index. Turbo then found no
matching <turbo-frame> in the frameless index response and rendered
"Content missing" (console: the response did not contain the expected
<turbo-frame id=echo_issue_N>).

Make both paths native and consistent: index.html.erb now wraps its body in
<turbo-frame id=dom_id(record, :echo)>, and the tab loader uses a native
lazy frame (src + loading=lazy) instead of the fetch behaviour. Initial
load, prompt->show and back->index now all frame-match the same id.

Adds request coverage asserting index carries the record Echo frame and the
show back-link targets it.
---
 .../echo/issues/_show-content.html.erb        | 10 +++-
 .../echo/projects/interactions/index.html.erb |  5 ++
 .../echo/projects/interactions_spec.rb        | 52 +++++++++++++++++++
 3 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb

diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
index 1b8eeb611..9ba8600c8 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
@@ -11,8 +11,14 @@
   <div class="inner">
     <h4 class="header-underline">Dradis Echo</h4>
 
-    <turbo-frame id="<%= dom_id(@issue, :echo) %>">
-      <div data-behavior="fetch" data-path="<%= echo.project_interactions_path(current_project, type: :issue, record: @issue.id) %>"></div>
+    <%# Native lazy frame: loads interactions#index when the Echo tab becomes %>
+    <%# visible. index.html.erb answers with a matching <turbo-frame>, so the %>
+    <%# initial load, prompt->show and back->index all Turbo-frame-match the same %>
+    <%# frame id (SEC-506: a data-behavior=fetch inner-HTML inject left the frame %>
+    <%# empty, so a native back-navigation to index found no frame to match). %>
+    <turbo-frame id="<%= dom_id(@issue, :echo) %>"
+                 src="<%= echo.project_interactions_path(current_project, type: :issue, record: @issue.id) %>"
+                 loading="lazy">
     </turbo-frame>
   </div>
 </div>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index 98dd4fd21..092830a84 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -1,3 +1,7 @@
+<%# Wrapped in the record's Echo frame so this response Turbo-frame-matches the %>
+<%# native lazy frame in issues/_show-content.html.erb and the back-link in %>
+<%# sessions/show.html.erb (both navigate dom_id(@record, :echo)) — SEC-506. %>
+<turbo-frame id="<%= dom_id(@record, :echo) %>">
 <% unless @turbo_status %>
   <div class="alert alert-danger">
     There was an error contacting Redis: please make sure the Redis server is running.
@@ -94,3 +98,4 @@
     or adapt them to your audience.
   </p>
 <% end %>
+</turbo-frame>
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
new file mode 100644
index 000000000..1492aacbe
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -0,0 +1,52 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# Regression coverage for SEC-506 Bug 3: the Echo tab loads interactions#index
+# into a native <turbo-frame id="echo_issue_<id>">, and the session back-link
+# navigates that same frame back to interactions#index. If index answers
+# frameless, Turbo reports "the response did not contain the expected
+# <turbo-frame>" and the tab shows "Content missing". So the index response must
+# carry the record's Echo frame verbatim.
+describe 'Echo interactions' do
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
+  end
+
+  let(:issue) do
+    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
+  end
+
+  describe 'GET /addons/echo/projects/:project_id/interactions' do
+    it 'wraps the conversation list in the record Echo turbo-frame' do
+      get "/addons/echo/projects/#{@project.id}/interactions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include(
+        "<turbo-frame id=\"#{ActionView::RecordIdentifier.dom_id(issue, :echo)}\""
+      )
+    end
+
+    it 'matches the frame id the session show back-link navigates' do
+      # The back-link and the index share dom_id(record, :echo); prove they agree
+      # so a Turbo back-navigation frame-matches instead of erroring out.
+      session = create(:echo_session, agent: roslin, record: issue)
+
+      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}",
+        params: { type: 'issue', record: issue.id }
+      frame_id = ActionView::RecordIdentifier.dom_id(issue, :echo)
+      back_link = echo.project_interactions_path(@project, type: 'issue', record: issue.id)
+      expect(response.body).to include("<turbo-frame id=\"#{frame_id}\"")
+      # href attributes HTML-escape the query separator (& -> &amp;); match escaped.
+      expect(response.body).to include(ERB::Util.html_escape(back_link))
+    end
+  end
+end

From 7b3a9285eae5d9b0f18bb9938999a5937ae0659a Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 19:54:44 +0100
Subject: [PATCH 29/57] Echo: tolerate turbo-rails' injected request_id local
 in broadcast partials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

turbo-rails 2.0.4 (broadcastable.rb:503) reverse_merges
request_id: Turbo.current_request_id into every broadcast_*_to partial's
locals. In a real request the RequestId middleware makes it non-nil, so it
reaches the partial; in a job / rack_test it's nil and .compact drops it.

Both Echo broadcast-target partials declare strict locals, so the broadcasts
that fire inside SessionsController#create — Message#broadcast_created
(after_create_commit) and Session#broadcast_composer_state (via
request_reply!) — raised ActionView::StrictLocalsError: unknown local:
:request_id and 500'd on the first real click (SEC-506 Bug 1; Bug 2 'no
reply' was downstream of the 500). rack_test specs stayed green because
current_request_id is nil there — the false negative that hid this.

Fix: accept-and-ignore the injected local in both partials
  _message.html.erb       -> (message:, request_id: nil)
  _composer_state.html.erb -> (session:, request_id: nil)

Adds a regression spec that forces a non-nil id via Turbo.with_request_id and
drives the real broadcast methods (RED before this change, GREEN after).
---
 .../sessions/_composer_state.html.erb         |  5 ++-
 .../sessions/messages/_message.html.erb       |  7 +++-
 .../plugins/echo/broadcast_request_id_spec.rb | 40 +++++++++++++++++++
 3 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb

diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
index 3c8167915..31d198761 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -1,4 +1,7 @@
-<%# locals: (session:) -%>
+<%# locals: (session:, request_id: nil) -%>
+<%# request_id is accepted-and-ignored: turbo-rails injects request_id into every %>
+<%# broadcast partial's locals (broadcastable.rb:503); non-nil in-request, so strict %>
+<%# locals must tolerate it or broadcast_composer_state 500s (SEC-506 Bug 1). %>
 <%# Broadcast on every idle<->generating transition (Session#broadcast_composer_state). %>
 <%# Route-free and locals-only so it renders from ReplyJob. Carries the Send button %>
 <%# and the multiplayer hint; the session_controller reads data-generating to keep %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index 4dc372f8b..7ee399459 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -1,4 +1,9 @@
-<%# locals: (message:) -%>
+<%# locals: (message:, request_id: nil) -%>
+<%# request_id is accepted-and-ignored: turbo-rails 2.0.4 broadcastable.rb:503 %>
+<%# reverse_merges request_id: Turbo.current_request_id into every broadcast %>
+<%# partial's locals. It's non-nil in a real request (RequestId middleware) and %>
+<%# .compact'd away in a job/rack_test, so strict locals must tolerate it or the %>
+<%# in-request broadcast_created 500s with StrictLocalsError (SEC-506 Bug 1). %>
 <%# Restyled per the accepted UX design (SEC-476). Renders from `render partial:` %>
 <%# with only `message:` in locals, so no controller-context helpers here. Author %>
 <%# line is keyed off `role`, never off user presence. %>
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
new file mode 100644
index 000000000..8472cf2ba
--- /dev/null
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
@@ -0,0 +1,40 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# SEC-506 Bug 1/2 regression: turbo-rails 2.0.4 broadcastable.rb:503 reverse_merges
+# `request_id: Turbo.current_request_id` into every broadcast partial's locals. In a
+# real request the RequestId middleware sets a non-nil id, so it reaches the partial;
+# in a job / rack_test it's nil and .compact drops it. Both Echo broadcast-target
+# partials use strict locals, so unless they tolerate `request_id`, the broadcasts
+# that fire *inside SessionsController#create* (Message#broadcast_created and, via
+# request_reply!, Session#broadcast_composer_state) raise StrictLocalsError → 500.
+#
+# A plain request spec can't catch this (nil request_id), which is why it slipped
+# through. We force a non-nil id with Turbo.with_request_id so the render exercises
+# the exact failing path.
+describe 'Echo broadcasts under a non-nil Turbo request id' do
+  let(:user) { create(:user) }
+  let(:agent) { create(:agent) }
+  let(:session) { create(:echo_session, agent: agent) }
+
+  around do |example|
+    Turbo.with_request_id('sec506-req-id') { example.run }
+  end
+
+  it 'renders _message via Message#broadcast_created without StrictLocalsError' do
+    message = create(:echo_message, session: session, role: :user, user: user)
+
+    expect { message.send(:broadcast_created) }.not_to raise_error
+  end
+
+  it 'renders _message for an assistant turn too' do
+    message = create(:assistant_message, session: session)
+
+    expect { message.send(:broadcast_created) }.not_to raise_error
+  end
+
+  it 'renders _composer_state via Session#broadcast_composer_state without StrictLocalsError' do
+    expect { session.broadcast_composer_state }.not_to raise_error
+  end
+end

From 5b93a012e19a95b731e496f81293aa29793a6159 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 20:26:58 +0100
Subject: [PATCH 30/57] Echo: mark reply-pending on show and add SEC-506
 conversation feature spec

Expose reply-pending? and the reply URL as Stimulus values on the conversation
element so the session controller can start generation from the client after it
subscribes (SEC-506 Bug 4). Also folds in QA's live-browser feature spec covering
the Bug 1 (start-from-prompt renders, no StrictLocalsError) and Bug 3 (Echo tab
lazy-frame + back-navigation) flows the rack_test specs can't reach.

Refs SEC-506.
---
 .../echo/projects/sessions/show.html.erb      | 10 ++-
 .../echo/sessions_conversation_spec.rb        | 67 +++++++++++++++++++
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb

diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
index 18d94cfb9..498d96078 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -10,7 +10,15 @@
   <%= turbo_stream_from [@session, :messages], channel: Dradis::Plugins::Echo::SessionsChannel %>
   <%= turbo_stream_from [@session, :composer_state], channel: Dradis::Plugins::Echo::SessionsChannel %>
 
-  <div class="echo-conversation" data-controller="dradis--plugins--echo--session">
+  <%# reply-pending / reply-url drive the client-side generation trigger: on a %>
+  <%# freshly-created session (reply_pending?), the session controller POSTs to %>
+  <%# this reply URL from `connect`, i.e. after the SessionsChannel subscription %>
+  <%# is established, so ReplyJob's streaming container isn't broadcast before the %>
+  <%# socket is listening (SEC-506 Bug 4). Revisiting an answered session renders %>
+  <%# reply-pending=false, so no spurious generation is triggered. %>
+  <div class="echo-conversation" data-controller="dradis--plugins--echo--session"
+       data-dradis--plugins--echo--session-reply-url-value="<%= echo.project_session_reply_path(current_project, @session) %>"
+       data-dradis--plugins--echo--session-reply-pending-value="<%= @session.reply_pending? %>">
     <div class="echo-conversation-header">
       <%= link_to echo.project_interactions_path(current_project, type: @type, record: @record.id),
             class: 'echo-back-link' do %>
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
new file mode 100644
index 000000000..d155482b1
--- /dev/null
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
@@ -0,0 +1,67 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# SEC-506 live-browser acceptance for the Echo Sessions conversation UI. These are
+# the flows the rack_test request specs structurally cannot exercise (the documented
+# live-JS/Turbo gap): the Bootstrap tab-show that triggers the native lazy frame, and
+# the Turbo-frame back-navigation between sessions#show and interactions#index.
+describe 'Echo Sessions conversation UI', js: true do
+  before { login_to_project_as_user }
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |a| a.update!(enabled: true) }
+  end
+
+  let(:issue) { create(:issue, node: current_project.issue_library, text: "#[Title]#\nSQLi") }
+
+  let!(:prompt) do
+    @logged_in_as.prompts.create!(
+      title: 'Summarise the finding',
+      prompt: 'Summarise the issue',
+      scope: 'issue',
+      visibility: :user
+    )
+  end
+
+  # Bug 3: the frame-mechanism swap (data-behavior=fetch -> native lazy turbo-frame).
+  it 'lazy-loads the conversation list when the Echo tab is shown and returns to it via the back-link' do
+    session = create(:echo_session, agent: roslin, record: issue, title: 'Earlier conversation')
+    create(:echo_message, session: session, role: :user, content: 'my earlier question', user: @logged_in_as)
+
+    visit project_issue_path(current_project, issue)
+
+    # The Echo tab-pane is hidden until the Bootstrap tab is shown; showing it must
+    # trigger the native <turbo-frame loading="lazy" src=...> to fetch interactions#index.
+    click_link 'Echo'
+    expect(page).to have_css("turbo-frame#echo_issue_#{issue.id}")
+    expect(page).to have_content('Earlier conversation') # lazy frame loaded on tab-show
+
+    # Into the session (sessions#show renders into the same native frame).
+    find('.echo-session-item', text: 'Earlier conversation').click
+    expect(page).to have_content('my earlier question')
+
+    # Back to the list: Turbo navigates the frame to interactions#index. Before the
+    # fix this reported "Content missing" (index answered frameless).
+    find('.echo-back-link').click
+    expect(page).to have_content('Earlier conversation')
+    expect(page).to have_no_content('Content missing')
+  end
+
+  # Bug 1: sessions#create -> render :show must be 200, not a StrictLocalsError 500.
+  it 'starts a conversation from a saved prompt without a StrictLocalsError' do
+    visit project_issue_path(current_project, issue)
+    click_link 'Echo'
+
+    # The prompt-selector stimulus controller auto-loads the selected prompt's preview
+    # form (the "Start with this prompt" submit) into the echo-prompt-preview frame.
+    expect(page).to have_button('Start with this prompt')
+    click_button 'Start with this prompt'
+
+    # The create response renders sessions#show into the echo frame: the first user
+    # message (the prompt body) appears and no error page / strict-locals crash.
+    expect(page).to have_content('Summarise the issue')
+    expect(page).to have_no_content('unknown local')
+    expect(page).to have_css('.echo-conversation')
+  end
+end

From 51a5486ff024c1c2dd262beb8e6445159483f7ad Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:05:06 +0100
Subject: [PATCH 31/57] Echo: tokenize session avatar foreground and size it in
 rem
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The .echo-avatar-agent rule hardcoded color: #fff and 35px sizing, which
the file's own header (tokens only, rem for non-border sizes) and
.claude/CLAUDE.md both forbid. There was no theme-constant white token,
so add --brand-fg (#{$white}) to both theme blocks — the avatar bg is
--brand-bg, theme-constant, so its foreground must be too — and reference
var(--brand-fg). 35px becomes 2.1875rem at the 16px root: pixel-identical.
---
 app/assets/stylesheets/hera/themes.scss                     | 2 ++
 .../assets/stylesheets/dradis/plugins/echo/sessions.scss    | 6 +++---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/assets/stylesheets/hera/themes.scss b/app/assets/stylesheets/hera/themes.scss
index bffc9e4a7..748cb32a4 100644
--- a/app/assets/stylesheets/hera/themes.scss
+++ b/app/assets/stylesheets/hera/themes.scss
@@ -7,6 +7,7 @@
 @mixin dark-theme {
   // Backgrounds
   --brand-bg: #{$brand-500};
+  --brand-fg: #{$white};
   --nav-active-bg: #{$brand-600};
   --primary-bg: #{$grey-900};
   --primary-bg-subtle: #{$grey-800};
@@ -105,6 +106,7 @@
 :root {
   // Backgrounds
   --brand-bg: #{$brand-500};
+  --brand-fg: #{$white};
   --nav-active-bg: #{$brand-500};
   --primary-bg: #{$white};
   --primary-bg-subtle: #{darken($white, 1%)}; // darken($primary-bg, 1%)
diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index 6d6e060e9..3ac18dfa7 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -178,12 +178,12 @@
   align-items: center;
   background-color: var(--brand-bg);
   border-radius: 50%;
-  color: #fff;
+  color: var(--brand-fg);
   display: flex;
   flex: 0 0 auto;
-  height: 35px;
+  height: 2.1875rem;
   justify-content: center;
-  width: 35px;
+  width: 2.1875rem;
 }
 
 // Streaming state — spinner + caption under the (possibly partial) content.

From edfa32df0b9035996704b41e826b7951375af975 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:35:52 +0100
Subject: [PATCH 32/57] Echo: move SEC-506 conversation specs to the spec slice
 (5b)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The three SEC-506 specs folded onto this views slice — sessions_conversation,
interactions and broadcast_request_id — pushed it past the 15-file/600-line
cap (16/690). The behaviour they cover ships here, but the specs belong on the
spec slice (5b), which stacks on this branch and so runs them against the same
code. Relocating them brings #1652 back under cap; they are re-added on
echo/add-session-stimulus.
---
 .../echo/sessions_conversation_spec.rb        | 67 -------------------
 .../plugins/echo/broadcast_request_id_spec.rb | 40 -----------
 .../echo/projects/interactions_spec.rb        | 52 --------------
 3 files changed, 159 deletions(-)
 delete mode 100644 engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
 delete mode 100644 engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
 delete mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb

diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
deleted file mode 100644
index d155482b1..000000000
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
+++ /dev/null
@@ -1,67 +0,0 @@
-require 'rails_helper'
-
-Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
-
-# SEC-506 live-browser acceptance for the Echo Sessions conversation UI. These are
-# the flows the rack_test request specs structurally cannot exercise (the documented
-# live-JS/Turbo gap): the Bootstrap tab-show that triggers the native lazy frame, and
-# the Turbo-frame back-navigation between sessions#show and interactions#index.
-describe 'Echo Sessions conversation UI', js: true do
-  before { login_to_project_as_user }
-
-  let!(:roslin) do
-    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |a| a.update!(enabled: true) }
-  end
-
-  let(:issue) { create(:issue, node: current_project.issue_library, text: "#[Title]#\nSQLi") }
-
-  let!(:prompt) do
-    @logged_in_as.prompts.create!(
-      title: 'Summarise the finding',
-      prompt: 'Summarise the issue',
-      scope: 'issue',
-      visibility: :user
-    )
-  end
-
-  # Bug 3: the frame-mechanism swap (data-behavior=fetch -> native lazy turbo-frame).
-  it 'lazy-loads the conversation list when the Echo tab is shown and returns to it via the back-link' do
-    session = create(:echo_session, agent: roslin, record: issue, title: 'Earlier conversation')
-    create(:echo_message, session: session, role: :user, content: 'my earlier question', user: @logged_in_as)
-
-    visit project_issue_path(current_project, issue)
-
-    # The Echo tab-pane is hidden until the Bootstrap tab is shown; showing it must
-    # trigger the native <turbo-frame loading="lazy" src=...> to fetch interactions#index.
-    click_link 'Echo'
-    expect(page).to have_css("turbo-frame#echo_issue_#{issue.id}")
-    expect(page).to have_content('Earlier conversation') # lazy frame loaded on tab-show
-
-    # Into the session (sessions#show renders into the same native frame).
-    find('.echo-session-item', text: 'Earlier conversation').click
-    expect(page).to have_content('my earlier question')
-
-    # Back to the list: Turbo navigates the frame to interactions#index. Before the
-    # fix this reported "Content missing" (index answered frameless).
-    find('.echo-back-link').click
-    expect(page).to have_content('Earlier conversation')
-    expect(page).to have_no_content('Content missing')
-  end
-
-  # Bug 1: sessions#create -> render :show must be 200, not a StrictLocalsError 500.
-  it 'starts a conversation from a saved prompt without a StrictLocalsError' do
-    visit project_issue_path(current_project, issue)
-    click_link 'Echo'
-
-    # The prompt-selector stimulus controller auto-loads the selected prompt's preview
-    # form (the "Start with this prompt" submit) into the echo-prompt-preview frame.
-    expect(page).to have_button('Start with this prompt')
-    click_button 'Start with this prompt'
-
-    # The create response renders sessions#show into the echo frame: the first user
-    # message (the prompt body) appears and no error page / strict-locals crash.
-    expect(page).to have_content('Summarise the issue')
-    expect(page).to have_no_content('unknown local')
-    expect(page).to have_css('.echo-conversation')
-  end
-end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
deleted file mode 100644
index 8472cf2ba..000000000
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
+++ /dev/null
@@ -1,40 +0,0 @@
-require 'rails_helper'
-
-Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
-
-# SEC-506 Bug 1/2 regression: turbo-rails 2.0.4 broadcastable.rb:503 reverse_merges
-# `request_id: Turbo.current_request_id` into every broadcast partial's locals. In a
-# real request the RequestId middleware sets a non-nil id, so it reaches the partial;
-# in a job / rack_test it's nil and .compact drops it. Both Echo broadcast-target
-# partials use strict locals, so unless they tolerate `request_id`, the broadcasts
-# that fire *inside SessionsController#create* (Message#broadcast_created and, via
-# request_reply!, Session#broadcast_composer_state) raise StrictLocalsError → 500.
-#
-# A plain request spec can't catch this (nil request_id), which is why it slipped
-# through. We force a non-nil id with Turbo.with_request_id so the render exercises
-# the exact failing path.
-describe 'Echo broadcasts under a non-nil Turbo request id' do
-  let(:user) { create(:user) }
-  let(:agent) { create(:agent) }
-  let(:session) { create(:echo_session, agent: agent) }
-
-  around do |example|
-    Turbo.with_request_id('sec506-req-id') { example.run }
-  end
-
-  it 'renders _message via Message#broadcast_created without StrictLocalsError' do
-    message = create(:echo_message, session: session, role: :user, user: user)
-
-    expect { message.send(:broadcast_created) }.not_to raise_error
-  end
-
-  it 'renders _message for an assistant turn too' do
-    message = create(:assistant_message, session: session)
-
-    expect { message.send(:broadcast_created) }.not_to raise_error
-  end
-
-  it 'renders _composer_state via Session#broadcast_composer_state without StrictLocalsError' do
-    expect { session.broadcast_composer_state }.not_to raise_error
-  end
-end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
deleted file mode 100644
index 1492aacbe..000000000
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ /dev/null
@@ -1,52 +0,0 @@
-require 'rails_helper'
-
-Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
-
-# Regression coverage for SEC-506 Bug 3: the Echo tab loads interactions#index
-# into a native <turbo-frame id="echo_issue_<id>">, and the session back-link
-# navigates that same frame back to interactions#index. If index answers
-# frameless, Turbo reports "the response did not contain the expected
-# <turbo-frame>" and the tab shows "Content missing". So the index response must
-# carry the record's Echo frame verbatim.
-describe 'Echo interactions' do
-  let(:user) { create(:user) }
-
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
-
-  let!(:roslin) do
-    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
-  end
-
-  let(:issue) do
-    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
-  end
-
-  describe 'GET /addons/echo/projects/:project_id/interactions' do
-    it 'wraps the conversation list in the record Echo turbo-frame' do
-      get "/addons/echo/projects/#{@project.id}/interactions",
-        params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include(
-        "<turbo-frame id=\"#{ActionView::RecordIdentifier.dom_id(issue, :echo)}\""
-      )
-    end
-
-    it 'matches the frame id the session show back-link navigates' do
-      # The back-link and the index share dom_id(record, :echo); prove they agree
-      # so a Turbo back-navigation frame-matches instead of erroring out.
-      session = create(:echo_session, agent: roslin, record: issue)
-
-      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}",
-        params: { type: 'issue', record: issue.id }
-      frame_id = ActionView::RecordIdentifier.dom_id(issue, :echo)
-      back_link = echo.project_interactions_path(@project, type: 'issue', record: issue.id)
-      expect(response.body).to include("<turbo-frame id=\"#{frame_id}\"")
-      # href attributes HTML-escape the query separator (& -> &amp;); match escaped.
-      expect(response.body).to include(ERB::Util.html_escape(back_link))
-    end
-  end
-end

From c46d196fb69e427af9de2e6c5aa517cfc8872698 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:33:24 +0100
Subject: [PATCH 33/57] Echo: sanitise failed-message view, fix conversations
 N+1, drop dead index

Applies PR #1655 review findings on the session views slice:

- Error leakage, display side (#6): the _message partial no longer
  renders metadata['error']; it shows a fixed generic summary so a raw
  provider body/host can never reach the browser.
- N+1 (#8): interactions#index preloads authors with includes(:user) and
  loads every conversation's message count in one grouped query, so the
  list no longer fires a user lookup and a COUNT per row.
- Dead view (#9): delete the drifted, unrendered sessions/index.html.erb
  (its route and action were removed in the controllers slice).
---
 .../echo/projects/interactions_controller.rb  |  5 +-
 .../echo/projects/interactions/index.html.erb |  2 +-
 .../echo/projects/sessions/index.html.erb     | 47 -------------------
 .../sessions/messages/_message.html.erb       |  4 +-
 .../dradis/plugins/echo/message_spec.rb       | 14 ++++++
 5 files changed, 22 insertions(+), 50 deletions(-)
 delete mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
index 317c74837..680f9fb54 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
@@ -12,7 +12,10 @@ def index
       Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
 
       @prompts = current_user.prompts.for(@type)
-      @sessions = Session.for_record(@record).order(updated_at: :desc)
+      # Preload authors and gather every conversation's message count in one
+      # grouped query so the list doesn't fire a user lookup and a COUNT per row.
+      @sessions = Session.for_record(@record).includes(:user).order(updated_at: :desc)
+      @message_counts = Message.where(session: @sessions).group(:session_id).count
     end
 
     def preview; end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index 092830a84..91a794090 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -26,7 +26,7 @@
               <span class="echo-session-meta">
                 Started by <%= session.user&.name || 'a removed user' %> ·
                 updated <%= local_time_ago(session.updated_at) %> ·
-                <%= pluralize(session.messages.size, 'message') %>
+                <%= pluralize(@message_counts.fetch(session.id, 0), 'message') %>
               </span>
             </span>
             <% if session.generating? %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
deleted file mode 100644
index 5bc6007a9..000000000
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/index.html.erb
+++ /dev/null
@@ -1,47 +0,0 @@
-<% if Dradis::Plugins::Echo::Agents::Roslin.enabled? %>
-  <% if @prompts.any? %>
-    <% if @sessions.any? %>
-      <div class="list-group mb-3" id="echo-sessions" data-behavior="echo-sessions">
-        <% @sessions.each do |session| %>
-          <%= link_to session.title.presence || "Session ##{session.id}",
-                echo.project_session_path(current_project, session),
-                id: dom_id(session),
-                class: 'list-group-item list-group-item-action',
-                data: { turbo_frame: dom_id(@record, :echo) } %>
-        <% end %>
-      </div>
-    <% end %>
-
-    <p>
-      Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
-      <%= link_to 'saved prompt', echo.prompts_path, data: { turbo_frame: '_top' } %> to start a session for this Issue.
-    </p>
-    <p>
-      You can edit the prompt before sending it, any changes are one-off and
-      won't affect the saved prompt template.
-    </p>
-  <% else %>
-    <%= render 'shared/empty_state',
-      actions_partial: 'dradis/plugins/echo/prompts/empty_state_actions',
-      docs_link: 'https://dradis.com/support/guides/echo/prompts.html',
-      name: 'prompt',
-      text: 'Create reusable prompts to standardize how your team analyzes findings, writes reports, summarizes vulnerabilities, and more. Save time by building a library of prompts that anyone on your team can use for consistent results.'
-    %>
-  <% end %>
-<% else %>
-  <div class="alert alert-warning">
-    <% if !current_user.respond_to?(:role?) || current_user.role?(:admin) %>
-      The Roslin agent is not enabled.
-      <%= link_to 'Enable it', echo.agents_path, data: { turbo_frame: '_top' } %>
-      to allow LLM interactions for AI-assisted writing.
-    <% else %>
-      <i class="fa-solid fa-robot me-1"></i>Roslin is not enabled. Ask an
-      admin to enable it to allow LLM interactions.
-    <% end %>
-  </div>
-  <p>
-    Think of Roslin as an editor or writing companion. It allows you to interact
-    with different LLM providers to help enhance your findings' readability
-    or adapt them to your audience.
-  </p>
-<% end %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index 7ee399459..c6b2fff08 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -29,8 +29,10 @@
     </div>
 
     <% if assistant && message.failed? %>
+      <%# Never render metadata['error'] here: the raw provider body/host is logged
+          server-side only. The view shows a fixed, generic summary. %>
       <div class="echo-error-line"><i class="fa-solid fa-circle-exclamation"></i><span>Roslin couldn&rsquo;t finish this response.</span></div>
-      <div class="echo-error-hint"><%= message.metadata['error'].to_s.presence || 'The request could not be completed.' %> Send another message to try again.</div>
+      <div class="echo-error-hint">Send another message to try again.</div>
     <% else %>
       <%# ReplyJob streams chunks into this container by dom_id(message, :content). Keep the
           spinner caption OUTSIDE it so appended chunks never overwrite the caption, and keep
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
index cd17dde56..3adfcb090 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/message_spec.rb
@@ -93,5 +93,19 @@ def render_message(message)
       message.update_column(:user_id, nil)
       expect(render_message(message.reload)).to include('Deleted user')
     end
+
+    it 'shows only a generic summary for a failed message, never the stored error' do
+      message = create(
+        :assistant_message,
+        status: :failed,
+        content: nil,
+        metadata: { 'error' => 'boom: secret-host:443 raw provider body' }
+      )
+
+      html = render_message(message.reload)
+
+      expect(html).to include('Send another message to try again')
+      expect(html).not_to include('secret-host')
+    end
   end
 end

From ba69f543104038650fcf6cbfcce71631f49375d8 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 17:43:59 +0100
Subject: [PATCH 34/57] Echo: lock composer on reply_pending so a fresh session
 disables Send

---
 .../sessions/_composer_state.html.erb         | 14 +++--
 .../plugins/echo/projects/sessions_spec.rb    | 51 +++++++++++++++++++
 2 files changed, 61 insertions(+), 4 deletions(-)

diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
index 31d198761..9013483ab 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -6,16 +6,22 @@
 <%# Route-free and locals-only so it renders from ReplyJob. Carries the Send button %>
 <%# and the multiplayer hint; the session_controller reads data-generating to keep %>
 <%# the textarea disabled in step with the (server-rendered) button. %>
-<% generating = session.generating? %>
+<%# Lock on generating? OR reply_pending?: a freshly-created session is idle with a %>
+<%# reply owed, and the composer_state replace that flips it to generating races the %>
+<%# client's still-in-flight subscribe, so on a slow box that broadcast is dropped and %>
+<%# the button would stay enabled until a full re-render. Folding reply_pending? in %>
+<%# server-renders the initial lock with zero dependency on that racy broadcast; %>
+<%# subsequent transitions (by then subscribed) are still driven by broadcasts (SEC-515). %>
+<% locked = session.generating? || session.reply_pending? %>
 <%= tag.div id: dom_id(session, :composer_state),
-      data: { behavior: 'echo-composer-state', generating: generating } do %>
+      data: { behavior: 'echo-composer-state', generating: locked } do %>
   <div class="echo-composer-actions">
-    <% if generating %>
+    <% if locked %>
       <span class="echo-composer-hint"><i class="fa-solid fa-lock"></i> Roslin is responding — you can send once it finishes.</span>
     <% else %>
       <span class="echo-composer-hint">Anyone on this project can join the conversation.</span>
     <% end %>
-    <button type="submit" class="btn btn-primary"<%= ' disabled'.html_safe if generating %>>
+    <button type="submit" class="btn btn-primary"<%= ' disabled'.html_safe if locked %>>
       <i class="fa-solid fa-paper-plane me-1"></i> Send
     </button>
   </div>
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 8e2fc8b73..0d9b0bb3e 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -130,4 +130,55 @@
       end.to raise_error(ActiveRecord::RecordNotFound)
     end
   end
+
+  describe 'GET /addons/echo/projects/:project_id/sessions/:id' do
+    # The initial Send-button lock is server-rendered off generating? OR
+    # reply_pending?, so a freshly-created (idle, reply-owed) session comes back
+    # disabled with zero dependency on the composer_state broadcast that races
+    # the client's subscribe on a slow box (SEC-515). A subscribe race can't be
+    # reproduced in rack_test, so we assert the server-rendered invariant.
+    def composer_state
+      Nokogiri::HTML(response.body).at_css('[data-behavior="echo-composer-state"]')
+    end
+
+    def send_button
+      composer_state.at_css('button[type="submit"]')
+    end
+
+    it 'server-renders the Send button disabled for a reply_pending session' do
+      session = create(:echo_session, record: issue, user: user, status: :idle)
+      create(:echo_message, session: session, role: :user, user: user)
+      expect(session).to be_reply_pending
+
+      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}"
+
+      expect(response).to have_http_status(:ok)
+      expect(composer_state['data-generating']).to eq('true')
+      expect(send_button.attributes).to have_key('disabled')
+    end
+
+    it 'server-renders the Send button disabled for a generating session' do
+      session = create(:echo_session, record: issue, user: user, status: :generating)
+      create(:echo_message, session: session, role: :user, user: user)
+
+      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}"
+
+      expect(response).to have_http_status(:ok)
+      expect(composer_state['data-generating']).to eq('true')
+      expect(send_button.attributes).to have_key('disabled')
+    end
+
+    it 'server-renders the Send button enabled for an answered session' do
+      session = create(:echo_session, record: issue, user: user, status: :idle)
+      create(:echo_message, session: session, role: :user, user: user)
+      create(:assistant_message, session: session)
+      expect(session).not_to be_reply_pending
+
+      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}"
+
+      expect(response).to have_http_status(:ok)
+      expect(composer_state['data-generating']).to eq('false')
+      expect(send_button.attributes).not_to have_key('disabled')
+    end
+  end
 end

From ca41466dc109580155d5cae6c8d93ad0e15a3d80 Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 15:38:45 +0200
Subject: [PATCH 35/57] add the missing field-sizing-content utility class

Echo's prompt textareas already reference this class to auto-grow
with their content, but the rule itself was never added.
---
 app/assets/stylesheets/hera/utilities.scss | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/assets/stylesheets/hera/utilities.scss b/app/assets/stylesheets/hera/utilities.scss
index 7b95bf5dc..9449a8275 100644
--- a/app/assets/stylesheets/hera/utilities.scss
+++ b/app/assets/stylesheets/hera/utilities.scss
@@ -1,3 +1,7 @@
+.field-sizing-content {
+  field-sizing: content;
+}
+
 .font-light {
   font-family: 'ProximaNovaLight', 'system-ui';
 }

From 5904fbcf9823734a4c1132ef2b08df6fc1096320 Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 15:39:42 +0200
Subject: [PATCH 36/57] redesign the Echo tab: two-column layout with
 per-column headings

Amends PR dradis/dradis-ce#1652 (Echo Sessions, Slice 5a) before merge.

The conversations list and "start a new conversation" picker were
stacked vertically, so a record with many conversations pushed the
composer further down the page. They're now two columns side by side,
each with its own heading ("Conversations" / "Start a new
conversation"), so the list no longer competes with the composer for
vertical room. The left column scrolls independently past a content-
driven height ceiling instead of growing the page.

Conversation rows are extracted into a shared session_item partial,
trimmed to title + last-updated timestamp (message count and author
were noise), and stacked with flexbox utilities instead of a <br> so
the line gap is controllable.

Also replaces the ad-hoc .echo-section-label styling with the app's
existing heading conventions.
---
 .../dradis/plugins/echo/sessions.scss         |  32 ++++--
 .../echo/projects/interactions_controller.rb  |   5 +-
 .../echo/issues/_show-content.html.erb        |   2 +-
 .../echo/projects/interactions/index.html.erb | 100 ++++++++----------
 .../projects/sessions/_session_item.html.erb  |  15 +++
 .../echo/projects/interactions_spec.rb        |  62 +++++++++++
 .../echo/projects/issues/widget_spec.rb       |   7 ++
 7 files changed, 154 insertions(+), 69 deletions(-)
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb

diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index 3ac18dfa7..6605b845a 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -4,18 +4,34 @@
 // interactions/show.html.erb. Tokens only (var(--*)); no hardcoded colors,
 // no ID selectors, no !important, no inline styles. px only for borders.
 
-// ---- Session list (interactions#index, above the prompt picker) ----
-.echo-section-label {
-  color: var(--text-muted);
-  font-size: 0.75rem;
-  font-weight: 600;
-  letter-spacing: 0.04em;
-  margin-bottom: 0.5rem;
-  text-transform: uppercase;
+// ---- Interactions layout (conversations and prompt picker side-by-side) ----
+.echo-interactions-layout {
+  display: flex;
+  gap: 1.5rem;
+
+  @media (max-width: 767px) {
+    flex-direction: column;
+  }
+}
+
+.echo-interactions-conversations {
+  flex-shrink: 0;
+  width: 13rem;
+
+  @media (max-width: 767px) {
+    width: 100%;
+  }
 }
 
+.echo-interactions-prompts {
+  flex: 1;
+}
+
+// ---- Session list (interactions#index, left column) ----
 .echo-session-list {
   margin-bottom: 1.5rem;
+  max-height: clamp(20rem, 70vh, 40rem);
+  overflow-y: auto;
 }
 
 .echo-session-item {
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
index 680f9fb54..317c74837 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
@@ -12,10 +12,7 @@ def index
       Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
 
       @prompts = current_user.prompts.for(@type)
-      # Preload authors and gather every conversation's message count in one
-      # grouped query so the list doesn't fire a user lookup and a COUNT per row.
-      @sessions = Session.for_record(@record).includes(:user).order(updated_at: :desc)
-      @message_counts = Message.where(session: @sessions).group(:session_id).count
+      @sessions = Session.for_record(@record).order(updated_at: :desc)
     end
 
     def preview; end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
index 9ba8600c8..b1cf6661a 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
@@ -9,7 +9,7 @@
 
 <div class="tab-pane" id="echo-tab">
   <div class="inner">
-    <h4 class="header-underline">Dradis Echo</h4>
+    <h4 class="header-underline mb-3">Dradis Echo</h4>
 
     <%# Native lazy frame: loads interactions#index when the Echo tab becomes %>
     <%# visible. index.html.erb answers with a matching <turbo-frame>, so the %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index 91a794090..6ecf11ddf 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -10,67 +10,55 @@
 
 <% if Dradis::Plugins::Echo::Agents::Roslin.enabled? %>
   <% if @prompts.any? %>
-    <%# The record's existing conversations, surfaced above the picker (Serial-position %>
-    <%# effect). Each row loads sessions#show into the Echo record frame. %>
-    <div class="echo-session-list" data-behavior="echo-sessions">
-      <div class="echo-section-label">Conversations</div>
-      <% if @sessions.any? %>
-        <% @sessions.each do |session| %>
-          <%= link_to echo.project_session_path(current_project, session, type: @type, record: @record.id),
-                id: dom_id(session),
-                class: 'echo-session-item',
-                data: { turbo_frame: dom_id(@record, :echo) } do %>
-            <i class="echo-session-icon fa-solid fa-comments"></i>
-            <span>
-              <span class="echo-session-title"><%= session.title.presence || "Session ##{session.id}" %></span><br>
-              <span class="echo-session-meta">
-                Started by <%= session.user&.name || 'a removed user' %> ·
-                updated <%= local_time_ago(session.updated_at) %> ·
-                <%= pluralize(@message_counts.fetch(session.id, 0), 'message') %>
-              </span>
-            </span>
-            <% if session.generating? %>
-              <span class="echo-session-generating"><span class="spinner-border spinner-border-xs" role="status"></span> Roslin is responding</span>
-            <% else %>
-              <i class="echo-session-chevron fa-solid fa-chevron-right"></i>
-            <% end %>
+    <div class="echo-interactions-layout">
+      <div class="echo-interactions-conversations">
+        <h5 class="mb-3">Conversations</h5>
+        <%# The record's existing conversations, surfaced next to the picker (Serial- %>
+        <%# position effect). Each row loads sessions#show into the Echo record frame. %>
+        <div class="echo-session-list" data-behavior="echo-sessions">
+          <% if @sessions.any? %>
+            <%= render partial: 'dradis/plugins/echo/projects/sessions/session_item',
+                  collection: @sessions, as: :session,
+                  locals: { record: @record, type: @type } %>
+          <% else %>
+            <div class="echo-session-empty">
+              <i class="fa-regular fa-comments me-1"></i> No conversations on this Issue yet — start one below.
+            </div>
           <% end %>
-        <% end %>
-      <% else %>
-        <div class="echo-session-empty">
-          <i class="fa-regular fa-comments me-1"></i> No conversations on this Issue yet — start one below.
         </div>
-      <% end %>
-    </div>
+      </div>
 
-    <div class="echo-section-label">Start a new conversation</div>
-    <p>
-      Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
-      <%= link_to 'saved prompt', echo.prompts_path, data: { turbo_frame: '_top' } %> to use with this Issue.
-    </p>
-    <p>
-      You can edit the prompt before sending it, any changes are one-off and
-      won't affect the saved prompt template.
-    </p>
+      <div class="echo-interactions-prompts">
+        <h5 class="mb-3">Start a new conversation</h5>
+        <p>
+          Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
+          <%= link_to 'saved prompt', echo.prompts_path, data: { turbo_frame: '_top' } %> to use with this Issue.
+        </p>
+        <p>
+          You can edit the prompt before sending it, any changes are one-off and
+          won't affect the saved prompt template.
+        </p>
 
-    <div class="row" data-controller="dradis--plugins--echo--prompt-selector">
-      <div class="col-12 mb-3">
-        <p class="form-label">Saved Prompts</p>
-        <select class="form-select">
-          <% @prompts.each do |prompt| %>
-            <option
-              data-combobox-option-icon="fa-solid <%= prompt.icon %>"
-              value="<%= echo.preview_project_interaction_path(current_project, prompt.id, type: @type, record: @record.id) %>">
-              <%= prompt.title %>
-            </option>
-          <% end %>
-        </select>
-      </div>
+        <div class="row" data-controller="dradis--plugins--echo--prompt-selector">
+          <div class="col-12 mb-3">
+            <p class="form-label">Saved Prompts</p>
+            <select class="form-select">
+              <% @prompts.each do |prompt| %>
+                <option
+                  data-combobox-option-icon="fa-solid <%= prompt.icon %>"
+                  value="<%= echo.preview_project_interaction_path(current_project, prompt.id, type: @type, record: @record.id) %>">
+                  <%= prompt.title %>
+                </option>
+              <% end %>
+            </select>
+          </div>
 
-      <div class="col-12">
-        <p class="form-label">Selected Prompt</p>
-        <turbo-frame id="echo-prompt-preview" data-dradis--plugins--echo--prompt-selector-target="frame">
-        </turbo-frame>
+          <div class="col-12">
+            <p class="form-label">Selected Prompt</p>
+            <turbo-frame id="echo-prompt-preview" data-dradis--plugins--echo--prompt-selector-target="frame">
+            </turbo-frame>
+          </div>
+        </div>
       </div>
     </div>
   <% else %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
new file mode 100644
index 000000000..aea025207
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
@@ -0,0 +1,15 @@
+<%= link_to echo.project_session_path(current_project, session, type: type, record: record.id),
+      id: dom_id(session),
+      class: 'echo-session-item',
+      data: { turbo_frame: dom_id(record, :echo) } do %>
+  <i class="echo-session-icon fa-solid fa-comments"></i>
+  <span class="d-flex flex-column">
+    <span class="echo-session-title"><%= session.title.presence || "Session ##{session.id}" %></span>
+    <span class="echo-session-meta">Updated <%= local_time_ago(session.updated_at) %></span>
+  </span>
+  <% if session.generating? %>
+    <span class="echo-session-generating"><span class="spinner-border spinner-border-xs" role="status"></span> Roslin is responding</span>
+  <% else %>
+    <i class="echo-session-chevron fa-solid fa-chevron-right"></i>
+  <% end %>
+<% end %>
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
new file mode 100644
index 000000000..52d46f637
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -0,0 +1,62 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+describe 'Echo interactions' do
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
+  end
+
+  let!(:prompt) do
+    user.prompts.create!(
+      title: 'Summarise the finding',
+      prompt: 'Summarise {{ issue.title }}',
+      scope: 'issue',
+      visibility: :user
+    )
+  end
+
+  let(:issue) do
+    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
+  end
+
+  describe 'GET /addons/echo/projects/:project_id/interactions' do
+    it 'renders the section heading using the app heading convention' do
+      get "/addons/echo/projects/#{@project.id}/interactions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('<h5 class="mb-3">Conversations</h5>')
+      expect(response.body).to include('<h5 class="mb-3">Start a new conversation</h5>')
+      expect(response.body).not_to include('echo-section-label')
+    end
+
+    it 'renders an existing conversation via the shared session-item partial' do
+      session = create(:echo_session, record: issue, user: user)
+
+      get "/addons/echo/projects/#{@project.id}/interactions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include(%(id="#{ActionView::RecordIdentifier.dom_id(session)}"))
+      expect(response.body).to include('class="echo-session-item"')
+    end
+
+    it 'renders the conversations list and prompt picker as two columns' do
+      get "/addons/echo/projects/#{@project.id}/interactions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('echo-interactions-layout')
+      expect(response.body).to include('echo-interactions-conversations')
+      expect(response.body).to include('echo-interactions-prompts')
+    end
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
index cb7cce4a7..e86eebb34 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
@@ -23,6 +23,13 @@
         expect(response.body).to include('data-behavior="roslin-issues-summary"')
         expect(response.body).to match(/<div id="roslin-widget" class="collapse"/)
       end
+
+      it 'renders the Echo tab title' do
+        get "/projects/#{@project.id}/issues/#{issue.id}"
+
+        expect(response).to have_http_status(:ok)
+        expect(response.body).to include('<h4 class="header-underline mb-3">Dradis Echo</h4>')
+      end
     end
 
     context 'when Roslin is disabled' do

From 26d65dff60fcdd20190e3353f440eff7003677cb Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 16:55:45 +0200
Subject: [PATCH 37/57] extract the Echo conversations column into a shared
 partial

---
 .../dradis/plugins/echo/sessions.scss         | 25 ++++++++++++++++++-
 .../echo/projects/interactions/index.html.erb | 20 +++------------
 .../sessions/_conversations_column.html.erb   | 23 +++++++++++++++++
 .../projects/sessions/_session_item.html.erb  |  5 +++-
 .../echo/projects/interactions_spec.rb        |  4 +--
 5 files changed, 56 insertions(+), 21 deletions(-)
 create mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_conversations_column.html.erb

diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index 6605b845a..3bfda6a2b 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -23,7 +23,25 @@
   }
 }
 
-.echo-interactions-prompts {
+.echo-conversations-column-header {
+  align-items: center;
+  display: flex;
+  justify-content: space-between;
+  margin-bottom: 0.75rem;
+
+  .echo-new-conversation-link {
+    color: var(--text-link);
+    font-size: 0.85rem;
+    text-decoration: none;
+    white-space: nowrap;
+
+    &:hover {
+      color: var(--text-link-hover);
+    }
+  }
+}
+
+.echo-interactions-panel {
   flex: 1;
 }
 
@@ -71,6 +89,11 @@
   }
 }
 
+.echo-session-item.active {
+  background-color: var(--secondary-bg-subtle);
+  border-color: var(--brand-bg);
+}
+
 .echo-session-empty {
   color: var(--text-muted);
   font-size: 0.9rem;
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index 6ecf11ddf..fb3a8e9d7 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -11,24 +11,10 @@
 <% if Dradis::Plugins::Echo::Agents::Roslin.enabled? %>
   <% if @prompts.any? %>
     <div class="echo-interactions-layout">
-      <div class="echo-interactions-conversations">
-        <h5 class="mb-3">Conversations</h5>
-        <%# The record's existing conversations, surfaced next to the picker (Serial- %>
-        <%# position effect). Each row loads sessions#show into the Echo record frame. %>
-        <div class="echo-session-list" data-behavior="echo-sessions">
-          <% if @sessions.any? %>
-            <%= render partial: 'dradis/plugins/echo/projects/sessions/session_item',
-                  collection: @sessions, as: :session,
-                  locals: { record: @record, type: @type } %>
-          <% else %>
-            <div class="echo-session-empty">
-              <i class="fa-regular fa-comments me-1"></i> No conversations on this Issue yet — start one below.
-            </div>
-          <% end %>
-        </div>
-      </div>
+      <%= render 'dradis/plugins/echo/projects/sessions/conversations_column',
+            record: @record, type: @type, sessions: @sessions %>
 
-      <div class="echo-interactions-prompts">
+      <div class="echo-interactions-panel">
         <h5 class="mb-3">Start a new conversation</h5>
         <p>
           Interact with <i class="fa-solid fa-robot me-1"></i>Roslin by selecting a
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_conversations_column.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_conversations_column.html.erb
new file mode 100644
index 000000000..ab2d2a543
--- /dev/null
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_conversations_column.html.erb
@@ -0,0 +1,23 @@
+<%# locals: (record:, type:, sessions:, active_session: nil, new_conversation_path: nil) -%>
+<div class="echo-interactions-conversations">
+  <div class="echo-conversations-column-header">
+    <h5 class="mb-0">Conversations</h5>
+    <% if new_conversation_path %>
+      <%= link_to new_conversation_path, class: 'echo-new-conversation-link',
+            data: { turbo_frame: dom_id(record, :echo) } do %>
+        <i class="fa-solid fa-plus"></i> New
+      <% end %>
+    <% end %>
+  </div>
+  <div class="echo-session-list" data-behavior="echo-sessions">
+    <% if sessions.any? %>
+      <%= render partial: 'dradis/plugins/echo/projects/sessions/session_item',
+            collection: sessions, as: :session,
+            locals: { record: record, type: type, active_session: active_session } %>
+    <% else %>
+      <div class="echo-session-empty">
+        <i class="fa-regular fa-comments me-1"></i> No conversations on this Issue yet — start one below.
+      </div>
+    <% end %>
+  </div>
+</div>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
index aea025207..ea387e4a9 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
@@ -1,6 +1,9 @@
+<%# locals: (session:, record:, type:, active_session: nil) -%>
+<% is_active = active_session && session.id == active_session.id %>
 <%= link_to echo.project_session_path(current_project, session, type: type, record: record.id),
       id: dom_id(session),
-      class: 'echo-session-item',
+      class: class_names('echo-session-item', active: is_active),
+      aria: { current: is_active ? 'page' : nil },
       data: { turbo_frame: dom_id(record, :echo) } do %>
   <i class="echo-session-icon fa-solid fa-comments"></i>
   <span class="d-flex flex-column">
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index 52d46f637..a11e6f225 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -33,7 +33,7 @@
         params: { type: 'issue', record: issue.id }
 
       expect(response).to have_http_status(:ok)
-      expect(response.body).to include('<h5 class="mb-3">Conversations</h5>')
+      expect(response.body).to include('<h5 class="mb-0">Conversations</h5>')
       expect(response.body).to include('<h5 class="mb-3">Start a new conversation</h5>')
       expect(response.body).not_to include('echo-section-label')
     end
@@ -56,7 +56,7 @@
       expect(response).to have_http_status(:ok)
       expect(response.body).to include('echo-interactions-layout')
       expect(response.body).to include('echo-interactions-conversations')
-      expect(response.body).to include('echo-interactions-prompts')
+      expect(response.body).to include('echo-interactions-panel')
     end
   end
 end

From 306c3427844b077454c5734090122d40280a5c0e Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 17:08:06 +0200
Subject: [PATCH 38/57] show the conversations sidebar with an active state on
 an open session

---
 .../dradis/plugins/echo/sessions.scss         | 11 ---
 .../echo/projects/sessions_controller.rb      |  4 +-
 .../echo/projects/sessions/show.html.erb      | 88 ++++++++++---------
 3 files changed, 49 insertions(+), 54 deletions(-)

diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index 3bfda6a2b..e711fa0de 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -133,17 +133,6 @@
   margin-bottom: 0.25rem;
   padding-bottom: 0.6rem;
 
-  .echo-back-link {
-    color: var(--text-link);
-    font-size: 0.85rem;
-    text-decoration: none;
-    white-space: nowrap;
-
-    &:hover {
-      color: var(--text-link-hover);
-    }
-  }
-
   .echo-conversation-agent {
     color: var(--text-muted);
     font-size: 0.8rem;
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 10c3e1a91..38456499f 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -49,6 +49,7 @@ def create
       @session.messages.build(content: params[:prompt], user: current_user)
 
       if @session.save
+        @sessions = Session.for_record(@record).order(updated_at: :desc)
         publish_event('echo_session.created', session: { id: @session.id })
         render :show
       else
@@ -68,7 +69,8 @@ def set_record
 
     def set_session
       @session = Session.find(record_params[:id])
-      @record = scoped_record(@session)
+      @record = scoped_record(@session.record)
+      @sessions = Session.for_record(@record).order(updated_at: :desc)
     end
 
     # Whitelists the record type against Prompt::SCOPES before it reaches a
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
index 498d96078..a7156a3d2 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -5,50 +5,54 @@
     </div>
   <% end %>
 
-  <%# Live transcript + composer state, both over the re-authorizing SessionsChannel %>
-  <%# (Slice 4): the socket re-checks project access on every subscribe. %>
-  <%= turbo_stream_from [@session, :messages], channel: Dradis::Plugins::Echo::SessionsChannel %>
-  <%= turbo_stream_from [@session, :composer_state], channel: Dradis::Plugins::Echo::SessionsChannel %>
+  <div class="echo-interactions-layout">
+    <%= render 'dradis/plugins/echo/projects/sessions/conversations_column',
+          record: @record, type: @type, sessions: @sessions, active_session: @session,
+          new_conversation_path: echo.project_interactions_path(current_project, type: @type, record: @record.id) %>
 
-  <%# reply-pending / reply-url drive the client-side generation trigger: on a %>
-  <%# freshly-created session (reply_pending?), the session controller POSTs to %>
-  <%# this reply URL from `connect`, i.e. after the SessionsChannel subscription %>
-  <%# is established, so ReplyJob's streaming container isn't broadcast before the %>
-  <%# socket is listening (SEC-506 Bug 4). Revisiting an answered session renders %>
-  <%# reply-pending=false, so no spurious generation is triggered. %>
-  <div class="echo-conversation" data-controller="dradis--plugins--echo--session"
-       data-dradis--plugins--echo--session-reply-url-value="<%= echo.project_session_reply_path(current_project, @session) %>"
-       data-dradis--plugins--echo--session-reply-pending-value="<%= @session.reply_pending? %>">
-    <div class="echo-conversation-header">
-      <%= link_to echo.project_interactions_path(current_project, type: @type, record: @record.id),
-            class: 'echo-back-link' do %>
-        <i class="fa-solid fa-arrow-left"></i> Conversations
-      <% end %>
-      <h5 class="echo-conversation-title">
-        <%= @session.title.presence || "Session ##{@session.id}" %>
-        <span class="echo-conversation-agent">· with <%= @session.agent.name %></span>
-      </h5>
-    </div>
+    <div class="echo-interactions-panel">
+      <%# Live transcript + composer state, both over the re-authorizing SessionsChannel %>
+      <%# (Slice 4): the socket re-checks project access on every subscribe. %>
+      <%= turbo_stream_from [@session, :messages], channel: Dradis::Plugins::Echo::SessionsChannel %>
+      <%= turbo_stream_from [@session, :composer_state], channel: Dradis::Plugins::Echo::SessionsChannel %>
 
-    <%# Broadcasts append to the literal `echo-messages` target (Message#broadcast_created), %>
-    <%# so this id must stay verbatim; only one session view is mounted per Echo frame. %>
-    <div id="echo-messages" class="echo-messages"
-         data-dradis--plugins--echo--session-target="messages">
-      <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
-                 collection: @session.messages.order(:created_at, :id), as: :message %>
-    </div>
+      <%# reply-pending / reply-url drive the client-side generation trigger: on a %>
+      <%# freshly-created session (reply_pending?), the session controller POSTs to %>
+      <%# this reply URL from `connect`, i.e. after the SessionsChannel subscription %>
+      <%# is established, so ReplyJob's streaming container isn't broadcast before the %>
+      <%# socket is listening (SEC-506 Bug 4). Revisiting an answered session renders %>
+      <%# reply-pending=false, so no spurious generation is triggered. %>
+      <div class="echo-conversation" data-controller="dradis--plugins--echo--session"
+           data-dradis--plugins--echo--session-reply-url-value="<%= echo.project_session_reply_path(current_project, @session) %>"
+           data-dradis--plugins--echo--session-reply-pending-value="<%= @session.reply_pending? %>">
+        <div class="echo-conversation-header">
+          <h5 class="echo-conversation-title">
+            <%= @session.title.presence || "Session ##{@session.id}" %>
+            <span class="echo-conversation-agent">· with <%= @session.agent.name %></span>
+          </h5>
+        </div>
 
-    <%= form_with url: echo.project_session_messages_path(current_project, @session), method: :post,
-          class: 'echo-composer',
-          data: { action: 'submit->dradis--plugins--echo--session#send' } do |f| %>
-      <%=
-        f.text_area :content,
-          class: 'form-control field-sizing-content',
-          placeholder: 'Message Roslin…',
-          rows: 2,
-          data: { 'dradis--plugins--echo--session-target': 'input' }
-      %>
-      <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
-    <% end %>
+        <%# Broadcasts append to the literal `echo-messages` target (Message#broadcast_created), %>
+        <%# so this id must stay verbatim; only one session view is mounted per Echo frame. %>
+        <div id="echo-messages" class="echo-messages"
+             data-dradis--plugins--echo--session-target="messages">
+          <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
+                     collection: @session.messages.order(:created_at, :id), as: :message %>
+        </div>
+
+        <%= form_with url: echo.project_session_messages_path(current_project, @session), method: :post,
+              class: 'echo-composer',
+              data: { action: 'submit->dradis--plugins--echo--session#send' } do |f| %>
+          <%=
+            f.text_area :content,
+              class: 'form-control field-sizing-content',
+              placeholder: 'Message Roslin…',
+              rows: 2,
+              data: { 'dradis--plugins--echo--session-target': 'input' }
+          %>
+          <%= render 'dradis/plugins/echo/projects/sessions/composer_state', session: @session %>
+        <% end %>
+      </div>
+    </div>
   </div>
 </turbo-frame>

From ee2cea80b3e0f3aa836c344e77a526cf88d89830 Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 19:27:46 +0200
Subject: [PATCH 39/57] remove redundant Echo tab title coverage from spec
 suite

---
 .../echo/projects/interactions_spec.rb        | 62 -------------------
 .../echo/projects/issues/widget_spec.rb       |  7 ---
 2 files changed, 69 deletions(-)
 delete mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb

diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
deleted file mode 100644
index a11e6f225..000000000
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ /dev/null
@@ -1,62 +0,0 @@
-require 'rails_helper'
-
-Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
-
-describe 'Echo interactions' do
-  let(:user) { create(:user) }
-
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
-
-  let!(:roslin) do
-    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
-  end
-
-  let!(:prompt) do
-    user.prompts.create!(
-      title: 'Summarise the finding',
-      prompt: 'Summarise {{ issue.title }}',
-      scope: 'issue',
-      visibility: :user
-    )
-  end
-
-  let(:issue) do
-    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
-  end
-
-  describe 'GET /addons/echo/projects/:project_id/interactions' do
-    it 'renders the section heading using the app heading convention' do
-      get "/addons/echo/projects/#{@project.id}/interactions",
-        params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include('<h5 class="mb-0">Conversations</h5>')
-      expect(response.body).to include('<h5 class="mb-3">Start a new conversation</h5>')
-      expect(response.body).not_to include('echo-section-label')
-    end
-
-    it 'renders an existing conversation via the shared session-item partial' do
-      session = create(:echo_session, record: issue, user: user)
-
-      get "/addons/echo/projects/#{@project.id}/interactions",
-        params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include(%(id="#{ActionView::RecordIdentifier.dom_id(session)}"))
-      expect(response.body).to include('class="echo-session-item"')
-    end
-
-    it 'renders the conversations list and prompt picker as two columns' do
-      get "/addons/echo/projects/#{@project.id}/interactions",
-        params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include('echo-interactions-layout')
-      expect(response.body).to include('echo-interactions-conversations')
-      expect(response.body).to include('echo-interactions-panel')
-    end
-  end
-end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
index e86eebb34..cb7cce4a7 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/issues/widget_spec.rb
@@ -23,13 +23,6 @@
         expect(response.body).to include('data-behavior="roslin-issues-summary"')
         expect(response.body).to match(/<div id="roslin-widget" class="collapse"/)
       end
-
-      it 'renders the Echo tab title' do
-        get "/projects/#{@project.id}/issues/#{issue.id}"
-
-        expect(response).to have_http_status(:ok)
-        expect(response.body).to include('<h4 class="header-underline mb-3">Dradis Echo</h4>')
-      end
     end
 
     context 'when Roslin is disabled' do

From af682c69413238a984aab1323e7889706720b3a1 Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 19:27:58 +0200
Subject: [PATCH 40/57] widen the Echo conversations column to fit session
 timestamps

---
 .../app/assets/stylesheets/dradis/plugins/echo/sessions.scss    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index e711fa0de..82c8bcaf9 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -16,7 +16,7 @@
 
 .echo-interactions-conversations {
   flex-shrink: 0;
-  width: 13rem;
+  width: 14rem;
 
   @media (max-width: 767px) {
     width: 100%;

From f24652b7eb0211c30891344700dd448cdf612814 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 31 Jul 2026 12:58:47 +0100
Subject: [PATCH 41/57] Echo: reconcile Slice-5 views onto Slice-4 controllers
 (SEC-571)

The views/stimulus/retire branches were authored on the pre-Slice-4
controllers, so cascading them onto the reviewed controllers left
Slice-4 residue that views had already superseded:

- Restore the reviewed sessions controller/routes/spec: the 'drop dead
  index' cleanup removed the drifted, unrendered index view, action,
  route and its tests. The line-level rebase kept only the template
  deletion, resurrecting the index action/route/test.
- Adopt the parent's session-based scoped_record(session) (Slice-4's
  record-scoping optimisation, a file views never touched) at the one
  call site in set_session, which still passed the record.
---
 .../echo/projects/sessions_controller.rb      | 28 +++++----------
 .../echo/projects/sessions/_messages.html.erb |  7 ----
 engines/dradis-echo/config/routes.rb          |  2 +-
 .../plugins/echo/projects/sessions_spec.rb    | 34 -------------------
 4 files changed, 9 insertions(+), 62 deletions(-)
 delete mode 100644 engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 38456499f..4a12c05bc 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -6,22 +6,12 @@ class Projects::SessionsController < AuthenticatedController
     include TurboConfigCheck
     layout false
 
-    before_action :set_type, only: [:create, :index]
-    before_action :set_record, only: [:create, :index]
+    before_action :set_type
+    before_action :set_record, only: [:create]
     before_action :check_turbo_config, only: [:show, :create]
     before_action :set_session, only: [:show]
 
-    # Lists the record's past sessions plus the prompts available to start a new
-    # one. Roslin-disabled and prompts empty-state warnings are handled by the
-    # view.
-    def index
-      @sessions = Session.for_record(@record)
-      @prompts = current_user.prompts.for(@type)
-    end
-
-    def show
-      @messages = @session.messages.order(:created_at, :id)
-    end
+    def show; end
 
     # Starts a conversation from a saved prompt. The Prompt is read only here, at
     # the controller boundary — we copy its title and never store a FK, so a
@@ -64,22 +54,20 @@ def record_params
     end
 
     def set_record
+      raise ActiveRecord::RecordNotFound if @type.blank?
+
       @record = current_project.send(@type.to_s.pluralize).find(record_params[:record])
     end
 
     def set_session
       @session = Session.find(record_params[:id])
-      @record = scoped_record(@session.record)
+      @record = scoped_record(@session)
       @sessions = Session.for_record(@record).order(updated_at: :desc)
     end
 
-    # Whitelists the record type against Prompt::SCOPES before it reaches a
-    # dynamic `current_project.send(@type.pluralize)` dispatch. An unknown type
-    # is an out-of-scope request, not a 500 — raise the same RecordNotFound the
-    # scoped lookups do.
     def set_type
-      @type = record_params[:type]&.to_sym
-      raise ActiveRecord::RecordNotFound unless Prompt::SCOPES.include?(@type)
+      allowed = Prompt::SCOPES.map(&:to_s)
+      @type = allowed.include?(record_params[:type]) ? record_params[:type].to_sym : nil
     end
   end
 end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb
deleted file mode 100644
index 60935049b..000000000
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_messages.html.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-<%# locals: (messages:) -%>
-<%# The live transcript container. ReplyJob and Message#broadcast_created append %>
-<%# new turns into #echo-messages, so its id must stay stable across renders. %>
-<div id="echo-messages" data-behavior="echo-messages">
-  <%= render partial: 'dradis/plugins/echo/projects/sessions/messages/message',
-             collection: messages, as: :message %>
-</div>
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index 3800bcf1a..652d88aeb 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -12,7 +12,7 @@
         resources :grammar_corrections, only: [:create]
         resources :grammar_suggestions, only: [:create]
 
-        resources :sessions, only: [:index, :show, :create] do
+        resources :sessions, only: [:show, :create] do
           scope module: 'sessions' do
             resource :reply, only: [:create]
             resources :messages, only: [:create]
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 0d9b0bb3e..07c5c5f77 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -29,40 +29,6 @@
     create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
   end
 
-  describe 'GET /addons/echo/projects/:project_id/sessions' do
-    it 'lists the record-scoped sessions and prompts' do
-      prompt # a prompt must exist for the sessions list to render
-      session = Dradis::Plugins::Echo::Session.create!(
-        agent: roslin, record: issue, title: 'Existing session', user: user
-      )
-
-      get "/addons/echo/projects/#{@project.id}/sessions",
-        params: { type: 'issue', record: issue.id }
-
-      expect(response).to have_http_status(:ok)
-      expect(response.body).to include('Existing session')
-      expect(response.body).to include(
-        ActionView::RecordIdentifier.dom_id(session)
-      )
-    end
-
-    it 'honours the Prompt::SCOPES whitelist' do
-      expect do
-        get "/addons/echo/projects/#{@project.id}/sessions",
-          params: { type: 'node', record: issue.id }
-      end.to raise_error(ActiveRecord::RecordNotFound)
-    end
-
-    it 'denies a record outside the current project scope' do
-      other_issue = create(:issue, node: create(:node))
-
-      expect do
-        get "/addons/echo/projects/#{@project.id}/sessions",
-          params: { type: 'issue', record: other_issue.id }
-      end.to raise_error(ActiveRecord::RecordNotFound)
-    end
-  end
-
   describe 'POST /addons/echo/projects/:project_id/sessions' do
     let(:params) do
       { type: 'issue', record: issue.id, prompt_id: prompt.id, prompt: 'Summarise the SQLi finding' }

From b92550966b1260323e60029ce17c410ac4d5c0b3 Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 3 Aug 2026 11:53:34 +0200
Subject: [PATCH 42/57] redesign the session list item: small spinner next to
 title, keep chevron

---
 .../dradis/plugins/echo/sessions.scss         | 34 +++++++++++++------
 .../projects/sessions/_session_item.html.erb  | 15 ++++----
 2 files changed, 31 insertions(+), 18 deletions(-)

diff --git a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
index 82c8bcaf9..e91745da4 100644
--- a/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
+++ b/engines/dradis-echo/app/assets/stylesheets/dradis/plugins/echo/sessions.scss
@@ -68,9 +68,16 @@
     background-color: var(--secondary-bg);
   }
 
+  .echo-session-body {
+    display: flex;
+    flex: 1 1 auto;
+    flex-direction: column;
+    min-width: 0;
+  }
+
   .echo-session-chevron {
     color: var(--text-muted);
-    margin-left: auto;
+    flex-shrink: 0;
   }
 
   .echo-session-icon {
@@ -84,8 +91,23 @@
     font-size: 0.75rem;
   }
 
+  .echo-session-row {
+    align-items: center;
+    display: flex;
+    gap: 0.5rem;
+
+    .spinner-container {
+      flex-shrink: 0;
+    }
+  }
+
   .echo-session-title {
+    flex: 1 1 auto;
     font-weight: 600;
+    min-width: 0;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
   }
 }
 
@@ -100,16 +122,6 @@
   padding: 0.5rem 0.25rem 1rem;
 }
 
-.echo-session-generating {
-  align-items: center;
-  color: var(--text-link);
-  display: inline-flex;
-  font-size: 0.75rem;
-  font-weight: 600;
-  gap: 0.35rem;
-  margin-left: auto;
-}
-
 // ---- Conversation surface (sessions#show) ----
 // Flex column: scrolling message list + pinned composer. Content-driven height
 // with a sensible ceiling — no viewport-locked 50vh.
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
index ea387e4a9..e01dc0ee8 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_session_item.html.erb
@@ -6,13 +6,14 @@
       aria: { current: is_active ? 'page' : nil },
       data: { turbo_frame: dom_id(record, :echo) } do %>
   <i class="echo-session-icon fa-solid fa-comments"></i>
-  <span class="d-flex flex-column">
-    <span class="echo-session-title"><%= session.title.presence || "Session ##{session.id}" %></span>
+  <span class="echo-session-body">
+    <span class="echo-session-row">
+      <span class="echo-session-title"><%= session.title.presence || "Session ##{session.id}" %></span>
+      <% if session.generating? %>
+        <%= spinner_tag spinner_class: 'spinner-border-sm text-primary', inline: true %>
+      <% end %>
+      <i class="echo-session-chevron fa-solid fa-chevron-right"></i>
+    </span>
     <span class="echo-session-meta">Updated <%= local_time_ago(session.updated_at) %></span>
   </span>
-  <% if session.generating? %>
-    <span class="echo-session-generating"><span class="spinner-border spinner-border-xs" role="status"></span> Roslin is responding</span>
-  <% else %>
-    <i class="echo-session-chevron fa-solid fa-chevron-right"></i>
-  <% end %>
 <% end %>

From cea943787cdcca5676fad212bf3ebc49602feec8 Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:49:09 +0100
Subject: [PATCH 43/57] Echo: add session Stimulus controller and feature
 coverage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Slice 5b of Echo Sessions (SEC-477). New session_controller keeps the
transcript scrolled to the newest message as chunks stream in, posts the
composer over fetch so sending never navigates the Echo frame, and
mirrors the broadcast generating state onto the textarea; it replaces the
now-removed prompt_controller. A feature spec drives the full flow with a
stubbed provider — start a session from a prompt, persist the streamed
first exchange, reload, and prove a follow-up carries the prior context
forward. CHANGELOG notes the multiplayer sessions enhancement.
---
 CHANGELOG                                     |  2 +
 .../dradis/plugins/echo/manifests/hera.js     |  2 +-
 .../dradis/plugins/echo/prompt_controller.js  | 26 ------
 .../dradis/plugins/echo/session_controller.js | 68 ++++++++++++++
 .../dradis/plugins/echo/sessions_spec.rb      | 91 +++++++++++++++++++
 5 files changed, 162 insertions(+), 27 deletions(-)
 delete mode 100644 engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/prompt_controller.js
 create mode 100644 engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
 create mode 100644 engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb

diff --git a/CHANGELOG b/CHANGELOG
index c47454b76..ef9a9cd4c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -33,6 +33,8 @@ v5.2.0 (July 2026)
   - UI: add dark mode support to the login and setup wizard pages
   - Upgraded gems:
     - concurrent-ruby, crass, faraday, msgpack, net-imap, nokogiri, puma
+  - Echo enhancements:
+    - Roslin: add multiplayer chat sessions on Issues — start a conversation from a saved prompt, follow up with more messages, and watch Roslin's reply stream live to everyone viewing
   - Bugs fixes:
     - Echo:
       - Preserve line breaks in streamed Ollama responses for models that emit them as standalone tokens
diff --git a/engines/dradis-echo/app/assets/config/dradis/plugins/echo/manifests/hera.js b/engines/dradis-echo/app/assets/config/dradis/plugins/echo/manifests/hera.js
index 30cb65c68..f446ee8b8 100644
--- a/engines/dradis-echo/app/assets/config/dradis/plugins/echo/manifests/hera.js
+++ b/engines/dradis-echo/app/assets/config/dradis/plugins/echo/manifests/hera.js
@@ -2,5 +2,5 @@
 
 //= link controllers/dradis/plugins/echo/agent_controller.js
 //= link controllers/dradis/plugins/echo/grammar_controller.js
-//= link controllers/dradis/plugins/echo/prompt_controller.js
 //= link controllers/dradis/plugins/echo/prompt_selector_controller.js
+//= link controllers/dradis/plugins/echo/session_controller.js
diff --git a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/prompt_controller.js b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/prompt_controller.js
deleted file mode 100644
index 802c062a8..000000000
--- a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/prompt_controller.js
+++ /dev/null
@@ -1,26 +0,0 @@
-import { Controller } from "@hotwired/stimulus"
-
-export default class extends Controller {
-  static values = {
-    interactionId: String,
-    prompt: String,
-    responseId: String,
-    url: String,
-  }
-
-  connect() {
-    fetch(this.urlValue, {
-      method: 'POST',
-      headers: {
-        'Accept': 'text/vnd.turbo-stream.html',
-        'Content-Type': 'application/json',
-        'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]').content,
-      },
-      body: JSON.stringify({
-        interaction_id: this.interactionIdValue,
-        response_id: this.responseIdValue,
-        prompt: this.promptValue
-      })
-    })
-  }
-}
diff --git a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
new file mode 100644
index 000000000..e7b7350b8
--- /dev/null
+++ b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
@@ -0,0 +1,68 @@
+import { Controller } from "@hotwired/stimulus"
+
+// Drives the Echo conversation surface (sessions#show):
+//   * keeps the transcript pinned to the newest message as chunks stream in,
+//   * clears the composer after a successful send,
+//   * mirrors the server's generating state onto the textarea.
+// The Send button's disabled state is server-rendered by the broadcast
+// _composer_state partial; here we only keep the textarea in step with it.
+export default class extends Controller {
+  static targets = ["messages", "input"]
+
+  connect() {
+    this.#scrollToBottom()
+
+    // Streaming appends arrive as childList/characterData mutations under
+    // .echo-messages; keep the view pinned to the bottom as they land.
+    this.messagesObserver = new MutationObserver(() => this.#scrollToBottom())
+    this.messagesObserver.observe(this.messagesTarget, {
+      childList: true, characterData: true, subtree: true
+    })
+
+    // The _composer_state partial is broadcast-replaced on every
+    // idle<->generating flip; re-sync the textarea whenever it changes.
+    this.#syncGenerating()
+    this.stateObserver = new MutationObserver(() => this.#syncGenerating())
+    this.stateObserver.observe(this.element, {
+      attributeFilter: ["data-generating"], attributes: true, childList: true, subtree: true
+    })
+  }
+
+  disconnect() {
+    this.messagesObserver?.disconnect()
+    this.stateObserver?.disconnect()
+  }
+
+  // Post over fetch so sending never navigates the Echo frame — the new user
+  // message and Roslin's reply both arrive over the socket. Clear the box on OK.
+  send(event) {
+    event.preventDefault()
+    if (this.#generating()) return
+
+    const form = event.target
+    fetch(form.action, {
+      body: new FormData(form),
+      headers: { "Accept": "text/vnd.turbo-stream.html", "X-CSRF-Token": this.#csrfToken() },
+      method: "POST"
+    }).then((response) => {
+      if (response.ok) form.reset()
+    })
+  }
+
+  #csrfToken() {
+    return document.querySelector("meta[name=csrf-token]")?.content || ""
+  }
+
+  #generating() {
+    const state = this.element.querySelector("[data-behavior~=echo-composer-state]")
+    return state?.dataset.generating === "true"
+  }
+
+  #scrollToBottom() {
+    if (this.hasMessagesTarget) this.messagesTarget.scrollTop = this.messagesTarget.scrollHeight
+  }
+
+  #syncGenerating() {
+    if (this.hasInputTarget) this.inputTarget.disabled = this.#generating()
+  }
+}
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
new file mode 100644
index 000000000..0917d0bd6
--- /dev/null
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
@@ -0,0 +1,91 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# End-to-end coverage of the Echo session flow through the real views, controllers
+# and models: start a session from a saved prompt, persist the first exchange, and
+# prove a follow-up retains the prior transcript. The provider is stubbed so the
+# reply is deterministic, and ReplyJob runs inline (perform_enqueued_jobs) so the
+# assistant turn is persisted within the request — no ActionCable needed (the test
+# cable adapter never delivers to a browser anyway).
+describe 'Echo sessions' do
+  include ActiveJob::TestHelper
+
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+
+    # Capture the context handed to the provider each turn so we can assert the
+    # follow-up carried the full history forward.
+    @contexts = []
+    allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
+      .to receive(:generate) do |_provider, messages:, model: nil, &block|
+        @contexts << messages
+        block.call("Roslin reply #{@contexts.size}")
+      end
+  end
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
+  end
+
+  let(:issue) { create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi") }
+
+  let!(:prompt) do
+    user.prompts.create!(
+      title: 'Summarise the finding',
+      prompt: 'Summarise {{ issue.title }}',
+      scope: 'issue',
+      visibility: :user
+    )
+  end
+
+  def start_session
+    visit echo.preview_project_interaction_path(@project.id, prompt.id, type: 'issue', record: issue.id)
+    perform_enqueued_jobs { click_button 'Start with this prompt' }
+  end
+
+  it 'starts a session from a prompt and persists the streamed first exchange' do
+    start_session
+
+    session = Dradis::Plugins::Echo::Session.last
+    expect(session.title).to eq('Summarise the finding')
+    expect(session.user).to eq(user)
+    expect(session.record).to eq(issue)
+
+    expect(session.messages.order(:id).pluck(:role, :content)).to eq([
+      %w[user Summarise\ SQLi],
+      %w[assistant Roslin\ reply\ 1]
+    ])
+    expect(session.reload).to be_idle
+    expect(page).to have_content('Roslin reply 1')
+  end
+
+  it 'retains the conversation context on a follow-up message after reload' do
+    start_session
+    session = Dradis::Plugins::Echo::Session.last
+
+    # Reload the conversation: the first reply has finished, so the transcript
+    # survives (acceptance: survives reload) and the composer re-enables.
+    visit echo.project_session_path(@project.id, session, type: 'issue', record: issue.id)
+    expect(page).to have_content('Roslin reply 1')
+
+    fill_in 'content', with: 'What is the impact?'
+    perform_enqueued_jobs { click_button 'Send' }
+
+    expect(session.messages.reload.order(:id).pluck(:role, :content)).to eq([
+      %w[user Summarise\ SQLi],
+      %w[assistant Roslin\ reply\ 1],
+      ['user', 'What is the impact?'],
+      %w[assistant Roslin\ reply\ 2]
+    ])
+
+    # The provider's second turn saw the whole prior transcript — context retained.
+    expect(@contexts.last.map { |message| message[:content] }).to eq(
+      ['Summarise SQLi', 'Roslin reply 1', 'What is the impact?']
+    )
+    expect(session.reload).to be_idle
+  end
+end

From 4505e3eed5ac9f3db2c95570ce48de1cf20518d7 Mon Sep 17 00:00:00 2001
From: dradis-bot <dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:59:51 +0100
Subject: [PATCH 44/57] Re-trigger CI for flaky node-merger attachment spec
 (unrelated to slice)


From 461078b823f24cd984e99ab144fa6e4a4d5b957e Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 20:27:42 +0100
Subject: [PATCH 45/57] Echo: trigger initial reply from the session controller
 once subscribed

Read the reply-url / reply-pending Stimulus values and, on connect (after the
<turbo-cable-stream-source> has subscribed), POST to RepliesController to start
generation for a freshly-created session. This closes the SEC-506 Bug 4 race:
the streaming container is broadcast only to an already-listening socket, so the
assistant reply renders live on initial creation instead of only on reload.

Also updates the rack_test session feature specs: generation is now client-
triggered, so they drive the reply-trigger POST explicitly (no JS to do it for
them) and read the first reply back on reload.

Refs SEC-506.
---
 .../dradis/plugins/echo/session_controller.js | 20 +++++++++++++++++++
 .../dradis/plugins/echo/sessions_spec.rb      | 19 +++++++++++++-----
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
index e7b7350b8..dcdaa7640 100644
--- a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
+++ b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
@@ -8,6 +8,7 @@ import { Controller } from "@hotwired/stimulus"
 // _composer_state partial; here we only keep the textarea in step with it.
 export default class extends Controller {
   static targets = ["messages", "input"]
+  static values = { replyUrl: String, replyPending: Boolean }
 
   connect() {
     this.#scrollToBottom()
@@ -26,6 +27,8 @@ export default class extends Controller {
     this.stateObserver.observe(this.element, {
       attributeFilter: ["data-generating"], attributes: true, childList: true, subtree: true
     })
+
+    this.#triggerPendingReply()
   }
 
   disconnect() {
@@ -49,6 +52,23 @@ export default class extends Controller {
     })
   }
 
+  // On a freshly-created session the server deliberately did NOT start
+  // generation (SEC-506 Bug 4): had it, ReplyJob's streaming-container broadcast
+  // would have raced ahead of this element's <turbo-cable-stream-source>
+  // subscription and been dropped. Now that we're connected — and thus
+  // subscribed — POST to start the reply, so every chunk lands on a listening
+  // socket. The POST round-trip comfortably outlasts the local subscribe
+  // handshake, and the server re-checks reply_pending? so a reconnect can't
+  // spawn a second reply.
+  #triggerPendingReply() {
+    if (!this.replyPendingValue || !this.hasReplyUrlValue) return
+
+    fetch(this.replyUrlValue, {
+      headers: { "X-CSRF-Token": this.#csrfToken() },
+      method: "POST"
+    })
+  }
+
   #csrfToken() {
     return document.querySelector("meta[name=csrf-token]")?.content || ""
   }
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
index 0917d0bd6..3174548c5 100644
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
@@ -42,15 +42,22 @@
     )
   end
 
+  # Generation is now started by the session Stimulus controller once it has
+  # subscribed, not by sessions#create — otherwise ReplyJob's streaming container
+  # broadcasts before the socket is listening (SEC-506 Bug 4). rack_test has no
+  # JS, so drive that reply-trigger POST explicitly and run the job inline.
   def start_session
     visit echo.preview_project_interaction_path(@project.id, prompt.id, type: 'issue', record: issue.id)
-    perform_enqueued_jobs { click_button 'Start with this prompt' }
+    click_button 'Start with this prompt'
+
+    session = Dradis::Plugins::Echo::Session.last
+    perform_enqueued_jobs { page.driver.post(echo.project_session_reply_path(@project.id, session)) }
+    session
   end
 
   it 'starts a session from a prompt and persists the streamed first exchange' do
-    start_session
+    session = start_session
 
-    session = Dradis::Plugins::Echo::Session.last
     expect(session.title).to eq('Summarise the finding')
     expect(session.user).to eq(user)
     expect(session.record).to eq(issue)
@@ -60,12 +67,14 @@ def start_session
       %w[assistant Roslin\ reply\ 1]
     ])
     expect(session.reload).to be_idle
+
+    # The reply is generated after create renders show, so it lands on reload.
+    visit echo.project_session_path(@project.id, session, type: 'issue', record: issue.id)
     expect(page).to have_content('Roslin reply 1')
   end
 
   it 'retains the conversation context on a follow-up message after reload' do
-    start_session
-    session = Dradis::Plugins::Echo::Session.last
+    session = start_session
 
     # Reload the conversation: the first reply has finished, so the transcript
     # survives (acceptance: survives reload) and the composer re-enables.

From de8300b1171b117aa3453b0bfc02acca4f1b16d6 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:38:30 +0100
Subject: [PATCH 46/57] Echo: house the SEC-506 conversation specs on the spec
 slice

These three specs cover SEC-506 conversation behaviour whose code ships on
the views slice (5a). They were relocated here off #1652 to keep that slice
under the 15-file/600-line cap; this branch stacks on 5a, so they run against
the same code. Covers turbo-frame back-nav, native Echo-tab frame, and
turbo-injected request_id tolerance in broadcast partials.
---
 .../echo/sessions_conversation_spec.rb        | 67 +++++++++++++++++++
 .../plugins/echo/broadcast_request_id_spec.rb | 40 +++++++++++
 .../echo/projects/interactions_spec.rb        | 52 ++++++++++++++
 3 files changed, 159 insertions(+)
 create mode 100644 engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
 create mode 100644 engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
 create mode 100644 engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb

diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
new file mode 100644
index 000000000..d155482b1
--- /dev/null
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
@@ -0,0 +1,67 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# SEC-506 live-browser acceptance for the Echo Sessions conversation UI. These are
+# the flows the rack_test request specs structurally cannot exercise (the documented
+# live-JS/Turbo gap): the Bootstrap tab-show that triggers the native lazy frame, and
+# the Turbo-frame back-navigation between sessions#show and interactions#index.
+describe 'Echo Sessions conversation UI', js: true do
+  before { login_to_project_as_user }
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |a| a.update!(enabled: true) }
+  end
+
+  let(:issue) { create(:issue, node: current_project.issue_library, text: "#[Title]#\nSQLi") }
+
+  let!(:prompt) do
+    @logged_in_as.prompts.create!(
+      title: 'Summarise the finding',
+      prompt: 'Summarise the issue',
+      scope: 'issue',
+      visibility: :user
+    )
+  end
+
+  # Bug 3: the frame-mechanism swap (data-behavior=fetch -> native lazy turbo-frame).
+  it 'lazy-loads the conversation list when the Echo tab is shown and returns to it via the back-link' do
+    session = create(:echo_session, agent: roslin, record: issue, title: 'Earlier conversation')
+    create(:echo_message, session: session, role: :user, content: 'my earlier question', user: @logged_in_as)
+
+    visit project_issue_path(current_project, issue)
+
+    # The Echo tab-pane is hidden until the Bootstrap tab is shown; showing it must
+    # trigger the native <turbo-frame loading="lazy" src=...> to fetch interactions#index.
+    click_link 'Echo'
+    expect(page).to have_css("turbo-frame#echo_issue_#{issue.id}")
+    expect(page).to have_content('Earlier conversation') # lazy frame loaded on tab-show
+
+    # Into the session (sessions#show renders into the same native frame).
+    find('.echo-session-item', text: 'Earlier conversation').click
+    expect(page).to have_content('my earlier question')
+
+    # Back to the list: Turbo navigates the frame to interactions#index. Before the
+    # fix this reported "Content missing" (index answered frameless).
+    find('.echo-back-link').click
+    expect(page).to have_content('Earlier conversation')
+    expect(page).to have_no_content('Content missing')
+  end
+
+  # Bug 1: sessions#create -> render :show must be 200, not a StrictLocalsError 500.
+  it 'starts a conversation from a saved prompt without a StrictLocalsError' do
+    visit project_issue_path(current_project, issue)
+    click_link 'Echo'
+
+    # The prompt-selector stimulus controller auto-loads the selected prompt's preview
+    # form (the "Start with this prompt" submit) into the echo-prompt-preview frame.
+    expect(page).to have_button('Start with this prompt')
+    click_button 'Start with this prompt'
+
+    # The create response renders sessions#show into the echo frame: the first user
+    # message (the prompt body) appears and no error page / strict-locals crash.
+    expect(page).to have_content('Summarise the issue')
+    expect(page).to have_no_content('unknown local')
+    expect(page).to have_css('.echo-conversation')
+  end
+end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
new file mode 100644
index 000000000..8472cf2ba
--- /dev/null
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
@@ -0,0 +1,40 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# SEC-506 Bug 1/2 regression: turbo-rails 2.0.4 broadcastable.rb:503 reverse_merges
+# `request_id: Turbo.current_request_id` into every broadcast partial's locals. In a
+# real request the RequestId middleware sets a non-nil id, so it reaches the partial;
+# in a job / rack_test it's nil and .compact drops it. Both Echo broadcast-target
+# partials use strict locals, so unless they tolerate `request_id`, the broadcasts
+# that fire *inside SessionsController#create* (Message#broadcast_created and, via
+# request_reply!, Session#broadcast_composer_state) raise StrictLocalsError → 500.
+#
+# A plain request spec can't catch this (nil request_id), which is why it slipped
+# through. We force a non-nil id with Turbo.with_request_id so the render exercises
+# the exact failing path.
+describe 'Echo broadcasts under a non-nil Turbo request id' do
+  let(:user) { create(:user) }
+  let(:agent) { create(:agent) }
+  let(:session) { create(:echo_session, agent: agent) }
+
+  around do |example|
+    Turbo.with_request_id('sec506-req-id') { example.run }
+  end
+
+  it 'renders _message via Message#broadcast_created without StrictLocalsError' do
+    message = create(:echo_message, session: session, role: :user, user: user)
+
+    expect { message.send(:broadcast_created) }.not_to raise_error
+  end
+
+  it 'renders _message for an assistant turn too' do
+    message = create(:assistant_message, session: session)
+
+    expect { message.send(:broadcast_created) }.not_to raise_error
+  end
+
+  it 'renders _composer_state via Session#broadcast_composer_state without StrictLocalsError' do
+    expect { session.broadcast_composer_state }.not_to raise_error
+  end
+end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
new file mode 100644
index 000000000..1492aacbe
--- /dev/null
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -0,0 +1,52 @@
+require 'rails_helper'
+
+Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
+
+# Regression coverage for SEC-506 Bug 3: the Echo tab loads interactions#index
+# into a native <turbo-frame id="echo_issue_<id>">, and the session back-link
+# navigates that same frame back to interactions#index. If index answers
+# frameless, Turbo reports "the response did not contain the expected
+# <turbo-frame>" and the tab shows "Content missing". So the index response must
+# carry the record's Echo frame verbatim.
+describe 'Echo interactions' do
+  let(:user) { create(:user) }
+
+  before do
+    login_as_user(user)
+    @project = Project.new
+  end
+
+  let!(:roslin) do
+    Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
+  end
+
+  let(:issue) do
+    create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi")
+  end
+
+  describe 'GET /addons/echo/projects/:project_id/interactions' do
+    it 'wraps the conversation list in the record Echo turbo-frame' do
+      get "/addons/echo/projects/#{@project.id}/interactions",
+        params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include(
+        "<turbo-frame id=\"#{ActionView::RecordIdentifier.dom_id(issue, :echo)}\""
+      )
+    end
+
+    it 'matches the frame id the session show back-link navigates' do
+      # The back-link and the index share dom_id(record, :echo); prove they agree
+      # so a Turbo back-navigation frame-matches instead of erroring out.
+      session = create(:echo_session, agent: roslin, record: issue)
+
+      get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}",
+        params: { type: 'issue', record: issue.id }
+      frame_id = ActionView::RecordIdentifier.dom_id(issue, :echo)
+      back_link = echo.project_interactions_path(@project, type: 'issue', record: issue.id)
+      expect(response.body).to include("<turbo-frame id=\"#{frame_id}\"")
+      # href attributes HTML-escape the query separator (& -> &amp;); match escaped.
+      expect(response.body).to include(ERB::Util.html_escape(back_link))
+    end
+  end
+end

From 5654153719f35c54ff8c47972fc471eefe85db26 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:45:12 +0100
Subject: [PATCH 47/57] Echo: surface a failed message send instead of
 swallowing it

Applies the PR #1655 review nit on the session Stimulus slice: the send
fetch had no rejection or non-OK handling, so a failed send gave the user
zero feedback. Handle both a non-OK response and a network error by
showing a transient inline alert; the composer text is preserved (reset()
still only runs on OK) so the user can retry.
---
 .../dradis/plugins/echo/session_controller.js | 35 +++++++++++++++++--
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
index dcdaa7640..990586d33 100644
--- a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
+++ b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
@@ -34,22 +34,51 @@ export default class extends Controller {
   disconnect() {
     this.messagesObserver?.disconnect()
     this.stateObserver?.disconnect()
+    clearTimeout(this.sendErrorTimeout)
   }
 
   // Post over fetch so sending never navigates the Echo frame — the new user
-  // message and Roslin's reply both arrive over the socket. Clear the box on OK.
+  // message and Roslin's reply both arrive over the socket. Clear the box on OK;
+  // on a non-OK response or a network error, keep the text and warn the user so
+  // a failed send isn't silently swallowed.
   send(event) {
     event.preventDefault()
     if (this.#generating()) return
 
     const form = event.target
+    this.#clearSendError()
+
     fetch(form.action, {
       body: new FormData(form),
       headers: { "Accept": "text/vnd.turbo-stream.html", "X-CSRF-Token": this.#csrfToken() },
       method: "POST"
     }).then((response) => {
-      if (response.ok) form.reset()
-    })
+      if (response.ok) {
+        form.reset()
+      } else {
+        this.#showSendError()
+      }
+    }).catch(() => this.#showSendError())
+  }
+
+  // Surfaces a send failure inline without clearing the composer, so the user
+  // can retry the same text. Auto-dismisses; a fresh failure replaces it.
+  #showSendError() {
+    this.#clearSendError()
+
+    const alert = document.createElement("div")
+    alert.className = "alert alert-danger echo-send-error"
+    alert.setAttribute("role", "alert")
+    alert.dataset.behavior = "echo-send-error"
+    alert.textContent = "Your message couldn't be sent. Check your connection and try again."
+
+    this.element.insertBefore(alert, this.element.firstChild)
+    this.sendErrorTimeout = setTimeout(() => this.#clearSendError(), 8000)
+  }
+
+  #clearSendError() {
+    clearTimeout(this.sendErrorTimeout)
+    this.element.querySelector("[data-behavior~=echo-send-error]")?.remove()
   }
 
   // On a freshly-created session the server deliberately did NOT start

From 33813a47c231157982673a56e49e1e8d5e201b8d Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 20 Jul 2026 19:06:18 +0200
Subject: [PATCH 48/57] run initBehaviors on turbo:frame-load so ComboBox works
 in lazy frames

---
 app/assets/javascripts/hera/behaviors.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/app/assets/javascripts/hera/behaviors.js b/app/assets/javascripts/hera/behaviors.js
index 3fa917926..f996f950c 100644
--- a/app/assets/javascripts/hera/behaviors.js
+++ b/app/assets/javascripts/hera/behaviors.js
@@ -205,6 +205,12 @@ document.addEventListener('turbo:load', function () {
     initBehaviors(document.querySelector('body'));
   });
 
+  // Native <turbo-frame> navigations (including loading="lazy") don't fire
+  // turbo:load
+  document.addEventListener('turbo:frame-load', function (event) {
+    initBehaviors(event.target);
+  });
+
   // Because this is an event and not a data-driven behavior, we can leave it
   // out of initBehaviors and attach the listener to document directly.
   //

From 71a01b632ce61be2d68c959918e8c58f26756544 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 15:56:57 +0100
Subject: [PATCH 49/57] Echo: restore new-conversation-link spec naming lost
 when flattening the views->stimulus merge

---
 .../plugins/echo/sessions_conversation_spec.rb     |  4 ++--
 .../plugins/echo/projects/interactions_spec.rb     | 14 +++++++-------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
index d155482b1..b22baec67 100644
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
@@ -25,7 +25,7 @@
   end
 
   # Bug 3: the frame-mechanism swap (data-behavior=fetch -> native lazy turbo-frame).
-  it 'lazy-loads the conversation list when the Echo tab is shown and returns to it via the back-link' do
+  it 'lazy-loads the conversation list when the Echo tab is shown and returns to it via the "+ New" link' do
     session = create(:echo_session, agent: roslin, record: issue, title: 'Earlier conversation')
     create(:echo_message, session: session, role: :user, content: 'my earlier question', user: @logged_in_as)
 
@@ -43,7 +43,7 @@
 
     # Back to the list: Turbo navigates the frame to interactions#index. Before the
     # fix this reported "Content missing" (index answered frameless).
-    find('.echo-back-link').click
+    find('.echo-new-conversation-link').click
     expect(page).to have_content('Earlier conversation')
     expect(page).to have_no_content('Content missing')
   end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index 1492aacbe..d81ec3024 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -3,8 +3,8 @@
 Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
 
 # Regression coverage for SEC-506 Bug 3: the Echo tab loads interactions#index
-# into a native <turbo-frame id="echo_issue_<id>">, and the session back-link
-# navigates that same frame back to interactions#index. If index answers
+# into a native <turbo-frame id="echo_issue_<id>">, and the session's "+ New"
+# link navigates that same frame back to interactions#index. If index answers
 # frameless, Turbo reports "the response did not contain the expected
 # <turbo-frame>" and the tab shows "Content missing". So the index response must
 # carry the record's Echo frame verbatim.
@@ -35,18 +35,18 @@
       )
     end
 
-    it 'matches the frame id the session show back-link navigates' do
-      # The back-link and the index share dom_id(record, :echo); prove they agree
-      # so a Turbo back-navigation frame-matches instead of erroring out.
+    it 'matches the frame id the session show "+ New" link navigates' do
+      # The "+ New" link and the index share dom_id(record, :echo); prove they
+      # agree so a Turbo navigation frame-matches instead of erroring out.
       session = create(:echo_session, agent: roslin, record: issue)
 
       get "/addons/echo/projects/#{@project.id}/sessions/#{session.id}",
         params: { type: 'issue', record: issue.id }
       frame_id = ActionView::RecordIdentifier.dom_id(issue, :echo)
-      back_link = echo.project_interactions_path(@project, type: 'issue', record: issue.id)
+      new_conversation_link = echo.project_interactions_path(@project, type: 'issue', record: issue.id)
       expect(response.body).to include("<turbo-frame id=\"#{frame_id}\"")
       # href attributes HTML-escape the query separator (& -> &amp;); match escaped.
-      expect(response.body).to include(ERB::Util.html_escape(back_link))
+      expect(response.body).to include(ERB::Util.html_escape(new_conversation_link))
     end
   end
 end

From 232a0abd46fe8ff0d4d6e65100127e352dacca7b Mon Sep 17 00:00:00 2001
From: MattBudz <matt.budz@protonmail.com>
Date: Mon, 3 Aug 2026 11:20:47 +0200
Subject: [PATCH 50/57] move CHANGELOG entries into the top/new section

---
 CHANGELOG | 23 +++++++----------------
 1 file changed, 7 insertions(+), 16 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index ef9a9cd4c..a52cbcffa 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,16 +1,16 @@
 [v#.#.#] ([month] [YYYY])
-  - [entity]:
-    - [future tense verb] [feature]
+  - Echo: add multiplayer chat sessions on Issues — start a conversation from a saved prompt, follow up with more messages, and watch Roslin's reply stream live to everyone viewing
   - Upgraded gems:
     - rails, rails-html-sanitizer, sqlite3, websocket-driver
   - Bugs fixes:
-    - [entity]:
-      - [future tense verb] [bug fix]
+    - Echo:
+      - Preserve line breaks in streamed Ollama responses for models that emit them as standalone tokens
+      - Remove a stray leading blank line from streamed responses
+      - Send only completed conversation turns to the AI provider, so a failed or in-progress reply can no longer break the next one
+      - Show a generic message when a reply fails instead of surfacing the provider's raw error
+      - Return a graceful error instead of a server error when a chat session is started with a blank prompt
     - Bug tracker items:
       - [item]
-  - Echo enhancements:
-    - [Echo entity]:
-      - [future tense verb] [Echo enhancement]
   - New integrations:
     - [integration]
   - Integration enhancements:
@@ -33,15 +33,6 @@ v5.2.0 (July 2026)
   - UI: add dark mode support to the login and setup wizard pages
   - Upgraded gems:
     - concurrent-ruby, crass, faraday, msgpack, net-imap, nokogiri, puma
-  - Echo enhancements:
-    - Roslin: add multiplayer chat sessions on Issues — start a conversation from a saved prompt, follow up with more messages, and watch Roslin's reply stream live to everyone viewing
-  - Bugs fixes:
-    - Echo:
-      - Preserve line breaks in streamed Ollama responses for models that emit them as standalone tokens
-      - Remove a stray leading blank line from streamed responses
-      - Send only completed conversation turns to the AI provider, so a failed or in-progress reply can no longer break the next one
-      - Show a generic message when a reply fails instead of surfacing the provider's raw error
-      - Return a graceful error instead of a server error when a chat session is started with a blank prompt
 
 v5.1.0 (May 2026)
   - DataTables: add sticky table toolbar that tracks below the navigation bar when scrolling

From 4a10c322185cd604997ca4cbf563064a99f351fb Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:39:39 +0100
Subject: [PATCH 51/57] Echo: retire the legacy Roslin one-shot interaction
 path

Slice 5 repurposed InteractionsController#index/#preview into the sessions
landing, leaving #create/#show and InteractionJob as the last remnants of the
Roslin one-shot prototype. Remove them now that ReplyJob-backed sessions are
live, so the record panel keeps only the sessions entry point.
---
 .../echo/projects/interactions_controller.rb  | 21 +-----
 .../dradis/plugins/echo/interaction_job.rb    | 32 ---------
 engines/dradis-echo/config/routes.rb          |  2 +-
 .../plugins/echo/interaction_job_spec.rb      | 70 -------------------
 .../echo/projects/interactions_spec.rb        | 21 ++++++
 5 files changed, 24 insertions(+), 122 deletions(-)
 delete mode 100644 engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
 delete mode 100644 engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
index 317c74837..22448d791 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
@@ -5,8 +5,8 @@ class Projects::InteractionsController < AuthenticatedController
 
     before_action :check_turbo_config, only: [:index]
     before_action :set_type
-    before_action :set_prompt, only: [:preview, :show]
-    before_action :set_record, except: [:create]
+    before_action :set_prompt, only: [:preview]
+    before_action :set_record
 
     def index
       Prompt.seed_default_prompts(current_user) if current_user.prompts.empty?
@@ -17,23 +17,6 @@ def index
 
     def preview; end
 
-    def show
-      @prompt_content = params[:prompt]
-      @interaction_id = SecureRandom.hex(20)
-      @response_id = SecureRandom.hex(10)
-    end
-
-    def create
-      InteractionJob.perform_later(
-        agent_id: Agents::Roslin.id,
-        prompt: params[:prompt],
-        interaction_id: params[:interaction_id],
-        response_id: params[:response_id]
-      )
-
-      head :ok
-    end
-
     private
 
     def check_turbo_config
diff --git a/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb b/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
deleted file mode 100644
index 0a358f50e..000000000
--- a/engines/dradis-echo/app/jobs/dradis/plugins/echo/interaction_job.rb
+++ /dev/null
@@ -1,32 +0,0 @@
-module Dradis::Plugins::Echo
-  class InteractionJob < ApplicationJob
-    queue_as :dradis_project
-
-    def perform(agent_id:, prompt:, interaction_id:, response_id:)
-      agent = Agent.find(agent_id)
-      raise "Agent '#{agent.name}' is not enabled" unless agent.enabled?
-
-      spinner_shown = true
-
-      agent.provider.generate(prompt: prompt, model: agent.model_override) do |chunk|
-        if spinner_shown
-          Turbo::StreamsChannel.broadcast_remove_to [interaction_id, 'prompts'], target: "#{response_id}_spinner"
-          spinner_shown = false
-        end
-
-        Turbo::StreamsChannel.broadcast_append_to(
-          [interaction_id, 'prompts'],
-          target: response_id,
-          content: ERB::Util.html_escape(chunk)
-        )
-      end
-
-      Turbo::StreamsChannel.broadcast_append_to [interaction_id, 'prompts'], target: 'messages', html: '<p>Done.</p>'
-    rescue => e
-      msg = '<div class="alert alert-danger m-0">'
-      msg << ERB::Util.html_escape(e.message)
-      msg << '</div>'
-      Turbo::StreamsChannel.broadcast_update_to [interaction_id, 'prompts'], target: response_id, html: msg
-    end
-  end
-end
diff --git a/engines/dradis-echo/config/routes.rb b/engines/dradis-echo/config/routes.rb
index 652d88aeb..55c88d4b0 100644
--- a/engines/dradis-echo/config/routes.rb
+++ b/engines/dradis-echo/config/routes.rb
@@ -5,7 +5,7 @@
 
     resources :projects, only: [] do
       scope module: 'projects' do
-        resources :interactions, only: [:index, :show, :create] do
+        resources :interactions, only: [:index] do
           get :preview, on: :member
         end
 
diff --git a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb b/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
deleted file mode 100644
index b7e3cf0ad..000000000
--- a/engines/dradis-echo/spec/jobs/dradis/plugins/echo/interaction_job_spec.rb
+++ /dev/null
@@ -1,70 +0,0 @@
-require 'rails_helper'
-require File.expand_path('../../../../factories/agents', __dir__)
-require File.expand_path('../../../../factories/providers', __dir__)
-
-describe Dradis::Plugins::Echo::InteractionJob do
-  let(:interaction_id) { 'project-1' }
-  let(:response_id) { 'response-1' }
-  let(:prompt) { 'Summarise this issue.' }
-  let(:agent) { create(:system_agent) }
-
-  def perform
-    described_class.perform_now(
-      agent_id: agent.id,
-      prompt: prompt,
-      interaction_id: interaction_id,
-      response_id: response_id
-    )
-  end
-
-  before do
-    allow(Turbo::StreamsChannel).to receive(:broadcast_append_to)
-    allow(Turbo::StreamsChannel).to receive(:broadcast_remove_to)
-    allow(Turbo::StreamsChannel).to receive(:broadcast_update_to)
-  end
-
-  describe 'when agent is not enabled' do
-    before { agent.update!(enabled: false) }
-
-    it 'broadcasts a user-friendly error' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
-        expect(kwargs[:html]).to include('is not enabled')
-      end
-    end
-  end
-
-  describe 'error message sanitisation' do
-    it 'HTML-escapes the error message before broadcasting' do
-      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
-        .to receive(:generate).and_raise('<script>alert(1)</script>')
-
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_update_to) do |_, **kwargs|
-        expect(kwargs[:html]).to include('&lt;script&gt;')
-        expect(kwargs[:html]).not_to include('<script>')
-      end
-    end
-  end
-
-  describe 'successful streaming' do
-    before do
-      allow_any_instance_of(Dradis::Plugins::Echo::Provider::Ollama)
-        .to receive(:generate).and_yield('Hello ').and_yield('world')
-    end
-
-    it 'removes the spinner on the first chunk' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_remove_to)
-        .with([interaction_id, 'prompts'], target: "#{response_id}_spinner")
-    end
-
-    it 'broadcasts each chunk to the response target' do
-      perform
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([interaction_id, 'prompts'], target: response_id, content: 'Hello ')
-      expect(Turbo::StreamsChannel).to have_received(:broadcast_append_to)
-        .with([interaction_id, 'prompts'], target: response_id, content: 'world')
-    end
-  end
-end
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index d81ec3024..85edab513 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -25,6 +25,13 @@
   end
 
   describe 'GET /addons/echo/projects/:project_id/interactions' do
+    it 'renders the sessions panel entry point' do
+      get "/addons/echo/projects/#{@project.id}/interactions", params: { type: 'issue', record: issue.id }
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('Start a new conversation')
+    end
+
     it 'wraps the conversation list in the record Echo turbo-frame' do
       get "/addons/echo/projects/#{@project.id}/interactions",
         params: { type: 'issue', record: issue.id }
@@ -49,4 +56,18 @@
       expect(response.body).to include(ERB::Util.html_escape(new_conversation_link))
     end
   end
+
+  describe 'the retired Roslin one-shot path' do
+    it 'no longer exposes a create route' do
+      expect {
+        post "/addons/echo/projects/#{@project.id}/interactions", params: { type: 'issue', record: issue.id }
+      }.to raise_error(ActionController::RoutingError)
+    end
+
+    it 'no longer exposes a show route' do
+      expect {
+        get "/addons/echo/projects/#{@project.id}/interactions/1", params: { type: 'issue', record: issue.id }
+      }.to raise_error(ActionController::RoutingError)
+    end
+  end
 end

From d03a40f26e5ce9e45cb047fbf3b4b60c990e741f Mon Sep 17 00:00:00 2001
From: dradis-bot <286253174+dradis-bot@users.noreply.github.com>
Date: Thu, 16 Jul 2026 08:39:46 +0100
Subject: [PATCH 52/57] Echo: make provider #generate accept messages: only

The prompt: sugar and resolve_messages existed solely for the one-shot
InteractionJob path, which is now gone. ReplyJob already calls
generate(messages:), so drop the single-string convenience and require a
multi-turn messages array everywhere.
---
 .../plugins/echo/provider/http_streaming.rb    | 12 +++++-------
 .../app/models/dradis/plugins/echo/provider.rb | 17 +----------------
 .../dradis/plugins/echo/provider/ollama.rb     |  5 ++---
 .../echo/provider/http_streaming_spec.rb       | 16 +++-------------
 .../plugins/echo/provider/ollama_spec.rb       | 18 +++++-------------
 .../dradis/plugins/echo/provider_spec.rb       |  2 +-
 6 files changed, 17 insertions(+), 53 deletions(-)

diff --git a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
index 9f13233a2..0f98005a0 100644
--- a/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
+++ b/engines/dradis-echo/app/models/concerns/dradis/plugins/echo/provider/http_streaming.rb
@@ -23,25 +23,23 @@ class Error < StandardError; end
       OpenSSL::SSL::SSLError
     ].freeze
 
-    # Sends prompt to the provider and returns the response.
+    # Sends the conversation to the provider and returns the response.
     #
     # With a block: yields each text chunk as it arrives, enabling streaming UX
-    # (e.g. InteractionJob broadcasts each chunk to the browser via Turbo).
+    # (e.g. ReplyJob broadcasts each chunk to the browser via Turbo).
     #
     # Without a block: accumulates all chunks and returns the complete response
     # as a string once the API finishes, for use outside a streaming context.
     #
-    # Accepts a multi-turn messages: array ([{ role:, content: }]) or the
-    # prompt: sugar for a single user message.
+    # Accepts a multi-turn messages: array ([{ role:, content: }]).
     #
     # Subclasses must implement: #build_uri, #build_headers, #build_body,
     # #extract_text. Optionally override #end_of_stream_marker.
-    def generate(messages: nil, prompt: nil, model: nil, &block)
+    def generate(messages:, model: nil, &block)
       resolved_model = model.presence || self.model
-      resolved_messages = resolve_messages(messages, prompt)
       uri = build_uri(resolved_model)
       headers = build_headers
-      body = build_body(messages: resolved_messages, model: resolved_model)
+      body = build_body(messages: messages, model: resolved_model)
 
       buffer = block ? nil : +''
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
index bf181d5b9..2942b3859 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider.rb
@@ -40,7 +40,7 @@ def self.inherited(subclass)
 
     # -- Instance Methods -----------------------------------------------------
 
-    def generate(messages: nil, prompt: nil, model: nil, &block)
+    def generate(messages:, model: nil, &block)
       raise NotImplementedError, "#{self.class.name} must implement #generate"
     end
 
@@ -55,20 +55,5 @@ def requires_api_key?
     def type_name
       self.class.name.demodulize
     end
-
-    private
-
-    # Normalizes the two ways to call #generate into a messages array. Callers
-    # pass either a multi-turn messages: array or the prompt: sugar, which wraps
-    # a single string into one user message.
-    def resolve_messages(messages, prompt)
-      if messages
-        messages
-      elsif prompt
-        [{ role: 'user', content: prompt }]
-      else
-        raise ArgumentError, '#generate requires either messages: or prompt:'
-      end
-    end
   end
 end
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
index d2333ffb1..2d174225c 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/ollama.rb
@@ -7,12 +7,11 @@ def requires_api_key?
       false
     end
 
-    def generate(messages: nil, prompt: nil, model: nil, &block)
+    def generate(messages:, model: nil, &block)
       resolved_model = model.presence || self.model
-      resolved_messages = resolve_messages(messages, prompt)
       buffer = block_given? ? nil : +''
 
-      client.chat({ model: resolved_model, messages: resolved_messages }) do |event, _raw|
+      client.chat({ model: resolved_model, messages: messages }) do |event, _raw|
         next if event['done']
 
         chunk = event.dig('message', 'content').to_s
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
index 4b43c28a7..a14af2e5c 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
@@ -81,7 +81,7 @@ def stub_http(body:, code: '200')
       sse_body = "data: #{JSON.generate(delta_event)}\n\n"
       stub_http(body: sse_body)
 
-      result = provider.generate(prompt: 'test')
+      result = provider.generate(messages: [{ role: 'user', content: 'test' }])
       expect(result).to eq('Hello')
     end
 
@@ -91,7 +91,7 @@ def stub_http(body:, code: '200')
       stub_http(body: sse_body)
 
       chunks = []
-      result = provider.generate(prompt: 'test') { |chunk| chunks << chunk }
+      result = provider.generate(messages: [{ role: 'user', content: 'test' }]) { |chunk| chunks << chunk }
       expect(chunks).to eq(['Hello'])
       expect(result).to be_nil
     end
@@ -112,17 +112,7 @@ def stub_http(body:, code: '200')
       expect(provider.generate(messages: messages)).to eq('Hello')
     end
 
-    it 'wraps the prompt: sugar into a single user message' do
-      stub_http(body: '')
-
-      expect(provider).to receive(:build_body)
-        .with(messages: [{ role: 'user', content: 'test' }], model: 'claude-sonnet-4-6')
-        .and_call_original
-
-      provider.generate(prompt: 'test')
-    end
-
-    it 'raises when neither messages: nor prompt: is given' do
+    it 'raises when messages: is not given' do
       expect { provider.generate }.to raise_error(ArgumentError)
     end
   end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
index 843d326eb..e1c7911ad 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/ollama_spec.rb
@@ -29,7 +29,7 @@ def content_event(content, done: false)
         content_event('', done: true)
       )
 
-      expect(provider.generate(prompt: 'hi')).to eq('Hello world')
+      expect(provider.generate(messages: [{ role: 'user', content: 'hi' }])).to eq('Hello world')
     end
 
     it 'preserves whitespace-only chunks, such as standalone line breaks' do
@@ -40,7 +40,7 @@ def content_event(content, done: false)
         content_event('', done: true)
       )
 
-      expect(provider.generate(prompt: 'hi')).to eq("1. First item.  \n2. Second item.")
+      expect(provider.generate(messages: [{ role: 'user', content: 'hi' }])).to eq("1. First item.  \n2. Second item.")
     end
 
     it 'skips events with empty content, such as thinking-only chunks' do
@@ -50,7 +50,7 @@ def content_event(content, done: false)
         content_event('', done: true)
       )
 
-      expect(provider.generate(prompt: 'hi')).to eq('Answer')
+      expect(provider.generate(messages: [{ role: 'user', content: 'hi' }])).to eq('Answer')
     end
 
     it 'replaces think tags embedded in the response text' do
@@ -62,7 +62,7 @@ def content_event(content, done: false)
         content_event('', done: true)
       )
 
-      expect(provider.generate(prompt: 'hi')).to eq('{thinking}reasoning{/thinking}Answer')
+      expect(provider.generate(messages: [{ role: 'user', content: 'hi' }])).to eq('{thinking}reasoning{/thinking}Answer')
     end
 
     it 'yields each chunk to the given block instead of buffering' do
@@ -73,7 +73,7 @@ def content_event(content, done: false)
       )
 
       chunks = []
-      provider.generate(prompt: 'hi') { |chunk| chunks << chunk }
+      provider.generate(messages: [{ role: 'user', content: 'hi' }]) { |chunk| chunks << chunk }
 
       expect(chunks).to eq(['Hello ', 'world'])
     end
@@ -90,13 +90,5 @@ def content_event(content, done: false)
 
       expect(provider.generate(messages: messages)).to eq('ok')
     end
-
-    it 'wraps the prompt: sugar into a single user message' do
-      expect(client).to receive(:chat)
-        .with(hash_including(messages: [{ role: 'user', content: 'hi' }]))
-        .and_yield(content_event('ok'), nil)
-
-      provider.generate(prompt: 'hi')
-    end
   end
 end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
index 4ad8257b7..f25f5b6dd 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
@@ -94,7 +94,7 @@
       provider = build(:provider)
       # Ollama overrides #generate, so test the base class directly
       expect do
-        Dradis::Plugins::Echo::Provider.new.generate(prompt: 'test')
+        Dradis::Plugins::Echo::Provider.new.generate(messages: [{ role: 'user', content: 'test' }])
       end.to raise_error(NotImplementedError)
     end
   end

From 2ccb0123ea3a8bf18bb3297173b2d354cad9d336 Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Fri, 17 Jul 2026 11:49:32 +0100
Subject: [PATCH 53/57] Echo: dedupe cable check and harden interactions
 dispatch

Applies PR #1655 review findings on the retire slice:

- check_turbo_config (#10): interactions_controller now uses the shared
  TurboConfigCheck concern instead of its own Redis-pinging copy, so
  non-Redis adapters no-op silently.
- Blank type (nit): set_record raises RecordNotFound when @type is blank
  so an unknown/missing type returns 404 instead of a 500 from
  send('').pluralize, mirroring SessionsController#set_record.
- set_prompt (nit): scope the preview prompt lookup through .for(@type)
  like sessions#create, honouring the Prompt::SCOPES whitelist.

The conversations N+1 fix (includes(:user) + grouped counts) is carried
up from the views slice and remains applied to interactions#index here.
---
 .../echo/projects/interactions_controller.rb       | 14 ++++----------
 .../plugins/echo/projects/interactions_spec.rb     |  6 ++++++
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
index 22448d791..9078e04c1 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/interactions_controller.rb
@@ -1,6 +1,7 @@
 module Dradis::Plugins::Echo
   class Projects::InteractionsController < AuthenticatedController
     include ProjectScoped
+    include TurboConfigCheck
     layout false
 
     before_action :check_turbo_config, only: [:index]
@@ -19,15 +20,6 @@ def preview; end
 
     private
 
-    def check_turbo_config
-      @turbo_status = begin
-        ActionCable.server.pubsub.redis_connection_for_subscriptions.ping
-        true
-      rescue
-        false
-      end
-    end
-
     def liquid_parse(template)
       assigns = { 'issue' => IssueDrop.new(@record) }
 
@@ -46,10 +38,12 @@ def record_params
     end
 
     def set_prompt
-      @prompt = current_user.prompts.find(params[:id])
+      @prompt = current_user.prompts.for(@type).find(params[:id])
     end
 
     def set_record
+      raise ActiveRecord::RecordNotFound if @type.blank?
+
       @record = current_project.send(@type.to_s.pluralize).find(record_params[:record])
     end
 
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index 85edab513..bb8f23366 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -55,6 +55,12 @@
       # href attributes HTML-escape the query separator (& -> &amp;); match escaped.
       expect(response.body).to include(ERB::Util.html_escape(new_conversation_link))
     end
+
+    it 'raises RecordNotFound (404) rather than a 500 for a missing or unknown type' do
+      expect {
+        get "/addons/echo/projects/#{@project.id}/interactions", params: { record: issue.id }
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
   end
 
   describe 'the retired Roslin one-shot path' do

From 265142e068a39a01bba08a8b6cdd1c2cec91503a Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Wed, 22 Jul 2026 15:49:08 +0100
Subject: [PATCH 54/57] Echo: use do...end for multi-line expect blocks in
 specs

Pre-existing Style/BlockDelimiters offenses across Echo spec files that
would break CI once this stack merges onto develop (where the cop is
enabled). Spec-only, parse-equivalent delimiter change.
---
 .../plugins/echo/projects/interactions_spec.rb       | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index bb8f23366..5aa422320 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -57,23 +57,23 @@
     end
 
     it 'raises RecordNotFound (404) rather than a 500 for a missing or unknown type' do
-      expect {
+      expect do
         get "/addons/echo/projects/#{@project.id}/interactions", params: { record: issue.id }
-      }.to raise_error(ActiveRecord::RecordNotFound)
+      end.to raise_error(ActiveRecord::RecordNotFound)
     end
   end
 
   describe 'the retired Roslin one-shot path' do
     it 'no longer exposes a create route' do
-      expect {
+      expect do
         post "/addons/echo/projects/#{@project.id}/interactions", params: { type: 'issue', record: issue.id }
-      }.to raise_error(ActionController::RoutingError)
+      end.to raise_error(ActionController::RoutingError)
     end
 
     it 'no longer exposes a show route' do
-      expect {
+      expect do
         get "/addons/echo/projects/#{@project.id}/interactions/1", params: { type: 'issue', record: issue.id }
-      }.to raise_error(ActionController::RoutingError)
+      end.to raise_error(ActionController::RoutingError)
     end
   end
 end

From a81150210e84a0cb6f8fccc62ade162c155c1d0e Mon Sep 17 00:00:00 2001
From: Product - Coder <etd-claude@nomejortu.com>
Date: Mon, 3 Aug 2026 15:19:22 +0100
Subject: [PATCH 55/57] de-reference and tighten Echo Sessions code comments

---
 .../projects/sessions/replies_controller.rb   | 10 ++++-----
 .../echo/projects/sessions_controller.rb      | 11 +++++-----
 .../dradis/plugins/echo/session_controller.js | 14 +++++-------
 .../app/models/dradis/plugins/echo/session.rb | 12 +++++-----
 .../echo/issues/_show-content.html.erb        |  6 ++---
 .../echo/projects/interactions/index.html.erb |  2 +-
 .../sessions/_composer_state.html.erb         | 22 ++++++++-----------
 .../sessions/messages/_message.html.erb       | 13 +++++------
 .../echo/projects/sessions/show.html.erb      |  9 ++++----
 .../echo/sessions_conversation_spec.rb        |  7 +++---
 .../dradis/plugins/echo/sessions_spec.rb      |  7 +++---
 .../plugins/echo/broadcast_request_id_spec.rb | 13 +++++------
 .../echo/projects/interactions_spec.rb        | 10 ++++-----
 .../plugins/echo/projects/sessions_spec.rb    | 12 +++++-----
 14 files changed, 63 insertions(+), 85 deletions(-)

diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
index e4cef5c30..210cc4cea 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions/replies_controller.rb
@@ -5,12 +5,10 @@ class Projects::Sessions::RepliesController < AuthenticatedController
     layout false
 
     # Starts generation for a freshly-created session. The session Stimulus
-    # controller POSTs here from `connect`, i.e. after the browser has subscribed
-    # to the SessionsChannel, so the streaming container ReplyJob broadcasts lands
-    # on a listening socket (SEC-506 Bug 4). Guarded by reply_pending? so a
-    # reconnect, a second viewer, or a stray POST on an already-answered session
-    # can never spawn an unsolicited reply — request_reply! only fires while a
-    # reply is genuinely owed.
+    # controller POSTs here from `connect` — after subscribing to the
+    # SessionsChannel — so ReplyJob's streaming container lands on a listening
+    # socket. reply_pending? guards against a reconnect or stray POST spawning an
+    # unsolicited reply on an already-answered session.
     def create
       @session.request_reply! if @session.reply_pending?
       head :ok
diff --git a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
index 4a12c05bc..12e5f2f39 100644
--- a/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
+++ b/engines/dradis-echo/app/controllers/dradis/plugins/echo/projects/sessions_controller.rb
@@ -19,12 +19,11 @@ def show; end
     # lookup through `for(@type)` honours the Prompt::SCOPES whitelist. The first
     # user Message carries the (Liquid-rendered, possibly edited) prompt text.
     #
-    # We deliberately do NOT call request_reply! here: on initial creation the
-    # browser hasn't subscribed to the SessionsChannel yet, so an immediate
-    # generation would broadcast the streaming container before the socket is
-    # listening and the reply would never render live (SEC-506 Bug 4). Instead we
-    # render `show` in the reply_pending? state and let the session Stimulus
-    # controller POST to RepliesController once it has connected.
+    # We deliberately do NOT call request_reply! here: the browser hasn't
+    # subscribed to the SessionsChannel yet, so generating now would broadcast the
+    # streaming container before the socket is listening and never render live.
+    # Instead we render `show` in the reply_pending? state and let the session
+    # Stimulus controller POST to RepliesController once connected.
     def create
       return head :unprocessable_entity if params[:prompt].blank?
 
diff --git a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
index 990586d33..69a04fdd5 100644
--- a/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
+++ b/engines/dradis-echo/app/javascript/controllers/dradis/plugins/echo/session_controller.js
@@ -81,14 +81,12 @@ export default class extends Controller {
     this.element.querySelector("[data-behavior~=echo-send-error]")?.remove()
   }
 
-  // On a freshly-created session the server deliberately did NOT start
-  // generation (SEC-506 Bug 4): had it, ReplyJob's streaming-container broadcast
-  // would have raced ahead of this element's <turbo-cable-stream-source>
-  // subscription and been dropped. Now that we're connected — and thus
-  // subscribed — POST to start the reply, so every chunk lands on a listening
-  // socket. The POST round-trip comfortably outlasts the local subscribe
-  // handshake, and the server re-checks reply_pending? so a reconnect can't
-  // spawn a second reply.
+  // On a freshly-created session the server did NOT start generation: it would
+  // have raced ReplyJob's streaming-container broadcast ahead of this element's
+  // <turbo-cable-stream-source> subscription and dropped it. Now that we're
+  // subscribed, POST to start the reply so every chunk lands on a listening
+  // socket. The server re-checks reply_pending? so a reconnect can't spawn a
+  // second reply.
   #triggerPendingReply() {
     if (!this.replyPendingValue || !this.hasReplyUrlValue) return
 
diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
index 37a6a886b..5d72c2e2a 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/session.rb
@@ -66,13 +66,11 @@ def request_reply!
       ReplyJob.perform_later(self) if enqueue
     end
 
-    # True when a reply is owed but generation hasn't started yet: the session is
-    # idle and the newest message is a user turn. `create` renders `show` in this
-    # state and lets the freshly-subscribed client trigger request_reply!, so the
-    # streaming container is only broadcast once the socket is listening (SEC-506
-    # Bug 4). It flips back to false the moment ReplyJob flips the session to
-    # `generating` or an assistant reply lands, which makes the client trigger
-    # idempotent across reconnects and multiple viewers.
+    # True when a reply is owed but generation hasn't started: the session is idle
+    # and the newest message is a user turn. Lets the freshly-subscribed client
+    # trigger request_reply! so the streaming container is only broadcast once the
+    # socket is listening. Flips to false once ReplyJob sets `generating` or a
+    # reply lands, keeping the client trigger idempotent across reconnects.
     def reply_pending?
       idle? && messages.order(:created_at, :id).last&.user?
     end
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
index b1cf6661a..bf23f8580 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/issues/_show-content.html.erb
@@ -12,10 +12,8 @@
     <h4 class="header-underline mb-3">Dradis Echo</h4>
 
     <%# Native lazy frame: loads interactions#index when the Echo tab becomes %>
-    <%# visible. index.html.erb answers with a matching <turbo-frame>, so the %>
-    <%# initial load, prompt->show and back->index all Turbo-frame-match the same %>
-    <%# frame id (SEC-506: a data-behavior=fetch inner-HTML inject left the frame %>
-    <%# empty, so a native back-navigation to index found no frame to match). %>
+    <%# visible. index.html.erb answers with a matching <turbo-frame>, so initial %>
+    <%# load, prompt->show and back->index all Turbo-frame-match the same id. %>
     <turbo-frame id="<%= dom_id(@issue, :echo) %>"
                  src="<%= echo.project_interactions_path(current_project, type: :issue, record: @issue.id) %>"
                  loading="lazy">
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
index fb3a8e9d7..d6a369803 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/interactions/index.html.erb
@@ -1,6 +1,6 @@
 <%# Wrapped in the record's Echo frame so this response Turbo-frame-matches the %>
 <%# native lazy frame in issues/_show-content.html.erb and the back-link in %>
-<%# sessions/show.html.erb (both navigate dom_id(@record, :echo)) — SEC-506. %>
+<%# sessions/show.html.erb (both navigate dom_id(@record, :echo)). %>
 <turbo-frame id="<%= dom_id(@record, :echo) %>">
 <% unless @turbo_status %>
   <div class="alert alert-danger">
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
index 9013483ab..e0f71fedb 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/_composer_state.html.erb
@@ -1,17 +1,13 @@
 <%# locals: (session:, request_id: nil) -%>
-<%# request_id is accepted-and-ignored: turbo-rails injects request_id into every %>
-<%# broadcast partial's locals (broadcastable.rb:503); non-nil in-request, so strict %>
-<%# locals must tolerate it or broadcast_composer_state 500s (SEC-506 Bug 1). %>
-<%# Broadcast on every idle<->generating transition (Session#broadcast_composer_state). %>
-<%# Route-free and locals-only so it renders from ReplyJob. Carries the Send button %>
-<%# and the multiplayer hint; the session_controller reads data-generating to keep %>
-<%# the textarea disabled in step with the (server-rendered) button. %>
-<%# Lock on generating? OR reply_pending?: a freshly-created session is idle with a %>
-<%# reply owed, and the composer_state replace that flips it to generating races the %>
-<%# client's still-in-flight subscribe, so on a slow box that broadcast is dropped and %>
-<%# the button would stay enabled until a full re-render. Folding reply_pending? in %>
-<%# server-renders the initial lock with zero dependency on that racy broadcast; %>
-<%# subsequent transitions (by then subscribed) are still driven by broadcasts (SEC-515). %>
+<%# request_id is accepted-and-ignored: turbo-rails injects it into every broadcast %>
+<%# partial's locals (non-nil in-request), so strict locals must tolerate it or %>
+<%# broadcast_composer_state 500s. Route-free and locals-only so it renders from %>
+<%# ReplyJob on every idle<->generating transition; session_controller reads %>
+<%# data-generating to keep the textarea in step with the server-rendered button. %>
+<%# Lock on generating? OR reply_pending?: the composer_state replace that flips a %>
+<%# freshly-created session to generating can race the client's in-flight subscribe %>
+<%# and be dropped; folding reply_pending? in server-renders the initial lock without %>
+<%# depending on that broadcast. Later transitions are subscribed and broadcast-driven. %>
 <% locked = session.generating? || session.reply_pending? %>
 <%= tag.div id: dom_id(session, :composer_state),
       data: { behavior: 'echo-composer-state', generating: locked } do %>
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
index c6b2fff08..6dc311303 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/messages/_message.html.erb
@@ -1,12 +1,9 @@
 <%# locals: (message:, request_id: nil) -%>
-<%# request_id is accepted-and-ignored: turbo-rails 2.0.4 broadcastable.rb:503 %>
-<%# reverse_merges request_id: Turbo.current_request_id into every broadcast %>
-<%# partial's locals. It's non-nil in a real request (RequestId middleware) and %>
-<%# .compact'd away in a job/rack_test, so strict locals must tolerate it or the %>
-<%# in-request broadcast_created 500s with StrictLocalsError (SEC-506 Bug 1). %>
-<%# Restyled per the accepted UX design (SEC-476). Renders from `render partial:` %>
-<%# with only `message:` in locals, so no controller-context helpers here. Author %>
-<%# line is keyed off `role`, never off user presence. %>
+<%# request_id is accepted-and-ignored: turbo-rails injects it into every broadcast %>
+<%# partial's locals (non-nil in a real request), so strict locals must tolerate it %>
+<%# or the in-request broadcast_created 500s with StrictLocalsError. Renders from %>
+<%# `render partial:` with only `message:` in locals, so no controller-context %>
+<%# helpers here. Author line is keyed off `role`, never off user presence. %>
 <% assistant = message.assistant? %>
 <%= tag.div id: dom_id(message),
       class: ['echo-message', assistant ? 'echo-message-assistant' : 'echo-message-user',
diff --git a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
index a7156a3d2..4afb8c0d9 100644
--- a/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
+++ b/engines/dradis-echo/app/views/dradis/plugins/echo/projects/sessions/show.html.erb
@@ -17,11 +17,10 @@
       <%= turbo_stream_from [@session, :composer_state], channel: Dradis::Plugins::Echo::SessionsChannel %>
 
       <%# reply-pending / reply-url drive the client-side generation trigger: on a %>
-      <%# freshly-created session (reply_pending?), the session controller POSTs to %>
-      <%# this reply URL from `connect`, i.e. after the SessionsChannel subscription %>
-      <%# is established, so ReplyJob's streaming container isn't broadcast before the %>
-      <%# socket is listening (SEC-506 Bug 4). Revisiting an answered session renders %>
-      <%# reply-pending=false, so no spurious generation is triggered. %>
+      <%# freshly-created session the controller POSTs this reply URL from `connect`, %>
+      <%# after subscribing to the SessionsChannel, so the streaming container isn't %>
+      <%# broadcast before the socket is listening. An answered session renders %>
+      <%# reply-pending=false, so no spurious generation fires. %>
       <div class="echo-conversation" data-controller="dradis--plugins--echo--session"
            data-dradis--plugins--echo--session-reply-url-value="<%= echo.project_session_reply_path(current_project, @session) %>"
            data-dradis--plugins--echo--session-reply-pending-value="<%= @session.reply_pending? %>">
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
index b22baec67..cd3bffe9f 100644
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_conversation_spec.rb
@@ -2,10 +2,9 @@
 
 Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
 
-# SEC-506 live-browser acceptance for the Echo Sessions conversation UI. These are
-# the flows the rack_test request specs structurally cannot exercise (the documented
-# live-JS/Turbo gap): the Bootstrap tab-show that triggers the native lazy frame, and
-# the Turbo-frame back-navigation between sessions#show and interactions#index.
+# Live-browser acceptance for the Echo Sessions conversation UI: the flows rack_test
+# request specs can't exercise — the Bootstrap tab-show that triggers the native lazy
+# frame, and Turbo-frame back-navigation between sessions#show and interactions#index.
 describe 'Echo Sessions conversation UI', js: true do
   before { login_to_project_as_user }
 
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
index 3174548c5..201a53669 100644
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
@@ -42,10 +42,9 @@
     )
   end
 
-  # Generation is now started by the session Stimulus controller once it has
-  # subscribed, not by sessions#create — otherwise ReplyJob's streaming container
-  # broadcasts before the socket is listening (SEC-506 Bug 4). rack_test has no
-  # JS, so drive that reply-trigger POST explicitly and run the job inline.
+  # Generation is started by the session Stimulus controller once subscribed, not
+  # by sessions#create. rack_test has no JS, so drive that reply-trigger POST
+  # explicitly and run the job inline.
   def start_session
     visit echo.preview_project_interaction_path(@project.id, prompt.id, type: 'issue', record: issue.id)
     click_button 'Start with this prompt'
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
index 8472cf2ba..23b92d206 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/broadcast_request_id_spec.rb
@@ -2,13 +2,12 @@
 
 Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
 
-# SEC-506 Bug 1/2 regression: turbo-rails 2.0.4 broadcastable.rb:503 reverse_merges
-# `request_id: Turbo.current_request_id` into every broadcast partial's locals. In a
-# real request the RequestId middleware sets a non-nil id, so it reaches the partial;
-# in a job / rack_test it's nil and .compact drops it. Both Echo broadcast-target
-# partials use strict locals, so unless they tolerate `request_id`, the broadcasts
-# that fire *inside SessionsController#create* (Message#broadcast_created and, via
-# request_reply!, Session#broadcast_composer_state) raise StrictLocalsError → 500.
+# Regression: turbo-rails reverse_merges `request_id: Turbo.current_request_id` into
+# every broadcast partial's locals — non-nil in a real request, dropped in a
+# job/rack_test. Both Echo broadcast-target partials use strict locals, so unless they
+# tolerate `request_id`, the broadcasts that fire inside SessionsController#create
+# (Message#broadcast_created and Session#broadcast_composer_state) raise
+# StrictLocalsError → 500.
 #
 # A plain request spec can't catch this (nil request_id), which is why it slipped
 # through. We force a non-nil id with Turbo.with_request_id so the render exercises
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index 5aa422320..d0d8e7e84 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -2,12 +2,10 @@
 
 Dir[Dradis::Plugins::Echo::Engine.root.join('spec/factories/*.rb')].sort.each { |f| require f }
 
-# Regression coverage for SEC-506 Bug 3: the Echo tab loads interactions#index
-# into a native <turbo-frame id="echo_issue_<id>">, and the session's "+ New"
-# link navigates that same frame back to interactions#index. If index answers
-# frameless, Turbo reports "the response did not contain the expected
-# <turbo-frame>" and the tab shows "Content missing". So the index response must
-# carry the record's Echo frame verbatim.
+# Regression: the Echo tab loads interactions#index into a native
+# <turbo-frame id="echo_issue_<id>">, and the "+ New" link navigates that same
+# frame back. If index answers frameless, Turbo reports "Content missing", so the
+# index response must carry the record's Echo frame verbatim.
 describe 'Echo interactions' do
   let(:user) { create(:user) }
 
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 07c5c5f77..3095383e5 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -40,9 +40,9 @@
       end.to change(Dradis::Plugins::Echo::Session, :count).by(1)
         .and change(Dradis::Plugins::Echo::Message, :count).by(1)
 
-      # The reply is triggered by the session Stimulus controller once it has
-      # subscribed, not by create — otherwise the streaming container broadcasts
-      # before the socket is listening and never renders live (SEC-506 Bug 4).
+      # The reply is triggered by the session Stimulus controller once subscribed,
+      # not by create — otherwise the streaming container broadcasts before the
+      # socket is listening and never renders live.
       expect(Dradis::Plugins::Echo::ReplyJob).not_to have_been_enqueued
 
       session = Dradis::Plugins::Echo::Session.last
@@ -100,9 +100,9 @@
   describe 'GET /addons/echo/projects/:project_id/sessions/:id' do
     # The initial Send-button lock is server-rendered off generating? OR
     # reply_pending?, so a freshly-created (idle, reply-owed) session comes back
-    # disabled with zero dependency on the composer_state broadcast that races
-    # the client's subscribe on a slow box (SEC-515). A subscribe race can't be
-    # reproduced in rack_test, so we assert the server-rendered invariant.
+    # disabled without depending on the composer_state broadcast that races the
+    # client's subscribe. That race can't be reproduced in rack_test, so we assert
+    # the server-rendered invariant.
     def composer_state
       Nokogiri::HTML(response.body).at_css('[data-behavior="echo-composer-state"]')
     end

From 6a5af5fc71c8fbd35675b089f73e54778f20f74e Mon Sep 17 00:00:00 2001
From: Aaron <mail@aapomm.io>
Date: Tue, 4 Aug 2026 18:02:26 +0800
Subject: [PATCH 56/57] Remove /messages path from the anthropic provider

---
 .../app/models/dradis/plugins/echo/provider/anthropic.rb | 4 ++--
 engines/dradis-echo/spec/factories/providers.rb          | 2 +-
 .../dradis/plugins/echo/provider/anthropic_spec.rb       | 9 +++++----
 .../dradis/plugins/echo/provider/http_streaming_spec.rb  | 2 +-
 .../spec/models/dradis/plugins/echo/provider_spec.rb     | 2 +-
 5 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
index f0708a1a2..c714299f3 100644
--- a/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
+++ b/engines/dradis-echo/app/models/dradis/plugins/echo/provider/anthropic.rb
@@ -3,7 +3,7 @@ class Provider::Anthropic < Provider
     include Provider::HttpStreaming
 
     API_VERSION = '2023-06-01'.freeze
-    DEFAULT_ADDRESS = 'https://api.anthropic.com/v1/messages'.freeze
+    DEFAULT_ADDRESS = 'https://api.anthropic.com/v1'.freeze
     DEFAULT_MAX_TOKENS = 4096
     DEFAULT_MODEL = 'claude-sonnet-4-6'.freeze
 
@@ -26,7 +26,7 @@ def build_headers
     end
 
     def build_uri(_model)
-      URI(address)
+      URI("#{address}/messages")
     end
 
     # Anthropic sends several SSE event types; only content_block_delta carries text:
diff --git a/engines/dradis-echo/spec/factories/providers.rb b/engines/dradis-echo/spec/factories/providers.rb
index ffa57ab9e..abc77e069 100644
--- a/engines/dradis-echo/spec/factories/providers.rb
+++ b/engines/dradis-echo/spec/factories/providers.rb
@@ -5,7 +5,7 @@
     model { 'qwen2.5:14b' }
 
     factory :anthropic_provider, class: 'Dradis::Plugins::Echo::Provider::Anthropic' do
-      address { 'https://api.anthropic.com/v1/messages' }
+      address { 'https://api.anthropic.com/v1' }
       api_key { 'sk-ant-test' }
       model { 'claude-sonnet-4-6' }
     end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
index 41f08117e..2643cd631 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/anthropic_spec.rb
@@ -12,12 +12,13 @@
   end
 
   describe '#build_uri' do
-    it 'returns the configured address' do
-      expect(provider.send(:build_uri, 'claude-sonnet-4-6').to_s).to eq(described_class::DEFAULT_ADDRESS)
+    it 'appends /messages to the configured address' do
+      expect(provider.send(:build_uri, 'claude-sonnet-4-6').to_s)
+        .to eq("#{described_class::DEFAULT_ADDRESS}/messages")
     end
 
-    it 'uses a custom address when set' do
-      provider.address = 'https://anthropic.proxy.example.com/v1/messages'
+    it 'appends /messages to a custom address when set' do
+      provider.address = 'https://anthropic.proxy.example.com/v1'
       expect(provider.send(:build_uri, 'claude-sonnet-4-6').to_s)
         .to eq('https://anthropic.proxy.example.com/v1/messages')
     end
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
index a14af2e5c..a5bc45518 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider/http_streaming_spec.rb
@@ -3,7 +3,7 @@
 describe Dradis::Plugins::Echo::Provider::HttpStreaming do
   let(:provider) do
     Dradis::Plugins::Echo::Provider::Anthropic.new(
-      address: 'https://api.anthropic.com/v1/messages',
+      address: 'https://api.anthropic.com/v1',
       api_key: 'sk-ant-test',
       model: 'claude-sonnet-4-6',
       name: 'Test'
diff --git a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
index f25f5b6dd..390ce0cc5 100644
--- a/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
+++ b/engines/dradis-echo/spec/models/dradis/plugins/echo/provider_spec.rb
@@ -59,7 +59,7 @@
     it 'returns the default for each subclass' do
       expect(described_class::Ollama.default_address).to eq('http://localhost:11434')
       expect(described_class::OpenAI.default_address).to eq('https://api.openai.com/v1')
-      expect(described_class::Anthropic.default_address).to eq('https://api.anthropic.com/v1/messages')
+      expect(described_class::Anthropic.default_address).to eq('https://api.anthropic.com/v1')
       expect(described_class::Gemini.default_address).to include('generativelanguage.googleapis.com')
     end
   end

From 9184e95fb8e8c68cf6ffe363cb4e3576e52328af Mon Sep 17 00:00:00 2001
From: caitmich <caitlinhenry.ss@gmail.com>
Date: Tue, 4 Aug 2026 13:56:42 -0400
Subject: [PATCH 57/57] Echo: use real projects in specs so Pro's CE sync
 passes

---
 .../channels/dradis/plugins/echo/sessions_channel_spec.rb  | 5 ++++-
 .../spec/features/dradis/plugins/echo/sessions_spec.rb     | 5 ++---
 .../dradis/plugins/echo/projects/interactions_spec.rb      | 7 +------
 .../dradis/plugins/echo/projects/sessions/messages_spec.rb | 7 ++-----
 .../dradis/plugins/echo/projects/sessions/replies_spec.rb  | 7 ++-----
 .../requests/dradis/plugins/echo/projects/sessions_spec.rb | 7 ++-----
 6 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
index b33227e7f..116e415c7 100644
--- a/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
+++ b/engines/dradis-echo/spec/channels/dradis/plugins/echo/sessions_channel_spec.rb
@@ -10,7 +10,10 @@
   let(:signed_name) { Turbo::StreamsChannel.signed_stream_name([session, :messages]) }
   let(:stream_name) { Turbo::StreamsChannel.verified_stream_name(signed_name) }
 
-  before { stub_connection(current_user: user) }
+  before do
+    session.project.assign_owner(user)
+    stub_connection(current_user: user)
+  end
 
   it 'accepts the subscription and streams the transcript for an authorized user' do
     subscribe(signed_stream_name: signed_name)
diff --git a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
index 201a53669..b9127b9ac 100644
--- a/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
+++ b/engines/dradis-echo/spec/features/dradis/plugins/echo/sessions_spec.rb
@@ -11,11 +11,10 @@
 describe 'Echo sessions' do
   include ActiveJob::TestHelper
 
-  let(:user) { create(:user) }
+  let(:user) { @logged_in_as }
 
   before do
-    login_as_user(user)
-    @project = Project.new
+    login_to_project_as_user
 
     # Capture the context handed to the provider each turn so we can assert the
     # follow-up carried the full history forward.
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
index d0d8e7e84..cfac734a9 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/interactions_spec.rb
@@ -7,12 +7,7 @@
 # frame back. If index answers frameless, Turbo reports "Content missing", so the
 # index response must carry the record's Echo frame verbatim.
 describe 'Echo interactions' do
-  let(:user) { create(:user) }
-
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
+  before { login_to_project_as_user }
 
   let!(:roslin) do
     Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
index cca74a084..bedb00e95 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/messages_spec.rb
@@ -5,12 +5,9 @@
 describe 'Echo session messages' do
   include ActiveJob::TestHelper
 
-  let(:user) { create(:user) }
+  let(:user) { @logged_in_as }
 
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
+  before { login_to_project_as_user }
 
   let(:agent) { create(:agent, enabled: true) }
   let(:issue) { create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi") }
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
index f8ed626eb..be5b50a44 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions/replies_spec.rb
@@ -5,12 +5,9 @@
 describe 'Echo session replies' do
   include ActiveJob::TestHelper
 
-  let(:user) { create(:user) }
+  let(:user) { @logged_in_as }
 
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
+  before { login_to_project_as_user }
 
   let(:agent) { create(:agent, enabled: true) }
   let(:issue) { create(:issue, node: @project.issue_library, text: "#[Title]#\nSQLi") }
diff --git a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
index 3095383e5..d3cef1eb3 100644
--- a/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
+++ b/engines/dradis-echo/spec/requests/dradis/plugins/echo/projects/sessions_spec.rb
@@ -5,12 +5,9 @@
 describe 'Echo sessions' do
   include ActiveJob::TestHelper
 
-  let(:user) { create(:user) }
+  let(:user) { @logged_in_as }
 
-  before do
-    login_as_user(user)
-    @project = Project.new
-  end
+  before { login_to_project_as_user }
 
   let!(:roslin) do
     Dradis::Plugins::Echo::Agents::Roslin.provision!.tap { |agent| agent.update!(enabled: true) }