feat(decopilot): in-UI message queue (surface + cancel) + externalize attachments at POST

[tlgimenes]

Summary

Two related changes that give users control over a thread's pending message queue and stop bloating the durable workflow record.

1. In-UI message queue (surface + cancel)

A thread's messages run one-at-a-time behind a per-thread DBOS thread-gate workflow (partition concurrency = 1). When a deploy strands the head gate PENDING on a dead executor/version, it permanently holds the partition slot and every later message sits ENQUEUED forever ("accepted and queued"), with no UI recourse. This moves that recovery into the user's hands:

• GET /:org/decopilot/queue/:threadId — lists the thread's pending gate workflows (running head + queued tail) with each message's text.
• POST /:org/decopilot/queue/:threadId/cancel/:workflowId — cancels one item; a running head also runs the full run-cancel teardown.
• Stop button now also frees a stranded PENDING gate head (today an orphaned gate ignores the in-memory run cancel).
• Queue panel above the composer lists pending messages and cancels them per-item.

The queue is read from dbos.workflow_status via DBOS.listWorkflows (the workflow_queue table is empty in this DBOS version). Authz is owner-only (validateThreadOwnership) plus a thread-run:{threadId}: prefix guard — a direct clone of the existing bgtool: cancel pattern.

2. Externalize attachments at POST

The existing uploadFileParts materializer (base64 data: → short mesh-storage: refs) ran only at dispatch — so the raw blobs were already serialized into the DBOS workflow input at POST. It now also runs at POST, bounding dbos.workflow_status.inputs. A pure idempotency guard keeps the still-present dispatch-time call from double-annotating; computeIdempotencyKey stays computed from the original messages so the workflowID is stable.

Testing

• Unit: 11/11 pass — pure mappers (thread-gate-queue.test.ts) + the attachment idempotency guard (file-materializer.test.ts, TDD).
• Typecheck/lint: clean for changed files (one pre-existing, unrelated AJV dual-version error in packages/mcp-utils exists at the merge base).
• E2E: packages/e2e/tests/decopilot-thread-queue.spec.ts is authored and typechecks but was not executed locally (needs Postgres + NATS + dev server). CI is the first real run — see follow-ups.

Reviewed

Per-task reviews + a final whole-branch review (no Critical/Important blockers; the attachment idempotency path and cancel-teardown preservation were traced and verified).

Follow-ups (deferred, flagged in code)

• e2e hardening (first CI run may surface these): (a) the 403 test currently proves a non-member is rejected — add a non-owner member case for the real ownership boundary; (b) confirm connectDevDb and the e2e app server share one DATABASE_URL (else dbos.* asserts pass vacuously); (c) confirm the {"json":[ctx]} seed envelope parses via DBOS.listWorkflows({loadInput:true}) in SDK 4.21.6.
• Larger storage redesign (separate PR): persist the user message to thread_messages at POST and pass only a reference into the workflow, with tombstone-on-cancel — making the queue list read thread_messages and shrinking the DBOS input to a pointer. This PR's list endpoint is intentionally source-swappable for that.

🤖 Generated with Claude Code

---

Summary by cubic

Adds an in-UI message queue for Decopilot threads with per-item cancel and “send while running” support; Stop also frees a stuck gate head. Attachments are externalized at POST so dbos.workflow_status.inputs stays small.

• New Features

  • GET /:org/decopilot/queue/:threadId returns the thread’s running head and queued tail from DBOS.listWorkflows; the UI shows only waiting items (excludes the active head).
  • POST /:org/decopilot/queue/:threadId/cancel/:workflowId cancels a queue item; if it’s the running head, it runs the full stop teardown. The Stop button now also cancels a stranded PENDING gate head to unblock the queue.
  • UI: a queue panel above the composer lists queued messages with per-item cancel and refreshes via SSE; the composer stays enabled mid-run, and sending enqueues behind the current turn (no optimistic body render).

• Performance

  • Run uploadFileParts at POST to convert data: blobs to mesh-storage: refs; idempotent via an annotation check and keeps the workflowID stable.

^{Written for commit bba7ddb. Summary will update on new commits.}