feat: stable app-user identity across api-key rotation + workspace/chat UX

Identity:
- app_users (end-users provisioned via api_key) are now keyed on the api_key's
  OWNER account, not the api_key id. SwitchToAppUser passes ident.UserID (the
  owner, pre-switch) so the calling app can rotate/replace its api_key — a new
  key row under the same account — without orphaning the end-user's sessions /
  files / agents. Covers the X-Fastclaw-End-User header, the OpenAI `user`
  field, and POST /v1/users (all route through SwitchToAppUser). The inbound
  IM path was already owner-scoped. Collision-safe, idempotent, non-fatal
  migration re-keys existing api_key-minted app_users onto their owner.

Workspace / chat UI:
- Resizable 3-pane layout: the platform sidebar is now drag-resizable (rail =
  drag to resize / click to toggle, persisted, clamped); the workspace panel
  caps at 70% of its container so expanding the sidebar auto-shrinks it and the
  page never scrolls horizontally; opens at a comfortable width.
- File viewer: Files tab is a tree + inline viewer split (no modal); tree
  default-expands one level; clicking a file shows highlighted SOURCE by
  default, full-bleed, no card / copy / download chrome; "open in new tab" by
  the close button; collapsible tree.
- Non-binary files (.env, Dockerfile, .sql, extension-less, unknown) render as
  text instead of a download prompt; only genuine binaries offer download.
- Reset the viewer's file + content on conversation switch (no stale preview).
- Preview tab only shown for coding projects with a live dev server.
- Assistant messages use the full lane width on narrow panels; composer aligns
  with the message rows (scrollbar gutter).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: idoubi

internal/auth/auth.go

@@ -252,20 +252,28 @@ func (r *Resolver) ResolveBearer(ctx context.Context, token string) (Identity, e
 	}, nil
 }
 
-// SwitchToAppUser rebinds ident to the app_user associated with
-// (ident.APIKeyID, externalID), minting that row the first time it's
-// seen. APIKeyID + APIKeyAgents are preserved — only UserID and Role
-// flip — so the apikey's agent ACL still gates access. Pass through
-// empty externalID untouched. Only valid for AuthMethod=="apikey";
-// session callers stay as-is.
+// SwitchToAppUser rebinds ident to the app_user for (owner account,
+// externalID), minting that row the first time it's seen. The app_user is
+// keyed on the api_key's OWNER account — NOT the api_key id — so the calling
+// app can rotate/replace its api_key without orphaning the end-user. APIKeyID
+// + APIKeyAgents are preserved (only UserID + Role flip) so the apikey's agent
+// ACL still gates access. Empty externalID passes through untouched. Only
+// valid for AuthMethod=="apikey"; session callers stay as-is.
 func (r *Resolver) SwitchToAppUser(ctx context.Context, ident Identity, externalID string) (Identity, error) {
 	if externalID == "" {
 		return ident, nil
 	}
 	if ident.AuthMethod != "apikey" || ident.APIKeyID == "" {
 		return ident, errors.New("auth.SwitchToAppUser: api_key auth required")
 	}
-	acc, err := r.accounts.EnsureAppUser(ctx, ident.APIKeyID, externalID, "")
+	// Already an app_user (request switched once) — re-keying off the
+	// app_user's own id would mint a nested user. No-op instead.
+	if ident.Role == users.RoleAppUser {
+		return ident, nil
+	}
+	// ident.UserID is the api_key's owner account here (pre-switch); key the
+	// app_user on it so rotating/replacing the api_key keeps the same user.
+	acc, err := r.accounts.EnsureAppUser(ctx, ident.UserID, externalID, "")
 	if err != nil {
 		return ident, err
 	}

internal/store/database.go

@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"log/slog"
 	"strings"
 	"time"
 
@@ -793,6 +794,32 @@ func (d *DBStore) migrateUsersAppUserCols(ctx context.Context) error {
 			WHERE apikey_id <> '' AND external_id <> ''`); err != nil {
 		return fmt.Errorf("create idx_users_apikey_external: %w", err)
 	}
+
+	// One-time, collision-safe re-key: app_users minted under the OLD scheme
+	// stored the api_key id as their mint scope, which orphans the end-user
+	// when the calling app rotates/replaces that key. Re-key them onto the
+	// api_key's OWNER account so identity survives key rotation. Only rows
+	// whose apikey_id still resolves to a real api_key are remapped; rows that
+	// would collide with an already-owner-keyed sibling (same owner +
+	// external_id) are skipped. Idempotent: once apikey_id holds a "u_…" owner
+	// it no longer matches any apikeys.id ("k_…"), so reruns touch nothing.
+	// Non-fatal: a rare unrecoverable collision (two legacy keys, same owner,
+	// same external_id) is logged and left for manual reconciliation rather
+	// than blocking startup.
+	if _, err := d.db.ExecContext(ctx, `
+		UPDATE users SET apikey_id = (SELECT a.user_id FROM apikeys a WHERE a.id = users.apikey_id)
+		WHERE role = 'app_user'
+		  AND apikey_id <> ''
+		  AND apikey_id IN (SELECT id FROM apikeys)
+		  AND NOT EXISTS (
+		    SELECT 1 FROM users u2
+		    WHERE u2.id <> users.id
+		      AND u2.role = 'app_user'
+		      AND u2.external_id = users.external_id
+		      AND u2.apikey_id = (SELECT a.user_id FROM apikeys a WHERE a.id = users.apikey_id)
+		  )`); err != nil {
+		slog.Warn("migrate: backfill app_user owner scope failed (non-fatal)", "error", err)
+	}
 	return nil
 }
 

internal/users/account.go

@@ -329,22 +329,27 @@ func (a *Accounts) SetPassword(ctx context.Context, id, newPassword string) erro
 	return a.store.UpdateUser(ctx, rec)
 }
 
-// EnsureAppUser returns the fastclaw user representing (apikeyID, externalID),
+// EnsureAppUser returns the fastclaw user representing (scopeNS, externalID),
 // creating one with role=app_user the first time it's seen. Idempotent:
-// later calls with the same pair return the existing row. The caller is
-// expected to be the api_key owner — Mint does not authenticate, that's
-// the auth middleware's job. Username/email are synthesized from the
-// pair and namespaced ("ext:<apikeyID>:<externalID>") so they don't
-// collide with real human signups but still satisfy the UNIQUE
-// constraints on those columns.
-func (a *Accounts) EnsureAppUser(ctx context.Context, apikeyID, externalID, displayName string) (*Account, error) {
-	apikeyID = strings.TrimSpace(apikeyID)
+// later calls with the same pair return the existing row.
+//
+// scopeNS is the STABLE namespace the external id is unique within — the
+// api_key OWNER account for the REST/OpenAI path (so the calling app can
+// rotate its api_key freely), or a channel namespace for inbound IM. It is
+// deliberately NOT the api_key id. Stored in the users.apikey_id column,
+// which is really a generic mint-scope slot.
+//
+// Username/email are synthesized from the pair and namespaced
+// ("ext:<scopeNS>:<externalID>") so they don't collide with real human
+// signups but still satisfy the UNIQUE constraints on those columns.
+func (a *Accounts) EnsureAppUser(ctx context.Context, scopeNS, externalID, displayName string) (*Account, error) {
+	scopeNS = strings.TrimSpace(scopeNS)
 	externalID = strings.TrimSpace(externalID)
-	if apikeyID == "" || externalID == "" {
-		return nil, errors.New("users.EnsureAppUser: apikeyID and externalID are required")
+	if scopeNS == "" || externalID == "" {
+		return nil, errors.New("users.EnsureAppUser: scopeNS and externalID are required")
 	}
 	// Fast path — already provisioned.
-	if rec, err := a.store.GetUserByExternal(ctx, apikeyID, externalID); err == nil {
+	if rec, err := a.store.GetUserByExternal(ctx, scopeNS, externalID); err == nil {
 		return toAccount(rec), nil
 	} else if !errors.Is(err, store.ErrNotFound) {
 		return nil, err
@@ -356,7 +361,7 @@ func (a *Accounts) EnsureAppUser(ctx context.Context, apikeyID, externalID, disp
 	// Synthesize unique username/email tokens. The downstream app
 	// is the source of truth for the human-readable identity; we
 	// only need *something* unique to satisfy the schema.
-	syn := apikeyID + ":" + externalID
+	syn := scopeNS + ":" + externalID
 	rec := &store.UserRecord{
 		ID:           id,
 		Username:     "ext:" + syn,
@@ -365,7 +370,7 @@ func (a *Accounts) EnsureAppUser(ctx context.Context, apikeyID, externalID, disp
 		DisplayName:  displayName,
 		Role:         RoleAppUser,
 		Status:       StatusActive,
-		APIKeyID:     apikeyID,
+		APIKeyID:     scopeNS,
 		ExternalID:   externalID,
 		AgentQuota:   -1,
 	}
@@ -374,7 +379,7 @@ func (a *Accounts) EnsureAppUser(ctx context.Context, apikeyID, externalID, disp
 		// between our GetUserByExternal and CreateUser. Re-read
 		// and return that row instead of bubbling the unique
 		// violation up to the caller.
-		if again, qerr := a.store.GetUserByExternal(ctx, apikeyID, externalID); qerr == nil {
+		if again, qerr := a.store.GetUserByExternal(ctx, scopeNS, externalID); qerr == nil {
 			return toAccount(again), nil
 		}
 		return nil, err

web/src/app/globals.css

@@ -290,6 +290,17 @@ html.theme-transition *::after {
   .chat-md [data-streamdown="code-block"] {
     @apply !border-0 !bg-transparent !p-0 !rounded-none !min-w-0 !max-w-full !overflow-x-auto relative;
   }
+
+  /* File-viewer (bareCode) mode: no copy pill, no card border/padding — the
+     source fills the pane edge-to-edge (line numbers are the only gutter). */
+  .chat-md-bare [data-streamdown="code-block-actions"],
+  .chat-md-bare [data-streamdown="code-block-header"] { @apply !hidden; }
+  .chat-md-bare [data-streamdown="code-block"],
+  .chat-md-bare [data-streamdown="code-block"] > div,
+  .chat-md-bare [data-streamdown="code-block"] pre,
+  .chat-md-bare [data-streamdown="code-block"] code {
+    @apply !border-0 !bg-transparent !rounded-none !p-0 !m-0;
+  }
   .chat-md [data-streamdown="code-block"] pre { @apply !max-w-full !min-w-0 !overflow-x-auto; }
   .chat-md [data-streamdown="code-block"] > div { @apply !min-w-0 !max-w-full; }
   .chat-md [data-streamdown="code-block-header"] { @apply !hidden; }

web/src/components/chat-markdown.tsx

@@ -74,10 +74,14 @@ export function ChatMarkdown({
   text,
   agentId,
   sessionId,
+  bareCode = false,
 }: {
   text: string;
   agentId?: string;
   sessionId?: string;
+  // File-viewer mode: hide the floating copy pill on code blocks (the .chat-md
+  // strip already removes the card) so a source file reads as plain code.
+  bareCode?: boolean;
 }) {
   // Build the URL transform once per agent/session. A stable identity keeps
   // Streamdown (a memo component) from re-rendering on every streamed keystroke,
@@ -119,7 +123,7 @@ export function ChatMarkdown({
   }
 
   return (
-    <div className={PROSE_CLASS} onClick={onMermaidClick} onWheelCapture={onWheelCapture}>
+    <div className={bareCode ? PROSE_CLASS + " chat-md-bare" : PROSE_CLASS} onClick={onMermaidClick} onWheelCapture={onWheelCapture}>
       <Streamdown
         parseIncompleteMarkdown
         plugins={streamdownPlugins}