feat(studio): assistant UI polish — Send/Stop, empty state, two-line cards

.changeset/cms-streaming-chat.md

@@ -0,0 +1,9 @@
+---
+"@mdcms/studio": minor
+---
+
+Add streaming + markdown rendering to the chat surface client APIs.
+
+- `StudioAiRouteApi.chatMessageStream(input)` opens an SSE connection against `POST /api/v1/ai/chat/messages/stream` and returns an `AsyncIterable<StudioAiChatStreamEvent>` that yields `text-delta`, `done`, and `error` events as the model produces them.
+- New `StudioAiChatStreamEvent` discriminated-union export covers the wire-shape of each SSE event the client can observe.
+- New runtime dependency on `streamdown` (v2.5.0). The chat panel now uses it under the hood to render assistant prose as markdown — headings, fenced code (shiki highlighting), GFM tables, task lists, links, etc. Streaming-aware: `parseIncompleteMarkdown` keeps mid-stream chunks from leaking unclosed `**`/```` fences while a token batch is in flight.

.dockerignore

@@ -4,6 +4,8 @@
 .nx
 .vscode
 .DS_Store
+.claude
+.worktrees
 node_modules
 **/node_modules
 dist

.nxignore

@@ -0,0 +1,6 @@
+# Local git worktrees and CLI scratch dirs live under .claude/ and don't
+# represent real workspace projects. Without this Nx walks into the
+# worktrees, discovers their package.json files as additional projects,
+# and demands matching `references` entries in the root tsconfig.json.
+.claude/
+.worktrees/

apps/server/src/bin/http-server.ts

@@ -9,6 +9,11 @@ type BunRuntime = {
   serve: (options: {
     port: number;
     fetch: (request: Request) => Response | Promise<Response>;
+    /** Per-connection idle timeout in seconds. Bun defaults to 10s, which
+     * is far too short for SSE chat streams that sit awaiting the next
+     * token from the LLM — we set it to Bun's maximum (255s) so any
+     * realistic generation completes before the socket gets closed. */
+    idleTimeout?: number;
   }) => BunServer;
 };
 
@@ -22,6 +27,7 @@ const { handler } = await prepareServerRequestHandlerWithModules({
 const server = Bun.serve({
   port: env.PORT,
   fetch: handler,
+  idleTimeout: 255,
 });
 
 let isShuttingDown = false;

apps/server/src/lib/runtime-with-modules.ts

@@ -416,7 +416,12 @@ export function createServerRequestHandlerWithModules(
     },
     requireCsrf: (request) => authService.requireCsrfProtection(request),
     emitAudit: (record) => {
-      logger.info("ai.audit", {
+      const isFailure =
+        record.outcome === "apply_failed" ||
+        record.outcome === "validation_failed" ||
+        record.outcome === "invalid_output" ||
+        record.outcome === "provider_error";
+      const payload = {
         outcome: record.outcome,
         taskKind: record.taskKind,
         provider: record.providerId,
@@ -427,7 +432,16 @@ export function createServerRequestHandlerWithModules(
         environment: record.environment,
         documentId: record.documentId,
         errorCode: record.errorCode,
-      });
+        ...(record.errorMessage ? { errorMessage: record.errorMessage } : {}),
+      };
+      // Lift failure audits to `error` level so they surface alongside
+      // request_failed logs — otherwise an apply that 500s leaves no
+      // breadcrumb at the default log level.
+      if (isFailure) {
+        logger.error("ai.audit", payload);
+      } else {
+        logger.info("ai.audit", payload);
+      }
     },
     contentTypesLookup,
     supportedLocalesLookup,

packages/modules/core.ai/src/server/apply.test.ts

@@ -140,7 +140,11 @@ describe("applyAiProposal", () => {
     const call = state.updateCalls[0]!;
     assert.equal(call.documentId, "doc_1");
     assert.equal(call.payload.body, "Hi there!");
-    assert.equal(call.payload.updatedBy, "user_99");
+    // `updatedBy` is intentionally NOT set on AI applies — the store
+    // falls through to its DEFAULT_ACTOR placeholder, matching the
+    // manual content endpoints. Real actor identity is recorded in
+    // the AI audit log instead.
+    assert.equal(call.payload.updatedBy, undefined);
     assert.equal(call.options.expectedDraftRevision, 4);
     assert.equal(call.options.expectedSchemaHash, "hash_1");
     assert.equal(result.body, "Hi there!");

packages/modules/core.ai/src/server/apply.ts

@@ -57,6 +57,14 @@ export type AiApplyContentStore = {
 export type AiApplyInput = {
   proposal: AiProposal;
   expectedSchemaHash: string;
+  /**
+   * Authenticated caller for audit purposes. Document writes pass
+   * through the content store WITHOUT this id — `createdBy`/`updatedBy`
+   * fall through to the store's `DEFAULT_ACTOR` placeholder, matching
+   * the behaviour of the manual content endpoints. The real actor is
+   * captured in the AI audit record instead. See
+   * `core.ai/server/apply.ts` create/update branches for context.
+   */
   actorId: string;
   store: AiApplyContentStore;
 };
@@ -181,7 +189,12 @@ function mergeFrontmatter(
 export async function applyAiProposal(
   input: AiApplyInput,
 ): Promise<AiApplyContentDocument> {
-  const { proposal, expectedSchemaHash, actorId, store } = input;
+  const { proposal, expectedSchemaHash, store } = input;
+  // `actorId` is intentionally not destructured into a local — the
+  // store calls below fall through to DEFAULT_ACTOR for createdBy/
+  // updatedBy. The id is still part of the input shape because the
+  // route handler uses it for audit-record emission.
+  void input.actorId;
   const scope: AiApplyContentScope = {
     project: proposal.project,
     environment: proposal.environment,
@@ -205,8 +218,12 @@ export async function applyAiProposal(
         format: operation.format,
         frontmatter: operation.frontmatter,
         body: operation.body,
-        createdBy: actorId,
-        updatedBy: actorId,
+        // Intentionally omit `createdBy`/`updatedBy` so the store
+        // falls through to the same DEFAULT_ACTOR placeholder the
+        // manual content endpoints use. The real actor identity is
+        // captured in the AI audit record — the underlying document
+        // attribution gap is shared with the manual UI flow and is
+        // tracked separately as a follow-up.
       },
       { expectedSchemaHash },
     );
@@ -306,7 +323,8 @@ export async function applyAiProposal(
     {
       body: nextBody,
       frontmatter: nextFrontmatter,
-      updatedBy: actorId,
+      // Omit `updatedBy` so the store falls through to DEFAULT_ACTOR
+      // — same path the manual `PUT /api/v1/content/:id` route takes.
     },
     {
       expectedSchemaHash,