Keep Cloud agent chat recoverable when browser storage fails

[teamleaderleo]

When browser storage rejects access or writes, Agent Chat can fail to mount, throw during option changes, or interrupt failed-start cleanup before returning to the composer. The chat now uses one guarded storage facade for provider preferences, working directories, and draft handoffs. A failed write preserves the latest value in memory, and a failed removal preserves a tombstone so a consumed draft does not reappear.

Healthy storage keeps its existing behavior, including observing changes from other views. The fallback lasts for the current page; it cannot persist across a reload when browser storage remains unavailable.

Changelog

• Fixed: Keep Cloud agent chat and failed-start draft recovery usable when browser storage rejects access or writes.

Validation

• bun run test/options-store.test.ts: fails with SecurityError at test commit 9f9b116d23d4; passes at 6b29ab82ab5a.
• bun run check: TypeScript check, 23 assertion scripts, and 50 Bun tests passed.
• bun run build: passed.
• python3 scripts/verify-local.py --affected upstream/main: all 15 selected checks passed.
• Headless Chrome with the production bundle and an isolated fake WebSocket: denied-storage and quota-error scenarios both mounted the composer, changed permission mode, submitted a prompt, and recovered the exact prompt after an injected start failure. Both completed with no page errors; no real agent or Cloud VM was started.
• git diff upstream/main --check: passed. No user-facing copy changed.

---

Summary by cubic

Fixes Cloud agent chat so the composer stays usable when browser storage rejects access or writes. All storage access—provider preferences, working directories, and draft handoffs—now goes through a guarded facade that keeps the latest value in memory when writes fail and keeps a tombstone on failed removal so a consumed draft doesn't reappear. Healthy storage keeps existing behavior, including observing changes from other views; the in-memory fallback lasts for the current page only and can't survive a reload.

Bug Fixes

• Added regression coverage for denied access (SecurityError), quota errors, and failed draft removal.

^{Written for commit 6b29ab8. Summary will update on new commits.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 19 seconds.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9dfc4596-8aaa-4b07-a43b-a5eb2a9eefe8

📥 Commits

Reviewing files that changed from the base of the PR and between 40a636e and 6b29ab8.

📒 Files selected for processing (9)

• agent-chat/src/browser-storage.ts
• agent-chat/src/components/Chat.tsx
• agent-chat/src/components/Composer.tsx
• agent-chat/src/hooks/useCatalogs.ts
• agent-chat/src/options-store.ts
• agent-chat/src/session.ts
• agent-chat/test/browser-storage.test.ts
• agent-chat/test/options-store.test.ts
• agent-chat/test/session.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[teamleaderleo]

Review: land. Resolving the storage object lazily inside each operation's try is the right shape, and three of the four failure modes are covered: a throwing property accessor (SecurityError), storage absent, and a quota error on write.

The fourth is handled but untested: a storage object that is returned while its getItem throws (Firefox with blocked cookies). I probed it, and it behaves correctly. Reads fall back to the cache, the written value is served back, and the tombstone works.

Verified the app renders with storage entirely unavailable: with throwing getters on both globalThis.localStorage and globalThis.sessionStorage, importing browser-storage and options-store succeeds and all nine operations return sane values. The migration is also complete, zero raw localStorage/sessionStorage references remain outside browser-storage.ts, so nothing is left to throw during first render.

11 mutants, 2 survived:

• The headline case has no regression test at its one production call site. src/session.ts:407: reverting restoreComposerDraft(draftStorage, ...) to sessionStorage passes the full 50-test suite, session.test.ts included. "Do not lose the user's draft when storage fails" is the point of the PR.
• The module-load hoist the file's own comment warns about is unguarded. src/browser-storage.ts:53-56 says evaluating a default like storage = localStorage can throw before the try/catch. Hoisting the resolution to module scope passes all six tests, because bun's globalThis.localStorage does not throw, so the test environment structurally cannot reproduce it. The note is right and the code follows it; the guard is aspirational.

Nit: a stray 4-space over-indent in the added block of test/session.test.ts.
— Raindrop g2 🫧 / Run: run_worker_20260930_3fc64ba6

[github-actions]

Merge receipt for 6b29ab82ab: every check was green at merge (12 verified; 16 skipped by policy). Full suite runs on main after merge.