Rebuild chat visuals with saved selections and mockup design tools

[phinaldoo]

Generated charts, maps, simulations, and mockups now run immediately inside the conversation, with an Omlorix runtime inspired by Codex and the T3 Code visualization demo. Models get a provider-neutral authoring contract, local libraries, and validation feedback.

• Replaces the visualization surface with source view, reset, text alternatives, portable HTML download, and expansion that preserves the running document. Offscreen widgets mount lazily; D3, TopoJSON, and Lucide load locally when referenced.

• Adds widgetState / setWidgetState({modelContent, privateContent}). Selections survive reloads; only model-visible selections and design changes supplement subsequent turns. Saves coalesce, follow live messages when their persisted ID arrives, flush before follow-ups, and expose retry/conflict status. Temporary/shared previews remain local.

• Adds runtime-provided Tweak controls: sliders, color pickers, toggles and selects, grouped by component. Includes original preview, design reset, and confirmed Apply in chat. Named variants get previous/next navigation and a picker; inactive variant controls hide without destroying their DOM or edits.

• Keeps authored code in the opaque, network-blocked sandbox. State endpoints check ownership, project access, widget identity, source identity, bounded JSON, and revisions. Follow-ups, external data and generated downloads retain capability and confirmation checks.

• Saves snapshots in the new nullable chat_messages.visualization_states column, separate from generated HTML. Includes migration visualization_state_20261007, chat/user exports, import, clone support, documentation, and proper translations in all 11 locales. Standalone HTML starts from the downloaded selections and design and retains local controls.

• Updates the security regression checks for automatic isolated scripts and the migration head. Upgrades the audited transitive dependencies to AnyIO 4.14.2, multidict 6.9.1, Soup Sieve 2.9, and urllib3 2.8.0, retaining verified hashes and all other pins.

Validation: The full backend suite passed in a clean Python 3.13 environment installed from the hash-locked production/development requirements: 4,183 passed, 11 skipped. Dependency resolution, compilation, Python lint, and the strict hash-locked vulnerability audit passed; no known vulnerabilities were reported. The upgraded packages also have hash-verified macOS ARM wheels for Python 3.14. The prior implementation validation passed 1,332 frontend tests, JavaScript lint, and translation parity. PostgreSQL migration SQL compiled in offline mode; no live PostgreSQL migration was run locally.

Browser validation covered charts, heatmaps, code treemaps, geographic maps, all four design control types, independent variants, original preview, confirmed/cancelled follow-ups, keyboard controls, narrow layouts, reload restoration, and standalone export. These checks used production components in a disposable SQLite fixture, with illustrative chart/activity data and mocked follow-up submission. No authenticated application session, live provider generation, Firefox, or Safari run is claimed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4973abbd-454e-48d7-8cd2-2e9a7c5364e0

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}