fix(asks): render agent markdown in asks, and show only waiting asks in the chat strip (#3115)

[dolho]

Summary

An ask's agent-written markdown now renders on every surface where it's answered or reviewed. Before, the Workspace asks and /m showed the question as raw **bold** / - list / `code` text. Titles, option labels and the given answer were plain text everywhere.

• One renderer, operator/AskMarkdown.vue, used by the operator queue card, resolved history, the Workspace asks (PortalAsks) and /m, so the surfaces can't drift again.
  • Question: block markdown via renderMarkdown, the same DOMPurify policy as chat and reports. It uses the chat bubble's prose classes and code-pill convention, so a list, inline code and a link look the same in the operator queue, the Workspace and the agent's chat.
  • Title, option labels and the given answer: inline-only via renderInlineMarkdown (the bug(canvas): markdown inside table cells is not rendered — table block cells show raw **bold**/code/[link]() text #2771 cell policy). Bold, italic, code and links are kept; block elements and class are dropped, so a field can't break its layout.
• Answers are unchanged. An option's value, key and what gets sent stay the raw string; only the label renders.
• /m gets the same elements without the prose classes. They're styled in currentColor, so its always-dark card needs no new colour literal.

Fixes #3115

Stopgap: the chat strip shows only waiting asks (ent#610 ruling)

Since #3023, the asks list also carries asks that ended in the last 7 days, and the strip above the composer rendered all of them, so answered approval tiles piled up in every chat with the agent. Per the ent#610 ruling, this PR makes the strip pending-only: an answered ask leaves the chat, and history lives in the Inbox. #3101 (ent#610 A2) rebases on top of this.

• PortalConversation.vue: the strip hosts <PortalAsks pending-only>, as the Work tab already does. It no longer gates on an ask count in the parent, because PortalAsks decides its own visibility, including the ent#468 "Sent." confirmation, which must outlive the last pending ask; a parent v-if on the pending count would unmount it the moment it appears. The strip's top gap follows its content via :has().

• tests/unit/portalAskStripPendingOnly.mount.spec.js (5 mount tests):

  • the strip passes pending-only;
  • a pending ask shows and an answered one never does;
  • when only ended asks exist, nothing renders;
  • answering the last ask keeps the confirmation;
  • without pending-only (history), ended asks are still listed.

  Mutation: dropping pending-only turns the wiring test red.

• Three source-text pins that asserted the old gating shape (agentAsks.length, store.asksForAgent in the conversation) now assert the new shape, with the same intent.

Live check (the same Main chat that had three answered approvals stacked): only the one waiting ask shows. After Approve → Send, the tile goes, "Sent." shows briefly, the strip ends empty, and it stays empty after a reload.

One waiting ask; the answered ones are gone	After Approve → Send

Screenshots

One real approval ask, raised by an agent through ask_operator on a local stack. The stored text is title: "Approve the **Q4 launch** plan"; the question has bold, a list with inline code `3` and a link; the options are "**Approve**" and "Reject". The same ask is shown on each surface.

Operator queue card (it rendered the question before; now the title and options render too, and code is a pill):

Workspace asks: this showed the raw ** / - / backticks before the fix, and now matches the operator queue:

/m at phone width (raw text before the fix):

Dark theme

Changes

• src/frontend/src/components/operator/AskMarkdown.vue: new; the one renderer (block and inline modes).
• QueueCard.vue, ResolvedCard.vue, portal/PortalAsks.vue, views/MobileAdmin.vue: switched to it.
• tests/unit/askMarkdown3115.mount.spec.js: new mount tests.
• docs/memory/feature-flows/operating-room.md: component row.

Notes for review

• QueueItemDetail.vue is deliberately untouched. The issue lists it, but nothing mounts it, and it reads store.selectedItem / store.selectedItemId, which no longer exist on the operator-queue store. It is dead code, worth a follow-up to remove.
• Queue card "details" (context key/values) stay verbatim. They're structured values such as ids, where markdown would mangle _ and * (bug(canvas): markdown inside table cells is not rendered — table block cells show raw **bold**/code/[link]() text #2771's reasoning for non-string cells), and the acceptance criteria don't cover them.
• bug(security): Tailwind utility classes in agent-authored chat/report markdown reach the page unfiltered — extend the ent#537 class allowlist beyond the canvas #2567 (class allowlist for agent markdown) is still open. Because asks now go through the shared renderMarkdown, they'll inherit that allowlist when it lands. Inline fields already drop class entirely.

Test Plan

• Stopgap: npx vitest run tests/unit/portalAskStripPendingOnly.mount.spec.js — 5 mount tests; full suite 194 files / 3,882 tests green after the pins were moved.
• npx vitest run tests/unit/askMarkdown3115.mount.spec.js: 11 mount tests covering:
  • the question renders <strong>, a <ul>, <code> and a hardened <a target=_blank rel=noopener>, with no raw **;
  • an inline field never keeps a block element or a class;
  • <script> / onerror are stripped (inline and block);
  • clicking a formatted option sends the raw string (queue card and Workspace);
  • a plain-text ask shows exactly its text;
  • /m renders the same elements.
• Mutation: with AskMarkdown reverted to escaped plain text, 9 of the 11 go red. The 2 that stay green are the plain-text and sanitiser tests, which plain text passes by design.
• Full frontend suite: 193 files, 3,877 tests, including the raw-colour, loading-gate and source-text ratchets. The design-token check and npm run build pass.
• Manual: on a local stack, an agent raised a real approval ask (bold title, a list with inline code and a link, a **Approve** option). I checked it on the Workspace, the operator queue (light and dark) and /m at phone width, and it renders the same on each.

🤖 Generated with Claude Code

[vybe]

merge-train: this PR is on today's train with #3119, #3120 and #3085. It validated READY. Everything renders through AskMarkdown → utils/markdown.js, which is DOMPurify-sanitized, and the mounted spec fails on a revert: 9 of 11 tests go red.

Follow-ups. None of them block:

• Inline mode keeps <a>, so a markdown link in an option label ends up nested inside the option <button>. That's at QueueCard.vue:142, PortalAsks.vue:121 and MobileAdmin.vue:287. Consider a no-links variant for options.
• Block mode inherits the class allowlist that bug(security): Tailwind utility classes in agent-authored chat/report markdown reach the page unfiltered — extend the ent#537 class allowlist beyond the canvas #2567 tracks.
• Nothing tests /m "Recently ended" (MobileAdmin.vue:378) or the "Sending X" line.
• QueueItemDetail.vue is dead code: nothing imports it. It's worth a removal follow-up.

[vybe]

merge-train: batch validated on train/20260930-1429 (#3126, all gates green)