Fix 6 bugs in webchat tool pipeline, history storage, and sandbox UI

[Copilot]

Several bugs across app.py and chat_client.py were degrading the webchat tool system: expert settings silently failed to save, tool XML polluted conversation history, and the LLM running check happened too late.

Bug Fixes

• PUT method missing on /api/webchat/users/<uid> — chat_client.py uses method="PUT" for expert settings; route only accepted POST/DELETE, causing silent 405s and expert state never persisting.

• Tool XML in conversation history — <tool>…</tool> blocks were saved verbatim to SQLite and fed back to the LLM on subsequent turns. Added _strip_tool_blocks() and applied it in the finally block before saving assistant messages. Rate-limit counting is preserved even for tool-only replies.

  def _strip_tool_blocks(text: str) -> str:
      return re.sub(r'<tool>.*?</tool>', '', text, flags=re.DOTALL).strip()

• Unclosed <tool> tag causes silent extra LLM call — when the LLM never emitted </tool>, the while iteration < 4 loop silently restarted with incomplete context. Now emits a visible error token and breaks.

• Early LLM-running guard in webchat_chat_route — moved _llm_status["running"] check before rate-check and SSE setup, returning HTTP 503 immediately instead of surfacing the error mid-stream.

Cleanup

• Redundant import base64 inside files_upload — replaced with the module-level b64mod alias already imported at the top.

• Sandbox file size raw bytes in UI (chat_client.py) — (${f.size}) → (${fmtSize(f.size)}) using the already-defined JS helper.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

Fixes several reliability issues in the webchat tool pipeline and related UI/history handling so expert settings persist correctly, tool XML doesn’t contaminate stored history, and users get earlier failures when the LLM server is down.

Changes:

• Added <tool>...</tool> stripping before persisting assistant messages to webchat history (and kept rate logging behavior).
• Added PUT support for /api/webchat/users/<uid> and moved the LLM-running check earlier in the chat route.
• Improved sandbox UI file size display and removed a redundant base64 import by reusing the module-level alias.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
app.py	Webchat route fixes (PUT support, earlier LLM guard), tool-tag stripping before persistence, unclosed-tool handling, cleanup of base64 usage in uploads.
chat_client.py	Sandbox file list UI now displays human-readable sizes via fmtSize().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

_strip_tool_blocks() only removes closed <tool>...</tool> blocks. In the unclosed-<tool> scenario handled later in _normal_stream, full_reply will still contain a partial <tool> block and this function will return it unchanged, so the polluted tool XML can still be persisted to SQLite and re-fed into future prompts. Consider stripping any trailing <tool> start tag with no closing tag (or truncating full_reply before saving) so malformed tool outputs can’t leak into history.

Suggested change

	return re.sub(r'<tool>.*?</tool>', '', text, flags=re.DOTALL).strip()
	# Önce kapalı <tool>...</tool> bloklarını kaldır.
	cleaned = re.sub(r'<tool>.*?</tool>', '', text, flags=re.DOTALL)
	# Ardından, kapanış etiketi olmayan sondaki bir <tool> bloğunu da temizle.
	# Bu, akış sırasında kısmi tool çıktısının geçmişe sızmasını engeller.
	last_open = cleaned.rfind("<tool")
	if last_open != -1:
	# Eğer bu noktadan sonra hiç </tool> yoksa, bu kısmi bir bloktur → kes.
	if "</tool>" not in cleaned[last_open:]:
	cleaned = cleaned[:last_open]
	return cleaned.strip()