feat(security): forward PF inference window console to main + dev devtools

[graydawnc]

PR 5/7 — make-it-work debug session + Effect/OTel observability + DetectorsChip + ScanBanner rescan progress

The chunky one (14 commits). After PR 4 wired the callout + activation, real-world dev surfaced a handful of inference loading + protocol + provider-coordination bugs. Same PR also adds the DetectorsChip + rescan progress in ScanBanner so the user sees what scanner is actually doing and how far along the burst is.

Themed as "make it actually run + surface what's happening" — fixes interleaved with the visibility additions because each fix taught us what to surface.

Subsystems touched

graph TB
  subgraph DevLoad["Inference window loading in dev"]
    A1["3fb8cdd: @fs/abs-path URL → Vite serves<br/>HTML outside the renderer root"]
    A2["5b23a85: pf-model:// URL parsing<br/>+ stream large files"]
    A3["f9538df: self-host ORT WASM<br/>+ correct MIME + skip empty analyze"]
  end

  subgraph Observability["Observability"]
    B1["3546854: Effect-ify pf-runtime /<br/>pf-coordinator / sync; OTel spans<br/>for download / runtime.start /<br/>handshake / analyze"]
    B2["26e882a: forward inference window<br/>console → main stdout + dev devtools"]
    B3["90bd11a: gate devtools behind<br/>SPOOL_PF_DEVTOOLS env"]
  end

  subgraph Coordination["Provider coordination"]
    C1["18be661: gate notifyPfOnline on<br/>runtime ACTUALLY reaching ready<br/>not just spawn-resolved"]
    C2["af4ae23: drop matches without<br/>offsets + diagnostic mapping log"]
    C3["b8f9c55: re-locate matches via<br/>indexOf when tokenizer lacks<br/>offsets fallback"]
  end

  subgraph UI["UI surfaces (meta row)"]
    D1["020d8af: DetectorsChip in Security<br/>page meta row — chip per active<br/>provider + live runtime label"]
    D2["1d81500: ScanBanner shows rescan<br/>progress, not the opaque profile str"]
    D3["d9ac7de: chip typography matches<br/>surrounding meta"]
    D4["9388339: chip sized as inline meta<br/>not buttons"]
  end

  subgraph CoreScan["Core scan listing"]
    E1["813fe3c: exclude info-tier kinds<br/>from per-session listFindings —<br/>keeps high-tier visible on page 1"]
  end

Loading

Critical fixes explained

3fb8cdd — inference window actually loadable in dev

flowchart LR
  subgraph Before
    direction TB
    M["main: win.loadURL"] -->|"/../inference/pf-inference.html"| Vite
    Vite -->|"URL parser normalises to /inference/..."| SPA["SPA fallback"]
    SPA -->|"serves wrong index html"| M
    SPA -->|"Sidebar undefined errors"| Boom["💥"]
  end

  subgraph After
    M2["main: win.loadURL"] -->|"@fs/abs-path/pf-inference.html"| Vite2
    Vite2 -->|"server.fs.allow includes packages/app/src/inference"| Hidden["hidden window<br/>loads correctly"]
    Hidden --> PfReady["pf:ready"]
  end

Loading

Vite roots the renderer at src/renderer/; our HTML lives at src/inference/pf-inference.html (outside). A relative /../inference/... URL hits Vite's SPA fallback, silently serving the main renderer's index.html into the hidden window. Fix: Vite's @fs/<abs-path> escape hatch.

18be661 — wait for actual ready

// Before: pfRuntime.start() resolves on spawn → notifyPfOnline immediately
// → currentProfile drifts to regex@1,pf@1.5b-q4.r2, but actual model
//    load failed inside transformers.js → analyze round-trips to a
//    dead window that returns []. User sees regex-only findings tagged
//    with a profile string that LIES about what scanned them.
//
// After: check getState().status === 'ready' before notifyPfOnline.
//        Failures route to notifyPfOffline; profile stays regex@1.

3546854 — Effect-ify + OTel

The hand-rolled Promise chain in pf-runtime / pf-coordinator / syncPfRuntime never wrote into the OTel pipeline. Failure mode: "PF feels broken but I don't know where it broke." After this commit every span has structured attributes (pf.download.outcome, pf.runtime.status, pf.runtime.kind, pf.runtime.error) and lands in the same exporter as the scan worker.

813fe3c — info-tier exclusion in listFindings

A session with 800+ absolute-path findings + a handful of api-key would have the api-keys pushed off page 1 by detected_at DESC. New excludeInfo filter drops info-tier kinds at the SQL layer; ignored when caller explicitly asks for an info kind.

What's in this PR

• 9 inference window / protocol / Effect-ify / observability fixes — see commit messages individually
• 4 UI commits adding DetectorsChip + ScanBanner rescan progress + typography polish
• 1 core/repo.ts change — excludeInfo filter

Test plan

• App suite: 273/273 at branch tip
• Manual: enable PF cold → window loads in dev → ready handshake → first analyze succeeds → DetectorsChip shows "Privacy Filter · WebGPU · Apple M2 Pro"
• Manual: kill inference window mid-scan → ScanError surfaces, session re-enqueues → next backfill cleans up

Builds on PR 4 (callout). Followed by PR 6 (class-mapping precision restrict).

🤖 Generated with Claude Code

[graydawnc]

• feat(security): hide PF UI entry points; move to opt-in Experimental section #298
• feat(security): restrict PF to high-precision PII categories #297
• feat(security): forward PF inference window console to main + dev devtools #296 👈 (View in Graphite)
• feat(security): in-page Privacy Filter discovery callout #295
• feat(security): real ONNX inference via openai/privacy-filter #294
• feat(security): wire ModelHost lifecycle + pf-analyze IPC bridge #293
• feat(security): hidden inference window skeleton for Privacy Filter ML #292
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.