Fix private action credential recovery in shared conversations

[Paul Lizer (paullizer)]

Summary

• Fix the misleading credential-load banner in working shared conversations. The pending-request API previously looked up the visible shared ID in personal conversation storage; an authorized conversation with no unfinished sign-in now returns an empty list.
• Resolve visible and execution conversation contexts through existing membership, source-link, and creator policies. Credential requests and identity choices stay private to the invoking user; sharing a conversation does not share personal agents or identities. Shared Orchestrate remains creator-only.
• Restore private live prompts and reopened sign-in requests, then resume saved work and publish the screened answer to the original shared thread. Stable answer IDs and the completed journal support delivery-only retry without repeating completed external actions. Legacy shared requests without a provable original question are rejected rather than replayed.
• Make V2 recovery conversation-kind-aware, with distinct session/access/transient error messages and a visibly busy, single-flight Reload button. Update documentation and regression coverage for version 0.261.348; the existing 24-hour expiry is unchanged.

Linked issue

N/A. Issue creation was deferred during investigation; no issue has been created.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.347 -> 0.261.348. No deployer changes.

Testing / validation

Python checks used an isolated environment with the application's pinned dependencies and application\single_app plus functional_tests on PYTHONPATH.

• python .\scripts\check_cosmos_response_boundaries.py --run-contracts - passed: 1,118 tests and 244 subtests; 1,067 storage owners and 411 doubles with zero review gaps. External network access was blocked. Includes fresh-process credential bootstrap, shared recovery, private stream projection, and relevant orchestration/storage contracts.
• node .\functional_tests\test_v2_action_personal_credentials.mjs - passed.
• npm --prefix .\application\v2_ui run typecheck - passed.
• npm --prefix .\application\v2_ui run build - passed, with the existing large-chunk warning.
• python .\functional_tests\test_docs_app_surface_coverage.py - passed, 7/7 checks; generated application-surface inventory remains current without a content change.
• python .\functional_tests\test_docs_site_quality.py - passed, 6/6 checks.
• git diff --check - passed before commit.

V2 credential browser coverage also passed (30 cases across the component and real Flask/Semantic Kernel backend suites), as did the classic credential browser cases (28). Coverage includes shared personal/group chats, noncreator participants using their own personal agents, navigation/reload races, revoked access, and delivery retry without another provider call.

No deployment, production credential submission, or real external action execution was performed. Production validation after deployment remains a separate authorized step.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated the personal action-credentials feature, user guide, and chat-controls reference. Added docs/explanation/fixes/SHARED_CHAT_ACTION_CREDENTIALS_FIX.md with the confirmed routing cause, privacy boundaries, continuation behavior, and limitations. The release-notes update was offered but remains deferred pending approval.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes or settings-to-browser surfaces were added. Existing CSRF, no-store headers, ETags, actor-partition ownership, manifest fingerprints, checkpoint/journal guards, and general personal-conversation authorization remain in place. Shared pending reads do not create backing conversations or participant-state records, and infrastructure errors remain explicit rather than returning an empty success.