fix: older defects (batch C) and the second batch's review

Chats:
- New Chat right after an answer saves that chat once. Saves run one at
  a time and read the chat on screen when their turn comes; a save
  scheduled for a chat that is no longer on screen is dropped. A chat
  whose id was still on its way to the URL no longer comes back after
  New Chat (the next answer went into it).
- Crossing the 768 px breakpoint keeps the chat panel: a streaming answer,
  unsaved messages and attachments stay. The panel gets the sizes of each
  side, and a panel collapsed on desktop opens on mobile.
- The chat's export waits for its own reply: an edit's history export
  still on its way no longer answers it with the older diagram, and two
  file saves at once no longer swap results.
- A second edit in one answer is previewed on the first edit's result.
- Stop also ends a running screenshot check; a chat that cannot be saved
  (storage full) can be left with "Continue without saving".
- Small diagrams with shapes count as diagrams; the tool card no longer
  crashes on malformed operations.

Quota and providers:
- Requests that reach the server's own endpoints count toward the quota:
  EdgeOne (always its own endpoint now), a private base URL whatever key
  header is sent, keyless Ollama without a URL. With the quota on, a
  redirect is followed only to a public address. The output cap applies
  to these requests too.
- Stop records the tokens of the steps that finished; the screenshot check
  counts its tokens without counting a request.
- EdgeOne configured only by AI_PROVIDER works, also in the admin Test,
  which forwards the access code. Azure set up only in the admin panel
  works in chat. The Test sends a Bedrock session token.
- The admin panel's Test of an entry without a URL uses the server's URL
  as the server does (no private address check for it); the admin panel
  no longer writes an Ollama URL.

MCP server:
- Write tools and start_session run one at a time, so two at once never
  drop each other's change; a cancelled call waiting its turn is skipped.
  get_diagram and export_diagram keep the session they started with.
- Export to .drawio first gets the user's latest edits from the browser.
- History thumbnails: one that arrives after the next AI write is
  dropped; a sync reply keeps the image; a version that changed only page
  settings is its own entry.
- A diagram over the 10 MB limit is saved without its image, or the user
  is told to download it (the server now answers 413 instead of cutting
  the connection).
- Labels holding text like id='1' or parent='1' are no longer read as
  attributes (a layer or a parent was deleted). A broken bare
  <mxGraphModel> file is refused.
- After a sync reply the tab no longer sends its autosave copy again.

Desktop and files:
- A newer switch of the same preset is not rolled back by an older one
  that failed. .env values with escaped quotes are read whole.
- MCP saved files: a file that could not be read stays protected while a
  folder without permission hides it, and is saved again once deleted.
- The desktop app reports "no chats" only when the count was read and no
  model settings are stored.

packages/mcp-server/tests/http-server.test.ts

@@ -467,22 +467,82 @@ describe("history restore", () => {
     const page = (cellId: string) =>
         `<mxfile><diagram id="p" name="P"><mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="${cellId}" vertex="1" parent="1"/></root></mxGraphModel></diagram></mxfile>`
 
+    // A thumbnail the tab took after loading the server write at `version`
+    const thumbnail = (id: string, svg: string, version: number) =>
+        postJson("/api/history-svg", {
+            sessionId: id,
+            svg,
+            stateId: getState(id)?.stateId,
+            version,
+        })
+
     it("gives a thumbnail only to the entry it shows", async () => {
         const id = "mcp-history-thumb"
-        setState(id, page("shown"))
+        const version = setState(id, page("shown"))
         // The last entry is another diagram (a tab's copy kept on recovery)
         addHistory(id, page("other"))
-        await postJson("/api/history-svg", {
-            sessionId: id,
-            svg: "SVG-OF-SHOWN",
-        })
+        await thumbnail(id, "SVG-OF-SHOWN", version)
         expect(getHistory(id).at(-1)?.svg).toBe("")
         addHistory(id, page("shown"))
+        await thumbnail(id, "SVG-OF-SHOWN", version)
+        expect(getHistory(id).at(-1)?.svg).toBe("SVG-OF-SHOWN")
+        expect(getState(id)?.svg).toBe("SVG-OF-SHOWN")
+    })
+
+    it("drops a thumbnail that arrives after the next AI write", async () => {
+        const id = "mcp-history-thumb-late"
+        const first = setState(id, page("first"))
+        addHistory(id, page("first"))
+        setState(id, page("second"))
+        addHistory(id, page("second"))
+        await thumbnail(id, "SVG-OF-FIRST", first)
+        expect(getHistory(id).map((e) => e.svg)).toEqual(["", ""])
+        expect(getState(id)?.svg).toBeUndefined()
+    })
+
+    it("drops a thumbnail of a state the server has since lost", async () => {
+        const id = "mcp-history-thumb-state"
+        const version = setState(id, page("shown"))
+        addHistory(id, page("shown"))
         await postJson("/api/history-svg", {
             sessionId: id,
             svg: "SVG-OF-SHOWN",
+            stateId: "another-state",
+            version,
         })
-        expect(getHistory(id).at(-1)?.svg).toBe("SVG-OF-SHOWN")
+        expect(getHistory(id).at(-1)?.svg).toBe("")
+    })
+
+    it("keeps a thumbnail in time after a sync reply", async () => {
+        const id = "mcp-history-thumb-sync"
+        const version = setState(id, page("ai"))
+        addHistory(id, page("ai"))
+        // draw.io's copy of the same diagram, sent back for a sync
+        const synced = page("ai").replace(
+            "<mxGraphModel>",
+            '<mxGraphModel dx="10">',
+        )
+        await postJson("/api/state", {
+            sessionId: id,
+            xml: synced,
+            baseVersion: version,
+            source: "sync",
+            stateId: getState(id)?.stateId,
+        })
+        await thumbnail(id, "SVG-OF-AI", version)
+        expect(getHistory(id).at(-1)?.svg).toBe("SVG-OF-AI")
+        // The state's own image is of the synced XML only
+        expect(getState(id)?.svg).toBeUndefined()
+    })
+
+    it("keeps the image when a write repeats the same XML", async () => {
+        const id = "mcp-history-thumb-same"
+        const version = setState(id, page("same"))
+        await thumbnail(id, "SVG-OF-SAME", version)
+        setState(id, page("same"), undefined, true)
+        expect(getState(id)?.svg).toBe("SVG-OF-SAME")
+        setState(id, page("changed"), undefined, true)
+        expect(getState(id)?.svg).toBeUndefined()
     })
 
     it("never pairs the image of an older diagram with a newer one", async () => {
@@ -515,14 +575,26 @@ describe("history restore", () => {
         expect(getHistory(id).map((e) => e.xml)).toContain(cleared)
     })
 
-    it("adds no entry for a re-serialized copy of the last one", () => {
+    it("adds no entry for a copy of the last one", () => {
         const id = "mcp-history-dedupe"
         addHistory(id, page("same"))
+        addHistory(id, page("same"), "SVG")
+        expect(getHistory(id)).toHaveLength(1)
+        // The missing image is filled in
+        expect(getHistory(id)[0].svg).toBe("SVG")
+    })
+
+    it("keeps a version that changed only the background", () => {
+        const id = "mcp-history-background"
+        addHistory(id, page("same"))
         addHistory(
             id,
-            page("same").replace("<mxGraphModel>", '<mxGraphModel dx="10">'),
+            page("same").replace(
+                "<mxGraphModel>",
+                '<mxGraphModel background="#FFE6CC">',
+            ),
         )
-        expect(getHistory(id)).toHaveLength(1)
+        expect(getHistory(id)).toHaveLength(2)
     })
 
     it("keeps manual edits in history before restoring", async () => {
@@ -545,3 +617,46 @@ describe("history restore", () => {
         expect(getHistory(id).map((e) => e.xml)).toContain(doc("manual"))
     })
 })
+
+describe("bodies over the size limit", () => {
+    it("answers 413 after reading the whole body", async () => {
+        const mib = Buffer.alloc(1024 * 1024, "x")
+        // Still sending when the limit is passed, as a browser would be.
+        // A browser whose upload is cut off reports a network error.
+        const result = await new Promise<{ status?: number; sent: boolean }>(
+            (resolve) => {
+                let sent = false
+                const req = http.request(
+                    {
+                        host: "127.0.0.1",
+                        port,
+                        path: "/api/state",
+                        method: "POST",
+                        headers: {
+                            host: `localhost:${port}`,
+                            "content-type": "application/json",
+                        },
+                    },
+                    (res) => {
+                        res.resume()
+                        res.on("end", () =>
+                            resolve({ status: res.statusCode, sent }),
+                        )
+                    },
+                )
+                req.on("error", () => resolve({ sent }))
+                const writeNext = (i: number) => {
+                    if (i === 15) {
+                        req.end(() => {
+                            sent = true
+                        })
+                        return
+                    }
+                    req.write(mib, () => setTimeout(() => writeNext(i + 1), 10))
+                }
+                writeNext(0)
+            },
+        )
+        expect(result).toEqual({ status: 413, sent: true })
+    })
+})