#616 release: session chat by id + auto-commit + credits per turn + assistant persistence

Summary

Promotes test to main. Squashed feature PRs included:

• #562 — feat(api): migrate /api/sessions/[sessionId]/chats/[chatId] from open-agents (GET/PATCH/DELETE with .strict() body validation). Verified end-to-end on preview — see PR comment.
• #614 — feat(chat-workflow): auto-commit + push after natural finish
• #612 — feat(credits): charge credits per chat turn (atomic wallet debit + audit)
• #609 — fix(chat-workflow): persist the assistant message after a successful run

Test plan

• All feature PRs already merged into test with green CI
• PR #562 manually verified on preview deployment (14/14 cases)
• Watch Vercel production deploy after merge

---

Summary by cubic

Adds session chat endpoints and completes the chat workflow. Users get auto-commit on natural finishes, per-turn credit charges, and reliable assistant replies after refresh.

• New Features

  • Session chat API: GET/PATCH/DELETE /api/sessions/{sessionId}/chats/{chatId} with auth and CORS. GET returns { chat, isStreaming, messages }. PATCH updates title/modelId with .strict() JSON validation. DELETE blocks removing the last chat in a session.
  • Auto-commit after natural finish: detects repo changes, commits and pushes, streams data-commit updates, and persists the commit info onto the assistant message.
  • Credits per turn: charges the wallet per successful turn with an atomic Supabase RPC audit. Uses gateway-reported cost when available, else a token-based estimate.

• Bug Fixes

  • Persist the final assistant message after a successful run to prevent data loss on refresh.
  • Bump lastAssistantMessageAt on persist so unread badges stay accurate.
  • Generate a stable assistant message ID to avoid duplicate-upsert skips.

Summary by CodeRabbit

• New Features

  • Added API endpoints for managing individual chats within sessions, including retrieval, updating, and deletion functionality.
  • Chat updates now support changing title and model preferences.
  • Deletion validation ensures at least one chat remains per session.
  • Added CORS support for cross-origin requests.

• Bug Fixes

  • Proper authentication and authorization checks for all chat operations.