[Bug]: Copying a text selection in chat replaces the clipboard with the entire session transcript

Inizia tracciando il copy listener e le funzioni ZK() e WK() in resources/app/out/renderer/assets/index-6Mcp5Fcu.js, quindi individua le controparti nel codice sorgente. Riproduci il caso con una sola riga montata nell’harness Chromium headless e verifica che la copia di una selezione parziale conservi solo quella selezione, mentre la copia dell’intera conversazione continui a funzionare.

GUI version

0.1.35

Operating system

Windows

Reproduction steps

1. Open the desktop app and open any chat that contains at least one assistant reply.
2. Scroll so that the reply you want to copy is the only message row inside the rendered feed area. This is easiest with a long reply (e.g. one containing large code blocks), or with a short/split window.
3. Select a small part of that reply with the mouse.
4. Press Ctrl+C (or right-click -> Copy).
5. Paste into any text editor.

Observed: the clipboard does not contain the selection. It contains the entire conversation,
serialized as:

User:

Assistant:
<all assistant text of that turn, tool calls stripped>

Selecting a different amount of text makes no difference, and the behavior is deterministic:
restarting the app and resizing the window do not change it once it starts happening.

To confirm the trigger condition, with a selection active run this in DevTools console:

const s = document.getSelection(), rows = document.querySelectorAll('[data-feed-row]');
[rows.length, s.containsNode(rows[0], true), s.containsNode(rows[rows.length-1], true)]

If rows.length is 1 while the session clearly contains many messages, the bug is being triggered.

Expected behavior

The clipboard contains exactly the text I selected, and nothing else.

Actual behavior

The clipboard is silently replaced with a full dump of the conversation in "User: ... Assistant: ..."
format, regardless of how small the selection was. The selected text is never copied.

Screenshots, recordings, or sanitized logs

Root cause found by inspecting the shipped renderer bundle
(resources/app/out/renderer/assets/index-6Mcp5Fcu.js).

The chat feed is a virtualized list, so [data-feed-row] elements only exist for the rows in the
current render window. A global copy listener rewrites the clipboard whenever it believes the
whole conversation is selected:

// is the whole conversation selected?
function ZK(e){
const t = e.ownerDocument.getSelection();
if (!t || t.rangeCount === 0 || t.isCollapsed) return false;
const n = e.querySelectorAll("[data-feed-row]"), r = n[0], a = n[n.length - 1];
return !r || !a ? false : t.containsNode(r, true) && t.containsNode(a, true);
}

// copy hook: replaces the clipboard
const r = a => {
if (a.defaultPrevented || !a.clipboardData || Gk(a.target)) return;
const s = e.current;
if (!Wk(s) || !ZK(s)) return;
const l = WK(t.current ?? []); // serializes ALL messages
l && (a.preventDefault(), a.clipboardData.setData("text/plain", l));
};
window.addEventListener("copy", r);

WK() is the serializer that produces the "User: ..." / "Assistant: ..." text.

The defect: ZK() takes "first row" and "last row" from querySelectorAll, i.e. only the rows the
virtualizer currently has mounted, not the whole conversation. When the render window contains
exactly one [data-feed-row], n[0] === n[n.length - 1], so selecting ANY text inside that single
row satisfies containsNode(first) && containsNode(last), and the clipboard is replaced with the
entire session. WK() uses the full message list, not the DOM, which is why the result is the
whole conversation even though only one row was visible.

Verified in a headless Chromium harness with the same DOM shape:

• 5 rows, selection inside the middle row -> containsNode(first)=false, containsNode(last)=false
• 5 rows, selection inside the last row -> false / true
• 1 row, selection inside it -> true / true (triggers)

Suggested fix: derive the check from the real row count (the list data length) instead of the
mounted DOM, or require the selection to start on the first data row and end on the last one.

Safety check

• I removed credentials and private project information from this report.