Round 2 prod-readiness (widget): fix openTab false-blocked + probe timeout

- openTab: window.open with 'noopener' always returns null, so the old
  Boolean(win) reported every successful open as blocked (misleading the two
  unattended agent tools 100% of the time). Open without noopener, sever opener
  manually, so only a real popup block is false.
- getSessionToken: add an AbortController client timeout (8s) so a hung
  /kapa/session connection degrades to the anonymous tier instead of leaving the
  drawer stuck on the loading spinner forever.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

Author: JakeSCahill

src/js/react/AskAI.jsx

@@ -35,7 +35,18 @@ function announceSession (authenticated, user, loginUrl) {
 
 async function getSessionToken () {
   const endpoint = window.KAPA_SESSION_ENDPOINT || '/kapa/session'
-  const res = await fetch(endpoint, { method: 'POST', credentials: 'include' })
+  // Client-side timeout: a hung connection (LB/proxy accepts TCP but never
+  // responds) would otherwise neither resolve nor reject, leaving the drawer
+  // stuck on the loading spinner forever. On abort we throw, so probeSession's
+  // .catch degrades to the anonymous tier — matching the network-error fallback.
+  const ctrl = new AbortController()
+  const timer = setTimeout(() => ctrl.abort(), Number(window.KAPA_SESSION_TIMEOUT_MS || 8000))
+  let res
+  try {
+    res = await fetch(endpoint, { method: 'POST', credentials: 'include', signal: ctrl.signal })
+  } finally {
+    clearTimeout(timer)
+  }
   if (res.status === 401) {
     const data = await res.json().catch(() => ({}))
     announceSession(false, null, data.login_url)

src/js/react/agentTools.js

@@ -40,7 +40,18 @@ function resolveDocsUrl (url) {
 
 // Open in a new tab; a blocked popup returns null so callers can degrade to a link
 function openTab (url) {
-  const win = window.open(url, '_blank', 'noopener')
+  // NOTE: window.open() returns null whenever the 'noopener' feature is set
+  // (per spec + all browsers), so we can't use its return to detect a blocked
+  // popup — doing so reported "blocked" on every successful open. Open without
+  // 'noopener' and sever opener manually so a genuine null (real popup block)
+  // is the only false, and the caller's degrade-to-a-link path is accurate.
+  let win
+  try {
+    win = window.open(url, '_blank')
+    if (win) win.opener = null
+  } catch {
+    return false
+  }
   return Boolean(win)
 }