fix(session-ui): fall back when copying code blocks on insecure origins - #51035

Issue for this PR

Fixes #50988

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

The copy button on markdown code blocks read navigator.clipboard and returned if it was missing. On a plain-HTTP, non-localhost origin (e.g. opencode serve --hostname 0.0.0.0 opened from another device), the Clipboard API is always missing, so the button did nothing.

The message and tool copy buttons in session-ui already use writeClipboard, which tries a hidden-textarea execCommand("copy") first and falls back to navigator.clipboard. The code-block button now uses the same helper and only shows "copied" when the copy actually succeeded.

markdown.tsx can't import from message-content.tsx because message-content.tsx imports Markdown. So writeClipboard moves unchanged into components/clipboard.ts, and its two existing callers import it from there. To test the real click path, the code-copy handler and its button-state helpers move out of markdown.tsx into components/markdown-code-copy.ts unchanged. Only the clipboard call inside the handler differs.

How did you verify your code works?

New packages/session-ui/src/components/clipboard.test.ts (happy-dom, navigator.clipboard removed, execCommand stubbed):

• writeClipboard copies through the execCommand path and returns true
• clicking a code-block copy button copies the code text and sets data-copied="true"

Commands:

• cd packages/session-ui && bun test src: 195 pass, 0 fail
• cd packages/session-ui && bun run typecheck: clean
• repo pre-push hook (oxlint + bun turbo typecheck): 0 lint errors, 35/35 typecheck tasks
• With the old navigator.clipboard-only handler, the code-block test fails (1 pass, 1 fail)

Screenshots / recordings

No visual change. The existing copy button now works on insecure origins.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

Review follow-up

• Merged current dev in 20ec936ad134f7f5c9461bc654282333c7f55ce6, preserving upstream Markdown link handling and message text pacing alongside the clipboard extraction. No history rewrite.
• d58edc01828819cfcda72f2c6d33f6e0cf8b23b3 guards missing execCommand, cleans up the temporary textarea in finally, falls through after legacy-copy exceptions, and routes ToolErrorCard copy through the same helper without showing copied state on failure.
• New tests cover missing/throwing/false/success legacy copy against missing/rejected/success modern copy. The browser tests click the actual ToolErrorCard copy button.
• Independent pre-fix checks: helper tests exit 1 (9 pass, 6 fail); ToolErrorCard browser matrix exit 1 (1 pass, 11 fail).
• Final independent checks with repository-required Bun 1.4.2: bun test src exits 0 (265 pass); package typecheck exits 0; ToolErrorCard browser matrix exits 0 (12 pass); the standard pre-push bun run check exits 0 (36/36 typecheck tasks; lint has advisory warnings, no errors).
• Full component suite also passed: 146/146 on an isolated Storybook port. An earlier run hit rendering timeouts and was interrupted; the complete rerun passed without source changes. Browser clipboard APIs are controlled in these tests; no real OS clipboard integration claim.