@agentsdock/server 1.0.10 → 1.0.11-beta.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsdock/server",
-  "version": "1.0.10",
+  "version": "1.0.11-beta.1",
   "description": "AgentsDock's self-hosted Python server and explicit installation CLI",
   "license": "Apache-2.0",
   "repository": {

package/server/VERSION

@@ -1 +1 @@
-1.0.10
+1.0.11-beta.1

package/server/agent_server.py

@@ -26,6 +26,7 @@ import importlib.util
 import inspect
 import io
 import json
+from transcript_reader import jsonl_records, scan_check, SCAN_SECONDS
 import logging
 import logging.handlers
 import math
@@ -471,39 +472,17 @@ def boolean_setting(suffix: str, default: bool) -> bool:
     return default
 
 
-CODEX_GOALS_DEFAULT_ENABLED = boolean_setting("CODEX_GOALS_ENABLED", True)
+CODEX_GOALS_DEFAULT_ENABLED = True
 
 
 def read_codex_goals_enabled(path: Path | None = None) -> bool:
-    """Read the persistent server-wide Codex goals policy.
+    """Goals are available without a server-wide opt-in.
 
-    Existing installations have no settings file, so goals remain enabled by
-    default.  An environment setting can choose the first-run default, while
-    an administrator's persisted choice remains authoritative afterward.
+    Ignore the retired environment/config switch, including persisted False
+    from older clients. Do not rewrite shared settings or resume paused goals.
+    Keep the optional path argument for compatibility with existing callers.
     """
-
-    settings_path = path or CODEX_SETTINGS_FILE
-    try:
-        value = json.loads(settings_path.read_text())
-    except FileNotFoundError:
-        return CODEX_GOALS_DEFAULT_ENABLED
-    except (json.JSONDecodeError, OSError) as exc:
-        logger.warning(
-            "could not read Codex server settings from %s: %s",
-            settings_path,
-            exc,
-        )
-        return CODEX_GOALS_DEFAULT_ENABLED
-    if not isinstance(value, dict) or not isinstance(
-        value.get("goals_enabled"),
-        bool,
-    ):
-        logger.warning(
-            "ignoring malformed Codex server settings at %s",
-            settings_path,
-        )
-        return CODEX_GOALS_DEFAULT_ENABLED
-    return bool(value["goals_enabled"])
+    return True
 
 
 # Per-thread Codex config overrides (codex-cli 0.149.1: thread/start,
@@ -1319,8 +1298,9 @@ HISTORY_SYNC_EVENT_SCAN_LIMIT = int(
 MAX_IMPORTED_TEXT_CHARS = int(agentsdock_setting("HISTORY_IMPORT_TEXT_CHARS", "12000"))
 MAX_LOCAL_SESSION_LIST_ITEMS = 500
 MAX_LOCAL_SESSION_SCAN_FILES = 10_000
-MAX_LOCAL_TRANSCRIPT_BYTES = 256 * 1024 * 1024
-MAX_LOCAL_TRANSCRIPT_LINE_BYTES = 4 * 1024 * 1024
+# Retained text/metadata budget. Opaque native media/tool bytes are streamed.
+# Private timeline/index readers still use this as their raw record bound.
+MAX_LOCAL_TRANSCRIPT_LINE_BYTES = 32 * 1024 * 1024
 MAX_LOCAL_TRANSCRIPT_SCAN_LINES = 250_000
 MAX_CODEX_SESSION_INDEX_BYTES = 16 * 1024 * 1024
 MAX_CODEX_SESSION_INDEX_LINES = 100_000
@@ -10706,6 +10686,8 @@ class SessionStore:
             "created_at": now,
             "updated_at": now,
         }
+        if not active_provider_id and not parent_id and sess["title"] == "New chat":
+            sess["_empty_chat_cleanup"] = {"version": 1, "dismissed_by": {}}
         if req.subagent_limit is not None:
             sess["subagent_limit"] = req.subagent_limit
         if initializing_fork and parent_id:
@@ -44941,98 +44923,44 @@ def bounded_jsonl_paths(
                     continue
 
 
-def bounded_jsonl_events(path: Path, *, preserve_invalid: bool = False) -> Iterator[dict[str, Any] | None]:
-    """Parse a transcript with hard byte, line-size, and line-count bounds."""
 
-    size = path.stat().st_size
-    if size > MAX_LOCAL_TRANSCRIPT_BYTES:
-        raise ValueError(
-            f"transcript exceeds the {MAX_LOCAL_TRANSCRIPT_BYTES}-byte import limit"
-        )
-    consumed = 0
+
+def bounded_jsonl_events(path: Path, *, preserve_invalid: bool = False) -> Iterator[dict[str, Any] | None]:
+    """Project native records with bounded memory, not a source-byte cap."""
+    initial = path.stat()
+    expected = {field: int(getattr(initial, field)) for field in ("st_dev", "st_ino", "st_size", "st_mtime_ns")}
     with path.open("rb") as stream:
-        for line_number in range(1, MAX_LOCAL_TRANSCRIPT_SCAN_LINES + 1):
-            raw_line = stream.readline(MAX_LOCAL_TRANSCRIPT_LINE_BYTES + 1)
-            if not raw_line:
-                return
-            consumed += len(raw_line)
-            if consumed > MAX_LOCAL_TRANSCRIPT_BYTES:
-                raise ValueError("transcript changed while it was being imported")
-            if len(raw_line) > MAX_LOCAL_TRANSCRIPT_LINE_BYTES:
-                raise ValueError(f"transcript line {line_number} exceeds the import limit")
-            if not raw_line.strip():
-                continue
-            try:
-                event = json.loads(raw_line)
-            except (json.JSONDecodeError, UnicodeDecodeError):
-                if preserve_invalid:
-                    yield None
-                continue
-            if isinstance(event, dict):
+        opened = os.fstat(stream.fileno())
+        if any(int(getattr(opened, field)) != expected[field] for field in expected):
+            raise ValueError("transcript changed before parsing")
+        for event, _end, raw in jsonl_records(stream, end=initial.st_size,
+                require_newline=False, max_records=MAX_LOCAL_TRANSCRIPT_SCAN_LINES,
+                max_retained_bytes=MAX_LOCAL_TRANSCRIPT_LINE_BYTES):
+            if not raw.blank and (event is not None or preserve_invalid):
                 yield event
-            elif preserve_invalid:
-                yield None
-        if stream.read(1):
-            raise ValueError(
-                f"transcript exceeds the {MAX_LOCAL_TRANSCRIPT_SCAN_LINES}-line import limit"
-            )
+        finished = os.fstat(stream.fileno())
+        if any(int(getattr(finished, field)) != expected[field] for field in expected):
+            raise ValueError("transcript changed during parsing")
 
 
 def bounded_jsonl_records_range(
-    path: Path,
-    start: int,
-    end: int,
-    *,
-    expected_stat: dict[str, int],
+    path: Path, start: int, end: int, *, expected_stat: dict[str, int],
+    require_newline: bool = True,
 ) -> Iterator[tuple[dict[str, Any] | None, int]]:
     """Read every record and ending offset in one immutable JSONL range."""
-
-    if start < 0 or end < start or end > MAX_LOCAL_TRANSCRIPT_BYTES:
+    if start < 0 or end < start or end > expected_stat["st_size"]:
         raise ValueError("transcript cursor range is invalid")
-    remaining = end - start
-    if remaining == 0:
-        return
     with path.open("rb") as stream:
         before = os.fstat(stream.fileno())
-        if any(
-            int(getattr(before, field)) != int(expected_stat[field])
-            for field in ("st_dev", "st_ino", "st_size", "st_mtime_ns")
-        ):
+        if any(int(getattr(before, field)) != int(expected_stat[field]) for field in ("st_dev", "st_ino", "st_size", "st_mtime_ns")):
             raise ValueError("transcript changed before cursor parsing")
         stream.seek(start)
-        for line_number in range(1, MAX_LOCAL_TRANSCRIPT_SCAN_LINES + 1):
-            if remaining <= 0:
-                break
-            raw_line = stream.readline(
-                min(MAX_LOCAL_TRANSCRIPT_LINE_BYTES + 1, remaining)
-            )
-            if not raw_line:
-                raise ValueError("transcript was truncated during cursor parsing")
-            remaining -= len(raw_line)
-            if len(raw_line) > MAX_LOCAL_TRANSCRIPT_LINE_BYTES:
-                raise ValueError(
-                    f"transcript cursor line {line_number} exceeds the import limit"
-                )
-            if not raw_line.endswith(b"\n"):
-                raise ValueError("transcript cursor does not end on a complete line")
-            event: dict[str, Any] | None = None
-            if raw_line.strip():
-                try:
-                    loaded = json.loads(raw_line)
-                except (json.JSONDecodeError, UnicodeDecodeError):
-                    loaded = None
-                if isinstance(loaded, dict):
-                    event = loaded
-            yield event, int(stream.tell())
-        if remaining > 0:
-            raise ValueError(
-                f"transcript cursor range exceeds the {MAX_LOCAL_TRANSCRIPT_SCAN_LINES}-line import limit"
-            )
+        for event, offset, _raw in jsonl_records(stream, end=end,
+                require_newline=require_newline, max_records=MAX_LOCAL_TRANSCRIPT_SCAN_LINES,
+                max_retained_bytes=MAX_LOCAL_TRANSCRIPT_LINE_BYTES):
+            yield event, offset
         after = os.fstat(stream.fileno())
-        if any(
-            int(getattr(after, field)) != int(expected_stat[field])
-            for field in ("st_dev", "st_ino", "st_size", "st_mtime_ns")
-        ):
+        if any(int(getattr(after, field)) != int(expected_stat[field]) for field in ("st_dev", "st_ino", "st_size", "st_mtime_ns")):
             raise ValueError("transcript changed during cursor parsing")
 
 
@@ -47494,7 +47422,6 @@ def normalized_history_sync_cursor(
             or int(raw.get(field, 0)) < 0
             for field in optional_integer_fields
         )
-        or int(raw["source_size"]) > MAX_LOCAL_TRANSCRIPT_BYTES
         or int(raw["source_offset"]) > int(raw["source_size"])
         or (
             timeline_pending_active
@@ -47675,10 +47602,6 @@ def provider_history_source_snapshot(
     """Hash a stable transcript through its last complete JSONL record."""
 
     initial = path.stat()
-    if initial.st_size > MAX_LOCAL_TRANSCRIPT_BYTES:
-        raise ValueError(
-            f"transcript exceeds the {MAX_LOCAL_TRANSCRIPT_BYTES}-byte import limit"
-        )
     # Provider CLIs may rotate a JSONL file with atomic replacement or move it
     # between dated directories. Backend/provider identity is validated before
     # this helper; byte-for-byte prefix continuity is authoritative across a
@@ -47693,7 +47616,8 @@ def provider_history_source_snapshot(
     prefix_digest = hashlib.sha256() if verify_offset is not None else None
     prefix_hashed = 0
     complete_size = 0
-    pending = b""
+    running_digest = hashlib.sha256()
+    deadline = time.monotonic() + SCAN_SECONDS
     with path.open("rb") as stream:
         opened = os.fstat(stream.fileno())
         expected_identity = (
@@ -47719,15 +47643,15 @@ def provider_history_source_snapshot(
                 take = min(len(chunk), int(verify_offset) - prefix_hashed)
                 prefix_digest.update(chunk[:take])
                 prefix_hashed += take
-            pending += chunk
-            newline = pending.rfind(b"\n")
+            scan_check(deadline, budget_seconds=SCAN_SECONDS)
+            newline = chunk.rfind(b"\n")
             if newline >= 0:
-                complete = pending[:newline + 1]
-                complete_digest.update(complete)
-                complete_size += len(complete)
-                pending = pending[newline + 1:]
-            if len(pending) > MAX_LOCAL_TRANSCRIPT_LINE_BYTES:
-                raise ValueError("incomplete transcript line exceeds the import limit")
+                running_digest.update(chunk[:newline + 1])
+                complete_digest = running_digest.copy()
+                complete_size = int(initial.st_size) - remaining - len(chunk) + newline + 1
+                running_digest.update(chunk[newline + 1:])
+            else:
+                running_digest.update(chunk)
         finished = os.fstat(stream.fileno())
         if (
             int(finished.st_dev),
@@ -50280,6 +50204,9 @@ def public_session(sess: dict[str, Any], *, summary: bool = False) -> dict[str,
     # Provider ids are intentionally omitted from summary responses, but the
     # UI still needs the authoritative first-turn backend fence.
     public["backend_locked"] = session_backend_locked(sess)
+    # Capability, not proof of emptiness: dismiss-empty repeats the full proof.
+    if sess.get("title") == "New chat" and not public["backend_locked"]:
+        public["empty_chat_cleanup"] = "client-v1"
     public["codex_provider"] = codex_provider.session_choice(sess.get("codex_provider"))
     connection = sess.get("provider_connection") or "default"
     # Keep legacy native summaries sparse, but retain a stored default as the
@@ -54177,26 +54104,29 @@ async def refresh_codex_app_server_binary(*, force: bool = False) -> None:
     schedule_codex_manager_drain()
 
 
-async def refresh_codex_app_server_login(*, request_handoff: bool = False) -> None:
+async def refresh_codex_app_server_login(*, request_handoff: bool = False, source: str = "manager_lookup") -> bool:
     """Change normal-Codex admission; never kill a credential-owning process.
 
-    Catalog refresh only observes the native login revision. Only an explicit
-    provider reload requests handoff for opaque credential stores. Neither
-    operation logs in or rotates native credentials.
+    Ordinary lookups/catalog refreshes only observe native file revisions.
+    Explicit native-admin login reload also covers opaque credential stores.
+    This is not a token refresh or login operation.
     """
     global CODEX_APP_SERVER_MANAGER, CODEX_LOGIN_REVISION
     if CODEX_TRANSPORT == CODEX_TRANSPORT_EXEC or CODEX_AUTH_LOCK.locked() or CODEX_MANAGER_CLOSING:
-        return
+        return False
+    # Sources are server-owned labels, never request text, account IDs or keys.
+    if source not in {"manager_lookup", "turn_admission", "account_status", "catalog_refresh", "manual_login_reload"}:
+        source = "manager_lookup"
     async with CODEX_LOGIN_PROBE_LOCK:
         if not await asyncio.to_thread(codex_auth.native_login_handoff_supported,
                 codex_app_server_env(), cwd=existing_cwd(DEFAULT_CWD)):
-            return
+            return False
         revision = await asyncio.to_thread(codex_auth.native_login_revision,
             codex_app_server_env(), cwd=existing_cwd(DEFAULT_CWD))
         async with CODEX_GOALS_CONFIG_LOCK:
             async with CODEX_APP_SERVER_MANAGER_LOCK:
                 if CODEX_APP_SERVER_MANAGER_CLEANUP_EPOCH is not None or CODEX_AUTH_LOCK.locked() or CODEX_MANAGER_CLOSING:
-                    return
+                    return False
                 observed_change = revision is not None and revision != CODEX_LOGIN_REVISION
                 CODEX_LOGIN_REVISION = revision
                 if observed_change or request_handoff:
@@ -54212,12 +54142,17 @@ async def refresh_codex_app_server_login(*, request_handoff: bool = False) -> No
                     if revision is not None and revision == previous:
                         manager._agentsdock_login_superseded = False
                     if changed or (request_handoff and revision is None):
+                        if getattr(manager, "_agentsdock_login_superseded", False) is not True:
+                            reason = "login_revision_changed" if changed else "explicit_reload_opaque_login"
+                            manager._agentsdock_login_handoff_source = source
+                            logger.info("Codex login handoff requested source=%s reason=%s manager=%x", source, reason, id(manager))
                         manager._agentsdock_login_superseded = True
                         if not any(manager is item for item in CODEX_RETIRED_APP_SERVER_MANAGERS):
                             CODEX_RETIRED_APP_SERVER_MANAGERS.append(manager)
                         if CODEX_APP_SERVER_MANAGER is manager:
                             CODEX_APP_SERVER_MANAGER = None
     schedule_codex_manager_drain()
+    return True
 
 
 def codex_manager_session_blocker(manager: CodexAppServerManager, session_id: str, *, ignore_task=None, ignore_maintenance=False) -> str | None:
@@ -54320,6 +54255,17 @@ def watch_codex_provider_handoff_blockers(
 
 async def release_idle_codex_manager_session(manager: CodexAppServerManager, session_id: str, *, ignore_task=None) -> bool:
     """Called under the session lifecycle lock; retain ownership on any doubt."""
+    def retained(reason: str) -> bool:
+        if getattr(manager, "_agentsdock_login_superseded", False) is True:
+            reasons = getattr(manager, "_agentsdock_login_handoff_blockers", None)
+            if reasons is None:
+                reasons = manager._agentsdock_login_handoff_blockers = {}
+            if reasons.get(session_id) != reason:
+                reasons[session_id] = reason
+                logger.info("Codex login handoff waiting source=%s manager=%x session=%s reason=%s",
+                    getattr(manager, "_agentsdock_login_handoff_source", "unknown"), id(manager), session_id, reason)
+        return False
+
     def blocked(*, own_maintenance=False):
         return (codex_manager_session_busy(manager, session_id, ignore_task=ignore_task,
                     ignore_maintenance=own_maintenance)
@@ -54360,7 +54306,7 @@ async def release_idle_codex_manager_session(manager: CodexAppServerManager, ses
                 sum(not task.done() for task in manager.client._server_request_tasks.values()),
                 error_type,
             )
-        return False
+        return retained(reasons[session_id])
 
     if blocked():
         return await defer("runtime_borrowers")
@@ -54440,6 +54386,10 @@ async def release_idle_codex_manager_session(manager: CodexAppServerManager, ses
         if CODEX_SESSION_APP_SERVER_MANAGERS.get(session_id) is manager:
             CODEX_SESSION_APP_SERVER_MANAGERS.pop(session_id, None)
             CODEX_GOAL_SYNC_GENERATIONS.pop(session_id, None)
+        if getattr(manager, "_agentsdock_login_superseded", False) is True:
+            getattr(manager, "_agentsdock_login_handoff_blockers", {}).pop(session_id, None)
+            logger.info("Codex login handoff released source=%s manager=%x session=%s",
+                getattr(manager, "_agentsdock_login_handoff_source", "unknown"), id(manager), session_id)
         return True
     except Exception as exc:
         logger.debug("Codex handoff retained an unverified idle owner", exc_info=True)
@@ -54459,7 +54409,7 @@ async def prepare_codex_login_turn(session: dict[str, Any]) -> None:
             session.pop("_codex_provider_pending", None)
     if codex_provider.session_choice(session.get("codex_provider")) == "custom":
         return
-    await refresh_codex_app_server_login()
+    await refresh_codex_app_server_login(source="turn_admission")
     session_id = str(session.get("id") or "")
     manager = existing_codex_app_server_manager(session)
     if getattr(manager, "_agentsdock_login_superseded", False) is not True:
@@ -54618,9 +54568,8 @@ async def codex_app_server_manager(sess: dict[str, Any] | None = None, *, allow_
     selected = CODEX_PROVIDER_STORE.for_session(sess, include_key=True) if sess is not None else None
     revision = selected["credential_id"] if selected else None
     session_id = str((sess or {}).get("id") or "")
-    # Goal enablement is a process launch flag. Manager lookup therefore takes
-    # the same barrier as configuration replacement, including the fast path;
-    # no caller can retain/create the old generation halfway through a toggle.
+    # Manager lookup shares the provider reconfiguration barrier, including the
+    # fast path, so a sign-in reload cannot race a retained/created generation.
     async with CODEX_GOALS_CONFIG_LOCK:
         ensure_provider_manager_factory_admission(codex=True)
         manager = existing_codex_app_server_manager(sess) if sess is not None else None
@@ -78295,6 +78244,7 @@ async def require_agent_token(request: Request, call_next):
     codex_goals_admin_route = request.url.path in {
         "/api/admin/codex/goals", "/api/admin/codex/subagents",
         "/api/admin/codex/auth", "/api/admin/codex/auth/api-key",
+        "/api/admin/codex/auth/reload",
         "/api/admin/codex/provider", "/api/admin/codex/provider/test",
         "/api/admin/codex/provider/models",
         "/api/admin/provider-connections/claude", "/api/admin/provider-connections/claude/check",
@@ -78483,7 +78433,7 @@ async def require_agent_token(request: Request, call_next):
             if body_error is not None:
                 status_code, detail = body_error
                 return JSONResponse({"detail": detail}, status_code=status_code)
-        elif request.url.path == "/api/admin/codex/auth/api-key" and request.method.upper() == "POST":
+        elif request.url.path in {"/api/admin/codex/auth/api-key", "/api/admin/codex/auth/reload"} and request.method.upper() == "POST":
             declared_size, transport_error = privileged_native_json_transport(
                 request, max_body_bytes=codex_auth.MAX_BODY_BYTES,
                 label="Codex authentication", require_content_length=True,
@@ -81302,15 +81252,11 @@ def codex_goals_admin_status() -> dict[str, Any]:
     enabled = bool(CODEX_GOALS_ENABLED)
     return {
         "enabled": enabled,
-        "configurable": True,
+        "configurable": False,
         "default_enabled": bool(CODEX_GOALS_DEFAULT_ENABLED),
         "scope": "server",
         "reconfiguring": bool(CODEX_GOALS_RECONFIGURING),
-        "message": (
-            "Persistent Codex goals are enabled for this server."
-            if enabled
-            else "Persistent Codex goals are disabled for this server."
-        ),
+        "message": "Persistent Codex goals are always available. Manage each goal in its chat.",
     }
 
 
@@ -82134,36 +82080,14 @@ async def get_codex_goals_admin() -> dict[str, Any]:
 async def put_codex_goals_admin(
     req: CodexGoalsAdminRequest,
 ) -> dict[str, Any]:
-    global CODEX_GOALS_ENABLED
-    async with CODEX_GOALS_CONFIG_LOCK:
-        requested = bool(req.enabled)
-        if requested == CODEX_GOALS_ENABLED:
-            return codex_goals_admin_status()
-        settings = read_codex_admin_settings()
-        await reserve_codex_goals_reconfiguration()
-        transition: dict[str, int] = {
-            "paused_goal_count": 0,
-            "fenced_goal_count": 0,
-        }
-        try:
-            if not requested:
-                transition = await pause_idle_codex_goals_before_disable()
-            # The feature flag is a process-level Codex setting. Replacing the
-            # shared, idle manager is the only way to make it authoritative for
-            # every loaded and future thread.
-            await close_codex_app_server_manager()
-            atomic_update_json(
-                CODEX_SETTINGS_FILE,
-                {
-                    **settings,
-                    "goals_enabled": requested,
-                    "updated_at": update_utc_now(),
-                },
-            )
-            CODEX_GOALS_ENABLED = requested
-        finally:
-            await release_codex_goals_reconfiguration()
-        return {**codex_goals_admin_status(), **transition}
+    # Preserve the authenticated legacy route without allowing an older client
+    # to disable goals for every chat or restart the shared provider manager.
+    if not req.enabled:
+        raise HTTPException(
+            status_code=409,
+            detail="Persistent Codex goals cannot be disabled server-wide. Pause individual goals in their chats.",
+        )
+    return codex_goals_admin_status()
 
 
 def require_native_admin_control(request: Request) -> None:
@@ -82187,7 +82111,7 @@ def require_native_admin_control(request: Request) -> None:
 async def codex_auth_operation(*, mutate: bool, existing_only: bool = False):
     """Fence native authentication changes with the existing Codex admission barrier."""
     if not mutate:
-        await refresh_codex_app_server_login()
+        await refresh_codex_app_server_login(source="account_status")
     async with CODEX_AUTH_LOCK:
         reserved = False
         try:
@@ -82224,10 +82148,20 @@ async def codex_auth_operation(*, mutate: bool, existing_only: bool = False):
                 await release_codex_goals_reconfiguration()
 
 
+async def reload_codex_login() -> bool:
+    logger.info("Codex login reload requested source=manual_login_reload")
+    if not await refresh_codex_app_server_login(request_handoff=True, source="manual_login_reload"):
+        logger.info("Codex login reload deferred source=manual_login_reload reason=unavailable_or_busy")
+        raise HTTPException(409, "Codex sign-in cannot be reloaded now. Its credential store is unsupported or maintenance is active.")
+    return any(getattr(manager, "_agentsdock_login_superseded", False) is True
+               for manager in codex_app_server_managers())
+
+
 app.include_router(codex_auth.create_router(
     authorize=require_native_admin_control,
     operation=codex_auth_operation,
     available=lambda: CODEX_TRANSPORT != CODEX_TRANSPORT_EXEC,
+    reload_login=reload_codex_login,
 ))
 
 
@@ -85787,7 +85721,7 @@ async def host_diagnostics(limit: int = 40) -> dict[str, Any]:
 async def runtime_catalog(refresh: bool = False) -> dict[str, Any]:
     if refresh:
         await refresh_codex_app_server_binary(force=True)
-        await refresh_codex_app_server_login()
+        await refresh_codex_app_server_login(source="catalog_refresh")
     return await asyncio.to_thread(discover_runtime_catalog, force_runtime_probe=refresh)
 
 
@@ -85908,12 +85842,13 @@ async def tail_session_process_log(session_id: str, path: str, lines: int = 200)
 
 
 @app.get("/api/sessions")
-async def list_sessions(summary: bool = False) -> dict[str, Any]:
+async def list_sessions(summary: bool = False, placeholder_client_id: str = "") -> dict[str, Any]:
     await STORE.ensure_sort_orders()
     sessions = [
         public_session(session, summary=summary)
         for session in sorted_sessions(list(STORE.sessions.values()))
         if not session.get("_fork_initializing")
+        and not empty_chat_dismissed_for(session, placeholder_client_id)
     ]
     return {"sessions": sessions}
 
@@ -89520,6 +89455,74 @@ async def ensure_discardable_empty_session(session_id: str, expected_updated_at:
         raise HTTPException(status_code=409, detail="Chat has content or resources; it was preserved.")
 
 
+def empty_chat_revision(session: dict[str, Any]) -> str:
+    # Use durable content/settings, not public runtime projections, read cursors
+    # or sort order. Reconnecting, reading or normalizing runtime metadata on
+    # startup must not resurrect an unchanged blank row.
+    revision = {key: session.get(key) for key in (
+        "created_at", "updated_at", "title", "folder", "cwd", "backend",
+        "model", "effort", "system_prompt", "_title_source",
+        "codex_provider", "provider_connection", "parent_id",
+        "codex_goal", "claude_goal",
+    )}
+    revision["latest_event_seq"] = int(session.get("latest_event_seq") or 0)
+    for key in ("backend_locked", "pinned", "archived", "manual_unread"):
+        revision[key] = bool(session.get(key))
+    return hashlib.sha256(json.dumps(revision, sort_keys=True,
+                                     separators=(",", ":")).encode()).hexdigest()
+
+
+def empty_chat_dismissed_for(session: dict[str, Any], client_id: str) -> bool:
+    if not client_id or session_backend_locked(session):
+        return False
+    state = session.get("_empty_chat_cleanup") or {}
+    return (isinstance(state, dict) and state.get("version") == 1
+            and isinstance(state.get("dismissed_by"), dict)
+            and state["dismissed_by"].get(client_id) == empty_chat_revision(session))
+
+
+@app.post("/api/sessions/{session_id}/dismiss-empty")
+async def dismiss_empty_session(session_id: str, expected_updated_at: str,
+                                placeholder_client_id: str) -> dict[str, Any]:
+    """Remove an unused row from one desktop's list without deleting its identity.
+
+    Another/offline desktop may own an unsent draft. Its list is unaffected;
+    subsequent real changes also invalidate this desktop's dismissal. No draft
+    content leaves a desktop, and no native history/process is touched.
+    """
+    if not re.fullmatch(r"[a-zA-Z0-9_-]{16,80}", placeholder_client_id):
+        raise HTTPException(400, "Invalid placeholder client identity")
+    await wait_for_queue_recovery_admission()
+    async with session_lifecycle_lock(session_id):
+        ensure_session_not_initializing(session_id)
+        if session_id in DELETING_SESSIONS or session_id in DELETED_SESSION_TOMBSTONES:
+            raise HTTPException(409, "Chat deletion is already in progress")
+        # Existing admission, uploads, jobs and terminal routes use this fence.
+        DELETING_SESSIONS.add(session_id)
+        try:
+            await ensure_discardable_empty_session(session_id, expected_updated_at)
+            async with STORE._lock:
+                session = STORE.sessions[session_id]
+                previous = session.get("_empty_chat_cleanup")
+                state = previous if isinstance(previous, dict) else {}
+                dismissed = dict(state.get("dismissed_by") or {})
+                if placeholder_client_id not in dismissed and len(dismissed) >= 256:
+                    raise HTTPException(409, "Too many desktop cleanup identities; chat preserved")
+                dismissed[placeholder_client_id] = empty_chat_revision(session)
+                session["_empty_chat_cleanup"] = {"version": 1, "dismissed_by": dismissed}
+                try:
+                    await STORE.save()
+                except BaseException:
+                    if previous is None:
+                        session.pop("_empty_chat_cleanup", None)
+                    else:
+                        session["_empty_chat_cleanup"] = previous
+                    raise
+            return {"ok": True, "dismissed": True}
+        finally:
+            DELETING_SESSIONS.discard(session_id)
+
+
 @app.post("/api/sessions/{session_id}/discard-empty")
 async def discard_empty_session(session_id: str, expected_updated_at: str) -> dict[str, Any]:
     # A separate route makes old servers fail safely with 404, rather than
@@ -90024,19 +90027,20 @@ def claude_imported_fork_boundary(
     digest = hashlib.sha256()
     last_message: dict[str, Any] = {}
     with path.open("rb") as stream:
-        for _line in range(MAX_LOCAL_TRANSCRIPT_SCAN_LINES):
-            if not remaining:
-                break
-            raw = stream.readline(min(MAX_LOCAL_TRANSCRIPT_LINE_BYTES + 1, remaining))
-            if not raw or not raw.endswith(b"\n") or len(raw) > MAX_LOCAL_TRANSCRIPT_LINE_BYTES:
-                raise ValueError("imported history checkpoint has an incomplete transcript record")
-            remaining -= len(raw)
-            digest.update(raw)
-            if not raw.strip():
+        original = os.fstat(stream.fileno())
+        for record, offset, raw in jsonl_records(stream, end=remaining,
+                max_records=MAX_LOCAL_TRANSCRIPT_SCAN_LINES):
+            raw.update_hash(digest)
+            remaining = int(cursor["source_offset"]) - offset
+            if raw.blank:
                 continue
-            record = json.loads(raw)
-            if isinstance(record, dict) and record.get("type") in {"user", "assistant"} and not record.get("isSidechain"):
+            if record is None:
+                raise ValueError("imported history checkpoint has a malformed transcript record")
+            if record.get("type") in {"user", "assistant"} and not record.get("isSidechain"):
                 last_message = record
+        current = os.fstat(stream.fileno())
+        if (original.st_dev, original.st_ino, original.st_size, original.st_mtime_ns) != (current.st_dev, current.st_ino, current.st_size, current.st_mtime_ns):
+            raise ValueError("imported history checkpoint changed during reading")
     if remaining or not hmac.compare_digest(digest.hexdigest(), cursor["source_digest"]):
         raise ValueError("imported history checkpoint no longer matches its native prefix")
     message = last_message.get("message")