@cjhyy/code-shell-core 0.9.5 → 0.9.7

package/dist/protocol/server.js

@@ -17,8 +17,13 @@ import { Methods, ErrorCodes, createResponse, createErrorResponse, createNotific
 import { diskDefaultsFrom } from "../engine/engine.js";
 import { ISOLATED_TASK_BEHAVIOR_MODE } from "../engine/run-types.js";
 import { isProtectedSettingKey, SettingsManager } from "../settings/manager.js";
-import { getApprovalRouter, getInteractiveApprovalBackend, } from "../tool-system/permission.js";
+import { sessionMessageOutcome, sessionMessageFailure, sessionMessageResultNotification, } from "./session-message-result.js";
+import { resolveSessionMessageWorkspace } from "./session-message-workspace.js";
+import { validateWorkspaceContext, workspacePrimaryRoot } from "../workspace/workspace-context.js";
+import { canonicalKey } from "../workspace/canonical-key.js";
+import { getApprovalRouter, getInteractiveApprovalBackend, InteractiveApprovalBackend, } from "../tool-system/permission.js";
 import { agentNotificationBus, notificationQueue, notificationEnvelopeToLegacyStreamEvent, } from "../tool-system/builtin/agent-notifications.js";
+import { clearSessionPathApprovals, openSessionPathApprovals } from "../tool-system/path-policy.js";
 import { backgroundShellManager } from "../runtime/background-shell.js";
 import { backgroundJobRegistry } from "../tool-system/builtin/background-jobs.js";
 import { listBackgroundWorkForUI } from "../tool-system/builtin/background-work.js";
@@ -168,6 +173,7 @@ const COMPACT_STREAM_STRATEGIES = new Set([
     // Range archival (archive_range query) emits its boundary through this map;
     // without "range" here it would be silently downgraded to "compacted".
     "range",
+    "notes",
 ]);
 function toCompactStreamStrategy(strategy) {
     return COMPACT_STREAM_STRATEGIES.has(strategy)
@@ -318,6 +324,7 @@ export class AgentServer {
     panelBridgeEnabled;
     connectionId;
     strictApprovalRouting;
+    childHostDisposers = new Map();
     approvalRouter;
     approvalConnectionUnregister = null;
     disconnected = false;
@@ -593,6 +600,13 @@ export class AgentServer {
             approvalRouter: this.approvalRouter,
             onStream: (event) => this.notify(Methods.StreamEvent, { sessionId, event }),
             notificationMailbox: this.notificationMailbox,
+            resolveWorkspace: this.workspaceBridgeEnabled
+                ? async (session) => {
+                    const slice = await this.resolveHostSessionWorkspace(session, sessionId);
+                    this.rememberSessionSlice(sessionId, slice);
+                    return slice;
+                }
+                : undefined,
         });
     }
     async rehydrateSessionForWake(sessionId) {
@@ -622,7 +636,8 @@ export class AgentServer {
                 });
                 return null;
             }
-            const session = await this.chatManager.getOrCreate(sessionId, slice);
+            const session = await this.chatManager.getOrCreate(sessionId, slice, { allowReopen: false });
+            session.engine.restoreSessionModel?.(sessionId);
             this.wireInteractiveSession(session, sessionId);
             logger.debug("bg_wakeup.rehydrated_session", {
                 sessionId,
@@ -662,6 +677,151 @@ export class AgentServer {
         session.engine.setAskUser((question, opts) => this.requestAskUserForSession(session, sid, question, opts));
         session.engine.setBrowserBridge(this.makeBrowserBridge(session, sid));
         session.engine.setInjectCredential((credentialId, credentialScope) => this.requestCredentialInjectForSession(session, sid, credentialId, credentialScope));
+        session.engine.setChildHostBindings?.((input) => {
+            if (input.parentSessionId !== sid)
+                throw new Error("child host parent identity mismatch");
+            assertSafeSessionId(input.sessionId);
+            const route = this.approvalRouter.current(sid);
+            if (!route || route.connectionId !== this.connectionId) {
+                throw new Error("child host unavailable: parent approval connection no longer owns session");
+            }
+            const backend = new InteractiveApprovalBackend();
+            backend.openSession(input.sessionId);
+            let active = false;
+            let closed = false;
+            let closedFailure = {
+                failure: "cancelled",
+                reason: "child run ended or was cancelled",
+            };
+            const scope = {
+                sourceSessionId: input.sessionId,
+                bindingId: nanoid(),
+                route,
+                pending: new Set(),
+                failure: () => {
+                    if (closed || input.signal?.aborted)
+                        return closedFailure;
+                    if (this.chatManager?.get(sid) !== session)
+                        return { failure: "session_closed", reason: "parent host session closed" };
+                    if (this.disconnected || !this.approvalRouter.matches(route))
+                        return { failure: "owner_lost", reason: "parent host approval ownership changed" };
+                    return undefined;
+                },
+            };
+            backend.setRequestGuard((request) => {
+                const failure = scope.failure();
+                if (failure)
+                    return { approved: false, ...failure };
+                if (request.sessionId !== input.sessionId)
+                    return {
+                        approved: false,
+                        failure: "owner_lost",
+                        reason: "child approval identity mismatch",
+                    };
+                return undefined;
+            });
+            backend.setPromptFn((request) => {
+                const failure = scope.failure();
+                if (failure)
+                    return Promise.resolve({ approved: false, ...failure });
+                if (request.sessionId !== input.sessionId) {
+                    return Promise.resolve({
+                        approved: false,
+                        failure: "owner_lost",
+                        reason: "child approval identity mismatch",
+                    });
+                }
+                return this.requestApprovalFromClient(request, route, scope);
+            });
+            const dispose = () => {
+                if (closed)
+                    return;
+                closed = true;
+                input.signal?.removeEventListener("abort", dispose);
+                this.childHostDisposers.delete(scope.bindingId);
+                backend.clearSession(input.sessionId);
+                if (active)
+                    clearSessionPathApprovals(input.sessionId);
+                for (const id of scope.pending) {
+                    const entry = this.takeSessionApproval(session, id, "cancelled");
+                    this.clearApprovalTimer(id);
+                    this.pendingApprovalTargets.delete(id);
+                    entry?.resolve(entry.metadata.kind === "internal"
+                        ? internalCancellation(closedFailure.failure, closedFailure.reason)
+                        : {
+                            approved: false,
+                            ...closedFailure,
+                        });
+                    try {
+                        this.notify(Methods.ApprovalResolved, { sessionId: sid, requestId: id });
+                    }
+                    catch {
+                        /* transport may already be closed */
+                    }
+                }
+                scope.pending.clear();
+                // One-way release uses the existing private host channel; it is never
+                // a model tool and never inherits a parent tab handoff grant.
+                try {
+                    this.notify(Methods.ApprovalRequest, {
+                        sessionId: sid,
+                        requestId: nanoid(12),
+                        childHost: {
+                            sourceSessionId: input.sessionId,
+                            bindingId: scope.bindingId,
+                            release: true,
+                        },
+                        request: {
+                            toolName: "__browser_action__",
+                            args: { action: "release" },
+                            description: "release child browser",
+                            riskLevel: "low",
+                        },
+                    });
+                }
+                catch {
+                    /* resource owner also closes targets on host teardown */
+                }
+            };
+            this.childHostDisposers.set(scope.bindingId, {
+                route,
+                dispose: (reason) => {
+                    closedFailure = { failure: "owner_lost", reason };
+                    dispose();
+                },
+            });
+            input.signal?.addEventListener("abort", dispose, { once: true });
+            if (input.signal?.aborted)
+                dispose();
+            return {
+                activate: () => {
+                    if (!closed && !active) {
+                        this.notify(Methods.ApprovalRequest, {
+                            sessionId: sid,
+                            requestId: nanoid(12),
+                            childHost: {
+                                sourceSessionId: input.sessionId,
+                                bindingId: scope.bindingId,
+                                activate: true,
+                            },
+                            request: {
+                                toolName: "__browser_action__",
+                                args: { action: "activate" },
+                                description: "bind child browser",
+                                riskLevel: "low",
+                            },
+                        });
+                        active = true;
+                        openSessionPathApprovals(input.sessionId);
+                    }
+                },
+                approvalBackend: backend,
+                browserBridge: this.makeBrowserBridge(session, sid, scope),
+                askUser: (question, opts) => this.requestAskUserForSession(session, sid, question, opts, scope),
+                injectCredentialToBrowser: (id, credentialScope) => this.requestCredentialInjectForSession(session, sid, id, credentialScope, scope),
+                dispose,
+            };
+        });
         session.engine.setSessionMessageRouter((input) => this.routeSessionMessage(input));
         if (this.workspaceBridgeEnabled && typeof session.engine.setWorkspaceBridge === "function") {
             session.engine.setWorkspaceBridge(this.makeWorkspaceBridge(session, sid));
@@ -672,6 +832,7 @@ export class AgentServer {
     }
     /** Queue a model-sent message as an ordinary user turn in another Session. */
     async routeSessionMessage(input) {
+        input.signal?.throwIfAborted();
         const manager = this.chatManager;
         if (!manager)
             throw new Error("cross-Session messaging requires a multi-session host");
@@ -680,12 +841,49 @@ export class AgentServer {
             throw new Error(`target Session is closing or closed: ${targetId}`);
         }
         const sourceSlice = this.lastSliceBySession.get(input.sourceSessionId);
-        const targetSlice = {
-            cwd: input.target.workspaceRoot,
-            projectTrusted: sourceSlice?.projectTrusted ?? false,
+        const sourceSession = manager.get(input.sourceSessionId);
+        const assertStillAuthorized = () => {
+            input.signal?.throwIfAborted();
+            if (this.disconnected || manager.isUnavailable(targetId)) {
+                throw new Error(`target Session is closing or closed: ${targetId}`);
+            }
+            if (sourceSession &&
+                (manager.get(input.sourceSessionId) !== sourceSession ||
+                    sourceSession.wasCancelledSinceLastTurn())) {
+                throw new Error("source Session was cancelled or closed before the message was queued");
+            }
         };
+        let targetSlice;
+        if (this.workspaceBridgeEnabled) {
+            if (!sourceSession)
+                throw new Error("source Session is no longer available");
+            targetSlice = await this.resolveHostSessionWorkspace(sourceSession, targetId);
+        }
+        else {
+            const sessionManager = sourceSession?.engine.getSessionManager?.() ??
+                (this.diskSessionReader ??= new SessionManager(this.sessionDiskRoot));
+            const sourceWorkspace = sourceSession?.engine.resolveSessionRunWorkspace?.(input.sourceSessionId);
+            targetSlice = resolveSessionMessageWorkspace({
+                sessionManager,
+                sourceSessionId: input.sourceSessionId,
+                targetSessionId: targetId,
+                sourceWorkspace: {
+                    cwd: sourceWorkspace?.cwd ?? sourceSlice?.cwd ?? input.target.workspaceRoot,
+                    workspaceContext: sourceWorkspace?.workspaceContext ?? sourceSlice?.workspaceContext,
+                    projectTrusted: sourceSlice?.projectTrusted ?? false,
+                },
+            });
+        }
+        assertStillAuthorized();
         const targetAlreadyExists = manager.sessionExistsOnDisk(targetId, targetSlice);
-        const targetSession = await manager.getOrCreate(targetId, targetSlice);
+        const targetWasResident = manager.get(targetId) !== undefined;
+        const targetSession = await manager.getOrCreate(targetId, targetSlice, {
+            allowReopen: false,
+            signal: input.signal,
+        });
+        assertStillAuthorized();
+        if (targetAlreadyExists && !targetWasResident)
+            targetSession.engine.restoreSessionModel?.(targetId);
         const approvalRegistration = this.approvalRouter.register(targetId, this.connectionId);
         if (!approvalRegistration.ok) {
             throw new Error(`target Session ${targetId} is owned by another connection`);
@@ -693,6 +891,43 @@ export class AgentServer {
         this.rememberSessionSlice(targetId, targetSlice);
         this.observeSessionAttached(targetId, targetSession.lastActivityAt);
         this.wireInteractiveSession(targetSession, targetId);
+        const messageId = `session-message-${nanoid(12)}`;
+        const state = { started: false, acknowledged: false, errorStreamed: false };
+        const finish = (outcome, result) => {
+            state.outcome = outcome;
+            state.result = result;
+            if (state.started)
+                this.observeRunBoundary(targetId, "end");
+            if (outcome.status !== "completed") {
+                logger.warn("session_message.turn_failed", {
+                    sourceSessionId: input.sourceSessionId,
+                    targetSessionId: targetId,
+                    messageId,
+                    error: outcome.error,
+                });
+                // Setup can return a failure without ever emitting an error event.
+                // UI observation must not prevent the durable reply from being queued.
+                try {
+                    if (!state.errorStreamed) {
+                        this.notify(Methods.StreamEvent, {
+                            sessionId: targetId,
+                            event: { type: "error", error: outcome.error ?? "cross-Session message failed" },
+                        });
+                    }
+                }
+                catch (error) {
+                    logger.warn("session_message.error_observation_failed", {
+                        messageId,
+                        error: String(error),
+                    });
+                }
+            }
+            if (state.acknowledged) {
+                this.notificationMailbox.enqueue(sessionMessageResultNotification(input, messageId, outcome));
+            }
+            if (result && result.turnCount > 0)
+                void this.maybeWakeIdleSession(targetId);
+        };
         const userMessageEvent = {
             type: "session_user_message",
             text: input.message,
@@ -700,50 +935,43 @@ export class AgentServer {
         this.observeSessionStream(targetId, userMessageEvent);
         this.notify(Methods.StreamEvent, { sessionId: targetId, event: userMessageEvent });
         const run = targetSession.enqueueTurn(input.message, {
-            cwd: input.target.workspaceRoot,
+            cwd: targetSlice.cwd,
+            workspaceContext: targetSlice.workspaceContext,
             // A planned Session needs its renderer-selected initial profile. Once a
             // Session exists, omitting this field makes Engine use the target's own
             // persisted binding, so a stale source catalog cannot switch it back.
             workspaceProfile: targetAlreadyExists ? undefined : input.target.workspaceProfile,
             sessionMessageTargets: input.catalog,
             onStream: (event) => {
+                if (event.type === "session_started" && !state.started) {
+                    state.started = true;
+                    this.observeRunBoundary(targetId, "start");
+                }
+                if (event.type === "error")
+                    state.errorStreamed = true;
                 this.observeSessionStream(targetId, event);
                 this.notify(Methods.StreamEvent, { sessionId: targetId, event });
             },
             approvalRouter: this.approvalRouter,
         });
-        // The turn itself must NOT block the sender — a member's work can take
-        // minutes and the lead has more to dispatch. But a turn that fails to *start*
-        // (most often: the target's digital human is not installed, so run-setup
-        // throws "Workspace profile ... is unavailable") used to be reported only to
-        // the log while SendMessageToSession still answered "has queued the turn".
-        // A real lead then waited two hours and re-sent, never learning the reason.
-        // So: surface an immediate failure to the caller, keep a slow turn detached.
-        let startupError;
-        const tracked = run
-            .then(() => this.maybeWakeIdleSession(targetId))
-            .catch((error) => {
-            startupError = error;
-            logger.warn("session_message.turn_failed", {
-                sourceSessionId: input.sourceSessionId,
-                targetSessionId: targetId,
-                error: error instanceof Error ? error.message : String(error),
-            });
-            this.notify(Methods.StreamEvent, {
-                sessionId: targetId,
-                event: {
-                    type: "error",
-                    error: error instanceof Error ? error.message : "cross-Session message failed",
-                },
-            });
-        });
-        // One macrotask is enough for a synchronous-throw path to settle; anything
-        // still running by then is genuine work and stays detached.
+        const tracked = run.then((result) => finish(sessionMessageOutcome(result), result), (error) => finish(sessionMessageFailure(error)));
+        // Acknowledge promptly, but never infer "started" from elapsed time. If
+        // setup/work is still pending, its eventual outcome takes the mailbox path.
         await Promise.race([tracked, new Promise((resolve) => setTimeout(resolve, 0))]);
-        if (startupError) {
-            throw startupError instanceof Error ? startupError : new Error(String(startupError));
+        if (state.outcome) {
+            if (state.outcome.status !== "completed")
+                throw new Error(state.outcome.error);
+            return {
+                messageId,
+                status: "completed",
+                result: { text: state.outcome.text, reason: state.result.reason },
+            };
         }
-        void tracked;
+        state.acknowledged = true;
+        void tracked.catch((error) => {
+            logger.warn("session_message.result_delivery_failed", { messageId, error: String(error) });
+        });
+        return { messageId, status: state.started ? "started" : "queued" };
     }
     // ─── Request Dispatch ───────────────────────────────────────────
     async handleRequest(req) {
@@ -1233,6 +1461,7 @@ export class AgentServer {
                     (params.goal != null && typeof params.goal === "object")
                     ? params.goal
                     : undefined,
+                disableGoal: params.disableGoal === true,
                 onStream: (event) => {
                     this.observeSessionStream(sid, event);
                     this.notify(Methods.StreamEvent, { sessionId: sid, event });
@@ -1510,7 +1739,7 @@ export class AgentServer {
         }
         this.abortController.abort();
         for (const [, resolve] of this.pendingApprovals) {
-            resolve({ approved: false, reason: "cancelled" });
+            resolve({ approved: false, failure: "cancelled", reason: "cancelled" });
         }
         this.pendingApprovals.clear();
         this.clearAllApprovalTimers();
@@ -2714,7 +2943,10 @@ export class AgentServer {
     /**
      * Ask the client to approve a tool operation (legacy single-engine path).
      */
-    requestApprovalFromClient(request, route) {
+    requestApprovalFromClient(request, route, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ approved: false, ...failure });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const effectiveRoute = route ?? {
@@ -2725,7 +2957,11 @@ export class AgentServer {
             const sessionId = effectiveRoute.sessionId;
             const session = this.chatManager && sessionId ? this.chatManager.get(sessionId) : undefined;
             if (this.chatManager && sessionId && !session) {
-                resolve({ approved: false, reason: `session closed: ${sessionId}` });
+                resolve({
+                    approved: false,
+                    failure: "session_closed",
+                    reason: `session closed: ${sessionId}`,
+                });
                 return;
             }
             if (session) {
@@ -2743,7 +2979,7 @@ export class AgentServer {
                     createdAt: Date.now(),
                     expiresAt: Date.now() + AgentServer.APPROVAL_TIMEOUT_MS,
                     surfaceable: !internal,
-                }, (decision) => resolve(decision));
+                }, (decision) => resolve(decision), scope);
             }
             else {
                 this.pendingApprovals.set(requestId, resolve);
@@ -2760,7 +2996,8 @@ export class AgentServer {
                     }
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
-                    resolve({ approved: false, reason: "approval timed out" });
+                    scope?.pending.delete(requestId);
+                    resolve({ approved: false, failure: "timed_out", reason: "approval timed out" });
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
@@ -2788,7 +3025,10 @@ export class AgentServer {
      * renderer routes the question to the right chat tab. This intentionally has
      * no wall-clock timeout; Stop/cancel drains the pending ask.
      */
-    requestAskUserForSession(session, sessionId, question, opts) {
+    requestAskUserForSession(session, sessionId, question, opts, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve(`(question ${failure.failure}: ${failure.reason})`);
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -2813,7 +3053,7 @@ export class AgentServer {
                     // chatManager approve handler resolves with the raw decision value.
                     resolve(typeof decision === "string" ? decision : "");
                 }
-            });
+            }, scope);
             const args = { question };
             if (opts?.header !== undefined)
                 args.header = opts.header;
@@ -2825,6 +3065,7 @@ export class AgentServer {
                 args.optionsOnly = opts.optionsOnly;
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope ? { sourceSessionId: scope.sourceSessionId } : {}),
                 request: {
                     toolName: "__ask_user__",
                     args,
@@ -2872,8 +3113,8 @@ export class AgentServer {
      * result string we parse back into the typed result. On timeout / malformed
      * reply we degrade to a safe error result rather than throwing.
      */
-    makeBrowserBridge(session, sessionId) {
-        const call = (action, payload) => this.requestBrowserActionForSession(session, sessionId, action, payload);
+    makeBrowserBridge(session, sessionId, scope) {
+        const call = (action, payload) => this.requestBrowserActionForSession(session, sessionId, action, payload, scope);
         return {
             requestHumanTakeover: () => call("requestTakeover", {}),
             snapshot: () => call("snapshot", {}),
@@ -2893,7 +3134,10 @@ export class AgentServer {
             switchTab: (tabId) => call("switchTab", { tabId }),
         };
     }
-    requestBrowserActionForSession(session, sessionId, action, payload) {
+    requestBrowserActionForSession(session, sessionId, action, payload, scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ ok: false, failure: failure.failure, detail: failure.reason });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -2905,12 +3149,13 @@ export class AgentServer {
                 resolve(parsed.ok
                     ? parsed.value
                     : { ok: false, failure: parsed.failure, detail: parsed.detail });
-            });
+            }, scope);
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
+                    scope?.pending.delete(requestId);
                     resolve({
                         ok: false,
                         failure: "timed_out",
@@ -2921,6 +3166,9 @@ export class AgentServer {
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope
+                    ? { childHost: { sourceSessionId: scope.sourceSessionId, bindingId: scope.bindingId } }
+                    : {}),
                 request: {
                     toolName: "__browser_action__",
                     args: { action, ...payload },
@@ -2936,7 +3184,10 @@ export class AgentServer {
      * calls restoreCookiesToBrowser and replies with a JSON result string we
      * parse into { ok, count?, error? }. Degrades to ok:false on timeout/malformed.
      */
-    requestCredentialInjectForSession(session, sessionId, credentialId, credentialScope = "full") {
+    requestCredentialInjectForSession(session, sessionId, credentialId, credentialScope = "full", scope) {
+        const failure = scope?.failure();
+        if (failure)
+            return Promise.resolve({ ok: false, error: `${failure.failure}: ${failure.reason}` });
         return new Promise((resolve) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
@@ -2946,12 +3197,13 @@ export class AgentServer {
                 resolve(parsed.ok
                     ? parsed.value
                     : { ok: false, error: parsed.detail });
-            });
+            }, scope);
             const timer = setTimeout(() => {
                 if (session.pendingApprovals.has(requestId)) {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
+                    scope?.pending.delete(requestId);
                     resolve({
                         ok: false,
                         error: `credential inject ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`,
@@ -2961,6 +3213,7 @@ export class AgentServer {
             this.approvalTimers.set(requestId, timer);
             this.notify(Methods.ApprovalRequest, {
                 ...routeEnvelope,
+                ...(scope ? { sourceSessionId: scope.sourceSessionId } : {}),
                 request: {
                     toolName: "__credential_action__",
                     args: { action: "injectCookie", credentialId, credentialScope },
@@ -3075,13 +3328,37 @@ export class AgentServer {
             });
         });
     }
-    requestWorkspaceSwitchForSession(session, sessionId, target) {
+    async requestWorkspaceSwitchForSession(session, sessionId, target) {
+        return (await this.requestWorkspaceActionForSession(session, sessionId, "switch", target));
+    }
+    /** The same host authority resolves both dispatched turns and their reply wakeups. */
+    async resolveHostSessionWorkspace(source, targetId) {
+        const registration = this.approvalRouter.register(source.id, this.connectionId);
+        if (!registration.ok)
+            throw new Error(`source Session ${source.id} is owned by another connection`);
+        const resolved = (await this.requestWorkspaceActionForSession(source, source.id, "resolve_session_run", targetId));
+        if (typeof resolved.cwd !== "string" ||
+            !resolved.cwd ||
+            typeof resolved.projectTrusted !== "boolean") {
+            throw new Error("host returned an invalid Session workspace");
+        }
+        const workspaceContext = resolved.workspaceContext === undefined
+            ? undefined
+            : validateWorkspaceContext(resolved.workspaceContext);
+        if (workspaceContext &&
+            canonicalKey(workspacePrimaryRoot(workspaceContext).path) !== canonicalKey(resolved.cwd)) {
+            throw new Error("host Session workspace does not match its working directory");
+        }
+        return { cwd: resolved.cwd, workspaceContext, projectTrusted: resolved.projectTrusted };
+    }
+    requestWorkspaceActionForSession(session, sessionId, action, target) {
+        const label = action === "switch" ? "workspace switch" : "Session workspace resolution";
         return new Promise((resolve, reject) => {
             const requestId = nanoid(12);
             const routeEnvelope = this.approvalRouteEnvelope(sessionId, requestId);
             this.registerSessionApproval(session, this.internalPendingMetadata(sessionId, requestId, routeEnvelope, "__workspace_action__"), (decision) => {
                 this.clearApprovalTimer(requestId);
-                const outcome = parseHostLoopbackDecision(decision, "workspace switch");
+                const outcome = parseHostLoopbackDecision(decision, label);
                 if (!outcome.ok) {
                     reject(new Error(outcome.detail));
                     return;
@@ -3094,11 +3371,11 @@ export class AgentServer {
                 // parsed` TypeError happened to be caught and turned into a rejection;
                 // this states the requirement instead of relying on that.)
                 if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-                    reject(new Error(`workspace switch ${HOST_LOOPBACK_FAILURE_DETAIL.malformed}`));
+                    reject(new Error(`${label} ${HOST_LOOPBACK_FAILURE_DETAIL.malformed}`));
                     return;
                 }
                 if ("ok" in parsed && parsed.ok === false) {
-                    reject(new Error(parsed.error ?? "workspace switch failed"));
+                    reject(new Error(parsed.error ?? `${label} failed`));
                     return;
                 }
                 resolve(parsed);
@@ -3108,7 +3385,7 @@ export class AgentServer {
                     this.takeSessionApproval(session, requestId, "expired");
                     this.pendingApprovalTargets.delete(requestId);
                     this.approvalTimers.delete(requestId);
-                    reject(new Error(`workspace switch ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`));
+                    reject(new Error(`${label} ${HOST_LOOPBACK_FAILURE_DETAIL.timed_out}`));
                 }
             }, AgentServer.APPROVAL_TIMEOUT_MS);
             this.approvalTimers.set(requestId, timer);
@@ -3116,8 +3393,8 @@ export class AgentServer {
                 ...routeEnvelope,
                 request: {
                     toolName: "__workspace_action__",
-                    args: { action: "switch", target },
-                    description: `workspace:switch:${target}`,
+                    args: { action, target },
+                    description: `workspace:${action}:${target}`,
                     riskLevel: "low",
                 },
             });
@@ -3226,7 +3503,7 @@ export class AgentServer {
             }
         }
         for (const [, resolve] of this.pendingApprovals) {
-            resolve({ approved: false, reason: "server closing" });
+            resolve({ approved: false, failure: "session_closed", reason: "server closing" });
         }
         this.pendingApprovals.clear();
         this.clearAllApprovalTimers();
@@ -3259,9 +3536,19 @@ export class AgentServer {
     workerGeneration() {
         return this.chatManager?.getLiveSessionSnapshot().generation ?? 0;
     }
-    registerSessionApproval(session, metadata, resolve) {
+    registerSessionApproval(session, metadata, resolve, scope) {
+        if (scope) {
+            metadata = { ...metadata, sourceSessionId: scope.sourceSessionId };
+            scope.pending.add(metadata.requestId);
+        }
         metadata = this.observeApprovalCreated(metadata);
-        session.pendingApprovals.set(metadata.requestId, { resolve, metadata });
+        session.pendingApprovals.set(metadata.requestId, {
+            resolve: (decision) => {
+                scope?.pending.delete(metadata.requestId);
+                resolve(decision);
+            },
+            metadata,
+        });
     }
     takeSessionApproval(session, requestId, status) {
         const entry = session.pendingApprovals.get(requestId);
@@ -3341,7 +3628,7 @@ export class AgentServer {
                 try {
                     entry.resolve(entry.metadata.kind === "internal"
                         ? internalCancellation(failure, reason)
-                        : { approved: false, reason });
+                        : { approved: false, failure, reason });
                 }
                 catch {
                     /* a resolver must never break cancel cleanup */
@@ -3352,6 +3639,12 @@ export class AgentServer {
     }
     failClosedApprovalTargets(targets, reason) {
         for (const target of targets) {
+            for (const child of this.childHostDisposers.values()) {
+                if (child.route.connectionId === target.connectionId &&
+                    child.route.sessionId === target.sessionId &&
+                    child.route.generation === target.generation)
+                    child.dispose(reason);
+            }
             const session = this.chatManager?.get(target.sessionId);
             if (session) {
                 this.cancelSessionApprovals(session, reason, "owner-lost", "owner_lost");
@@ -3367,7 +3660,7 @@ export class AgentServer {
                 this.pendingApprovals.delete(requestId);
                 this.pendingApprovalTargets.delete(requestId);
                 this.clearApprovalTimer(requestId);
-                resolve?.({ approved: false, reason });
+                resolve?.({ approved: false, failure: "owner_lost", reason });
             }
         }
     }