@hienlh/ppm 0.22.1 → 0.22.3

package/src/providers/codex-app-server/codex-provider.ts

@@ -305,6 +305,7 @@ export class CodexAppServerProvider implements AIProvider {
   private unstartedSessions = new Set<string>();
   private live = new Map<string, LiveSession>();
   private modelsCache: { models: ModelOption[]; expiry: number } | null = null;
+  private modelsPending: Promise<ModelOption[]> | null = null;
   /** Keyed by `cwd\0codexHome` — skills differ per workspace AND per account. */
   private skillsCache = new Map<string, { skills: CodexSkill[]; expiry: number }>();
 
@@ -1075,6 +1076,15 @@ export class CodexAppServerProvider implements AIProvider {
 
   async listModels(): Promise<ModelOption[]> {
     if (this.modelsCache && Date.now() < this.modelsCache.expiry) return this.modelsCache.models;
+    if (!this.modelsPending) {
+      this.modelsPending = this.loadModels().finally(() => { this.modelsPending = null; });
+    }
+    // A refresh must not block the picker once a successful list is available.
+    if (this.modelsCache) return this.modelsCache.models;
+    return this.modelsPending;
+  }
+
+  private async loadModels(): Promise<ModelOption[]> {
     const client = new CodexJsonRpcClient();
     try {
       // Without a CODEX_HOME the app-server falls back to the machine's own
@@ -1147,12 +1157,14 @@ export class CodexAppServerProvider implements AIProvider {
   }
 
   /** Read the session's account without advancing the account-selection strategy. */
-  async getUsage(sessionId?: string): Promise<UsageInfo> {
+  async getUsage(sessionId?: string, pickedAccountId?: string): Promise<UsageInfo> {
     // Idempotent, and needed because a caller can reach the provider before the
     // server has started background polling — an unregistered source would make
     // the shared layer answer {} instead of reading codex.
     registerUsageSource(codexUsageSource);
-    const accountId = sessionId ? getSessionCodexAccount(sessionId) : null;
+    // An unopened chat has a claimed account but no session binding yet.
+    // Read that exact account without advancing the selection strategy.
+    const accountId = sessionId ? getSessionCodexAccount(sessionId) : pickedAccountId ?? null;
     const bound = accountId ? getCodexAccount(accountId) : null;
     if (bound) {
       // Through the shared layer, so this answers from the cache or the stored
@@ -1166,12 +1178,12 @@ export class CodexAppServerProvider implements AIProvider {
       };
     }
 
-    // Nothing bound yet — a session binds on its first send. Name the account
+    // No binding or explicit tab claim — a session binds on its first send. Name the account
     // that will serve it, but do NOT read its quota: that spawns an app-server
     // against a login which is not yet this session's, and which a round-robin
     // or lowest-usage pick may never hand it. So the toolbar can say WHO will
     // answer without PPM touching that account on a session's behalf before
-    // the session owns it. The numbers arrive with the first turn.
+    // the session owns it. Quota is read once a tab claims it or a session binds it.
     //
     // Skipped when the session names an account that no longer exists: naming
     // a different one there would be a lie about a binding that already failed.

package/src/server/index.ts

@@ -20,6 +20,7 @@ import { fsBrowseRoutes } from "./routes/fs-browse.ts";
 import { fsOpsRoutes } from "./routes/fs-ops.ts";
 import { fsUploadRoutes } from "./routes/fs-upload.ts";
 import { fsSqliteRoutes } from "./routes/fs-sqlite.ts";
+import { htmlPreviewRoutes } from "./routes/html-preview.ts";
 import { accountsRoutes } from "./routes/accounts.ts";
 import { proxyRoutes } from "./routes/proxy.ts";
 import { mcpRoutes } from "./routes/mcp.ts";
@@ -176,10 +177,14 @@ if (process.env.NODE_ENV !== "production") {
 // Proxy routes — before auth middleware (uses own auth key)
 app.route("/proxy", proxyRoutes);
 
+// HTML assets authenticate with bounded preview capabilities, never the PPM session token.
+app.route("/api/html-preview/content", htmlPreviewRoutes.content);
+
 // Auth check endpoint (behind auth middleware)
 app.use("/api/*", authMiddleware);
 app.use("/api/*", gzipJson);
 app.get("/api/auth/check", (c) => c.json(ok(true)));
+app.route("/api/html-preview", htmlPreviewRoutes.api);
 
 // Port forwarding — starts per-port Cloudflare tunnels
 app.route("/api/preview", portForwardingRoutes);

package/src/server/routes/chat.ts

@@ -31,7 +31,7 @@ import {
   getIndexStatus as chatSearchGetIndexStatus,
   getKnownSessionCount as chatSearchKnownCount,
 } from "../../services/chat-search.service.ts";
-import type { ChatSearchResult, ChatSearchResponse } from "../../types/chat.ts";
+import { compareSessionsByActivity, type ChatSearchResult, type ChatSearchResponse } from "../../types/chat.ts";
 import { ok, err } from "../../types/api.ts";
 
 type Env = { Variables: { projectPath: string; projectName: string } };
@@ -135,7 +135,7 @@ chatRoutes.get("/usage", async (c) => {
         const { invalidateUsage } = await import("../../services/provider-usage/usage-registry.ts");
         invalidateUsage(providerId);
       }
-      try { return c.json(ok(await provider.getUsage(c.req.query("session")))); } catch { return c.json(ok({})); }
+      try { return c.json(ok(await provider.getUsage(c.req.query("session"), c.req.query("accountId")))); } catch { return c.json(ok({})); }
     }
     return c.json(ok({}));
   }
@@ -227,12 +227,8 @@ chatRoutes.get("/sessions", async (c) => {
     // most recently active node). Pinned sessions are never collapsed.
     const collapsed = collapseTreesToHeads(enriched);
 
-    // Sort: pinned first, then by createdAt desc
-    collapsed.sort((a, b) => {
-      if (a.pinned && !b.pinned) return -1;
-      if (!a.pinned && b.pinned) return 1;
-      return new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime();
-    });
+    // Pinned first, then most recently active (not merely most recently created).
+    collapsed.sort(compareSessionsByActivity);
 
     // Server-side search + tag filter
     let filtered = collapsed;

package/src/server/routes/files.ts

@@ -1,3 +1,4 @@
+import { searchProjectContent, ProjectSearchError } from "../../services/project-content-search.service";
 import { Hono } from "hono";
 import { resolve, isAbsolute } from "node:path";
 import { existsSync, mkdirSync } from "node:fs";
@@ -303,23 +304,6 @@ fileRoutes.post("/rename", async (c) => {
   }
 });
 
-/** Convert glob pattern (VSCode-style) to RegExp for path filtering.
- *  - `*.ts`       → matches any .ts file in any directory
- *  - `src/**`     → matches any file under src/
- *  - `src/**\/*.ts` → matches .ts files under src/
- */
-function globToPathRegex(glob: string): RegExp {
-  const escaped = glob
-    .replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape regex special chars
-    .replace(/\*\*/g, "\x00") // temp placeholder for **
-    .replace(/\*/g, "[^/]*") // * = within one segment
-    .replace(/\x00/g, ".*") // ** = across segments
-    .replace(/\?/g, "[^/]"); // ? = single non-slash char
-  // No slash in pattern → match at any depth (like **/<pattern>)
-  const re = glob.includes("/") ? `^${escaped}($|/)` : `(^|/)${escaped}($|/)`;
-  return new RegExp(re);
-}
-
 /** GET /files/resolve?name=filename — resolve filename to project path(s) */
 fileRoutes.get("/resolve", (c) => {
   try {
@@ -335,67 +319,19 @@ fileRoutes.get("/resolve", (c) => {
   }
 });
 
-/** GET /files/search?q=...&caseSensitive=false — search file content with grep */
+/** GET /files/search ? bounded, asynchronous project content search. */
 fileRoutes.get("/search", async (c) => {
-  const projectPath = c.get("projectPath");
-  const q = (c.req.query("q") ?? "").trim();
-  const caseSensitive = c.req.query("caseSensitive") === "true";
-  const wholeWord = c.req.query("wholeWord") === "true";
-  const useRegex = c.req.query("regex") === "true";
-  const include = (c.req.query("include") ?? "").trim();
-
-  if (!useRegex && q.length < 2) return c.json(ok({ results: [], total: 0 }));
-  if (useRegex && q.length < 1) return c.json(ok({ results: [], total: 0 }));
-
-  // Build include path filter regexes (post-filter, supports paths + globs)
-  const includeFilters = include
-    ? include.split(",").map((s) => s.trim()).filter(Boolean).map(globToPathRegex)
-    : [];
-
-  // Build the grep pattern
-  let pattern = useRegex ? q : q.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  if (wholeWord) pattern = `\\b${pattern}\\b`;
-
   try {
-    const EXCLUDE_DIRS = ["node_modules", ".git", "dist", ".next", "build", ".turbo", "coverage", "__pycache__"];
-    const excludeDirArgs = EXCLUDE_DIRS.flatMap((d) => ["--exclude-dir", d]);
-    const excludeArgs = ["--exclude=*.min.js", "--exclude=*.map", "--exclude=*.lock", "--exclude=bun.lock"];
-    const flags = ["-rn", "--max-count=5", "-I", "-E", ...(caseSensitive ? [] : ["-i"])];
-
-    const proc = Bun.spawnSync({
-      cmd: ["grep", ...flags, ...excludeDirArgs, ...excludeArgs, "--", pattern, projectPath],
-      stdout: "pipe",
-      stderr: "pipe",
+    const result = await searchProjectContent(c.get("projectPath"), {
+      query: (c.req.query("q") ?? "").trim(),
+      caseSensitive: c.req.query("caseSensitive") === "true",
+      wholeWord: c.req.query("wholeWord") === "true",
+      regex: c.req.query("regex") === "true",
+      include: (c.req.query("include") ?? "").trim(),
     });
-
-    const raw = proc.stdout.toString();
-    if (!raw.trim()) return c.json(ok({ results: [], total: 0 }));
-
-    // Parse grep output: /abs/path/file.ts:42:content
-    const fileMap = new Map<string, { lineNum: number; content: string }[]>();
-    for (const line of raw.split("\n")) {
-      if (!line) continue;
-      // Strip projectPath prefix, then split on first two colons
-      const rel = line.startsWith(projectPath) ? line.slice(projectPath.length + 1) : line;
-      const firstColon = rel.indexOf(":");
-      if (firstColon < 0) continue;
-      const secondColon = rel.indexOf(":", firstColon + 1);
-      if (secondColon < 0) continue;
-      const filePath = rel.slice(0, firstColon);
-      const lineNum = parseInt(rel.slice(firstColon + 1, secondColon), 10);
-      const content = rel.slice(secondColon + 1).trimEnd();
-      if (!filePath || isNaN(lineNum)) continue;
-      // Apply include path filter if specified
-      if (includeFilters.length > 0 && !includeFilters.some((re) => re.test(filePath))) continue;
-      if (!fileMap.has(filePath)) fileMap.set(filePath, []);
-      fileMap.get(filePath)!.push({ lineNum, content });
-    }
-
-    const results = Array.from(fileMap.entries()).map(([file, matches]) => ({ file, matches }));
-    const total = results.reduce((sum, r) => sum + r.matches.length, 0);
-    return c.json(ok({ results, total }));
-  } catch (e) {
-    return c.json(err((e as Error).message), 500);
+    return c.json(ok(result));
+  } catch (error) {
+    return c.json(err((error as Error).message), error instanceof ProjectSearchError ? error.status : 500);
   }
 });
 

package/src/server/routes/html-preview.ts

@@ -0,0 +1,116 @@
+import { Hono } from "hono";
+import { realpath, stat } from "node:fs/promises";
+import { basename, dirname, extname, isAbsolute, relative, resolve, sep } from "node:path";
+import { assertAllowed, assertNotPpmDir, resolvePath } from "../../services/fs-path-guard.service.ts";
+import { ok, err } from "../../types/api.ts";
+import { rangeFileResponse } from "../helpers/range-file-response.ts";
+import { resolveProjectPath } from "../helpers/resolve-project.ts";
+
+const PREFIX = "/api/html-preview/content";
+const TTL = 60 * 60 * 1000;
+const MAX_SESSIONS = 128;
+const ASSETS = new Set([".html", ".htm", ".css", ".js", ".mjs", ".json", ".png", ".jpg", ".jpeg", ".gif", ".webp", ".avif", ".svg", ".ico", ".mp4", ".webm", ".mov", ".mp3", ".wav", ".ogg", ".m4a", ".woff", ".woff2", ".ttf", ".otf", ".vtt"]);
+interface PreviewSession { root: string; expires: number }
+
+function denied(): never {
+  throw Object.assign(new Error("Preview path is not allowed"), { status: 403 });
+}
+
+function inside(root: string, path: string): boolean {
+  const rel = relative(root, path);
+  return rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+
+function guardAsset(path: string, root = dirname(path)): void {
+  assertAllowed(path);
+  assertNotPpmDir(path);
+  // Only web assets, never hidden directories, dotenv, database or key files.
+  if (relative(root, path).split(/[\\/]/).some((part) => part.startsWith(".")) || !ASSETS.has(extname(path).toLowerCase())) denied();
+}
+
+/** Independent capability store per router pair; no session credentials enter iframe URLs. */
+export function createHtmlPreviewRoutes(now = Date.now) {
+  const sessions = new Map<string, PreviewSession>();
+  const api = new Hono();
+  const content = new Hono();
+
+  api.post("/", async (c) => {
+    try {
+      const body = await c.req.json().catch(() => null);
+      if (!body || typeof body.filePath !== "string" || !body.filePath ||
+        (body.projectName !== undefined && typeof body.projectName !== "string")) {
+        return c.json(err("filePath and optional projectName are required"), 400);
+      }
+      let candidate: string;
+      if (isAbsolute(body.filePath) || body.filePath.startsWith("~")) {
+        candidate = resolvePath(body.filePath);
+      } else {
+        if (!body.projectName) return c.json(err("projectName is required for relative paths"), 400);
+        const projectRoot = resolveProjectPath(body.projectName);
+        candidate = resolve(projectRoot, body.filePath);
+        if (!inside(projectRoot, candidate)) denied();
+        if (!inside(await realpath(projectRoot), await realpath(candidate))) denied();
+      }
+      guardAsset(candidate);
+      const path = await realpath(candidate);
+      guardAsset(path);
+      if (!/\.html?$/i.test(path)) return c.json(err("Preview requires an HTML file"), 400);
+      if (!(await stat(path)).isFile()) return c.json(err("File not found"), 404);
+      for (const [token, session] of sessions) if (session.expires <= now()) sessions.delete(token);
+      if (sessions.size >= MAX_SESSIONS) sessions.delete(sessions.keys().next().value!);
+      const token = crypto.randomUUID();
+      sessions.set(token, { root: dirname(path), expires: now() + TTL });
+      return c.json(ok({ url: `${PREFIX}/${token}/${encodeURIComponent(basename(path))}` }));
+    } catch (error) {
+      const status = (error as { status?: number; code?: string }).status === 403 ? 403 :
+        (error as { code?: string }).code === "ENOENT" ? 404 : 400;
+      return c.json(err(status === 403 ? "Access denied" : "Cannot preview this file"), status);
+    }
+  });
+
+  content.get("/:token/*", async (c) => {
+    const token = c.req.param("token");
+    const session = sessions.get(token);
+    if (!session || session.expires <= now()) {
+      sessions.delete(token);
+      return c.json(err("Preview expired; refresh to reopen"), 404);
+    }
+    try {
+      const encoded = new URL(c.req.url).pathname.slice(`${PREFIX}/${token}/`.length);
+      const asset = decodeURIComponent(encoded);
+      if (!asset || asset.includes("\\") || asset.includes("\0") || asset.includes(":")) denied();
+      const candidate = resolve(session.root, asset);
+      if (!inside(session.root, candidate)) denied();
+      guardAsset(candidate, session.root);
+      const path = await realpath(candidate);
+      if (!inside(session.root, path)) denied();
+      guardAsset(path, session.root);
+      if (!(await stat(path)).isFile()) return c.json(err("File not found"), 404);
+      // Bun reconstructs req.url with its listening port. Preserve the browser's
+      // Host through Vite/tunnels; validate before inserting into a CSP directive.
+      const requestHost = c.req.header("host") ?? "";
+      const host = /^(?:[a-z0-9.-]+|\[[a-f0-9:]+\])(?::\d{1,5})?$/i.test(requestHost)
+        ? requestHost : new URL(c.req.url).host;
+      // A scheme-less host source follows the document's actual scheme through tunnels.
+      const source = `${host}${PREFIX}/${token}/`;
+      const policy = ["sandbox allow-scripts", "default-src 'none'", `script-src 'unsafe-inline' ${source}`,
+        `style-src 'unsafe-inline' ${source}`, `img-src ${source} data: blob:`,
+        `media-src ${source} blob:`, `font-src ${source} data:`, `connect-src ${source}`,
+        "base-uri 'none'", "form-action 'none'", "frame-ancestors 'self'", "object-src 'none'"].join("; ");
+      return rangeFileResponse(path, c.req.raw, {
+        "Content-Security-Policy": policy,
+        "Referrer-Policy": "no-referrer",
+        "Cache-Control": "no-store",
+        "X-Content-Type-Options": "nosniff",
+        // Module scripts/fonts fetch from the sandbox's opaque origin.
+        "Access-Control-Allow-Origin": "*",
+      }, /\.html?$/i.test(path) ? "text/html; charset=utf-8" : undefined);
+    } catch (error) {
+      const status = (error as { status?: number }).status === 403 ? 403 : 404;
+      return c.json(err(status === 403 ? "Access denied" : "Preview asset not found"), status);
+    }
+  });
+  return { api, content };
+}
+
+export const htmlPreviewRoutes = createHtmlPreviewRoutes();

package/src/server/routes/settings.ts

@@ -5,9 +5,9 @@ import {
   validateAIProviderConfig,
   validateCodexContextConfig,
   validateDefaultProvider,
-  VALID_PROVIDERS,
   DEFAULT_CONFIG,
   type AIProviderConfig,
+  type NewChatProviderMode,
   type TelegramConfig,
   type PPMBotConfig,
   type ThemeConfig,
@@ -184,12 +184,20 @@ settingsRoutes.put("/ai", async (c) => {
   try {
     const body = await c.req.json<{
       default_provider?: string;
+      new_chat_provider_mode?: NewChatProviderMode;
       share_provider_context?: boolean;
       providers?: Record<string, Partial<AIProviderConfig>>;
     }>();
 
     const currentAi = configService.get("ai");
 
+    if ("new_chat_provider_mode" in body && body.new_chat_provider_mode !== "default" && body.new_chat_provider_mode !== "follow-focus") {
+      return c.json(err("new_chat_provider_mode must be one of: default, follow-focus"), 400);
+    }
+    if ("default_provider" in body && (typeof body.default_provider !== "string" || !body.default_provider)) {
+      return c.json(err("default_provider must be a non-empty string"), 400);
+    }
+
     if ("share_provider_context" in body && typeof body.share_provider_context !== "boolean") {
       return c.json(err("share_provider_context must be a boolean"), 400);
     }
@@ -197,7 +205,14 @@ settingsRoutes.put("/ai", async (c) => {
     // Validate each provider config
     if (body.providers) {
       for (const [name, providerConfig] of Object.entries(body.providers)) {
-        const errors = validateAIProviderConfig(providerConfig);
+        // Field-only updates still need the saved provider kind and CLI command.
+        // Validate submitted values without revalidating unrelated legacy settings.
+        const existing = currentAi.providers[name];
+        const errors = validateAIProviderConfig({
+          type: existing?.type,
+          cli_command: existing?.cli_command,
+          ...providerConfig,
+        });
         if (errors.length > 0) {
           return c.json(err(`Provider "${name}": ${errors.join(", ")}`), 400);
         }
@@ -207,6 +222,7 @@ settingsRoutes.put("/ai", async (c) => {
     // Merge: body overrides current values (shallow merge per provider)
     const updated = {
       ...currentAi,
+      new_chat_provider_mode: body.new_chat_provider_mode ?? currentAi.new_chat_provider_mode ?? "default",
       share_provider_context: body.share_provider_context ?? currentAi.share_provider_context ?? true,
       ...(body.default_provider && { default_provider: body.default_provider }),
     };
@@ -231,11 +247,8 @@ settingsRoutes.put("/ai", async (c) => {
       }
     }
 
-    // Validate default_provider is in allowed list and references existing provider
+    // Configured providers include runtime integrations such as Codex.
     if (body.default_provider) {
-      if (!VALID_PROVIDERS.includes(body.default_provider as any)) {
-        return c.json(err(`default_provider must be one of: ${VALID_PROVIDERS.join(", ")}`), 400);
-      }
       const dpErr = validateDefaultProvider(updated.default_provider, updated.providers);
       if (dpErr) return c.json(err(dpErr), 400);
     }

package/src/services/chat.service.ts

@@ -11,6 +11,7 @@ import type {
   ChatMessage,
   SendMessageOpts,
 } from "../providers/provider.interface.ts";
+import { compareSessionsByActivity } from "../types/chat.ts";
 
 class ChatService {
   // Delivery hints only: a restart/eviction safely sends a fresh snapshot.
@@ -75,10 +76,7 @@ class ChatService {
         }
       }
     }
-    return all.sort(
-      (a, b) =>
-        new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),
-    );
+    return all.sort(compareSessionsByActivity);
   }
 
   async deleteSession(

package/src/services/config.service.ts

@@ -167,6 +167,8 @@ class ConfigService {
     dbProjects: { path: string; name: string; color: string | null }[],
   ): PpmConfig {
     const config = structuredClone(DEFAULT_CONFIG);
+    // Existing installs without an AI row must also retain the old tab behavior.
+    config.ai.new_chat_provider_mode = "default";
     for (const [key, jsonValue] of Object.entries(dbRows)) {
       if (key in config && key !== "projects") {
         try {

package/src/services/project-content-search.service.ts

@@ -0,0 +1,119 @@
+import { access } from "node:fs/promises";
+import { dirname, resolve } from "node:path";
+
+export class ProjectSearchError extends Error {
+  constructor(message: string, public status: 400 | 500 | 503 | 504 = 500) { super(message); }
+}
+
+interface ResolverOptions {
+  platform?: string;
+  which?: (name: string) => string | null;
+  exists?: (path: string) => Promise<boolean>;
+  programFiles?: string;
+  programFilesX86?: string;
+}
+
+/** Git for Windows ships GNU grep even when its usr/bin is absent from PATH. */
+export async function resolveProjectSearchGrep(options: ResolverOptions = {}): Promise<string | undefined> {
+  const which = options.which ?? ((name: string) => Bun.which(name));
+  const direct = which("grep");
+  if (direct) return direct;
+  if ((options.platform ?? process.platform) !== "win32") return;
+  const exists = options.exists ?? (async (path: string) => { try { await access(path); return true; } catch { return false; } });
+  const git = which("git");
+  const roots = git ? [resolve(dirname(git), ".."), resolve(dirname(git), "../..")] : [];
+  for (const base of [options.programFiles ?? process.env.ProgramFiles, options.programFilesX86 ?? process.env["ProgramFiles(x86)"]]) {
+    if (base) roots.push(resolve(base, "Git"));
+  }
+  for (const root of roots) {
+    const candidate = resolve(root, "usr/bin/grep.exe");
+    if (await exists(candidate)) return candidate;
+  }
+}
+
+/** Convert glob pattern (VSCode-style) to RegExp for path filtering.
+ *  - `*.ts`       → matches any .ts file in any directory
+ *  - `src/**`     → matches any file under src/
+ *  - `src/**\/*.ts` → matches .ts files under src/
+ */
+function globToPathRegex(glob: string): RegExp {
+  const escaped = glob
+    .replace(/[.+^${}()|[\]\\]/g, "\\$&") // escape regex special chars
+    .replace(/\*\*/g, "\x00") // temp placeholder for **
+    .replace(/\*/g, "[^/]*") // * = within one segment
+    .replace(/\x00/g, ".*") // ** = across segments
+    .replace(/\?/g, "[^/]"); // ? = single non-slash char
+  // No slash in pattern → match at any depth (like **/<pattern>)
+  const re = glob.includes("/") ? `^${escaped}($|/)` : `(^|/)${escaped}($|/)`;
+  return new RegExp(re);
+}
+
+export interface ProjectSearchOptions {
+  query: string;
+  caseSensitive?: boolean;
+  wholeWord?: boolean;
+  regex?: boolean;
+  include?: string;
+}
+
+export async function searchProjectContent(projectPath: string, options: ProjectSearchOptions,
+  dependencies: { resolveGrep?: () => Promise<string | undefined>; timeoutMs?: number; maxBytes?: number } = {}) {
+  const empty = { results: [] as Array<{ file: string; matches: Array<{ lineNum: number; content: string }> }>, total: 0 };
+  if (options.query.length < (options.regex ? 1 : 2)) return empty;
+  const executable = await (dependencies.resolveGrep ?? resolveProjectSearchGrep)();
+  if (!executable) throw new ProjectSearchError("Content search needs GNU grep. Install Git for Windows, or make grep available on PATH, then retry.", 503);
+  const excluded = ["node_modules", ".git", "dist", ".next", "build", ".turbo", "coverage", "__pycache__"];
+  // Long --null also works with BSD grep, where -Z means decompress.
+  const flags = ["-rHn", "--null", "--max-count=5", "-I", options.regex ? "-E" : "-F", ...(options.caseSensitive ? [] : ["-i"]), ...(options.wholeWord ? ["-w"] : [])];
+  const proc = Bun.spawn({ cmd: [executable, ...flags, ...excluded.flatMap((dir) => ["--exclude-dir", dir]),
+    "--exclude=*.min.js", "--exclude=*.map", "--exclude=*.lock", "--exclude=bun.lock", "--", options.query, "."],
+    cwd: projectPath, stdout: "pipe", stderr: "pipe" });
+  let failure: ProjectSearchError | undefined;
+  let bytes = 0;
+  const stop = (error: ProjectSearchError) => { failure ??= error; proc.kill(); };
+  const timer = setTimeout(() => stop(new ProjectSearchError("Content search timed out. Narrow the query or choose a smaller project and retry.", 504)), dependencies.timeoutMs ?? 10_000);
+  async function collect(stream: ReadableStream<Uint8Array>): Promise<string> {
+    const reader = stream.getReader();
+    const decoder = new TextDecoder();
+    let text = "";
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        bytes += value.byteLength;
+        if (bytes > (dependencies.maxBytes ?? 8 * 1024 * 1024)) {
+          stop(new ProjectSearchError("Too many search results. Narrow the query or choose a smaller project and retry.", 400));
+        } else text += decoder.decode(value, { stream: true });
+      }
+      return text + decoder.decode();
+    } finally { reader.releaseLock(); }
+  }
+  let raw: string, stderr: string, code: number;
+  try { [raw, stderr, code] = await Promise.all([collect(proc.stdout), collect(proc.stderr), proc.exited]); }
+  finally { clearTimeout(timer); if (proc.exitCode === null) proc.kill(); }
+  if (failure) throw failure;
+  if (code !== 0 && code !== 1) {
+    const invalidPattern = options.regex && /regular expression|unmatched|unterminated|invalid range|trailing backslash|repetition/i.test(stderr);
+    throw new ProjectSearchError(invalidPattern ? "Invalid regular expression. Check the pattern and retry." : "Content search failed. Check file permissions and the search tool, then retry.", invalidPattern ? 400 : 500);
+  }
+  if (code === 1) return empty;
+  const filters = (options.include ?? "").split(",").map((s) => s.trim()).filter(Boolean).map(globToPathRegex);
+  const files = new Map<string, Array<{ lineNum: number; content: string }>>();
+  // grep --null separates filenames with NUL: colons, spaces and newlines are safe.
+  let offset = 0;
+  while (offset < raw.length) {
+    const separator = raw.indexOf("\0", offset);
+    if (separator < 0) break;
+    const end = raw.indexOf("\n", separator + 1);
+    const recordEnd = end < 0 ? raw.length : end;
+    const file = raw.slice(offset, separator).replace(/^\.\//, "");
+    const record = /^(\d+):(.*)$/s.exec(raw.slice(separator + 1, recordEnd));
+    offset = recordEnd + 1;
+    if (!record || (filters.length && !filters.some((filter) => filter.test(file)))) continue;
+    const matches = files.get(file) ?? [];
+    matches.push({ lineNum: Number(record[1]), content: record[2]!.trimEnd() });
+    files.set(file, matches);
+  }
+  const results = Array.from(files, ([file, matches]) => ({ file, matches }));
+  return { results, total: results.reduce((sum, result) => sum + result.matches.length, 0) };
+}

package/src/types/chat.ts

@@ -70,7 +70,7 @@ export interface AIProvider {
   /** Drop runtime skill discovery results after a user requests a refresh. */
   invalidateSkillsCache?(): void;
   /** Provider-specific usage/quota (rate limits). Used by GET /chat/usage. */
-  getUsage?(sessionId?: string): Promise<UsageInfo>;
+  getUsage?(sessionId?: string, pickedAccountId?: string): Promise<UsageInfo>;
   /** True when a live streaming subprocess exists for this session */
   hasStreamingSession?(sessionId: string): boolean;
   /** Prompt-cache lifetime for this session, in ms — how long holding its subprocess pays. */
@@ -119,6 +119,24 @@ export interface SessionInfo {
   tag?: { id: number; name: string; color: string } | null;
 }
 
+/**
+ * Keeps every history surface in the same order: pinned conversations first,
+ * then the conversation most recently written to. Older providers may not
+ * expose an update timestamp, so their creation time remains the fallback.
+ */
+export function compareSessionsByActivity(a: SessionInfo, b: SessionInfo): number {
+  if (a.pinned && !b.pinned) return -1;
+  if (!a.pinned && b.pinned) return 1;
+  return sessionActivityTime(b) - sessionActivityTime(a);
+}
+
+function sessionActivityTime(session: SessionInfo): number {
+  const updated = session.updatedAt ? Date.parse(session.updatedAt) : NaN;
+  if (Number.isFinite(updated)) return updated;
+  const created = Date.parse(session.createdAt);
+  return Number.isFinite(created) ? created : 0;
+}
+
 export interface SessionListResponse {
   sessions: SessionInfo[];
   hasMore: boolean;

package/src/types/config.ts

@@ -74,8 +74,12 @@ export interface ProjectConfig {
   image?: string;
 }
 
+export type NewChatProviderMode = "default" | "follow-focus";
+
 export interface AIConfig {
   default_provider: string;
+  /** Missing in legacy settings: use the configured default provider. */
+  new_chat_provider_mode?: NewChatProviderMode;
   /** Share project rules and memory between providers. Unset defaults to true. */
   share_provider_context?: boolean;
   providers: Record<string, AIProviderConfig>;
@@ -140,6 +144,7 @@ export const DEFAULT_CONFIG: PpmConfig = {
   projects: [],
   ai: {
     default_provider: "claude",
+    new_chat_provider_mode: "follow-focus",
     share_provider_context: true,
     providers: {
       claude: {
@@ -280,7 +285,7 @@ export function validateCodexContextConfig(config: Partial<AIProviderConfig>): s
 
 /** Validate default_provider references an existing provider key */
 export function validateDefaultProvider(defaultProvider: string, providers: Record<string, unknown>): string | null {
-  if (!providers[defaultProvider]) {
+  if (!Object.hasOwn(providers, defaultProvider)) {
     return `default_provider "${defaultProvider}" not found in providers`;
   }
   return null;
@@ -293,6 +298,12 @@ export function validateDefaultProvider(defaultProvider: string, providers: Reco
 export function sanitizeConfig(config: PpmConfig): boolean {
   let dirty = false;
 
+  // Preserve legacy behavior on upgrade; only fresh configs opt into following focus.
+  if (config.ai.new_chat_provider_mode !== "default" && config.ai.new_chat_provider_mode !== "follow-focus") {
+    config.ai.new_chat_provider_mode = "default";
+    dirty = true;
+  }
+
   if (typeof config.ai.share_provider_context !== "boolean") {
     config.ai.share_provider_context = true;
     dirty = true;