@kabmo-labs/kabmo 0.0.1 → 0.1.0

package/src/client/components/mobile/mobile-session-sidebar/SessionRow.tsx

@@ -3,6 +3,7 @@ import type { SessionItemData } from '@/shared/types';
 import { useInlineRename } from '@/client/hooks/ui/inline-rename';
 import { useSessionRenaming } from '@/client/hooks/workspace/renaming-sessions';
 import { SessionActionsMenu, useRowMenu } from '@/client/components/common/session-actions-menu';
+import { SelectionCheckbox } from '@/client/components/common/batch-selection/SelectionCheckbox';
 
 export interface MobileSessionRowProps {
   session: SessionItemData;
@@ -25,6 +26,11 @@ export interface MobileSessionRowProps {
   /** Ask omp to name this session from its transcript. Omitted for a pending
    *  `new-…` chat, which has no transcript to derive a title from. */
   onRenameWithAi?: () => void;
+  /** Draw a checkbox and let the row's tap toggle the selection instead of
+   *  opening the session (batch mode). */
+  selectable?: boolean;
+  selected?: boolean;
+  onToggleSelect?: () => void;
 }
 
 export function MobileSessionRow({
@@ -41,6 +47,9 @@ export function MobileSessionRow({
   onDelete,
   onRename,
   onRenameWithAi,
+  selectable = false,
+  selected = false,
+  onToggleSelect,
 }: MobileSessionRowProps) {
   const {
     isEditing,
@@ -91,14 +100,16 @@ export function MobileSessionRow({
       <div
         data-testid="session-item"
         data-session-id={String(session.id)}
-        onContextMenu={hasActions ? menu.openAtCursor : undefined}
+        onContextMenu={hasActions && !selectable ? menu.openAtCursor : undefined}
         className={`w-full rounded-lg flex items-center transition-colors ${
-          isActive ? 'bg-ink/10 font-medium text-ink' : 'hover:bg-ink/5 text-ink/85'
+          selectable && selected
+            ? 'bg-ink/10 ring-1 ring-inset ring-ink/20 text-ink'
+            : isActive ? 'bg-ink/10 font-medium text-ink' : 'hover:bg-ink/5 text-ink/85'
         }`}
       >
         <button
           type="button"
-          onClick={onSelect}
+          onClick={selectable ? onToggleSelect : onSelect}
           className="flex-1 text-left pl-2 pr-3 py-2 flex items-center justify-between min-w-0"
         >
           <div className="flex items-center min-w-0 pr-2">
@@ -107,7 +118,16 @@ export function MobileSessionRow({
                 outranks the run spinner — the spinner says work is happening,
                 the question mark says it is YOUR turn (desktop parity). An
                 in-flight rename outranks both, for the same reason it does
-                there: it answers a click that is still pending. */}
+                there: it answers a click that is still pending.
+                In batch mode the slot carries the checkbox instead: a row that
+                is a choice should not also report a run. */}
+            {selectable ? (
+              <SelectionCheckbox
+                checked={selected}
+                label={`Select ${session.title}`}
+                onChange={() => onToggleSelect?.()}
+              />
+            ) : (
             <span className="w-4 flex-shrink-0 flex items-center justify-center">
               {renaming ? (
                 <span role="status" aria-label="Generating a name…">
@@ -121,6 +141,7 @@ export function MobileSessionRow({
                 <Check size={13} className="text-ink/50" />
               ) : null}
             </span>
+            )}
             <span className="text-xs truncate leading-snug ml-2">{title}</span>
           </div>
 
@@ -134,7 +155,7 @@ export function MobileSessionRow({
             column so the trailing glyph's centre stays 19px from the row's right
             edge whether the last element is this trigger or the chevron. Without
             it the glyphs step in and out from row to row. */}
-        {hasActions && (
+        {hasActions && !selectable && (
           <button
             type="button"
             onClick={menu.openBelow}
@@ -151,7 +172,7 @@ export function MobileSessionRow({
         {/* Last element, so its glyph sits in the folder header's chevron column.
             `p-1.5 mr-1.5` centres a 14px glyph on that column while keeping a
             touch-sized tap target. */}
-        {showChevron && (
+        {showChevron && !selectable && (
           <button
             type="button"
             onClick={onToggleExpand}

package/src/client/components/mobile/mobile-session-sidebar/Toolbar.test.ts

@@ -72,6 +72,8 @@ async function mount(overrides: Partial<MobileSessionToolbarProps> = {}) {
       onHideArchived: () => { calls.hidden += 1; },
       onSearchChange: () => {},
       onClearSearch: () => {},
+      onSelectWorkspaces: () => {},
+      selecting: false,
       ...overrides,
     }), container);
   });

package/src/client/components/mobile/mobile-session-sidebar/Toolbar.tsx

@@ -1,5 +1,5 @@
 import type { RefObject } from 'preact/compat';
-import { Archive, ArrowUpDown, Calendar, FolderPlus, Plus, RefreshCw, Search, X } from 'lucide-preact';
+import { Archive, ArrowUpDown, Calendar, FolderPlus, ListChecks, Plus, RefreshCw, Search, X } from 'lucide-preact';
 import type { SessionSortOption } from '@/shared/types';
 import { SortMenu } from '@/client/components/common/sort-menu';
 
@@ -24,6 +24,10 @@ export interface MobileSessionToolbarProps {
   onHideArchived: () => void;
   onSearchChange: (value: string) => void;
   onClearSearch: () => void;
+  /** Enter the workspace batch-selection mode (checkbox on each workspace). */
+  onSelectWorkspaces: () => void;
+  /** True while a batch selection is active — the control reads pressed. */
+  selecting: boolean;
 }
 
 export function MobileSessionToolbar({
@@ -45,6 +49,8 @@ export function MobileSessionToolbar({
   onHideArchived,
   onSearchChange,
   onClearSearch,
+  onSelectWorkspaces,
+  selecting,
 }: MobileSessionToolbarProps) {
   return (
     <div className="@container p-3 border-b border-ink/10 flex flex-col space-y-2.5 flex-shrink-0 bg-canvas">
@@ -123,6 +129,25 @@ export function MobileSessionToolbar({
           <Archive size={16} strokeWidth={1.8} />
         </button>
 
+        {/* Batch selection over the WORKSPACES. A mode, like search, so it
+            sits with the view controls and reports its pressed state — and it
+            is the only way into the workspace batch, because a workspace has
+            no row of its own to long-press. */}
+        <button
+          type="button"
+          onClick={onSelectWorkspaces}
+          aria-pressed={selecting}
+          className={`w-9.5 h-9.5 rounded-xl border active:scale-95 flex items-center justify-center transition-all flex-shrink-0 cursor-pointer shadow-xs ${
+            selecting
+              ? 'bg-ink/10 text-ink border-ink/30'
+              : 'border-ink/15 bg-paper hover:bg-ink/5 text-ink/80 hover:text-ink'
+          }`}
+          title={selecting ? 'Cancel selection' : 'Select workspaces'}
+          aria-label={selecting ? 'Cancel selection' : 'Select workspaces'}
+        >
+          <ListChecks size={16} strokeWidth={1.8} />
+        </button>
+
         {/* Refresh sessions button — same action the desktop toolbar's
             RefreshCw performs: refetch the session list from the server.
             The icon spins for the duration of that fetch, so the click has a

package/src/client/hooks/workspace/batch-delete-run.ts

@@ -0,0 +1,95 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The state machine behind a batch delete, shared by both sidebars.
+ *
+ * It exists so the two layouts cannot drift on the three follow-ups that are
+ * load-bearing, and which are easy to get subtly wrong once per sidebar:
+ *
+ *   - a removed session's client cache is forgotten (`forgetSession`), or every
+ *     panel keyed to that id keeps serving the state of a chat that is gone;
+ *   - when the removed set includes the session in the URL, `?sessionId=` (and
+ *     `?subagent=`, which belongs to it) is dropped — otherwise the chat renders
+ *     its "not found" state over a row the user just deleted;
+ *   - the sidebar is refreshed ONCE per batch, from the server's own republish.
+ *
+ * A refusal does not abort the batch: the server already deleted everything it
+ * could, and the dialog lists what survived with its reason.
+ */
+
+import { useCallback, useState } from 'preact/hooks';
+import { useSearchParams } from '@/client/lib/router/search-params';
+import { forgetSession } from '@/shared/lib/workspace/session-state/store';
+import {
+  deleteSessionsBatch,
+  deleteWorkspacesBatch,
+  type BatchDeleteOutcome,
+} from '@/client/hooks/workspace/batch-delete';
+import type { BatchMode } from '@/shared/lib/workspace/batch-select';
+
+export interface BatchDeleteRun {
+  /** The ids awaiting confirmation; empty when the dialog is closed. */
+  pending: string[];
+  isDeleting: boolean;
+  /** The settled result, or null while the request runs. */
+  outcome: BatchDeleteOutcome | null;
+  /** Open the confirmation for these ids. */
+  request: (ids: readonly string[]) => void;
+  /** Close it without deleting. */
+  cancel: () => void;
+  /** Issue the delete. Resolves with the settled outcome (null when nothing ran). */
+  confirm: (mode: BatchMode) => Promise<BatchDeleteOutcome | null>;
+}
+
+export function useBatchDeleteRun(refresh: () => void): BatchDeleteRun {
+  const [pending, setPending] = useState<string[]>([]);
+  const [isDeleting, setIsDeleting] = useState(false);
+  const [outcome, setOutcome] = useState<BatchDeleteOutcome | null>(null);
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  const request = useCallback((ids: readonly string[]) => {
+    setOutcome(null);
+    setPending([...ids]);
+  }, []);
+
+  const cancel = useCallback(() => {
+    setOutcome(null);
+    setPending([]);
+  }, []);
+
+  const confirm = useCallback(async (mode: BatchMode): Promise<BatchDeleteOutcome | null> => {
+    if (pending.length === 0 || isDeleting) return null;
+    setIsDeleting(true);
+    setOutcome(null);
+    const ids = pending;
+    const result = mode === 'workspace'
+      ? await deleteWorkspacesBatch(ids)
+      : await deleteSessionsBatch(ids);
+
+    if (mode === 'session' && result.removed.length > 0) {
+      for (const id of result.removed) forgetSession(id);
+      const openSession = searchParams.get('sessionId');
+      if (openSession && result.removed.includes(openSession)) {
+        setSearchParams((prev) => {
+          const next = new URLSearchParams(prev);
+          next.delete('sessionId');
+          next.delete('subagent');
+          return next;
+        }, { replace: true });
+      }
+    }
+
+    if (result.removed.length > 0) refresh();
+    setOutcome(result);
+    setIsDeleting(false);
+    // The dialog STAYS open on a refusal so the reason can be read; a fully
+    // successful run closes itself, because the rows it named are gone.
+    if (result.removed.length === ids.length) setPending([]);
+    return result;
+  }, [pending, isDeleting, searchParams, setSearchParams, refresh]);
+
+  return { pending, isDeleting, outcome, request, cancel, confirm };
+}

package/src/client/hooks/workspace/batch-delete.ts

@@ -0,0 +1,63 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The batch verbs, one call per noun.
+ *
+ * Both are server routes rather than a client loop: a loop of N single deletes
+ * would pay N round trips for one user action, and each of them republishes the
+ * sidebar on its own. The server answers ONE summary — what was removed, and
+ * per-id refusals with their own reason — which is what the confirmation dialog
+ * reports after it closes.
+ */
+
+export interface BatchDeleteRefusal {
+  id: string;
+  error: string;
+  code?: string;
+}
+
+export interface BatchDeleteOutcome {
+  removed: string[];
+  refused: BatchDeleteRefusal[];
+  /** Set only when the request itself failed (network, 4xx, 5xx). */
+  error?: string;
+}
+
+const EMPTY: BatchDeleteOutcome = { removed: [], refused: [] };
+
+async function postBatch(url: string, ids: readonly string[]): Promise<BatchDeleteOutcome> {
+  try {
+    const res = await fetch(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ ids }),
+    });
+    const body = (await res.json().catch(() => null)) as Partial<BatchDeleteOutcome> | null;
+    if (!res.ok) {
+      return { ...EMPTY, error: body?.error || `Could not delete (HTTP ${res.status}).` };
+    }
+    return {
+      removed: Array.isArray(body?.removed) ? body.removed : [],
+      refused: Array.isArray(body?.refused) ? body.refused : [],
+    };
+  } catch (error) {
+    return { ...EMPTY, error: error instanceof Error ? error.message : 'Could not reach the server.' };
+  }
+}
+
+/** Remove sessions, transcripts included. Pending `new-…` ids are refused by the server. */
+export function deleteSessionsBatch(ids: readonly string[]): Promise<BatchDeleteOutcome> {
+  return postBatch('/api/sessions/batch-delete', ids);
+}
+
+/**
+ * Unregister workspaces. Same semantics as the single "Delete Workspace"
+ * action — the transcript files on disk are NOT touched, only the sidebar
+ * registration (and the tombstone that stops the sync re-adding it).
+ */
+export function deleteWorkspacesBatch(ids: readonly string[]): Promise<BatchDeleteOutcome> {
+  return postBatch('/api/folders/batch-delete', ids);
+}

package/src/client/hooks/workspace/batch-selection.ts

@@ -0,0 +1,98 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * One batch selection, for both sidebars and both nouns.
+ *
+ * The mode is the state that makes the checkboxes exist at all: `null` means
+ * the sidebar is behaving normally, and entering a mode is the user's explicit
+ * act (a workspace's `⋯` menu, or the toolbar's Select control). Leaving it —
+ * by Cancel, by Escape, or by finishing a delete — clears the selection, so a
+ * mode never comes back pre-filled with rows the user no longer remembers
+ * picking.
+ *
+ * The selection is pruned against what the sidebar can currently offer, but
+ * pruning is deliberately NOT done in an effect: a row that disappears for one
+ * render (a folder collapsing under a filter, a push mid-refresh) must not
+ * silently drop a choice. Callers pass the ids they are about to delete, and
+ * the delete path resolves them against the live list.
+ */
+
+import { useCallback, useMemo, useState } from 'preact/hooks';
+import {
+  selectionSummary,
+  toggleSelection,
+  type BatchMode,
+  type SelectionSummary,
+} from '@/shared/lib/workspace/batch-select';
+
+export interface BatchSelectionHandle {
+  /** The active mode, or null when the sidebar is not selecting. */
+  mode: BatchMode | null;
+  /**
+   * The workspace a SESSION selection is scoped to. A session batch is started
+   * from one workspace's `⋯` menu, so the checkboxes belong to that workspace's
+   * rows only — the other folders stay ordinary lists, which is also what makes
+   * "select all" unambiguous. Null in workspace mode.
+   */
+  scopeFolderId: number | null;
+  /** The ids selected in the active mode, in click order. */
+  selected: string[];
+  /** Enter a mode, replacing any previous selection. */
+  begin: (mode: BatchMode, scopeFolderId?: number) => void;
+  /** Leave the mode and forget the selection. */
+  end: () => void;
+  /** Add or remove one id. */
+  toggle: (id: string) => void;
+  /** Add every id in `ids` that is not already selected. */
+  selectAllOf: (ids: readonly string[]) => void;
+  /** Drop every id in `ids` from the selection. */
+  unselectAllOf: (ids: readonly string[]) => void;
+  /** Tri-state summary of the selection against a set of available ids. */
+  summaryOf: (available: readonly string[]) => SelectionSummary;
+}
+
+export function useBatchSelection(): BatchSelectionHandle {
+  const [mode, setMode] = useState<BatchMode | null>(null);
+  const [scopeFolderId, setScopeFolderId] = useState<number | null>(null);
+  const [selected, setSelected] = useState<string[]>([]);
+
+  const begin = useCallback((next: BatchMode, folderId?: number) => {
+    setMode(next);
+    setScopeFolderId(next === 'session' ? folderId ?? null : null);
+    setSelected([]);
+  }, []);
+
+  const end = useCallback(() => {
+    setMode(null);
+    setScopeFolderId(null);
+    setSelected([]);
+  }, []);
+
+  const toggle = useCallback((id: string) => {
+    setSelected((prev) => toggleSelection(prev, id));
+  }, []);
+
+  const selectAllOf = useCallback((ids: readonly string[]) => {
+    setSelected((prev) => [...new Set([...prev, ...ids])]);
+  }, []);
+
+  const unselectAllOf = useCallback((ids: readonly string[]) => {
+    setSelected((prev) => {
+      const drop = new Set(ids);
+      return prev.filter((id) => !drop.has(id));
+    });
+  }, []);
+
+  const summaryOf = useCallback(
+    (available: readonly string[]) => selectionSummary(selected, available),
+    [selected],
+  );
+
+  return useMemo(
+    () => ({ mode, scopeFolderId, selected, begin, end, toggle, selectAllOf, unselectAllOf, summaryOf }),
+    [mode, scopeFolderId, selected, begin, end, toggle, selectAllOf, unselectAllOf, summaryOf],
+  );
+}

package/src/client/tailwind.css

@@ -43,6 +43,12 @@
      of the K's upper arm (`public/icon.svg`) — and it is the only chroma
      outside the error red. */
   --color-brand: #f26522;
+  /* The icon's tile and the ink on it, also not theme tokens: the wordmark's K
+     is the app icon (`public/icon.svg`), so its green plate and cream strokes
+     must be identical in every palette — including the dark ones, where a
+     themed surface would turn the plate into a hole. */
+  --color-brand-tile: #0b5d3b;
+  --color-brand-cream: #f7f4ea;
 }
 
 @layer base {

package/src/server/lib/lifecycle/restart.ts

@@ -20,9 +20,6 @@
  * launcher is what brings the new files up.
  */
 
-import { existsSync } from 'node:fs';
-import { join as joinPath } from 'node:path';
-
 import { resolveBunBin } from '@/server/lib/lifecycle/bun';
 import { packageDir } from '@/server/lib/fs/package-root';
 import { listInstanceRecords } from '@/server/lib/lifecycle/instance';
@@ -30,6 +27,7 @@ import { isCliManaged, resolveLaunchMode, unmanagedReason } from '@/server/lib/l
 import { capitalizeFirstLetter } from '@/shared/lib/chat/capitalize';
 import { loadAuthConfig } from '@/server/lib/auth/guard';
 import { PASSWORD_HANDOVER_ENV, PASSWORD_HANDOVER_STDIN, serializeHandover } from '@/shared/lib/auth/handover';
+import { copyAt, type InstalledCopy } from '@/server/lib/updates/installed-cli';
 import type { UpdateApplyResult } from '@/shared/types/updates';
 
 /**
@@ -87,11 +85,46 @@ function ownInstance(): { port: number; launchMode: string } | null {
   return { port, launchMode: resolveLaunchMode() };
 }
 
-/** `kabmo restart --port <port>` for the install this server runs from. */
-function restartCommand(port: number): string[] | null {
-  const cli = joinPath(PKG_ROOT, 'src', 'cli', 'kabmo.js');
-  if (!existsSync(cli)) return null;
-  return [resolveBunBin(), cli, 'restart', '--port', String(port)];
+/**
+ * The marker the TARGET copy reads its credential through.
+ *
+ * The rename renamed the variable too (`OMPCHAMBER_PASSWORD_HANDOVER` →
+ * `KABMO_PASSWORD_HANDOVER`), so a restart that set only one spelling would
+ * hand a payload to a CLI that never looks for it — and the replacement would
+ * come back with authentication silently disabled. Keyed by package name
+ * because that is the only fact about the target this process can read.
+ */
+const HANDOVER_ENV_BY_PACKAGE: Record<string, string> = {
+  'ompchamber': 'OMPCHAMBER_PASSWORD_HANDOVER',
+  '@kabmo-labs/kabmo': PASSWORD_HANDOVER_ENV,
+};
+
+export interface RestartInvocation {
+  /** argv for the detached helper: `<bun> <cli> restart --port <port>`. */
+  cmd: string[];
+  /** The variable that CLI reads its credential marker from. */
+  handoverEnv: string;
+  /** Package root the helper runs in. */
+  root: string;
+}
+
+/**
+ * How to restart the copy rooted at `root`.
+ *
+ * The CLI is that copy's OWN registered bin, resolved from its `package.json`,
+ * because the file name is not a constant across a rename: a renamed package
+ * ships only the bin it declares, so a hard-coded `kabmo.js` finds nothing in
+ * a copy that names it something else. Null when the root holds no runnable
+ * copy.
+ */
+export function restartInvocation(port: number, root: string): RestartInvocation | null {
+  const copy = copyAt(root);
+  if (!copy) return null;
+  return {
+    cmd: [resolveBunBin(), copy.cli, 'restart', '--port', String(port)],
+    handoverEnv: HANDOVER_ENV_BY_PACKAGE[copy.packageName] ?? PASSWORD_HANDOVER_ENV,
+    root: copy.root,
+  };
 }
 
 /**
@@ -127,7 +160,7 @@ export function withRestartPlan(result: UpdateApplyResult, plan: SelfRestartPlan
  * helper is detached so this process exiting does not take it down, and it
  * removes this port's record itself (`stopInstance`) before serving.
  */
-export function scheduleSelfRestart(purpose: SelfRestartPurpose = 'update'): SelfRestartPlan {
+export function scheduleSelfRestart(purpose: SelfRestartPurpose = 'update', installed: InstalledCopy | null = null): SelfRestartPlan {
   const self = ownInstance();
   if (!self) {
     const nextStep = purpose === 'restart' ? 'restart it yourself' : 'restart it yourself to apply the update';
@@ -138,11 +171,16 @@ export function scheduleSelfRestart(purpose: SelfRestartPurpose = 'update'): Sel
     return { restarting: false, message: skipRestartNote(self.launchMode, purpose) };
   }
 
-  const cmd = restartCommand(self.port);
-  if (!cmd) {
+  // The copy that must come back is the one the update INSTALLED. Falling back
+  // to this process's own root keeps `Restart` (which installs nothing) and a
+  // caller that could not read the install working as before.
+  const root = installed?.root ?? PKG_ROOT;
+  const invocation = restartInvocation(self.port, root);
+  if (!invocation) {
     const nextStep = purpose === 'restart' ? 'restart it yourself' : 'restart it yourself to apply the update';
-    return { restarting: false, message: `The kabmo CLI is missing from ${PKG_ROOT} — ${nextStep}.` };
+    return { restarting: false, message: `The CLI is missing from ${root} — ${nextStep}.` };
   }
+  const { cmd, handoverEnv } = invocation;
 
   // The replacement must come up with the SAME credential this process is
   // serving under. Without it, a restart silently disables authentication —
@@ -160,7 +198,7 @@ export function scheduleSelfRestart(purpose: SelfRestartPurpose = 'update'): Sel
     try {
       const child = Bun.spawn({
         cmd,
-        cwd: PKG_ROOT,
+        cwd: root,
         stdin: credential ? 'pipe' : 'ignore',
         stdout: 'inherit',
         stderr: 'inherit',
@@ -169,7 +207,7 @@ export function scheduleSelfRestart(purpose: SelfRestartPurpose = 'update'): Sel
         // CLI forwards it to the server it spawns, which is the only place it
         // is ever read.
         env: credential
-          ? { ...Bun.env, [PASSWORD_HANDOVER_ENV]: PASSWORD_HANDOVER_STDIN }
+          ? { ...Bun.env, [handoverEnv]: PASSWORD_HANDOVER_STDIN }
           : Bun.env,
       });
       if (credential && child.stdin) {

package/src/server/lib/omp/session/delete-flow.server.ts

@@ -0,0 +1,101 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The one session-removal sequence, shared by the single DELETE route and the
+ * batch route.
+ *
+ * The ORDER is the contract and it is enforced here, not by the callers:
+ *  1. refuse a pending `new-…` chat and an id that is not one path segment —
+ *     both name something other than the session they appear to;
+ *  2. refuse a session whose omp child is mid-turn (a run, a live subagent, or
+ *     a dialog the agent is blocked on) — the delete would kill work the user
+ *     can still see, and omp would flush the file back on shutdown anyway;
+ *  3. destroy the child and AWAIT its exit — omp writes session state on
+ *     shutdown and would otherwise recreate the transcript just removed;
+ *  4. purge side questions, then the transcript, artifacts and Kabmo rows.
+ *
+ * A batch that re-implemented any of this would drift from the single delete,
+ * and the drift would be silent: the route answers per-id verdicts either way.
+ */
+
+import { getRpcSession } from '@/server/lib/omp/rpc/session-registry';
+import { purgeSessionData } from '@/server/lib/omp/session/delete.server';
+import { purgeBtwForSession } from '@/server/lib/btw/purge.server';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+import { isMockMode } from '@/server/mock.server';
+
+export interface SessionRemoval {
+  /** True when the session was removed (or would have been, in mock mode). */
+  ok: boolean;
+  /** HTTP status the single-session route answers with; batch callers use `error`. */
+  status: number;
+  code?: 'session_pending' | 'invalid_id' | 'session_busy' | 'not_found';
+  error?: string;
+  fileRemoved?: boolean;
+  artifactsRemoved?: boolean;
+  btwTopicsRemoved?: number;
+}
+
+/**
+ * Remove one session, in the documented order. Never throws: every failure is
+ * a verdict, because a batch has to keep going after one refused id.
+ */
+export async function removeSession(sessionId: string): Promise<SessionRemoval> {
+  if (sessionId.startsWith('new-')) {
+    return {
+      ok: false,
+      status: 400,
+      code: 'session_pending',
+      error: 'This chat has not been created yet.',
+    };
+  }
+  // The id names a directory under the sessions root and another under the btw
+  // root, so it must be exactly one path segment — see `isSinglePathSegment`
+  // for the `.` case that made this load-bearing.
+  if (!isSinglePathSegment(sessionId)) {
+    return { ok: false, status: 400, code: 'invalid_id', error: 'Invalid session id' };
+  }
+
+  try {
+    // A live child is the only other writer of the transcript. Busy means a
+    // turn, a live subagent, or a dialog omp is parked on.
+    const live = getRpcSession(sessionId);
+    if (live?.isAlive()) {
+      if (live.isBusy()) {
+        return {
+          ok: false,
+          status: 409,
+          code: 'session_busy',
+          error: 'This session is working. Stop the run before deleting it.',
+        };
+      }
+      await live.destroyAndWait();
+    }
+
+    // Side questions live outside the session file and are removed first: their
+    // children must be gone before the parent transcript they were snapshotted
+    // from disappears.
+    const btwTopicsRemoved = isMockMode() ? 0 : await purgeBtwForSession(sessionId);
+    const purged = await purgeSessionData(sessionId);
+    if (!purged.found) {
+      return { ok: false, status: 404, code: 'not_found', error: 'Session not found' };
+    }
+
+    return {
+      ok: true,
+      status: 200,
+      fileRemoved: purged.fileRemoved,
+      artifactsRemoved: purged.artifactsRemoved,
+      btwTopicsRemoved,
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      status: 500,
+      error: error instanceof Error ? error.message : String(error),
+    };
+  }
+}

package/src/server/lib/updates/apply.ts

@@ -12,6 +12,7 @@ import { updateKabmo } from '@/server/lib/updates/install';
 import { applyOmpUpdate } from '@/server/lib/updates/omp';
 import { withUpdateSlot } from '@/server/lib/updates/single-flight';
 import { recycleStandbyProcesses } from '@/server/lib/omp/session/standby.server';
+import type { InstalledCopy } from '@/server/lib/updates/installed-cli';
 import type { UpdateApplyResult, UpdateTarget } from '@/shared/types/updates';
 
 /** A stage label or a line of command output, as the update produces it. */
@@ -27,6 +28,12 @@ export interface UpdateProgressHooks {
 export interface AppliedUpdate {
   result: UpdateApplyResult;
   updated: boolean;
+  /**
+   * The copy this run left on disk, when it knows. The restart that follows
+   * launches THIS one — the running process's own directory is the build the
+   * update just replaced, which is how a rename came back as the old product.
+   */
+  installed?: InstalledCopy | null;
 }
 
 /**
@@ -74,6 +81,7 @@ export async function applyUpdate(target: UpdateTarget, hooks: UpdateProgressHoo
           output: result.output || undefined,
         },
         updated: result.updated,
+        installed: result.installed,
       };
     }