@monster-orange/den 0.4.13 → 0.4.15

package/src/shared/environment-manager/workspaces.ts

@@ -344,6 +344,37 @@ export function resolveWorkspaceDir(
   return reposRoot;
 }
 
+/**
+ * The folders of a workspace's by-path repos (`repo add <path>`), wherever
+ * they are, outside its own folder too (AG-17.1). Managed clones and a
+ * feature workspace's clones live under Den's or the workspace's folder.
+ */
+export function repoFolders(cfg: WorkspaceConfig | undefined): string[] {
+  return Object.values(cfg?.services ?? {})
+    .map((e) => (e as { path?: string }).path)
+    .filter((p): p is string => typeof p === "string" && path.isAbsolute(p));
+}
+
+/**
+ * Where Bring in looks for a workspace's conversations (AG-17.1). Its own
+ * folder, and everything in it; each by-path repo's folder, outside it
+ * too. When its folder is only the shared repos root (no folder of its
+ * own), the root's other subfolders are other workspaces' repos or no
+ * repo at all: only its repos' folders count, and the root itself only
+ * exactly.
+ */
+export function conversationFolders(
+  name: string,
+  cfg: WorkspaceConfig,
+  reposRoot: string,
+): { under: string[]; exact: string[] } {
+  const dir = resolveWorkspaceDir(name, cfg, reposRoot);
+  const repos = repoFolders(cfg);
+  if (path.resolve(dir) === path.resolve(reposRoot))
+    return { under: repos, exact: [dir] };
+  return { under: [dir, ...repos], exact: [] };
+}
+
 export function getWorkspaceByName(name: string): {
   name: string;
   config: WorkspaceConfig;

package/src/shared/web-session.ts

@@ -21,7 +21,7 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import * as yaml from "yaml";
-import { parseMachineName } from "./cli-command.js";
+import { parseMachineName, parseSshUser } from "./cli-command.js";
 import { getStateDir } from "./paths.js";
 
 export const LOGIN_CODE_TTL_MS = 60_000;
@@ -195,6 +195,12 @@ export interface WebAuthConfig {
    * page gives this machine ("runs on <name>"). Unset: the short hostname.
    */
   machineName?: string;
+  /**
+   * `web.ssh_user` (SEC-2a-UX; user.yml, else the distribution's): the
+   * account the signed-out page's ssh link logs in as. Unset: the account
+   * Den runs as. "": no account on the page.
+   */
+  sshUser?: string;
 }
 
 /** `web.edge_unattested`'s values. */
@@ -290,8 +296,13 @@ export function readWebAuthConfig(
   const clientId =
     clientIdOf(user, "config/local/user.yml") ?? clientIdOf(team, configFile);
   const machineName = parseMachineName(user.machine_name);
+  const sshUser =
+    user.ssh_user !== undefined
+      ? parseSshUser(user.ssh_user)
+      : parseSshUser(team.ssh_user);
   return {
     ...(machineName ? { machineName } : {}),
+    ...(sshUser !== undefined ? { sshUser } : {}),
     allowPlainHttpRemote: plain === true,
     ignored,
     edgeUnattested: unattested ?? "signin",
@@ -319,6 +330,43 @@ function clientIdOf(
   return v.trim();
 }
 
+// ── The approval key (0.4.15) ─────────────────────────────────────────────
+
+/**
+ * Why a cookie alone can't approve an agent's change: browsers send a
+ * localhost cookie to every localhost port (cookies ignore ports), so a
+ * dev server an agent runs on another port receives Den's session cookie,
+ * and GET /api/session gives any cookie holder the session's CSRF token.
+ * The approval key is a second secret only the signed-in page holds: it
+ * comes in the sign-in's own answer (a 303's URL fragment, which never
+ * reaches a server, or the sign-in poll's JSON), the page keeps it in its
+ * localStorage (per origin, port included), and sends it as
+ * X-Den-Approve-Key.
+ */
+export const APPROVE_KEY_HEADER = "x-den-approve-key";
+/** The fragment parameter a sign-in's 303 carries it in. */
+export const APPROVE_KEY_FRAGMENT = "ak";
+
+export function approveKeyHash(key: string): string {
+  return createHash("sha256").update(`den-approve-v1:${key}`).digest("hex");
+}
+
+/** Whether `given` is the key whose hash the session keeps (constant time). */
+export function approveKeyMatches(
+  storedHash: string | undefined,
+  given: string | undefined | null,
+): boolean {
+  if (!storedHash || !given || !/^[A-Za-z0-9_-]{43}$/.test(given)) return false;
+  const a = Buffer.from(approveKeyHash(given), "hex");
+  const b = Buffer.from(storedHash, "hex");
+  return a.length === b.length && a.length > 0 && timingSafeEqual(a, b);
+}
+
+/** `next` with the approval key in its fragment (a sign-in's 303). */
+export function withApproveKey(next: string, key: string): string {
+  return `${next.split("#")[0]}#${APPROVE_KEY_FRAGMENT}=${key}`;
+}
+
 // ── The session store ──────────────────────────────────────────────────────
 
 export interface SessionRecord {
@@ -329,14 +377,21 @@ export interface SessionRecord {
   csrf: string;
   /** The Host it was issued on. */
   host: string;
-  /** SEC-2a: how it signed in: a GitHub sign-in, or a one-time link (pairing). Unset: a link (before 0.4.5). */
-  via?: "github" | "link" | "code";
+  /** SEC-2a: how it signed in: a GitHub sign-in, a one-time link, a code (pairing), or the install's setup link (claim, 0.4.15). Unset: a link (before 0.4.5). */
+  via?: "github" | "link" | "code" | "claim";
   /** SEC-2a: the client's address when Den could attest it. */
   client?: string;
   /** SEC-2a: a GitHub sign-in's login (the chip's "@login"). */
   login?: string;
   /** SEC-2a: not yet greeted ("This device is signed in…", once). */
   welcome?: true;
+  /**
+   * 0.4.15: sha256 of this session's approval key (approvalKeyMatches).
+   * The key itself is handed over once, at the end of the sign-in, and
+   * never by GET /api/session. Unset: a session from before 0.4.15, which
+   * must sign in again to approve.
+   */
+  approveKeyHash?: string;
 }
 
 interface StoreFile {
@@ -464,14 +519,17 @@ export class WebSessionStore {
   create(meta: {
     userAgent?: string;
     host?: string;
-    via?: "github" | "link" | "code";
+    via?: "github" | "link" | "code" | "claim";
     client?: string;
     login?: string;
   }): {
     id: string;
     session: SessionView;
+    /** The approval key, for the sign-in's answer only (never stored). */
+    approveKey: string;
   } {
     const id = randomBytes(32).toString("base64url");
+    const approveKey = randomBytes(32).toString("base64url");
     const key = this.keyOf(id);
     if (!key) throw new Error("web.secret is missing: no session can be made");
     const now = this.now();
@@ -487,12 +545,13 @@ export class WebSessionStore {
       ...(meta.client ? { client: String(meta.client).slice(0, 64) } : {}),
       ...(meta.login ? { login: String(meta.login).slice(0, 64) } : {}),
       welcome: true,
+      approveKeyHash: approveKeyHash(approveKey),
     };
     const data = structuredClone(this.load());
     this.prune(data, now);
     data.sessions[key] = rec;
     this.save(data);
-    return { id, session: { key, ...rec } };
+    return { id, session: { key, ...rec }, approveKey };
   }
 
   /**

package/src/ui/cli/agent-ops.ts

@@ -116,6 +116,7 @@ import {
   restoreRecord,
   writeRecord,
   checkDisplayName,
+  nameSlug,
   writeRuntimeFiles,
   type AgentRecord,
   type Override,
@@ -129,6 +130,7 @@ import {
   syncConfiguredRuntimes,
   type AgentMcp,
   type LaunchInput,
+  type LaunchOutput,
   type Runtime,
 } from "../../shared/agents/runtimes.js";
 import type {
@@ -136,6 +138,12 @@ import type {
   RuntimeModel,
   RuntimePermissions,
 } from "../../shared/agents/runtime.js";
+import {
+  inScope,
+  OPEN_ELSEWHERE_MESSAGE,
+  openElsewhere,
+  type RuntimeConversation,
+} from "../../shared/agents/conversations.js";
 import {
   archiveHandoff,
   DEFAULT_ROTATE,
@@ -185,6 +193,11 @@ export interface AgentsDeps extends SessionsDeps {
   distRoot?: () => string;
   /** A workspace's checkout directory: where its agents run. */
   workspaceDir?: (ws: string) => string;
+  /**
+   * AG-17.1: the folders a workspace's conversations may have run in: its
+   * own folder, and each repo's path, a repo added by path outside it too.
+   */
+  workspaceFolders?: (ws: string) => { under: string[]; exact?: string[] };
   /** The MCP server binary and its env; Den adds the scoped args. */
   mcpServer?: () => { command: string[] | string; env: Record<string, string> };
   /**
@@ -221,6 +234,7 @@ export interface AgentsResolved extends Resolved {
   agentsConfig: () => ResolvedAgentsConfig;
   distRoot: () => string;
   workspaceDir: (ws: string) => string;
+  workspaceFolders: (ws: string) => { under: string[]; exact?: string[] };
   mcpServer: () => { command: string[] | string; env: Record<string, string> };
   exitWatchMs: number;
   stopWaitMs: number;
@@ -250,6 +264,8 @@ export class AgentError extends Error {
   readonly usage: boolean;
   readonly code?: string;
   readonly hints: string[];
+  /** AG-10.10: the running agent a start collided with, so a page can open it. */
+  readonly running?: { id: string; sessionId: string };
   constructor(
     message: string,
     o: {
@@ -257,6 +273,7 @@ export class AgentError extends Error {
       usage?: boolean;
       code?: string;
       hints?: string[];
+      running?: { id: string; sessionId: string };
     } = {},
   ) {
     super(message);
@@ -265,6 +282,7 @@ export class AgentError extends Error {
     this.usage = o.usage ?? false;
     this.code = o.code;
     this.hints = o.hints ?? [];
+    if (o.running) this.running = o.running;
   }
 }
 
@@ -276,6 +294,8 @@ const refused = (message: string, hints: string[] = [], status = 409) =>
   new AgentError(message, { status, hints });
 
 let workspaceDirFn: ((ws: string) => string) | null = null;
+let foldersFn: ((ws: string) => { under: string[]; exact?: string[] }) | null =
+  null;
 /** The workspaces config, for start and resume (loaded on first use). */
 export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
   await loadWorkspaces(d);
@@ -287,6 +307,12 @@ export async function loadAgentWorkspaces(d: AgentsDeps): Promise<void> {
     if (!cfg) throw usage(`workspace "${name}" does not exist`, 404);
     return ws.resolveWorkspaceDir(name, cfg, getReposRoot());
   };
+  // A by-path repo's own folder (repo add <path>), wherever it is.
+  foldersFn = (name) => {
+    const cfg = ws.readWorkspacesFile().workspaces[name];
+    if (!cfg) throw usage(`workspace "${name}" does not exist`, 404);
+    return ws.conversationFolders(name, cfg, getReposRoot());
+  };
 }
 
 /** The distribution's bin shim (as `mcp connect` registers), else Den's CLI. */
@@ -317,6 +343,14 @@ export function resolveAgentsDeps(d: AgentsDeps): AgentsResolved {
         if (!workspaceDirFn) throw new Error("workspaces not loaded");
         return workspaceDirFn(ws);
       }),
+    workspaceFolders:
+      d.workspaceFolders ??
+      ((ws) => {
+        // A caller that gives its own folder (a test) gives just it.
+        if (d.workspaceDir) return { under: [d.workspaceDir(ws)] };
+        if (!foldersFn) throw new Error("workspaces not loaded");
+        return foldersFn(ws);
+      }),
     mcpServer: d.mcpServer ?? (() => defaultMcpServer(base.cli)),
     exitWatchMs: d.exitWatchMs ?? EXIT_WATCH_MS,
     stopWaitMs: d.stopWaitMs ?? STOP_WAIT_MS,
@@ -1012,13 +1046,68 @@ function sessionOf(
 }
 
 /**
- * The id an agent gets: --id, else the persona's id while it is free (or
- * this workspace's), else `<persona>-<ws>`.
+ * The id a new start gets without --id (AG-10.10): the persona's id while
+ * no agent has it; `<persona>-<ws>` when another workspace's agent has it;
+ * else the first of `<base>-2`, `<base>-3`… no agent has. A stopped agent's
+ * id is never reused by a new start: only its Resume or Start fresh.
+ */
+/**
+ * AG-10.10b: the id a Name gives: its slug while no agent has it; a
+ * running agent in the workspace with that id or that title is refused
+ * (open it instead); a stopped one, or another workspace's, makes it the
+ * next free `<slug>-2`… (Resume continues the stopped one). Null when the
+ * Name has no id characters: the persona's default then.
  */
-function defaultId(stateDir: string, persona: string, ws: string): string {
+async function namedId(
+  d: AgentsResolved,
+  name: string,
+  ws: string,
+): Promise<string | null> {
+  const slug = nameSlug(name);
+  const sessions = await withClient(d, (c) => c.list());
+  const live = (rec: AgentRecord) => {
+    const s = sessionOf(sessions, rec);
+    return s && !s.exited ? s : undefined;
+  };
+  // No two live agents in one workspace share a title, or this id.
+  for (const rec of listRecords(d.stateDir())) {
+    if (rec.workspace !== ws) continue;
+    const same =
+      rec.id === slug ||
+      (rec.displayName ?? "").toLowerCase() === name.toLowerCase();
+    const s = same ? live(rec) : undefined;
+    if (s)
+      throw new AgentError(`agent ${rec.id} is running (${s.name})`, {
+        status: 409,
+        hints: [`Attach: ${d.cli} sessions attach ${s.name}`],
+        running: { id: rec.id, sessionId: s.ref.id },
+      });
+  }
+  if (!slug) return null;
+  if (!readRecord(d.stateDir(), slug)) return slug;
+  const stem = slug.slice(0, 58);
+  for (let n = 2; n < 1000; n++) {
+    const id = `${stem}-${n}`;
+    if (!readRecord(d.stateDir(), id)) return id;
+  }
+  throw refused(`no free agent id for ${slug}: give one with --id`);
+}
+
+export function defaultId(
+  stateDir: string,
+  persona: string,
+  ws: string,
+): string {
   const rec = readRecord(stateDir, persona);
-  if (!rec || rec.workspace === ws) return persona;
-  return `${persona}-${ws}`.slice(0, 64);
+  if (!rec) return persona;
+  const base = rec.workspace === ws ? persona : `${persona}-${ws}`.slice(0, 64);
+  if (base !== persona && !readRecord(stateDir, base)) return base;
+  const stem = base.slice(0, 58);
+  for (let n = 2; n < 1000; n++) {
+    const id = `${stem}-${n}`;
+    if (!readRecord(stateDir, id)) return id;
+  }
+  throw refused(`no free agent id for ${persona}: give one with --id`);
 }
 
 function checkId(where: string, id: string): void {
@@ -1310,6 +1399,8 @@ export interface StartRequest {
   permission?: string;
   /** Extra allowed commands for this launch, instead of the persona's. */
   allow?: unknown;
+  /** AG-10.10: a display name for this agent (AG-4b's), to tell two apart. */
+  name?: unknown;
   /**
    * The page's start (AG-10.1): a model must be one the runtime offers,
    * never a free string (the CLI's --model for generic stays free).
@@ -1418,6 +1509,11 @@ interface StartMore {
   rotations?: AgentRecord["rotations"];
   /** Called once the old session is known ended, before the launch. */
   beforeLaunch?: () => void;
+  /**
+   * AG-17.1, bring in a conversation: launch the runtime's resume of this
+   * one (its id, in the folder it ran in) instead of a new conversation.
+   */
+  bringIn?: { token: string; cwd: string };
 }
 
 export async function startAgent(
@@ -1436,7 +1532,17 @@ export async function startAgent(
     throw usage(
       `${where}: no persona "${req.persona}" (personas: ${[...all.keys()].sort().join(", ")})`,
     );
-  const id = req.id ?? defaultId(d.stateDir(), persona.id, ws);
+  let given: string | null = null;
+  if (req.name !== undefined)
+    try {
+      given = checkDisplayName(req.name);
+    } catch (e) {
+      throw usage(`${where}: ${(e as Error).message}`);
+    }
+  const id =
+    req.id ??
+    (given ? await namedId(d, given, ws) : null) ??
+    defaultId(d.stateDir(), persona.id, ws);
   checkId(where, id);
   syncCatalog(d);
   const rt = runtimeFor(req.runtime ?? persona.runtime ?? DEFAULT_RUNTIME_ID);
@@ -1457,6 +1563,10 @@ export async function startAgent(
       ...(rt.permissions ? { allow } : {}),
     }),
     ...(more.firstPrompt ? { firstPrompt: more.firstPrompt } : {}),
+    // AG-17.1: the runtime's resume, in the folder the conversation ran in.
+    ...(more.bringIn
+      ? { worktree: more.bringIn.cwd, resumeToken: more.bringIn.token }
+      : {}),
   };
   // AG-13.4: a command a runtime can't express is said, never dropped.
   const unexpressed =
@@ -1470,10 +1580,14 @@ export async function startAgent(
     const sessions = await c.list();
     const old = prev ? sessionOf(sessions, prev) : undefined;
     if (old && !old.exited)
-      throw refused(`agent ${id} is running (${old.name})`, [
-        `Attach: ${d.cli} sessions attach ${old.name}`,
-      ]);
-    const out = launchOrThrow(() => rt.launch(input));
+      throw new AgentError(`agent ${id} is running (${old.name})`, {
+        status: 409,
+        hints: [`Attach: ${d.cli} sessions attach ${old.name}`],
+        running: { id, sessionId: old.ref.id },
+      });
+    const out = more.bringIn
+      ? { ...broughtIn(rt, input), resumeToken: more.bringIn.token }
+      : launchOrThrow(() => rt.launch(input));
     more.beforeLaunch?.();
     // A new conversation: a handoff left from the last one is kept aside,
     // so the next rotation needs its own (den#4).
@@ -1504,18 +1618,24 @@ export async function startAgent(
           // AG-4b: a name given to the agent is the agent's, not its
           // conversation's: Start fresh and Relaunch keep it. AG-10.8:
           // else its persona's name ("Rita").
-          ...(prev?.displayName
-            ? { displayName: prev.displayName }
-            : persona.displayName
-              ? { displayName: persona.displayName }
-              : {}),
-          ...(prev?.displayName && prev.displayNameAt
-            ? { displayNameAt: prev.displayNameAt }
-            : {}),
+          // AG-10.10: a name given at start wins.
+          ...(given
+            ? { displayName: given, displayNameAt: new Date().toISOString() }
+            : prev?.displayName
+              ? {
+                  displayName: prev.displayName,
+                  ...(prev.displayNameAt
+                    ? { displayNameAt: prev.displayNameAt }
+                    : {}),
+                }
+              : persona.displayName
+                ? { displayName: persona.displayName }
+                : {}),
           // 0.4.8: launched on this token, so a resume continues it.
           ...(out.resumeToken
             ? { resumeToken: out.resumeToken, launched: true }
             : {}),
+          ...(more.bringIn ? { broughtInAt: new Date().toISOString() } : {}),
         },
         argv: out.argv,
         env: out.env,
@@ -1536,6 +1656,188 @@ export async function startAgent(
   });
 }
 
+/** A bring-in's launch: the runtime's resume (AG-17.1), never a new one. */
+function broughtIn(
+  rt: Runtime,
+  input: LaunchInput,
+): Omit<LaunchOutput, "resumeToken"> {
+  const out = launchOrThrow(() => rt.resume?.(input) ?? null);
+  if (!out) throw refused(`${rt.id} can't continue a conversation`);
+  return out;
+}
+
+// ── AG-17.1: bring in a conversation ────────────────────────────────────────
+
+/** A runtime's conversation as Bring in lists it. */
+export interface ListedConversation extends RuntimeConversation {
+  runtime: string;
+  /** Written in the last minute: still open in another terminal. */
+  open: boolean;
+  /** The Den agent already continuing it, if one is. */
+  agent?: string;
+}
+
+/** Each runtime, and whether it can bring a conversation in. */
+export interface BringInRuntime {
+  id: string;
+  label: string;
+  bringIn: boolean;
+  /** Why it can't, for the page. */
+  why?: string;
+}
+
+function bringInRuntimes(): BringInRuntime[] {
+  return runtimeIds().map((id) => {
+    const rt = getRuntime(id)!;
+    const label = rt.label ?? id;
+    return rt.listSessions
+      ? { id, label, bringIn: true }
+      : {
+          id,
+          label,
+          bringIn: false,
+          why: `${label} can't bring in a conversation yet`,
+        };
+  });
+}
+
+/** The conversation id each agent of this state dir continues. */
+function agentByToken(d: AgentsResolved): Map<string, string> {
+  const m = new Map<string, string>();
+  for (const r of listRecords(d.stateDir()))
+    if (r.resumeToken) m.set(`${r.runtime} ${r.resumeToken}`, r.id);
+  return m;
+}
+
+/**
+ * The conversations Bring in offers for workspace `ws` (AG-17.1): each
+ * runtime's own (only those with listSessions), that ran in the
+ * workspace's folder or inside it, newest first. Reading never starts
+ * anything; a runtime's history is read only at the ends of each file.
+ */
+export function listConversations(
+  d: AgentsResolved,
+  ws: string,
+  runtime?: string,
+): { runtimes: BringInRuntime[]; conversations: ListedConversation[] } {
+  const where = "agents import";
+  checkWorkspaceName(where, ws);
+  if (!d.workspaceExists(ws))
+    throw usage(`${where}: workspace "${ws}" does not exist`, 404);
+  syncCatalog(d);
+  if (runtime !== undefined) runtimeFor(runtime);
+  // Its folder and every repo's; a shared root only exactly (AG-17.1).
+  const scope = d.workspaceFolders(ws);
+  const taken = agentByToken(d);
+  const now = Date.now();
+  const conversations: ListedConversation[] = [];
+  const seen = new Set<string>();
+  for (const id of runtimeIds()) {
+    if (runtime !== undefined && id !== runtime) continue;
+    const rt = getRuntime(id);
+    if (!rt?.listSessions) continue;
+    for (const c of rt.listSessions(scope, d.env)) {
+      if (seen.has(`${id} ${c.id}`)) continue;
+      seen.add(`${id} ${c.id}`);
+      const agent = taken.get(`${id} ${c.id}`);
+      conversations.push({
+        ...c,
+        runtime: id,
+        open: openElsewhere(c.lastAt, now),
+        ...(agent ? { agent } : {}),
+      });
+    }
+  }
+  conversations.sort((a, b) => b.lastAt.localeCompare(a.lastAt));
+  return { runtimes: bringInRuntimes(), conversations };
+}
+
+export interface ImportRequest {
+  workspace: string;
+  /** The runtime's conversation id. */
+  session: string;
+  persona: string;
+  runtime?: string;
+  id?: string;
+}
+
+/** The persona's id, else the first `<persona>-<n>` no agent has. */
+function freeId(d: AgentsResolved, persona: string): string {
+  if (!readRecord(d.stateDir(), persona)) return persona;
+  for (let n = 2; n < 1000; n++) {
+    const id = `${persona.slice(0, 58)}-${n}`;
+    if (!readRecord(d.stateDir(), id)) return id;
+  }
+  throw refused(`no free agent id for ${persona}: give one with --id`);
+}
+
+/**
+ * Bring a conversation in (AG-17.1): the runtime's resume of it, under Den
+ * (its token, hooks, guards, the folder it ran in, the audit trail), as a
+ * new agent with the persona given. Afterwards it is an agent like any
+ * other: stop, resume, rename. Refused while the conversation is open in
+ * another terminal (written in the last minute), when an agent already
+ * continues it, or when it isn't one of the workspace's.
+ */
+export async function importAgent(
+  d: AgentsResolved,
+  req: ImportRequest,
+): Promise<Started> {
+  const where = "agents import";
+  const runtime = req.runtime ?? DEFAULT_RUNTIME_ID;
+  const { runtimes, conversations } = listConversations(
+    d,
+    req.workspace,
+    runtime,
+  );
+  const rt = runtimes.find((r) => r.id === runtime);
+  if (!rt?.bringIn)
+    throw refused(
+      rt?.why ?? `${runtime} can't bring in a conversation`,
+      [],
+      422,
+    );
+  const c = conversations.find((x) => x.id === req.session);
+  // Another workspace's (or no repo's): say whose, never bring it in.
+  const elsewhere = c
+    ? null
+    : (getRuntime(runtime)?.conversationCwd?.(req.session, d.env) ?? null);
+  if (!c && elsewhere && !inScope(elsewhere, d.workspaceFolders(req.workspace)))
+    throw refused(
+      `This conversation belongs to ${elsewhere}, not to workspace ${req.workspace}`,
+      [`List this workspace's: ${d.cli} agents import -w ${req.workspace}`],
+      409,
+    );
+  if (!c)
+    throw refused(
+      `${where}: no ${rt.label} conversation "${req.session}" in workspace ${req.workspace}'s folder`,
+      [`List them: ${d.cli} agents import -w ${req.workspace}`],
+      404,
+    );
+  if (c.agent)
+    throw new AgentError(
+      `${where}: agent ${c.agent} already continues this conversation`,
+      {
+        code: "already_agent",
+        hints: [
+          `Resume it: ${d.cli} agents resume ${c.agent} -w ${req.workspace}`,
+        ],
+      },
+    );
+  if (c.open)
+    throw new AgentError(OPEN_ELSEWHERE_MESSAGE, { code: "open_elsewhere" });
+  if (!fs.statSync(c.cwd, { throwIfNoEntry: false })?.isDirectory())
+    throw refused(`${where}: the folder it ran in, ${c.cwd}, is gone`);
+  const id = req.id ?? freeId(d, req.persona);
+  if (readRecord(d.stateDir(), id))
+    throw refused(`${where}: agent ${id} exists; give this one another --id`);
+  return startAgent(
+    d,
+    { workspace: req.workspace, persona: req.persona, runtime, id },
+    { bringIn: { token: c.id, cwd: c.cwd } },
+  );
+}
+
 // ── stop, resume ────────────────────────────────────────────────────────────
 
 /** The code of a refusal naming another workspace's agent. */