@monster-orange/den 0.4.16 → 0.4.17

package/CHANGELOG.md

@@ -4,6 +4,64 @@ All notable changes to Den are documented here. Each release lists the
 config and manifest changes a distribution must make to move to it under
 **Migrations**.
 
+## [0.4.17] - 2026-11-08
+
+### Fixed
+
+- **An agent's workspace is a link.** The agent pane's header and the
+  workspace's heading in the Agents list link to the Workspaces page
+  focused on it (`?ws=`). ⌘K has "Go to workspace <ws>" for every
+  workspace, the front agent's first on the Agents page, found by the
+  workspace's name or any of its agents'.
+- **"Last test run" is the server's.** The Workspaces page's "Last run"
+  column is now "Last test run", read from the server's run history
+  (`<state>/run-history.jsonl`, `GET /api/runs/last`). It shows runs from
+  every browser and survives a restart. The service's own state ("up 2h")
+  is shown apart from it.
+- **One org rule.** Environments and Releases have no org picker of their
+  own. Both follow the top bar's View and say so with the same note. A
+  page shows its own org picker only when it filters by org.
+- **Environments never waits on a slow host.** Every row shows at once,
+  pulsing "checking", and each result streams into its row. The server
+  runs at most 12 checks at once, each capped at 10 s; one that runs out
+  of time says "timed out after 10 s". Re-check works while checks run.
+- **An agent in an inactive workspace opens its terminal.** The terminal
+  route checks the person and the agent, not the workspace's active
+  flag. The pane says "Sign in" only when you're signed out; any other
+  refusal gives its real reason.
+- **Menus are never clipped.** Every ⋯ menu in the shell (Workspaces
+  rows and the workspace menu, the top bar's menus) now opens in the
+  browser's top layer through one shared helper, so a scrolling table or
+  card no longer cuts it off. It stays beside its button, flips up near
+  the bottom of the window, and closes on an outside click as before.
+- **The Tests module picker is never clipped.** It uses the same
+  top-layer menu.
+- **Visit ↗ opens a service.** Workspaces (beside Start, Stop, Restart
+  and Logs, and as a link on the service's name), Services and Graph
+  cards open the service's edge URL when it is routed, else its local
+  URL, in a new tab. A service with no URL has no Visit. Below 1600 px
+  wide the Workspaces button shows only "↗". The detail panel's "Open ↗"
+  is now "Visit ↗".
+- **Favourite a service from Workspaces and Graph.** Workspaces rows and
+  Graph cards (top-right) have the ☆ star. It uses the same list as
+  Services, so a favourite set on one page shows on all of them.
+- **Change persona on an agent that was never prompted** said "same
+  conversation", though there was nothing to resume: it starts fresh under
+  the same conversation id, as Resume does. The CLI, the API (`note`, with
+  `fresh: true`), the toast and the pane now say "nothing to resume yet;
+  started fresh (same conversation id, folder and scope)".
+- **Last test run counts a repo's own suites.** A run of the suites pillar
+  (a repo's `tests:`, such as `unit`) and a repo's performance modules
+  now name the repos they test, so a repo with only `tests: unit` fills
+  its Last test run. Den's own integration tests name none.
+- **The Workspaces table keeps its height in a short window.** Under about
+  620 px tall it shrank to nothing and its rows and ⋯ were out of reach.
+  It keeps at least 200 px and scrolls.
+
+### Migrations
+
+None.
+
 ## [0.4.16] - 2026-11-08
 
 ### Added

package/README.md

@@ -10,8 +10,8 @@
 </p>
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.16/hero-dark.png">
-  <img src="docs/images/0.4.16/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
+  <source media="(prefers-color-scheme: dark)" srcset="docs/images/0.4.17/hero-dark.png">
+  <img src="docs/images/0.4.17/hero-light.png" width="100%" alt="Den's Graph page: the demo workspace's services grouped by application, all healthy, with the status chip and the left rail">
 </picture>
 
 ## Set up by your agent
@@ -38,7 +38,7 @@ It doesn't replace your tools. Your repos, Docker, your test runners, your secre
 yours. Den connects them and turns on good practice from the start.
 
 <p align="center">
-  <img src="docs/images/0.4.16/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
+  <img src="docs/images/0.4.17/up.gif" width="100%" alt="make up in the Graph page: every stack down, then demo-api, demo-web and demo-notes come up in dependency order until the status chip reads All 3 healthy">
 </p>
 
 ## How it helps
@@ -68,10 +68,10 @@ yours. Den connects them and turns on good practice from the start.
   lives in your own repo.
 
 <p align="center">
-  <img src="docs/images/0.4.16/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
-  <img src="docs/images/0.4.16/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
-  <img src="docs/images/0.4.16/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
-  <img src="docs/images/0.4.16/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
+  <img src="docs/images/0.4.17/agents.png" width="49%" alt="The Agents tab: the demo workspace's sessions on the left, and one open in a terminal pane on the right, running demo-api's test and then the service">
+  <img src="docs/images/0.4.17/workspaces.png" width="49%" alt="The Workspaces page: the demo workspace's repos with their health, mode and Start, Stop, Restart and Logs actions">
+  <img src="docs/images/0.4.17/status-drawer.png" width="49%" alt="The status drawer: nothing needs attention, and every service in the demo workspace, by application, with its latency">
+  <img src="docs/images/0.4.17/edge.png" width="49%" alt="The Edge page: the edge container up, its ports and TLS, and every route it serves, Den's own and each stack's, with its upstream">
 </p>
 
 ## Get started

package/docs/distributions.md

@@ -355,6 +355,19 @@ is never mistaken for another repo's service. An alias that names more than
 one service is an error that lists them (`"worker" is ambiguous in workspace
 "default": one/worker, two/worker`); name one of them.
 
+## Opening a service
+
+A service with a URL gets **Visit ↗**, which opens it in a new tab. It
+shows on Workspaces (beside Start, Stop, Restart and Logs, and as a link
+on the service's name), on Services and on Graph cards. Den picks the
+URL in this order: the service's `urls.<env>`; for `local`, its edge
+route when the edge serves one; else the origin of its HTTP health
+check. A service with none of these has no Visit.
+
+The ☆ star on Workspaces rows, Services and Graph cards marks a
+favourite. It is one list, saved in `shell.pins`, so a star set on one
+page shows on all of them.
+
 ## Health checks
 
 A service declares its health per environment under `health`, in one of
@@ -432,6 +445,36 @@ that a container existed, running or not).
 `service`, with both forms at once, or with a key of another type (`cmd`,
 `url`), and says which.
 
+### The Environments page
+
+The Environments page lists every service's row at once, each cell pulsing
+"checking" until its result arrives. The results stream in one at a time
+(`GET /api/health/stream`, one event per check), so a slow host holds up
+its own cell only. The server runs at most 12 checks at once, and no check
+takes longer than 10 s. A check that runs out of time says "timed out after
+10 s" in its row. Re-check and the page's other controls work while the
+checks run.
+
+The page has no org picker of its own. It follows the top bar's View (all
+active workspaces, or one), asks for that workspace only, and says so:
+"Shows workspace south, as the top bar's View. Change it there." The
+Release page follows the same rule with the same note. A page shows its own
+org picker only when it filters by org.
+
+### Last test run
+
+The Workspaces page's "Last test run" column shows each repo's latest test
+run: its result (✓ or ✗), how long ago, and the pillar and environment on
+hover. It reads the server's run history, so it shows runs started from any
+browser or tab, and it survives a restart. The service's own state ("up 2h")
+is shown apart from it, in the Health cell.
+
+The history is `<state>/run-history.jsonl` (mode 0600): one line when a run
+starts and one when it ends. Past 2000 lines it keeps the newest 1000.
+`GET /api/runs/last` (read only) gives `{ repos: { <repo>: { id, pillar,
+env, repos, startedAt, endedAt, exitCode, running } } }`. A run a restart
+cut off has no end and is not shown.
+
 ## Placement
 
 Each service says where it runs, per environment: `local` (on this machine,
@@ -2552,6 +2595,18 @@ text frame `{"type":"resize","cols":c,"rows":r}` resizes, and the server
 sends `{"type":"session",…}` first and `{"type":"exit","exitCode":n}` when
 the session ends.
 
+The terminal route checks the person and the agent, not whether the
+agent's workspace is active: an agent in a workspace you've switched away
+from still opens. A `GET` of the io path (not a WebSocket) says why one
+would be refused: `401` when you're signed out (the pane then says "Sign
+in"), `404` with the reason when there is no such session here, and `426`
+when the upgrade would be allowed. The pane shows that reason, not "Sign
+in", for any refusal but the first.
+
+The pane's header and the workspace's heading in the list link to the
+Workspaces page focused on that workspace (`/local-dev?ws=<ws>`), and ⌘K
+has "Go to workspace <ws>" for each workspace with agents.
+
 ### Stopped agents: Resume, Start fresh, Remove
 
 An agent that stops stays in the list, below the running ones (AG-14, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monster-orange/den",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "description": "Den: a local multi-repo dev orchestrator, HTTPS edge and E2E harness",
   "type": "module",
   "bin": {

package/src/ui/cli/agent-ops.ts

@@ -2212,6 +2212,13 @@ export interface PersonaChanged extends Resumed {
   from: string;
 }
 
+/**
+ * What a resume with nothing to continue yet says (AG-14, AG-18): the
+ * runtime started fresh under the same conversation id.
+ */
+export const FRESH_NOTE =
+  "nothing to resume yet; started fresh (same conversation id, folder and scope)";
+
 /** How often, and how long, "after this turn" checks its turn (AG-18). */
 export const TURN_POLL_MS = 1_000;
 export const TURN_WAIT_MS = 30 * 60_000;

package/src/ui/cli/agents-command.ts

@@ -95,6 +95,7 @@ import {
   type AgentsDeps,
   type AgentsResolved,
   type EarlyExit,
+  FRESH_NOTE,
   type RuntimeChoice,
   type Started,
 } from "./agent-ops.js";
@@ -420,7 +421,9 @@ async function persona(args: string[], d: AgentsResolved): Promise<number> {
   return report(
     d,
     s,
-    `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); same conversation, as ${s.rec.sessionName} in ${s.rec.cwd}`,
+    s.fresh
+      ? `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); ${FRESH_NOTE}, as ${s.rec.sessionName} in ${s.rec.cwd}`
+      : `agent ${s.rec.id} is now ${s.rec.persona} (was ${s.from}); same conversation, as ${s.rec.sessionName} in ${s.rec.cwd}`,
   );
 }
 
@@ -468,10 +471,7 @@ async function resume(args: string[], d: AgentsResolved): Promise<number> {
   if (args.includes("--all-interrupted")) return resumeAll(args, d);
   const { id, ws } = idAndWorkspace("agents resume", args);
   const s = await resumeAgent(d, id, ws);
-  if (s.fresh)
-    d.out(
-      `agent ${s.rec.id}: nothing to resume yet; started fresh (same conversation id, folder and scope)`,
-    );
+  if (s.fresh) d.out(`agent ${s.rec.id}: ${FRESH_NOTE}`);
   return report(
     d,
     s,

package/src/ui/server/agent-routes.ts

@@ -140,6 +140,7 @@ import {
   type AgentsDeps,
   type AgentsResolved,
   type Started,
+  FRESH_NOTE,
 } from "../cli/agent-ops.js";
 import { agentSessionName } from "../../shared/agents/session-name.js";
 import { recordAction } from "./audit.js";
@@ -714,7 +715,9 @@ export async function handleAgentRoutes(
       }
       const s = await change();
       audit(what, s.early ? "exited at once" : undefined);
-      sendStarted(res, s, d);
+      // Never prompted: nothing was resumed, so it says so (not "same
+      // conversation").
+      sendStarted(res, s, d, s.fresh ? { note: FRESH_NOTE } : {});
     } else if (verb === "remove") {
       const removed = await removeAgent(d, id!, ws);
       audit(what);

package/src/ui/server/check-pool.ts

@@ -0,0 +1,72 @@
+/**
+ * How health checks run (0.4.17): at most CHECK_CONCURRENCY at once, each
+ * given at most CHECK_TIMEOUT_MS. A check that runs over its time gets the
+ * caller's stand-in result ("timed out after 10 s") rather than holding up
+ * the run, and the run never waits on it again.
+ */
+
+/** The most checks in flight at once. */
+export const CHECK_CONCURRENCY = 12;
+/** The longest one check may take, whatever its kind. */
+export const CHECK_TIMEOUT_MS = 10_000;
+
+/** What a check that ran out of time says. */
+export function timedOutText(ms: number): string {
+  return `timed out after ${Math.round(ms / 1000)} s`;
+}
+
+/**
+ * `p`, or `late()` once `ms` passes first. A late `p` that later settles
+ * is ignored, and so is its rejection.
+ */
+export function withTimeout<T>(
+  p: Promise<T>,
+  ms: number,
+  late: () => T,
+): Promise<T> {
+  return new Promise<T>((resolve, reject) => {
+    let done = false;
+    const timer = setTimeout(() => {
+      if (done) return;
+      done = true;
+      resolve(late());
+    }, ms);
+    timer.unref?.();
+    p.then(
+      (v) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        resolve(v);
+      },
+      (e: unknown) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
+        reject(e);
+      },
+    );
+  });
+}
+
+/**
+ * `fn` over `items`, at most `limit` at a time, the results in the items'
+ * order. Each starts as soon as a slot frees up.
+ */
+export async function runCapped<T, R>(
+  items: readonly T[],
+  limit: number,
+  fn: (item: T, index: number) => Promise<R>,
+): Promise<R[]> {
+  const out = new Array<R>(items.length);
+  let next = 0;
+  const worker = async (): Promise<void> => {
+    while (next < items.length) {
+      const i = next++;
+      out[i] = await fn(items[i], i);
+    }
+  };
+  const n = Math.max(1, Math.min(limit, items.length));
+  await Promise.all(Array.from({ length: n }, worker));
+  return out;
+}

package/src/ui/server/index.ts

@@ -31,6 +31,8 @@ import { moduleScanner } from "../../shared/test-discovery/module-scanner.js";
 import { resolveFieldEnv } from "../../shared/perf/optional-fields.js";
 import { testRunner } from "../cli/test-runner.js";
 import { discoverRepos } from "../../pillars/smoke/discover.js";
+import { planSuites } from "../../pillars/suites/run.js";
+import { listServicesWithManifests } from "../../shared/manifest/workspace-manifests.js";
 import {
   awsProfileEnv,
   loadAwsProfiles,
@@ -856,6 +858,19 @@ import { heldActions } from "./held-actions.js";
 import type { ApprovalQueue } from "./approvals.js";
 import { processPathRules } from "../cli/onboard-reads.js";
 import { handleAgentRoutes, startAgentUpkeep } from "./agent-routes.js";
+import {
+  lastRunsByRepo,
+  recordRunEnd,
+  recordRunStart,
+  reposOfRun,
+} from "./run-history.js";
+import {
+  CHECK_CONCURRENCY,
+  CHECK_TIMEOUT_MS,
+  runCapped,
+  timedOutText,
+  withTimeout,
+} from "./check-pool.js";
 import {
   handleSessionList,
   handleSessionUpgrade,
@@ -1273,6 +1288,9 @@ function sshUserNow(): string {
   return sshUser(set, osUser);
 }
 
+/** Test runs this server is running now, by id (run-history.ts). */
+const LIVE_RUNS = new Set<string>();
+
 /** The ssh target for this request: the Host it used, minus the port. */
 function sshTargetOf(req: http.IncomingMessage): string {
   return sshTarget(req.headers.host, os.hostname());
@@ -1969,8 +1987,10 @@ async function handleRequest(
   // AG-4a-term's session routes (`/api/sessions/<id>/io`): shell-grade, and
   // an agent's token reaches its own session's only (request-guard). The io
   // is a WebSocket (the server's upgrade handler): a plain GET of it is 426.
-  if (pathname.startsWith("/api/sessions/"))
-    return sendSessionHttp(req, res, pathname);
+  if (pathname.startsWith("/api/sessions/")) {
+    await sendSessionHttp(req, res, pathname);
+    return;
+  }
   // ON-3: an agent's held writes; Allow from the person's browser only.
   if (
     guard.ok &&
@@ -2782,15 +2802,55 @@ async function handleRequest(
     // Streaming emits in completion order, which varies per poll (shell probes
     // finish at wildly different speeds), so without a stable key the client
     // repaints the dots in a different order every 5s.
-    const results = await Promise.all(
-      sortedEntries.map((e, idx) =>
-        checkEntry(e).then((r) => {
-          const ranked = { ...r, openUrl: e.openUrl, links: e.links, idx };
-          onResult?.(ranked);
-          return ranked;
-        }),
+    // 0.4.17: at most CHECK_CONCURRENCY at once, each with at most
+    // CHECK_TIMEOUT_MS: a dead host's check says "timed out after 10 s" and
+    // never holds up the run (check-pool.ts).
+    const late = (e: (typeof sortedEntries)[number]): HealthResult => ({
+      repo: e.repo,
+      service: e.service,
+      label: e.label,
+      ...(e.checkType !== "none"
+        ? healthCheckFields(e.checkType, e.target)
+        : { url: null }),
+      repoPath: e.repoPath,
+      mode: e.mode,
+      isEntrypoint: e.isEntrypoint,
+      ...e.meta,
+      ms: CHECK_TIMEOUT_MS,
+      ok: false,
+      error: timedOutText(CHECK_TIMEOUT_MS),
+    });
+    const run = (e: (typeof sortedEntries)[number], idx: number) =>
+      withTimeout(checkEntry(e), CHECK_TIMEOUT_MS, () => late(e)).then((r) => {
+        const ranked = { ...r, openUrl: e.openUrl, links: e.links, idx };
+        onResult?.(ranked);
+        return ranked;
+      });
+    // Compose and container checks are answered in-process from one shared
+    // docker listing (the call in flight): they start no process, so they
+    // run outside the cap, all at once, and a cycle still lists once.
+    const inProcess = (e: (typeof sortedEntries)[number]) =>
+      (e.checkType === "container" && !!e.container) ||
+      (e.checkType === "shell" && !!e.compose && e.target === e.compose.cmd);
+    const indexed = sortedEntries.map((e, idx) => ({ e, idx }));
+    const results = new Array<HealthResult>(sortedEntries.length);
+    await Promise.all([
+      ...indexed
+        .filter(({ e }) => inProcess(e))
+        .map(({ e, idx }) =>
+          run(e, idx).then((r) => {
+            results[idx] = r;
+          }),
+        ),
+      runCapped(
+        indexed.filter(({ e }) => !inProcess(e)),
+        CHECK_CONCURRENCY,
+        ({ e, idx }) =>
+          run(e, idx).then((r) => {
+            results[idx] = r;
+          }),
       ),
-    );
+    ]);
     return results;
   }
 
@@ -3413,6 +3473,13 @@ async function handleRequest(
     return;
   }
 
+  // ── API: each repo's last test run (0.4.17, run-history.ts) ─────────────────
+  if (pathname === "/api/runs/last") {
+    return sendJson(res, {
+      repos: lastRunsByRepo(getStateDir(), LIVE_RUNS),
+    });
+  }
+
   // ── API: running daemons list ──────────────────────────────────────────────
   if (pathname === "/api/service/daemons") {
     await startupPrune;
@@ -3878,8 +3945,36 @@ async function handleRequest(
 
     const startTime = Date.now();
     let overallExit = 0;
+    // 0.4.17: the server's run history (every browser's runs, kept), which
+    // Workspaces' Last test run reads per repo.
+    // Every run kind that runs a repo's own tests names it, the suites
+    // pillar (`tests:`) and a repo's performance modules included.
+    const tested = await reposOfRun(String(pillar), String(env), modules, {
+      pillarSources: (p) =>
+        collectTestSources(p as Pillar).map((x) => x.repoName),
+      suiteRepos: (e, only) =>
+        planSuites(listServicesWithManifests(), e as Environment, only).run.map(
+          (x) => x.repo,
+        ),
+      perfModules: async () =>
+        (await moduleScanner.scanModules("performance")).map((m) => m.name),
+      repoNames: () => discoverRepos().map((r) => r.repoName),
+    });
+    LIVE_RUNS.add(runId);
+    recordRunStart(getStateDir(), {
+      id: runId,
+      pillar: String(pillar),
+      env: String(env),
+      repos: tested,
+    });
+    let recorded = false;
 
     const finishLifecycle = (exitCode: number, note?: string): void => {
+      if (!recorded) {
+        recorded = true;
+        LIVE_RUNS.delete(runId);
+        recordRunEnd(getStateDir(), runId, exitCode);
+      }
       const dur = formatDuration(Date.now() - startTime);
       const extra = note ? ` · ${note}` : "";
       serverLog(

package/src/ui/server/public/agents-page.js

@@ -147,6 +147,9 @@ const st = {
   signedOut: false,
   open: [],
   panes: new Map(),
+  // AG-18: agents (ws\0id) whose persona change started fresh, for the
+  // pane's line once it follows them.
+  fresh: new Set(),
   timer: null,
   xterm: null,
   csrf: null,
@@ -326,6 +329,18 @@ function rotationWhy(rot) {
   );
 }
 
+/** The Workspaces page, focused on workspace `ws` (0.4.17). */
+function wsHref(ws) {
+  const nav = window.denShell?.nav?.() ?? [];
+  const base = nav.find((n) => n.id === "local-dev")?.href ?? "/local-dev";
+  return `${base}?ws=${encodeURIComponent(ws)}`;
+}
+
+/** Workspace `ws` as a link to it on Workspaces. */
+function wsLinkHtml(ws) {
+  return `<a class="wslink" href="${esc(wsHref(ws))}" title="${esc(t("ag.goWs", { ws }))}">${esc(ws)}</a>`;
+}
+
 /** Its rotation, when one is due: "ready" or "due" (den#4). */
 function rotationOf(r) {
   if (!r.rotation?.due) return "";
@@ -480,7 +495,7 @@ function paintList() {
     ? groups
         .map(
           (g) =>
-            `<div class="wsg" data-ws="${esc(g.ws)}"><div class="wsh"><span>${esc(g.ws)}</span><span>${esc(g.rows.length)}</span></div>` +
+            `<div class="wsg" data-ws="${esc(g.ws)}"><div class="wsh"><span>${wsLinkHtml(g.ws)}</span><span>${esc(g.rows.length)}</span></div>` +
             g.rows.map(rowHtml).join("") +
             `</div>`,
         )
@@ -616,6 +631,11 @@ function followAgents() {
   }
 }
 
+/** The pane's line for a resume that had nothing to continue (AG-14). */
+function freshLine(p) {
+  p.term?.write(`\x1b[2m${t("ag.freshLine")}\x1b[0m\r\n`);
+}
+
 /** Move pane `p` to session row `row`, where it was. */
 function retarget(p, row) {
   const old = p.id;
@@ -639,6 +659,7 @@ function retarget(p, row) {
   p.term?.write(
     `\r\n\x1b[2m${t("ag.switched", { p: row.persona ?? row.agent })}\x1b[0m\r\n`,
   );
+  if (st.fresh.delete(`${p.agentWs}\u0000${p.agent}`)) freshLine(p);
   paintBar(p);
   paintLayout();
   writeUrl();
@@ -769,6 +790,7 @@ function paintLayout() {
   if (n === 0) {
     box.className = "agempty";
     delete box.dataset.layout;
+    delete box.dataset.ws;
     box.innerHTML = `<div>${esc(t("ag.empty"))}</div>`;
     return;
   }
@@ -776,6 +798,10 @@ function paintLayout() {
   const shown = visibleIds();
   box.className = `agp n${Math.max(1, shown.length)}${layout === "tabs" ? " tabs" : ""}`;
   box.dataset.layout = layout;
+  // The front agent's workspace: ⌘K lists it first (0.4.17).
+  const front = rowOf(st.cur)?.workspace;
+  if (front) box.dataset.ws = front;
+  else delete box.dataset.ws;
   const empty = box.querySelector(":scope > div:not(.pane):not(.agtabs)");
   if (empty) empty.remove();
   let strip = box.querySelector(":scope > .agtabs");
@@ -919,10 +945,14 @@ function paintBar(p) {
   const r = rowOf(p.id);
   const bar = p.el.querySelector(".bar2");
   const name = r ? paneName(r) : p.label || p.id;
-  // AG-4b: the session's name last, when it says more.
-  const where = r
-    ? [r.workspace, r.runtime, sessionExtra(r)].filter(Boolean).join(" · ")
-    : p.workspace || "";
+  // AG-4b: the session's name last, when it says more. The workspace is a
+  // link to it on Workspaces (0.4.17).
+  const ws = r ? r.workspace : p.workspace || "";
+  const rest = r
+    ? [r.runtime, sessionExtra(r)].filter(Boolean).join(" · ")
+    : "";
+  const where =
+    (ws ? wsLinkHtml(ws) : "") + (ws && rest ? " · " : "") + esc(rest);
   const tone = r ? stateTone(r) : p.exited ? "off" : "pending";
   const stop =
     r?.kind === "agent" && (r.state === "running" || r.state === "stopping")
@@ -943,7 +973,7 @@ function paintBar(p) {
       : "";
   bar.innerHTML =
     `<span class="den-dot ${tone}" aria-hidden="true"></span>` +
-    `<b>${esc(name)}</b><span class="where mono">${esc(where)}</span>` +
+    `<b>${esc(name)}</b><span class="where mono">${where}</span>` +
     (r?.tokenRevoked
       ? `<span class="tagx warn" title="${esc(t("ag.revokedTip"))}">${esc(t("ag.revoked"))}</span>`
       : "") +
@@ -1124,21 +1154,41 @@ async function connect(p) {
     }
     p.term?.write(new Uint8Array(e.data));
   };
-  sock.onclose = (e) => {
+  sock.onclose = async (e) => {
     if (p.sock !== sock) return;
     p.sock = null;
     if (p.closed) return;
-    // Refused before it opened: beyond loopback without a session, the
-    // upgrade is 401 (a browser sees only the close).
-    if (!opened) void refresh();
-    const why =
-      e.reason || (opened ? String(e.code) : t("ag.signin", { cli: CLI }));
+    // Refused before it opened: a browser sees only the close, so ask the
+    // route why with a plain GET (0.4.17). "Sign in" only when it's 401.
+    let why = e.reason || String(e.code);
+    if (!opened) {
+      void refresh();
+      why = await refusalReason(p.id);
+      if (p.closed || p.sock) return;
+    }
     p.term?.write(`\r\n${t("ag.lost", { why })}\r\n`);
     p.lost = true;
     paintBar(p);
   };
 }
 
+/** Why session `id`'s io upgrade was refused, in words for its pane. */
+async function refusalReason(id) {
+  try {
+    const r = await fetch(`/api/sessions/${encodeURIComponent(id)}/io`, {
+      headers: { accept: "application/json" },
+      credentials: "same-origin",
+    });
+    if (r.status === 401) return t("ag.signin", { cli: CLI });
+    const b = await r.json().catch(() => null);
+    if (r.status === 426) return t("ag.refusedUnknown");
+    if (typeof b?.error === "string" && b.error) return b.error;
+    return t("ag.refusedStatus", { status: r.status });
+  } catch {
+    return t("ag.refusedUnknown");
+  }
+}
+
 // ── links and keys in a pane (AG-4b) ───────────────────────────────────
 
 /** What Shift+Enter sends to a pane's session (a plain session: Enter). */
@@ -2306,11 +2356,20 @@ async function submitPersonaChange(when) {
       body,
     );
     window.denShell?.toast?.(
-      t(r?.pending ? "ag.pc.pending" : "ag.pc.done", {
-        id: ch.name,
-        p: personaName(p),
-      }),
+      t(
+        r?.pending ? "ag.pc.pending" : r?.fresh ? "ag.pc.fresh" : "ag.pc.done",
+        { id: ch.name, p: personaName(p) },
+      ),
     );
+    // Never prompted: nothing was resumed. Its pane says so, now if it
+    // has already moved to the new session, else when it does.
+    if (r?.fresh) {
+      const pane = [...st.panes.values()].find(
+        (q) => q.agent === ch.id && q.agentWs === ch.workspace,
+      );
+      if (pane && pane.id === r.agent?.sessionId) freshLine(pane);
+      else st.fresh.add(`${ch.workspace}\u0000${ch.id}`);
+    }
     for (const w of r?.warnings ?? []) window.denShell?.toast?.(w);
     dlg.close?.();
     await refresh();