@openchambery/web 2.0.0-beta.3 → 2.0.0-beta.30

package/server/lib/quota/providers/openrouter.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -12,14 +12,14 @@ export const providerId = 'openrouter';
 export const providerName = 'OpenRouter';
 const aliases = ['openrouter'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/wafer.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -17,14 +17,14 @@ const aliases = ['wafer', 'wafer-ai', 'wafer_ai', 'wafer.ai'];
 const WAFER_QUOTA_URL = 'https://pass.wafer.ai/v1/inference/quota';
 const WAFER_WINDOW_SECONDS = 5 * 3600;
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/zai.js

@@ -1,4 +1,4 @@
-import { readAuthFile } from '../../opencode/auth.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -15,14 +15,14 @@ export const providerId = 'zai-coding-plan';
 export const providerName = 'z.ai';
 const aliases = ['zai-coding-plan', 'zai', 'z.ai'];
 
-export const isConfigured = () => {
-  const auth = readAuthFile();
+export const isConfigured = async () => {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   return Boolean(entry?.key || entry?.token);
 };
 
 export const fetchQuota = async () => {
-  const auth = readAuthFile();
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKey = entry?.key ?? entry?.token;
 

package/server/lib/quota/providers/zhipuai-coding-plan.js

@@ -25,8 +25,7 @@
  * @property {number} [nextResetTime]
  * @property {Array<{modelCode: string, usage: number}>} [usageDetails]
  */
-import { readAuthFile } from '../../opencode/auth.js';
-import { readConfigLayers } from '../../opencode/shared.js';
+import { readOpenCodeCredentials } from '../../opencode/auth.js';
 import {
   getAuthEntry,
   normalizeAuthEntry,
@@ -40,8 +39,8 @@ export const providerId = 'zhipuai-coding-plan';
 export const providerName = 'Zhipu AI Coding Plan';
 const aliases = ['zhipuai-coding-plan', 'zhipuai', 'zhipu'];
 
-function getApiKey() {
-  const auth = readAuthFile();
+async function getApiKey() {
+  const auth = await readOpenCodeCredentials();
   const entry = normalizeAuthEntry(getAuthEntry(auth, aliases));
   const apiKeyFromAuth = entry?.key ?? entry?.token;
 
@@ -49,28 +48,15 @@ function getApiKey() {
     return apiKeyFromAuth;
   }
 
-  try {
-    const { mergedConfig } = readConfigLayers();
-
-    for (const alias of aliases) {
-      const providerConfig = mergedConfig?.provider?.[alias];
-      if (providerConfig?.options?.apiKey) {
-        return providerConfig.options.apiKey;
-      }
-    }
-  } catch {
-    // Ignore config read errors; the provider will be treated as not configured.
-  }
-
   return null;
 }
 
-export const isConfigured = () => {
-  return Boolean(getApiKey());
+export const isConfigured = async () => {
+  return Boolean(await getApiKey());
 };
 
 export const fetchQuota = async () => {
-  const apiKey = getApiKey();
+  const apiKey = await getApiKey();
 
   if (!apiKey) {
     return buildResult({

package/server/lib/quota/routes.js

@@ -28,7 +28,7 @@ export function registerQuotaRoutes(app, { getQuotaProviders }) {
   app.get('/api/quota/providers', async (_req, res) => {
     try {
       const { listConfiguredQuotaProviders } = await getQuotaProviders();
-      res.json({ providers: listConfiguredQuotaProviders() });
+      res.json({ providers: await listConfiguredQuotaProviders() });
     } catch (error) {
       console.error('Failed to list quota providers:', error);
       res.status(500).json({ error: error.message || 'Failed to list quota providers' });

package/server/lib/relay/DOCUMENTATION.md

@@ -39,7 +39,8 @@ Relay is not a separate link format: it is one transport candidate inside the un
 ## What travels the tunnel
 
 Everything a client normally sends to the single OpenChamber origin:
-- **HTTP** — REST endpoints and proxied OpenCode SDK calls under `/api/*`, plus `/auth/*` and `/health`.
+- **HTTP** — REST endpoints and proxied OpenCode SDK calls under `/api/*`, plus `/auth/*` and `/health`. On a packaged desktop client the UI origin is `openchamber-ui://` (`location.origin` is `"null"`) while the SDK still addresses the injected loopback. Relay mode tunnels those shell-local absolute `/api` `/auth` `/health` URLs; they must not fall through to the local OpenCode process.
+- **Events** — relay `auto` uses SSE (bearer), the same path mobile uses. Desktop WebSocket upgrades over the tunnel close and drop assistant deltas; an explicit `ws` setting is unchanged.
 - **SSE** — streamed responses opened through `runtimeFetch`, including `/api/openchamber/events` and SDK global SSE. Relay carries these HTTP response body frames through the tunnel.
 - **WebSocket** — the endpoints that use a real socket (the global event stream on platforms that support WS, terminal I/O, dictation, and Preview/Browser HMR under `/api/preview/proxy/<id>/...`).
 
@@ -117,6 +118,7 @@ Catalog loaders (`loadProviders` / `loadAgents`) and assistant Query keys gate w
 - The tunnel is transparent to the app: adding relay support to a feature should not require the feature to know the relay exists — it goes through the shared runtime transport helpers.
 - The two implementations stay byte-compatible and the wire format is versioned/negotiated so mixed client/host app versions degrade gracefully rather than break. The Layer 1 Relay does not inspect application versions; unsupported Host/Client features are omitted at the endpoints.
 - Host-control reconnect storms are bounded at both ends: the Host does not reset backoff on a brief `open`, and the Relay rate-limits host-control upgrades per IP and per `serverId` (`4029`) without replacing a live control socket.
+- Concurrent service starts recheck the endpoint's active Host after awaiting identity, so each endpoint has one managed Host and stopping the service closes every started Host.
 - Tunneled HTTP/WS always dial `getLocalPort()` on loopback; there is no client-selected target-port override on the host dispatcher.
 
 For the operational rules that keep future changes (new WebSocket endpoints, transport refactors, terminal/voice porting) from breaking this, load the `relay-transport` skill.

package/server/lib/relay/service.js

@@ -313,6 +313,7 @@ export const createRelayService = ({
     }
     const identity = await identityRuntime.getRelayIdentity();
     for (const relayUrl of pending) {
+      if (hostClients.has(relayUrl)) continue;
       const hostClient = startRelayHost({
         relayUrl,
         identity,

package/server/lib/relay/service.test.js

@@ -123,6 +123,19 @@ describe('relay service pairing endpoint', () => {
     delete process.env.OPENCHAMBER_RELAY_URL;
   });
 
+  it('starts only one host per endpoint during concurrent startup and stops every started host', async () => {
+    const { service, settings } = createTestRelayService({ hasRelayDemand: async () => true });
+    await settings.write({ privateRelay: { enabled: true, relayUrl: DEFAULT_RELAY_URL } });
+
+    try {
+      await Promise.all([service.reconcile(), service.reconcile()]);
+      expect(relayMocks.starts).toEqual([DEFAULT_RELAY_URL]);
+    } finally {
+      service.stop();
+    }
+    expect(relayMocks.stops).toEqual(relayMocks.starts);
+  });
+
   it('appends a new pairing endpoint (multi-relay) while keeping the primary', async () => {
     const { service, settings } = createTestRelayService();
 

package/server/lib/scheduled-tasks/DOCUMENTATION.md

@@ -8,6 +8,7 @@ Server-owned scheduled task runtime and routes for OpenChamber-only automation.
 - Runtime orchestration and execution is owned by this module.
 - Durable run history is owned by an independent SQLite store in this module.
 - This module is OpenChamber feature logic; it is intentionally separate from OpenCode proxy/runtime internals.
+- Prompt and goal execution preserve hash-prefixed text literally; no snippet discovery or expansion occurs before dispatch.
 
 ## Files
 
@@ -215,7 +216,13 @@ Every actual run (timer or manual):
        `message.list({ limit: 50, order: 'desc' })` (newest first) — never
        `order: 'asc'` page-0 + `at(-1)`, which reads an old page once the
        session exceeds the limit.
-     - Real terminal success requires an assistant tail with `time.completed`
+      - OpenCode 2.0.16 emits a native `idle` tail whose `outcome` is authoritative:
+        `succeeded` → success; `failed` / `interrupted` → error. An unknown idle
+        outcome keeps polling. Read it only after `session.active` confirms the
+        session is inactive; an older terminal record cannot settle live work.
+        This also applies to post-run continuation snapshots. Earlier servers
+        without idle records use the assistant-tail rules below.
+      - Assistant-tail terminal success requires `time.completed`
        and finish not `tool-calls` (prefer `finish: 'stop'`). `finish:
        'tool-calls'`, incomplete assistants (no `time.completed`), and
        non-assistant tails such as `model-switched` never succeed — including

package/server/lib/scheduled-tasks/runtime.js

@@ -2,7 +2,6 @@ import crypto from 'node:crypto';
 import { DateTime } from 'luxon';
 import parser from 'cron-parser';
 import { makeOpenCodeV2Client } from '../opencode/v2-client.js';
-import { expandSnippets } from '../opencode/snippets.js';
 import {
   getSessionGoalCapability,
   isSessionGoalSupported,
@@ -304,7 +303,7 @@ const isUserMessage = (info) => (
  * - finish tool-calls is mid-loop, never success
  * - incomplete (no time.completed) is never success
  * - model-switched / non-assistant tails are not success
- * - only a completed assistant with a real terminal finish succeeds
+ * - native idle outcomes settle the execution; older servers use assistant finish
  */
 const classifyMessageTail = (messages) => {
   if (!Array.isArray(messages) || messages.length === 0) {
@@ -317,6 +316,15 @@ const classifyMessageTail = (messages) => {
   if (!latest) {
     return { outcome: 'unknown' };
   }
+  if (latest.type === 'idle') {
+    if (latest.outcome === 'succeeded') {
+      return { outcome: 'success' };
+    }
+    if (latest.outcome === 'failed' || latest.outcome === 'interrupted') {
+      return { outcome: 'error', error: `session execution ${latest.outcome}` };
+    }
+    return { outcome: 'unknown' };
+  }
   if (isAssistantMessage(latest)) {
     if (latest.error) {
       return {
@@ -849,7 +857,7 @@ export const createScheduledTasksRuntime = (deps) => {
   };
 
   const buildPromptText = (task, projectPath) => {
-    const promptText = expandSnippets(task.execution.prompt, projectPath);
+    const promptText = task.execution.prompt;
     if (!task.execution.goalEnabled) {
       return promptText;
     }
@@ -874,7 +882,7 @@ export const createScheduledTasksRuntime = (deps) => {
     // back to an inline objective so parseGoalMetadata still accepts the
     // record. Oversized prompts are distilled into audit criteria by the
     // small model; on distill failure a head+tail excerpt keeps intent.
-    let objectiveText = expandSnippets(task.execution.prompt, projectPath);
+    let objectiveText = task.execution.prompt;
     if (objectiveText.length > 5000) {
       let distilled = null;
       try {

package/server/lib/scheduled-tasks/runtime.test.js

@@ -1108,6 +1108,78 @@ describe('scheduled-tasks run history and session lifecycle', () => {
     expect(client.prompt).not.toHaveBeenCalled();
   });
 
+  it.each([
+    ['succeeded', 'success', null],
+    ['failed', 'error', 'session execution failed'],
+    ['interrupted', 'error', 'session execution interrupted'],
+  ])('settles native idle outcome %s instead of timing out', async (outcome, status, error) => {
+    vi.useFakeTimers();
+    try {
+      const history = createHistoryStore();
+      const client = createSuccessfulClient({
+        messageListImpl: async () => ({
+          data: [
+            { id: 'msg_idle', type: 'idle', outcome, time: { created: 1_200 } },
+            outcome === 'succeeded' ? erroredAssistant() : completedAssistant(),
+          ],
+        }),
+      });
+      const updateState = vi.fn(async (_projectID, _taskID, state) => ({
+        task: { ...scheduledTask, state: { ...scheduledTask.state, ...state } },
+      }));
+      const runtime = createRuntime(updateState, {
+        runHistoryStore: history,
+        waitForOpenCodeReady: vi.fn(async () => {}),
+        maxRunDurationMs: 2_500,
+      });
+      await runtime.syncProject('project-1');
+      const pending = runtime.runNow('project-1', 'task-1');
+      await vi.advanceTimersByTimeAsync(2_500);
+      const result = await pending;
+      expect(result.status).toBe(status);
+      expect(result.error ?? null).toBe(error);
+      expect(history.finishRun).toHaveBeenCalledWith(
+        expect.any(String), expect.objectContaining({ status }),
+      );
+      expect(client.interrupt).not.toHaveBeenCalled();
+      expect(client.messageList).toHaveBeenCalledTimes(1);
+      expect(history.finishRun.mock.calls[0][1].durationMs).toBeLessThan(2_500);
+      runtime.stop();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it('does not settle an older idle record while the session is active', async () => {
+    vi.useFakeTimers();
+    try {
+      const history = createHistoryStore();
+      let busy = true;
+      const client = createSuccessfulClient({
+        activeImpl: async () => busy ? { ses_1: { type: 'running' } } : {},
+        messageListImpl: async () => ({
+          data: [{ id: 'msg_idle', type: 'idle', outcome: 'succeeded', time: { created: 1_200 } }],
+        }),
+      });
+      const runtime = createRuntime(vi.fn(async () => ({ task: scheduledTask })), {
+        runHistoryStore: history,
+        waitForOpenCodeReady: vi.fn(async () => {}),
+        maxRunDurationMs: 5_000,
+      });
+      await runtime.syncProject('project-1');
+      const pending = runtime.runNow('project-1', 'task-1');
+      await vi.advanceTimersByTimeAsync(1_000);
+      expect(history.finishRun).not.toHaveBeenCalled();
+      expect(client.messageList).not.toHaveBeenCalled();
+      busy = false;
+      await vi.advanceTimersByTimeAsync(1_000);
+      expect((await pending).status).toBe('success');
+      runtime.stop();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it('ordinary non-goal runs still create a session and settle on the assistant tail', async () => {
     const history = createHistoryStore();
     const client = createSuccessfulClient({ sessionID: 'ses_plain' });
@@ -1182,16 +1254,17 @@ describe('scheduled-tasks run history and session lifecycle', () => {
     );
   });
 
-  it('does not succeed when the latest message is model-switched', async () => {
+  it.each([
+    { id: 'msg_switch', type: 'model-switched', model: { providerID: 'openai', id: 'gpt-4.1' } },
+    { id: 'msg_idle', type: 'idle', outcome: 'unknown' },
+  ])('does not succeed on an unrecognized terminal: $type', async (tail) => {
     vi.useFakeTimers();
     const history = createHistoryStore();
     createSuccessfulClient({
       messageListImpl: async () => ({
         data: [{
-          id: 'msg_switch',
-          type: 'model-switched',
+          ...tail,
           time: { created: Date.now() },
-          model: { providerID: 'openai', id: 'gpt-4.1' },
         }],
       }),
     });
@@ -1442,7 +1515,7 @@ describe('scheduled-tasks run history and session lifecycle', () => {
     vi.unstubAllGlobals();
   });
 
-  it('corrects lastStatus error → success on idle after a continuation, without rewriting history', async () => {
+  it.each(['assistant', 'idle'])('corrects lastStatus error → success from %s after a continuation, without rewriting history', async (tailType) => {
     const history = createHistoryStore();
     const client = createSuccessfulClient({ settlement: 'assistant-error' });
     const fetchMock = vi.fn(async (url) => {
@@ -1468,7 +1541,9 @@ describe('scheduled-tasks run history and session lifecycle', () => {
     expect(history.finishRun).toHaveBeenCalledTimes(1);
 
     client.messageList.mockImplementation(async () => ({
-      data: [completedAssistant('msg_ok')],
+      data: [tailType === 'idle'
+        ? { id: 'msg_idle', type: 'idle', outcome: 'succeeded', time: { created: 1_200 } }
+        : completedAssistant('msg_ok')],
     }));
 
     await runtime.observeSessionEvent({

package/server/lib/session-goal/DOCUMENTATION.md

@@ -186,6 +186,17 @@ before touching the filesystem). Rationale: metadata rides every
 
 ## Flow
 
+Recent-message reads request the newest 40 records with V2 `order: desc`, then
+reverse that page into chronological order for tail checks, audit selection and
+accounting. The SDK and HTTP fallback use the same ordering contract; `asc`
+without a cursor would read the oldest page and strand long sessions after
+compaction. Message IDs are not used to reorder the fetched page.
+
+UI goal removal sends the Merge Patch tombstone `openchamber.goal: null`.
+Omitting the key preserves the stored goal. Objective-file cleanup and stopping
+the active turn follow a successful metadata write; failed writes retain the
+goal and its objective for retry.
+
 1. `createSessionGoalRuntime` subscribes to the global SSE hub (it needs
    the envelope's `directory`).
 2. `session.status: idle` arms a 15s per-session timer; `busy`/`retry` clears

package/server/lib/session-goal/runtime.js

@@ -722,20 +722,20 @@ export const createSessionGoalRuntime = ({
       const client = openCodeClient();
       if (typeof client?.message?.list === 'function') {
         const listed = await client.message.list(
-          { sessionID: sessionId, limit: MESSAGE_FETCH_LIMIT, order: 'asc' },
+          { sessionID: sessionId, limit: MESSAGE_FETCH_LIMIT, order: 'desc' },
           directoryRequestOptions(directory),
         );
         const projected = projectGoalMessages(listed, sessionId);
-        if (projected) return projected;
+        if (projected) return projected.reverse();
       }
     } catch {
       // Fall through to controlled HTTP seam for tests / older fixtures.
     }
     const raw = await openCodeFetch(`/session/${encodeURIComponent(sessionId)}/message`, {
       directory,
-      query: { limit: String(MESSAGE_FETCH_LIMIT) },
+      query: { limit: String(MESSAGE_FETCH_LIMIT), order: 'desc' },
     }).catch(() => null);
-    return projectGoalMessages(raw, sessionId);
+    return projectGoalMessages(raw, sessionId)?.reverse() ?? null;
   };
 
   /**

package/server/lib/session-goal/runtime.test.js

@@ -136,7 +136,7 @@ const makeFetch = ({ messages, liveStatus }) => {
       }
       if (pathEndsWith(reqPath, '/session/ses-goal/message')) {
         // Official v2 SessionMessagesResponse shape.
-        return jsonResponse({ data: messages, cursor: {} });
+        return jsonResponse({ data: new URL(url).searchParams.get('order') === 'desc' ? [...messages].reverse() : messages, cursor: {} });
       }
       if (pathEndsWith(reqPath, '/session/ses-goal') && !reqPath.includes('/message')) {
         if (init.method === 'PATCH') {
@@ -263,6 +263,33 @@ describe('session-goal v2 message projection helpers', () => {
 });
 
 describe('session-goal continuation delivery', () => {
+  it.each([false, true])('continues after a completed compaction beyond the first message page (HTTP fallback: %s)', async (fallback) => {
+    const messages = Array.from({ length: 42 }, (_, index) => ({
+      id: `msg_${String(index).padStart(3, '0')}`,
+      type: index === 41 ? 'compaction' : index % 2 ? 'user' : 'assistant',
+      time: index === 41 ? { created: index + 1 } : { created: index + 1, completed: index + 2 },
+      model: { providerID: 'p', id: 'm' },
+      agent: 'build',
+      ...(index === 41 ? { status: 'completed', summary: 'Work remains' } : { text: 'Working' }),
+    }));
+    const fixture = makeFetch({ messages, liveStatus: 'idle' });
+    const runtime = makeRuntime();
+    try {
+      await withFetch(async (input, init) => {
+        const url = new URL(String(input));
+        if (pathEndsWith(url.pathname, '/session/ses-goal/message')) {
+          if (fallback && url.pathname.startsWith('/api/')) return jsonResponse({ error: 'unavailable' }, 503);
+          const ordered = url.searchParams.get('order') === 'desc' ? [...messages].reverse() : messages;
+          return jsonResponse({ data: ordered.slice(0, Number(url.searchParams.get('limit') || 40)), cursor: {} });
+        }
+        return fixture.fetch(input, init);
+      }, async () => runtime.runTick('ses-goal', '/repo'));
+      expect(fixture.calls.prompt).toBe(1);
+    } finally {
+      runtime.stop();
+    }
+  });
+
   it('dispatches v2 session.prompt with stable continuation id and metadata', async () => {
     const promptBodies = [];
     const messages = [
@@ -291,7 +318,7 @@ describe('session-goal continuation delivery', () => {
         return jsonResponse({ data: {} });
       }
       if (pathEndsWith(reqPath, '/session/ses-goal/message')) {
-        return jsonResponse({ data: messages, cursor: {} });
+        return jsonResponse({ data: new URL(url).searchParams.get('order') === 'desc' ? [...messages].reverse() : messages, cursor: {} });
       }
       if (pathEndsWith(reqPath, '/session/ses-goal') && !reqPath.includes('/message')) {
         if (init.method === 'PATCH' && init.body) {
@@ -984,7 +1011,9 @@ describe('session-goal runtime — pause / audit / dispatch boundary', () => {
         const body = Array.isArray(messages)
           ? { data: messages, cursor: {} }
           : messages;
-        return jsonResponse(body);
+        return jsonResponse(new URL(String(input)).searchParams.get('order') === 'desc'
+          ? { ...body, data: [...body.data].reverse() }
+          : body);
       }
       if (pathEndsWith(reqPath, '/session/ses-goal')) {
         if (init.method === 'PATCH') {

package/server/lib/session-index/DOCUMENTATION.md

@@ -1,5 +1,12 @@
 # Session Index Runtime
 
+Native `session.renamed` updates the existing runtime-scoped summary's title and
+update clock directly, publishing through the normal index revision path. It
+preserves activity ordering, pins and execution status; older/duplicate events
+and unknown sessions are no-ops. Partial rename payloads never fabricate rows.
+
+Native `session.moved` uses `data.location.directory`, not the old event-envelope directory. The transactional `move` operation retains summary activity/status and independent pin membership, maintains the newest-20 destination bound, and installs a runtime-scoped event-clock fence against delayed source-directory upserts/pages. Duplicate/older moves are no-ops. Unknown sessions are not fabricated from the partial move payload.
+
 Every OpenChamber Web Server enables `session-index.sqlite` in its data
 directory by default. Electron injects its user-data path explicitly.
 `sessionIndexDbPath` and `OPENCHAMBER_SESSION_INDEX_DB_PATH` override that

package/server/lib/session-index/event-ingest.js

@@ -36,6 +36,19 @@ export const applySessionIndexEvent = (service, event, observedAt = Date.now(),
 
   const baseType = normalizeSessionEventType(payload.type);
 
+  if (baseType === 'session.renamed') {
+    if (isHostReady && !isHostReady()) return false;
+    const data = payload.data ?? properties;
+    return service.rename(data.sessionID, data.title, payload.created ?? properties.eventCreated ?? observedAt);
+  }
+
+  if (baseType === 'session.moved') {
+    const data = payload.data ?? properties;
+    return typeof data.sessionID === 'string' && typeof data.location?.directory === 'string'
+      ? service.move(data.sessionID, data.location.directory, typeof payload.created === 'number' ? payload.created : observedAt, payload.durable?.seq)
+      : false;
+  }
+
   if (baseType === 'session.created' || baseType === 'session.updated') {
     // Until Host metadata is ready, do not write session lifecycle into the
     // index (would bake unprojected upstream archive). Transcript paths use

package/server/lib/session-index/event-ingest.test.js

@@ -3,6 +3,13 @@ import { describe, expect, it, vi } from 'vitest';
 import { applySessionIndexEvent } from './event-ingest.js';
 
 describe('session index event ingest', () => {
+  it('takes moved ownership from native data rather than the old event envelope directory', () => {
+    const service = { move: vi.fn(() => true) };
+    expect(applySessionIndexEvent(service, { directory: '/old', payload: {
+      type: 'session.moved', created: 20, data: { sessionID: 'ses_move', location: { directory: '/new' }, projectID: 'project' },
+    } }, 30)).toBe(true);
+    expect(service.move).toHaveBeenCalledWith('ses_move', '/new', 20, undefined);
+  });
   it('writes session summaries, user activity, and status to the service', () => {
     const service = {
       upsertAndReportChange: vi.fn(() => true),

package/server/lib/session-index/service.js

@@ -277,6 +277,30 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     WHERE runtime_key = ? AND session_id = ?
   `);
 
+  const movedLocations = new Map();
+  const isStaleLocation = (session, directory) => {
+    const moved = movedLocations.get(`${runtimeKey()}:${session?.id}`);
+    return moved && moved.directory !== normalizeDirectory(directory) && toTimestamp(session?.time?.updated) <= moved.at;
+  };
+  const move = db.transaction((sessionID, directory, at = Date.now(), sequence) => {
+    directory = normalizeDirectory(directory);
+    if (!sessionID || !directory) return false;
+    const key = runtimeKey();
+    const fenceKey = `${key}:${sessionID}`;
+    const previous = movedLocations.get(fenceKey);
+    if (previous && (sequence !== undefined && previous.sequence !== undefined
+      ? sequence <= previous.sequence
+      : at < previous.at || (at === previous.at && previous.directory === directory))) return false;
+    movedLocations.set(fenceKey, { directory, at, sequence });
+    touchExistingDirectory.run({ runtimeKey: key, directory, lastAccessedAt: at });
+    const roots = db.prepare('UPDATE OR REPLACE session_summary SET directory = ? WHERE runtime_key = ? AND session_id = ? AND directory != ?').run(directory, key, sessionID, directory);
+    const children = db.prepare('UPDATE OR REPLACE session_child SET directory = ? WHERE runtime_key = ? AND session_id = ? AND directory != ?').run(directory, key, sessionID, directory);
+    db.prepare(`DELETE FROM session_summary WHERE runtime_key = ? AND directory = ? AND session_id IN (
+      SELECT session_id FROM session_summary WHERE runtime_key = ? AND directory = ? ORDER BY activity_updated_at DESC, session_id DESC LIMIT -1 OFFSET ?
+    )`).run(key, directory, key, directory, MAX_ROOT_SESSIONS);
+    return roots.changes > 0 || children.changes > 0;
+  });
+
   const replaceDirectoryRows = ({ directory, sessions, cursor, hasMore, fullSync = true, now = Date.now() }) => {
     const normalizedDirectory = normalizeDirectory(directory);
     if (!normalizedDirectory) throw new Error('directory is required');
@@ -289,6 +313,7 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     // stale unarchived cache cannot resurrect them.
     const summaries = Array.isArray(sessions)
       ? sessions
+        .filter((session) => !isStaleLocation(session, normalizedDirectory))
         .map((session) => toSummary(session, normalizedDirectory))
         .filter((summary) => summary && !summary.archivedAt)
         .slice(0, MAX_ROOT_SESSIONS)
@@ -328,6 +353,7 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
   });
 
   const upsertMutation = db.transaction((session, now = Date.now(), options = {}) => {
+    if (isStaleLocation(session, session?.directory ?? session?.location?.directory)) return { accepted: false, changed: false };
     if (!isVisibleSession(session)) {
       const changed = remove(session?.id);
       return { accepted: changed, changed };
@@ -517,6 +543,23 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     return result.changes > 0;
   };
 
+  const rename = (sessionID, title, observedAt) => {
+    if (typeof sessionID !== 'string' || !sessionID || typeof title !== 'string') return false;
+    const timestamp = toTimestamp(observedAt);
+    if (!timestamp) return false;
+    const key = runtimeKey();
+    if (HIDDEN_SESSION_TITLES.has(title)) {
+      const current = db.prepare('SELECT updated_at FROM session_summary WHERE runtime_key = ? AND session_id = ?').get(key, sessionID);
+      return current && current.updated_at <= timestamp ? remove(sessionID) : false;
+    }
+    const result = db.prepare(`
+      UPDATE session_summary SET title = ?, updated_at = ?
+      WHERE runtime_key = ? AND session_id = ? AND updated_at <= ?
+        AND (title != ? OR updated_at != ?)
+    `).run(title, timestamp, key, sessionID, timestamp, title, timestamp);
+    return result.changes > 0;
+  };
+
   const updateStatus = (sessionID, status, observedAt) => {
     if (typeof sessionID !== 'string' || !sessionID) return false;
     if (status !== 'busy' && status !== 'retry' && status !== 'idle') return false;
@@ -570,6 +613,8 @@ export const createSessionIndexService = ({ dbPath, getRuntimeConfig = () => nul
     upsertAndReportChange,
     touchActivity,
     updateStatus,
+    rename,
+    move,
     setPinned,
     clearPinned,
     remove,