@visual-z/xeno 0.1.4 → 0.2.1

package/src/store/session-archive.ts

@@ -0,0 +1,162 @@
+/** Portable log graphs. No provider calls, workspace writes, or executable package payloads (D3/D8). */
+import { createReadStream } from "node:fs";
+import { lstat, mkdir, mkdtemp, open, readdir, rename, rm } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { dirname, join, resolve } from "node:path";
+import { archivePath } from "../core/session-archive.ts";
+import { blobFilePath, digestFile, verifyBlob } from "./blobs.ts";
+import { listNodes, readCursor, readCursorAt, readManifest, readNode, relocateSession, type Cursor } from "./log.ts";
+import { readNodeHistory } from "./restore.ts";
+import { replayContext } from "./replay.ts";
+
+// Wire chunk size, not a content limit: bounded JSON lines keep large snapshots streamable.
+const CHUNK = 64 * 1024;
+type FileEntry = { path: string; source: string };
+
+async function regular(path: string): Promise<void> {
+  if (!(await lstat(path)).isFile()) throw new Error(`Archive requires a regular file: ${path}`);
+}
+
+async function storedFiles(root: string, prefix = ""): Promise<FileEntry[]> {
+  const files: FileEntry[] = [];
+  for (const entry of await readdir(join(root, prefix), { withFileTypes: true })) {
+    const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (archivePath(path)) { await regular(join(root, path)); files.push({ path, source: join(root, path) }); }
+    else if ((path === "artifacts" || /^artifacts\/[a-f0-9]{2}$/.test(path)) && entry.isDirectory()) files.push(...await storedFiles(root, path));
+    else if (path === "artifacts" || path === "blobs") {
+      if (!entry.isDirectory()) throw new Error(`Invalid archive store: ${path}`);
+    }
+  }
+  return files;
+}
+
+async function referencedBlobs(dir: string, fallback?: string): Promise<Map<string, string[]>> {
+  const refs = new Map<string, string[]>(), cursor = await readCursor(dir);
+  for (const node of await listNodes(dir)) {
+    const read = await readNode(dir, node);
+    if (!read.header || read.corrupt.length) throw new Error(`Corrupt archive node ${node}`);
+    const historical = await readCursorAt(dir, node);
+    const roots = [...new Set([historical?.blob_dir, cursor?.blob_dir, fallback, join(dir, "blobs")].filter((p): p is string => !!p))];
+    const add = (sha: string) => { refs.set(sha, [...new Set([...(refs.get(sha) ?? []), ...roots])]); };
+    for (const event of read.events) {
+      if (event.t === "snapshot") for (const sha of [...Object.values(event.added), ...Object.values(event.changed)]) add(sha);
+      if (event.t === "user" || event.t === "tool_result") for (const image of event.images ?? []) { add(image.sha256); if (image.original) add(image.original.sha256); }
+    }
+  }
+  return refs;
+}
+
+async function validateSession(dir: string): Promise<Cursor> {
+  const cursor = await readCursor(dir);
+  if (!cursor) throw new Error("Archive has no resumable cursor");
+  const manifest = await readManifest(dir), nodes = await listNodes(dir);
+  if (!nodes.includes(cursor.node)) throw new Error("Archive cursor points to a missing node");
+  for (const closed of manifest.nodes) {
+    if (!nodes.includes(closed.node) || await digestFile(join(dir, `node-${String(closed.node).padStart(4, "0")}.jsonl`)) !== closed.sha256) throw new Error("Archive closed node digest mismatch");
+    if (closed.handoff_ref) await regular(join(dir, `handoff-${String(closed.node).padStart(4, "0")}.yaml`));
+  }
+  const contexts = new Set<string>();
+  for (const node of nodes) {
+    const history = await readNodeHistory(dir, node);
+    if (!history.ok) throw new Error(`Invalid archive graph: ${history.error}`);
+    await replayContext(dir, node, manifest);
+    const state = await readCursorAt(dir, node); if (state?.context_ref) contexts.add(state.context_ref);
+    for (const event of (await readNode(dir, node)).events) if (event.t === "cut" && event.next_context_ref) contexts.add(event.next_context_ref);
+  }
+  if (cursor.context_ref) contexts.add(cursor.context_ref);
+  for (const sha of contexts) if (!await verifyBlob(join(dir, "artifacts"), sha)) throw new Error(`Missing frozen context ${sha}`);
+  return cursor;
+}
+
+export async function exportSessionArchive(dir: string, destination: string, blobDir?: string): Promise<void> {
+  await validateSession(dir);
+  const files = await storedFiles(dir);
+  for (const [sha, roots] of await referencedBlobs(dir, blobDir)) {
+    let source: string | undefined;
+    for (const root of roots) if (await verifyBlob(root, sha)) { source = blobFilePath(root, sha); break; }
+    if (!source) throw new Error(`Missing session blob ${sha}`);
+    files.push({ path: `blobs/${sha.slice(0, 2)}/${sha.slice(2)}`, source });
+  }
+  if (files.some(file => resolve(file.source) === resolve(destination))) throw new Error("Cannot export over session storage");
+  const temp = `${destination}.${randomUUID()}.tmp`, out = await open(temp, "wx", 0o600);
+  const digest = createHash("sha256"); let count = 0;
+  const emit = async (record: unknown, hashed = true) => { const line = JSON.stringify(record) + "\n"; if (hashed) digest.update(line); await out.writeFile(line); };
+  try {
+    await emit({ format: "xeno-session", version: 1 });
+    for (const file of files.sort((a, b) => a.path.localeCompare(b.path))) {
+      await regular(file.source);
+      const hash = createHash("sha256"); let size = 0;
+      await emit({ file: file.path });
+      for await (const chunk of createReadStream(file.source, { highWaterMark: CHUNK })) {
+        const bytes = chunk as Buffer; size += bytes.length; hash.update(bytes); await emit({ data: bytes.toString("base64") });
+      }
+      const sha256 = hash.digest("hex");
+      if (/^(artifacts|blobs)\//.test(file.path) && file.path.split("/").slice(1).join("") !== sha256) throw new Error(`Corrupt archive blob ${file.path}`);
+      await emit({ end: file.path, size, sha256 }); count++;
+    }
+    await emit({ complete: count, sha256: digest.digest("hex") }, false);
+    await out.sync(); await out.close(); await rename(temp, destination);
+  } finally { await out.close(); await rm(temp, { force: true }); }
+}
+
+/** Bound a hostile or truncated line before JSON parsing, without a whole-archive size cap. */
+async function* lines(path: string): AsyncGenerator<string> {
+  let pending = "";
+  for await (const chunk of createReadStream(path, { encoding: "utf8", highWaterMark: CHUNK })) {
+    pending += chunk; let end: number;
+    while ((end = pending.indexOf("\n")) !== -1) {
+      if (end > CHUNK * 2) throw new Error("Archive line exceeds chunk envelope");
+      yield pending.slice(0, end); pending = pending.slice(end + 1);
+    }
+    if (pending.length > CHUNK * 2) throw new Error("Archive line exceeds chunk envelope");
+  }
+  if (pending) throw new Error("Incomplete archive tail");
+}
+
+/** Only a validated staging directory is published; failed imports never become browser entries. */
+export async function importSessionArchive(file: string, sessionRoot: string, workspace: string): Promise<string> {
+  await regular(file); await mkdir(sessionRoot, { recursive: true });
+  const stage = await mkdtemp(join(sessionRoot, ".xeno-import-"));
+  const destination = join(sessionRoot, `${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`);
+  const seen = new Set<string>(), digest = createHash("sha256");
+  let header = false, complete = false, active: { path: string; file: Awaited<ReturnType<typeof open>>; hash: ReturnType<typeof createHash>; size: number } | undefined;
+  try {
+    for await (const line of lines(file)) {
+      if (complete) throw new Error("Unexpected data after archive footer");
+      const value: unknown = JSON.parse(line);
+      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid archive record");
+      const record = value as Record<string, unknown>;
+      if (!header) {
+        if (record["format"] !== "xeno-session" || record["version"] !== 1) throw new Error("Expected xeno-session v1 archive. Legacy event-only JSONL lacks recovery metadata; re-export the original session.");
+        header = true;
+      } else if (record["complete"] !== undefined) {
+        if (active || record["complete"] !== seen.size || record["sha256"] !== digest.digest("hex")) throw new Error("Archive completeness digest mismatch");
+        complete = true; continue;
+      } else if (record["file"] !== undefined) {
+        const path = record["file"];
+        if (active || !archivePath(path) || seen.has(path)) throw new Error("Invalid or duplicate archive path");
+        seen.add(path); await mkdir(dirname(join(stage, path)), { recursive: true });
+        active = { path, file: await open(join(stage, path), "wx", 0o600), hash: createHash("sha256"), size: 0 };
+      } else if (record["data"] !== undefined) {
+        const data = record["data"];
+        if (!active || typeof data !== "string" || data.length > Math.ceil(CHUNK / 3) * 4) throw new Error("Invalid archive chunk");
+        const bytes = Buffer.from(data, "base64");
+        if (bytes.toString("base64") !== data) throw new Error("Invalid archive base64");
+        active.hash.update(bytes); active.size += bytes.length; await active.file.writeFile(bytes);
+      } else if (record["end"] !== undefined) {
+        if (!active || record["end"] !== active.path || record["size"] !== active.size || record["sha256"] !== active.hash.digest("hex")) throw new Error("Archive file digest mismatch");
+        if (/^(artifacts|blobs)\//.test(active.path) && active.path.split("/").slice(1).join("") !== record["sha256"]) throw new Error("Archive blob address mismatch");
+        await active.file.sync(); await active.file.close(); active = undefined;
+      } else throw new Error("Unknown archive record");
+      digest.update(line + "\n");
+    }
+    if (!complete) throw new Error("Incomplete archive: missing footer");
+    await validateSession(stage);
+    for (const sha of (await referencedBlobs(stage)).keys()) if (!await verifyBlob(join(stage, "blobs"), sha)) throw new Error(`Missing session blob ${sha}`);
+    await mkdir(join(stage, "blobs"), { recursive: true });
+    await relocateSession(stage, workspace);
+    await rename(stage, destination);
+    const parent = await open(sessionRoot, "r"); try { await parent.sync(); } finally { await parent.close(); }
+    return destination;
+  } finally { await active?.file.close(); await rm(stage, { recursive: true, force: true }); }
+}

package/src/store/session-browser.ts

@@ -0,0 +1,68 @@
+/** Location discovery only; session data is always read from its append-only journals (D3/D8). */
+import { readdir, readFile, mkdir, rename, realpath } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { configDir } from "./config.ts";
+import { atomicWrite } from "./atomic.ts";
+import { serialized } from "./serial.ts";
+import { readListed, type ListedSession } from "./sessions.ts";
+import { readCursor, writeCursor } from "./log.ts";
+
+export interface SessionRoot { path: string; workspace: string }
+const registryPath = () => join(configDir(), "session-roots.json");
+export async function sessionRoots(current: SessionRoot): Promise<SessionRoot[]> {
+  let rows: SessionRoot[] = [];
+  try {
+    const data: unknown = JSON.parse(await readFile(registryPath(), "utf8"));
+    if (!Array.isArray(data)) throw new Error("Session root registry is not an array");
+    rows = data.filter((row): row is SessionRoot => row !== null && typeof row === "object" && typeof row.path === "string" && typeof row.workspace === "string");
+  } catch (error) { if ((error as { code?: string }).code !== "ENOENT") throw error; }
+  return [...new Map([...rows, current].map(row => [resolve(row.path), { ...row, path: resolve(row.path), workspace: resolve(row.workspace) }])).values()];
+}
+export async function registerSessionRoot(root: SessionRoot): Promise<void> {
+  const path = registryPath();
+  return serialized(path, async () => {
+    const rows = await sessionRoots(root);
+    await mkdir(dirname(path), { recursive: true });
+    await atomicWrite(path, JSON.stringify(rows, null, 2) + "\n");
+  });
+}
+export interface SessionScan { sessions: ListedSession[]; loaded: number; total: number; root: string }
+export async function* scanSessionRoots(roots: readonly SessionRoot[], signal?: AbortSignal): AsyncGenerator<SessionScan> {
+  const found: { id: string; path: string; workspace: string }[] = [];
+  for (const root of roots) {
+    if (signal?.aborted) return;
+    try {
+      const entries = await readdir(root.path, { withFileTypes: true });
+      found.push(...entries.filter(entry => entry.isDirectory() && !entry.name.startsWith(".")).map(entry => ({ id: entry.name, path: join(root.path, entry.name), workspace: root.workspace })));
+    } catch (error) {
+      if ((error as { code?: string }).code !== "ENOENT") yield { sessions: [{ ok: false, id: root.path, path: root.path, error: String(error) }], loaded: 0, total: 0, root: root.path };
+    }
+  }
+  const unique = [...new Map(found.map(row => [resolve(row.path), row])).values()];
+  // Eight concurrent reads bound descriptors and let cancellation run between batches; no total-result cap.
+  for (let offset = 0; offset < unique.length; offset += 8) {
+    if (signal?.aborted) return;
+    const batch = unique.slice(offset, offset + 8);
+    const sessions = await Promise.all(batch.map(async row => {
+      try { return await readListed(row.id, row.path, { workspace: row.workspace, ...(signal ? { signal } : {}) }); }
+      catch (error) { return { ok: false as const, id: row.id, path: row.path, error: String(error) }; }
+    }));
+    if (signal?.aborted) return;
+    yield { sessions, loaded: Math.min(offset + batch.length, unique.length), total: unique.length, root: batch[0]!.workspace };
+  }
+}
+export async function renameSession(path: string, name: string): Promise<void> {
+  const cursor = await readCursor(path);
+  if (!cursor) throw new Error("This empty session has no saved cursor to rename");
+  await writeCursor(path, { ...cursor, name: name.trim() });
+}
+export async function archiveSession(path: string, active?: string): Promise<string> {
+  const target = await realpath(path);
+  if (active && target === await realpath(active)) throw new Error("Cannot remove the currently active session");
+  const trash = join(dirname(target), ".trash");
+  await mkdir(trash, { recursive: true });
+  const destination = join(trash, `${target.split(/[\\/]/).at(-1)!}-${randomUUID()}`);
+  await rename(target, destination);
+  return destination;
+}

package/src/store/session-position.ts

@@ -0,0 +1,27 @@
+/** Position lookup is shared by in-session navigation and copied forks (D8, Pi before/at semantics). */
+import type { NodeRef } from "../core/events.ts";
+import { digestNode, listNodes, nodePath, readCursorAt, readNode, type Basis, type Cursor } from "./log.ts";
+
+export async function resolveHistoryPosition(dir: string, eventId: string, position: "at" | "before" = "at"): Promise<{
+  node: number; parent: NodeRef | null; basis: Basis; selection: Cursor | null; editorText?: string;
+}> {
+  let found: Awaited<ReturnType<typeof readNode>> | undefined;
+  let node = -1;
+  for (const candidate of await listNodes(dir)) {
+    const read = await readNode(dir, candidate);
+    if (!read.events.some(e => e.id === eventId)) continue;
+    if (found) throw new Error(`ambiguous history event ${eventId}`);
+    if (!read.header || read.corrupt.length) throw new Error(`corrupt history node ${candidate}`);
+    node = candidate; found = read;
+  }
+  if (!found?.header) throw new Error(`NO_SUCH_EVENT: ${eventId}`);
+  const index = found.events.findIndex(e => e.id === eventId);
+  const event = found.events[index]!;
+  if (position === "before" && event.t !== "user") throw new Error("fork before requires a user message");
+  const selection = await readCursorAt(dir, node, eventId);
+  const cutoff = position === "before" ? found.events[index - 1]?.id : eventId;
+  const parent = cutoff === undefined ? found.header.parent
+    : { node, log_ref: nodePath(dir, node), sha256: await digestNode(dir, node), at_event: cutoff };
+  return { node, parent, basis: cutoff === undefined ? found.header.basis : "inherit", selection,
+    ...(position === "before" && event.t === "user" ? { editorText: event.text } : {}) };
+}

package/src/store/sessions.ts

@@ -22,7 +22,7 @@
  * and silently truncate a log.
  */
 
-import { cp, mkdir, mkdtemp, open, readdir, rename, rm, stat } from "node:fs/promises";
+import { cp, lstat, mkdir, mkdtemp, open, readdir, rename, rm, stat } from "node:fs/promises";
 import type { Dirent } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
@@ -33,13 +33,19 @@ import {
   initNode,
   readManifest,
   readCursor,
+  readCursorAt,
   readNode,
   writeCursor,
+  setParentSession,
   type Manifest,
 } from "./log.ts";
 import { readNodeHistory } from "./restore.ts";
 import { replayContext } from "./replay.ts";
 import { recoverCut } from "./recovery.ts";
+import { planSessionEntry, type SessionEntryFlags } from "../core/session-entry.ts";
+import { assertNever } from "../core/exhaustive.ts";
+import { resolveHistoryPosition } from "./session-position.ts";
+import { importSessionArchive } from "./session-archive.ts";
 
 /**
  * A listing that reads every session ever is unbounded. Two hundred is
@@ -77,6 +83,9 @@ export type ListedSession =
       events: number;
       updated_at: string | null;
       path: string;
+      workspace?: string;
+      parent_session?: string;
+      text?: string;
     }
   | {
       ok: false;
@@ -150,7 +159,7 @@ export async function createSession(
   );
 }
 
-export async function listSessions(workspace: string, sessionDir?: string): Promise<SessionList> {
+export async function listSessions(workspace: string, sessionDir?: string, limit = MAX_SESSION_LIST): Promise<SessionList> {
   const dir = sessionsDir(workspace, sessionDir);
   let entries: Dirent[];
   try {
@@ -160,7 +169,7 @@ export async function listSessions(workspace: string, sessionDir?: string): Prom
     throw err;
   }
 
-  const dirs = entries.filter((e) => e.isDirectory());
+  const dirs = entries.filter((e) => e.isDirectory() && !e.name.startsWith("."));
   const withMtime = await Promise.all(
     dirs.map(async (d) => {
       const path = join(dir, d.name);
@@ -173,8 +182,8 @@ export async function listSessions(workspace: string, sessionDir?: string): Prom
   // session recorded: a backup restore can make an old session the
   // newest directory on disk, and that must not hide the one that ran last.
   withMtime.sort((a, b) => b.mtime - a.mtime);
-  const truncated = Math.max(0, withMtime.length - MAX_SESSION_LIST);
-  const chosen = withMtime.slice(0, MAX_SESSION_LIST);
+  const truncated = Math.max(0, withMtime.length - limit);
+  const chosen = withMtime.slice(0, limit);
 
   const sessions: ListedSession[] = [];
   for (const d of chosen) {
@@ -218,7 +227,7 @@ export async function findSessionByPrefix(
     return { ok: false, reason: "empty session id", candidates: [] };
   }
 
-  const { sessions } = await listSessions(workspace, sessionDir);
+  const { sessions } = await listSessions(workspace, sessionDir, Infinity);
   const ok = sessions.filter((s): s is Extract<ListedSession, { ok: true }> => s.ok);
 
   const exactId = ok.filter((s) => s.id === needle);
@@ -277,6 +286,7 @@ export async function copyAncestryTo(
   destDir: string,
   createdAt: string,
   untilEvent?: string,
+  position: "at" | "before" = "at",
 ): Promise<void> {
   const rel = relative(resolve(sourceDir), resolve(destDir));
   if (rel === "" || (!rel.startsWith("..") && !isAbsolute(rel))) {
@@ -292,26 +302,25 @@ export async function copyAncestryTo(
     const tip = cursor?.node ?? 0;
     const history = await readNodeHistory(stage, tip);
     if (!history.ok) throw new Error(`cannot copy session: ${history.error}`);
-    let target = tip;
-    if (untilEvent !== undefined) {
-      const matches = history.nodes.filter((n) => n.events.some((e) => e.id === untilEvent));
-      if (matches.length !== 1) throw new Error(`cannot copy session: event ${untilEvent} is missing or ambiguous on the current path`);
-      target = matches[0]!.node;
-    }
     const nodes = await listNodes(stage);
+    const resolved = untilEvent === undefined ? { basis: "inherit" as const, selection: await readCursorAt(stage, tip),
+      parent: { node: tip, log_ref: nodePath(destDir, tip), sha256: await digestNode(stage, tip) } }
+      : await resolveHistoryPosition(stage, untilEvent, position);
+    const { selection: historical, basis, parent } = resolved;
     const next = Math.max(cursor?.next_node ?? 1, ...nodes.map((n) => n + 1));
-    await initNode(stage, next, {
-      node: target, log_ref: nodePath(destDir, target), sha256: await digestNode(stage, target),
-      ...(untilEvent === undefined ? {} : { at_event: untilEvent }),
-    }, createdAt, "inherit");
+    await initNode(stage, next, parent, createdAt, basis);
+    const selection = { ...(historical ?? cursor) };
+    delete selection.at_event;
     await writeCursor(stage, {
-      ...cursor, node: next, next_node: next + 1, model: cursor?.model ?? "unknown", updated_at: createdAt,
+      ...selection, node: next, next_node: next + 1, model: historical?.model ?? cursor?.model ?? "unknown", updated_at: createdAt,
+      ...(historical === null && parent !== null ? { needs_model_checkpoint: true } : {}),
     });
     await replayContext(stage, next);
+    await setParentSession(stage, resolve(sourceDir));
     await syncCopiedTree(stage);
     await rename(stage, destDir);
-    const parent = await open(dirname(destDir), "r");
-    try { await parent.sync(); } finally { await parent.close(); }
+    const directory = await open(dirname(destDir), "r");
+    try { await directory.sync(); } finally { await directory.close(); }
   } finally { await rm(stage, { recursive: true, force: true }); }
 }
 
@@ -328,21 +337,7 @@ async function syncCopiedTree(dir: string): Promise<void> {
   try { await directory.sync(); } finally { await directory.close(); }
 }
 
-export interface ResolveLogOpts {
-  explicit?: string;
-  fresh?: boolean;
-  /**
-   * `-c` / `--continue`. Pick the newest session and refuse if there is
-   * none -- creating one would make `-c` indistinguishable from a first run.
-   */
-  continueLatest?: boolean;
-  /**
-   * `--no-session`. Log goes to a temp directory, so the workspace never
-   * grows a `.xeno/sessions/` folder. A flag that still called createSession
-   * would pass every assertion on the flag and still leave a directory.
-   */
-  noSession?: boolean;
-  session?: string;
+export interface ResolveLogOpts extends SessionEntryFlags {
   sessionDir?: string;
 }
 
@@ -350,45 +345,59 @@ export interface ResolveLogOpts {
  * Picks the log directory for a process that did not pass a path, or
  * honours one that did.
  *
- * Newest-by-recorded-time is the default because that is the session the
- * person was just in. `--fresh` always allocates a new one; it never
- * deletes. A leftover `.xeno/log` is not picked -- that would make the
- * `--log .xeno/log` the card requires for continuing it unnecessary, and
- * it would mix the old layout into the new one without anyone asking.
+ * Like Pi, a new invocation starts a new session unless a resume intent
+ * was explicit. --fresh remains a non-destructive alias for that default.
+ * Legacy .xeno/log stays opt-in; storage layout never implies user intent.
  */
 export async function resolveLogDir(
   workspace: string,
   opts: ResolveLogOpts = {},
 ): Promise<{ logDir: string; created: boolean; legacyNotice: string | null }> {
+  const entry = planSessionEntry(opts);
   // Computed first: createSession will mkdir `.xeno/sessions/`, after which
   // the leftover-log condition is no longer true.
   const legacyNotice = await legacyLogNotice(workspace);
-  if (opts.noSession === true) {
-    const logDir = await mkdtemp(join(tmpdir(), "xeno-nosession-"));
-    return { logDir, created: true, legacyNotice };
-  }
-  if (opts.explicit !== undefined) {
-    return { logDir: opts.explicit, created: false, legacyNotice };
-  }
-  if (opts.session !== undefined && opts.session.length > 0) {
-    const found = await findSessionByPrefix(workspace, opts.session, opts.sessionDir);
-    if (!found.ok) throw new Error(found.reason);
-    return { logDir: found.session.path, created: false, legacyNotice };
-  }
-  if (opts.continueLatest === true) {
-    const { sessions } = await listSessions(workspace, opts.sessionDir);
-    const newest = sessions.find((s) => s.ok);
-    if (newest === undefined) {
-      throw new Error("no session to continue");
+  switch (entry.kind) {
+    case "named": {
+      const root = sessionsDir(workspace, opts.sessionDir), logDir = join(root, entry.id);
+      await mkdir(root, { recursive: true });
+      try { await mkdir(logDir); return { logDir, created: true, legacyNotice }; }
+      catch (error) {
+        if ((error as { code?: string }).code !== "EEXIST" || !(await lstat(logDir)).isDirectory()) throw error;
+        return { logDir, created: false, legacyNotice };
+      }
     }
-    return { logDir: newest.path, created: false, legacyNotice };
-  }
-  if (opts.fresh !== true) {
-    const { sessions } = await listSessions(workspace, opts.sessionDir);
-    const newest = sessions.find((s) => s.ok);
-    if (newest !== undefined) {
-      return { logDir: newest.path, created: false, legacyNotice };
+    case "ephemeral": {
+      const logDir = await mkdtemp(join(tmpdir(), "xeno-nosession-"));
+      return { logDir, created: true, legacyNotice };
     }
+    case "open": {
+      if (entry.explicit) return { logDir: entry.target, created: false, legacyNotice };
+      const archive = resolve(workspace, entry.target);
+      if (await stat(archive).then(info => info.isFile(), () => false)) {
+        return { logDir: await importSessionArchive(archive, sessionsDir(workspace, opts.sessionDir), workspace), created: true, legacyNotice };
+      }
+      const found = await findSessionByPrefix(workspace, entry.target, opts.sessionDir);
+      if (!found.ok) throw new Error(found.reason);
+      return { logDir: found.session.path, created: false, legacyNotice };
+    }
+    case "fork": {
+      const found = await findSessionByPrefix(workspace, entry.target, opts.sessionDir);
+      if (!found.ok) throw new Error(found.reason);
+      const created = await createSession(workspace, systemIdClock, opts.sessionDir);
+      await copyAncestryTo(found.session.path, created.path, new Date().toISOString());
+      return { logDir: created.path, created: true, legacyNotice };
+    }
+    case "continue": {
+      const { sessions } = await listSessions(workspace, opts.sessionDir, Infinity);
+      const newest = sessions.find((s) => s.ok);
+      if (newest !== undefined) return { logDir: newest.path, created: false, legacyNotice };
+      break;
+    }
+    case "select":
+      throw new Error("--resume needs an interactive terminal. Pass --session <id> instead");
+    case "new": break;
+    default: return assertNever(entry, "resolveLogDir");
   }
   const created = await createSession(workspace, systemIdClock, opts.sessionDir);
   return { logDir: created.path, created: true, legacyNotice };
@@ -401,7 +410,7 @@ async function existingDir(workspace: string, prefix: string): Promise<string |
   return null;
 }
 
-async function readListed(id: string, path: string): Promise<ListedSession> {
+export async function readListed(id: string, path: string, details?: { workspace: string; signal?: AbortSignal }): Promise<ListedSession> {
   let parsed: unknown;
   try {
     parsed = await readManifest(path);
@@ -409,7 +418,7 @@ async function readListed(id: string, path: string): Promise<ListedSession> {
     if ((err as { code?: string }).code === "ENOENT") {
       return {
         ok: true, id, path,
-        name: null, model: null, node: null, events: 0, updated_at: null,
+        name: null, model: null, node: null, events: 0, updated_at: null, ...(details ? { workspace: details.workspace } : {}),
       };
     }
     return { ok: false, id, path, error: `${path} could not be read: ${(err as Error).message}` };
@@ -424,7 +433,7 @@ async function readListed(id: string, path: string): Promise<ListedSession> {
   if (cursor === undefined) {
     return {
       ok: true, id, path,
-      name: null, model: null, node: null, events: 0, updated_at: null,
+      name: null, model: null, node: null, events: 0, updated_at: null, ...(details ? { workspace: details.workspace } : {}),
     };
   }
 
@@ -432,6 +441,16 @@ async function readListed(id: string, path: string): Promise<ListedSession> {
   // listing (a cycle, a missing parent), and a list that throws for one
   // bad tree is the same shape as a list that throws for one bad file.
   const events = (await readNode(path, cursor.node)).events.length;
+  const text: string[] = [];
+  if (details) for (const node of await listNodes(path)) {
+    if (details.signal?.aborted) break;
+    const read = await readNode(path, node);
+    if (read.corrupt.length) throw new Error(`${path} has corrupt events`);
+    for (const event of read.events) {
+      if (event.t === "user") text.push(event.text);
+      else if (event.t === "assistant") for (const block of event.blocks) if (block.type === "text") text.push(block.text);
+    }
+  }
   return {
     ok: true,
     id,
@@ -441,6 +460,8 @@ async function readListed(id: string, path: string): Promise<ListedSession> {
     node: cursor.node,
     events,
     updated_at: cursor.updated_at,
+    ...(details ? { workspace: cursor.workspace ?? details.workspace, text: text.join("\n"),
+      ...(manifest.parent_session ? { parent_session: manifest.parent_session } : {}) } : {}),
   };
 }
 

package/src/store/trust.ts

@@ -9,6 +9,7 @@
 
 import { dirname, join, resolve } from "node:path";
 import { configDir, readJsonFile, writeJsonFile } from "./config.ts";
+import { parseSettings } from "../core/settings.ts";
 
 export type TrustFile = { readonly [dir: string]: boolean };
 
@@ -38,6 +39,18 @@ export function lookupTrust(decisions: TrustFile, dir: string): boolean | undefi
   }
 }
 
+export async function projectTrust(workspace: string, temporary?: boolean): Promise<{ trusted: boolean; saved?: { path: string; trusted: boolean }; policy: "ask" | "always" | "never" }> {
+  const [saved, settings] = await Promise.all([readTrust(), readJsonFile<unknown>(join(configDir(), "settings.json"))]);
+  const policy = parseSettings(settings.value).settings.defaultProjectTrust ?? "ask";
+  let path = resolve(workspace);
+  for (;;) {
+    const decision = saved.value[path];
+    if (decision !== undefined) return { trusted: temporary ?? decision, saved: { path, trusted: decision }, policy };
+    const parent = dirname(path); if (parent === path) break; path = parent;
+  }
+  return { trusted: temporary ?? policy === "always", policy };
+}
+
 export async function readTrust(): Promise<{ value: TrustFile; error: string | null }> {
   const { value, error } = await readJsonFile<unknown>(trustPath());
   if (error) return { value: {}, error };

package/src/tui/chat-viewport.ts

@@ -0,0 +1,47 @@
+/** Ported from Pi (MIT), coding-agent/chat-viewport.ts at 02eed88. */
+import { type Component, ScrollView, type ScrollViewScrollbar, VStack } from "../vendor/pi-tui/index.ts";
+
+export interface ChatViewportOptions {
+	readonly document: Component;
+	readonly pendingMessages: Component;
+	readonly status: Component;
+	readonly editor: Component;
+	readonly footer: Component;
+	readonly widgetsAbove?: Component;
+	readonly widgetsBelow?: Component;
+	readonly scrollbar?: ScrollViewScrollbar;
+	readonly scrollbarTrackStyle?: (text: string) => string;
+	readonly scrollbarThumbStyle?: (text: string) => string;
+}
+
+export interface ChatViewport {
+	readonly root: Component;
+	readonly transcript: ScrollView;
+}
+
+/** Shared fullscreen transcript and fixed input-dock layout. */
+export function createChatViewport(options: ChatViewportOptions): ChatViewport {
+	const transcript = new ScrollView(options.document, {
+		follow: "end",
+		primary: true,
+		overscroll: "chain",
+		scrollbar: options.scrollbar ?? "auto",
+		...(options.scrollbarTrackStyle === undefined ? {} : { scrollbarTrackStyle: options.scrollbarTrackStyle }),
+		...(options.scrollbarThumbStyle === undefined ? {} : { scrollbarThumbStyle: options.scrollbarThumbStyle }),
+	});
+	const dock = new VStack([
+		{ component: options.pendingMessages, shrink: 1, minSize: 0 },
+		{ component: options.status, shrink: 1, minSize: 0 },
+		...(options.widgetsAbove === undefined ? [] : [{ component: options.widgetsAbove, shrink: 1, minSize: 0 }]),
+		{ component: options.editor, shrink: 1, minSize: 3 },
+		...(options.widgetsBelow === undefined ? [] : [{ component: options.widgetsBelow, shrink: 1, minSize: 0 }]),
+		{ component: options.footer, shrink: 1, minSize: 0 },
+	]);
+	return {
+		transcript,
+		root: new VStack([
+			{ component: transcript, basis: 0, grow: 1, shrink: 1, minSize: 1 },
+			{ component: dock, basis: "auto", grow: 0, shrink: 1, minSize: 1 },
+		]),
+	};
+}