conductor-remote 1.42.2 → 1.43.0

package/dist-node/src/routes.js

@@ -0,0 +1,96 @@
+/**
+ * Every `/api` path, declared once, for the three callers that must agree on it.
+ *
+ * The relay matches these, the phone builds them (`web/src/lib/api.ts`) and the MCP
+ * tools build them too (`src/mcp-tools.ts`). Before this each path was spelled three
+ * times: a regex here, a template literal there, another template literal in the third
+ * place. `src/wire.ts` had already made the *shapes* impossible to disagree about, and
+ * this is the other half — a renamed path used to typecheck cleanly in all three files
+ * and surface as a 404 on someone's phone.
+ *
+ * One pattern gives both directions. `param()` splits `/api/sessions/:id/stop` at the
+ * placeholder, so the same string builds `path(id)` for a client and the regex the relay
+ * matches with. They cannot drift because there is only one of them.
+ *
+ * **This module stays stdlib-free — no `node:` imports, ever.** It is one of the two
+ * files under `src/` the web app may import a *value* from (the other is
+ * `src/shared.ts`), and `scripts/check-imports.ts` walks both to enforce it. Anything
+ * needing Node belongs in the handler, not in the table.
+ */
+/** Escape a literal for use inside a RegExp — the paths are fixed strings, but `.` is real syntax. */
+function literal(text) {
+    return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function flat(method, pattern) {
+    return { method, pattern, path: () => pattern };
+}
+function param(method, pattern) {
+    const [head, tail] = pattern.split(/:[a-zA-Z]+/);
+    if (tail === undefined)
+        throw new Error(`route ${pattern} declares no :param`);
+    return {
+        method,
+        pattern,
+        path: value => `${head}${encodeURIComponent(value)}${tail}`,
+        re: new RegExp(`^${literal(head)}([^/]+)${literal(tail)}$`)
+    };
+}
+/**
+ * The table. Names read as what the caller wants, not as the verb plus the noun, because
+ * the method is right there in the value.
+ */
+export const routes = {
+    // ── the relay itself ──
+    state: flat('GET', '/api/state'),
+    search: flat('GET', '/api/search'),
+    repos: flat('GET', '/api/repos'),
+    repoIcon: param('GET', '/api/repos/:repo/icon'),
+    logs: flat('GET', '/api/logs'),
+    settings: flat('GET', '/api/settings'),
+    updateSettings: flat('PATCH', '/api/settings'),
+    nosleep: flat('GET', '/api/nosleep'),
+    armNoSleep: flat('POST', '/api/nosleep'),
+    disarmNoSleep: flat('DELETE', '/api/nosleep'),
+    push: flat('GET', '/api/push'),
+    pushSubscribe: flat('POST', '/api/push/subscribe'),
+    pushUnsubscribe: flat('POST', '/api/push/unsubscribe'),
+    pushTest: flat('POST', '/api/push/test'),
+    // ── workspaces ──
+    createWorkspace: flat('POST', '/api/workspaces'),
+    sessions: param('GET', '/api/workspaces/:workspaceId/sessions'),
+    newChat: param('POST', '/api/workspaces/:workspaceId/sessions'),
+    diff: param('GET', '/api/workspaces/:workspaceId/diff'),
+    merge: param('POST', '/api/workspaces/:workspaceId/merge'),
+    workspaceStatus: param('POST', '/api/workspaces/:workspaceId/status'),
+    /** Dismiss a first prompt the relay never managed to deliver (src/firstprompt.ts). */
+    dismissFirstPrompt: param('DELETE', '/api/workspaces/:workspaceId/prompt'),
+    // ── chats ──
+    messages: param('GET', '/api/sessions/:sessionId/messages'),
+    models: param('GET', '/api/sessions/:sessionId/models'),
+    agent: param('POST', '/api/sessions/:sessionId/agent'),
+    stop: param('POST', '/api/sessions/:sessionId/stop'),
+    sendPrompt: param('POST', '/api/sessions/:sessionId/prompt'),
+    /** Copy a chat into a fresh tab beside it, as a Conductor attachment (src/attachments.ts). */
+    splitChat: param('POST', '/api/sessions/:sessionId/split'),
+    /** Dismiss a prompt parked behind the lock screen (src/parked.ts). */
+    dismissParkedPrompt: param('DELETE', '/api/sessions/:sessionId/prompt')
+};
+// ── matching, for the relay ─────────────────────────────────────────────────────
+// The client half of a route is a function call; the server half needs these two.
+/** Whether this request is that parameterless route. */
+export function isRoute(route, method, pathname) {
+    return method === route.method && pathname === route.pattern;
+}
+/**
+ * The decoded parameter when this request is that route, else null.
+ *
+ * Decoding here rather than at each call site is the point: a workspace id is safe
+ * either way, but a repo name is not, and one handler forgetting `decodeURIComponent`
+ * is exactly the bug this table exists to make unwritable.
+ */
+export function routeParam(route, method, pathname) {
+    if (method !== route.method)
+        return null;
+    const m = pathname.match(route.re);
+    return m ? decodeURIComponent(m[1]) : null;
+}

package/dist-node/src/server.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import http from 'node:http';
 import path from 'node:path';
 import zlib from 'node:zlib';
+import { writeAttachment } from "./attachments.js";
 import { startAutoUpdate, updateStatus } from "./autoupdate.js";
 import { loadConfig, stateDir } from "./config.js";
 import { ConductorDb } from "./db.js";
@@ -17,9 +18,11 @@ import { chatRoute, notifyAll, notifyDevice, pushConfig, startNotifier, subscrib
 import { ParkedPromptQueue } from "./parked.js";
 import { attachPrStatus } from "./pr.js";
 import { Reads } from "./reads.js";
+import { isRoute, routeParam, routes } from "./routes.js";
 import { foldHits, queryTokens, SearchIndex } from "./search.js";
 import { readSettings, writeSettings } from "./settings.js";
 import { driftWarningLines, tailscaleBin } from "./tailscale.js";
+import { renderTranscript } from "./transcript.js";
 import { autoJoinHotspotMode, currentSsid, looksLikeHotspot, preferredNetworks } from "./wifi.js";
 import { createWorkspace, describeActuator, EFFORT_LABELS, listAgentModels, lockBlocked, newChat, pickActuator, retryWontHelp, screenLocked, setAgentOptions, setRestartGuard, setWorkspaceStatus, stopTurn, UiBusyError, uiQueueDepth, WORKSPACE_STATUS_LABELS, withUiPriority } from "./writes.js";
 // Before anything that logs: from here on every console line is also kept in memory for
@@ -160,6 +163,31 @@ function locateChat(ws, sessionId) {
         session: sessions[index]
     };
 }
+/**
+ * Open a chat tab in a workspace and come back with its id.
+ *
+ * ⌘T is fire-and-forget like every other keystroke here, so the id is not something
+ * the write can return — the DB is the receipt. Which row is the new one is decided by
+ * diffing the tab list against the one taken *before* the keystroke, not by taking the
+ * newest: a sibling tab or another agent may have opened one in between, and picking by
+ * `created_at` would hand back theirs.
+ */
+async function openChat(ws) {
+    const before = new Set(reads.listSessions(ws.id).map(s => s.id));
+    const result = await newChat(ws);
+    if (!result.ok)
+        return { error: true, result };
+    // The new session lands in the DB a beat after Cmd+T — poll for the fresh id.
+    for (let i = 0; i < 12; i++) {
+        await sleep(500);
+        const fresh = reads.listSessions(ws.id).find(s => !before.has(s.id));
+        if (fresh)
+            return { sessionId: fresh.id };
+    }
+    // The tab is almost certainly on screen; only its id is missing. Say so rather than
+    // failing the call, so a caller can still tell the user where the work went.
+    return { sessionId: null };
+}
 /** Poll the DB until Conductor records the setting we just drove through the UI. */
 async function confirmAgentOptions(ws, sessionId, opts) {
     for (let attempt = 0; attempt < 10; attempt++) {
@@ -506,7 +534,7 @@ const server = http.createServer(async (req, res) => {
     return withUiPriority(priority, async () => {
         try {
             // GET /api/state — workspace list with active-session status
-            if (req.method === 'GET' && pathname === '/api/state') {
+            if (isRoute(routes.state, req.method, pathname)) {
                 const update = updateStatus();
                 const workspaces = reads.listWorkspaces();
                 attachPrStatus(workspaces); // colours pr_status from cache; refreshes stale entries in the background
@@ -538,7 +566,7 @@ const server = http.createServer(async (req, res) => {
             //
             // Both reach archived workspaces. That is the point: 1,846 of the 1,886 here are
             // archived, so a search limited to the live sidebar would miss almost everything.
-            if (req.method === 'GET' && pathname === '/api/search') {
+            if (isRoute(routes.search, req.method, pathname)) {
                 const q = url.searchParams.get('q') ?? '';
                 // 12, not 50: an OR query over common words ("add", "remove") has a long weak tail,
                 // and past the first screenful nobody scrolls — they retype instead.
@@ -572,14 +600,14 @@ const server = http.createServer(async (req, res) => {
                 });
             }
             // GET /api/repos — repos a new workspace can be created in
-            if (req.method === 'GET' && pathname === '/api/repos') {
+            if (isRoute(routes.repos, req.method, pathname)) {
                 return json(req, res, 200, { repos: reads.listRepos() });
             }
             // GET /api/settings — relay preferences plus what the phone needs to edit them:
             // the SSIDs this Mac already holds credentials for, so the picker offers a choice
             // instead of asking someone to type a network name from memory on a phone keyboard.
             // `ssid` is best-effort and often null (macOS gates it behind Location Services).
-            if (req.method === 'GET' && pathname === '/api/settings') {
+            if (isRoute(routes.settings, req.method, pathname)) {
                 // Four subprocesses, all concurrent: this is the one route that shells out more
                 // than once, and serialising them would put the phone's polls behind the sum.
                 const [known, current, autoJoinHotspot, nosleep] = await Promise.all([
@@ -603,7 +631,7 @@ const server = http.createServer(async (req, res) => {
                 });
             }
             // PATCH /api/settings { fallbackSsids?, autoRejoin? } — merge and persist.
-            if (req.method === 'PATCH' && pathname === '/api/settings') {
+            if (isRoute(routes.updateSettings, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const patch = {};
                 if (Array.isArray(body.fallbackSsids))
@@ -615,14 +643,14 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, 200, { settings: writeSettings(patch) });
             }
             // GET /api/nosleep — is the Mac being held awake, and can this relay do it at all
-            if (req.method === 'GET' && pathname === '/api/nosleep') {
+            if (isRoute(routes.nosleep, req.method, pathname)) {
                 return json(req, res, 200, { ...(await nosleepState()), maxSeconds: NOSLEEP_MAX_SECONDS });
             }
             // POST /api/nosleep { seconds } — hold this Mac awake, lid closed, for a bounded window.
             // Only works once `conductor-remote nosleep setup` has installed the scoped sudoers
             // rule; without it there is no way for a TTY-less daemon to reach root, and the
             // response says so rather than failing vaguely.
-            if (req.method === 'POST' && pathname === '/api/nosleep') {
+            if (isRoute(routes.armNoSleep, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const seconds = Number(body.seconds);
                 // Whole seconds, not just "> 0": the helper reads 0 as "until killed", and 0.4
@@ -633,7 +661,7 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, result.ok ? 200 : result.state.available ? 502 : 409, result);
             }
             // DELETE /api/nosleep — let it sleep again now, rather than at the window's end
-            if (req.method === 'DELETE' && pathname === '/api/nosleep') {
+            if (isRoute(routes.disarmNoSleep, req.method, pathname)) {
                 const result = await disarmNoSleep();
                 return json(req, res, result.ok ? 200 : result.state.available ? 502 : 409, result);
             }
@@ -641,7 +669,7 @@ const server = http.createServer(async (req, res) => {
             // without reaching the Mac. Default is this process's captured console (ordered, timestamped);
             // `file` tails the daemon's stdout/stderr on disk, which is the only place the *previous*
             // process's crash survives. Everything is redacted: the startup banner prints the token.
-            if (req.method === 'GET' && pathname === '/api/logs') {
+            if (isRoute(routes.logs, req.method, pathname)) {
                 const file = url.searchParams.get('file');
                 if (file && !LOG_FILE_NAMES.includes(file)) {
                     return json(req, res, 404, { error: `unknown log file ${file}`, files: LOG_FILE_NAMES });
@@ -667,13 +695,13 @@ const server = http.createServer(async (req, res) => {
                 });
             }
             // GET /api/push — the VAPID public key the phone subscribes with, plus who's already subscribed
-            if (req.method === 'GET' && pathname === '/api/push') {
+            if (isRoute(routes.push, req.method, pathname)) {
                 return json(req, res, 200, pushConfig());
             }
             // POST /api/push/subscribe { subscription, label? } — register (or refresh) this device.
             // Idempotent by endpoint: the app re-sends on every load, which is what heals a relay that
             // lost its store, or a subscription the browser silently renewed.
-            if (req.method === 'POST' && pathname === '/api/push/subscribe') {
+            if (isRoute(routes.pushSubscribe, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const sub = body.subscription;
                 if (!sub?.endpoint || !sub.keys?.p256dh || !sub.keys.auth) {
@@ -686,14 +714,14 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, 200, { ok: true, ...registered });
             }
             // POST /api/push/unsubscribe { endpoint } — the phone turned notifications off
-            if (req.method === 'POST' && pathname === '/api/push/unsubscribe') {
+            if (isRoute(routes.pushUnsubscribe, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 if (!body.endpoint)
                     return json(req, res, 400, { error: 'need the endpoint' });
                 return json(req, res, 200, { ok: unsubscribeDevice(body.endpoint), devices: pushConfig().devices });
             }
             // POST /api/push/test { id } — push to one device, so "is this actually wired up?" has an answer
-            if (req.method === 'POST' && pathname === '/api/push/test') {
+            if (isRoute(routes.pushTest, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 if (!body.id)
                     return json(req, res, 400, { error: 'need the device id' });
@@ -708,7 +736,7 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, result.ok ? 200 : 502, result);
             }
             // POST /api/workspaces { repo, prompt, send? } — create a workspace via Conductor's deep link
-            if (req.method === 'POST' && pathname === '/api/workspaces') {
+            if (isRoute(routes.createWorkspace, req.method, pathname)) {
                 const body = JSON.parse((await readBody(req)) || '{}');
                 // The prompt is optional — a bare `path=` opens an empty workspace, like
                 // Conductor's own New workspace — but *something* has to say where it goes.
@@ -759,9 +787,9 @@ const server = http.createServer(async (req, res) => {
                 });
             }
             // GET /api/repos/:name/icon — the repo's resolved sidebar icon (see src/icons.ts)
-            let m = pathname.match(/^\/api\/repos\/([^/]+)\/icon$/);
-            if (req.method === 'GET' && m) {
-                const icon = reads.resolveRepoIcon(decodeURIComponent(m[1]));
+            const repo = routeParam(routes.repoIcon, req.method, pathname);
+            if (repo) {
+                const icon = reads.resolveRepoIcon(repo);
                 if (!icon)
                     return json(req, res, 404, { error: 'no icon' });
                 return void fs.readFile(icon.path, (err, data) => {
@@ -773,32 +801,26 @@ const server = http.createServer(async (req, res) => {
                 });
             }
             // GET /api/workspaces/:id/sessions
-            m = pathname.match(/^\/api\/workspaces\/([^/]+)\/sessions$/);
-            if (req.method === 'GET' && m) {
-                return json(req, res, 200, { sessions: reads.listSessions(decodeURIComponent(m[1])) });
+            const listSessionsIn = routeParam(routes.sessions, req.method, pathname);
+            if (listSessionsIn) {
+                return json(req, res, 200, { sessions: reads.listSessions(listSessionsIn) });
             }
             // POST /api/workspaces/:id/sessions — open a new chat (Cmd+T) in the workspace
-            if (req.method === 'POST' && m) {
-                const workspaceId = decodeURIComponent(m[1]);
+            const newChatIn = routeParam(routes.newChat, req.method, pathname);
+            if (newChatIn) {
+                const workspaceId = newChatIn;
                 const ws = reads.getWorkspace(workspaceId);
                 if (!ws)
                     return json(req, res, 404, { error: 'workspace not found' });
-                const before = new Set(reads.listSessions(workspaceId).map(s => s.id));
-                const result = await newChat(ws);
-                if (!result.ok)
-                    return json(req, res, 502, result);
-                // The new session lands in the DB a beat after Cmd+T — poll for the fresh id.
-                let sessionId = null;
-                for (let i = 0; i < 12 && !sessionId; i++) {
-                    await new Promise(r => setTimeout(r, 500));
-                    sessionId = reads.listSessions(workspaceId).find(s => !before.has(s.id))?.id ?? null;
-                }
-                return json(req, res, 200, { ok: true, sessionId });
+                const opened = await openChat(ws);
+                if ('error' in opened)
+                    return json(req, res, 502, opened.result);
+                return json(req, res, 200, { ok: true, sessionId: opened.sessionId });
             }
             // GET /api/workspaces/:id/diff
-            m = pathname.match(/^\/api\/workspaces\/([^/]+)\/diff$/);
-            if (req.method === 'GET' && m) {
-                const ws = reads.getWorkspace(decodeURIComponent(m[1]));
+            const diffOf = routeParam(routes.diff, req.method, pathname);
+            if (diffOf) {
+                const ws = reads.getWorkspace(diffOf);
                 if (!ws)
                     return json(req, res, 404, { error: 'workspace not found' });
                 if (!ws.worktree)
@@ -807,9 +829,9 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, 200, diff);
             }
             // POST /api/workspaces/:id/merge — merge the workspace's open PR (mirrors Conductor's merge button)
-            m = pathname.match(/^\/api\/workspaces\/([^/]+)\/merge$/);
-            if (req.method === 'POST' && m) {
-                const ws = reads.getWorkspace(decodeURIComponent(m[1]));
+            const mergeOf = routeParam(routes.merge, req.method, pathname);
+            if (mergeOf) {
+                const ws = reads.getWorkspace(mergeOf);
                 if (!ws)
                     return json(req, res, 404, { error: 'workspace not found' });
                 const result = await mergePr(ws);
@@ -819,9 +841,9 @@ const server = http.createServer(async (req, res) => {
             // Conductor derives that status from a PR it sometimes never links (a PR merged inside its
             // poll window is invisible to it afterwards), which strands finished work in "In progress"
             // with no way to correct it from a phone. This is that way.
-            m = pathname.match(/^\/api\/workspaces\/([^/]+)\/status$/);
-            if (req.method === 'POST' && m) {
-                const workspaceId = decodeURIComponent(m[1]);
+            const statusOf = routeParam(routes.workspaceStatus, req.method, pathname);
+            if (statusOf) {
+                const workspaceId = statusOf;
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const status = body.status ?? '';
                 if (!WORKSPACE_STATUS_LABELS[status]) {
@@ -853,15 +875,15 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, 200, { ok: true, workspace: reads.getWorkspace(workspaceId) });
             }
             // GET /api/sessions/:id/messages?after=<rowid>
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/messages$/);
-            if (req.method === 'GET' && m) {
+            const messagesOf = routeParam(routes.messages, req.method, pathname);
+            if (messagesOf) {
                 const after = Number(url.searchParams.get('after') ?? 0);
-                return json(req, res, 200, reads.getMessages(decodeURIComponent(m[1]), Number.isFinite(after) ? after : 0));
+                return json(req, res, 200, reads.getMessages(messagesOf, Number.isFinite(after) ? after : 0));
             }
             // GET /api/sessions/:id/models?workspaceId= — labels from Conductor's live picker
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/models$/);
-            if (req.method === 'GET' && m) {
-                const sessionId = decodeURIComponent(m[1]);
+            const modelsOf = routeParam(routes.models, req.method, pathname);
+            if (modelsOf) {
+                const sessionId = modelsOf;
                 const ws = reads.getWorkspace(url.searchParams.get('workspaceId') ?? '');
                 if (!ws)
                     return json(req, res, 404, { error: 'workspace for session not found' });
@@ -873,9 +895,9 @@ const server = http.createServer(async (req, res) => {
             }
             // POST /api/sessions/:id/agent  { effort?, plan?, fast?, model? }
             // Drives the composer's own model/effort/plan/fast controls for one chat.
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/agent$/);
-            if (req.method === 'POST' && m) {
-                const sessionId = decodeURIComponent(m[1]);
+            const agentOf = routeParam(routes.agent, req.method, pathname);
+            if (agentOf) {
+                const sessionId = agentOf;
                 const body = JSON.parse((await readBody(req)) || '{}');
                 if (body.effort && !EFFORT_LABELS[body.effort]) {
                     return json(req, res, 400, { error: `effort must be one of ${Object.keys(EFFORT_LABELS).join(', ')}` });
@@ -891,9 +913,9 @@ const server = http.createServer(async (req, res) => {
                 return json(req, res, 200, { ok: true, session: reads.listSessions(ws.id).find(s => s.id === sessionId) });
             }
             // POST /api/sessions/:id/stop — the desktop app's stop button, for one chat.
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/stop$/);
-            if (req.method === 'POST' && m) {
-                const sessionId = decodeURIComponent(m[1]);
+            const stopOf = routeParam(routes.stop, req.method, pathname);
+            if (stopOf) {
+                const sessionId = stopOf;
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const ws = body.workspaceId
                     ? reads.getWorkspace(body.workspaceId)
@@ -939,9 +961,9 @@ const server = http.createServer(async (req, res) => {
             // POST /api/sessions/:id/prompt  { text, agent? } — agent is the phone's staged
             // settings patch, applied before the prompt so the two can't come apart (and so
             // both park together when the Mac turns out to be locked).
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/prompt$/);
-            if (req.method === 'POST' && m) {
-                const sessionId = decodeURIComponent(m[1]);
+            const promptTo = routeParam(routes.sendPrompt, req.method, pathname);
+            if (promptTo) {
+                const sessionId = promptTo;
                 const body = JSON.parse((await readBody(req)) || '{}');
                 const text = (body.text ?? '').trim();
                 if (!text)
@@ -998,18 +1020,98 @@ const server = http.createServer(async (req, res) => {
                 }
                 return json(req, res, 502, result);
             }
+            // POST /api/sessions/:id/split { prompt?, includeThinking?, includeTools? }
+            //
+            // Conductor's own "Fork to new tab" resumes the agent's real session. This copies
+            // the conversation instead, as a Conductor attachment, which is the cut that
+            // survives being read by a *different* agent: prose and reasoning, no tool churn.
+            // Two reasons it exists at all. A tangent asked inside a running chat leaves three
+            // conversations interleaved in one tab, which reads badly for everyone afterwards;
+            // and Conductor's fork lives on a hover menu over one message, which an agent
+            // cannot reach and which the relay would have to find by walking a transcript that
+            // gets more expensive the longer the chat is.
+            //
+            // It stops before sending. The composed prompt goes out through the ordinary send
+            // route so it inherits the retry loop, the transcript confirm and the parked queue
+            // — and because ⌘T plus a send is two UI turns, which together outlast any caller's
+            // budget (28s + 55s against the MCP client's 75s).
+            const splitFrom = routeParam(routes.splitChat, req.method, pathname);
+            if (splitFrom) {
+                const sessionId = splitFrom;
+                const body = JSON.parse((await readBody(req)) || '{}');
+                // `active_session_id` is how every other route resolves this, and it would only
+                // ever find the tab on screen. Splitting a chat you are not looking at is the
+                // normal case here, so the session's own column decides.
+                const workspaceId = body.workspaceId ?? reads.sessionWorkspaceId(sessionId);
+                const ws = workspaceId ? reads.getWorkspace(workspaceId) : null;
+                if (!ws)
+                    return json(req, res, 404, { error: 'workspace for session not found' });
+                if (!ws.worktree)
+                    return json(req, res, 409, { error: 'worktree path unresolved' });
+                const source = reads.listSessions(ws.id).find(s => s.id === sessionId);
+                if (!source)
+                    return json(req, res, 404, { error: 'chat not found in that workspace' });
+                const format = { thinking: body.includeThinking !== false, tools: body.includeTools === true };
+                const { entries } = reads.getMessages(sessionId);
+                const rendered = renderTranscript(entries, format);
+                if (!rendered.kept)
+                    return json(req, res, 409, { error: 'that chat has nothing to copy yet' });
+                // Conductor's own name for a copied transcript, so the chip reads the same as one
+                // saved by hand. The header states the cut, because a transcript that silently
+                // drops half a chat is worse than one that admits to it.
+                const title = source.title?.trim() || 'chat';
+                const carried = [`thinking ${format.thinking ? 'included' : 'omitted'}`];
+                carried.push(`tool calls ${format.tools ? 'included' : 'omitted'}`);
+                const header = [
+                    `# Transcript of ${title}`,
+                    '',
+                    `${[ws.repo_name, ws.branch].filter(Boolean).join(' · ')}`,
+                    `Copied from the Conductor chat \`${sessionId}\` by conductor-remote. ${carried.join(', ')}.`,
+                    '',
+                    ''
+                ].join('\n');
+                const attachment = writeAttachment(ws.worktree, `Transcript of ${title}.md`, header + rendered.text);
+                const opened = await openChat(ws);
+                if ('error' in opened) {
+                    return json(req, res, 502, { ...opened.result, attachment: { ...attachment, ...rendered } });
+                }
+                // Both forms on purpose: the token is what Conductor turns into a chip, and the
+                // sentence is what still works if it does not. Nothing here may depend on which.
+                const prompt = (body.prompt ?? '').trim();
+                const text = [
+                    attachment.token,
+                    `(the chat this was split off from — read \`${attachment.relPath}\` first)`,
+                    '',
+                    prompt
+                ]
+                    .join('\n')
+                    .trim();
+                return json(req, res, 200, {
+                    ok: true,
+                    sessionId: opened.sessionId,
+                    workspaceId: ws.id,
+                    text,
+                    attachment: {
+                        name: attachment.name,
+                        path: attachment.relPath,
+                        bytes: attachment.bytes,
+                        kept: rendered.kept,
+                        elided: rendered.elided
+                    }
+                });
+            }
             // DELETE /api/workspaces/:id/prompt — dismiss an undelivered first prompt
-            m = pathname.match(/^\/api\/workspaces\/([^/]+)\/prompt$/);
-            if (req.method === 'DELETE' && m) {
-                const workspaceId = decodeURIComponent(m[1]);
+            const forgetFirst = routeParam(routes.dismissFirstPrompt, req.method, pathname);
+            if (forgetFirst) {
+                const workspaceId = forgetFirst;
                 if (!firstPrompts.forget(workspaceId))
                     return json(req, res, 404, { error: 'no pending prompt' });
                 return json(req, res, 200, { ok: true });
             }
             // DELETE /api/sessions/:id/prompt — dismiss whatever is parked for this chat
-            m = pathname.match(/^\/api\/sessions\/([^/]+)\/prompt$/);
-            if (req.method === 'DELETE' && m) {
-                const sessionId = decodeURIComponent(m[1]);
+            const forgetParked = routeParam(routes.dismissParkedPrompt, req.method, pathname);
+            if (forgetParked) {
+                const sessionId = forgetParked;
                 if (!parkedPrompts.forgetSession(sessionId))
                     return json(req, res, 404, { error: 'no parked prompt' });
                 return json(req, res, 200, { ok: true });

package/dist-node/src/transcript.js

@@ -117,3 +117,83 @@ export function parseMessage(row, worktree = null) {
     flush();
     return entries;
 }
+const HEADINGS = {
+    user: 'User',
+    assistant: 'Assistant',
+    thinking: 'Thinking',
+    tool: 'Tools',
+    system: 'System'
+};
+/** One tool row per line, the shape `read_chat` prints: what it did, then what it did it to. */
+function toolLine(e) {
+    if (e.error)
+        return `- [error] ${e.text}`;
+    return `- [${e.tool ?? 'tool'}] ${e.text}${e.detail ? ` — \`${e.detail}\`` : ''}`;
+}
+function plural(n, one) {
+    return `${n} ${one}${n === 1 ? '' : 's'}`;
+}
+/**
+ * A chat as markdown, in Conductor's own transcript layout.
+ *
+ * The layout is copied from the files Conductor writes (`Transcript of <chat>.md`):
+ * an `##` heading per role, prose verbatim under it, and an elision marker for what
+ * was dropped. The heading comes *before* the marker — a run of tool calls between a
+ * prompt and its answer prints as `## Assistant`, then the marker, then the reply —
+ * which is what makes the result read like Conductor's own file rather than a log.
+ *
+ * The marker says what kind of thing went missing rather than only how many, because
+ * this render is configurable and Conductor's is not: "12 tool calls elided" tells
+ * you a flag was off, where a bare count reads as noise nobody wanted.
+ *
+ * `system` rows are always kept. They are rare, short, and one of them is how a
+ * cancelled turn ends ("aborted by user") — the single line that explains why an
+ * answer stops mid-thought, and dropping it would leave the next agent to guess.
+ */
+export function renderTranscript(entries, format) {
+    const out = [];
+    const elided = { thinking: 0, tools: 0 };
+    const pending = { thinking: 0, tools: 0 };
+    let heading = null;
+    let kept = 0;
+    const flushElisions = () => {
+        const parts = [];
+        if (pending.tools)
+            parts.push(plural(pending.tools, 'tool call'));
+        if (pending.thinking)
+            parts.push(plural(pending.thinking, 'thinking block'));
+        pending.tools = 0;
+        pending.thinking = 0;
+        if (parts.length)
+            out.push(`[${parts.join(', ')} elided]`);
+    };
+    for (const e of entries) {
+        if (e.role === 'thinking' && !format.thinking) {
+            pending.thinking++;
+            elided.thinking++;
+            continue;
+        }
+        if (e.role === 'tool' && !format.tools) {
+            pending.tools++;
+            elided.tools++;
+            continue;
+        }
+        const want = HEADINGS[e.role];
+        if (want !== heading) {
+            out.push(`## ${want}`);
+            heading = want;
+        }
+        flushElisions();
+        out.push(e.role === 'tool' ? toolLine(e) : e.text);
+        kept++;
+    }
+    // Anything dropped after the last kept entry still has to be admitted to.
+    flushElisions();
+    // Tool rows are a list, so consecutive ones share a paragraph; everything else is
+    // separated by a blank line, which is what makes the markdown render as prose.
+    const text = out
+        .map((line, i) => (line.startsWith('- ') && out[i + 1]?.startsWith('- ') ? `${line}\n` : `${line}\n\n`))
+        .join('')
+        .trim();
+    return { text: `${text}\n`, kept, elided };
+}

package/dist-node/src/writes.js

@@ -638,6 +638,13 @@ export async function createWorkspace(prompt, repoPath) {
  * Open a new chat in the target workspace — Conductor's "New chat, same files"
  * (Cmd+T). Focuses the workspace first (its own link, see `workspaceLink`), then
  * Cmd+T; the caller detects the freshly-created session id from the DB.
+ *
+ * The pane is asserted before the keystroke for the same reason a send asserts before
+ * typing: `focusWorkspace` confirms every route it takes except its last one, the
+ * palette, and Cmd+T against an unconfirmed pane opens a tab in someone else's
+ * workspace. Nothing catches that afterwards — the caller looks for the new session in
+ * *this* workspace's tab list, so a stray tab reads as "the id could not be read back"
+ * while sitting in a conversation nobody asked to change.
  */
 export async function newChat(workspace) {
     if (!focusQuery(workspace))
@@ -647,6 +654,9 @@ ${CONDUCTOR_HANDLERS}
 
 my activateConductor()
 my focusWorkspace()
+set strips to my tabGroups()
+if (count of strips) is 0 then error "couldn't find the chat pane to open a tab in"
+my assertWorkspace(item 1 of strips)
 tell application "System Events"
 	keystroke "t" using {command down}
 end tell`.trim();