flowviant 0.44.1 → 0.47.0

package/bin/lib/work.mjs

@@ -1,7 +1,8 @@
 /**
  * Work sessions — the Workbench tabs, daemon side.
  *
- * A tab is a held Claude session with BUILD permissions in a PERSISTENT
+ * A tab is a held coding-CLI session (Claude or codex — the server names the
+ * brain per tab, and the pin holds it) with BUILD permissions in a PERSISTENT
  * worktree on its own `session/<id>` branch. Nothing here is detached and
  * nothing is ever reset — uncommitted state between turns IS the session, and
  * blowing it away would be closing the human's editor mid-thought. (Plan
@@ -15,16 +16,34 @@
  * two getters (the MCP URL and the lease TTL can change with any poll).
  */
 
-import { existsSync, rmSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  rmSync,
+  readdirSync,
+  readFileSync,
+  writeFileSync,
+  realpathSync,
+  statSync,
+  lstatSync,
+  mkdirSync,
+  cpSync,
+} from 'node:fs';
 import { execFileSync } from 'node:child_process';
-import { join } from 'node:path';
+import { join, dirname } from 'node:path';
 import { FLEET_URL, FLEET_TOKEN, USER_AGENT, REFRESH_BEFORE_SECONDS } from './config.mjs';
-import { git, baseBranchName, isSafePathSegment } from './git.mjs';
+import { git, gitRaw, splitNul, baseBranchName, isSafePathSegment } from './git.mjs';
 import { c, note, ok, warn } from './ui.mjs';
 import { mcpFor, runTurn } from './claude.mjs';
-import { SYSTEM_WORK, WORK_TURN_KICKOFF } from './prompts.mjs';
+import {
+  SYSTEM_WORK,
+  WORK_TURN_KICKOFF,
+  SYSTEM_WORK_PLAIN,
+  WORK_TURN_KICKOFF_PLAIN,
+} from './prompts.mjs';
 import { materializeInto, scrub as envScrub } from './env.mjs';
-import { detectRuntimes, pickRuntimeFor, RUNTIMES } from './runtimes.mjs';
+import { detectRuntimes, canRun, RUNTIMES } from './runtimes.mjs';
+import { isTerminalSessionLive, isAgyConversationLive } from './localSessions.mjs';
+import { homedir } from 'node:os';
 
 export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLeaseTtl }) {
   const WORK_TOKEN_URL = FLEET_URL.replace(/\/agents\/?$/, '/work-token');
@@ -178,14 +197,21 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * is the point. If the directory was retired but the branch survives, the
    * worktree re-attaches to the branch and the committed work is still there.
    */
-  const sessionWtFor = (sessionId) => {
+  const sessionWtFor = (sessionId, baseAt) => {
     if (!isSafePathSegment(sessionId)) return null;
     const wt = join(baseDir, 'sessions', sessionId);
     const fresh = !existsSync(wt);
     if (fresh) {
       const branch = `session/${sessionId}`;
+      // `baseAt` is the adoption override: a tab born from a terminal session
+      // branches from THAT checkout's HEAD, because the conversation being
+      // resumed was had against those commits — putting it on the project base
+      // would hand it a repo state it has never seen. Everything else is
+      // unchanged, the attach fallback included: a surviving branch already
+      // chose its base, and re-basing it here would move committed work.
+      const at = baseAt || baseRef;
       try {
-        git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+        git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
       } catch {
         git(['worktree', 'prune'], repoRoot);
         try {
@@ -193,7 +219,7 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           git(['worktree', 'add', wt, branch], repoRoot);
         } catch {
           try {
-            git(['worktree', 'add', '-b', branch, wt, baseRef], repoRoot);
+            git(['worktree', 'add', '-b', branch, wt, at], repoRoot);
           } catch {
             return null;
           }
@@ -233,6 +259,84 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     }
   };
 
+  /**
+   * Carry a terminal checkout's DIRTY state into a fresh adopt worktree. The
+   * source is strictly READ-ONLY — nothing here writes to it, because it is
+   * the human's own checkout and adoption promises to leave it exactly as the
+   * closed terminal did. Tracked changes travel as one binary patch staged
+   * through the worktree's PRIVATE git dir (invisible to status, dies with the
+   * tree); untracked files are copied one by one, skipping anything over 5MB.
+   *
+   * Returns '' or ONE bracketed line for the turn's prompt: a carry problem is
+   * the AGENT's to explain to the user, never a reason to fail the adoption —
+   * the conversation is the thing being adopted, and it resumes either way.
+   */
+  const carryDirtyState = (srcCwd, wt) => {
+    const problems = [];
+    try {
+      // A Buffer, not utf8: a `--binary` patch (and a hunk from a non-UTF-8
+      // text file) must round-trip byte-exact or the apply corrupts what it
+      // carries. 64MB of headroom — a dirtier tree than that fails the read
+      // here and is SAID, below, rather than half-applied.
+      const patch = execFileSync('git', ['diff', 'HEAD', '--binary'], {
+        cwd: srcCwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        maxBuffer: 64 * 1024 * 1024,
+      });
+      if (patch.length) {
+        const patchPath = sessionMetaPath(wt, 'flowviant-adopt.patch');
+        if (!patchPath) throw new Error('no private git dir to stage the patch in');
+        try {
+          writeFileSync(patchPath, patch);
+          git(['apply', '--whitespace=nowarn', patchPath], wt);
+        } finally {
+          try {
+            rmSync(patchPath, { force: true });
+          } catch {
+            /* best-effort — the private git dir dies with the worktree anyway */
+          }
+        }
+      }
+    } catch {
+      problems.push(
+        'their uncommitted TRACKED changes did not carry over (they are still in the terminal checkout, untouched)'
+      );
+    }
+    try {
+      const skipped = [];
+      for (const rel of splitNul(
+        gitRaw(['ls-files', '--others', '--exclude-standard', '-z'], srcCwd)
+      )) {
+        try {
+          const from = join(srcCwd, rel);
+          // lstat, not stat: a symlink is carried as itself, and its own size
+          // is what the 5MB budget judges — never the file it points at.
+          if (lstatSync(from).size > 5 * 1024 * 1024) {
+            skipped.push(rel);
+            continue;
+          }
+          const to = join(wt, rel);
+          mkdirSync(dirname(to), { recursive: true });
+          cpSync(from, to);
+        } catch {
+          skipped.push(rel);
+        }
+      }
+      if (skipped.length) {
+        problems.push(
+          `${skipped.length} untracked file${skipped.length === 1 ? '' : 's'} did not carry (over 5MB or unreadable): ${skipped.slice(0, 5).join(', ')}${skipped.length > 5 ? ', …' : ''}`
+        );
+      }
+    } catch {
+      problems.push(
+        'untracked files could not be listed in the terminal checkout, so none were carried'
+      );
+    }
+    return problems.length
+      ? `[ADOPTION NOTE from the daemon — tell the user plainly at the start of your reply: ${problems.join('; ')}.]`
+      : '';
+  };
+
   /**
    * WHICH CLI drives this session — picked ONCE, on the first turn, and pinned
    * in the worktree's meta dir. The held context belongs to the CLI that made
@@ -241,9 +345,31 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
    * same reason). If the pinned CLI has left the machine, the turn settles
    * honestly instead of substituting. A retired-and-reattached directory has
    * no marker and no held context either, so re-picking there is correct.
-   * Returns { id } | { id: null } (nothing installed) | { missing: label }.
+   *
+   * THE SERVER'S WORD COMES FIRST. A tab is created AS a runtime's tab
+   * (`job.runtime`; null/absent = Claude, which is what every tab ran on until
+   * now), so on the first turn a named runtime IS the pick — never a
+   * preference the machine may override. And a named runtime that DISAGREES
+   * with an existing pin is an identity change mid-life: something upstream
+   * now calls this tab a different brain's, and the only honest move is to
+   * settle the turn and say so ({ mismatch }), because a held context must
+   * never be answered by a different brain.
+   *
+   * Returns { id } | { id: null } (nothing installed) | { missing: label } |
+   * { unsupported: label } (a runtime no session can run on) |
+   * { mismatch: { pin, runtime } } (labels, for the caller's sentence).
+   *
+   * SESSION-CAPABLE means rt.mcp is truthy — the session tools ride a real
+   * per-invocation MCP config — OR the runtime runs tabs PLAIN (Antigravity):
+   * no MCP at all, no cards, no streaming; the final answer is delivered by
+   * the daemon's own report and ship-time reconciliation keeps the ledger
+   * whole. `pickRuntimeFor('build')` is still the WRONG question here — it
+   * says yes to the mediated DISPATCH path without saying how a tab would
+   * speak, and a session pinned by it once threw in mcpFor on every turn.
    */
-  const sessionRuntime = (wt) => {
+  const sessionCapable = (rid) =>
+    (Boolean(RUNTIMES[rid]?.mcp) || rid === 'antigravity') && canRun(RUNTIMES[rid], 'build');
+  const sessionRuntime = (wt, jobRuntime) => {
     const marker = sessionMetaPath(wt, 'flowviant-runtime');
     let pinned = null;
     if (marker && existsSync(marker)) {
@@ -254,10 +380,50 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
       }
     }
     if (pinned && RUNTIMES[pinned]) {
+      if (jobRuntime && jobRuntime !== pinned) {
+        return {
+          mismatch: {
+            pin: RUNTIMES[pinned].label || pinned,
+            runtime: RUNTIMES[jobRuntime]?.label || jobRuntime,
+          },
+        };
+      }
+      // A pin that names a non-session-capable runtime is settled honestly by
+      // the caller, not silently re-picked: re-picking would hand the held
+      // context to a different brain, which is the exact substitution the pin
+      // exists to prevent.
+      if (!sessionCapable(pinned)) return { unsupported: RUNTIMES[pinned].label || pinned };
       const installed = detectRuntimes().find((r) => r.id === pinned)?.installed;
       return installed ? { id: pinned } : { missing: RUNTIMES[pinned].label || pinned };
     }
-    const id = pickRuntimeFor('build');
+    // First turn, and the server named the brain: that IS the pick, gated the
+    // same two ways as a pin — not session-capable and not installed both
+    // settle honestly via the caller's existing paths, never substituted.
+    if (jobRuntime) {
+      if (!sessionCapable(jobRuntime))
+        return { unsupported: RUNTIMES[jobRuntime]?.label || jobRuntime };
+      const installed = detectRuntimes().find((r) => r.id === jobRuntime)?.installed;
+      if (!installed) return { missing: RUNTIMES[jobRuntime]?.label || jobRuntime };
+      if (marker) {
+        try {
+          writeFileSync(marker, jobRuntime);
+        } catch {
+          /* best-effort — an unpinnable session just re-picks next turn */
+        }
+      }
+      return { id: jobRuntime };
+    }
+    // The fresh pick — Claude first when it qualifies, for the reason
+    // pickRuntimeFor gives: the prompts were tuned against it. DELIBERATELY
+    // NARROWER than sessionCapable: a PLAIN tab (Antigravity — no cards, no
+    // streaming) is a degraded mode someone CHOOSES, so it is honored only
+    // when the server names it, never handed out as a default.
+    const rows = detectRuntimes();
+    const okFor = (rid) =>
+      Boolean(RUNTIMES[rid]?.mcp) &&
+      sessionCapable(rid) &&
+      Boolean(rows.find((r) => r.id === rid)?.installed);
+    const id = okFor('claude') ? 'claude' : (Object.keys(RUNTIMES).find(okFor) ?? null);
     if (!id) return { id: null };
     if (marker) {
       try {
@@ -269,6 +435,51 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
     return { id };
   };
 
+  /**
+   * The shape a codex thread id must have before it is written to disk or —
+   * decisive — pushed into argv as `resume <id>`. Conservative on purpose:
+   * alphanumeric plus dash/underscore, never a leading dash (an argv that
+   * parses as a flag), never whitespace. Anything else is dropped and the
+   * session simply runs fresh in its own worktree.
+   */
+  const CODEX_THREAD_RE = /^[0-9a-zA-Z][0-9a-zA-Z_-]{7,63}$/;
+
+  /** agy conversation ids are plain UUIDs (the db filename IS the identity —
+   *  measured: a renamed copy fails "trajectory not found"). Guarded the same
+   *  way as the codex id: it rides in argv as `--conversation <id>`. */
+  const AGY_CONV_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+  /** agy's own cwd registry — {cwd → the conversation that ran there LAST}.
+   *  Read once, right after a fresh agy turn, to learn the id the turn just
+   *  created; from then on the tab's marker is the identity and this registry
+   *  is never consulted again (a dispatch sharing the machine may overwrite
+   *  the cwd's entry between turns). */
+  const agyRegistryLookup = (cwd) => {
+    try {
+      const raw = readFileSync(
+        join(homedir(), '.gemini', 'antigravity-cli', 'cache', 'last_conversations.json'),
+        'utf8'
+      );
+      const map = JSON.parse(raw);
+      if (!map || typeof map !== 'object') return null;
+      // agy keys by the cwd as IT resolved it — try our literal path and its
+      // realpath, so a symlinked home doesn't orphan the lookup.
+      let keys = [cwd];
+      try {
+        keys.push(realpathSync(cwd));
+      } catch {
+        /* the literal alone, then */
+      }
+      for (const k of keys) {
+        const id = map[k];
+        if (typeof id === 'string' && AGY_CONV_RE.test(id)) return id;
+      }
+      return null;
+    } catch {
+      return null;
+    }
+  };
+
   /**
    * The spawn lock: the pid of the CLI currently live in this worktree. A
    * restarted daemon must not put a second Claude into a directory the orphan
@@ -394,7 +605,107 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
           note(
             `${c.cyan('tab')} ${c.dim(`— ${job.askedByName || 'the owner'} in "${job.sessionName || 'a session'}"`)}`
           );
-          const dir = sessionWtFor(job.sessionId);
+          // ── ADOPTION: a tab born from a TERMINAL session ────────────────
+          // The server sends `adopt {id, cwd}` only while the session has no
+          // sessionRef — no turn has ever spoken from a worktree here — and
+          // the first turn resumes the terminal conversation by forking it
+          // into the tab's own worktree. Everything the server asserts is
+          // re-validated MACHINE-side: the id shape, the source directory,
+          // and — decisive — that the terminal is actually closed, because
+          // forking a session someone is still typing into puts two Claudes
+          // on one conversation.
+          const adopting = Boolean(job.adopt) && !job.sessionRef;
+          let srcHead = null;
+          let adoptSrc = null; // the validated, realpath'd source checkout
+          if (adopting) {
+            if (
+              typeof job.adopt.id !== 'string' ||
+              !/^[0-9a-f][0-9a-f-]{6,62}$/i.test(job.adopt.id)
+            ) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: 'that terminal session id is not one this machine can resume',
+              });
+              return;
+            }
+            let srcCwd = null;
+            try {
+              srcCwd = realpathSync(String(job.adopt.cwd ?? ''));
+              if (!statSync(srcCwd).isDirectory()) srcCwd = null;
+            } catch {
+              srcCwd = null;
+            }
+            if (!srcCwd) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: "the terminal session's directory no longer exists on the machine",
+              });
+              return;
+            }
+            // Inside the repo, outside the daemon's own worktrees: an adopt
+            // source is a HUMAN's checkout, and one of our directories showing
+            // up here means a stale or confused offer, not a session to fork.
+            const under = (p, root) =>
+              p === root || p.startsWith(root.endsWith('/') ? root : `${root}/`);
+            let realRoot = repoRoot;
+            let realBase = baseDir;
+            try {
+              realRoot = realpathSync(repoRoot);
+            } catch {
+              /* keep the literal path */
+            }
+            try {
+              realBase = realpathSync(baseDir);
+            } catch {
+              /* keep the literal path */
+            }
+            if (!under(srcCwd, realRoot)) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer: "the terminal session's directory is outside this project's repository",
+              });
+              return;
+            }
+            if (under(srcCwd, realBase)) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  "that directory is one of the daemon's own worktrees — its session is already a tab, not something to adopt",
+              });
+              return;
+            }
+            try {
+              srcHead = git(['rev-parse', 'HEAD'], srcCwd);
+            } catch {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  "the terminal session's directory is not a usable git checkout (no HEAD to branch from)",
+              });
+              return;
+            }
+            // Liveness by the SESSION's own runtime: Claude has a real pid
+            // registry; agy only leaves store-write recency + a process check,
+            // and adoption there is a MOVE (no fork exists), so the composite
+            // errs toward refusing — a false "live" costs a retry in minutes,
+            // a false "ended" puts two drivers on one conversation store.
+            const adoptLive =
+              job.runtime === 'antigravity'
+                ? isAgyConversationLive(job.adopt.id)
+                : isTerminalSessionLive(job.adopt.id);
+            if (adoptLive) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'That terminal session is still open on the machine — close it there first, then adopt.',
+              });
+              return;
+            }
+            adoptSrc = srcCwd;
+          }
+          // Based at the SOURCE's HEAD when adopting — the resumed
+          // conversation was had against those commits, not the project base.
+          const dir = sessionWtFor(job.sessionId, adopting ? srcHead : undefined);
           if (!dir) {
             await settleWorkTurn(job.id, {
               ok: false,
@@ -414,7 +725,20 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             );
             return;
           }
-          const rt = sessionRuntime(dir.wt);
+          // WHICH BRAIN the roster says this tab speaks (null/absent = Claude,
+          // which is what every tab ran on until now) — honored by
+          // sessionRuntime: on a first turn a named runtime IS the pick, and a
+          // named runtime that disagrees with the pin settles below.
+          const rt = sessionRuntime(dir.wt, job.runtime || null);
+          if (rt.mismatch) {
+            // Something upstream changed this tab's identity mid-life. A held
+            // context must never be answered by a different brain — say so.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: `this tab is pinned to ${rt.mismatch.pin} but the server says it is a ${rt.mismatch.runtime} tab — reopen a new tab`,
+            });
+            return;
+          }
           if (rt.missing) {
             await settleWorkTurn(job.id, {
               ok: false,
@@ -422,58 +746,173 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             });
             return;
           }
-          if (!rt.id) {
+          if (rt.unsupported) {
+            // A pin from before the session-capable gate existed — or a
+            // first-turn tab the server named for one — can carry a runtime no
+            // tab can run on (Antigravity has no MCP config, and the session's
+            // whole control plane rides one). An honest sentence beats the
+            // mcpFor throw this used to crash into every turn.
             await settleWorkTurn(job.id, {
               ok: false,
-              answer:
-                'No coding CLI is installed on the machine — install Claude Code (or another supported CLI), then send the message again',
+              answer: `this session runs on ${rt.unsupported}, which cannot drive a Workbench tab on this machine — open a new tab`,
             });
             return;
           }
-          let mint = await mintWorkToken(job.sessionId);
-          if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
-          if (mint?.gone) {
+          if (!rt.id) {
             await settleWorkTurn(job.id, {
               ok: false,
               answer:
-                'Flowviant no longer offers this session to this machine — the tab may have been closed or moved',
+                'No coding CLI is installed on the machine — install Claude Code (or another supported CLI), then send the message again',
             });
             return;
           }
-          if (!mint?.token) {
+          if (adopting && rt.id !== 'claude' && rt.id !== 'antigravity') {
+            // An adopt id names a conversation in ITS OWN CLI's store: claude
+            // forks it (--resume --fork-session), agy moves it
+            // (--conversation). Codex has no adoptable store yet, and its
+            // args builder backstops this with a loud throw — but a sentence
+            // here beats a stack there.
             await settleWorkTurn(job.id, {
               ok: false,
               answer:
-                'the machine could not mint a session credential from Flowviant — check its connection, then send the message again',
+                'adopting this terminal session needs its own CLI on the machine — install it, then try again',
             });
             return;
           }
-          // Resume iff a conversation is known to live in THIS directory: the
-          // server's sessionRef is only ever a path some turn actually SPOKE
-          // from (see the settle below), and it must match the directory we
-          // just opened. Anything else starts fresh IN the existing worktree —
-          // never a reset; the dirty state is the session.
-          const resume = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
-          const mcp = mcpFor(rt.id, mint.token, getMcpUrl());
+          // A PLAIN tab (agy) mounts no MCP: no credential to mint, no config
+          // to write. The trade is stated in SYSTEM_WORK_PLAIN — no cards, no
+          // streaming — and the honesty survives on the existing rails: the
+          // answer lands via work-turn-done, the rail says "no card yet", and
+          // ship-time reconciliation books every branch commit.
+          const plainTab = rt.id === 'antigravity';
+          let mint = null;
+          if (!plainTab) {
+            mint = await mintWorkToken(job.sessionId);
+            if (!mint) mint = await mintWorkToken(job.sessionId, true); // one transient blip ≠ a dead turn
+            if (mint?.gone) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'Flowviant no longer offers this session to this machine — the tab may have been closed or moved',
+              });
+              return;
+            }
+            if (!mint?.token) {
+              await settleWorkTurn(job.id, {
+                ok: false,
+                answer:
+                  'the machine could not mint a session credential from Flowviant — check its connection, then send the message again',
+              });
+              return;
+            }
+          }
+          // CODEX RESUMES BY THREAD ID, never by `--last`: `resume --last` is
+          // the MACHINE's most recent codex conversation, and two codex tabs —
+          // or a tab plus a codex dispatch — would cross-resume each other's
+          // context. The id was captured off thread.started (runtimes.mjs) and
+          // persisted below, beside the runtime pin; absent, the turn runs
+          // FRESH in the same worktree — the dirty state is most of the held
+          // context, and a machine-global guess is someone else's conversation.
+          let codexResumeId = null;
+          if (rt.id === 'codex') {
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            if (threadMarker && existsSync(threadMarker)) {
+              try {
+                const v = readFileSync(threadMarker, 'utf8').trim();
+                if (CODEX_THREAD_RE.test(v)) codexResumeId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
+          }
+          // AGY RESUMES BY CONVERSATION ID, learned once and pinned beside the
+          // runtime marker: an adopted tab knows it from the adopt hint; a new
+          // tab learns it from agy's own cwd registry after its first turn.
+          // The marker beats `--continue` because it is the tab's OWN identity
+          // — the registry maps a cwd to whatever ran there LAST, and a
+          // dispatch sharing the machine could overwrite that between turns.
+          let agyConvId = null;
+          if (rt.id === 'antigravity' && !adopting) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            if (convMarker && existsSync(convMarker)) {
+              try {
+                const v = readFileSync(convMarker, 'utf8').trim();
+                if (AGY_CONV_RE.test(v)) agyConvId = v;
+              } catch {
+                /* unreadable marker — run fresh */
+              }
+            }
+          }
+          // Resume iff a conversation is known to live in THIS directory. For
+          // Claude that proof is the server's sessionRef — only ever a path
+          // some turn actually SPOKE from (see the settle below), and it must
+          // match the directory we just opened. For codex it is the stored
+          // thread id, which lives IN the directory and is stronger. Anything
+          // else starts fresh IN the existing worktree — never a reset; the
+          // dirty state is the session.
+          // agy layers its two resumes: the pinned conversation id when the
+          // marker exists (deterministic, registry-proof), else the Claude
+          // rule — a tab that has SPOKEN from this directory may `--continue`
+          // it (cwd-keyed; measured safe), so a lost marker degrades to the
+          // weaker resume instead of silently starting over.
+          const spokeHere = !dir.fresh && Boolean(job.sessionRef) && job.sessionRef === dir.wt;
+          const resume =
+            rt.id === 'codex'
+              ? Boolean(codexResumeId)
+              : rt.id === 'antigravity'
+                ? Boolean(agyConvId) || spokeHere
+                : spokeHere;
+          // The dirty carry, on the adopt worktree's FIRST life only: a
+          // re-attempted adoption (the directory already exists) carried what
+          // it could the first time, and re-applying would double it. A carry
+          // problem never fails the adoption — it becomes one bracketed line
+          // in the prompt, so the AGENT tells the user what stayed behind.
+          let carryNote = '';
+          if (adopting && dir.fresh && adoptSrc) carryNote = carryDirtyState(adoptSrc, dir.wt);
+          const mcp = plainTab
+            ? { args: [], env: null, dir: null }
+            : mcpFor(rt.id, mint.token, getMcpUrl());
           // Attempts count RUNS: the infra refusals above consumed nothing and
           // settled on their own terms.
           workAttempts.set(job.id, tries + 1);
           let out;
+          let seenThreadId = null; // codex's conversation id, off thread.started
           const spawned = []; // this turn's children, for the teardown registry
           try {
+            const message = carryNote ? `${job.body}\n\n${carryNote}` : job.body;
             const turnArgs = {
-              prompt: WORK_TURN_KICKOFF({
-                sessionId: job.sessionId,
-                sessionName: job.sessionName,
-                message: job.body,
-                askedByName: job.askedByName,
-              }),
-              system: SYSTEM_WORK,
+              // A plain tab has no tools to name and no session id to pass —
+              // its kickoff asks for one complete report instead of a stream.
+              prompt: plainTab
+                ? WORK_TURN_KICKOFF_PLAIN({
+                    sessionName: job.sessionName,
+                    message,
+                    askedByName: job.askedByName,
+                  })
+                : WORK_TURN_KICKOFF({
+                    sessionId: job.sessionId,
+                    sessionName: job.sessionName,
+                    message,
+                    askedByName: job.askedByName,
+                  }),
+              // The adopt turn resumes the TERMINAL conversation by forking it
+              // into this cwd (claude: --resume <id> --fork-session). After it
+              // speaks once, the fork lives natively here and turn 2+ is the
+              // ordinary --continue resume path, unchanged.
+              ...(adopting ? { adoptResumeId: job.adopt.id } : {}),
+              system: plainTab ? SYSTEM_WORK_PLAIN : SYSTEM_WORK,
               cwd: dir.wt,
               mcpArgs: mcp.args,
               mcpEnv: mcp.env,
               runtime: rt.id,
               label: c.cyan('[tab]'),
+              // Only codex announces one (thread.started); held here so the id
+              // this turn actually SPOKE under is what gets persisted after it
+              // ends. Last write wins on purpose: a failed resume that fell
+              // back to fresh reports the fresh run's id, healing the marker.
+              onThreadId: (id) => {
+                seenThreadId = String(id ?? '').trim() || seenThreadId;
+              },
               onSpawn: (ch) => {
                 if (!ch) return;
                 spawned.push(ch);
@@ -487,12 +926,25 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
                 }
               },
             };
-            out = await runTurn({ ...turnArgs, resume });
+            out = await runTurn({
+              ...turnArgs,
+              resume,
+              resumeThreadId: codexResumeId || undefined,
+              resumeConversationId: agyConvId || undefined,
+            });
             // A resume that produced NOTHING usually means the held
             // conversation is gone (a first turn that crashed before writing
-            // state, a wiped CLI dir). Retry once fresh in the SAME worktree —
-            // never reset — instead of bricking the tab forever.
-            if (resume && !(out || '').trim()) out = await runTurn({ ...turnArgs, resume: false });
+            // state, a wiped CLI dir — or, on codex, a deleted thread). Retry
+            // once fresh in the SAME worktree — never reset — instead of
+            // bricking the tab forever; the retry carries no resumeThreadId,
+            // so codex genuinely starts over rather than re-asking for the
+            // thread that just came back empty. NEVER on an adopt turn
+            // (`resume` is structurally false there, and the guard says so out
+            // loud): a fresh conversation would silently discard the adoption
+            // and answer as a new session wearing its name — the empty adopt
+            // turn settles failed below instead.
+            if (!adopting && resume && !(out || '').trim())
+              out = await runTurn({ ...turnArgs, resume: false });
           } finally {
             for (const ch of spawned) workChildren.delete(ch);
             if (lockPath) {
@@ -504,11 +956,56 @@ export function createWorkManager({ repoRoot, baseDir, baseRef, getMcpUrl, getLe
             }
             if (mcp.dir) rmSync(mcp.dir, { recursive: true, force: true });
           }
+          // Persist the codex thread id AFTER the turn ends, so the next turn
+          // resumes exactly the conversation that just spoke. Shape-guarded
+          // before it ever touches disk — it later rides in argv as
+          // `resume <id>` — and best-effort, like the runtime pin: an
+          // unwritable marker just means the tab runs fresh next turn.
+          if (rt.id === 'codex' && seenThreadId && CODEX_THREAD_RE.test(seenThreadId)) {
+            const threadMarker = sessionMetaPath(dir.wt, 'flowviant-codex-thread');
+            if (threadMarker) {
+              try {
+                writeFileSync(threadMarker, seenThreadId);
+              } catch {
+                /* best-effort */
+              }
+            }
+          }
           const answer = (out || '').trim();
           // No output at all smells like a dead MCP credential (the lane
           // workers' no-sentinel case) — drop the cached token so the next
           // turn re-mints instead of failing the same way forever.
           if (!answer) workTokens.delete(job.sessionId);
+          if (adopting && !answer) {
+            // The fork came back with nothing — the terminal session's
+            // transcript is most likely gone (cleaned, expired, deleted). Say
+            // exactly that; no sessionRef is recorded, so the server keeps
+            // offering the adoption and a retry after the user checks is cheap.
+            await settleWorkTurn(job.id, {
+              ok: false,
+              answer: "Couldn't resume the terminal session — it may have been removed.",
+            });
+            warn('adopt turn produced no output — settled as failed');
+            return;
+          }
+          // Persist the agy conversation id once the turn actually SPOKE — an
+          // adopted tab pins the id it moved in (the adopt hint); a new tab
+          // learns the one its first fresh turn just created, from agy's own
+          // cwd registry. From here on the marker is the tab's identity and
+          // the registry is never trusted again.
+          if (rt.id === 'antigravity' && answer.length > 0) {
+            const convMarker = sessionMetaPath(dir.wt, 'flowviant-agy-conversation');
+            if (convMarker && !existsSync(convMarker)) {
+              const learned = adopting ? job.adopt.id : agyRegistryLookup(dir.wt);
+              if (learned && AGY_CONV_RE.test(learned)) {
+                try {
+                  writeFileSync(convMarker, learned);
+                } catch {
+                  /* best-effort — an unpinned tab resumes via --continue's cwd key */
+                }
+              }
+            }
+          }
           await settleWorkTurn(job.id, {
             ok: answer.length > 0,
             answer: