ompchamber 3.3.3 → 3.5.0

package/src/server/lib/btw/service.server.ts

@@ -12,32 +12,32 @@
  *    cancel — a second question is refused, exactly like the TUI);
  *  - a new question is its own topic; only a follow-up continues one, and it
  *    sees only that topic's turns (plus the parent's context);
+ *  - the side conversation runs on the CHAT's model and thinking selector, read
+ *    from the parent transcript at every ask — the panel has no pickers of its
+ *    own, exactly like omp's `/btw`, which runs the side turn on
+ *    `request.session.model`;
  *  - promotion is refused once the parent transcript has moved past the point
- *    the topic was snapshotted at, and while a turn is still running.
+ *    the topic was snapshotted at, while a turn is still running, and for a
+ *    topic with follow-ups (a branch carries one question/answer pair).
  */
 
 import { isMockMode } from '@/server/mock.server';
 import { findSessionFileById } from '@/server/lib/omp/session/locator';
 import { readRawHeaderLine } from '@/server/lib/omp/session/files';
-import { loadSessionModel } from '@/server/lib/omp/session/messages';
-import { resolveSpawnCwd } from '@/server/lib/omp/rpc/manager';
-import { loadPersistedAccessMode } from '@/shared/lib/omp/config/access-mode.server';
-import type { ApprovalMode } from '@/shared/lib/omp/config/access-mode';
+import { loadSessionModel, loadSessionThinkingSelector } from '@/server/lib/omp/session/messages';
+import { getRpcSession, resolveSpawnCwd } from '@/server/lib/omp/rpc/manager';
 import { composeMessageWithTextAttachments, type AttachedTextFileData } from '@/shared/lib/chat/attachments';
 import {
   createBtwTopic,
   deleteBtwTopic,
   getBtwTopic,
   readBtwTopicLeaf,
-  setBtwTopicApprovalMode,
-  setBtwTopicModel,
   setBtwTopicPromoted,
-  setBtwTopicThinkingLevel,
 } from '@/server/lib/btw/store.server';
 import { promoteBtwTopic as materializePromotedTopic, readTranscriptLeaf, removeBtwWorkspace, resolveBtwWorkspacePaths } from '@/server/lib/btw/session-copy.server';
 import { btwStateFor, ensureBtwRuntime, findRunningBtwRuntime, forgetBtwRuntime, getBtwRuntime, publishBtwState } from '@/server/lib/btw/registry.server';
 import { BtwError, type BtwImages } from '@/server/lib/btw/runtime.server';
-import type { BtwModel, BtwState } from '@/shared/types';
+import type { BtwState } from '@/shared/types';
 
 /** Longest a topic label may be, matching the sidebar's session-title length. */
 const TOPIC_TITLE_CHARS = 60;
@@ -93,15 +93,6 @@ export interface AskBtwInput {
    * be asked about a file the same way a chat turn can.
    */
   textFiles?: AttachedTextFileData[];
-  /**
-   * Composer picks for the FIRST question of a topic, which has no row to write
-   * them to yet. Later questions address an existing topic and are re-targeted
-   * through the dedicated `set_model` / `set_thinking_level` / `set_access_mode`
-   * actions instead.
-   */
-  model?: BtwModel;
-  thinkingLevel?: string;
-  approvalMode?: ApprovalMode;
 }
 
 export async function askBtw(sessionId: string, input: AskBtwInput): Promise<BtwState> {
@@ -119,15 +110,18 @@ export async function askBtw(sessionId: string, input: AskBtwInput): Promise<Btw
     throw new BtwError('Unknown side question.', 'btw_topic_not_found');
   }
 
-  const approvalMode = input.approvalMode ?? (await loadPersistedAccessMode());
+  // The side conversation mirrors the chat: model and thinking selector are read
+  // from the parent transcript at every ask, so a change made in the chat reaches
+  // the next side question (omp reads `request.session.model` the same way).
+  const model = await topicModel(parent.sessionFile);
+  const thinkingLevel = await loadSessionThinkingSelector(parent.sessionFile);
   const topic =
     existing ??
     (await createBtwTopic({
       sessionId,
       title: topicTitle(question),
-      model: input.model ?? (await topicModel(parent.sessionFile)),
-      thinkingLevel: input.thinkingLevel,
-      approvalMode,
+      model,
+      thinkingLevel,
     }));
 
   const runtime = ensureBtwRuntime({
@@ -135,68 +129,17 @@ export async function askBtw(sessionId: string, input: AskBtwInput): Promise<Btw
     sessionId,
     parentSessionFile: parent.sessionFile,
     cwd: parent.cwd,
-    model: topic.model,
-    thinkingLevel: topic.thinkingLevel,
-    // The topic's own mode wins once set; a fresh topic adopts the composer's.
-    approvalMode: topic.approvalMode ?? approvalMode,
+    model,
+    thinkingLevel,
   });
 
+  // A live child keeps the model it was spawned with; re-target it before the
+  // prompt so this question runs on what the chat is on NOW.
+  await runtime.retarget(model, thinkingLevel);
   await runtime.ask(composeMessageWithTextAttachments(question, input.textFiles ?? []), input.images);
   return btwStateFor(sessionId);
 }
 
-/** One topic of this session, or a `btw_topic_not_found` refusal. */
-async function requireTopic(sessionId: string, topicId: string) {
-  const topic = await getBtwTopic(topicId);
-  if (!topic || topic.sessionId !== sessionId) throw new BtwError('Unknown side question.', 'btw_topic_not_found');
-  return topic;
-}
-
-/**
- * Re-target a topic's model. With a live child the change reaches it through
- * `set_model` (omp applies it to the running turn, which is what the dropdown
- * promises); an idle topic simply records it for the next spawn.
- */
-export async function setBtwModel(sessionId: string, topicId: string, provider: string, modelId: string): Promise<BtwState> {
-  await requireTopic(sessionId, topicId);
-  const runtime = getBtwRuntime(topicId);
-  if (runtime) {
-    await runtime.setModel(provider, modelId);
-  } else {
-    await setBtwTopicModel(topicId, { provider, id: modelId });
-    await publishBtwState(sessionId);
-  }
-  return btwStateFor(sessionId);
-}
-
-export async function setBtwThinkingLevel(sessionId: string, topicId: string, level: string): Promise<BtwState> {
-  await requireTopic(sessionId, topicId);
-  await setBtwTopicThinkingLevel(topicId, level === 'auto' ? null : level);
-  await getBtwRuntime(topicId)?.setThinkingLevel(level);
-  await publishBtwState(sessionId);
-  return btwStateFor(sessionId);
-}
-
-/**
- * Adopt a new tool-approval mode for a topic. omp has no RPC for it, so an idle
- * child is dropped and the next question respawns with the new flag; a running
- * turn keeps its child (and therefore its mode) until it settles.
- */
-export async function setBtwApprovalMode(sessionId: string, topicId: string, mode: ApprovalMode): Promise<BtwState> {
-  await requireTopic(sessionId, topicId);
-  await setBtwTopicApprovalMode(topicId, mode);
-  await getBtwRuntime(topicId)?.setApprovalMode(mode);
-  await publishBtwState(sessionId);
-  return btwStateFor(sessionId);
-}
-
-/** Answer an ask/approval dialog a side child is blocked on. */
-export async function respondBtwDialog(sessionId: string, topicId: string, id: string, response: Record<string, unknown>): Promise<BtwState> {
-  await requireTopic(sessionId, topicId);
-  getBtwRuntime(topicId)?.respondToDialog(id, response);
-  return btwStateFor(sessionId);
-}
-
 /** The parent's model, so the side conversation runs on the visible model. */
 async function topicModel(sessionFile: string) {
   const model = await loadSessionModel(sessionFile);
@@ -210,6 +153,19 @@ export async function abortBtw(sessionId: string, topicId: string): Promise<BtwS
   return btwStateFor(sessionId);
 }
 
+/**
+ * Refuse a session operation that would move the conversation out from under a
+ * running side question. omp blocks the same operations while a `/btw` answer is
+ * in flight or unsaved (`BtwController.withSessionMove` / `flush`); a chamber
+ * chat that switched sessions mid-question would leave the answer attached to a
+ * transcript nobody is looking at.
+ */
+export async function assertBtwIdle(sessionId: string, action: string): Promise<void> {
+  if (findRunningBtwRuntime(sessionId)) {
+    throw new BtwError(`A side question is still running — wait for it, or cancel it, before you ${action}.`, 'btw_busy');
+  }
+}
+
 /**
  * Turn the topic into a session of the chat's own: a branch of the parent
  * conversation whose tip is the side answer, opened by the caller.
@@ -225,8 +181,21 @@ export async function promoteBtw(sessionId: string, topicId: string): Promise<{
   if (topic.turns.some((turn) => turn.status === 'running')) {
     throw new BtwError('Wait for the side answer to finish, or cancel it, before promoting it.', 'btw_busy');
   }
+  // omp's branch action carries ONE question/answer pair and refuses a topic with
+  // follow-ups, so the earlier turns cannot be silently dropped from the branch.
+  if (topic.turns.length > 1) {
+    throw new BtwError(
+      'A side question with follow-ups cannot be promoted — omp branches one answer at a time.',
+      'btw_multi_turn',
+    );
+  }
 
   const parent = await resolveParent(sessionId);
+  // The branch is cut from the parent's transcript, so the chat must be idle:
+  // omp's guard refuses while `session.isStreaming`.
+  if (getRpcSession(sessionId)?.isRunning()) {
+    throw new BtwError('The chat is still running — wait for it to finish before promoting a side question.', 'btw_busy');
+  }
   const snapshotLeaf = await readBtwTopicLeaf(topicId);
   if (snapshotLeaf) {
     const currentLeaf = await readTranscriptLeaf(parent.sessionFile);

package/src/server/lib/btw/store.server.ts

@@ -15,10 +15,14 @@
  * `leaf_id` is the parent session's transcript leaf when the topic started.
  * Promotion refuses when the parent has moved on, exactly like omp's own
  * `/btw` branch guard ("session changed since /btw started").
+ *
+ * `thinking_level` holds the chat's thinking SELECTOR (`auto` included), not the
+ * effort the side child resolved; `approval_mode` is no longer written — a side
+ * child runs `--no-tools`, so there is no approval gate to configure. Both
+ * columns stay in the schema for existing rows.
  */
 
 import { getDb } from '@/server/db.server';
-import { isApprovalMode, type ApprovalMode } from '@/shared/lib/omp/config/access-mode';
 import type { BtwModel, BtwTopic, BtwTurn, BtwTurnStatus, ChatMessageData } from '@/shared/types';
 
 interface TopicRow {
@@ -51,7 +55,7 @@ const TURN_STATUSES: Record<string, true> = {
   running: true,
   complete: true,
   cancelled: true,
-  failed: true,
+  error: true,
   interrupted: true,
 };
 
@@ -72,7 +76,6 @@ function rowToTopic(row: TopicRow): BtwTopic {
     updatedAt: row.updated_at,
     ...(model ? { model } : {}),
     ...(row.thinking_level ? { thinkingLevel: row.thinking_level } : {}),
-    ...(isApprovalMode(row.approval_mode) ? { approvalMode: row.approval_mode } : {}),
     ...(row.promoted_session_id ? { promotedSessionId: row.promoted_session_id } : {}),
     turns: [],
   };
@@ -138,10 +141,8 @@ export interface NewBtwTopicInput {
   sessionId: string;
   title: string;
   model?: BtwModel;
+  /** The chat's thinking selector, so the side child classifies like the chat. */
   thinkingLevel?: string;
-  approvalMode?: ApprovalMode;
-  /** Parent transcript leaf when the topic was created (promotion guard). */
-  leafId?: string | null;
 }
 
 export async function createBtwTopic(input: NewBtwTopicInput): Promise<BtwTopic> {
@@ -155,8 +156,8 @@ export async function createBtwTopic(input: NewBtwTopicInput): Promise<BtwTopic>
     model_id: input.model?.id ?? null,
     model_name: input.model?.name ?? null,
     thinking_level: input.thinkingLevel ?? null,
-    approval_mode: input.approvalMode ?? null,
-    leaf_id: input.leafId ?? null,
+    approval_mode: null,
+    leaf_id: null,
     promoted_session_id: null,
     created_at: now,
     updated_at: now,
@@ -262,18 +263,6 @@ export async function setBtwTopicModel(topicId: string, model: BtwModel): Promis
   ]);
 }
 
-/** Record the thinking level the side child runs at (`null` clears it). */
-export async function setBtwTopicThinkingLevel(topicId: string, level: string | null): Promise<void> {
-  const db = await getDb();
-  await db.run('UPDATE btw_topics SET thinking_level = ?, updated_at = ? WHERE id = ?', [level, Date.now(), topicId]);
-}
-
-/** Record the approval mode the side child was spawned with. */
-export async function setBtwTopicApprovalMode(topicId: string, mode: ApprovalMode): Promise<void> {
-  const db = await getDb();
-  await db.run('UPDATE btw_topics SET approval_mode = ?, updated_at = ? WHERE id = ?', [mode, Date.now(), topicId]);
-}
-
 export async function setBtwTopicPromoted(topicId: string, promotedSessionId: string): Promise<void> {
   const db = await getDb();
   await db.run('UPDATE btw_topics SET promoted_session_id = ?, updated_at = ? WHERE id = ?', [

package/src/server/lib/fs/path-segment.test.ts

@@ -0,0 +1,100 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The session-delete blast radius.
+ *
+ * `DELETE /api/sessions/:sessionId` removes a directory under the sessions root
+ * and another under the btw root, both by joining the id onto the root. The
+ * case that shipped broken was `.`: `join(root, '.')` is `root` itself, so the
+ * btw purge's unconditional workspace removal deleted EVERY session's side
+ * questions and the route still answered 404 — an invisible, root-wide wipe
+ * from a request that looked like a miss.
+ *
+ * These tests pin the two properties that made it possible: the guard rejects
+ * every value that is not one segment, and the btw purge refuses a non-segment
+ * even when called directly (the route is not the only entry point).
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import fs from 'fs';
+import path from 'path';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+import { purgeBtwForSession } from '@/server/lib/btw/purge.server';
+
+describe('isSinglePathSegment', () => {
+  test('accepts the id shapes the app actually produces', () => {
+    // omp session ids are UUIDs; mock ids are integers; pending chats are `new-…`.
+    expect(isSinglePathSegment('11111111-2222-3333-4444-555555555555')).toBe(true);
+    expect(isSinglePathSegment('3')).toBe(true);
+    expect(isSinglePathSegment('new-1758800000000')).toBe(true);
+    // A dot INSIDE a name is fine — only a name that resolves to a directory is not.
+    expect(isSinglePathSegment('session.v2')).toBe(true);
+  });
+
+  test('refuses the values that resolve somewhere other than one child', () => {
+    // The shipped bug: join(root, '.') === root.
+    expect(isSinglePathSegment('.')).toBe(false);
+    expect(isSinglePathSegment('..')).toBe(false);
+    expect(isSinglePathSegment('a/b')).toBe(false);
+    expect(isSinglePathSegment('..\\a')).toBe(false);
+    expect(isSinglePathSegment('')).toBe(false);
+    // A NUL byte truncates at the syscall boundary.
+    expect(isSinglePathSegment('a\0b')).toBe(false);
+  });
+
+  test('the guard agrees with the join it is guarding', () => {
+    // The property that matters: whenever the guard says yes, joining onto a
+    // root stays directly inside it. Asserted against `path.join` itself rather
+    // than a restatement of the rule.
+    const root = '/tmp/root';
+    for (const id of ['11111111-2222-3333-4444-555555555555', '3', 'new-1', 'session.v2']) {
+      expect(isSinglePathSegment(id)).toBe(true);
+      expect(path.join(root, id).startsWith(`${root}${path.sep}`)).toBe(true);
+      expect(path.dirname(path.join(root, id))).toBe(root);
+    }
+    for (const id of ['.', '..', 'a/b', '../x']) {
+      expect(isSinglePathSegment(id)).toBe(false);
+    }
+  });
+});
+
+describe('purgeBtwForSession refuses a non-segment id', () => {
+  const root = '/tmp/omc-path-segment-test';
+  const btwRoot = path.join(root, 'btw');
+  const seeded = [
+    path.join(btwRoot, 'sessA', 'topicA', 'session.jsonl'),
+    path.join(btwRoot, 'sessB', 'topicB', 'session.jsonl'),
+  ];
+
+  beforeAll(async () => {
+    await fs.promises.rm(root, { recursive: true, force: true });
+    // Two unrelated sessions' side questions, exactly as the bug destroyed them.
+    // The btw root is derived from the database path, so pointing that at this
+    // tree is what puts them where the purge would look.
+    for (const file of seeded) {
+      await fs.promises.mkdir(path.dirname(file), { recursive: true });
+      await Bun.write(file, '{"type":"session"}\n');
+    }
+    Bun.env.OMPCHAMBER_DB_PATH = path.join(root, 'db.sqlite');
+  });
+
+  afterAll(async () => {
+    delete Bun.env.OMPCHAMBER_DB_PATH;
+    await fs.promises.rm(root, { recursive: true, force: true });
+  });
+
+  test('`.` does not remove the btw root', async () => {
+    // The guard returns before `listBtwTopics`, so no database is touched.
+    expect(await purgeBtwForSession('.')).toBe(0);
+    // Both sessions' transcripts must survive — this is the regression.
+    for (const file of seeded) expect(fs.existsSync(file)).toBe(true);
+  });
+
+  test('a separator does not reach outside the root', async () => {
+    expect(await purgeBtwForSession('../btw')).toBe(0);
+    for (const file of seeded) expect(fs.existsSync(file)).toBe(true);
+  });
+});

package/src/server/lib/fs/path-segment.ts

@@ -0,0 +1,45 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * One rule, two callers: does this id name exactly one child of a root?
+ *
+ * The purge paths join a session id onto a root to find the directory it owns —
+ * `join(sessionsRoot, …)`, `join(btwRoot, sessionId)` — and then remove it
+ * recursively. `path.join` NORMALIZES, so a value that is not a plain segment
+ * silently retargets the removal:
+ *
+ *   join(root, '.')  === root          → deletes every child of the root
+ *   join(root, '..') === dirname(root) → deletes outside the root
+ *   join(root, 'a/b')                  → reaches into a sibling subtree
+ *
+ * Measured: `DELETE /api/sessions/.` (curl needs `--path-as-is`; it strips the
+ * trailing dot itself) passed a `/^[A-Za-z0-9._-]+$/` guard, normalized to the
+ * btw root, and removed two unrelated sessions' side-question transcripts.
+ *
+ * The check is deliberately structural rather than an enumeration of dangerous
+ * spellings: an id is safe exactly when it is one non-dot segment. Real ids
+ * satisfy that by construction — omp session ids are UUIDs and mock ids are
+ * integers — so nothing legitimate is refused.
+ *
+ * `normalize` is compared, not just scanned for separators, because it is the
+ * same operation the callers' `join` performs: asserting the two agree is what
+ * makes this a proof about the path that will actually be built, rather than a
+ * guess about which inputs look suspicious.
+ */
+
+import { normalize } from 'node:path';
+
+/** True when `id` names one child of a root, and nothing else. */
+export function isSinglePathSegment(id: string): boolean {
+  if (id.length === 0) return false;
+  if (id === '.' || id === '..') return false;
+  if (id.includes('/') || id.includes('\\')) return false;
+  // A NUL byte would truncate the path at the syscall boundary.
+  if (id.includes('\0')) return false;
+  // The load-bearing assertion: normalization must be a no-op, so `join(root, id)`
+  // cannot resolve anywhere but directly under `root`.
+  return normalize(id) === id;
+}

package/src/server/lib/omp/rpc/constants.ts

@@ -134,6 +134,16 @@ export const PASSTHROUGH_COMMANDS = new Set([
 // whose liveness probe had just reported `running: false`).
 export const OBSERVER_ONLY_COMMANDS = new Set(['get_subagents', 'get_subagent_messages']);
 
+/**
+ * Commands that MOVE the conversation: they replace the transcript the session
+ * is running on, so a side question that snapshotted the old one would be left
+ * describing a conversation the chat has already left. omp blocks the same
+ * operations while a `/btw` answer is in flight or unsaved
+ * (`BtwController.withSessionMove` / `flush`); the chamber refuses them with
+ * `btw_busy` (409) instead.
+ */
+export const CONVERSATION_MOVING_COMMANDS = new Set(['switch_session', 'branch', 'new_session', 'handoff']);
+
 // Commands that can carry user-attached images to the model. All of them must
 // pass the same server-side per-image/count/aggregate validation before the
 // payload reaches omp — a client is free to POST any of them directly.

package/src/server/lib/omp/rpc/session-commands.ts

@@ -15,6 +15,7 @@ import { clearSessionFileCaches } from '@/server/lib/omp/session/files';
 import { scheduleQueueDelivery } from '@/server/lib/queue/delivery.server';
 import { clearStreamStatus, markStreamStatus } from '@/shared/lib/omp/session/stream-state.server';
 import { buildWebState, type WebStateHost } from '@/server/lib/omp/rpc/web-state';
+import { isTuiOnlySlashCommand, tuiOnlyCommandNotice } from '@/shared/lib/chat/composer/tui-only';
 
 /** Runtime surface AgentSessionWrapper exposes to the command dispatcher. */
 export interface SessionCommandHost extends WebStateHost {
@@ -50,6 +51,44 @@ async function settleCommandTimeout(host: SessionCommandHost): Promise<never> {
   throw new WebRpcError('The OMP session stopped responding and was reset.', 'session_unresponsive');
 }
 
+/**
+ * Refuse a prompt that invokes a command omp implements only in its TUI, and
+ * report it the way omp reports a real command result.
+ *
+ * This is the SERVER half of the guard in
+ * `client/hooks/chat/timeline/tui-only-guard.ts`. It exists because one prompt
+ * path never passes through the composer: the follow-up queue's auto-delivery
+ * calls `session.send({ type: 'prompt' })` directly from
+ * `lib/queue/delivery.server.ts`. A `/plan` queued before a run would otherwise
+ * be delivered to the model as literal text once the run ends.
+ *
+ * The refusal is framed as a real command result — a `command_output` notice
+ * plus, for a non-streaming prompt, the `agentInvoked:false` ack — so the
+ * client's existing fold renders the notice and settles the optimistic spinner
+ * with no new protocol.
+ *
+ * `streaming` is the caller's own knowledge of whether a turn is running: a
+ * steer of a refused command must not clear the flags of the turn it was aimed
+ * at (omp runs `session.steer()` with no slash handling at all, so a steer of
+ * `/plan` is exactly as meaningless as a fresh one).
+ *
+ * Returns true when the prompt was refused (the caller must not dispatch).
+ */
+function refuseTuiOnlyPrompt(host: SessionCommandHost, message: unknown, streaming: boolean): boolean {
+  if (typeof message !== 'string' || !isTuiOnlySlashCommand(message)) return false;
+  host.emit({ type: 'command_output', text: tuiOnlyCommandNotice(message) });
+  if (!streaming) {
+    host.promptRunning = false;
+    host.awaitingAgentStart = false;
+    host.awaitingAgentStartDeadline = 0;
+    host.emit({ type: 'prompt_result', agentInvoked: false });
+    // Nothing ran, so the queue may hold the next item — give it the same
+    // delivery window a real consumed builtin or a run end would.
+    scheduleQueueDelivery(host);
+  }
+  return true;
+}
+
 export async function dispatchSessionCommand(host: SessionCommandHost, command: Record<string, unknown>): Promise<unknown> {
   if (host.restarting) throw new WebRpcError(RESTARTING_MESSAGE, 'session_restarting');
   if (!host.isAlive()) throw new Error('Session is no longer running');
@@ -66,6 +105,11 @@ export async function dispatchSessionCommand(host: SessionCommandHost, command:
       if (host.bashRunning) {
         throw new Error('Cannot send a prompt while a shell command is running');
       }
+      // Checked before the streaming-behavior split: a steer of a TUI-only
+      // command is just as meaningless as a fresh one. `streaming` keeps the
+      // refusal from clearing a running turn's flags when the prompt was a
+      // steer aimed at that turn.
+      if (refuseTuiOnlyPrompt(host, command.message, Boolean(command.streamingBehavior))) return null;
       const streamingBehavior = command.streamingBehavior as 'steer' | 'followUp' | undefined;
       // The live `stream` row starts with the DISPATCH, not with agent_start:
       // the spawn/ack round trip that precedes agent_start must not read as
@@ -229,6 +273,7 @@ export async function dispatchSessionCommand(host: SessionCommandHost, command:
       if (!host.isRunning()) {
         throw new WebRpcError('The session is idle — start a prompt first.', 'session_idle');
       }
+      if (refuseTuiOnlyPrompt(host, command.message, true)) return null;
       await host.proc.sendCommand({
         type,
         message: command.message as string,

package/src/server/lib/omp/session/delete.server.ts

@@ -0,0 +1,136 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Deleting a session: the transcript on disk, its subagent artifacts, and every
+ * chamber-side row keyed to the session id.
+ *
+ * The transcript is authoritative — omp's own session listing is derived from
+ * the JSONL alone — so a delete that removed only the chamber's rows would see
+ * the session come straight back on the next sidebar scan. What "delete" means
+ * here, in one place:
+ *
+ *   - the session JSONL, plus any `<name>.jsonl.bak-*` copy an earlier rewind
+ *     left beside it (a full copy of the same transcript: leaving it behind
+ *     would mean the conversation was not actually deleted);
+ *   - its sibling artifacts directory, which holds the subagent transcripts;
+ *   - the `archived_sessions`, `session_ui_state`, `session_stream_state`,
+ *     `queued_messages` and `chat_sessions` rows for that id;
+ *   - in mock mode the demo `sessions` row and its `files` tree.
+ *
+ * The caller owns the process: a live omp child MUST be destroyed before this
+ * runs, because omp flushes its session state on shutdown and would otherwise
+ * recreate the file this just removed. Side-question rows and workspaces are
+ * the btw module's business (`purgeBtwForSession`).
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { getDb } from '@/server/db.server';
+import type { DbClient } from '@/server/lib/db/client';
+import { findSessionFileById } from '@/server/lib/omp/session/locator';
+import { clearSessionFileCaches } from '@/server/lib/omp/session/files';
+import { invalidateOmpSidebarData } from '@/server/lib/omp/session/reader';
+import { siblingDirForSession } from '@/server/lib/omp/subagent/history/paths';
+import { isSinglePathSegment } from '@/server/lib/fs/path-segment';
+
+export interface SessionPurgeResult {
+  /** Something keyed to this id existed — a transcript, a mock session row, or
+   *  a chamber row. False means the id resolved nowhere at all. */
+  found: boolean;
+  fileRemoved: boolean;
+  artifactsRemoved: boolean;
+}
+
+/**
+ * Chamber rows keyed by a session id. Every statement is a no-op when the id
+ * matches nothing, which is what makes one purge serve both modes: real
+ * sessions (omp UUIDs, present on disk only) and mock ones (numeric ids in
+ * `sessions`).
+ *
+ * `files` carries a FOREIGN KEY to `sessions` and `foreign_keys` is ON, so its
+ * children go before the session row or the delete is refused.
+ */
+const SESSION_ROW_DELETES: readonly (readonly [string, string])[] = [
+  ['archived_sessions', 'session_id'],
+  ['session_ui_state', 'session_id'],
+  ['session_stream_state', 'session_id'],
+  ['queued_messages', 'session_id'],
+  ['chat_sessions', 'session_id'],
+  ['files', 'session_id'],
+];
+
+async function purgeChamberRows(db: DbClient, sessionId: string): Promise<number> {
+  let changes = 0;
+  for (const [table, column] of SESSION_ROW_DELETES) {
+    const result = await db.run(`DELETE FROM ${table} WHERE ${column} = ?`, [sessionId]);
+    changes += result.changes ?? 0;
+  }
+  const mockRow = await db.run('DELETE FROM sessions WHERE id = ?', [sessionId]);
+  return changes + (mockRow.changes ?? 0);
+}
+
+/** Remove the transcript and the `.bak-*` copies beside it. */
+async function removeTranscript(filePath: string): Promise<boolean> {
+  const existed = await Bun.file(filePath).exists();
+  await fs.promises.rm(filePath, { force: true });
+  const dir = path.dirname(filePath);
+  const prefix = `${path.basename(filePath)}.bak-`;
+  try {
+    for (const entry of await fs.promises.readdir(dir)) {
+      if (entry.startsWith(prefix)) await fs.promises.rm(path.join(dir, entry), { force: true });
+    }
+  } catch {
+    // A backup that cannot be listed is not worth failing a delete the
+    // transcript half of which already succeeded.
+  }
+  return existed;
+}
+
+/**
+ * Purge everything the chamber and the agent directory hold for `sessionId`.
+ * `sessionId` must be a single safe path segment — it names the artifacts
+ * directory — which the route validates before calling.
+ */
+export async function purgeSessionData(sessionId: string): Promise<SessionPurgeResult> {
+  // Second gate, independent of the route's: an id that is not one segment
+  // would make `siblingDirForSession` and the btw purge resolve outside the
+  // session it names. Refusing here means a future caller that forgets the
+  // route's guard still cannot widen the blast radius.
+  if (!isSinglePathSegment(sessionId)) {
+    return { found: false, fileRemoved: false, artifactsRemoved: false };
+  }
+
+  const filePath = await findSessionFileById(sessionId);
+  let fileRemoved = false;
+  let artifactsRemoved = false;
+  if (filePath) {
+    fileRemoved = await removeTranscript(filePath);
+    const artifactsDir = siblingDirForSession(filePath);
+    // `stat`, not `Bun.file().exists()`: the latter answers for regular files
+    // only and reports a directory as absent, which would claim every session
+    // had no subagent transcripts.
+    artifactsRemoved = await fs.promises
+      .stat(artifactsDir)
+      .then((stats) => stats.isDirectory(), () => false);
+    await fs.promises.rm(artifactsDir, { recursive: true, force: true });
+  }
+
+  const db = await getDb();
+  const rowChanges = await purgeChamberRows(db, sessionId);
+
+  // Both caches outlive the mutation by their own keys: the file list/scan pair
+  // is mtime-keyed (a delete bumps the parent directory, but the memo can still
+  // answer first) and the sidebar dataset is TTL'd, so without this the deleted
+  // row is served back to the refresh that follows the delete.
+  clearSessionFileCaches();
+  invalidateOmpSidebarData();
+
+  return {
+    found: Boolean(filePath) || rowChanges > 0,
+    fileRemoved,
+    artifactsRemoved,
+  };
+}