opencode-sesh 0.1.3 → 0.1.5

package/AGENTS.md

@@ -13,8 +13,8 @@ territory: read this first, then the specific file you need.
 2. **`tui/sesh-panel.tsx`** — a SolidJS/OpenTUI plugin for the opencode TUI: a
    recent-sessions section in the sidebar plus a `ctrl+o` / `/sesh` picker.
 3. **`opencode/tools/sesh-list.ts`** — the `sesh-list` custom tool, so the agent
-   can list sessions across every directory (the native `opencode session list`
-   is project-scoped).
+   can list sessions across every directory by querying the global `opencode
+   db` store (the native `opencode session list` is project-scoped).
 
 No iTerm2, no AppleScript, no panes, no window management — **never add any.**
 opencode has no persistent-sidebar API, so the "sidebar" is a `sidebar_content`
@@ -43,15 +43,19 @@ The **filename becomes the tool name** in opencode, so `sesh-list.ts` is the
 
 ## Data flow (fzf picker)
 
-`bin/sesh-list.sh` is the only place that knows the session store (opencode
-SQLite DB: `session` / `message` / `part` tables). Keystrokes never touch the
-database:
+`bin/sesh-list.sh` owns the fzf picker's session store access (opencode SQLite
+DB: `session` / `message` / `part` tables); the `sesh-list` agent tool queries
+the same store through `opencode db`. Keep its SQL column names in sync with
+the schema below. Keystrokes never touch the database:
 
 - `--refresh` (expensive): bulk-reads session metadata and per-session text
   parts, validates the persistent extraction cache
-  (`$SESH_CACHE_DIR/extractions/<ses_*.json>`) against `time_updated` + part
-  count, re-extracts only changed sessions, prunes vanished ones, and atomically
-  publishes `STATE_DIR/snapshot.jsonl` with `status = fresh`. Scope
+  (`$SESH_CACHE_DIR/extractions/<ses_*.json>`, schema 2) against `time_updated`,
+  part count and the latest part timestamp, re-extracts only changed sessions,
+  prunes vanished ones, and atomically publishes `STATE_DIR/snapshot.jsonl`.
+  Extraction moves transcripts through files, never argv (no ARG_MAX limit); if
+  any session fails, the published status is `stale` and that session stays
+  uncached so the next refresh retries, otherwise `status = fresh`. Scope
   (`--cwd`/toggle) and `--limit` apply at assembly, so metadata always covers
   the whole DB and pruning is always safe.
 - render (cheap, pure `jq`): reads the snapshot only. Filters on `searchText`
@@ -67,7 +71,7 @@ One worker (`sesh-refresh-worker.sh`, per picker, TERMed on exit) serializes
 scans; fzf's `start`/`every(3)`/`change` bindings render only. Selection requests
 a fresh poll (`request`/`wait`, ≤12 s) before dispatch. opencode has no
 live-agent API, so `liveState` is always `unknown` and rows render gray;
-dispatch is always `opencode --session <id>` (`--fork` with Ctrl-F/Enter).
+dispatch is always `opencode --session <id>` (`--fork` with Ctrl-F or --fork).
 Resume happens in place (`exec` after `cd` to the session's cwd).
 
 ## Conventions
@@ -77,17 +81,21 @@ Resume happens in place (`exec` after `cd` to the session's cwd).
 - **Text parts only** in search/preview; reasoning and tool payloads are
   excluded (asserted in tests).
 - Validate session ids (`^ses_[A-Za-z0-9]+$`) before SQL interpolation — never
-  interpolate unvalidated input.
+  interpolate unvalidated input. Open SQLite read-only (`sqlite3 -readonly`).
 - Prefer direct `sqlite3` over `opencode db` (startup latency). Never parse
   `sqlite3 -json` in `-R` mode; it pretty-prints — parse as JSON.
 - `jq -R` output stays JSON-quoted: use `-Rr` when a shell variable needs the
   raw string.
-- fzf: stock only, `>= 0.52` (`transform:`, `every():`). `{q}` in binds is
+- fzf: stock only, `>= 0.73` (`transform:`, `every():`). `{q}` in binds is
   shell-quoted by fzf — don't add quoting. Ctrl-G is bind-only (stays open);
   Ctrl-F is `--expect` (accepts with fork).
 - The installer prefers the local opencode version for `@opencode-ai/*` and
   merges (never clobbers) the config `package.json`; opencode runs `bun install`
   at startup.
+- Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+  (`feat`, `fix`, `docs`, `ci`, …). See
+  [CONTRIBUTING.md](CONTRIBUTING.md#commit-messages) for the types and the
+  version mapping.
 
 ## TUI panel (`tui/sesh-panel.tsx`)
 

package/CHANGELOG.md

@@ -7,6 +7,60 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-09-13
+
+### Fixed
+
+- Transcript indexing no longer puts the whole conversation on the command line,
+  so large sessions (over a megabyte of text) are indexed instead of silently
+  dropped. A failed extraction now reports the snapshot as `stale` and retries
+  on the next refresh rather than certifying an incomplete index as fresh.
+- Transcript preview renders text parts even when newer tool parts outnumber
+  them, and a long message no longer blanks the preview when the output pipe
+  closes early.
+- Warm extraction caches are invalidated on any part change (text or timestamp),
+  not only when the session timestamp or part count moves.
+- The installer refuses to replace a symlinked `sesh` launcher that is not a
+  sesh install, and uninstall leaves foreign launcher symlinks untouched.
+
+### Security
+
+- Session ids are validated with the anchored `^ses_[A-Za-z0-9]+$` pattern at
+  the preview and deletion boundaries before any SQL, and the local SQLite store
+  is opened read-only.
+
+### Added
+
+- Regression coverage for large transcripts, part-only cache invalidation,
+  preview text/tool ordering and long previews, malformed session ids, empty
+  stores, and installer launcher ownership.
+
+## [0.1.4] - 2026-09-13
+
+### Fixed
+
+- The picker keeps the selected session across automatic refreshes and no
+  longer retargets Enter, Ctrl-F, or Ctrl-X when the selected session
+  disappears (`--track`/`--id-nth` plus a non-actionable placeholder row).
+- Ctrl-F now forks: fzf's `--print-query`/`--expect` output (query, key, row)
+  was parsed as key, query, row, so forking resumed the original session.
+- Require fzf >= 0.73 in the launcher, installer, README, and AGENTS — the
+  `every()` refresh event the picker relies on was added in 0.73.
+- Transcript extraction caches are written 0700/0600 regardless of the caller's
+  umask, and existing caches are tightened on refresh.
+
+### Changed
+
+- The `sesh-list` agent tool queries the global session store, so it lists
+  every project directory (roots, non-archived) instead of only the current
+  project; directory filtering now happens before the limit.
+
+### Added
+
+- Real-fzf PTY regressions for selection tracking and fork parsing
+  (`npm run test:picker`), an agent-tool contract/SQL suite, and fzf
+  version-gate and cache-permission regressions.
+
 ## [0.1.3] - 2026-09-12
 
 ### Added
@@ -48,7 +102,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Fixture-database regression suite, TypeScript typechecking, and ShellCheck in
   CI.
 
-[Unreleased]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.3...HEAD
+[Unreleased]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/ozandogrultan/opencode-sesh/compare/v0.1.0...v0.1.1

package/README.md

@@ -82,7 +82,7 @@ ctrl+o            # inside opencode — picker
 ### Requirements
 
 - [opencode](https://opencode.ai), used at least once
-- `bash`, `jq`, and [`fzf`](https://github.com/junegunn/fzf) `>= 0.52`
+- `bash`, `jq`, and [`fzf`](https://github.com/junegunn/fzf) `>= 0.73`
 - `sqlite3` recommended — the picker queries the session DB directly in
   milliseconds and falls back to the slower `opencode db` CLI without it
 - [`glow`](https://github.com/charmbracelet/glow) optional — styles the
@@ -104,7 +104,7 @@ bash install.sh --uninstall   # from source
 | --- | --- |
 | Type | Search titles and transcript text across all directories |
 | Enter | Resume the selected session in this terminal |
-| Ctrl-F Enter | Resume as a fork (the original is untouched) |
+| Ctrl-F       | Resume as a fork (the original is untouched) |
 | Ctrl-G | Toggle current-directory scope / all sessions |
 | Space (empty query) | Toggle the transcript preview |
 | `?` (empty query) | Toggle shortcut help |

package/bin/sesh-delete.sh

@@ -37,7 +37,7 @@ acquire_lock() {
 # fzf passes an empty second field for headers and notices. They are never
 # actions, and should not surface a misleading failure prompt.
 [ -n "$session_id" ] || exit 0
-case "$session_id" in ses_[A-Za-z0-9]*) ;; *) echo "Invalid session identity."; pause; exit 0;; esac
+[[ "$session_id" =~ ^ses_[A-Za-z0-9]+$ ]] || { echo "Invalid session identity."; pause; exit 0; }
 [ -n "$state_dir" ] && [ -f "$snapshot" ] || { echo "No session snapshot available."; pause; exit 0; }
 
 # Serialize this action with the sole snapshot publisher. A short collision

package/bin/sesh-list.sh

@@ -6,6 +6,7 @@
 # TSV: agentId, sessionId, liveState, display, cwd, trackingId.
 # Every row, including headers/notices, requires a unique nonempty trackingId.
 set -euo pipefail
+umask 077
 
 LIMIT=0
 LIMIT_SET=0
@@ -17,6 +18,7 @@ INCLUDE_ARCHIVED=0
 ARCHIVED_SET=0
 STATE_DIR=''
 QUERY=''
+SELECTED_ID=''
 SCOPE_CWD=''
 usage() { echo "usage: ${0##*/} [--refresh] [--wait-lock SECONDS] --state-dir DIR [--cwd] [--limit N] [--archived] [--toggle-scope] [--query TEXT]" >&2; }
 while [ "$#" -gt 0 ]; do
@@ -29,6 +31,7 @@ while [ "$#" -gt 0 ]; do
     --archived) INCLUDE_ARCHIVED=1; ARCHIVED_SET=1 ;;
     --toggle-scope) TOGGLE_SCOPE=1 ;;
     --query) QUERY=${2:-}; shift ;;
+    --selected-id) SELECTED_ID=${2:-}; shift ;;
     --help) usage; exit 0 ;;
     *) echo "unknown option: $1" >&2; usage; exit 2 ;;
   esac
@@ -92,7 +95,9 @@ fi
 # would make every preview keystroke laggy.
 db_json() {
   if [ -n "$SQLITE_BIN" ]; then
-    "$SQLITE_BIN" -json "$DB_PATH" "$1"
+    # Read-only: sesh never writes the store directly (deletes go through
+    # `opencode session delete`).
+    "$SQLITE_BIN" -json -readonly "$DB_PATH" "$1"
   else
     "$OPENCODE_BIN" db "$1" --format json
   fi
@@ -111,18 +116,24 @@ set_status() { atomic_text "$STATUS" "$1"; }
 render() {
   local state=''
   [ -f "$STATUS" ] && state=$(cat "$STATUS" 2>/dev/null || true)
-  if [ ! -s "$SNAPSHOT" ]; then
+  if [ ! -f "$SNAPSHOT" ]; then
     [ -n "$state" ] && [ "$state" != fresh ] && printf '\t\tunknown\t%s%s%s\t\tnotice:live-state\n' "$YELLOW" "$state" "$RESET"
     return 0
   fi
   {
     [ -n "$state" ] && [ "$state" != fresh ] && printf '\t\tunknown\t%s%s%s\t\tnotice:live-state\n' "$YELLOW" "$state" "$RESET"
-    "$JQ_BIN" -sr --arg green "$GREEN" --arg cyan "$CYAN" --arg gray "$GRAY" --arg magenta "$MAGENTA" --arg red "$RED" --arg bold "$BOLD" --arg reset "$RESET" --arg query "$QUERY" --arg home "$HOME" '
+    "$JQ_BIN" -sr --arg green "$GREEN" --arg cyan "$CYAN" --arg gray "$GRAY" --arg magenta "$MAGENTA" --arg red "$RED" --arg bold "$BOLD" --arg yellow "$YELLOW" --arg reset "$RESET" --arg query "$QUERY" --arg home "$HOME" --arg selected "$SELECTED_ID" '
       def ago($epoch):
         ((now - ($epoch | tonumber)) | floor) as $s
         | if $s < 60 then "now" elif $s < 3600 then "\($s / 60 | floor)m" elif $s < 86400 then "\($s / 3600 | floor)h" else "\($s / 86400 | floor)d" end;
       def homepath:
         . as $p | if $p == "" then "?" elif $p == $home then "~" elif ($home != "" and startswith($home + "/")) then "~" + .[($home|length):] else . end;
+      # Preserve a vanished selection as a non-actionable row with its original
+      # tracking key. Otherwise fzf falls back to a different session. Keep it
+      # until the user moves away; empty field 2 makes Enter/Ctrl-F/Ctrl-X no-ops.
+      (if ($selected | test("^ses_[A-Za-z0-9]+$")) and (any(.sessionId == $selected) | not)
+       then (["", "", "unknown", ($yellow + "Selected session is no longer available; choose another session" + $reset), "", $selected] | @tsv)
+       else empty end),
       (($query | ascii_downcase) as $q
       | map(select($q == "" or (.searchText | contains($q))))
       | group_by(.cwd)
@@ -159,8 +170,22 @@ acquire_lock_wait() {
   done
 }
 
+private_dir() {
+  # These are dedicated sesh directories, never the shared XDG parent. Refuse
+  # symlinks/foreign ownership rather than changing permissions on their target.
+  [ ! -L "$1" ] || { echo "sesh: private directory is a symlink: $1" >&2; return 1; }
+  mkdir -p "$1"
+  [ -O "$1" ] || { echo "sesh: private directory is not owned by this user: $1" >&2; return 1; }
+  chmod 700 "$1"
+}
+
 refresh() {
-  mkdir -p "$STATE_DIR"
+  private_dir "$STATE_DIR"
+  private_dir "$CACHE_DIR"
+  private_dir "$EXTRACTIONS"
+  # Migrate warm caches too, including temporary files left by older versions.
+  # Do not follow symlinks or chmod unrelated files outside our extraction store.
+  find "$EXTRACTIONS" -maxdepth 1 -type f -user "$(id -u)" \( -name 'ses_*.json' -o -name 'ses_*.json.tmp' \) -exec chmod 600 {} +
   if [ "${SESH_LOCK_HELD:-}" != "$STATE_DIR" ]; then
     if [ "$WAIT_LOCK" -gt 0 ]; then acquire_lock_wait || return $?; else acquire_lock || return 0; fi
   fi
@@ -180,7 +205,6 @@ refresh() {
     if [ -f "$SNAPSHOT" ]; then set_status 'stale: neither sqlite3 nor opencode is available; showing last good snapshot'; else set_status 'unavailable: neither sqlite3 nor opencode is available'; fi
     return 0
   fi
-  mkdir -p "$EXTRACTIONS"
   local scratch sessions parts cache_records cache_state historical needs_extract out
   scratch=$(mktemp -d "$STATE_DIR/.refresh.XXXXXX")
   refresh_scratch=$scratch
@@ -199,6 +223,9 @@ refresh() {
     if [ -f "$SNAPSHOT" ]; then set_status 'stale: opencode database query failed; showing last good snapshot'; else set_status 'unavailable: opencode database query failed'; fi
     return 0
   }
+  # sqlite3 emits no bytes for zero rows. Publish an empty snapshot so removal
+  # of the final session also produces the non-actionable selection notice.
+  [ -s "$sessions" ] || printf '[]\n' > "$sessions"
   "$JQ_BIN" -e 'type == "array"' "$sessions" >/dev/null 2>&1 || {
     if [ -f "$SNAPSHOT" ]; then set_status 'stale: opencode database query failed; showing last good snapshot'; else set_status 'unavailable: opencode database query failed'; fi
     return 0
@@ -218,11 +245,11 @@ refresh() {
     | ($parts[0] | map({key:.session_id, value:.}) | from_entries) as $stats
     | [$sessions[0][] | . + {partCount: ($stats[.id].n // 0), partMax: ($stats[.id].m // 0)}] as $meta
     | ($meta | map({key:.id, value:.}) | from_entries) as $byId
-    | [$caches[0][]? | select(.cacheSchema == 1 and (.sessionId | type) == "string")
-       | select($byId[.sessionId] as $m | $m != null and .cacheUpdated == $m.time_updated and .cacheParts == $m.partCount)] as $cached
-    | ($cached | map({key:.sessionId, value:true}) | from_entries) as $cachedIds
+    | [$caches[0][]? | select(.cacheSchema == 2 and (.sessionId | type) == "string")
+       | select($byId[.sessionId] as $m | $m != null and .cacheUpdated == $m.time_updated and .cacheParts == $m.partCount and .cacheMax == $m.partMax)] as $cached
+    | ($cached | map({key: .sessionId, value:true}) | from_entries) as $cachedIds
     | {cached: $cached,
-       stale: [$meta[] | select($cachedIds[.id] != true) | {id, directory, title, time_created, time_updated, archived, partCount}],
+       stale: [$meta[] | select($cachedIds[.id] != true) | {id, directory, title, time_created, time_updated, archived, partCount, partMax}],
        prune: [$caches[0][]? | select(.sessionId? as $s | $byId[$s] == null) | .cachePath],
        meta: $meta}
   ' "$cache_records" > "$cache_state" || {
@@ -233,7 +260,8 @@ refresh() {
   "$JQ_BIN" -c '.stale[]?' "$cache_state" > "$needs_extract"
   while IFS= read -r cache; do [ -n "$cache" ] && rm -f "$cache"; done < <("$JQ_BIN" -r '.prune[]?' "$cache_state")
 
-  local sid dir title created updated archived partCount text fulltext record cache
+  local sid dir title created updated partCount partMax raw_file text_file record cache
+  local extract_failed=0
   while IFS= read -r row; do
     [ -n "$row" ] || continue
     sid=$(printf '%s' "$row" | "$JQ_BIN" -r '.id')
@@ -243,27 +271,40 @@ refresh() {
     created=$(printf '%s' "$row" | "$JQ_BIN" -r '.time_created // 0')
     updated=$(printf '%s' "$row" | "$JQ_BIN" -r '.time_updated // 0')
     partCount=$(printf '%s' "$row" | "$JQ_BIN" -r '.partCount // 0')
+    partMax=$(printf '%s' "$row" | "$JQ_BIN" -r '.partMax // 0')
     cache="$EXTRACTIONS/$sid.json"
-    # Text parts only: reasoning blobs and tool payloads would bloat the
-    # search index without helping anyone find a session.
-    text=$(db_json "SELECT data FROM part WHERE session_id = '$sid' AND json_extract(data, '\$.type') = 'text' ORDER BY time_created;" 2>/dev/null \
-      | "$JQ_BIN" -r '[.[]? | (.data? // empty) | (try fromjson catch empty) | select(type == "object" and .type == "text") | .text // empty] | join(" ")' 2>/dev/null) || text=''
-    fulltext=$(printf '%s' "$title $text" | "$JQ_BIN" -Rrs 'ascii_downcase' 2>/dev/null) || fulltext=''
+    raw_file="$scratch/$sid.parts.json"
+    text_file="$scratch/$sid.text"
+    # Text parts only: reasoning blobs and tool payloads would bloat the search
+    # index. The transcript travels through files, never argv, so a large
+    # conversation cannot hit ARG_MAX; a failure leaves the session uncached so
+    # the next refresh retries instead of certifying it fresh.
+    if db_json "SELECT data FROM part WHERE session_id = '$sid' AND json_extract(data, '\$.type') = 'text' ORDER BY time_created;" > "$raw_file" 2>/dev/null \
+      && "$JQ_BIN" -r '[.[]? | (.data? // empty) | (try fromjson catch empty) | select(type == "object" and .type == "text") | .text // empty] | join(" ")' "$raw_file" > "$text_file" 2>/dev/null; then
+      :
+    else
+      extract_failed=1
+      continue
+    fi
     if [ -z "$title" ]; then
-      title=$(printf '%s' "$text" | "$JQ_BIN" -Rrs 'gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end | select(length > 0) // "(untitled)"' 2>/dev/null) || title='(untitled)'
+      title=$("$JQ_BIN" -Rrs 'gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end | select(length > 0) // "(untitled)"' "$text_file" 2>/dev/null) || title='(untitled)'
       [ -n "$title" ] || title='(untitled)'
     fi
     record=$("$JQ_BIN" -cn --arg sid "$sid" --arg cwd "$dir" --arg title "$title" \
-      --argjson created "$created" --argjson updated "$updated" --argjson parts "$partCount" --arg fulltext "$fulltext" '
-      {cacheSchema: 1, cacheSession: $sid, cacheUpdated: $updated, cacheParts: $parts,
+      --argjson created "$created" --argjson updated "$updated" --argjson parts "$partCount" --argjson maxpart "$partMax" \
+      --rawfile text "$text_file" '
+      {cacheSchema: 2, cacheSession: $sid, cacheUpdated: $updated, cacheParts: $parts, cacheMax: $maxpart,
        sessionId: $sid, transcriptPath: "", source: "opencode",
        cwd: $cwd, title: ($title | gsub("[\r\n]+"; " ") | if length > 70 then .[0:67] + "..." else . end),
        updatedEpoch: (($updated / 1000 | floor) | if . > 0 then . else ($created / 1000 | floor) end),
-       fulltextLower: $fulltext}') || record=''
+       fulltextLower: (($title + " " + $text) | sub("\n$"; "") | ascii_downcase)}') || record=''
     if [ -n "$record" ]; then
-      printf '%s\n' "$record" > "$cache.tmp"
-      mv "$cache.tmp" "$cache"
+      cache_tmp=$(mktemp "$EXTRACTIONS/$sid.json.XXXXXX")
+      printf '%s\n' "$record" > "$cache_tmp"
+      mv "$cache_tmp" "$cache"
       printf '%s\n' "$record" >> "$historical"
+    else
+      extract_failed=1
     fi
   done < "$needs_extract"
 
@@ -271,6 +312,7 @@ refresh() {
     .meta as $meta
     | ($hist | map({key: .sessionId, value: .}) | from_entries) as $histById
     | [$meta[]
+       | select((.id | type) == "string" and (.id | test("^ses_[A-Za-z0-9]+$")))
        | select($archived == 1 or .archived == 0)
        | select($scope == "" or .directory == $scope)
        | . as $m | ($histById[$m.id] // {}) as $h
@@ -287,7 +329,13 @@ refresh() {
     return 1
   fi
   mv -f "$out" "$SNAPSHOT"
-  set_status fresh || true
+  if [ "$extract_failed" = 1 ]; then
+    # Publish what we have, but say the index is incomplete and keep the
+    # failed sessions uncached so the next refresh retries them.
+    set_status 'stale: transcript extraction incomplete; refresh to retry' || true
+  else
+    set_status fresh || true
+  fi
 }
 
 if [ "$REFRESH" = 1 ] || [ "$TOGGLE_SCOPE" = 1 ]; then refresh; fi

package/bin/sesh-preview.sh

@@ -10,7 +10,7 @@ JQ_BIN=${SESH_JQ:-jq}
 
 [ -n "$state_dir" ] && [ -n "$session_id" ] || { echo "(no session selected)"; exit 0; }
 [ -f "$snapshot" ] || { echo "(no session snapshot available)"; exit 0; }
-case "$session_id" in ses_[A-Za-z0-9]*) ;; *) echo "(no transcript for this row)"; exit 0;; esac
+[[ "$session_id" =~ ^ses_[A-Za-z0-9]+$ ]] || { echo "(no transcript for this row)"; exit 0; }
 "$JQ_BIN" -se --arg sid "$session_id" 'any(.sessionId == $sid)' "$snapshot" >/dev/null 2>&1 \
   || { echo "(selected session is no longer in this snapshot)"; exit 0; }
 
@@ -26,26 +26,31 @@ fi
 
 SQLITE_BIN=${SESH_SQLITE:-}
 if [ -z "$SQLITE_BIN" ] && command -v sqlite3 >/dev/null 2>&1; then SQLITE_BIN=sqlite3; fi
-SQL="SELECT m.data AS msg, p.data AS part FROM part p JOIN message m ON m.id = p.message_id WHERE p.session_id = '$session_id' ORDER BY p.time_created DESC LIMIT 200;"
+SQL="SELECT m.data AS msg, p.data AS part FROM part p JOIN message m ON m.id = p.message_id WHERE p.session_id = '$session_id' AND json_extract(p.data, '\$.type') = 'text' ORDER BY p.time_created DESC LIMIT 200;"
 if [ -n "$SQLITE_BIN" ]; then
-  rows=$("$SQLITE_BIN" -json "$DB_PATH" "$SQL" 2>/dev/null) || rows=''
+  rows=$("$SQLITE_BIN" -json -readonly "$DB_PATH" "$SQL" 2>/dev/null) || rows=''
 else
   OPENCODE_BIN=${SESH_OPENCODE:-opencode}
   rows=$("$OPENCODE_BIN" db "$SQL" --format json 2>/dev/null) || rows=''
 fi
 [ -n "$rows" ] || { echo "(no displayable transcript messages)"; exit 0; }
 
-# Text parts only, newest first, with role headers. Control bytes are stripped
-# with tr (byte-safe for UTF-8: only 0x00-0x1F and 0x7F are removed).
+# Text parts only, newest first, with role headers. The 120-block cap is applied
+# inside jq so nothing closes the pipe early (a `head` here would trip pipefail
+# with SIGPIPE and blank the preview). Control bytes are stripped with tr
+# (byte-safe for UTF-8: only 0x00-0x1F and 0x7F are removed).
 rendered=$(printf '%s' "$rows" | "$JQ_BIN" -r '
   (if type == "array" then . else [] end)
+  | map(
+      ((.msg | try fromjson catch {}) | .role? // "") as $role
+      | (.part | try fromjson catch {}) as $p
+      | select(($p.type? // "") == "text")
+      | ($p.text? // "") | select(type == "string" and length > 0)
+      | (if $role == "user" then "# You" elif $role == "assistant" then "# Opencode" else "# Message" end) + "\n\n" + .
+    )
+  | .[0:120]
   | .[]
-  | ((.msg | try fromjson catch {}) | .role? // "") as $role
-  | (.part | try fromjson catch {}) as $p
-  | select(($p.type? // "") == "text")
-  | ($p.text? // "") | select(type == "string" and length > 0)
-  | (if $role == "user" then "# You" elif $role == "assistant" then "# Opencode" else "# Message" end) + "\n\n" + .
-' 2>/dev/null | tr -d '\000-\010\013\014\016-\037\177' | head -120) || rendered=''
+' 2>/dev/null | tr -d '\000-\010\013\014\016-\037\177') || rendered=''
 [ -n "$rendered" ] || { echo "(no displayable transcript messages)"; exit 0; }
 
 resolve_glow() {

package/bin/sesh-refresh-worker.sh

@@ -2,6 +2,7 @@
 # A short-lived worker owned by one picker.  It serializes expensive refreshes;
 # fzf only ever asks the list script to render the last published snapshot.
 set -euo pipefail
+umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # The list script can be overridden for reuse; default is the opencode list.
@@ -14,6 +15,7 @@ SCOPE=''
 LIMIT=60
 TARGET=''
 TIMEOUT=12
+SELECTED_ID=''
 
 usage() { echo "usage: ${0##*/} init|worker|render|request|wait --state-dir DIR [options]" >&2; exit 2; }
 while [ "$#" -gt 0 ]; do
@@ -22,6 +24,7 @@ while [ "$#" -gt 0 ]; do
     --scope) [ "$#" -ge 2 ] || usage; SCOPE=$2; shift ;;
     --limit) [ "$#" -ge 2 ] || usage; LIMIT=$2; shift ;;
     --query) [ "$#" -ge 2 ] || usage; QUERY=$2; shift ;;
+    --selected-id) [ "$#" -ge 2 ] || usage; SELECTED_ID=$2; shift ;;
     --target) [ "$#" -ge 2 ] || usage; TARGET=$2; shift ;;
     --timeout) [ "$#" -ge 2 ] || usage; TIMEOUT=$2; shift ;;
     *) usage ;;
@@ -49,7 +52,7 @@ case "$MODE" in
     atomic_text "$STATE_DIR/worker-complete" 0
     ;;
   render)
-    "$LIST" --state-dir "$STATE_DIR" --query "${QUERY:-}"
+    "$LIST" --state-dir "$STATE_DIR" --query "${QUERY:-}" --selected-id "$SELECTED_ID"
     # An empty, first snapshot should not look like a broken picker.
     if [ ! -f "$STATE_DIR/status" ] && [ -f "$STATE_DIR/worker.pid" ]; then
       printf '\t\tunknown\tLoading sessions…\t\tnotice:loading\n'

package/bin/sesh-shortcuts.sh

@@ -5,7 +5,7 @@ sesh shortcuts
 
   Type              Search session titles and transcript text
   Enter             Resume the selected session here
-  Ctrl-F Enter      Resume the selected session as a fork
+  Ctrl-F            Resume the selected session as a fork
   Ctrl-G            Toggle current-directory scope / all sessions
   Space             Toggle transcript preview
   ?                 Toggle this help

package/bin/sesh.sh

@@ -4,6 +4,7 @@
 # Refreshes publish one state-dir snapshot; fzf query changes render that
 # snapshot only, so typing never starts competing scans.
 set -euo pipefail
+umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
@@ -25,8 +26,8 @@ version=$("$SESH_FZF" --version 2>/dev/null || true)
 if [[ "$version" =~ ^([0-9]+)\.([0-9]+)(\.([0-9]+))? ]]; then
   fzf_major=$((10#${BASH_REMATCH[1]}))
   fzf_minor=$((10#${BASH_REMATCH[2]}))
-  if [ "$fzf_major" -eq 0 ] && [ "$fzf_minor" -lt 52 ]; then
-    echo "sesh: fzf >= 0.52.0 is required (found $version)" >&2
+  if [ "$fzf_major" -eq 0 ] && [ "$fzf_minor" -lt 73 ]; then
+    echo "sesh: fzf >= 0.73.0 is required (found $version)" >&2
     exit 1
   fi
 else
@@ -92,7 +93,7 @@ cleanup() {
 trap cleanup EXIT
 trap 'exit 130' HUP INT TERM
 
-cache_cmd="$q_worker render --state-dir $q_state --query {q}"
+cache_cmd="$q_worker render --state-dir $q_state --query {q} --selected-id {6}"
 preview_cmd="if [ -f $q_state/help ]; then $q_shortcuts; else $q_preview $q_state {2}; fi"
 help_bind="?:transform:[ -z {q} ] && ( [ -f $q_state/help ] && rm -f $q_state/help && echo hide-preview || ( : > $q_state/help && echo show-preview+refresh-preview ) ) || echo 'put(?)'"
 toggle_cmd="$q_list --toggle-scope --state-dir $q_state >/dev/null"
@@ -102,7 +103,7 @@ query="$picker_query"
 while :; do
 selection=''
 set +e
-selection=$(FZF_DEFAULT_COMMAND='printf ""' FZF_DEFAULT_OPTS='' FZF_DEFAULT_OPTS_FILE='' "$SESH_FZF" --print-query --expect=ctrl-f --query="$query" --ansi --delimiter=$'\t' --with-nth=4 --disabled --layout=reverse --info=hidden --prompt='❯ ' \
+selection=$(FZF_DEFAULT_COMMAND='printf ""' FZF_DEFAULT_OPTS='' FZF_DEFAULT_OPTS_FILE='' "$SESH_FZF" --print-query --expect=ctrl-f --query="$query" --ansi --delimiter=$'\t' --with-nth=4 --track --id-nth=6 --disabled --layout=reverse --info=hidden --prompt='❯ ' \
   --preview="$preview_cmd" --preview-window='right,50%,wrap,hidden' \
   --bind='space:transform:[ -z {q} ] && echo toggle-preview || echo "put( )"' \
   --bind="$help_bind" \
@@ -113,10 +114,11 @@ selection=$(FZF_DEFAULT_COMMAND='printf ""' FZF_DEFAULT_OPTS='' FZF_DEFAULT_OPTS
 status=$?
 set -e
 case "$status" in 0) ;; 1|130) exit 0;; *) echo "sesh: picker failed ($status)" >&2; exit "$status";; esac
-key=${selection%%$'\n'*}
-selection=${selection#*$'\n'}
+# --print-query precedes the --expect key (empty for Enter), then the row.
 query=${selection%%$'\n'*}
 selection=${selection#*$'\n'}
+key=${selection%%$'\n'*}
+selection=${selection#*$'\n'}
 session_id=$(printf '%s\n' "$selection" | cut -f2)
 [ -n "$session_id" ] || continue
 # Dispatch queues a new worker scan and waits for that exact serialized poll.

package/install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Install sesh for the current user.
 # Terminal- and OS-agnostic: macOS and Linux, any terminal. No administrator
-# privileges, downloads, or shell-rc edits. Runtime requires jq, fzf >= 0.52
+# privileges, downloads, or shell-rc edits. Runtime requires jq, fzf >= 0.73
 # and sqlite3 or the opencode CLI; the in-TUI panel additionally needs the
 # packages opencode installs for local plugins (handled below).
 set -euo pipefail
@@ -91,8 +91,33 @@ remove_tui_entry() {
   fi
 }
 
+# The launcher is a symlink we create. Treat it as ours only when it resolves to
+# a sesh launcher, so a foreign symlink is never replaced on install nor deleted
+# on uninstall. Recognized by the exact source path, a `.../bin/sesh` target, or
+# the marker in the target file (covers npm upgrades and a moved checkout).
+launcher_is_ours() {
+  local link=$1 target
+  [ -L "$link" ] || return 1
+  target=$(readlink "$link" 2>/dev/null) || return 1
+  [ -n "$target" ] || return 1
+  case "$target" in
+    /*) ;;
+    *) target="$(cd "$(dirname "$link")" && pwd -P)/$target" ;;
+  esac
+  case "$target" in
+    "$SOURCE_DIR/bin/sesh"|*/bin/sesh) return 0 ;;
+  esac
+  [ -f "$target" ] && grep -qF 'Pick an opencode session' "$target" 2>/dev/null
+}
+
 if [ "$UNINSTALL" = 1 ]; then
-  [ -L "$LAUNCHER" ] && rm -f "$LAUNCHER" && note "removed $LAUNCHER"
+  if [ -L "$LAUNCHER" ]; then
+    if launcher_is_ours "$LAUNCHER"; then
+      rm -f "$LAUNCHER" && note "removed $LAUNCHER"
+    else
+      note "left $LAUNCHER untouched (not a sesh launcher: $(readlink "$LAUNCHER" 2>/dev/null))"
+    fi
+  fi
   remove_if_marker "$COMMAND_DST" "rich interactive picker" && note "removed $COMMAND_DST"
   remove_if_marker "$TOOL_DST" "list opencode sessions for the agent" && note "removed $TOOL_DST"
   remove_if_marker "$PANEL_DST" "@jsxImportSource @opentui/solid" && note "removed $PANEL_DST"
@@ -120,8 +145,8 @@ for tool in bash jq fzf; do
 done
 fzf_version=$(fzf --version 2>/dev/null || true)
 if [[ "$fzf_version" =~ ^([0-9]+)\.([0-9]+)(\.([0-9]+))? ]]; then
-  if [ "$((10#${BASH_REMATCH[1]}))" -eq 0 ] && [ "$((10#${BASH_REMATCH[2]}))" -lt 52 ]; then
-    fail "fzf >= 0.52.0 is required (found $fzf_version)."
+  if [ "$((10#${BASH_REMATCH[1]}))" -eq 0 ] && [ "$((10#${BASH_REMATCH[2]}))" -lt 73 ]; then
+    fail "fzf >= 0.73.0 is required (found $fzf_version)."
   fi
 else
   fail "cannot parse fzf version from: $fzf_version."
@@ -135,6 +160,9 @@ mkdir -p "$BIN_DIR"
 if [ -e "$LAUNCHER" ] && [ ! -L "$LAUNCHER" ]; then
   fail "$LAUNCHER already exists and is not a symlink. Move it aside, then retry."
 fi
+if [ -L "$LAUNCHER" ] && ! launcher_is_ours "$LAUNCHER"; then
+  fail "$LAUNCHER is a symlink to $(readlink "$LAUNCHER" 2>/dev/null), which is not a sesh install. Move it aside, then retry."
+fi
 ln -sfn "$SOURCE_DIR/bin/sesh" "$LAUNCHER"
 note "linked $LAUNCHER -> $SOURCE_DIR/bin/sesh"
 

package/opencode/tools/sesh-list.ts

@@ -12,7 +12,10 @@ export default tool({
   args: {
     limit: tool.schema
       .number()
-      .describe("Maximum sessions to return")
+      .int()
+      .min(0)
+      .max(1000)
+      .describe("Maximum sessions to return (0–1000; 0 returns none)")
       .default(50),
     directory: tool.schema
       .string()
@@ -20,23 +23,29 @@ export default tool({
       .optional(),
   },
   async execute(args) {
+    // Validate here as well as in the schema for direct/programmatic callers.
+    if (!Number.isInteger(args.limit) || args.limit < 0 || args.limit > 1000) {
+      throw new Error("limit must be an integer between 0 and 1000")
+    }
     const bun = (globalThis as any).Bun
     if (!bun || typeof bun.$ !== "function") {
       throw new Error("This tool requires the Bun runtime (globalThis.Bun.$)")
     }
 
-    const out = await bun.$`opencode session list -n ${args.limit} --format json`.json()
-    const sessions = (Array.isArray(out) ? out : []).filter(
-      (s) => !args.directory || s.directory === args.directory,
-    )
-    return JSON.stringify(
-      sessions.map((s) => ({
-        id: s.id,
-        title: s.title,
-        directory: s.directory,
-        updated: s.updated,
-        created: s.created,
-      })),
-    )
+    // `session list` is project-scoped and hides only children of forks. The
+    // global store has no project instance, so query the SQLite session table
+    // directly (OpenCode 1.18.30). Match `Session.listGlobal`/the picker: roots
+    // only, non-archived. Bun quotes the SQL as one shell argument; SQL string
+    // literals need their own escaping as well.
+    const where = args.directory === undefined
+      ? ""
+      : ` AND directory = '${args.directory.replaceAll("'", "''")}'`
+    const query = `SELECT id, title, directory, time_updated AS updated, time_created AS created
+      FROM session WHERE parent_id IS NULL AND time_archived IS NULL${where}
+      ORDER BY time_updated DESC, id DESC LIMIT ${args.limit}`
+    const text = await bun.$`opencode db ${query} --format json`.text()
+    const sessions = JSON.parse(text.trim() || "[]")
+    if (!Array.isArray(sessions)) throw new Error("Unexpected opencode db result: expected an array")
+    return JSON.stringify(sessions)
   },
 })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-sesh",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "Browse, search, preview and resume opencode sessions from the terminal and the TUI.",
   "license": "MIT",
@@ -40,17 +40,23 @@
     "node": ">=20"
   },
   "scripts": {
+    "prepare": "husky",
     "test": "bash tests/sesh.sh",
+    "test:picker": "python3 tests/picker.py",
     "typecheck": "tsc -p tsconfig.json",
-    "lint:sh": "bash -n bin/*.sh bin/sesh install.sh tests/sesh.sh"
+    "lint:sh": "for script in bin/*.sh bin/sesh install.sh tests/*.sh; do bash -n \"$script\" || exit; done",
+    "prepublishOnly": "npm test && npm run typecheck"
   },
   "devDependencies": {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
     "@opencode-ai/plugin": "1.18.30",
     "@opencode-ai/sdk": "1.18.30",
     "@opentui/core": "^0.5.11",
     "@opentui/keymap": "^0.5.11",
     "@opentui/solid": "^0.5.11",
     "@types/node": "26.5.1",
+    "husky": "^9.1.7",
     "solid-js": "1.9.12",
     "typescript": "7.0.2"
   }