pilotswarm 0.5.13 → 0.5.14

package/tui/src/node-sdk-transport.js

@@ -710,10 +710,48 @@ export class NodeSdkTransport {
         return this.mgmt.listSessionsPage(opts);
     }
 
+    async listSessionsVisible(viewer) {
+        return this.mgmt.listSessionsVisible(viewer);
+    }
+
+    async listKnownUsers(opts) {
+        return this.mgmt.listKnownUsers(opts);
+    }
+
     async getSession(sessionId) {
         return this.mgmt.getSession(sessionId);
     }
 
+    // ── Session sharing / access (security model) ────────────────
+
+    async getSessionAccess(sessionId, viewer) {
+        return this.mgmt.getSessionAccess(sessionId, viewer);
+    }
+
+    async setSessionVisibility(sessionId, visibility) {
+        return this.mgmt.setSessionVisibility(sessionId, visibility);
+    }
+
+    async grantSessionShare(sessionId, grantee, access, grantedBy) {
+        return this.mgmt.grantSessionShare(sessionId, grantee, access, grantedBy);
+    }
+
+    async revokeSessionShare(sessionId, grantee) {
+        return this.mgmt.revokeSessionShare(sessionId, grantee);
+    }
+
+    async listSessionShares(sessionId) {
+        return this.mgmt.listSessionShares(sessionId);
+    }
+
+    async recordAuthzAudit(entry) {
+        return this.mgmt.recordAuthzAudit(entry);
+    }
+
+    async listAuthzAudit(opts) {
+        return this.mgmt.listAuthzAudit(opts);
+    }
+
     async getOrchestrationStats(sessionId) {
         return this.mgmt.getOrchestrationStats(sessionId);
     }
@@ -963,7 +1001,7 @@ export class NodeSdkTransport {
         );
     }
 
-    async createSession({ model, reasoningEffort, contextTier, owner, groupId } = {}) {
+    async createSession({ model, reasoningEffort, contextTier, owner, groupId, visibility } = {}) {
         const effectiveModel = await this.assertSessionModelCreatable({ model, owner });
         const session = await this.client.createSession({
             ...(effectiveModel ? { model: effectiveModel } : {}),
@@ -971,12 +1009,13 @@ export class NodeSdkTransport {
             ...(contextTier ? { contextTier } : {}),
             ...(owner ? { owner } : {}),
             ...(groupId ? { groupId } : {}),
+            ...(visibility ? { visibility } : {}),
         });
         this.sessionHandles.set(session.sessionId, session);
         return { sessionId: session.sessionId, model: effectiveModel, reasoningEffort: reasoningEffort || undefined, contextTier: contextTier || undefined };
     }
 
-    async createSessionForAgent(agentName, { model, reasoningEffort, contextTier, title, splash, splashMobile, initialPrompt, owner, groupId } = {}) {
+    async createSessionForAgent(agentName, { model, reasoningEffort, contextTier, title, splash, splashMobile, initialPrompt, owner, groupId, visibility } = {}) {
         const effectiveModel = await this.assertSessionModelCreatable({ model, owner });
         const session = await this.client.createSessionForAgent(agentName, {
             ...(effectiveModel ? { model: effectiveModel } : {}),
@@ -988,6 +1027,7 @@ export class NodeSdkTransport {
             ...(initialPrompt ? { initialPrompt } : {}),
             ...(owner ? { owner } : {}),
             ...(groupId ? { groupId } : {}),
+            ...(visibility ? { visibility } : {}),
         });
         this.sessionHandles.set(session.sessionId, session);
         return {
@@ -1027,9 +1067,14 @@ export class NodeSdkTransport {
             throw new Error(buildTerminalSendError(sessionId, session));
         }
 
-        const sendOptions = options?.clientMessageIds && Array.isArray(options.clientMessageIds) && options.clientMessageIds.length > 0
-            ? { clientMessageIds: options.clientMessageIds }
-            : undefined;
+        const sendOptions = {
+            ...(options?.clientMessageIds && Array.isArray(options.clientMessageIds) && options.clientMessageIds.length > 0
+                ? { clientMessageIds: options.clientMessageIds }
+                : {}),
+            // Server-stamped sender identity (security model) — set by the
+            // portal runtime from the validated auth context.
+            ...(options?.sender && typeof options.sender === "object" ? { sender: options.sender } : {}),
+        };
 
         if (options?.enqueueOnly) {
             // enqueueOnly originally routed through mgmt.sendMessage to skip
@@ -1054,11 +1099,11 @@ export class NodeSdkTransport {
         // "Working…" forever. Propagate the error so the caller can retry
         // through the full sessionHandle.send path that owns the start.
         const sessionHandle = await this.getSessionHandle(sessionId);
-        await sessionHandle.send(prompt);
+        await sessionHandle.send(prompt, sendOptions);
     }
 
-    async sendAnswer(sessionId, answer) {
-        await this.mgmt.sendAnswer(sessionId, answer);
+    async sendAnswer(sessionId, answer, options = {}) {
+        await this.mgmt.sendAnswer(sessionId, answer, options?.sender ? { sender: options.sender } : undefined);
     }
 
     async sendSessionEvent(sessionId, eventName, data) {

package/tui/tui-splash-mobile.txt

@@ -1,7 +1,5 @@
-{bold}{cyan-fg}█▀█ █ █   █▀█ ▀█▀{/cyan-fg} {magenta-fg}█▀ █ █ █ ▄▀█ █▀█ █▀▄▀█{/magenta-fg}{/bold}
-{bold}{cyan-fg}█▀▀ █ █▄▄ █▄█  █ {/cyan-fg} {magenta-fg}▄█ ▀▄▀▄▀ █▀█ █▀▄ █ ▀ █{/magenta-fg}{/bold}
-{yellow-fg}░▒▓██████████████████████████████████▓▒░{/yellow-fg}
- {bold}{white-fg}Durable AI Agent Orchestration{/white-fg}{/bold}
- {cyan-fg}Crash recovery{/cyan-fg} · {magenta-fg}Durable timers{/magenta-fg}
- {yellow-fg}Sub-agents{/yellow-fg} · {green-fg}Multi-node scaling{/green-fg}
- {gray-fg}Powered by duroxide + Copilot SDK{/gray-fg}
+{bold}{green-fg}█▀█ █ █   █▀█ ▀█▀ █▀ █ █ █ ▄▀█ █▀█ █▀▄▀█{/green-fg}{/bold}
+{bold}{green-fg}█▀▀ █ █▄▄ █▄█  █  ▄█ ▀▄▀▄▀ █▀█ █▀▄ █ ▀ █{/green-fg}{/bold}
+{green-fg}░▒▓██████████████████████████████████▓▒░{/green-fg}
+ {bold}{white-fg}Cluster Orchestrator{/white-fg}{/bold}
+ {green-fg}Agents{/green-fg} · {yellow-fg}Infra{/yellow-fg} · {cyan-fg}Maintenance{/cyan-fg}

package/tui/tui-splash.txt

@@ -1,11 +1,15 @@
-{bold}{cyan-fg}
-    ____  _ __      __  _____                              
-   / __ \(_) /___  / /_/ ___/      ______ __________ ___  
-{/cyan-fg}{magenta-fg}  / /_/ / / / __ \/ __/\__ \ | /| / / __ `/ ___/ __ `__ \
- / ____/ / / /_/ / /_ ___/ / |/ |/ / /_/ / /  / / / / / /{/magenta-fg}
-{yellow-fg}/_/   /_/_/\____/\__//____/|__/|__/\__,_/_/  /_/ /_/ /_/ {/yellow-fg}
+{bold}
+{red-fg}██████╗ ██╗██╗      ██████╗ ████████╗███████╗██╗    ██╗ █████╗ ██████╗ ███╗   ███╗{/red-fg}
+{yellow-fg}██╔══██╗██║██║     ██╔═══██╗╚══██╔══╝██╔════╝██║    ██║██╔══██╗██╔══██╗████╗ ████║{/yellow-fg}
+{green-fg}██████╔╝██║██║     ██║   ██║   ██║   ███████╗██║ █╗ ██║███████║██████╔╝██╔████╔██║{/green-fg}
+{cyan-fg}██╔═══╝ ██║██║     ██║   ██║   ██║   ╚════██║██║███╗██║██╔══██║██╔══██╗██║╚██╔╝██║{/cyan-fg}
+{blue-fg}██║     ██║███████╗╚██████╔╝   ██║   ███████║╚███╔███╔╝██║  ██║██║  ██║██║ ╚═╝ ██║{/blue-fg}
+{magenta-fg}╚═╝     ╚═╝╚══════╝ ╚═════╝    ╚═╝   ╚══════╝ ╚══╝╚══╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝     ╚═╝{/magenta-fg}
 {/bold}
+{cyan-fg}   ╔═════════════════════════════════════════════════════════════════════╗{/cyan-fg}
+{cyan-fg}   ║{/cyan-fg}{bold}{white-fg}               C l u s t e r   O r c h e s t r a t o r               {/white-fg}{/bold}{cyan-fg}║{/cyan-fg}
+{cyan-fg}   ╚═════════════════════════════════════════════════════════════════════╝{/cyan-fg}
 
-  {bold}{white-fg}Durable AI Agent Orchestration{/white-fg}{/bold}
-  {cyan-fg}Crash recovery{/cyan-fg} · {magenta-fg}Durable timers{/magenta-fg} · {yellow-fg}Sub-agents{/yellow-fg} · {green-fg}Multi-node scaling{/green-fg}
-  {gray-fg}Powered by duroxide + GitHub Copilot SDK{/gray-fg}
+  {bold}{cyan-fg}Agents{/cyan-fg} · {yellow-fg}Infrastructure{/yellow-fg} · {green-fg}Maintenance{/green-fg} · {magenta-fg}Monitoring{/magenta-fg}{/bold}
+  {bold}{red-fg}Spawn{/red-fg} · {cyan-fg}Steer{/cyan-fg} · {yellow-fg}Sweep{/yellow-fg} · {blue-fg}Scale{/blue-fg}{/bold}
+  {gray-fg}Many agents. One formation.{/gray-fg}

package/ui/core/src/commands.js

@@ -76,6 +76,8 @@ export const UI_COMMANDS = {
     STOP_TURN: "stopTurn",
     DELETE_SESSION: "deleteSession",
     PIN_SESSION: "pinSession",
+    CYCLE_SESSION_VISIBILITY: "cycleSessionVisibility",
+    OPEN_SHARE_SESSION: "openShareSession",
     TOGGLE_SELECT_MODE: "toggleSelectMode",
     TOGGLE_SESSION_SELECTION: "toggleSessionSelection",
     CLEAR_SESSION_SELECTION: "clearSessionSelection",

package/ui/core/src/controller.js

@@ -1423,13 +1423,33 @@ export class PilotSwarmUiController {
             this.scheduleSessionsRefresh(250);
             return true;
         })().catch((error) => {
-            // Revert the merged envelope back to the original pending items so
-            // the user can edit/retry them.
+            const authRefused = error?.code === "FORBIDDEN" || error?.code === "UNAUTHORIZED"
+                || error?.status === 403 || error?.status === 401;
             const items = this.getSessionOutbox(sessionId);
-            const reverted = items.flatMap((item) => (
-                item.id === mergedItem.id ? pendingItems : [item]
-            ));
-            this.setSessionOutboxItems(sessionId, reverted);
+            if (authRefused) {
+                // Authorization refusals are terminal — retrying can't succeed.
+                // Mark the envelope rejected (renders as the red ✗, same as a
+                // cancelled send) and drop it shortly after instead of leaving
+                // a forever-pending item.
+                const rejected = items.map((item) => (
+                    item.id === mergedItem.id ? { ...item, phase: "rejected" } : item
+                ));
+                this.setSessionOutboxItems(sessionId, rejected);
+                setTimeout(() => {
+                    const current = this.getSessionOutbox(sessionId);
+                    const remaining = current.filter((item) => !(item.id === mergedItem.id && item.phase === "rejected"));
+                    if (remaining.length !== current.length) {
+                        this.setSessionOutboxItems(sessionId, remaining);
+                    }
+                }, 6000);
+            } else {
+                // Transient failure: revert the merged envelope back to the
+                // original pending items so the user can edit/retry them.
+                const reverted = items.flatMap((item) => (
+                    item.id === mergedItem.id ? pendingItems : [item]
+                ));
+                this.setSessionOutboxItems(sessionId, reverted);
+            }
             this.dispatch({
                 type: "ui/status",
                 text: error?.message || String(error),
@@ -4351,6 +4371,245 @@ export class PilotSwarmUiController {
         }
     }
 
+    /**
+     * Cycle the active session's general visibility:
+     * private → shared_read → shared_write → private. Visibility is a
+     * per-session property, so system sessions and group rows are refused.
+     */
+    async cycleSessionVisibility() {
+        const state = this.getState();
+        const sessionId = state.sessions.activeSessionId;
+        const session = sessionId ? state.sessions.byId[sessionId] : null;
+        if (!session) {
+            this.dispatch({ type: "ui/status", text: "No session selected" });
+            return;
+        }
+        if (session.isSystem) {
+            this.dispatch({ type: "ui/status", text: "System sessions are always private" });
+            return;
+        }
+        if (session.isGroup) {
+            this.dispatch({ type: "ui/status", text: "Groups don't have visibility" });
+            return;
+        }
+        if (typeof this.transport.setSessionVisibility !== "function") {
+            this.dispatch({ type: "ui/status", text: "Not supported by this transport" });
+            return;
+        }
+        const next = cycleValue(
+            ["private", "shared_read", "shared_write"],
+            session.visibility || "private",
+            1,
+        );
+        try {
+            await this.transport.setSessionVisibility(sessionId, next);
+            await this.refreshSessions();
+            this.dispatch({ type: "ui/status", text: `Visibility → ${next}` });
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+        }
+    }
+
+    /**
+     * Open the Share modal for the active session: shows the general
+     * visibility plus the per-person grant list, with a single input line
+     * for edits — `name [r|w]` grants, `-name` revokes. The current grants
+     * are loaded up front so the modal (and revoke matching) can render
+     * them without another round trip.
+     */
+    async openShareSessionModal() {
+        const state = this.getState();
+        const sessionId = state.sessions.activeSessionId;
+        const session = sessionId ? state.sessions.byId[sessionId] : null;
+        if (!session) {
+            this.dispatch({ type: "ui/status", text: "No session selected" });
+            return;
+        }
+        if (session.isSystem) {
+            this.dispatch({ type: "ui/status", text: "System sessions are always private" });
+            return;
+        }
+        if (session.isGroup) {
+            this.dispatch({ type: "ui/status", text: "Groups can't be shared" });
+            return;
+        }
+        if (typeof this.transport.listSessionShares !== "function") {
+            this.dispatch({ type: "ui/status", text: "Session sharing is not supported by this transport" });
+            return;
+        }
+        let shares;
+        try {
+            shares = await this.transport.listSessionShares(sessionId);
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+            return;
+        }
+        this.dispatch({
+            type: "ui/modal",
+            modal: {
+                type: "shareSession",
+                title: `Share (${shortSessionIdValue(sessionId)})`,
+                sessionId,
+                previousFocus: state.ui.focusRegion,
+                value: "",
+                cursorIndex: 0,
+                shares: Array.isArray(shares) ? shares : [],
+                visibility: session.visibility || "private",
+            },
+        });
+        this.dispatch({ type: "ui/status", text: "name [r|w] grants · -name revokes · Enter apply" });
+    }
+
+    updateShareSessionModal(updater) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return null;
+        const nextModal = typeof updater === "function" ? updater(modal) : updater;
+        if (!nextModal) return null;
+        this.dispatch({ type: "ui/modal", modal: { ...modal, ...nextModal } });
+        return this.getState().ui.modal;
+    }
+
+    setShareSessionValue(value, cursorIndex = String(value || "").length) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const safeValue = clampRenameSessionValue(value, 120);
+        const safeCursor = clampPromptCursor(safeValue, cursorIndex);
+        this.updateShareSessionModal({ value: safeValue, cursorIndex: safeCursor });
+    }
+
+    insertShareSessionText(text) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const next = insertPromptTextAtCursor(modal.value || "", modal.cursorIndex || 0, clampRenameSessionValue(text, 120));
+        this.setShareSessionValue(next.prompt, next.cursor);
+    }
+
+    deleteShareSessionChar() {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const next = deletePromptCharBackward(modal.value || "", modal.cursorIndex || 0);
+        this.setShareSessionValue(next.prompt, next.cursor);
+    }
+
+    moveShareSessionCursor(delta) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        this.setShareSessionValue(modal.value || "", clampPromptCursor(modal.value || "", (modal.cursorIndex || 0) + delta));
+    }
+
+    moveShareSessionCursorToBoundary(kind) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        this.setShareSessionValue(modal.value || "", kind === "start" ? 0 : String(modal.value || "").length);
+    }
+
+    /**
+     * Apply the typed share command. Empty input just closes the modal.
+     * `-name` (or `revoke name`) revokes an existing grant; anything else
+     * grants, with an optional trailing r/read/w/write access token
+     * (default read). The grantee is resolved against the member directory
+     * when the transport exposes it; unmatched text falls back to a raw
+     * subject so a grant can target someone who has never signed in —
+     * an email-keyed grant binds at their first sign-in.
+     */
+    async confirmShareSessionModal() {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const sessionId = modal.sessionId;
+        if (!sessionId) return;
+
+        const raw = String(modal.value || "").trim();
+        const previousFocus = modal.previousFocus;
+        if (!raw) {
+            this.dispatch({ type: "ui/modal", modal: null });
+            if (previousFocus) this.setFocus(previousFocus);
+            return;
+        }
+
+        // Revoke: `-name` or `revoke name` targets an existing grant by
+        // subject, email, or display name (case-insensitive).
+        const revokeWho = raw.startsWith("-")
+            ? raw.slice(1).trim()
+            : (raw.toLowerCase().startsWith("revoke ") ? raw.slice("revoke ".length).trim() : null);
+        if (revokeWho !== null) {
+            const needle = revokeWho.toLowerCase();
+            const grant = (modal.shares || []).find((row) =>
+                (row.subject && String(row.subject).toLowerCase() === needle)
+                || (row.email && String(row.email).toLowerCase() === needle)
+                || (row.displayName && String(row.displayName).toLowerCase() === needle));
+            if (!grant) {
+                this.dispatch({ type: "ui/status", text: `No grant matching "${revokeWho}"` });
+                return;
+            }
+            this.dispatch({ type: "ui/modal", modal: null });
+            if (previousFocus) this.setFocus(previousFocus);
+            try {
+                await this.transport.revokeSessionShare(sessionId, { provider: grant.provider, subject: grant.subject });
+                this.dispatch({ type: "ui/status", text: `Revoked ${revokeWho}` });
+            } catch (error) {
+                this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+            }
+            return;
+        }
+
+        // Grant: an optional trailing access token picks read/write.
+        const tokens = raw.split(/\s+/);
+        const accessByToken = { r: "read", read: "read", w: "write", write: "write" };
+        const lastToken = tokens.length > 1 ? tokens[tokens.length - 1].toLowerCase() : null;
+        const access = lastToken && accessByToken[lastToken] ? accessByToken[lastToken] : "read";
+        const who = lastToken && accessByToken[lastToken] ? tokens.slice(0, -1).join(" ") : raw;
+
+        // Resolve the typed text against the member directory: an exact
+        // displayName/email/subject match wins; otherwise a unique partial
+        // match is accepted and multiple partial matches are ambiguous.
+        const needle = who.toLowerCase();
+        let grantee = null;
+        if (typeof this.transport.listKnownUsers === "function") {
+            let users = [];
+            try {
+                users = await this.transport.listKnownUsers({ limit: 500 });
+            } catch {
+                users = [];
+            }
+            const candidates = Array.isArray(users) ? users : [];
+            grantee = candidates.find((user) =>
+                (user.displayName && user.displayName.toLowerCase() === needle)
+                || (user.email && user.email.toLowerCase() === needle)
+                || (user.subject && user.subject.toLowerCase() === needle)) || null;
+            if (!grantee) {
+                const partial = candidates.filter((user) =>
+                    (user.displayName && user.displayName.toLowerCase().includes(needle))
+                    || (user.email && user.email.toLowerCase().includes(needle))
+                    || (user.subject && user.subject.toLowerCase().includes(needle)));
+                if (partial.length === 1) {
+                    grantee = partial[0];
+                } else if (partial.length > 1) {
+                    this.dispatch({ type: "ui/status", text: `"${who}" is ambiguous (${partial.length} matches)` });
+                    return;
+                }
+            }
+        }
+        if (!grantee) {
+            // Not-yet-seen user: treat the text as a raw subject under the
+            // caller's provider (mirrors the portal's resolveGrantee).
+            const principal = this.getState().auth?.principal || null;
+            grantee = { provider: principal?.provider || "dev", subject: who, email: null, displayName: null };
+        }
+
+        this.dispatch({ type: "ui/modal", modal: null });
+        if (previousFocus) this.setFocus(previousFocus);
+        try {
+            await this.transport.grantSessionShare(
+                sessionId,
+                { provider: grantee.provider, subject: grantee.subject, email: grantee.email ?? null, displayName: grantee.displayName ?? null },
+                access,
+            );
+            this.dispatch({ type: "ui/status", text: `Granted ${access} to ${who}` });
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+        }
+    }
+
     closeModal() {
         const modal = this.getState().ui.modal;
         if (!modal) return;
@@ -4455,6 +4714,10 @@ export class PilotSwarmUiController {
             await this.confirmRenameSessionModal();
             return;
         }
+        if (modal.type === "shareSession") {
+            await this.confirmShareSessionModal();
+            return;
+        }
         if (modal.type === "sessionGroupPicker") {
             await this.confirmSessionGroupPickerModal();
             return;
@@ -6261,6 +6524,12 @@ export class PilotSwarmUiController {
             case UI_COMMANDS.OPEN_RENAME_SESSION:
                 this.openRenameSessionModal();
                 return;
+            case UI_COMMANDS.CYCLE_SESSION_VISIBILITY:
+                await this.cycleSessionVisibility();
+                return;
+            case UI_COMMANDS.OPEN_SHARE_SESSION:
+                await this.openShareSessionModal();
+                return;
             case UI_COMMANDS.OPEN_SESSION_FILTER:
                 this.openSessionOwnerFilter();
                 return;

package/ui/core/src/history.js

@@ -353,16 +353,33 @@ export function dedupeChatMessages(chat = []) {
     return deduped;
 }
 
+// In a multi-writer session the runtime prepends a `[FROM: name (relation)]`
+// attribution line to the prompt so the agent knows who is speaking. The chat
+// pane conveys the same thing through the message's speaker label + color, so
+// strip the raw marker from the DISPLAY text (the structured `sender` below
+// drives the label). Only a leading marker is removed.
+function stripLeadingSenderMarker(text) {
+    return typeof text === "string"
+        ? text.replace(/^\[FROM:[^\]\n]*\]\n?/, "")
+        : text;
+}
+
 function buildChatMessage(event, role) {
     const rawText = messageTextFromEvent(event);
     const sessionMessageCard = buildSessionMessageChatCard(event, rawText);
     if (sessionMessageCard) return sessionMessageCard;
 
-    const text = extractVisibleChatText(rawText, role);
+    const text = stripLeadingSenderMarker(extractVisibleChatText(rawText, role));
     if (!hasVisibleMessageText(text)) return null;
     const clientMessageIds = Array.isArray(event?.data?.clientMessageIds)
         ? event.data.clientMessageIds.filter((id) => typeof id === "string" && id)
         : [];
+    // Structured sender identity (security model): who sent this message. The
+    // chat selector uses it to label the line with the sender's name and a
+    // distinct color when it is not the current viewer.
+    const sender = event?.data?.sender && typeof event.data.sender === "object"
+        ? event.data.sender
+        : null;
     return {
         id: `${event.sessionId}:${event.seq}`,
         role: deriveChatRole(event, role, text),
@@ -370,6 +387,7 @@ function buildChatMessage(event, role) {
         time: formatTimestamp(event.createdAt),
         createdAt: event.createdAt instanceof Date ? event.createdAt.getTime() : new Date(event.createdAt).getTime(),
         ...(clientMessageIds.length > 0 ? { clientMessageIds } : {}),
+        ...(sender ? { sender } : {}),
     };
 }
 

package/ui/core/src/reducer.js

@@ -1000,6 +1000,10 @@ export function appReducer(state, action) {
                 ui: {
                     ...state.ui,
                     chatScrollBySession: savedChatScroll,
+                    // Status notices are per-moment, usually per-session (send
+                    // refusals, access hints) — a stale one must not follow the
+                    // user to the next session.
+                    statusText: previousActiveId !== action.sessionId ? "" : state.ui.statusText,
                     scroll: {
                         ...state.ui.scroll,
                         chat: Number(savedChatScroll[action.sessionId]) || 0,