pilotswarm 0.5.13 → 0.5.15

package/ui/core/src/controller.js

@@ -92,7 +92,9 @@ function normalizeSessionListRow(session) {
     if (session.isGroup) return session;
     return {
         ...session,
-        groupId: session.groupId ?? null,
+        // The wire DTO carries the viewer-private placement as viewerGroupId;
+        // the local groupId field is what the tree/selectors key off.
+        groupId: session.viewerGroupId ?? null,
         parentSessionId: session.parentSessionId ?? null,
     };
 }
@@ -101,6 +103,30 @@ function sessionGroupIdFromRowId(sessionId) {
     return String(sessionId || "").startsWith("group:") ? String(sessionId).slice("group:".length) : null;
 }
 
+// Per-row placement skip reasons ('system', 'not_found') folded into a short
+// status-bar suffix, e.g. "2 system, 1 not found".
+function summarizePlacementSkips(rows) {
+    const counts = new Map();
+    for (const row of rows || []) {
+        const label = row?.reason === "system" ? "system" : "not found";
+        counts.set(label, (counts.get(label) || 0) + 1);
+    }
+    return [...counts.entries()].map(([label, count]) => `${count} ${label}`).join(", ");
+}
+
+// Deep-link load failures split into two renderable kinds: a definitive
+// not-found/no-access answer from the server (the API deliberately returns
+// identical shapes for unknown vs unshared sessions), and everything else —
+// network/server faults — which stays retryable.
+function classifyNavigationLoadError(error) {
+    const status = Number(error?.status);
+    const code = String(error?.code || "").toUpperCase();
+    if (status === 404 || status === 403 || code === "NOT_FOUND" || code === "FORBIDDEN") {
+        return "not_found";
+    }
+    return "network";
+}
+
 async function loadSessionCatalogPageWindow(transport) {
     if (typeof transport.listSessionsPage !== "function") {
         return transport.listSessions();
@@ -506,6 +532,12 @@ function buildSessionOwnerFilterItems(state) {
             ownerKey: principalKey,
             description: "Show sessions owned by the authenticated user currently signed in.",
         });
+        items.push({
+            id: "shared",
+            kind: "shared",
+            label: "Shared with me",
+            description: "Show sessions other users have shared with you.",
+        });
     }
 
     const ownersByKey = new Map();
@@ -542,6 +574,7 @@ export function defaultOwnerFilterForPrincipal(principal) {
             includeSystem: true,
             includeUnowned: false,
             includeMe: true,
+            includeShared: true,
             ownerKeys: [],
         }
         : {
@@ -549,6 +582,7 @@ export function defaultOwnerFilterForPrincipal(principal) {
             includeSystem: false,
             includeUnowned: false,
             includeMe: false,
+            includeShared: false,
             ownerKeys: [],
         };
 }
@@ -558,6 +592,7 @@ function ownerFilterHasSelections(filter) {
         filter?.includeSystem
         || filter?.includeUnowned
         || filter?.includeMe
+        || filter?.includeShared
         || (Array.isArray(filter?.ownerKeys) && filter.ownerKeys.length > 0),
     );
 }
@@ -571,6 +606,7 @@ function toggleOwnerFilterItem(currentFilter, item, principal) {
             includeSystem: false,
             includeUnowned: false,
             includeMe: false,
+            includeShared: false,
             ownerKeys: [],
         };
     }
@@ -583,6 +619,7 @@ function toggleOwnerFilterItem(currentFilter, item, principal) {
     if (item.kind === "system") next.includeSystem = !next.includeSystem;
     if (item.kind === "unowned") next.includeUnowned = !next.includeUnowned;
     if (item.kind === "me") next.includeMe = !next.includeMe;
+    if (item.kind === "shared") next.includeShared = !next.includeShared;
     if (item.kind === "owner" && item.ownerKey) {
         const existingIndex = next.ownerKeys.indexOf(item.ownerKey);
         if (existingIndex >= 0) {
@@ -594,7 +631,7 @@ function toggleOwnerFilterItem(currentFilter, item, principal) {
 
     return ownerFilterHasSelections(next)
         ? next
-        : { all: true, includeSystem: false, includeUnowned: false, includeMe: false, ownerKeys: [] };
+        : { all: true, includeSystem: false, includeUnowned: false, includeMe: false, includeShared: false, ownerKeys: [] };
 }
 
 function getRenameSessionPrefix(session) {
@@ -1423,13 +1460,33 @@ export class PilotSwarmUiController {
             this.scheduleSessionsRefresh(250);
             return true;
         })().catch((error) => {
-            // Revert the merged envelope back to the original pending items so
-            // the user can edit/retry them.
+            const authRefused = error?.code === "FORBIDDEN" || error?.code === "UNAUTHORIZED"
+                || error?.status === 403 || error?.status === 401;
             const items = this.getSessionOutbox(sessionId);
-            const reverted = items.flatMap((item) => (
-                item.id === mergedItem.id ? pendingItems : [item]
-            ));
-            this.setSessionOutboxItems(sessionId, reverted);
+            if (authRefused) {
+                // Authorization refusals are terminal — retrying can't succeed.
+                // Mark the envelope rejected (renders as the red ✗, same as a
+                // cancelled send) and drop it shortly after instead of leaving
+                // a forever-pending item.
+                const rejected = items.map((item) => (
+                    item.id === mergedItem.id ? { ...item, phase: "rejected" } : item
+                ));
+                this.setSessionOutboxItems(sessionId, rejected);
+                setTimeout(() => {
+                    const current = this.getSessionOutbox(sessionId);
+                    const remaining = current.filter((item) => !(item.id === mergedItem.id && item.phase === "rejected"));
+                    if (remaining.length !== current.length) {
+                        this.setSessionOutboxItems(sessionId, remaining);
+                    }
+                }, 6000);
+            } else {
+                // Transient failure: revert the merged envelope back to the
+                // original pending items so the user can edit/retry them.
+                const reverted = items.flatMap((item) => (
+                    item.id === mergedItem.id ? pendingItems : [item]
+                ));
+                this.setSessionOutboxItems(sessionId, reverted);
+            }
             this.dispatch({
                 type: "ui/status",
                 text: error?.message || String(error),
@@ -1676,7 +1733,7 @@ export class PilotSwarmUiController {
         }).catch(() => {});
     }
 
-    async start() {
+    async start({ initialSessionId = null } = {}) {
         await this.transport.start();
         const authContext = typeof this.transport.getAuthContext === "function"
             ? this.transport.getAuthContext()
@@ -1707,6 +1764,13 @@ export class PilotSwarmUiController {
             workersOnline: typeof this.transport.getWorkerCount === "function" ? this.transport.getWorkerCount() : null,
             statusText: "Connected",
         });
+        // Latch the deep-link intent AFTER the default owner-filter dispatch
+        // (a filter change releases the latch) and BEFORE the first refresh,
+        // so the first catalog load resolves selection onto the link target.
+        const deepLinkSessionId = String(initialSessionId || "").trim();
+        if (deepLinkSessionId) {
+            this.dispatch({ type: "sessions/navigationIntent", sessionId: deepLinkSessionId });
+        }
         await this.refreshSessions();
         this.catalogTimer = setInterval(() => {
             this.refreshSessions().catch((error) => {
@@ -1762,6 +1826,36 @@ export class PilotSwarmUiController {
                 sessions = [...groupRows, ...sessions];
             }
         }
+        // A pending deep-link target may be readable but absent from the
+        // paged catalog window — fetch it explicitly. A definitive failure
+        // (unknown or unshared: identical 404 shapes) fails the intent; the
+        // reducer then refuses fallback selection so the renderer can show
+        // the nav error instead of silently landing somewhere else.
+        const pendingIntent = preRefreshState.sessions.navigationIntent;
+        if (
+            pendingIntent?.status === "pending"
+            && !sessions.some((session) => session?.sessionId === pendingIntent.sessionId)
+            && typeof this.transport.getSession === "function"
+        ) {
+            try {
+                const intentSession = await this.transport.getSession(pendingIntent.sessionId);
+                if (intentSession?.sessionId) {
+                    sessions = [...sessions, normalizeSessionListRow(intentSession)];
+                } else {
+                    this.dispatch({
+                        type: "sessions/navigationIntentFailed",
+                        sessionId: pendingIntent.sessionId,
+                        errorKind: "not_found",
+                    });
+                }
+            } catch (error) {
+                this.dispatch({
+                    type: "sessions/navigationIntentFailed",
+                    sessionId: pendingIntent.sessionId,
+                    errorKind: classifyNavigationLoadError(error),
+                });
+            }
+        }
         const active = previousActive;
         if (
             active
@@ -1787,7 +1881,20 @@ export class PilotSwarmUiController {
         if (selected) {
             if (selected !== previousActive) {
                 if (!this.getState().sessions.byId[selected]?.isGroup) {
-                    await this.loadSession(selected);
+                    const selectedIntent = this.getState().sessions.navigationIntent;
+                    if (selectedIntent && selectedIntent.sessionId === selected && selectedIntent.status !== "failed") {
+                        try {
+                            await this.loadSession(selected);
+                        } catch (error) {
+                            this.dispatch({
+                                type: "sessions/navigationIntentFailed",
+                                sessionId: selected,
+                                errorKind: classifyNavigationLoadError(error),
+                            });
+                        }
+                    } else {
+                        await this.loadSession(selected);
+                    }
                 }
                 return;
             }
@@ -2999,6 +3106,32 @@ export class PilotSwarmUiController {
         });
     }
 
+    /**
+     * Latch a navigation intent (deep link) onto a session id. The intent
+     * outranks in-memory selection and the profile's activeSessionId until
+     * the user navigates manually or changes a filter. Also the retry path
+     * for a failed intent: re-latching resets it to pending.
+     */
+    setNavigationIntent(sessionId) {
+        const id = String(sessionId || "").trim();
+        if (!id) return;
+        this.dispatch({ type: "sessions/navigationIntent", sessionId: id });
+        const state = this.getState();
+        if (state.sessions.byId[id]) {
+            this.loadSession(id).catch((error) => {
+                this.dispatch({
+                    type: "sessions/navigationIntentFailed",
+                    sessionId: id,
+                    errorKind: classifyNavigationLoadError(error),
+                });
+            });
+            return;
+        }
+        if (Object.keys(state.sessions.byId).length > 0) {
+            this.scheduleSessionsRefresh(0);
+        }
+    }
+
     async loadSession(sessionId) {
         if (!sessionId) return;
         const active = this.getState().sessions.activeSessionId;
@@ -3174,7 +3307,9 @@ export class PilotSwarmUiController {
 
     async createSession(options = {}) {
         try {
-            const created = await this.transport.createSession(this.applyActiveGroupDefault(options));
+            const requestOptions = this.applyActiveGroupDefault(options);
+            const created = await this.transport.createSession(requestOptions);
+            await this.placeCreatedSessionInGroup(created, requestOptions.groupId ?? null);
             await this.refreshSessions();
             await this.loadSession(created.sessionId);
             this.setFocus(FOCUS_REGIONS.PROMPT);
@@ -3191,7 +3326,9 @@ export class PilotSwarmUiController {
             throw new Error("Named-agent session creation is not supported by this transport");
         }
         try {
-            const created = await this.transport.createSessionForAgent(agentName, this.applyActiveGroupDefault(options));
+            const requestOptions = this.applyActiveGroupDefault(options);
+            const created = await this.transport.createSessionForAgent(agentName, requestOptions);
+            await this.placeCreatedSessionInGroup(created, requestOptions.groupId ?? null);
             await this.refreshSessions();
             await this.loadSession(created.sessionId);
             this.setFocus(FOCUS_REGIONS.PROMPT);
@@ -3206,6 +3343,20 @@ export class PilotSwarmUiController {
         }
     }
 
+    /**
+     * Post-create placement follow-up. createSession's groupId only places
+     * when an owner principal reaches the catalog (web mode places
+     * server-side; the local TUI passes no owner), so when a group was
+     * requested, place explicitly — idempotent where the server already did.
+     * Skipped when the create response already reports the placement.
+     */
+    async placeCreatedSessionInGroup(created, groupId) {
+        if (!groupId || !created?.sessionId) return;
+        if (typeof this.transport.placeSessionsInGroup !== "function") return;
+        if ((created.viewerGroupId ?? null) === groupId) return;
+        await this.transport.placeSessionsInGroup([created.sessionId], groupId).catch(() => {});
+    }
+
     getMovableGroupSessionSelection() {
         const state = this.getState();
         const selectedIds = Array.isArray(state.sessions.selectedIds) && state.sessions.selectedIds.length > 0
@@ -3229,16 +3380,12 @@ export class PilotSwarmUiController {
             return null;
         }
 
+        // The server returns only the viewer's own groups, and placement is
+        // viewer-private — any readable non-system selection is movable, so
+        // mixed-owner selections are allowed and every group is offered.
         const groups = await this.transport.listSessionGroups().catch(() => []);
         const sessionIds = eligible.map((session) => session.sessionId);
         const firstGroupId = eligible.length === 1 ? eligible[0].groupId || null : null;
-        const selectedOwnerKeys = new Set(eligible.map((session) => ownerKeyForPrincipal(session.owner) || ""));
-        const singleOwnerKey = selectedOwnerKeys.size === 1 ? [...selectedOwnerKeys][0] : null;
-        const singleOwner = selectedOwnerKeys.size === 1 ? eligible[0]?.owner ?? null : null;
-        const compatibleGroups = selectedOwnerKeys.size === 1
-            ? (Array.isArray(groups) ? groups : []).filter((group) => (ownerKeyForPrincipal(group.owner) || "") === singleOwnerKey)
-            : [];
-        const canCreateOrAssignGroup = selectedOwnerKeys.size === 1;
         const items = [
             {
                 id: "__no_group__",
@@ -3248,22 +3395,20 @@ export class PilotSwarmUiController {
                 groupId: null,
                 memberCount: 0,
             },
-            ...(canCreateOrAssignGroup ? [{
+            {
                 id: "__new_group__",
                 kind: "newGroup",
                 label: "[New Group]",
-                description: "Create a new group for this owner, then move the selected session(s) into it.",
+                description: "Create a new group, then move the selected session(s) into it.",
                 groupId: null,
                 memberCount: 0,
-                owner: singleOwner,
-            }] : []),
-            ...compatibleGroups.map((group) => ({
+            },
+            ...(Array.isArray(groups) ? groups : []).map((group) => ({
                 id: group.groupId,
                 kind: "group",
                 label: group.title || group.groupId,
                 description: group.description || "Move selected session(s) into this group.",
                 groupId: group.groupId,
-                owner: group.owner ?? null,
                 memberCount: group.memberCount ?? 0,
             })),
         ];
@@ -3285,9 +3430,7 @@ export class PilotSwarmUiController {
         });
         this.dispatch({
             type: "ui/status",
-            text: canCreateOrAssignGroup
-                ? "Choose a group, [New Group], or [No Group]"
-                : "Selected sessions have different owners; only [No Group] is available",
+            text: "Choose a group, [New Group], or [No Group]",
         });
         return items;
     }
@@ -3302,7 +3445,10 @@ export class PilotSwarmUiController {
             this.dispatch({ type: "ui/status", text: "No sessions selected to move" });
             return null;
         }
-        if (typeof this.transport.moveSessionsToGroup === "function") {
+        let placementResults = null;
+        if (typeof this.transport.placeSessionsInGroup === "function") {
+            placementResults = await this.transport.placeSessionsInGroup(ids, groupId ?? null);
+        } else if (typeof this.transport.moveSessionsToGroup === "function") {
             await this.transport.moveSessionsToGroup(groupId ?? null, ids);
         } else if (groupId && typeof this.transport.assignSessionsToGroup === "function") {
             await this.transport.assignSessionsToGroup(groupId, ids);
@@ -3311,17 +3457,28 @@ export class PilotSwarmUiController {
             return null;
         }
 
+        const resultRows = Array.isArray(placementResults) ? placementResults.filter(Boolean) : null;
+        const skippedRows = resultRows ? resultRows.filter((row) => row.placed !== true) : [];
+        const placedCount = resultRows
+            ? resultRows.filter((row) => row.placed === true).length
+            : ids.length;
+
         this.dispatch({ type: "sessions/selectClear" });
         await this.refreshSessions();
-        if (groupId) {
+        if (groupId && placedCount > 0) {
             await this.loadSession(`group:${groupId}`).catch(() => {});
         }
         const target = groupId ? `group ${statusTitle || groupId}` : "No Group";
+        const skippedSummary = skippedRows.length > 0
+            ? ` · skipped ${skippedRows.length} (${summarizePlacementSkips(skippedRows)})`
+            : "";
         this.dispatch({
             type: "ui/status",
-            text: `Moved ${ids.length} session${ids.length === 1 ? "" : "s"} to ${target}`,
+            text: placedCount > 0
+                ? `Moved ${placedCount} session${placedCount === 1 ? "" : "s"} to ${target}${skippedSummary}`
+                : `No sessions moved to ${target}${skippedSummary}`,
         });
-        return true;
+        return placedCount > 0;
     }
 
     async confirmSessionGroupPickerModal() {
@@ -3340,7 +3497,6 @@ export class PilotSwarmUiController {
                     title: "New Group",
                     previousFocus: modal.previousFocus,
                     sessionIds: modal.sessionIds || [],
-                    owner: item.owner ?? null,
                     value: baseTitle,
                     cursorIndex: baseTitle.length,
                     maxLength: 80,
@@ -3420,11 +3576,14 @@ export class PilotSwarmUiController {
         if (previousFocus) this.setFocus(previousFocus);
 
         try {
+            // No owner key: the transport/server stamps the caller's
+            // principal. The UI never infers group ownership from the
+            // selected sessions (owner: null is reserved for the portal
+            // runtime's anonymous path).
             const group = await this.transport.createSessionGroup({
                 title,
                 description: `${(modal.sessionIds || []).length} grouped session${(modal.sessionIds || []).length === 1 ? "" : "s"}`,
                 sessionIds: modal.sessionIds || [],
-                owner: modal.owner ?? null,
             });
             await this.moveSessionsToGroup(group.groupId, modal.sessionIds || [], { statusTitle: group.title || title });
         } catch (error) {
@@ -3684,15 +3843,21 @@ export class PilotSwarmUiController {
         this.dispatch({ type: "ui/status", text: "Select a model and press Enter" });
     }
 
-    async openSwitchModelPicker() {
+    async openSwitchModelPicker(onApplied = null) {
+        // Callers (e.g. the portal Manage modal) can be notified when a switch
+        // is actually applied — distinct from cancelling the picker — so they
+        // can close/reopen their own chrome accordingly.
+        this._onSwitchModelApplied = typeof onApplied === "function" ? onApplied : null;
         const state = this.getState();
         const sessionId = state.sessions.activeSessionId;
         const session = sessionId ? state.sessions.byId[sessionId] || null : null;
         if (!session || session.isGroup) {
+            this._onSwitchModelApplied = null;
             this.dispatch({ type: "ui/status", text: "Select a session before switching model" });
             return;
         }
         if (typeof this.transport.setSessionModel !== "function") {
+            this._onSwitchModelApplied = null;
             this.dispatch({ type: "ui/status", text: "Model switching is not supported by this transport" });
             return;
         }
@@ -3725,6 +3890,11 @@ export class PilotSwarmUiController {
         const tierSuffix = options.contextTier ? ` · ${CONTEXT_TIER_LABELS[options.contextTier] || options.contextTier}` : "";
         this.dispatch({ type: "ui/status", text: `Next turn will use ${modelLabel}${tierSuffix}` });
         await this.refreshSessions();
+        // Notify a Manage-modal-style caller that the switch was applied (vs
+        // cancelled), so it can close rather than reopen.
+        const onApplied = this._onSwitchModelApplied;
+        this._onSwitchModelApplied = null;
+        if (typeof onApplied === "function") onApplied();
     }
 
     openHelpModal() {
@@ -4351,6 +4521,245 @@ export class PilotSwarmUiController {
         }
     }
 
+    /**
+     * Cycle the active session's general visibility:
+     * private → shared_read → shared_write → private. Visibility is a
+     * per-session property, so system sessions and group rows are refused.
+     */
+    async cycleSessionVisibility() {
+        const state = this.getState();
+        const sessionId = state.sessions.activeSessionId;
+        const session = sessionId ? state.sessions.byId[sessionId] : null;
+        if (!session) {
+            this.dispatch({ type: "ui/status", text: "No session selected" });
+            return;
+        }
+        if (session.isSystem) {
+            this.dispatch({ type: "ui/status", text: "System sessions are always private" });
+            return;
+        }
+        if (session.isGroup) {
+            this.dispatch({ type: "ui/status", text: "Groups don't have visibility" });
+            return;
+        }
+        if (typeof this.transport.setSessionVisibility !== "function") {
+            this.dispatch({ type: "ui/status", text: "Not supported by this transport" });
+            return;
+        }
+        const next = cycleValue(
+            ["private", "shared_read", "shared_write"],
+            session.visibility || "private",
+            1,
+        );
+        try {
+            await this.transport.setSessionVisibility(sessionId, next);
+            await this.refreshSessions();
+            this.dispatch({ type: "ui/status", text: `Visibility → ${next}` });
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+        }
+    }
+
+    /**
+     * Open the Share modal for the active session: shows the general
+     * visibility plus the per-person grant list, with a single input line
+     * for edits — `name [r|w]` grants, `-name` revokes. The current grants
+     * are loaded up front so the modal (and revoke matching) can render
+     * them without another round trip.
+     */
+    async openShareSessionModal() {
+        const state = this.getState();
+        const sessionId = state.sessions.activeSessionId;
+        const session = sessionId ? state.sessions.byId[sessionId] : null;
+        if (!session) {
+            this.dispatch({ type: "ui/status", text: "No session selected" });
+            return;
+        }
+        if (session.isSystem) {
+            this.dispatch({ type: "ui/status", text: "System sessions are always private" });
+            return;
+        }
+        if (session.isGroup) {
+            this.dispatch({ type: "ui/status", text: "Groups can't be shared" });
+            return;
+        }
+        if (typeof this.transport.listSessionShares !== "function") {
+            this.dispatch({ type: "ui/status", text: "Session sharing is not supported by this transport" });
+            return;
+        }
+        let shares;
+        try {
+            shares = await this.transport.listSessionShares(sessionId);
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+            return;
+        }
+        this.dispatch({
+            type: "ui/modal",
+            modal: {
+                type: "shareSession",
+                title: `Share (${shortSessionIdValue(sessionId)})`,
+                sessionId,
+                previousFocus: state.ui.focusRegion,
+                value: "",
+                cursorIndex: 0,
+                shares: Array.isArray(shares) ? shares : [],
+                visibility: session.visibility || "private",
+            },
+        });
+        this.dispatch({ type: "ui/status", text: "name [r|w] grants · -name revokes · Enter apply" });
+    }
+
+    updateShareSessionModal(updater) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return null;
+        const nextModal = typeof updater === "function" ? updater(modal) : updater;
+        if (!nextModal) return null;
+        this.dispatch({ type: "ui/modal", modal: { ...modal, ...nextModal } });
+        return this.getState().ui.modal;
+    }
+
+    setShareSessionValue(value, cursorIndex = String(value || "").length) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const safeValue = clampRenameSessionValue(value, 120);
+        const safeCursor = clampPromptCursor(safeValue, cursorIndex);
+        this.updateShareSessionModal({ value: safeValue, cursorIndex: safeCursor });
+    }
+
+    insertShareSessionText(text) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const next = insertPromptTextAtCursor(modal.value || "", modal.cursorIndex || 0, clampRenameSessionValue(text, 120));
+        this.setShareSessionValue(next.prompt, next.cursor);
+    }
+
+    deleteShareSessionChar() {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const next = deletePromptCharBackward(modal.value || "", modal.cursorIndex || 0);
+        this.setShareSessionValue(next.prompt, next.cursor);
+    }
+
+    moveShareSessionCursor(delta) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        this.setShareSessionValue(modal.value || "", clampPromptCursor(modal.value || "", (modal.cursorIndex || 0) + delta));
+    }
+
+    moveShareSessionCursorToBoundary(kind) {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        this.setShareSessionValue(modal.value || "", kind === "start" ? 0 : String(modal.value || "").length);
+    }
+
+    /**
+     * Apply the typed share command. Empty input just closes the modal.
+     * `-name` (or `revoke name`) revokes an existing grant; anything else
+     * grants, with an optional trailing r/read/w/write access token
+     * (default read). The grantee is resolved against the member directory
+     * when the transport exposes it; unmatched text falls back to a raw
+     * subject so a grant can target someone who has never signed in —
+     * an email-keyed grant binds at their first sign-in.
+     */
+    async confirmShareSessionModal() {
+        const modal = this.getState().ui.modal;
+        if (!modal || modal.type !== "shareSession") return;
+        const sessionId = modal.sessionId;
+        if (!sessionId) return;
+
+        const raw = String(modal.value || "").trim();
+        const previousFocus = modal.previousFocus;
+        if (!raw) {
+            this.dispatch({ type: "ui/modal", modal: null });
+            if (previousFocus) this.setFocus(previousFocus);
+            return;
+        }
+
+        // Revoke: `-name` or `revoke name` targets an existing grant by
+        // subject, email, or display name (case-insensitive).
+        const revokeWho = raw.startsWith("-")
+            ? raw.slice(1).trim()
+            : (raw.toLowerCase().startsWith("revoke ") ? raw.slice("revoke ".length).trim() : null);
+        if (revokeWho !== null) {
+            const needle = revokeWho.toLowerCase();
+            const grant = (modal.shares || []).find((row) =>
+                (row.subject && String(row.subject).toLowerCase() === needle)
+                || (row.email && String(row.email).toLowerCase() === needle)
+                || (row.displayName && String(row.displayName).toLowerCase() === needle));
+            if (!grant) {
+                this.dispatch({ type: "ui/status", text: `No grant matching "${revokeWho}"` });
+                return;
+            }
+            this.dispatch({ type: "ui/modal", modal: null });
+            if (previousFocus) this.setFocus(previousFocus);
+            try {
+                await this.transport.revokeSessionShare(sessionId, { provider: grant.provider, subject: grant.subject });
+                this.dispatch({ type: "ui/status", text: `Revoked ${revokeWho}` });
+            } catch (error) {
+                this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+            }
+            return;
+        }
+
+        // Grant: an optional trailing access token picks read/write.
+        const tokens = raw.split(/\s+/);
+        const accessByToken = { r: "read", read: "read", w: "write", write: "write" };
+        const lastToken = tokens.length > 1 ? tokens[tokens.length - 1].toLowerCase() : null;
+        const access = lastToken && accessByToken[lastToken] ? accessByToken[lastToken] : "read";
+        const who = lastToken && accessByToken[lastToken] ? tokens.slice(0, -1).join(" ") : raw;
+
+        // Resolve the typed text against the member directory: an exact
+        // displayName/email/subject match wins; otherwise a unique partial
+        // match is accepted and multiple partial matches are ambiguous.
+        const needle = who.toLowerCase();
+        let grantee = null;
+        if (typeof this.transport.listKnownUsers === "function") {
+            let users = [];
+            try {
+                users = await this.transport.listKnownUsers({ limit: 500 });
+            } catch {
+                users = [];
+            }
+            const candidates = Array.isArray(users) ? users : [];
+            grantee = candidates.find((user) =>
+                (user.displayName && user.displayName.toLowerCase() === needle)
+                || (user.email && user.email.toLowerCase() === needle)
+                || (user.subject && user.subject.toLowerCase() === needle)) || null;
+            if (!grantee) {
+                const partial = candidates.filter((user) =>
+                    (user.displayName && user.displayName.toLowerCase().includes(needle))
+                    || (user.email && user.email.toLowerCase().includes(needle))
+                    || (user.subject && user.subject.toLowerCase().includes(needle)));
+                if (partial.length === 1) {
+                    grantee = partial[0];
+                } else if (partial.length > 1) {
+                    this.dispatch({ type: "ui/status", text: `"${who}" is ambiguous (${partial.length} matches)` });
+                    return;
+                }
+            }
+        }
+        if (!grantee) {
+            // Not-yet-seen user: treat the text as a raw subject under the
+            // caller's provider (mirrors the portal's resolveGrantee).
+            const principal = this.getState().auth?.principal || null;
+            grantee = { provider: principal?.provider || "dev", subject: who, email: null, displayName: null };
+        }
+
+        this.dispatch({ type: "ui/modal", modal: null });
+        if (previousFocus) this.setFocus(previousFocus);
+        try {
+            await this.transport.grantSessionShare(
+                sessionId,
+                { provider: grantee.provider, subject: grantee.subject, email: grantee.email ?? null, displayName: grantee.displayName ?? null },
+                access,
+            );
+            this.dispatch({ type: "ui/status", text: `Granted ${access} to ${who}` });
+        } catch (error) {
+            this.dispatch({ type: "ui/status", text: error?.message || String(error) });
+        }
+    }
+
     closeModal() {
         const modal = this.getState().ui.modal;
         if (!modal) return;
@@ -4455,6 +4864,10 @@ export class PilotSwarmUiController {
             await this.confirmRenameSessionModal();
             return;
         }
+        if (modal.type === "shareSession") {
+            await this.confirmShareSessionModal();
+            return;
+        }
         if (modal.type === "sessionGroupPicker") {
             await this.confirmSessionGroupPickerModal();
             return;
@@ -6261,6 +6674,12 @@ export class PilotSwarmUiController {
             case UI_COMMANDS.OPEN_RENAME_SESSION:
                 this.openRenameSessionModal();
                 return;
+            case UI_COMMANDS.CYCLE_SESSION_VISIBILITY:
+                await this.cycleSessionVisibility();
+                return;
+            case UI_COMMANDS.OPEN_SHARE_SESSION:
+                await this.openShareSessionModal();
+                return;
             case UI_COMMANDS.OPEN_SESSION_FILTER:
                 this.openSessionOwnerFilter();
                 return;