pilotswarm 0.5.36 → 0.5.38

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "pilotswarm",
-    "version": "0.5.36",
+    "version": "0.5.38",
     "description": "PilotSwarm application package: terminal UI, browser portal + Web API server, and MCP server — one install, three bins.",
     "type": "module",
     "license": "MIT",
@@ -81,13 +81,13 @@
         "ink": "^6.8.0",
         "jose": "^6.2.2",
         "mermaid": "^11.16.0",
-        "pilotswarm-sdk": "0.5.36",
+        "pilotswarm-sdk": "0.5.38",
         "react": "^19.2.4",
         "react-dom": "^19.2.4",
         "ws": "^8.18.2"
     },
     "devDependencies": {
         "@vitejs/plugin-react": "^5.1.0",
-        "vite": "^7.2.0"
+        "vite": "7.3.5"
     }
 }

package/tui/src/app.js

@@ -932,10 +932,6 @@ export function PilotSwarmTuiApp({ controller, platform, onRequestExit }) {
         }
 
         if (focus === "chat" || focus === "inspector" || focus === "activity") {
-            if (focus === "chat" && plainShortcut && input === "s") {
-                controller.handleCommand(UI_COMMANDS.TOGGLE_CHAT_VIEW).catch(() => {});
-                return;
-            }
             if (key.upArrow || input === "k") {
                 controller.handleCommand(UI_COMMANDS.SCROLL_UP).catch(() => {});
                 return;

package/tui/src/index.js

@@ -158,7 +158,6 @@ export async function startTuiApp(config) {
         mode: config.mode,
         branding: config.branding,
         themeId: userConfig.themeId,
-        chatViewMode: userConfig.chatViewMode,
         sessionOwnerFilter: userConfig.sessionOwnerFilter,
         layoutAdjustments: userConfig.layoutAdjustments,
         pinnedSessionIds: userConfig.pinnedSessionIds,
@@ -255,7 +254,6 @@ export async function startTuiApp(config) {
 
     // Persist theme changes to config file
     let lastPersistedThemeId = store.getState().ui.themeId;
-    let lastPersistedChatViewMode = store.getState().ui.chatViewMode;
     let lastPersistedSessionOwnerFilter = JSON.stringify(store.getState().sessions.ownerFilter || null);
     let lastPersistedLayoutAdjustments = JSON.stringify({
         paneAdjust: store.getState().ui.layout?.paneAdjust || 0,
@@ -268,7 +266,6 @@ export async function startTuiApp(config) {
     store.subscribe(() => {
         const state = store.getState();
         const currentThemeId = state.ui.themeId;
-        const currentChatViewMode = state.ui.chatViewMode;
         const currentSessionOwnerFilter = state.sessions.ownerFilter || null;
         const currentSessionOwnerFilterJson = JSON.stringify(currentSessionOwnerFilter);
         const currentLayoutAdjustments = {
@@ -291,12 +288,6 @@ export async function startTuiApp(config) {
             changed = true;
         }
 
-        if ((currentChatViewMode === "summary" || currentChatViewMode === "transcript") && currentChatViewMode !== lastPersistedChatViewMode) {
-            lastPersistedChatViewMode = currentChatViewMode;
-            patch.chatViewMode = currentChatViewMode;
-            changed = true;
-        }
-
         if (currentSessionOwnerFilterJson !== lastPersistedSessionOwnerFilter) {
             lastPersistedSessionOwnerFilter = currentSessionOwnerFilterJson;
             patch.sessionOwnerFilter = currentSessionOwnerFilter;

package/ui/core/src/canvas-actions.js

@@ -0,0 +1,148 @@
+/**
+ * Canvas response actions — the browser half of the interactive-canvas
+ * contract.
+ *
+ * The agent draws the canvas AND declares, per draw, exactly which structured
+ * responses that page may send back (`responseContract` on `draw_canvas`,
+ * carried in `session.canvas_updated` event data). A page control posts
+ * `{type: "canvas-action", action, data}` to the parent; the CanvasFrame
+ * hands it here. This module is the whole decision:
+ *
+ *   - NO contract on the current canvas → nothing is accepted. Interactivity
+ *     is opt-in per revision, default-closed.
+ *   - The action must be declared, every field must match its declared
+ *     primitive type, no undeclared fields, hard size caps.
+ *
+ * A conforming action is formatted as a canonical `[canvas-action] {...}`
+ * user message. The transcript records it (provenance: it is a real message
+ * from the authenticated viewer), the agent reads the JSON, and the portal
+ * chat HIDES it — the canvas redraw is the user-visible half of the loop.
+ *
+ * Provenance (that the message came from the canvas iframe and not some other
+ * artifact preview) is enforced by the caller: the CanvasFrame accepts
+ * postMessage events only from its own live iframe's contentWindow. This
+ * module assumes that check already happened.
+ */
+
+export const CANVAS_ACTION_PREFIX = "[canvas-action] ";
+
+const ACTION_MAX_STRING_CHARS = 2048;
+const ACTION_MAX_SERIALIZED_BYTES = 8192;
+
+/** Serialized-size guard that tolerates hosts without TextEncoder. */
+function serializedByteLength(value) {
+    // Cyclic objects and BigInts cross postMessage (structured clone) but
+    // make JSON.stringify THROW — and this module's contract is that garbage
+    // is refused, never thrown, because the throw would escape the sync
+    // submit path as an uncaught error. Infinity fails the size check.
+    let json;
+    try {
+        json = JSON.stringify(value) || "";
+    } catch {
+        return Infinity;
+    }
+    if (typeof TextEncoder !== "undefined") return new TextEncoder().encode(json).length;
+    return json.length;
+}
+
+/**
+ * Validate one posted message against the current canvas contract.
+ * Returns `{ok: true, action, data}` or `{ok: false, reason}`; never throws
+ * on garbage — a hostile page must not be able to crash the portal shell.
+ */
+export function validateCanvasAction(contract, message) {
+    const actions = contract?.actions;
+    if (!actions || typeof actions !== "object") {
+        return { ok: false, reason: "the current canvas declares no response contract" };
+    }
+    if (!message || typeof message !== "object" || message.type !== "canvas-action") {
+        return { ok: false, reason: "not a canvas-action message" };
+    }
+    const action = typeof message.action === "string" ? message.action : "";
+    const declaredFields = Object.prototype.hasOwnProperty.call(actions, action) ? actions[action] : null;
+    if (!declaredFields || typeof declaredFields !== "object") {
+        return { ok: false, reason: `action ${JSON.stringify(action)} is not declared by the contract` };
+    }
+    const data = message.data === undefined ? {} : message.data;
+    if (!data || typeof data !== "object" || Array.isArray(data)) {
+        return { ok: false, reason: "data must be an object" };
+    }
+    for (const key of Object.keys(data)) {
+        if (!Object.prototype.hasOwnProperty.call(declaredFields, key)) {
+            return { ok: false, reason: `field ${JSON.stringify(key)} is not declared for action ${JSON.stringify(action)}` };
+        }
+    }
+    const clean = {};
+    for (const [field, declaredRaw] of Object.entries(declaredFields)) {
+        const declared = String(declaredRaw || "");
+        const optional = declared.endsWith("?");
+        const type = optional ? declared.slice(0, -1) : declared;
+        const value = data[field];
+        if (value === undefined || value === null) {
+            if (optional) continue;
+            return { ok: false, reason: `required field ${JSON.stringify(field)} is missing` };
+        }
+        if (type === "json") {
+            // One structured value for batched forms — a 23-item sign-off
+            // submits as a single object, not 23 round trips. Internal shape
+            // is the agent's contract with itself (it authored both sides);
+            // the serialized-size cap below is the only bound that matters.
+            if (typeof value !== "object") {
+                return { ok: false, reason: `field ${JSON.stringify(field)} must be a JSON object or array` };
+            }
+            clean[field] = value;
+            continue;
+        }
+        if (typeof value !== type) {
+            return { ok: false, reason: `field ${JSON.stringify(field)} must be a ${type}` };
+        }
+        if (type === "string" && value.length > ACTION_MAX_STRING_CHARS) {
+            return { ok: false, reason: `field ${JSON.stringify(field)} exceeds ${ACTION_MAX_STRING_CHARS} characters` };
+        }
+        if (type === "number" && !Number.isFinite(value)) {
+            return { ok: false, reason: `field ${JSON.stringify(field)} must be a finite number` };
+        }
+        clean[field] = value;
+    }
+    if (serializedByteLength(clean) > ACTION_MAX_SERIALIZED_BYTES) {
+        return { ok: false, reason: `action payload exceeds ${ACTION_MAX_SERIALIZED_BYTES} bytes` };
+    }
+    return { ok: true, action, data: clean };
+}
+
+/** The canonical wire text — what the agent reads and history flags on. */
+export function formatCanvasActionPrompt(action, data) {
+    return `${CANVAS_ACTION_PREFIX}${JSON.stringify({ action, data })}`;
+}
+
+/** Detector for the history pipelines: is this user message a canvas action? */
+export function isCanvasActionContent(content) {
+    return typeof content === "string" && content.startsWith(CANVAS_ACTION_PREFIX);
+}
+
+/** Parse the canonical text back to {action, data}; null when malformed. */
+export function parseCanvasActionContent(content) {
+    if (!isCanvasActionContent(content)) return null;
+    try {
+        const parsed = JSON.parse(content.slice(CANVAS_ACTION_PREFIX.length));
+        if (!parsed || typeof parsed !== "object" || typeof parsed.action !== "string") return null;
+        return { action: parsed.action, data: parsed.data && typeof parsed.data === "object" ? parsed.data : {} };
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * A small sliding-window rate limiter: at most `burst` accepted actions per
+ * `windowMs`. The page is agent-authored JS speaking AS the viewer, so this
+ * is the bound on a buggy page auto-posting in a loop.
+ */
+export function createCanvasActionLimiter({ burst = 3, windowMs = 3000 } = {}) {
+    const stamps = [];
+    return function tryAcquire(now = Date.now()) {
+        while (stamps.length && now - stamps[0] > windowMs) stamps.shift();
+        if (stamps.length >= burst) return false;
+        stamps.push(now);
+        return true;
+    };
+}

package/ui/core/src/commands.js

@@ -21,7 +21,6 @@ export const UI_COMMANDS = {
     OPEN_MOVE_TO_GROUP: "openMoveToGroup",
     CREATE_SESSION_GROUP: "createSessionGroup",
     OPEN_ARTIFACT_UPLOAD: "openArtifactUpload",
-    TOGGLE_CHAT_VIEW: "toggleChatView",
     CLOSE_MODAL: "closeModal",
     MODAL_PREV: "modalPrev",
     MODAL_NEXT: "modalNext",

package/ui/core/src/controller.js

@@ -1,4 +1,5 @@
 import { UI_COMMANDS, FOCUS_REGIONS, INSPECTOR_TABS, cycleValue } from "./commands.js";
+import { canvasKey as canvasPrefKey } from "./state.js";
 import { parseAgentSourceLink } from "./repo-links.js";
 import { importPackageFilesFromLink, readImportedPackageName } from "./repo-import.js";
 import {
@@ -10,6 +11,7 @@ import {
     getNextHistoryEventLimit,
 } from "./history.js";
 import { applySessionUsageEvent, cloneContextUsageSnapshot } from "./context-usage.js";
+import { validateCanvasAction, formatCanvasActionPrompt, createCanvasActionLimiter } from "./canvas-actions.js";
 import { shouldKeepRecoverableTransportWarning } from "./session-errors.js";
 import {
     computeLegacyLayout,
@@ -2413,6 +2415,17 @@ export class PilotSwarmUiController {
         if (pendingGroupRows) {
             this.dispatch({ type: "sessions/groupsLoaded", groups: pendingGroupRows, sessions });
         }
+        // Canvas summaries ride the list rows (session_canvases join) — seed
+        // the store so rows mark on cold load, before any session is selected
+        // or any live event arrives. Never regresses what live events already
+        // know; see the canvas/seed reducer.
+        const canvasSeed = [];
+        for (const row of sessions) {
+            for (const c of Array.isArray(row?.canvases) ? row.canvases : []) {
+                canvasSeed.push({ sessionId: row.sessionId, slot: c.slot, name: c.name, latestRev: c.latestRev, sizeBytes: c.sizeBytes });
+            }
+        }
+        if (canvasSeed.length) this.dispatch({ type: "canvas/seed", entries: canvasSeed });
         this.dispatch({ type: "sessions/loaded", sessions });
         this.refreshOpenSessionOwnerFilterModal();
         const selected = this.getState().sessions.activeSessionId;
@@ -2444,6 +2457,11 @@ export class PilotSwarmUiController {
             if (!existingHistory?.events?.length) {
                 await this.ensureSessionHistory(selected, { force: true }).catch(() => {});
             }
+            // Boot-restore can hydrate the selection through THIS branch
+            // instead of loadSession (whether the profile poll beats the first
+            // sessions refresh is a race), so the canvas snapshot must be
+            // armed here too. Memoized — refreshes after the first are free.
+            this.ensureCanvasSnapshot(selected).catch(() => {});
             if (this.activeSessionSubscriptionId !== selected) {
                 this.attachActiveSession(selected);
             }
@@ -4163,6 +4181,13 @@ export class PilotSwarmUiController {
         await this.syncSessionDetail(sessionId).catch(() => {});
         this.attachActiveSession(sessionId);
         this.ensureInspectorData().catch(() => {});
+        // Canvas snapshot rides the selection burst. Invalidate-then-fetch on
+        // every selection, deliberately: the live event stream only covers the
+        // ATTACHED session, so a session's canvas knowledge goes stale the
+        // moment you switch away — re-selection is the continuity break, and
+        // one indexed limit-1 row is noise against the burst above.
+        this.dispatch({ type: "canvas/snapshotInvalidate", sessionId });
+        this.ensureCanvasSnapshot(sessionId).catch(() => {});
     }
 
     /**
@@ -4229,6 +4254,188 @@ export class PilotSwarmUiController {
         return true;
     }
 
+    /**
+     * Apply a live `session.canvas_updated` event: converge content always,
+     * flip the right column only when it is unmistakably appropriate.
+     *
+     * Flip guards (the artifact-presented set, plus the user's own choices):
+     * active session only, fresh only, not already in canvas mode, and never
+     * after the user has manually toggled away this session — their explicit
+     * choice downgrades flips to the unseen-changes badge.
+     */
+    applyCanvasUpdate(sessionId, event) {
+        const rev = Number(event?.data?.rev);
+        if (!sessionId || !Number.isFinite(rev) || rev <= 0) return false;
+        const rawSlot = Number(event?.data?.slot);
+        const slot = Number.isInteger(rawSlot) && rawSlot >= 1 && rawSlot <= 5 ? rawSlot : 1;
+        this.dispatch({
+            type: "canvas/updated",
+            sessionId,
+            slot,
+            ...(typeof event?.data?.name === "string" ? { name: event.data.name } : {}),
+            rev,
+            note: typeof event?.data?.note === "string" ? event.data.note : "",
+            sizeBytes: event?.data?.sizeBytes,
+            responseContract: event?.data?.responseContract,
+        });
+
+        const state = this.getState();
+        if (sessionId !== state.sessions.activeSessionId) return true;
+        // The opt-out is PER SLOT: leaving one canvas by hand must not
+        // silence a different canvas's first draw.
+        if (state.canvas.prefs[canvasPrefKey(sessionId, slot)]?.optedOut) return true;
+        const createdAt = event?.createdAt ? Date.parse(event.createdAt) : Number.NaN;
+        if (Number.isFinite(createdAt) && Date.now() - createdAt > PRESENTED_ARTIFACT_FRESHNESS_MS) {
+            return true;
+        }
+        // canvas/flip rather than a plain mode change: it ticks flipSeq even
+        // when the mode is already "canvas", because a phone can be off its
+        // canvas tab while the mode state still says canvas — the tick is
+        // what brings the tab back. On desktop the repeat dispatch is a no-op.
+        this.dispatch({ type: "canvas/flip", sessionId, slot });
+        return true;
+    }
+
+    /**
+     * The cold-load snapshot: one indexed lookup against the full durable log,
+     * fired per session as part of the selection burst and memoized. Its
+     * result is definitive both ways — an event means a canvas exists at that
+     * rev; nothing means none has ever been drawn. The client never
+     * blind-loads canvas.html on a hunch.
+     */
+    /**
+     * A structured response posted by the canvas page, on its way to the
+     * agent. The CanvasFrame already proved provenance (the message came from
+     * the live canvas iframe and nothing else); this is the rest of the
+     * pipeline: validate against the CURRENT revision's contract (no contract
+     * → accept nothing), rate-limit (the page is agent-authored JS speaking
+     * as the viewer), then send it as a real user message through the
+     * ordinary transport path — no outbox, no optimistic chat bubble. The
+     * history pipeline recognizes the canonical prefix and keeps it out of
+     * the portal chat pane; the transcript still records it for provenance.
+     */
+    submitCanvasAction(sessionId, message) {
+        if (!sessionId) return Promise.resolve({ ok: false, reason: "no session" });
+        // Creator-only, mirrored from the server's enforcement (the server is
+        // the authority; this is the friendly refusal). The canvas mutates —
+        // a shared viewer may be looking at a different revision than the one
+        // the creator is conversing through, so their clicks must not speak.
+        const me = this.getState().auth?.principal || null;
+        const ownerRow = this.getState().sessions.byId[sessionId]?.owner || null;
+        if (me && ownerRow && (String(ownerRow.provider || "") !== String(me.provider || "")
+            || String(ownerRow.subject || "") !== String(me.subject || ""))) {
+            return Promise.resolve({ ok: false, reason: "only the session's creator can use canvas controls" });
+        }
+        const contract = this.getState().canvas.bySessionId[sessionId]?.responseContract || null;
+        const verdict = validateCanvasAction(contract, message);
+        if (!verdict.ok) return Promise.resolve(verdict);
+        if (!this.canvasActionLimiters) this.canvasActionLimiters = new Map();
+        let limiter = this.canvasActionLimiters.get(sessionId);
+        if (!limiter) {
+            limiter = createCanvasActionLimiter();
+            this.canvasActionLimiters.set(sessionId, limiter);
+        }
+        if (!limiter()) return Promise.resolve({ ok: false, reason: "rate limited" });
+        const prompt = formatCanvasActionPrompt(verdict.action, verdict.data);
+        return this.transport.sendMessage(sessionId, prompt, { enqueueOnly: true })
+            .then(() => {
+                this.syncSessionEvents(sessionId).catch(() => {});
+                return { ok: true, action: verdict.action };
+            })
+            .catch((error) => ({ ok: false, reason: error?.message || String(error) }));
+    }
+
+    async ensureCanvasSnapshot(sessionId) {
+        if (!sessionId) return;
+        if (this.getState().canvas.bySessionId[sessionId]?.snapshotLoaded) return;
+        if (typeof this.transport.getSessionEventsBefore !== "function") {
+            // A transport without the filtered query (older direct mode) still
+            // converges via live events; record the attempt so we do not spin.
+            this.dispatch({ type: "canvas/snapshot", sessionId, rev: 0 });
+            return;
+        }
+        try {
+            // A 30-event window, not 1: five interleaved slots mean the top
+            // event only describes the most recently drawn slot. Latest per
+            // slot wins; every drawn slot gets its snapshot.
+            const rows = await this.transport.getSessionEventsBefore(
+                sessionId, Number.MAX_SAFE_INTEGER, 30, ["session.canvas_updated"],
+            );
+            const bySlot = new Map();
+            for (const row of Array.isArray(rows) ? rows : []) {
+                const slot = Number(row?.data?.slot) || 1;
+                const rev = Number(row?.data?.rev) || 0;
+                if (!bySlot.has(slot) || rev > (Number(bySlot.get(slot)?.data?.rev) || 0)) bySlot.set(slot, row);
+            }
+            // Always at least a slot-1 snapshot (rev 0 marks snapshotLoaded
+            // so this does not respin).
+            if (!bySlot.has(1)) bySlot.set(1, null);
+            let anyDrawn = false;
+            for (const [slot, top] of bySlot) {
+                const rev = Number(top?.data?.rev) || 0;
+                if (rev > 0) anyDrawn = true;
+                this.dispatch({
+                    type: "canvas/snapshot",
+                    sessionId,
+                    slot,
+                    rev,
+                    ...(typeof top?.data?.name === "string" ? { name: top.data.name } : {}),
+                    note: typeof top?.data?.note === "string" ? top.data.note : "",
+                    sizeBytes: top?.data?.sizeBytes,
+                    responseContract: top?.data?.responseContract,
+                });
+            }
+            // The latest data tick per slot is that page's cold-load state —
+            // replay it so a freshly loaded shell reconstructs without the
+            // agent.
+            if (anyDrawn) {
+                const dataRows = await this.transport.getSessionEventsBefore(
+                    sessionId, Number.MAX_SAFE_INTEGER, 30, ["session.canvas_data"],
+                ).catch(() => []);
+                const tickBySlot = new Map();
+                for (const row of Array.isArray(dataRows) ? dataRows : []) {
+                    const slot = Number(row?.data?.slot) || 1;
+                    const dr = Number(row?.data?.dataRev) || 0;
+                    if (!tickBySlot.has(slot) || dr > (Number(tickBySlot.get(slot)?.data?.dataRev) || 0)) tickBySlot.set(slot, row);
+                }
+                for (const [slot, tick] of tickBySlot) {
+                    if (!tick?.data?.dataRev) continue;
+                    this.dispatch({
+                        type: "canvas/data",
+                        sessionId,
+                        slot,
+                        dataRev: Number(tick.data.dataRev),
+                        payload: tick.data.payload,
+                        note: typeof tick.data.note === "string" ? tick.data.note : "",
+                    });
+                }
+            }
+        } catch {
+            // Leave snapshotLoaded unset — the next selection retries.
+        }
+    }
+
+    /**
+     * An agent asked to PRESENT an already-drawn canvas — no bytes, no rev,
+     * nothing marked unseen. Same guards as a draw's auto-flip: only the
+     * active session, only a fresh event (a reconnect replay must not yank
+     * the view), and the user's manual dismissal of that slot still wins.
+     */
+    applyCanvasPresented(sessionId, event) {
+        const rawSlot = Number(event?.data?.slot);
+        const slot = Number.isInteger(rawSlot) && rawSlot >= 1 && rawSlot <= 5 ? rawSlot : 1;
+        if (!sessionId) return false;
+        const state = this.getState();
+        if (sessionId !== state.sessions.activeSessionId) return false;
+        if (state.canvas.prefs[canvasPrefKey(sessionId, slot)]?.optedOut) return false;
+        const createdAt = event?.createdAt ? Date.parse(event.createdAt) : Number.NaN;
+        if (Number.isFinite(createdAt) && Date.now() - createdAt > PRESENTED_ARTIFACT_FRESHNESS_MS) {
+            return false;
+        }
+        this.dispatch({ type: "canvas/flip", sessionId, slot });
+        return true;
+    }
+
     mergeSessionEvent(sessionId, event) {
         if (!sessionId || !event) return false;
         const state = this.getState();
@@ -4279,6 +4486,27 @@ export class PilotSwarmUiController {
         if (event.eventType === "session.artifact_presented") {
             this.maybeRevealPresentedArtifact(sessionId, event);
         }
+        // Canvas: CONTENT convergence is ungated — a stale canvas_updated in a
+        // reconnect replay must still advance latestRev and refresh a mounted
+        // pane. Only the FLIP is guarded (below). This deliberately diverges
+        // from artifact_presented, which drops stale events outright: a
+        // presentation is an action, a canvas is state.
+        if (event.eventType === "session.canvas_updated") {
+            this.applyCanvasUpdate(sessionId, event);
+        }
+        if (event.eventType === "session.canvas_presented") {
+            this.applyCanvasPresented(sessionId, event);
+        }
+        if (event.eventType === "session.canvas_data") {
+            this.dispatch({
+                type: "canvas/data",
+                sessionId,
+                slot: Number(event?.data?.slot) || 1,
+                dataRev: Number(event?.data?.dataRev),
+                payload: event?.data?.payload,
+                note: typeof event?.data?.note === "string" ? event.data.note : "",
+            });
+        }
         this.reconcileOutboxAgainstEvent(sessionId, event);
         const derivedModel = extractSessionModelFromEvent(event);
         const currentSession = this.getState().sessions.byId[sessionId] || { sessionId };
@@ -4453,6 +4681,15 @@ export class PilotSwarmUiController {
         const eligible = this.getMovableGroupSessionSelection();
 
         if (eligible.length === 0) {
+            // With a GROUP active, the folder button means "this group":
+            // rename it. (Creating from here always made a second group —
+            // reported as a surprise on the phone.)
+            const active = state.sessions.activeSessionId
+                ? state.sessions.byId[state.sessions.activeSessionId]
+                : null;
+            if (active?.isGroup && active.groupId) {
+                return this.openRenameGroupModal(active);
+            }
             // Nothing selected is a legitimate intent: make an empty folder to
             // drag sessions into, rather than scolding the user.
             return this.openCreateEmptyGroupModal();
@@ -4521,6 +4758,32 @@ export class PilotSwarmUiController {
         return this.openMoveToGroupModal();
     }
 
+    /** Rename the active group in place (same modal, rename mode). */
+    openRenameGroupModal(group) {
+        if (typeof this.transport.updateSessionGroup !== "function") {
+            this.dispatch({ type: "ui/status", text: "Group rename is not supported by this transport" });
+            return null;
+        }
+        const state = this.getState();
+        const current = String(group.title || "").trim();
+        this.dispatch({
+            type: "ui/modal",
+            modal: {
+                type: "sessionGroupName",
+                mode: "rename",
+                groupId: group.groupId,
+                title: "Rename Group",
+                previousFocus: state.ui.focusRegion,
+                sessionIds: [],
+                value: current,
+                cursorIndex: current.length,
+                maxLength: 80,
+            },
+        });
+        this.dispatch({ type: "ui/status", text: "Edit the group name and press Enter" });
+        return null;
+    }
+
     /** Name-and-create an EMPTY group (no sessions), ready to drag into. */
     async openCreateEmptyGroupModal() {
         if (typeof this.transport.createSessionGroup !== "function") {
@@ -4672,6 +4935,19 @@ export class PilotSwarmUiController {
             this.dispatch({ type: "ui/status", text: "Group name cannot be empty" });
             return;
         }
+        if (modal.mode === "rename" && modal.groupId) {
+            const previousFocusRename = modal.previousFocus;
+            this.dispatch({ type: "ui/modal", modal: null });
+            if (previousFocusRename) this.setFocus(previousFocusRename);
+            try {
+                await this.transport.updateSessionGroup(modal.groupId, { title });
+                this.dispatch({ type: "ui/status", text: `Renamed group to "${title}"` });
+                await this.refreshSessions().catch(() => {});
+            } catch (error) {
+                this.dispatch({ type: "ui/status", text: `Rename failed: ${error?.message || String(error)}` });
+            }
+            return;
+        }
         if (typeof this.transport.createSessionGroup !== "function") {
             this.dispatch({ type: "ui/status", text: "Session grouping is not supported by this transport" });
             return;
@@ -4728,22 +5004,7 @@ export class PilotSwarmUiController {
         return sessionId ? state.sessions.byId[sessionId] || null : null;
     }
 
-    toggleChatViewMode() {
-        const activeSession = this.getActiveSession();
-        if (activeSession?.isGroup) {
-            this.dispatch({ type: "ui/status", text: "Session groups show group details" });
-            return;
-        }
-        const nextMode = this.getState().ui?.chatViewMode === "summary" ? "transcript" : "summary";
-        this.dispatch({ type: "ui/chatViewMode", mode: nextMode });
-        this.dispatch({ type: "ui/status", text: nextMode === "summary" ? "Showing session summary" : "Showing chat transcript" });
-    }
 
-    setChatViewMode(mode) {
-        if (mode !== "summary" && mode !== "transcript") return;
-        if (this.getActiveSession()?.isGroup) return;
-        this.dispatch({ type: "ui/chatViewMode", mode });
-    }
 
     /**
      * Opens the agent step of the new-session flow.
@@ -7257,7 +7518,15 @@ export class PilotSwarmUiController {
 
     applyPaneVisualScrollOffset(pane, offset, options = {}, state = this.getState()) {
         const maxOffset = this.getPaneMaxScrollOffset(pane, state);
-        const nextOffset = Math.max(0, Math.min(Number(offset) || 0, maxOffset));
+        // fromViewport: the offset was measured off the real DOM (scrollTop /
+        // row height), which the browser has already bounded. Clamping it
+        // against the CONTROLLER's max — counted in TUI render-metric rows, a
+        // different unit — teleported the pane on the first wheel tick: one
+        // 100px notch re-applied as metric-max × 16px, thousands of pixels
+        // away. The two row spaces must never clamp each other.
+        const nextOffset = options.fromViewport
+            ? Math.max(0, Number(offset) || 0)
+            : Math.max(0, Math.min(Number(offset) || 0, maxOffset));
         if (this.paneUsesStickyBottomFollow(pane, state)) {
             const followBottom = options.followBottom !== undefined
                 ? Boolean(options.followBottom)
@@ -7276,7 +7545,7 @@ export class PilotSwarmUiController {
     updatePaneScrollFromViewport(pane, offset, options = {}) {
         const state = this.getState();
         if (this.paneUsesStickyBottomFollow(pane, state)) {
-            this.applyPaneVisualScrollOffset(pane, offset, options, state);
+            this.applyPaneVisualScrollOffset(pane, offset, { ...options, fromViewport: true }, state);
             return;
         }
         this.scrollPaneTo(pane, offset);
@@ -7829,7 +8098,9 @@ export class PilotSwarmUiController {
                     pane: "chat",
                     offset: 0,
                 });
-            } else if (preserveChatView && previousScrollOffset > 0) {
+            } else if (preserveChatView && previousScrollOffset > 0 && !options.autoTriggered) {
+                // EXPLICIT "load older" (the TUI's `e`): jump up to the start
+                // of what was just fetched — the user asked to SEE it.
                 const nextState = this.getState();
                 const nextRenderedLines = this.getActiveChatRenderMetrics(nextState).totalLines;
                 const addedLines = Math.max(0, nextRenderedLines - previousRenderedLines);
@@ -7841,6 +8112,13 @@ export class PilotSwarmUiController {
                     });
                 }
             }
+            // AUTO-triggered (scrolling reached the top): change NOTHING. The
+            // offset is distance-from-BOTTOM, which prepended content cannot
+            // move — leaving it alone keeps the viewport glued to the exact
+            // messages the user was reading, and they scroll on into the new
+            // page naturally. Adding the delta here teleported the view to
+            // the TOP of a 3.3x-larger window — observed as "loading history
+            // takes you way back instead of a few pages up".
 
             const stateLabel = history.hasOlderEvents
                 ? options.autoTriggered
@@ -8523,9 +8801,6 @@ export class PilotSwarmUiController {
             case UI_COMMANDS.OPEN_ARTIFACT_UPLOAD:
                 this.openArtifactUploadModal();
                 return;
-            case UI_COMMANDS.TOGGLE_CHAT_VIEW:
-                this.toggleChatViewMode();
-                return;
             case UI_COMMANDS.CLOSE_MODAL:
                 this.closeModal();
                 return;