Make code session discovery repository-aware and resume state roots explicitly

[atyrode]

Context

A trusted code session in tyrode-infra persisted successfully under ~/.omp/agent/sessions, but a separate top-level OMP process could not resolve it through history://. This is not proof of lost state: history:// is a live harness-roster lookup, not a filesystem session index.

Persisted OMP sessions currently span several state models:

• trusted/generated code launches force OMP profile default;
• the wrapper's UUID shim scans default and named-profile roots only when no explicit state selector is present;
• explicit OMP_PROFILE, PI_CODING_AGENT_DIR, PI_CONFIG_DIR, --profile, or --session-dir bypass that scan;
• generated one-shot --config overlays should not change session-root identity;
• untrusted sessions are intentionally isolated and refuse resume flags;
• history:// only knows agents registered to the current live harness session.

The result is both a discovery problem and a weak resume experience: a persisted session can appear hidden, and code cannot yet prioritize sessions belonging to the repository where it was opened.

Goal

Give code one deterministic, metadata-only, repository-aware way to discover and resume trusted sessions across every managed state root, while clearly separating persisted OMP sessions from live history:// agents.

The TUI should make history available without permanently consuming generator space, support direct resume and resume-with-customization, and keep the selected launch target unambiguous until launch or explicit clearing.

Related tracking

• Blocked for recorded launch-recipe restoration by Record and restore non-secret code launch recipes per OMP session #6. This issue can deliver discovery and current-setup resume first; Record and restore non-secret code launch recipes per OMP session #6 owns versioned non-secret launch receipts and compatible recorded-setting restoration.
• Related follow-up Investigate an in-session OMP provider-usage footer dotfiles#220 investigates an in-session OMP provider-usage footer. It is not a dependency of session discovery.

Scope

1. One trusted state-root resolver

Reuse one resolver for code discovery/launches and the omp resume shim.

• Search the default root, named profiles, and supported explicit session directories selectable by code.
• Resolve a full ID or prefix to exactly one (canonical trusted state root, full session ID) tuple before launch.
• Preserve deterministic ambiguity protection across roots.
• When a session is outside the active root, select that root explicitly or show the exact safe resume command.
• Keep ompu state outside all trusted discovery and clearly report that untrusted sessions are intentionally non-resumable.

2. Metadata-only repository-aware discovery

Read only an explicit metadata allowlist:

• session title;
• full session ID;
• recorded canonical cwd;
• repository/worktree identity when determinable;
• profile/state root;
• creation time and last activity.

Do not inspect prompts, messages, tool output, transcript bodies, or credentials to summarize a session.

Rank results deterministically:

1. exact current-directory match;
2. same Git repository/worktree;
3. recorded cwd in a parent/child relationship;
4. sessions elsewhere by last activity.

The default history view prioritizes the current repository, with an explicit route to all trusted sessions. Missing/deleted cwd values, symlinks, and linked worktrees must degrade safely.

3. Collapsible history rail

History is collapsed by default on the left of the code TUI and reserves no unexplained empty pane width while collapsed.

When expanded:

• a keyboard-navigable session list appears on the left;
• focused-row changes update an adjacent compact, read-only settings inspection;
• pointer hover may mirror focus where supported, but every action and setting remains fully keyboard accessible;
• the normal editable generator becomes a compact selected session settings view showing only values recorded or safely known for the focused session, rather than every available generator option;
• unavailable historical values are labeled unknown rather than inferred from transcript content;
• the compact inspection should let the history rail remain useful without forcing the full generator to retain its normal width;
• narrow terminals use a drawer/full-screen history composition rather than crushing history, generator, routing, usage, or help into unreadable columns.

Focusing or hovering a row is inspection only. It must never launch that session and must not silently replace an already selected pending resume target.

4. Explicit resume target and customization flow

The history surface provides two intentional paths:

1. resume a resolved session with the current compatible setup; or
2. choose resume, customize profile first through a discoverable keyboard action.

Customization must:

• explicitly select the resolved session as the pending resume target;
• collapse history again;
• restore the generator's normal editable profile/facet controls;
• retain the selected session until the user explicitly clears or replaces it;
• show a persistent resume summary next to the generator launch action, including title and an unambiguous ID suffix;
• change the final action language from Launch new to Resume <title> · <ID>;
• never treat focusing/hovering another history row as target replacement;
• provide a clear action that returns to a new-session launch.

The launch target is model state, not a visual side effect. Resize, usage refresh, vault-manager entry, routing collapse, and generator edits must not clear or replace it.

5. Current versus recorded settings

This issue owns discovery and resume with current setup. OMP remains responsible for replaying its own session state.

Recorded code launch settings are a separate contract owned by #6. Until a valid root-scoped receipt exists:

• show only safely available metadata;
• do not reconstruct generated routing by scanning transcript bodies;
• do not claim that the original vault or generator profile is known;
• keep current selected vault and current Nix-managed policy as the default resume setup.

Resume with current setup and resume, customize profile first have different model precedence. Pinned OMP v17 intentionally restores the session's last active model and thinking state when no explicit model is supplied; a generated one-shot config changing the default role is not itself an explicit model override. Therefore:

• direct resume with no model/profile customization preserves the session-owned active model and thinking state when compatible;
• choosing resume, customize profile first and selecting a generator profile/default model is explicit user intent, so that selected model must win instead of being silently replaced by the session's previous model;
• an explicit forwarded code --resume <ID> --model <MODEL> override must also win;
• if the chosen vault cannot authenticate the restored or selected model, stop with an actionable choice rather than silently switching model or identity.

This is a launcher precedence/UX contract, not evidence that OMP replay is corrupt: #6 owns the launch-recipe and argv implementation details.

A future receipt lookup must happen only after this issue resolves the exact (canonical trusted state root, full session ID) tuple; an ID prefix alone can never select a receipt.

6. Documentation

Explain the difference between:

• persisted OMP sessions;
• top-level OMP processes;
• live history:// agents;
• OMP session replay;
• current code launch setup;
• optional recorded launch recipes from Record and restore non-secret code launch recipes per OMP session #6;
• intentionally isolated untrusted sessions.

Delivery plan and progress

Phase 1 — resolver and metadata

• Extract and test the canonical trusted state-root resolver.
• Resolve IDs/prefixes to exactly one root plus full ID.
• Define and enforce the metadata allowlist.
• Add deterministic repository/worktree ranking.
• Cover missing cwd, symlink, worktree, and duplicate-prefix cases.

Phase 2 — history TUI

• Add the collapsed-by-default left history rail with no reserved empty width.
• Add keyboard navigation and optional pointer focus parity.
• Add compact focused-session settings inspection.
• Preserve responsive wide, medium, narrow, and short layouts.
• Keep row focus/hover inspection-only and non-launching.

Phase 3 — resume target state

• Add direct current-setup resume from a resolved session.
• Add the resume, customize profile first keyboard action.
• Preserve the pending target while history collapses and generator editing resumes.
• Render an unambiguous new-versus-resume launch summary/action.
• Add explicit clear/replace behavior for the pending target.

Phase 4 — integration and documentation

• Route code and the omp UUID shim through the shared resolver contract.
• Verify generated one-shot configs preserve state-root identity.
• Verify untrusted isolation and actionable non-resumable reporting.
• Document persistence, roots, history://, and receipt boundaries.
• Hand recorded-recipe restoration to Record and restore non-secret code launch recipes per OMP session #6 after the exact root/full-ID tuple resolves.

Acceptance criteria

• A trusted session launched through code is discoverable and resumable by documented ID.
• Opening code in a repository prioritizes exact-directory and same-repository sessions.
• Sessions outside the repository remain reachable through an explicit all-sessions view.
• Listing reads only allowlisted metadata and never exposes transcript or credential content.
• Default, named-profile, and explicit-session-directory cases have focused resolver tests.
• Duplicate prefixes across roots fail with an actionable deterministic diagnostic.
• Generated one-shot --config overlays do not change session-root identity.
• History is collapsed on the left by default and consumes no unexplained width while collapsed.
• Expanded history is fully keyboard navigable and shows compact settings for the focused row.
• Focus/hover never launches or silently changes a pending target.
• Resume-with-customization collapses history, restores the editable generator, and preserves the selected session.
• Direct resume without customization preserves compatible session-owned model/thinking state.
• A generator profile/default model explicitly selected for resume wins over the session's previous active model.
• An explicit forwarded --model wins during resume, and incompatible vault/model combinations fail with an actionable choice rather than a silent identity or model switch.
• The bottom summary/action always distinguishes Launch new from Resume <title> · <ID>.
• Clearing or replacing a pending resume target is explicit.
• Resizes and background refreshes preserve both history focus and the pending launch target.
• Untrusted sessions remain isolated and their non-resumable behavior is clearly reported.
• Documentation distinguishes persisted sessions, top-level processes, live history:// agents, current setup, and recorded recipes.

Likely ownership

• pkgs/code-tui/
• pkgs/omp-configured/default.nix
• pkgs/omp-configured/README.md
• pkgs/cli-kit/ only where an existing generic responsive/navigation primitive is genuinely reusable