Hand off an ended session from the desktop app

src/Capacitor.App/App.axaml.cs

@@ -208,6 +208,7 @@ internal static TelemetryStartup DesktopTelemetry(
     // last, since its transitions are what the feed subscribes to.
     ServerPermissionFeed? _permissionFeed;
     SessionAttentionTracker? _attention;
+    HandoffDrafts? _handoffDrafts;
     BackgroundCommandActivity? _commands;
     SessionAccessService? _sessionAccess;
     PullRequestToneCache? _pullRequestTones;
@@ -426,7 +427,7 @@ await QuiesceAppAsync(_wizardAuth, _historyImport, _localInstall,
             await HandleStartupFailureAsync(
                 desktop, ex, _service, _shutdown,
                 [_tray, _trayVm, _promptCoordinator, _consent, _desktopNotifications, _notificationSink,
-                    _notificationSessions, _notificationSettings, _permissionFeed, _attention, _commands, _permissions, _accounts, _sessionAccess,
+                    _notificationSessions, _notificationSettings, _permissionFeed, _attention, _handoffDrafts, _commands, _permissions, _accounts, _sessionAccess,
                     _pullRequestTones, _launchApprovals, _webWorkspace, _activity, _home, _localServer, _localStack, _rail, _pause, _staleDaemonNudge, _restartPending, _expectedRestart],
                 _lifecycle, _lane, _localUpgrade, _localSearch, _menuBar, _coordinator);
             await DisposeServerClientsAsync(); // after _home above
@@ -449,6 +450,7 @@ await HandleStartupFailureAsync(
             _notificationSettings = null;
             _permissionFeed = null;
             _attention = null;
+            _handoffDrafts = null;
             _commands = null;
             _permissions = null;
             _accounts = null;
@@ -1034,7 +1036,8 @@ void BuildDaemonGraph(
             onUnauthorized: serverLane.ParkSignedOut);
         var sessions = new ServerSessionsService(
             serverLane, ServerSessionsService.HttpFetch(sessionHttp, profiles), ServerSessionsService.HttpOwners(sessionHttp, profiles),
-            _time, onUnauthorized: serverLane.ParkSignedOut, fetchSummary: ServerSearchHttp.Summary(sessionHttp, profiles));
+            _time, onUnauthorized: serverLane.ParkSignedOut, fetchSummary: ServerSearchHttp.Summary(sessionHttp, profiles),
+            fetchHandoffContext: ServerSearchHttp.HandoffContext(sessionHttp, profiles));
         var repoIdentity = new RepoIdentityResolver();
         var directory = new AgentDirectory(
             service, remoteAgents, serverLane, repoIdentity, GitRepository.ResolveMainRepoRoot,
@@ -1189,6 +1192,7 @@ void BuildDaemonGraph(
         var transcripts = new LocalTranscripts();
         var readings = new AccountReadings(accounts.Snapshot, remoteAgents.DrawableDaemonAccounts, UsageClock.Create(_time));
         _usageClock = readings.Clock;
+        var handoffOutcomes = new HandoffOutcomeReader(service, ops, _time);
         WorkspaceViewModel BuildWorkspace(string agentId) => new(
             agentId, service, actions, attachFactory, () => new XtermTerminalSurface(80, 24, PtyDumpPath), _time, workspaceOpener, permissions,
             workContext, ops, uploader,
@@ -1199,7 +1203,8 @@ void BuildDaemonGraph(
             resumeLedger: id => ResumeLedgerStore.For(_daemonStore, service.DaemonName).TryRead(id),
             pullRequestSnapshots: pullRequestSnapshots, transcripts: transcripts,
             pullRequestLinksChanged: pullRequestTones.Refresh, readings: readings, senders: senders,
-            appSubject: appSubject, notifier: notifier, serverLane: serverLane.Status, workContextLayout: workContextLayout);
+            appSubject: appSubject, notifier: notifier, serverLane: serverLane.Status, workContextLayout: workContextLayout,
+            handoffOutcomes: handoffOutcomes);
         // The origin lookup below and this call are two reads of a cache the directory's own
         // background recompute mutates, so the row can be gone by the time this runs: no row, no
         // host, and the click opens nothing.
@@ -1211,8 +1216,31 @@ void BuildDaemonGraph(
                     signInCompleted: serverClients.SignInCompleted, plans: plans, drafts: drafts, inputSending: attention.ReplySending,
                     pullRequestSnapshots: pullRequestSnapshots, pullRequestLinksChanged: pullRequestTones.Refresh, readSubagent: readSubagent,
                     readings: readings, senders: senders, remoteAgents: remoteAgents, notifier: notifier, appSubject: appSubject,
-                    serverSessions: sessions, workContextLayout: workContextLayout)
+                    serverSessions: sessions, workContextLayout: workContextLayout, handoffOutcomes: handoffOutcomes)
                 : null;
+        // One for the app's life: a failed hand-off's draft outlives the composer that sent it.
+        var handoffDrafts = new HandoffDrafts(serverLane.LaunchFailures, directory, _time);
+        _handoffDrafts = handoffDrafts;
+        var checkouts = new LocalCheckoutFinder(repoIdentity);
+        var knownRepos = new RepoPathStore(_config, _time);
+        async Task<IReadOnlyList<string>> HandoffCandidatesAsync(CancellationToken ct) {
+            var remembered = (await _appState.LoadAsync()).HarnessByRepo?.Keys ?? [];
+            var known = await knownRepos.GetSortedPathsAsync();
+            var agents = service.Agents.Items.Select(a => a.RepoPath).OfType<string>().Where(p => p.Length > 0);
+            return [.. remembered, .. known, .. agents];
+        }
+        MainWindowViewModel? OpenWindow() => _coordinator?.Window?.DataContext as MainWindowViewModel;
+        HandoffComposerViewModel BuildHandoff(AgentRow row) => new(
+            HandoffComposerViewModel.SourceOf(row), service, launch, sessions, ops, checkouts, HandoffCandidatesAsync,
+            handoffDrafts, serverLane.Status, uploader, directory,
+            navigationGeneration: () => OpenWindow()?.NavigationGeneration ?? 0,
+            openSessionIfCurrent: (agentId, origin, generation) => OpenWindow()?.OpenSessionIfCurrent(agentId, origin, generation),
+            closeFailedLaunch: agentId => OpenWindow()?.CloseFailedLaunch(agentId),
+            // Unconditional: the failed launch's close has just moved the navigation generation on.
+            reopenSource: (sessionId, presentation) =>
+                OpenWindow() is { } window ? window.ReopenServerSessionAsync(sessionId, presentation) : Task.FromResult(false),
+            notifier: notifier,
+            modelCatalog: modelCatalog.Catalog, shutdown: _shutdown.Token);
         // A session the server lists with no daemon behind it: read-only, so no terminal surface.
         RemoteSessionViewModel? BuildServer(string sessionId) =>
             directory.Rows.Lookup($"server:{sessionId}") is { HasValue: true, Value: var row }
@@ -1222,7 +1250,7 @@ void BuildDaemonGraph(
                     signInCompleted: serverClients.SignInCompleted, plans: plans, drafts: drafts, inputSending: attention.ReplySending,
                     pullRequestSnapshots: pullRequestSnapshots, pullRequestLinksChanged: pullRequestTones.Refresh, readSubagent: readSubagent,
                     readings: readings, remoteAgents: remoteAgents, notifier: notifier, appSubject: appSubject, serverSessions: sessions,
-                    workContextLayout: workContextLayout)
+                    workContextLayout: workContextLayout, handoff: BuildHandoff, handoffOutcomes: handoffOutcomes)
                 : null;
 
         _coordinator = new MainWindowCoordinator(
@@ -2880,7 +2908,7 @@ await QuiesceAppAsync(_wizardAuth, _historyImport, _localInstall, _lifecycle, _l
             await Dispatcher.UIThread.InvokeAsync(async () => {
                 IDisposable?[] ui = [
                     _tray, _trayVm, _promptCoordinator, _consent, _desktopNotifications, _notificationSink,
-                    _notificationSessions, _notificationSettings, _permissionFeed, _attention, _commands, _permissions, _accounts, _sessionAccess,
+                    _notificationSessions, _notificationSettings, _permissionFeed, _attention, _handoffDrafts, _commands, _permissions, _accounts, _sessionAccess,
                     _pullRequestTones, _launchApprovals, _webWorkspace, _activity, _home, _localServer, _localStack, _rail, _pause, _staleDaemonNudge, _restartPending, _expectedRestart,
                 ];
                 if (shutdown) {

src/Capacitor.App/Services/HandoffContextFetch.cs

@@ -0,0 +1,6 @@
+using Capacitor.Remote.Models;
+
+namespace Capacitor.App.Services;
+
+/// Unavailable is a session the server hides from the caller or does not hold; Context is set only on Ok.
+public sealed record HandoffContextFetch(ServerReadOutcome Outcome, HandoffContextDto? Context);

src/Capacitor.App/Services/HandoffDraft.cs

@@ -0,0 +1,10 @@
+using Capacitor.App.ViewModels;
+using Capacitor.Cli.Core;
+
+namespace Capacitor.App.Services;
+
+/// A hand-off composer's contents as the chips showed them: PermissionMode and CodexPosture are the
+/// chip values, not what the launch sent. Error is the failure that handed the draft back.
+public sealed record HandoffDraft(
+    string Text, IReadOnlyList<StagedAttachment> Attachments, string Vendor, string Model, string? Effort,
+    string? PermissionMode, CodexLaunchPosture? CodexPosture, string? Error);

src/Capacitor.App/Services/HandoffDrafts.cs

@@ -0,0 +1,121 @@
+using System.Reactive.Disposables;
+using System.Reactive.Disposables.Fluent;
+using System.Reactive.Linq;
+using System.Reactive.Subjects;
+using Capacitor.App.ViewModels;
+using DynamicData;
+using ReactiveUI.Reactive;
+
+namespace Capacitor.App.Services;
+
+/// Hand-off drafts awaiting their launch's verdict, for the app's lifetime: the composer that sent
+/// one is gone once the new session opens, and a failure must hand the draft back to the source
+/// session's next composer. Failures are buffered from construction, because one can arrive before
+/// the launch call returns and the hold that would match it is made.
+public sealed class HandoffDrafts : IDisposable {
+    static readonly TimeSpan PendingTtl = TimeSpan.FromMinutes(10);
+    static readonly TimeSpan RecentFailureTtl = TimeSpan.FromSeconds(30);
+
+    sealed record Held(string SourceSessionId, HandoffDraft Draft, DateTimeOffset At, Action<string>? OnFailed);
+
+    readonly Lock _lock = new();
+    readonly Dictionary<string, Held> _pending = new(StringComparer.Ordinal);
+    readonly Dictionary<string, (string Reason, DateTimeOffset At)> _recentFailures = new(StringComparer.Ordinal);
+    readonly Dictionary<string, HandoffDraft> _failed = new(StringComparer.Ordinal);
+    readonly IAgentDirectory? _directory;
+    readonly TimeProvider _time;
+    readonly CompositeDisposable _subscriptions = new();
+    readonly Subject<string> _failedFor = new();
+
+    public HandoffDrafts(IObservable<LaunchFailure> failures, IAgentDirectory? directory, TimeProvider time) {
+        _directory = directory;
+        _time = time;
+        // Settled on the lane's thread, so a hold made before the UI hop still sees the failure.
+        failures
+            .Select(Settle)
+            .Where(onFailed => onFailed is not null)
+            .ObserveOn(RxSchedulers.MainThreadScheduler)
+            .Subscribe(onFailed => onFailed!())
+            .DisposeWith(_subscriptions);
+        directory?.Rows.Connect()
+            .Subscribe(changes => {
+                foreach (var change in changes)
+                    if (change.Reason is ChangeReason.Add or ChangeReason.Update
+                     && change.Current is { IsPlaceholder: false, Origin: AgentOrigin.Local } row)
+                        Confirm(row.Id);
+            })
+            .DisposeWith(_subscriptions);
+    }
+
+    /// onFailed runs on the UI thread, with the worded failure, when a failure for the agent arrives
+    /// after this hold.
+    public HandoffHold Hold(string sourceSessionId, string agentId, HandoffDraft draft, Action<string>? onFailed = null) {
+        var id = Key(agentId);
+        if (RowExists(id)) return HandoffHold.AlreadyStarted;
+        lock (_lock) {
+            var now = _time.GetUtcNow();
+            if (_recentFailures.Remove(id, out var failure) && now - failure.At <= RecentFailureTtl) {
+                _failed[sourceSessionId] = draft with { Error = HandoffFailureText.For(failure.Reason) };
+                return HandoffHold.AlreadyFailed;
+            }
+            _pending[id] = new Held(sourceSessionId, draft, now, onFailed);
+        }
+        // The row can land between the first check and the registration.
+        if (!RowExists(id)) return HandoffHold.Pending;
+        Confirm(id);
+        return HandoffHold.AlreadyStarted;
+    }
+
+    /// The source session of a draft a later failure handed back, on the UI thread, after the
+    /// hold's onFailed. Whichever composer calls TakeFailed first gets the draft.
+    public IObservable<string> FailedFor => _failedFor;
+
+    /// A draft whose composer is gone before its launch settled, for the source's next composer.
+    public void HoldFailed(string sourceSessionId, HandoffDraft draft) {
+        lock (_lock) _failed[sourceSessionId] = draft;
+    }
+
+    public HandoffDraft? TakeFailed(string sourceSessionId) {
+        lock (_lock) return _failed.Remove(sourceSessionId, out var draft) ? draft : null;
+    }
+
+    public void Confirm(string agentId) {
+        var id = Key(agentId);
+        lock (_lock) {
+            _pending.Remove(id);
+            _recentFailures.Remove(id);
+        }
+    }
+
+    Action? Settle(LaunchFailure failure) {
+        var id = Key(failure.AgentId);
+        lock (_lock) {
+            var now = _time.GetUtcNow();
+            if (_pending.Remove(id, out var held) && now - held.At <= PendingTtl) {
+                var worded = HandoffFailureText.For(failure.Reason);
+                _failed[held.SourceSessionId] = held.Draft with { Error = worded };
+                return () => {
+                    _directory?.RemovePlaceholder(id);
+                    held.OnFailed?.Invoke(worded);
+                    _failedFor.OnNext(held.SourceSessionId);
+                };
+            }
+            _recentFailures[id] = (failure.Reason, now);
+            foreach (var stale in _recentFailures.Where(kv => now - kv.Value.At > RecentFailureTtl).Select(kv => kv.Key).ToList())
+                _recentFailures.Remove(stale);
+            foreach (var stale in _pending.Where(kv => now - kv.Value.At > PendingTtl).Select(kv => kv.Key).ToList())
+                _pending.Remove(stale);
+            return null;
+        }
+    }
+
+    bool RowExists(string id) =>
+        _directory?.Rows.Items.Any(r => r is { IsPlaceholder: false, Origin: AgentOrigin.Local } && Key(r.Id) == id) == true;
+
+    static string Key(string agentId) => AgentIds.Normalize(agentId) ?? agentId;
+
+    public void Dispose() {
+        _subscriptions.Dispose();
+        _failedFor.Dispose();
+    }
+}

src/Capacitor.App/Services/HandoffHold.cs

@@ -0,0 +1,5 @@
+namespace Capacitor.App.Services;
+
+/// What holding a hand-off draft found. AlreadyFailed: a failure for the agent arrived before the
+/// hold, and the draft waits in TakeFailed. AlreadyStarted: the agent's row is already listed.
+public enum HandoffHold { Pending, AlreadyFailed, AlreadyStarted }

src/Capacitor.App/Services/HandoffOutcomeReader.cs

@@ -0,0 +1,62 @@
+using System.Reactive.Linq;
+using Capacitor.Cli.Core.Handoff;
+using Capacitor.Cli.Core.LocalIpc;
+
+namespace Capacitor.App.Services;
+
+/// Follows the daemon's stored hand-off outcome for a session id. The daemon keeps it by the
+/// successor's id, so the answer is the same whether the view is the live agent or the server row
+/// the successor became.
+public sealed class HandoffOutcomeReader(IDaemonClientService daemon, ILocalControlOps ops, TimeProvider time) {
+    internal static readonly TimeSpan PollInterval = TimeSpan.FromSeconds(2);
+    internal static readonly TimeSpan NullWindow = TimeSpan.FromMinutes(2);
+
+    /// Emits each outcome that differs in value from the last: every read deserializes fresh lists,
+    /// so reference equality would re-emit each poll. An answer of null (nothing stored yet, or a
+    /// failed read) is retried for <see cref="NullWindow"/>; a running outcome is followed without limit.
+    /// Completes on a terminal state or when the window lapses, and emits nothing for a daemon
+    /// without handoff/1.
+    public IObservable<HandoffOutcomeDto> Watch(string sessionId) =>
+        daemon.Status
+            .SkipWhile(status => status.State != AttachState.Connected)
+            .Take(1)
+            .SelectMany(status => status.Capabilities?.Contains(HandoffWire.Capability) == true
+                ? Poll(sessionId)
+                : Observable.Empty<HandoffOutcomeDto>());
+
+    /// The chat card's stream for one session id, inside a Switch over ids: it opens with null so a
+    /// card from the previous id is cleared rather than carried over.
+    public static IObservable<HandoffOutcomeDto?> CardFor(HandoffOutcomeReader reader, string? sessionId) =>
+        sessionId is null
+            ? Observable.Return<HandoffOutcomeDto?>(null)
+            : reader.Watch(sessionId).Select(outcome => (HandoffOutcomeDto?)outcome).StartWith((HandoffOutcomeDto?)null);
+
+    IObservable<HandoffOutcomeDto> Poll(string sessionId) =>
+        Observable.Create<HandoffOutcomeDto>(async (observer, ct) => {
+            var started = time.GetTimestamp();
+            var seen = false;
+            HandoffOutcomeDto? last = null;
+            try {
+                while (!ct.IsCancellationRequested) {
+                    var outcome = await Task.Run(() => ops.ReadHandoffOutcomeAsync(sessionId, ct), ct).ConfigureAwait(false);
+                    if (outcome is not null) {
+                        seen = true;
+                        if (!Same(outcome, last)) observer.OnNext(outcome);
+                        last = outcome;
+                        if (outcome.State != "running") break;
+                    } else if (!seen && time.GetElapsedTime(started) >= NullWindow) {
+                        break;
+                    }
+                    await Task.Delay(PollInterval, time, ct).ConfigureAwait(false);
+                }
+                observer.OnCompleted();
+            } catch (OperationCanceledException) when (ct.IsCancellationRequested) {
+            } catch (Exception ex) {
+                observer.OnError(ex);
+            }
+        });
+
+    internal static bool Same(HandoffOutcomeDto a, HandoffOutcomeDto? b) =>
+        b is not null && a.SourceSessionId == b.SourceSessionId && a.SourceTitle == b.SourceTitle
+        && a.State == b.State && a.Detail == b.Detail && a.Items.SequenceEqual(b.Items);
+}