[Juliusolsson05]

Problem

With several Agent Code windows open (one per monitor, say), you can't move a running agent from one window to another. The only cross-window handover today happens when a window closes. Root Agent Code Management agents (#906) can rearrange lanes inside a window but can't move work between windows either.

What this adds

Send to Window… (palette, plus the Sessions right-click menu) moves the focused lane's agent or terminal to another open window you pick:

• Move, not copy. Nothing restarts. The process, conversation, draft, pin, title and MCP choices go as they are, and session IDs don't change.
• Children move with it. Linked agents and orchestration workers go too, transitively, using the same ownership edge the index nests by.
• Where it lands. It joins a target project that already holds the same folder, otherwise a new project tab, and it is shown in the target's focused lane.
• The lane it leaves is cleared, like Clear Lane (⌥⌫).
• Picker labels. Each window is shown as Window N · <project titles> · <n> sessions, because every window has the same OS title. The picker starts on the window you used last.
• Root management tool. agents.moveToWindow is published as ac_agents_move_to_window to root-management agents and the external operator. It returns once the move has committed.

How it works (ordering is the safety property)

source A                      main                          target B
send ─────────────► window:send-sessions
                     validate, move routing → B, start a 20 s deadline
                     ─────► workspace:receive-sessions ──► merge, seed runtimes,
                                                          select into focused lane,
                                                          autosave (durable)
                     ◄──── window:session-move-complete ◄─┘
◄── workspace:sessions-moved-out
drop rows (no kill)

• Routing moves first (reusing the router's transfer), so events emitted mid-handoff reach the window about to show them. Parked agents are claimed for the target, so the source can't wake them mid-move.
• The target confirms only from the autosave success path. This is the same discipline the window-close adoption uses, because the confirmation makes the source drop its rows.
• Refusal or deadline: main rolls back only the exact leases it created (compared by identity), and the source keeps the agent. On a deadline the target is also told to give back what it merged (rows only).
• Duplicates over loss: between the target's save and the source's save, both slices list the agent. A crash there leaves a duplicate row, never a lost agent. The opposite order would leave a window where no slice lists a live agent.
• Fresh tab ids: a new target project gets a fresh tab id. A shared id would make a later window-close adoption refuse the whole workspace on collision.

Design decisions

• Your four rulings: move rather than copy; same-folder project, else a new tab; children move along; the source lane is cleared.
• UNCONFIRMED defaults, please confirm:
  • the target window is not raised;
  • the command title is Send to Window…;
  • terminals can be moved, but extension views can't.
• No up-front "no other window" check. The renderer can't know the window count synchronously, so the picker says "No other Agent Code window is open" and names New Window.
• Picker labels come from each window's last saved workspace (at most one autosave old). Asking every live renderer would cost an IPC round trip per window.

Refactors and fixes along the way

• The adoption seeding (snapshot → runtime seed → condition re-seed → history) moved to seedIncomingSessions.ts, shared by adoption and moves. These steps carry the bug(workspace): window adoption drops pending permission and question conditions #895/fix(workspace): seed pending conditions when a window adopts, restores or wakes a session #1083 fixes.
• forgetClosedSessionDebugState became forgetSessionViewState and now also releases the bootstrap timer that close used to clear inline.
• The Root management confirmation dialog no longer claims the grant can attach, detach or bury agents (all removed in Unified workspace layout: merge Grid and Dispatch into one stage-over-fleet workspace #992).
• The catalog count history in catalog.test.ts now records the step c882a41 made without extending the comment.

Tests

• main/window/sessionMove.test.ts:
  • start authority (same window, unready target, foreign owner, already moving, malformed);
  • confirm authority (wrong window, reloaded renderer);
  • refusal and deadline rollback;
  • "only its own leases";
  • a late confirm is ignored;
  • a closed source is released, not transferred back.
  • I checked by mutation that two of these guards are each caught by a test.
• workspace/sessionMove.test.ts: transitive and cycle-safe subtree; packet round trip; same-folder join versus a fresh tab id; collision refusal; source drop; target cancel restoring the original state.
• hook/ipc/useSessionMoves.renderer.test.tsx:
  • the target queues its confirmation for autosave, refuses collisions and mismatched packets, and holds offers until bootstrap;
  • a cancel arriving during the snapshot wait stops the merge (this was a real bug in my first version; the test fails without the fix);
  • the source drops rows only on main's commit and never kills.
• storage/workspaceFile.test.ts: picker labels.
• Updated the pinned lists for the catalog, context menu and command target.

Verification

• npx tsc -b: clean.
• npm run check:keybindings and npm run test:contract: OK.
• Full npm test: 994 files, 8259 passed, 1 skipped (Node 24, local). The two follow-up fixes after that run (cancel during merge, picker default) were verified with their own suites plus tsc -b.

Known limitations

• A window closing mid-move (source or target): the window-close handover may hit an id collision and refuse. The slice then comes back next launch as its own window. A duplicate, not a loss.
• A child moved without its parent keeps its relationship ids. It shows as a top-level row, and the parent's orchestration tools no longer reach it from the old window.
• Not yet handled: a session replacement or provider switch while a move is pending.
• Manual app QA is still owed. I don't launch the app, so the two-window flow has not been exercised end to end on screen.

Review dispositions (one round: Codex on correctness, Claude on integration)

Finding	Verdict	Disposition
Codex 1 / Claude 1: an in-flight save could confirm a move (or an adoption) whose rows it did not contain, so the source dropped rows that were not durable anywhere	valid (the adoption half predates this PR)	fixed in 856eb5e0: confirmations are captured at serialization; a regression test fails on the old code
Codex 2: waking a parked agent in the target rotated the lease, so a deadline rollback skipped it while the target dropped its rows	valid	fixed in d883ef63: rollback also takes back a newer claim by the target window; any other window's claim is still left alone
Codex 3: after a rollback the source kept stale readiness and conditions that had been delivered only to the target	valid	fixed in d883ef63: rollback marks a router gap, so the source's existing routing-gap repair resyncs
Codex 4: the source retiring its Browser Pocket guest unregistered the target's new guest under the same pocket id	valid	fixed in 2d13863d: only the renderer holding the current registration may unregister it
Claude 2: agents.moveToWindow accepted extension views	valid	fixed in 45d00581: the rule now lives in the packet builder and is shared by every entry point
Claude 3: moving a child alone silently cuts it off from its parent's orchestration tools	valid (UX)	45d00581: the picker and the capability description warn. Redirecting the move to the root owner is a product call, left UNCONFIRMED
Claude 4: the picker offered windows that were closing or not ready	valid, low	fixed in d883ef63
Mutation survivors: failed offer delivery, autosave confirm drain, moving map never cleared, outcome split, append ordering	valid gaps	tests added (failed delivery, two moves in a row, in-flight save, not_started/unknown, clock behind the target's rows)
Remaining survivors (pin dedupe, self-link guard, packet version, fresh-id retry, empty drafts, unmount settle, H6/H8/H11/H17/H19)	nits	declined: each guard has a WHY comment, and none has a user-visible failure without another bug first
Suspicion: session:input and deliver-prompt do not check display-window ownership	pre-existing, unproven	not taken up here; no failure sequence was shown for this branch
Suspicion: replacement or provider switch during a pending move, and leftover history refs after a move-out	unproven	recorded as residuals in the plan

Fixes #1481

🤖 Generated with Claude Code