Fix ptmux previews and app session restoration

CLI/cmux.swift

@@ -1846,7 +1846,11 @@ final class ClaudeHookSessionStore {
         includeTerminalPromptTurnIds: Bool = true
     ) -> Bool {
         if max(record.activePromptDepth ?? 0, record.activePromptTurnIds?.count ?? 0) > 0 {
-            return true
+            // Prompt depth belongs to a process generation. An interrupted
+            // process (or a ledger-settled Stop) can leave depth behind; do not
+            // let it suppress the next confirmed process's resume binding.
+            // Same-process and unverifiable starts still cannot erase a turn.
+            return !authoritativeSessionStartProcessIsNewer(incomingPID, than: record)
         }
         let hasCompletedTurnState = normalizeOptional(record.lastPromptTurnId) != nil
             || (includeTerminalPromptTurnIds && !terminalPromptTurnSet(from: record).isEmpty)

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentLaunchPositionalScanning.swift

@@ -180,7 +180,9 @@ extension AgentLaunchSanitizer {
 
     static func variadicValueCanContinue(_ value: String, policy: Policy) -> Bool {
         guard policy.scansOptionsPastPositionals else { return true }
-        return looksLikeGreedyOptionalValue(value)
+        // An explicit empty argv value can disable tools or clear a list. It is
+        // distinct from a missing value and must survive capture and replay.
+        return value.isEmpty || looksLikeGreedyOptionalValue(value)
     }
 
     static func looksLikeOptionalValue(_ value: String, following: String?) -> Bool {

Packages/macOS/CMUXAgentLaunch/Sources/CMUXAgentLaunch/AgentLaunchSanitizerGrokPolicy.swift

@@ -19,6 +19,8 @@ extension AgentLaunchSanitizer {
             "-r",
             "--rules",
             "--sandbox",
+            "--session-id",
+            "-s",
             "--system-prompt-override",
             "--tools",
             "--worktree",
@@ -27,6 +29,9 @@ extension AgentLaunchSanitizer {
         optionalValueOptions: [
             "--resume",
             "-r",
+            // Older captures dropped the UUID but retained this selector.
+            "--session-id",
+            "-s",
             "--worktree",
             "-w"
         ],
@@ -53,15 +58,20 @@ extension AgentLaunchSanitizer {
         droppedOptions: [
             "--continue",
             "-c",
+            "--fork-session",
             "--restore-code",
             "--resume",
             "-r",
+            "--session-id",
+            "-s",
             "--worktree",
             "-w"
         ],
         droppedOptionPrefixes: [
             "--resume=",
             "-r=",
+            "--session-id=",
+            "-s=",
             "--worktree=",
             "-w="
         ],

Packages/macOS/CMUXAgentLaunch/Tests/CMUXAgentLaunchTests/AgentResumeArgvTests.swift

@@ -3,6 +3,40 @@ import Testing
 
 @Suite("AgentResumeArgv")
 struct AgentResumeArgvTests {
+    @Test("Claude preserves the explicit empty tools list through capture and resume")
+    func claudeResumeKeepsEmptyToolList() throws {
+        let captured = try #require(AgentLaunchSanitizer.sanitizedLaunchArguments(
+            ["claude", "--tools", "", "--model", "sonnet"],
+            launcher: "claude",
+            fallbackKind: "claude"
+        ))
+        #expect(
+            AgentResumeArgv().builtInKind(
+                kind: "claude", sessionId: "saved-session", executablePath: nil, arguments: captured
+            ) == ["claude", "--resume", "saved-session", "--tools", "", "--model", "sonnet"]
+        )
+    }
+
+    @Test("Grok resumes the saved conversation without new-session selectors", arguments: [
+        ["--session-id", "new-session"],
+        ["-s", "new-session"],
+        ["--session-id=new-session"],
+        ["-s=new-session"],
+        ["--resume", "parent-session", "--fork-session", "--session-id", "new-session"],
+        // Older captures kept the flag but dropped its value as a positional prompt.
+        ["--session-id"],
+    ])
+    func grokResumeDropsNewSessionSelectors(selectors: [String]) {
+        #expect(
+            AgentResumeArgv().builtInKind(
+                kind: "grok",
+                sessionId: "saved-session",
+                executablePath: "/opt/bin/grok",
+                arguments: ["/opt/bin/grok"] + selectors + ["--model", "grok-4", "--sandbox", "read-only"]
+            ) == ["/opt/bin/grok", "-r", "saved-session", "--model", "grok-4", "--sandbox", "read-only"]
+        )
+    }
+
     @Test("Built-in --option style kinds", arguments: [
         ("claude", "claude", ["claude", "--resume", "SID"]),
         ("grok", "grok", ["grok", "-r", "SID"]),

Sources/DockSplitStore+SessionRestore.swift

@@ -235,7 +235,8 @@ extension DockSplitStore {
             snapshot,
             workspaceId: workspaceId
         )
-        guard let terminalSnapshot = snapshot.terminal else { return nil }
+        guard let savedTerminalSnapshot = snapshot.terminal else { return nil }
+        let terminalSnapshot = savedTerminalSnapshot.reconcilingAgentBindingForRestore(surfaceID: snapshot.id)
         let policy = Workspace.makeSessionRestorePolicyService()
         let localTmuxStartCommand = policy.localTmuxStartCommand(terminalSnapshot.tmuxStartCommand)
         let restorableAgent = localTmuxStartCommand == nil
@@ -286,17 +287,20 @@ extension DockSplitStore {
         recoveryObservationsByPanelId[snapshot.id] = recoveryObservation
         let recoveryPlan = terminalSnapshot.recoveryPlan(
             surfaceID: snapshot.id,
-            claimedOwnerSurfaceID: recoveryObservation.agent.flatMap { recoveryPlannedAgentOwners[$0] }
+            claimedOwnerSurfaceID: terminalSnapshot.boundAgentIdentityForRestore.flatMap { recoveryPlannedAgentOwners[$0] }
         )
         let shouldAutoResumeAgent: Bool = {
             guard AgentSessionAutoResumeSettings.isEnabled(defaults: agentSessionAutoResumeDefaults),
                   case .resumeAgent = recoveryPlan.action else { return false }
             return true
         }()
-        if shouldAutoResumeAgent, let agent = recoveryObservation.agent {
+        if shouldAutoResumeAgent, let agent = terminalSnapshot.boundAgentIdentityForRestore {
             recoveryPlannedAgentOwners[agent] = snapshot.id
         }
-        let shouldCheckAgentOwnership = shouldAutoResumeAgent &&
+        let restoresBoundLocalAgent = shouldAutoResumeAgent &&
+            terminalSnapshot.hasLocalBoundAgentBindingForRestore &&
+            terminalSnapshot.isRemoteTerminal != true && hibernation == nil
+        let shouldCheckAgentOwnership = !restoresBoundLocalAgent && shouldAutoResumeAgent &&
             (restorableAgentCanAutoResume || resumeBinding?.isAgentHookBinding == true)
         let restoreAgentIndex = shouldCheckAgentOwnership ? restorableAgentIndex : nil
         let restoreIndexUnavailable = shouldCheckAgentOwnership && restoreAgentIndex == nil
@@ -361,7 +365,10 @@ extension DockSplitStore {
             stablePanelHasLiveProcess
             ? nil
             : approvedResumeBinding.flatMap {
-                policy.surfaceResumeStartupLaunch(
+                if restoresBoundLocalAgent {
+                    return $0.boundAgentStartupLaunch()
+                }
+                return policy.surfaceResumeStartupLaunch(
                     forApprovedBinding: $0
                 )
             }

Sources/DockSplitStore+SessionSnapshot.swift

@@ -520,11 +520,9 @@ extension DockSplitStore {
                 currentProcessIdentity: Workspace.agentPIDProcessIdentity(pid:)
             )
         }
-        let coordinated = restoredAgentLifecycle.continuationSnapshot(
-            panelId: panelId,
-            observation: observation,
-            currentProcessIdentity: Workspace.agentPIDProcessIdentity(pid:)
-        )
+        // Completion ends the old process; the panel keeps its session binding
+        // until another command or an explicit mutation replaces it.
+        let coordinated = restoredAgentLifecycle.snapshotsByPanelId[panelId]
         let observed = restoredAgentLifecycle.resumeStatesByPanelId[panelId] == .completedAgentExit
             ? nil
             : observation?.snapshot

Sources/MainWindowPersistenceRouteSnapshot.swift

@@ -51,15 +51,14 @@ enum MainWindowPersistenceRouteSnapshot {
         }
     }
 
-    /// Remote-tmux-only live windows require their active SSH control graph
-    /// and intentionally do not participate in persisted session topology.
+    /// Mirrors with a saved attachment target participate in session persistence.
     var isEligibleForSessionPersistence: Bool {
         switch self {
         case .live(let route):
             let workspaces = route.tabManager.tabs
             let omitsRemoteMirrorOnlyWindow = route.dock == nil
                 && !workspaces.isEmpty
-                && workspaces.allSatisfy(\.isRemoteTmuxMirror)
+                && workspaces.allSatisfy { $0.isRemoteTmuxMirror && !$0.isRestorableInSessionSnapshot }
             return !omitsRemoteMirrorOnlyWindow
         case .frozen:
             return true

Sources/RemoteTmuxControlConnection+Commands.swift

@@ -413,6 +413,14 @@ extension RemoteTmuxControlConnection {
         // while a smaller peer legitimately clamped the window must not suppress
         // recovery after that peer leaves.
         windowClaimParityRearmsSpent.removeAll()
+        if !supportsPerWindowSize {
+            _ = send("set-option -g focus-events on")
+            _ = send("refresh-client -f ignore-size")
+            legacyWindowSizingConfigured.removeAll()
+            for windowId in lastWindowSizes.keys.sorted() {
+                configureLegacyWindowSizing(windowId: windowId)
+            }
+        }
         if let size = lastClientSize {
             if send("refresh-client -C \(size.columns)x\(size.rows)") {
                 lastSentClientSize = size
@@ -448,17 +456,19 @@ extension RemoteTmuxControlConnection {
     /// Sends literal key bytes to a pane via tmux `send-keys -H` (hex-encoded),
     /// which is binary-safe and needs no shell quoting.
     @discardableResult
-    func sendKeys(paneId: Int, data: Data) -> Bool {
+    func sendKeys(paneId: Int, data: Data, claimsSizing: Bool = true) -> Bool {
         guard !data.isEmpty else { return true }
+        if claimsSizing, !activatePaneSizing(paneId: paneId) { return false }
         let hex = Self.hexByteArguments(data)
         return sendInternal("send-keys -t %\(paneId) -H \(hex)", kind: .other)
     }
 
     /// Sends a physical named key and lets tmux encode it for the target pane's
     /// advertised terminal and live input modes.
     @discardableResult
-    func sendKey(paneId: Int, key: RemoteTmuxKeyName) -> Bool {
-        sendInternal("send-keys -t %\(paneId) \(key.value)", kind: .other)
+    func sendKey(paneId: Int, key: RemoteTmuxKeyName, claimsSizing: Bool = true) -> Bool {
+        if claimsSizing, !activatePaneSizing(paneId: paneId) { return false }
+        return sendInternal("send-keys -t %\(paneId) \(key.value)", kind: .other)
     }
 
     nonisolated static func hexByteArguments(_ data: Data) -> String {

Sources/RemoteTmuxControlConnection+Sizing.swift

@@ -29,6 +29,11 @@ extension RemoteTmuxControlConnection {
 
     func removeWindowSizeClaim(windowId: Int) {
         windowClaimParityRearmsSpent.removeValue(forKey: windowId)
+        legacyWindowSizingConfigured.remove(windowId)
+        if interactiveSizingWindowId == windowId {
+            interactiveSizingWindowId = nil
+            interactiveSizingOwnerId = nil
+        }
         guard let removed = lastWindowSizes.removeValue(forKey: windowId) else {
             sentWindowSizes.removeValue(forKey: windowId)
             return
@@ -46,6 +51,11 @@ extension RemoteTmuxControlConnection {
     func retainWindowSizeClaims(for liveWindowIDs: Set<Int>) {
         lastWindowSizes = lastWindowSizes.filter { liveWindowIDs.contains($0.key) }
         sentWindowSizes = sentWindowSizes.filter { liveWindowIDs.contains($0.key) }
+        legacyWindowSizingConfigured.formIntersection(liveWindowIDs)
+        if let id = interactiveSizingWindowId, !liveWindowIDs.contains(id) {
+            interactiveSizingWindowId = nil
+            interactiveSizingOwnerId = nil
+        }
         windowClaimParityRearmsSpent = windowClaimParityRearmsSpent.filter { liveWindowIDs.contains($0.key) }
         maximumWindowClaimColumns = lastWindowSizes.values.reduce(0) { max($0, $1.0) }
         maximumWindowClaimRows = lastWindowSizes.values.reduce(0) { max($0, $1.1) }
@@ -138,10 +148,10 @@ extension RemoteTmuxControlConnection {
     /// ``reseedAfterReconnect()`` re-pins every window (a fresh ssh client
     /// otherwise reverts everything to 80×24).
     ///
-    /// If the server rejects the `@id:` form (`%error` — pre-3.x tmux), the
-    /// connection flips to the session-wide fallback for its lifetime and
-    /// surfaces the degraded mode in diagnostics; callers keep calling this
-    /// method either way.
+    /// If the server rejects the `@id:` form (including tmux 3.2a), the
+    /// connection uses a session-wide client size and configures mirrored
+    /// windows to follow the last interacting client. Geometry records dimensions;
+    /// explicit focus/input transfers ownership through `activateWindowSizing`.
     func setWindowSize(windowId: Int, columns: Int, rows: Int) {
         guard columns > 0, rows > 0 else { return }
         // Record desired state before dedup. If a different debounced size is
@@ -150,7 +160,10 @@ extension RemoteTmuxControlConnection {
         _ = recordWindowSizeClaim(windowId: windowId, columns: columns, rows: rows)
         lastSizeRequestWindowId = windowId
         guard supportsPerWindowSize else {
-            setClientSize(columns: columns, rows: rows)
+            configureLegacyWindowSizing(windowId: windowId)
+            if interactiveSizingWindowId == nil || interactiveSizingWindowId == windowId {
+                setClientSize(columns: columns, rows: rows)
+            }
             return
         }
         // The CLIENT's own size must cover the largest window claim: tmux
@@ -269,6 +282,7 @@ extension RemoteTmuxControlConnection {
     /// Sends the per-window form, tagging the command so an `%error` reply
     /// can flip the capability off and replay via the session-wide path.
     func sendPerWindowSize(windowId: Int, columns: Int, rows: Int) {
+        guard supportsPerWindowSize else { return }
         // Record AFTER the send reports success: a send attempted while the
         // transport is down returns false, and recording it anyway makes
         // the ledger claim the server has a size it never received — dedup
@@ -289,16 +303,90 @@ extension RemoteTmuxControlConnection {
     func notePerWindowSizeRejected() {
         guard supportsPerWindowSize else { return }
         supportsPerWindowSize = false
-        record("remote.tmux.perWindowSize unsupported; falling back to session-wide client size")
+        for task in windowSizeDebounceTasks.values { task.cancel() }
+        windowSizeDebounceTasks.removeAll()
+        for task in perWindowRedrawKickTasks.values { task.cancel() }
+        perWindowRedrawKickTasks.removeAll()
+        sentWindowSizes.removeAll()
+        _ = send("set-option -g focus-events on")
+        _ = send("refresh-client -f ignore-size")
+        record("remote.tmux.perWindowSize unsupported; using latest interaction with session-wide client size")
+        for windowId in lastWindowSizes.keys.sorted() {
+            configureLegacyWindowSizing(windowId: windowId)
+        }
         // Replay the most recently requested window's size — deterministic,
         // and in practice the visible tab's. (`.values.first` on a Dictionary
         // could hand the session a hidden tab's stale claim.)
         let replay = lastSizeRequestWindowId.flatMap { lastWindowSizes[$0] } ?? lastWindowSizes.values.first
         if let replay {
             setClientSize(columns: replay.0, rows: replay.1)
         }
+        if let windowId = interactiveSizingWindowId {
+            _ = activateWindowSizing(windowId: windowId, ownerId: interactiveSizingOwnerId)
+        }
+    }
+
+    /// Removes the previous compatibility policy. Latest keeps a background
+    /// cmux connection from permanently limiting a native terminal's grid.
+    func configureLegacyWindowSizing(windowId: Int) {
+        guard !supportsPerWindowSize,
+              connectionState == .connected,
+              !legacyWindowSizingConfigured.contains(windowId) else { return }
+        guard sendTracked(
+            "set-option -w -t @\(windowId) window-size latest",
+            completion: { [weak self] succeeded in
+                if !succeeded { self?.legacyWindowSizingConfigured.remove(windowId) }
+            }
+        ) else { return }
+        legacyWindowSizingConfigured.insert(windowId)
+        lastSentClientSize = nil
+    }
+
+    /// Only explicit user focus/input calls this. In tmux 3.2a neither
+    /// refresh-client -C nor send-keys updates w->latest. select-window does,
+    /// then the final refresh commits its otherwise deferred resize immediately.
+    /// Native terminal input/resize can subsequently take ownership naturally.
+    @discardableResult
+    func activateWindowSizing(windowId: Int, ownerId: UUID? = nil) -> Bool {
+        interactiveSizingWindowId = windowId
+        interactiveSizingOwnerId = ownerId
+        guard !supportsPerWindowSize else { return true }
+        guard let size = lastWindowSizes[windowId] else { return true }
+        guard connectionState == .connected else { return false }
+        let sessionTarget = sessionId.map { "'$\($0)'" }
+            ?? RemoteTmuxHost.controlModeLineSafeName(sessionName)
+                .map { RemoteTmuxHost.shellSingleQuoted("=" + $0) }
+        guard let sessionTarget else { return false }
+        clientSizeDebounceTask?.cancel()
+        clientSizeDebounceTask = nil
+        let commands = [
+            "refresh-client -f '!ignore-size'",
+            "set-option -w -t @\(windowId) window-size latest",
+            "select-window -t \(sessionTarget):@\(windowId)",
+            "refresh-client -C \(size.0)x\(size.1)"
+        ]
+        guard sendBatchInternal(commands, kinds: commands.map { _ in .other }) else { return false }
+        lastClientSize = (size.0, size.1)
+        lastSentClientSize = lastClientSize
+        scheduleAttachRedrawKickIfNeeded()
+        return true
+    }
+
+    func deactivateWindowSizing(windowId: Int, ownerId: UUID? = nil) {
+        guard interactiveSizingWindowId == windowId,
+              ownerId == nil || ownerId == interactiveSizingOwnerId else { return }
+        interactiveSizingWindowId = nil
+        interactiveSizingOwnerId = nil
+        if !supportsPerWindowSize { _ = send("refresh-client -f ignore-size") }
     }
 
+    func activatePaneSizing(paneId: Int) -> Bool {
+        guard !supportsPerWindowSize else { return true }
+        guard let windowId = publishedWindowIdByPane[paneId]
+            ?? windowsByID.values.first(where: { $0.paneIDsInOrder.contains(paneId) })?.id
+        else { return false }
+        return activateWindowSizing(windowId: windowId)
+    }
 
     /// One-shot, attach-only: force a real SIGWINCH when the attach size push was a
     /// no-op, so a running TUI re-renders the current frame at the current width.
@@ -354,8 +442,8 @@ extension RemoteTmuxControlConnection {
                 return
             } else {
                 // Only kick when some mirrored window ALREADY has the target size — i.e. the
-                // size apply above cannot produce a SIGWINCH for it. (window-size latest makes
-                // every window track the client, so one client-level kick redraws them all.)
+                // size apply above cannot produce a SIGWINCH for it. A client-level
+                // kick redraws the windows whose size is bounded by this client.
                 let windowAlreadyAtTarget = windowsByID.values.contains {
                     Self.windowMatchesClaim(
                         windowColumns: $0.width, windowRows: $0.height,

Sources/RemoteTmuxControlConnection.swift

@@ -195,6 +195,11 @@ final class RemoteTmuxControlConnection {
     var windowSizeDebounceTasks: [Int: Task<Void, Never>] = [:]
     /// Whether the server accepts per-window `refresh-client -C` sizing.
     var supportsPerWindowSize = true
+    /// Mirrored legacy windows migrated from the old smallest policy to latest.
+    var legacyWindowSizingConfigured: Set<Int> = []
+    /// Last window explicitly activated by the user, never by a layout echo.
+    var interactiveSizingWindowId: Int?
+    var interactiveSizingOwnerId: UUID?
     /// Instant of the most recent sizing write on this connection — kept for
     /// diagnostics (how stale is the last size request).
     var lastSizingSendAt: ContinuousClock.Instant?