Fix coding-agent session naming across panes and tabs

README.md

@@ -30,7 +30,7 @@
 - **Live pane headers** — See your active directory, git branch, and context usage in every pane title bar, updating live as you work. Fresh-agent panes carry their context meter in their status strip instead of the header.
 - **Host pressure dashboard pane** — CPU, memory, pressure, and I/O at a glance with near-zero overhead (metrics stream only while you're watching). Linux, WSL, and macOS only — not shown on Windows.
 - **Activity notifications** — Configurable attention indicators (highlight, pulse, darken) on tabs and pane headers when a coding CLI finishes its turn, with click or type dismiss modes
-- **One name per agent conversation** — Every Claude, Codex, and OpenCode conversation gets a single short name that appears on its pane, tab, sidebar, and history — and stays that same name across refreshes, restarts, and other devices. Freshell names new conversations automatically as you work (short names built for a tab), you can rename from anywhere, and the name is written back to the CLI's own session list where the CLI supports it.
+- **One name per agent conversation** — Every Claude, Codex, and OpenCode conversation gets a single short name that appears on its pane, tab, sidebar, and history — and stays that same name across refreshes, restarts, and other devices. Freshell names new conversations automatically as you work (short names built for a tab), you can rename from anywhere, and the name is written back to the CLI's own session list where the CLI supports it. AI naming uses `GOOGLE_GENERATIVE_AI_API_KEY` at startup, or the Gemini key in Settings → Naming. Saving a nonempty Settings key replaces the running server's key; clearing the field takes effect after a restart, provided no environment key is set. With no key, naming uses the Freshell server's OneCLI connection, if it has one.
 - **Progressive sidebar search** — Two-phase search with instant local results followed by deep server-side content search
 - **Mobile responsive** — Auto-collapsing sidebar and overlay navigation for phones and tablets
 - **Stream Deck** — Drive freshell from an Elgato Stream Deck: tabs on keys with repo icons and status backgrounds (or classic live previews and status rings), press to focus, long-press to approve or stop agents. See [Stream Deck](#stream-deck).
@@ -209,7 +209,7 @@ Then unplug and replug the deck. Without the rule, the connection status shows "
 | `GEMINI_CMD` | No | Gemini CLI command override |
 | `KIMI_CMD` | No | Kimi CLI command override |
 | `AMPLIFIER_CMD` | No | Amplifier CLI command override |
-| `GOOGLE_GENERATIVE_AI_API_KEY` | No | Gemini API key for AI-powered terminal summaries |
+| `GOOGLE_GENERATIVE_AI_API_KEY` | No | Gemini API key for automatic conversation names and terminal summaries; takes precedence over Settings at startup |
 | `FRESHELL_CLAUDE_NODE` | No | Node executable for the isolated Claude SDK sidecar (normally set by Electron) |
 | `FRESHELL_CLAUDE_SIDECAR` | No | Claude sidecar entrypoint override for Rust development/service runs |
 | `FRESHELL_MCP_NODE` | No | Node executable for the standalone MCP client |

crates/freshell-codex/tests/remote_proxy_relay.rs

@@ -13,6 +13,8 @@
 //! (`transport.rs` is gated the same way).
 #![cfg(feature = "real-transport")]
 
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::Arc;
 use std::time::Duration;
 
 use futures_util::{SinkExt, StreamExt};
@@ -1818,3 +1820,153 @@ async fn canary_warning_does_not_suppress_the_first_over_cap_capacity_trigger()
 
     proxy.close().await;
 }
+
+// ── 14. the live repair-trigger loop stays fixed (name-reliability plan
+//         2026-10-21, Task 12 Step 0) ────────────────────────────────────────────
+
+/// The live log's repair-trigger flood (~1.6 lines per second per codex pane,
+/// "upstream connection errored." then "client connection errored.") was one
+/// loop per pane: the TUI polls `plugin/list`, whose ~17.8 MB response
+/// exceeded the proxy's old 16 MiB transport default, so the upstream read
+/// failed, the hub tore the connection down, and the TUI reconnected and
+/// polled again. This is the size of that response.
+const INCIDENT_PLUGIN_LIST_BYTES: usize = 17_800_000;
+
+/// How long the reconnecting TUI runs. The old caps looped roughly every
+/// second on loopback, so this window would have seen several cycles.
+const RECONNECT_LOOP_WINDOW: Duration = Duration::from_secs(5);
+
+/// An upstream app-server that answers EVERY request on EVERY connection with
+/// the incident-sized `plugin/list` response (its sockets read at the proxy
+/// caps, like a real app-server's uncapped reader). Counts accepted
+/// connections.
+async fn start_plugin_list_upstream() -> (String, Arc<AtomicUsize>) {
+    let listener = TcpListener::bind(("127.0.0.1", 0)).await.unwrap();
+    let addr = listener.local_addr().unwrap();
+    let accepted = Arc::new(AtomicUsize::new(0));
+    let counter = Arc::clone(&accepted);
+    let response = Arc::new(
+        json!({"id": 1, "result": {"data": huge_string(INCIDENT_PLUGIN_LIST_BYTES)}}).to_string(),
+    );
+    tokio::spawn(async move {
+        while let Ok((stream, _)) = listener.accept().await {
+            counter.fetch_add(1, Ordering::SeqCst);
+            let response = Arc::clone(&response);
+            tokio::spawn(async move {
+                let Ok(mut ws) = accept_async_with_config(stream, Some(proxy_ws_config())).await
+                else {
+                    return;
+                };
+                while let Some(Ok(message)) = ws.next().await {
+                    if matches!(message, Message::Text(_))
+                        && ws
+                            .send(Message::Text(response.as_ref().clone()))
+                            .await
+                            .is_err()
+                    {
+                        return;
+                    }
+                }
+            });
+        }
+    });
+    (format!("ws://{}:{}", addr.ip(), addr.port()), accepted)
+}
+
+/// What the reconnecting TUI saw by the end of its window.
+struct TuiLoopReport {
+    connects: usize,
+    responses: usize,
+    /// The connection open at the deadline (closed by the caller after it has
+    /// drained the proxy's events, so the test's own teardown is not counted).
+    open: Option<
+        tokio_tungstenite::WebSocketStream<
+            tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>,
+        >,
+    >,
+}
+
+/// The incident TUI: poll `plugin/list` every 500 ms and reconnect at once
+/// whenever the socket ends, until `window` elapses.
+async fn run_reconnecting_plugin_list_tui(proxy_url: &str, window: Duration) -> TuiLoopReport {
+    let deadline = tokio::time::Instant::now() + window;
+    let mut report = TuiLoopReport {
+        connects: 0,
+        responses: 0,
+        open: None,
+    };
+    let poll = json!({"id": 1, "method": "plugin/list", "params": {}}).to_string();
+    while tokio::time::Instant::now() < deadline {
+        let mut ws = connect_tui_with_ws_config(proxy_url, proxy_ws_config()).await;
+        report.connects += 1;
+        let mut next_poll = tokio::time::Instant::now();
+        loop {
+            if tokio::time::Instant::now() >= deadline {
+                report.open = Some(ws);
+                return report;
+            }
+            if tokio::time::Instant::now() >= next_poll {
+                if ws.send(Message::Text(poll.clone())).await.is_err() {
+                    break;
+                }
+                next_poll += Duration::from_millis(500);
+            }
+            let wake = next_poll.min(deadline);
+            match tokio::time::timeout_at(wake, ws.next()).await {
+                Err(_) => continue,
+                Ok(Some(Ok(Message::Text(text)))) => {
+                    if text.len() >= INCIDENT_PLUGIN_LIST_BYTES {
+                        report.responses += 1;
+                    }
+                }
+                Ok(Some(Ok(_))) => continue,
+                Ok(Some(Err(_))) | Ok(None) => break,
+            }
+        }
+    }
+    report
+}
+
+#[tokio::test]
+async fn incident_shaped_polling_tui_keeps_one_connection_and_logs_no_repair_trigger() {
+    // Production-default options (no cap injection): the 17.8 MB response
+    // relays, so the TUI is never disconnected, never reconnects, and the
+    // proxy reports nothing. With the old 16 MiB transport cap the same
+    // TUI reconnected every cycle (the loop the live log recorded).
+    let (upstream_url, accepted) = start_plugin_list_upstream().await;
+    let (proxy, mut events) =
+        CodexRemoteProxy::start(CodexRemoteProxyOptions::new(&upstream_url, true))
+            .await
+            .unwrap();
+
+    let report = run_reconnecting_plugin_list_tui(proxy.ws_url(), RECONNECT_LOOP_WINDOW).await;
+
+    let mut triggers = Vec::new();
+    while let Ok(event) = events.try_recv() {
+        if let RemoteProxyEvent::RepairTrigger(trigger) = event {
+            triggers.push(trigger);
+        }
+    }
+    assert_eq!(
+        (report.connects, accepted.load(Ordering::SeqCst)),
+        (1, 1),
+        "the TUI keeps one connection (and the proxy one upstream dial) for the whole window \
+         (repair triggers seen: {triggers:?})"
+    );
+    assert!(
+        report.responses >= 2,
+        "the TUI must actually receive the incident-sized response (got {} in {:?})",
+        report.responses,
+        RECONNECT_LOOP_WINDOW
+    );
+    assert_eq!(
+        triggers,
+        Vec::<RemoteProxyRepairTrigger>::new(),
+        "an incident-sized response must not produce repair triggers"
+    );
+
+    if let Some(mut ws) = report.open {
+        let _ = ws.close(None).await;
+    }
+    proxy.close().await;
+}

crates/freshell-freshagent/Cargo.toml

@@ -108,8 +108,8 @@ tracing = "0.1"
 libc = "0.2"
 
 [dev-dependencies]
-# `test-util` unlocks `#[tokio::test(start_paused = true)]`, so the shared quiet
-# deadman's waiter tests drive its window on a paused clock.
+# `test-util` drives the quiet deadman and naming bind's bounded retries on
+# paused clocks.
 tokio = { version = "1", features = ["rt-multi-thread", "macros", "sync", "time", "test-util"] }
 tower = { version = "0.5", features = ["util"] }
 # DIAG-01 test facility: a capturing `Layer` + `tracing::subscriber::set_default`

crates/freshell-freshagent/src/claude.rs

@@ -6532,6 +6532,7 @@ mod send_outcome;
 pub use send_outcome::ClaudeSendOutcome;
 
 mod attach;
+mod continuation_name;
 mod establish;
 mod fork;
 mod genesis;

crates/freshell-freshagent/src/claude/continuation_name.rs

@@ -0,0 +1,41 @@
+//! Undo/redo replaces a runtime while continuing the same conversation.
+//! Its child inherits the current saved name once; explicit fork-to-new
+//! and ordinary conversation switches never call this operation.
+
+use super::*;
+use crate::naming::NameError;
+use freshell_protocol::session_names::{NamedProvider, SessionNameRef};
+
+impl FreshClaudeState {
+    pub(super) async fn preserve_rollback_name(
+        &self,
+        original_session: &str,
+        replacement: &str,
+        session_type: &str,
+    ) -> Result<(), NameError> {
+        if session_type == "kilroy" {
+            return Ok(());
+        }
+        let Some(sink) = self.naming() else {
+            return Ok(());
+        };
+        let durable = SessionNameRef::Session {
+            provider: NamedProvider::Claude,
+            session_id: original_session.into(),
+        };
+        // Establishment binds creates to their native UUID. A prior undo
+        // may have independently renamed this child, so copy this current
+        // durable record, never an ancestor's pending handle.
+        let source = durable;
+        let target = SessionNameRef::Session {
+            provider: NamedProvider::Claude,
+            session_id: replacement.into(),
+        };
+        sink.continue_session(source, target.clone())
+            .await
+            .inspect_err(|error| {
+                crate::naming::log_name_error("internal_continuation", &target, error);
+            })?;
+        Ok(())
+    }
+}

crates/freshell-freshagent/src/claude/rollback.rs

@@ -965,6 +965,26 @@ impl FreshClaudeState {
             }
         };
 
+        // Preserve the name before any identity announcement can re-key a
+        // resumed pane. The source stays independent, including its manual
+        // provenance. A failed name commit leaves the original live.
+        if self
+            .preserve_rollback_name(&durable_id, &replacement, session_type)
+            .await
+            .is_err()
+        {
+            self.unwind_replacement(&replacement, &durable_id, lease_held)
+                .await;
+            self.compensate_rollback_record(&durable_id, existing.clone())
+                .await;
+            reply_sink(rollback_error_frame(
+                &op,
+                "NAME_PERSISTENCE_FAILED",
+                "The conversation's saved name could not be retained. Try again.",
+            ));
+            return;
+        }
+
         // ONE awaited ledger batch: the replacement's binding (its genesis,
         // the original's settings, `supersedes` = the original, which retires
         // the original's row and links it to the replacement) with the

crates/freshell-freshagent/src/codex.rs

@@ -12282,6 +12282,7 @@ pub(crate) mod tests {
                 document_generation: 1,
                 changed: false,
                 native_sync: None,
+                outcome: None,
             }
         }
     }