fix: repair the regressions and dead paths introduced by the 2026-09-07/08 merges

src/main/agentNames/ipc.ts

@@ -2,6 +2,10 @@ import { ipcMain } from 'electron'
 import { join } from 'node:path'
 import { z } from 'zod'
 
+import {
+  AGENT_NAME_IDENTITY_MAX_LENGTH,
+  AGENT_NAME_IDENTITY_REQUEST_MAX,
+} from '@shared/types/agentNames.js'
 import { AgentNameRegistry } from '@main/agentNames/registry.js'
 import { STATE_DIR } from '@main/storage/paths.js'
 import { getBrowserWindow, windowIdFor } from '@main/window/windowRegistry.js'
@@ -14,9 +18,12 @@ import { getBrowserWindow, windowIdFor } from '@main/window/windowRegistry.js'
 // address — so the two must not be able to take each other down.
 export const AGENT_NAMES_FILE = join(STATE_DIR, 'agent-names.json')
 
-// Bounded so a malformed or hostile renderer cannot make the allocator walk a
-// huge list under the serialization tail. 10k is far past any real workspace.
-const requestSchema = z.array(z.string().min(1).max(200)).max(10_000)
+// Both bounds come from the shared contract, because the renderer's
+// `identityOf` has to refuse exactly what this refuses — see
+// shared/types/agentNames.ts for the batch-wide failure that drift caused.
+const requestSchema = z
+  .array(z.string().min(1).max(AGENT_NAME_IDENTITY_MAX_LENGTH))
+  .max(AGENT_NAME_IDENTITY_REQUEST_MAX)
 
 /**
  * The ONLY consumer of AgentNameRegistry.

src/main/agentNames/registry.ts

@@ -98,6 +98,30 @@ function adoptAssignments(source: Record<string, string>): Record<string, string
 export class AgentNameRegistry {
   private state: RegistryState | undefined
 
+  /**
+   * Normalized spoken names currently assigned, kept alongside `state`.
+   *
+   * WHY it is cached instead of rebuilt: `allocate` used to walk every value
+   * and normalize it on EVERY call, purely to answer "has a hand-edited file
+   * already used this name". That is O(assignments) work per allocation for a
+   * question whose answer only changes when this process assigns something,
+   * and this process is the single writer after the first load. `load` already
+   * builds exactly this set for its duplicate check, so caching it there costs
+   * nothing and makes the common path proportional to the NEW names.
+   *
+   * WHY there is still no prune path, which would bound the file properly:
+   * assignments can only be dropped by knowing which identities are still
+   * live, and no single window knows that. A window holds its own workspace,
+   * not the others', so pruning against one window's identity set would delete
+   * names belonging to agents open in another window and hand those names out
+   * again. That is a correctness bug traded for a size nicety. The growth rate
+   * was the real problem and it is fixed at the source: successors mid-replace
+   * no longer burn an allocation each (see the renderer's
+   * pendingIdentityCarry), so the file now grows once per genuinely new agent
+   * rather than once per reload, resume, rewind and provider switch.
+   */
+  private usedNames: Set<string> | undefined
+
   // WHY one promise tail rather than a mutex or a per-identity lock: every
   // allocation reads the whole counter and writes the whole file, so the
   // critical section is the entire operation. Two windows starting agents in
@@ -129,6 +153,7 @@ export class AgentNameRegistry {
         throw new Error(`Agent name registry at ${this.path} is unreadable; refusing to overwrite it`, { cause: error })
       }
       this.state = { version: 1, nextIndex: 0, assignments: emptyAssignments() }
+      this.usedNames = new Set()
       return this.state
     }
 
@@ -167,7 +192,13 @@ export class AgentNameRegistry {
       // name makes every later lookup ambiguous with no evidence for choosing
       // between them.
       const spoken = Object.values(assignments).map(normalizeAgentName)
-      if (new Set(spoken).size !== spoken.length) throw new Error('Two identities share one spoken name')
+      const distinct = new Set(spoken)
+      if (distinct.size !== spoken.length) throw new Error('Two identities share one spoken name')
+      // Assigned here rather than after the try, so a file that fails
+      // validation leaves BOTH `state` and this cache unset — the refusal has
+      // to be all-or-nothing or a later allocation would consult a set that
+      // describes a registry we refused to load.
+      this.usedNames = distinct
     } catch (error) {
       // WHY this is not cached and not repaired: leaving `this.state` unset
       // means every later call re-reads and re-fails, so the user gets a
@@ -188,7 +219,14 @@ export class AgentNameRegistry {
     // we mutated in place, a write error would leave this process believing it
     // had published names that are not on disk.
     const draft: RegistryState = { ...loaded, assignments: adoptAssignments(loaded.assignments) }
-    const used = new Set(Object.values(draft.assignments).map(normalizeAgentName))
+    // `load` guarantees this alongside `state`; the fallback keeps the type
+    // honest without pretending an unloaded registry is an empty one.
+    const used = this.usedNames ?? new Set<string>()
+    // Every name this call adds, so a failed commit can undo its effect on the
+    // shared cache. The draft's assignments are already a copy and roll back
+    // for free; this set is not, because copying it per allocation is the cost
+    // being removed.
+    const added: string[] = []
     let changed = false
 
     for (const identity of identities) {
@@ -210,11 +248,24 @@ export class AgentNameRegistry {
       // would have to reconcile two divergent counters with no evidence.
       while (used.has(normalizeAgentName(name))) name = agentNameAt(draft.nextIndex++)
       draft.assignments[identity] = name
-      used.add(normalizeAgentName(name))
+      const normalized = normalizeAgentName(name)
+      used.add(normalized)
+      added.push(normalized)
       changed = true
     }
 
-    if (changed) await this.commit(draft)
+    if (changed) {
+      try {
+        await this.commit(draft)
+      } catch (error) {
+        // Same contract as the draft copy above: a write that did not land
+        // must leave this process believing nothing was published. Leaving the
+        // names in the cache would make the retry skip past them and burn the
+        // vocabulary for allocations that never happened.
+        for (const name of added) used.delete(name)
+        throw error
+      }
+    }
     return Object.fromEntries(identities.map(identity => [identity, draft.assignments[identity]]))
   }
 

src/main/index.ts

@@ -205,7 +205,22 @@ const caffeinateController = new CaffeinateController()
 // no async boot step — only the per-run unlock boolean.
 const vaultService = new VaultService({
   store: createFileVaultStore(join(STATE_DIR, 'key-vault'), createSafeStorageCodec()),
-  promptAuth: reason => systemPreferences.promptTouchID(reason),
+  promptAuth: async reason => {
+    // WHY the platform check lives HERE and not in ensureUnlocked: the service
+    // deliberately attempts the prompt rather than pre-gating on
+    // canPromptAuth, because that flag once reported biometric capability only
+    // and pre-gating locked out every password-only Mac from the login-password
+    // path this feature promises. That reasoning is right for capability. It is
+    // NOT right for a platform that has no promptTouchID at all: there,
+    // "attempt it" meant calling undefined, and the user got a raw
+    // "systemPreferences.promptTouchID is not a function" TypeError instead of
+    // the honest platform message. Fails closed either way; only the wording
+    // was broken.
+    if (process.platform !== 'darwin' || typeof systemPreferences.promptTouchID !== 'function') {
+      throw new Error('The API key vault needs macOS Touch ID or login-password authentication, which this platform does not provide.')
+    }
+    await systemPreferences.promptTouchID(reason)
+  },
   // canPromptTouchID checks biometrics, not user-presence/password auth.
   // Electron 43's promptTouchID uses SecAccessControlUserPresence; attempt
   // that supported macOS API and let rejection keep the vault locked.

src/main/sessionManager.codexReplacement.test.ts

@@ -21,6 +21,21 @@ const { createSession, resolveTranscriptPath } = vi.hoisted(() => ({
   resolveTranscriptPath: vi.fn(),
 }))
 
+vi.mock('@main/workspaceDirectory.js', () => ({
+  // These suites spawn into synthetic paths ('/tmp/project', '/recorded/worktree')
+  // that intentionally do not exist on disk. The real spawn-path guard stats the
+  // cwd, so it is stubbed here; workspaceDirectory.test.ts covers the guard
+  // itself, and sessionManager.recover.test.ts overrides this mock to prove the
+  // manager surfaces a missing folder.
+  MissingWorkspaceDirectoryError: class MissingWorkspaceDirectoryError extends Error {
+    constructor(readonly cwd: string) {
+      super(`Workspace folder is missing: ${cwd}`)
+      this.name = 'MissingWorkspaceDirectoryError'
+    }
+  },
+  assertWorkspaceDirectoryExists: vi.fn(async () => {}),
+}))
+
 vi.mock('@providers/registry.main.js', () => ({
   getMainProvider: () => ({ createSession, resolveTranscriptPath }),
 }))

src/main/sessionManager.lifecycle.test.ts

@@ -13,6 +13,21 @@ const { createSession, deliverPrompt } = vi.hoisted(() => ({
   deliverPrompt: vi.fn(),
 }))
 
+vi.mock('@main/workspaceDirectory.js', () => ({
+  // These suites spawn into synthetic paths ('/tmp/project', '/recorded/worktree')
+  // that intentionally do not exist on disk. The real spawn-path guard stats the
+  // cwd, so it is stubbed here; workspaceDirectory.test.ts covers the guard
+  // itself, and sessionManager.recover.test.ts overrides this mock to prove the
+  // manager surfaces a missing folder.
+  MissingWorkspaceDirectoryError: class MissingWorkspaceDirectoryError extends Error {
+    constructor(readonly cwd: string) {
+      super(`Workspace folder is missing: ${cwd}`)
+      this.name = 'MissingWorkspaceDirectoryError'
+    }
+  },
+  assertWorkspaceDirectoryExists: vi.fn(async () => {}),
+}))
+
 vi.mock('@providers/registry.main.js', () => ({
   getMainProvider: () => ({ createSession, deliverPrompt }),
 }))

src/main/sessionManager.recover.test.ts

@@ -12,6 +12,21 @@ const terminalControl = vi.hoisted(() => ({
   stop: vi.fn(async (): Promise<void> => {}),
 }))
 
+vi.mock('@main/workspaceDirectory.js', () => ({
+  // These suites spawn into synthetic paths ('/tmp/project', '/recorded/worktree')
+  // that intentionally do not exist on disk. The real spawn-path guard stats the
+  // cwd, so it is stubbed here; workspaceDirectory.test.ts covers the guard
+  // itself, and the missing-folder case below overrides this mock to prove the
+  // manager surfaces it.
+  MissingWorkspaceDirectoryError: class MissingWorkspaceDirectoryError extends Error {
+    constructor(readonly cwd: string) {
+      super(`Workspace folder is missing: ${cwd}`)
+      this.name = 'MissingWorkspaceDirectoryError'
+    }
+  },
+  assertWorkspaceDirectoryExists: vi.fn(async () => {}),
+}))
+
 vi.mock('@providers/registry.main.js', () => ({
   getMainProvider: () => ({ createSession, deliverPrompt }),
 }))
@@ -92,6 +107,42 @@ describe('SessionManager recover', () => {
     terminalControl.stop.mockClear()
   })
 
+  it('reports the missing folder instead of a generic start failure', async () => {
+    // The 2026-09-08 regression report: six panes came up as ERROR after their
+    // git worktrees were deleted, and the only text the user ever saw was
+    // "agent exited before it became ready for input (start-failed)". node-pty
+    // chdirs inside the forked child, so without the spawn-path guard the PTY
+    // is created successfully and the process is dead microseconds later —
+    // recover() returns ok:true and the failure masquerades as a readiness
+    // timeout. This asserts the guard converts that into a message naming the
+    // folder, and marks it non-retryable so Dispatch stops re-spawning it.
+    const { assertWorkspaceDirectoryExists } = await import('@main/workspaceDirectory.js')
+    const { MissingWorkspaceDirectoryError } = await import('@main/workspaceDirectory.js')
+    vi.mocked(assertWorkspaceDirectoryExists).mockRejectedValueOnce(
+      new MissingWorkspaceDirectoryError('/tmp/deleted-worktree'),
+    )
+    const { SessionManager } = await import('./sessionManager')
+    const manager = new SessionManager()
+
+    const result = await manager.recover({
+      sessionId: 'gone-folder-session',
+      kind: 'claude',
+      cwd: '/tmp/deleted-worktree',
+    })
+
+    expect(result).toMatchObject({
+      ok: false,
+      code: 'start-failed',
+      retryable: false,
+      message: 'Workspace folder is missing: /tmp/deleted-worktree',
+    })
+    // No backend was constructed, and nothing was left half-claimed: the guard
+    // runs before the spawn reservation precisely so a retry is not fenced out
+    // by a session that never existed.
+    expect(createSession).not.toHaveBeenCalled()
+    expect(manager.getBackendSnapshot('gone-folder-session')).toBeNull()
+  })
+
   it('adopts a matching live backend without constructing another provider', async () => {
     const { SessionManager } = await import('./sessionManager')
     const manager = new SessionManager()

src/main/sessionManager.screenGate.test.ts

@@ -6,6 +6,21 @@ const { createSession, createTerminalSession } = vi.hoisted(() => ({
   createTerminalSession: vi.fn(),
 }))
 
+vi.mock('@main/workspaceDirectory.js', () => ({
+  // These suites spawn into synthetic paths ('/tmp/project', '/recorded/worktree')
+  // that intentionally do not exist on disk. The real spawn-path guard stats the
+  // cwd, so it is stubbed here; workspaceDirectory.test.ts covers the guard
+  // itself, and the missing-folder case below overrides this mock to prove the
+  // manager surfaces it.
+  MissingWorkspaceDirectoryError: class MissingWorkspaceDirectoryError extends Error {
+    constructor(readonly cwd: string) {
+      super(`Workspace folder is missing: ${cwd}`)
+      this.name = 'MissingWorkspaceDirectoryError'
+    }
+  },
+  assertWorkspaceDirectoryExists: vi.fn(async () => {}),
+}))
+
 vi.mock('@providers/registry.main.js', () => ({
   getMainProvider: () => ({
     name: 'Claude',

src/main/sessionManager.ts

@@ -34,6 +34,10 @@ import type {
   SessionRecoverResult,
 } from '@shared/types/session.js'
 import { TmuxRegistry } from '@main/tmux/TmuxRegistry.js'
+import {
+  MissingWorkspaceDirectoryError,
+  assertWorkspaceDirectoryExists,
+} from '@main/workspaceDirectory.js'
 import { performanceService } from '@main/performance/PerformanceService.js'
 import { getToolPath, refreshToolchainFromState } from '@main/setup/toolchain.js'
 import { resolveToolPath } from '@main/setup/binaryResolver.js'
@@ -1836,12 +1840,20 @@ export class SessionManager extends EventEmitter {
       return {
         ok: false,
         code: 'start-failed',
-        retryable: true,
+        // A deleted folder is not retryable: every retry re-runs the same
+        // stat and fails identically. The incident journal for 2026-09-08
+        // shows the old path retrying these spawns on each Dispatch select,
+        // which is pure noise once the cause is known.
+        retryable: !(error instanceof MissingWorkspaceDirectoryError),
         // WHY the raw provider exception stays out of IPC: binary launch
         // errors can contain environment values, proxy URLs, or scoped MCP
         // tokens. Main records the typed code and internal performance error;
         // renderer receives one stable, actionable message with no payload.
-        message: 'Session failed to start. Check provider setup and retry.',
+        // The missing-directory case is the deliberate exception — its
+        // message is curated and its payload is a path the UI already shows.
+        message: error instanceof MissingWorkspaceDirectoryError
+          ? error.message
+          : 'Session failed to start. Check provider setup and retry.',
       }
     } finally {
       if (this.recoveriesInFlight.get(options.sessionId) === claim) {
@@ -2422,6 +2434,13 @@ export class SessionManager extends EventEmitter {
     }
     const kind: SessionKind = options.kind ?? DEFAULT_PROVIDER
     const providerRuntime = resolveProviderRuntime(kind, options.providerRuntime)
+    // Fail here rather than in the forked child. See
+    // MissingWorkspaceDirectoryError for why a deleted cwd is otherwise
+    // invisible until the readiness wait times out. This runs before the
+    // spawn reservation so a missing folder leaves no half-claimed session
+    // behind, and it is in spawnWithId rather than in spawn()/recover()
+    // separately because this is the one funnel both of them pass through.
+    await assertWorkspaceDirectoryExists(options.cwd)
     if (
       this.sessions.has(sessionId) ||
       this.spawningSessionGenerations.has(sessionId) ||

src/main/sessionManager.wake.test.ts

@@ -6,6 +6,21 @@ const { createSession, createTerminalSession } = vi.hoisted(() => ({
   createTerminalSession: vi.fn(),
 }))
 
+vi.mock('@main/workspaceDirectory.js', () => ({
+  // These suites spawn into synthetic paths ('/tmp/project', '/recorded/worktree')
+  // that intentionally do not exist on disk. The real spawn-path guard stats the
+  // cwd, so it is stubbed here; workspaceDirectory.test.ts covers the guard
+  // itself, and sessionManager.recover.test.ts overrides this mock to prove the
+  // manager surfaces a missing folder.
+  MissingWorkspaceDirectoryError: class MissingWorkspaceDirectoryError extends Error {
+    constructor(readonly cwd: string) {
+      super(`Workspace folder is missing: ${cwd}`)
+      this.name = 'MissingWorkspaceDirectoryError'
+    }
+  },
+  assertWorkspaceDirectoryExists: vi.fn(async () => {}),
+}))
+
 vi.mock('@providers/registry.main.js', () => ({
   getMainProvider: () => ({
     name: 'OpenCode',