fix(workspace): pair the attach snapshot with the scope its binding was resolved under

The sidebar and boot box read the snapshot under the scope captured around the
binding resolve; the boot box clears another account's lines. Status ignores a
partial attach-time selection and lists each unreported tool once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172qrhMa5TQgETASi5hxMqD

Author: ralphstodomingo

packages/opencode/src/altimate/workspace/attach-snapshot.ts

@@ -158,6 +158,7 @@ function isSnapshot(v: unknown): v is AttachSnapshot {
   if (s.declared !== null) {
     const d = s.declared as Partial<Declared> | undefined
     if (!d || !isStringArray(d.keys) || !isStringArray(d.extensionKeys)) return false
+    if (d.partial !== undefined && d.partial !== true) return false
     // The optional groupings too: the status view iterates them.
     if (d.integrations !== undefined) {
       if (!Array.isArray(d.integrations)) return false

packages/opencode/src/altimate/workspace/engine-probes.ts

@@ -153,7 +153,17 @@ export async function declared(workspaceId: string): Promise<Declared | null> {
       extensionKeys.push(...toolKeys)
       if (toolKeys.length > 0) extensions.push({ id: integration.id, name, keys: toolKeys })
     }
-    return { keys, extensionKeys, ...(extensions.length > 0 ? { extensions } : {}), integrations }
+    // The schema lets the list, or an integration's tools, be absent; neither is
+    // an empty selection.
+    const list = workspace.integrations
+    const partial = !Array.isArray(list) || list.some((i) => !Array.isArray(i.tools))
+    return {
+      keys,
+      extensionKeys,
+      ...(extensions.length > 0 ? { extensions } : {}),
+      integrations,
+      ...(partial ? { partial: true as const } : {}),
+    }
   } catch (err) {
     log.warn("could not read the declared workspace integrations", { workspaceId, err: String(err) })
     return null

packages/opencode/src/altimate/workspace/engine-types.ts

@@ -86,6 +86,10 @@ export type Declared = {
    * attach was measured against even after the selection changes. Optional, like
    * `extensions`. */
   integrations?: DeclaredIntegration[]
+  /** The lookup's response left out the integration list or an integration's
+   * tools, so `integrations` is not a known selection: nothing can tell whether
+   * the selection changed since. */
+  partial?: true
 }
 
 export type DeclaredExtension = { id: string; name: string; keys: string[] }

packages/opencode/src/altimate/workspace/status-view.ts

@@ -111,9 +111,16 @@ export function buildStatusView(
     })
     const gaps = toGaps(reported.get(integration.id) ?? [])
     // An extension's absent keys are expected without its IDE bridge, not dropped.
+    // One per catalog entry, like `served`.
+    const missing = new Set<string>()
     const unreported = integration.extension
       ? []
-      : integration.keys.filter((k) => !present.has(sanitize(k)) && !reportedKeys.has(k))
+      : integration.keys.filter((k) => {
+          const entry = sanitize(k)
+          if (present.has(entry) || reportedKeys.has(k) || missing.has(entry)) return false
+          missing.add(entry)
+          return true
+        })
     rows.push({
       id: integration.id,
       name: names.get(integration.id) ?? integration.name ?? `Integration ${integration.id}`,
@@ -153,8 +160,12 @@ export function buildStatusView(
     ...counts,
     rows,
     extras,
+    // Only when both sides are known selections: the attach's read can be partial too.
     selectionChanged:
-      !!live?.selection && !!snapshot.declared?.integrations && !sameSelection(declaredIntegrations, live.selection),
+      !!live?.selection &&
+      !!snapshot.declared?.integrations &&
+      !snapshot.declared.partial &&
+      !sameSelection(declaredIntegrations, live.selection),
   }
 }
 
@@ -220,16 +231,25 @@ export function sidebarAttachLine(snapshot: AttachSnapshot, now = Date.now()): s
   return `${statusHeadline(snapshotCounts(snapshot))} · last session ${describeAge(snapshot.at, now)}`
 }
 
-/** The last attach for `binding`, matched under the account scope the binding
- * cache and the overlay use (tenant, URL and credential digest). Undefined when
- * no session has attached to it under these credentials. */
-export async function boundAttachSnapshot(
+/** The last attach for `binding`, matched under `scope`, the account scope the
+ * binding was resolved under (`accountScope`, read around that resolve by the
+ * caller): never a scope sampled on its own, which could pair one account's
+ * binding with another's snapshot. Undefined when no session has attached to it
+ * under that scope. */
+export function boundAttachSnapshot(
   directory: string,
   binding: { datamateId: number | string } | null,
-): Promise<AttachSnapshot | undefined> {
-  if (!binding) return undefined
+  scope: string | null,
+): AttachSnapshot | undefined {
+  if (!binding || scope === null) return undefined
+  return currentAttachSnapshot(directory, { scope, datamateId: binding.datamateId })
+}
+
+/** The account scope a binding read now would run under, as the binding cache
+ * writes it; null when credentials do not resolve this instant. */
+export async function accountScope(): Promise<string | null> {
   const key = await currentScope().catch(() => null)
-  return currentAttachSnapshot(directory, { scope: key ? scopeStringOf(key) : null, datamateId: binding.datamateId })
+  return key ? scopeStringOf(key) : null
 }
 
 /** The live selection, or null when the read could not say what it is: a

packages/opencode/src/altimate/workspace/welcome-lines.ts

@@ -89,3 +89,34 @@ export function welcomeLinesFor(
   if (outcome.status === "unknown") return null
   return welcomeLines({ binding: outcome.status === "bound" ? outcome.binding : null, snapshot, now })
 }
+
+/** What the box shows, and the account scope it describes. */
+export interface WelcomeState {
+  lines: WelcomeLines | null
+  scope: string | null
+}
+
+/** One refresh of the box. `scopeBefore` and `scopeAfter` bracket the binding
+ * resolve and the snapshot read. Lines that belong to another account are
+ * cleared as soon as a different one reads; a pass whose account moved
+ * underneath it is dropped, so one account's binding never shows with
+ * another's numbers; an unknown answer leaves the box as it is. A null scope is
+ * "could not read the credentials this instant", not a different account. */
+export function nextWelcomeState(
+  prev: WelcomeState,
+  read: {
+    scopeBefore: string | null
+    outcome: BindingOutcome
+    snapshot: AttachSnapshot | undefined
+    scopeAfter: string | null
+    now?: number
+  },
+): WelcomeState {
+  const base =
+    prev.scope !== null && read.scopeBefore !== null && read.scopeBefore !== prev.scope
+      ? { lines: null, scope: null }
+      : prev
+  if (read.scopeAfter !== read.scopeBefore) return base
+  const lines = welcomeLinesFor(read.outcome, read.snapshot, read.now)
+  return lines ? { lines, scope: read.scopeBefore } : base
+}

packages/opencode/src/plugin/tui/altimate/workspace-sidebar.tsx

@@ -17,7 +17,7 @@ import { buildManageUrl, resolveWorkspaceWebUrl } from "@/altimate/workspace/bro
 import { getResolvedWorkspaceId } from "@/altimate/workspace/session-context"
 // altimate_change start - counts from the last attach under the workspace name
 import { describeAge } from "@/altimate/workspace/attach-snapshot"
-import { boundAttachSnapshot, sidebarAttachLine } from "@/altimate/workspace/status-view"
+import { accountScope, boundAttachSnapshot, sidebarAttachLine } from "@/altimate/workspace/status-view"
 // altimate_change end
 import { AltimateApi } from "@/altimate/api/client"
 import { openManageUrl } from "./workspace"
@@ -71,29 +71,25 @@ function View(props: { api: TuiPluginApi }) {
   // altimate_change end
   // altimate_change start - what the last session got, in numbers
   const [attachLine, setAttachLine] = createSignal<string | null>(null)
-  const readAttachLine = async (bound: CachedBinding | null) => {
-    // Only for the workspace this project is bound to now, under these
-    // credentials; anything else would describe the wrong workspace by this
-    // name. Matched under the full account scope the overlay writes it with,
-    // not the tile's `tenant|apiUrl`.
-    const snapshot = await boundAttachSnapshot(props.api.state.path.directory, bound)
+  const readAttachLine = (bound: CachedBinding | null) => {
+    // Only for the workspace this project is bound to now, matched under the
+    // account scope that binding was resolved under (`boundScope`), the one the
+    // overlay writes the snapshot with; anything else would describe the wrong
+    // workspace by this name.
+    const snapshot = boundAttachSnapshot(props.api.state.path.directory, bound, boundScope)
     setAttachLine(snapshot ? sidebarAttachLine(snapshot) : null)
   }
   // altimate_change end
 
   let refreshInFlight = false
   let refreshQueued = false
   let disposed = false
-  /** `tenant|apiUrl` the current binding was resolved under. */
+  // altimate_change start - the full account scope, so a key switch on the same tenant is an account change too
+  /** The account scope (tenant, URL and credential digest) the current binding
+   * was resolved under: workspaces and their attach snapshots belong to it. */
   let boundScope: string | null = null
-  const currentScope = async (): Promise<string | null> => {
-    try {
-      const creds = await AltimateApi.getCredentials()
-      return `${creds.altimateInstanceName}|${creds.altimateUrl}`
-    } catch {
-      return null
-    }
-  }
+  const currentScope = (): Promise<string | null> => accountScope()
+  // altimate_change end
   const refresh = async (why: "poll" | "notify" = "poll") => {
     // A notification that lands mid-refresh is queued, not dropped: that pass
     // may already have read the old binding, and returning early would leave
@@ -190,7 +186,7 @@ function View(props: { api: TuiPluginApi }) {
       }
       const b = binding()
       // altimate_change start - what the last session got, in numbers
-      await readAttachLine(b ?? null)
+      readAttachLine(b ?? null)
       // altimate_change end
       // No clear here: every path that reaches this with no binding has already
       // cleared the manage URL, or never set one.

packages/opencode/src/plugin/tui/altimate/workspace-welcome.tsx

@@ -9,8 +9,8 @@ import type { TuiPlugin, TuiPluginApi } from "@opencode-ai/plugin/tui"
 import type { BuiltinTuiPlugin } from "@opencode-ai/tui/builtins"
 import { createSignal, onCleanup, onMount } from "solid-js"
 import { resolveBindingOutcome } from "@/altimate/workspace/state"
-import { boundAttachSnapshot } from "@/altimate/workspace/status-view"
-import { welcomeLinesFor, type WelcomeLines } from "@/altimate/workspace/welcome-lines"
+import { accountScope, boundAttachSnapshot } from "@/altimate/workspace/status-view"
+import { nextWelcomeState, type WelcomeState } from "@/altimate/workspace/welcome-lines"
 
 const id = "altimate:welcome-workspace"
 
@@ -23,7 +23,7 @@ const POLL_MS = 5_000
 
 function View(props: { api: TuiPluginApi }) {
   const theme = () => props.api.theme.current
-  const [lines, setLines] = createSignal<WelcomeLines | null>(null)
+  const [state, setState] = createSignal<WelcomeState>({ lines: null, scope: null })
   let inFlight = false
   const refresh = async () => {
     if (inFlight) return
@@ -34,10 +34,14 @@ function View(props: { api: TuiPluginApi }) {
       // would read as unlinked and the box would tell the user to run
       // `altimate-code link`. An unknown answer (the server unreachable) leaves
       // the box as it was rather than asserting either way.
+      // Bracketed by two account reads: after an account switch the box must
+      // not keep the previous account's workspace, nor pair one account's
+      // binding with another's numbers.
+      const scopeBefore = await accountScope()
       const outcome = await resolveBindingOutcome(dir).catch(() => ({ status: "unknown" }) as const)
-      const snapshot = await boundAttachSnapshot(dir, outcome.status === "bound" ? outcome.binding : null)
-      const next = welcomeLinesFor(outcome, snapshot)
-      if (next) setLines(next)
+      const snapshot = boundAttachSnapshot(dir, outcome.status === "bound" ? outcome.binding : null, scopeBefore)
+      const scopeAfter = await accountScope()
+      setState((prev) => nextWelcomeState(prev, { scopeBefore, outcome, snapshot, scopeAfter }))
     } finally {
       inFlight = false
     }
@@ -47,7 +51,7 @@ function View(props: { api: TuiPluginApi }) {
     const timer = setInterval(() => void refresh(), POLL_MS)
     onCleanup(() => clearInterval(timer))
   })
-  const current = () => lines()
+  const current = () => state().lines
   return (
     <box gap={0} paddingTop={1}>
       <text fg={theme().accent}>

packages/opencode/test/altimate/workspace/engine-probes.test.ts

@@ -63,6 +63,18 @@ describe("declared", () => {
     })
   })
 
+  test("a response missing the list or an integration's tools is marked partial, not an empty selection", async () => {
+    // The schema allows both; neither says the selection is empty. (codex)
+    api.isConfigured = async () => true
+    api.listIntegrations = async () => [{ id: "snowflake", type: "tool", tools: [] }]
+    for (const integrations of [undefined, null, [{ id: "snowflake" }]]) {
+      api.getDatamate = async () => ({ id: "42", name: "analytics", integrations })
+      expect((await declared("42"))?.partial).toBe(true)
+    }
+    api.getDatamate = async () => ({ id: "42", name: "analytics", integrations: [{ id: "snowflake", tools: [] }] })
+    expect((await declared("42"))?.partial).toBeUndefined()
+  })
+
   test("a workspace with no extension-type integration reports the flat lists only", async () => {
     api.isConfigured = async () => true
     api.getDatamate = async () => ({

packages/opencode/test/altimate/workspace/status-view.test.ts

@@ -17,6 +17,7 @@ afterAll(() => {
 })
 
 const {
+  accountScope,
   boundAttachSnapshot,
   buildStatusView,
   loadStatusView,
@@ -106,6 +107,14 @@ describe("buildStatusView", () => {
     expect(statusHeadline(view)).toBe("2 of 5 integration tools available · 3 need attention")
   })
 
+  test("a selection the attach could only read in part is never reported as changed", () => {
+    // The attach-time read omitted the list or an integration's tools. (codex)
+    const partial = snapshot()
+    partial.declared = { ...partial.declared!, partial: true }
+    const view = buildStatusView(partial, { selection: [{ id: "slack", tools: [{ key: "slack_post" }] }], catalog })
+    expect(view.selectionChanged).toBe(false)
+  })
+
   test("the same selection in another order is not a change", () => {
     const view = buildStatusView(snapshot(), { selection: [...selection].reverse(), catalog })
     expect(view.selectionChanged).toBe(false)
@@ -153,6 +162,16 @@ describe("buildStatusView", () => {
     )
     expect(view.rows[0].served).toHaveLength(1)
     expect(rowLine(view.rows[0])).toStartWith("1 of 2")
+    // Nor are they two dropped tools when neither is served. (coderabbit)
+    const dropped = buildStatusView(
+      snapshot({
+        declared: { keys: ["jira.search", "jira_search"], extensionKeys: [], integrations: declared },
+        present: [],
+        unfulfilled: [],
+      }),
+      null,
+    )
+    expect(dropped.rows[0].unreported).toEqual(["jira.search"])
   })
 
   test("a row shows every distinct error its gaps carry", () => {
@@ -292,7 +311,7 @@ describe("loadStatusView", () => {
   })
 })
 
-describe("boundAttachSnapshot", () => {
+describe("boundAttachSnapshot and accountScope", () => {
   const DIR = "/proj/bound"
   const creds = { altimateUrl: "https://api.example.com", altimateInstanceName: "acme", altimateApiKey: "key-1" }
   let configured: ReturnType<typeof spyOn>
@@ -307,29 +326,32 @@ describe("boundAttachSnapshot", () => {
     credentials.mockRestore()
   })
   // The scope the overlay writes a snapshot under: the binding cache's, with the credential digest.
-  const accountScope = (apiKey: string) =>
+  const scopeFor = (apiKey: string) =>
     scopeStringOf({
       tenant: creds.altimateInstanceName,
       apiUrl: creds.altimateUrl,
       account: credentialDigest(creds.altimateUrl, creds.altimateInstanceName, apiKey),
     })
-
-  test("finds the attach the overlay wrote under the full account scope", async () => {
-    // The sidebar matched it under `tenant|apiUrl` and never found it. (kilo)
+  const written = (apiKey: string) =>
     writeAttachSnapshot(
       DIR,
-      snapshot({ workspace: { id: "6", name: "e2e-demo-live", key: workspaceIdentity(accountScope("key-1"), 6) } }),
+      snapshot({ workspace: { id: "6", name: "e2e-demo-live", key: workspaceIdentity(scopeFor(apiKey), 6) } }),
     )
-    expect((await boundAttachSnapshot(DIR, { datamateId: 6 }))?.workspace.id).toBe("6")
+
+  test("accountScope is the full scope the overlay writes the snapshot under", async () => {
+    // The sidebar matched under `tenant|apiUrl` and never found it. (kilo)
+    written("key-1")
+    const scope = await accountScope()
+    expect(scope).toBe(scopeFor("key-1"))
+    expect(boundAttachSnapshot(DIR, { datamateId: 6 }, scope)?.workspace.id).toBe("6")
   })
 
-  test("finds nothing for another key on the same tenant, or with no binding", async () => {
-    writeAttachSnapshot(
-      DIR,
-      snapshot({ workspace: { id: "6", name: "e2e-demo-live", key: workspaceIdentity(accountScope("key-2"), 6) } }),
-    )
-    expect(await boundAttachSnapshot(DIR, { datamateId: 6 })).toBeUndefined()
-    expect(await boundAttachSnapshot(DIR, null)).toBeUndefined()
+  test("a snapshot matches only under the scope the binding was resolved under", () => {
+    // Another key on the same tenant is another account; no binding or no scope finds nothing. (codex)
+    written("key-2")
+    expect(boundAttachSnapshot(DIR, { datamateId: 6 }, scopeFor("key-1"))).toBeUndefined()
+    expect(boundAttachSnapshot(DIR, { datamateId: 6 }, scopeFor("key-2"))?.workspace.id).toBe("6")
+    expect(boundAttachSnapshot(DIR, null, scopeFor("key-2"))).toBeUndefined()
+    expect(boundAttachSnapshot(DIR, { datamateId: 6 }, null)).toBeUndefined()
   })
 })
-

packages/opencode/test/altimate/workspace/welcome-lines.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test"
 import { workspaceIdentity, type AttachSnapshot } from "../../../src/altimate/workspace/attach-snapshot"
-import { WELCOME_LINE_MAX_CHARS, welcomeLines, welcomeLinesFor, WORKSPACE_COMMANDS } from "../../../src/altimate/workspace/welcome-lines"
+import { nextWelcomeState, WELCOME_LINE_MAX_CHARS, welcomeLines, welcomeLinesFor, WORKSPACE_COMMANDS } from "../../../src/altimate/workspace/welcome-lines"
 
 const binding = {
   datamateId: 6,
@@ -98,3 +98,32 @@ describe("welcomeLines", () => {
   })
 })
 
+describe("nextWelcomeState: one refresh of the box", () => {
+  // After an account switch the box must not keep the previous account's
+  // workspace, nor pair one account's binding with another's numbers. (coderabbit)
+  const A = "acme|https://api.example.com|a"
+  const B = "acme|https://api.example.com|b"
+  const shown = { lines: welcomeLines({ binding, snapshot: undefined }), scope: A }
+  const bound = { status: "bound", binding } as const
+  const unknown = { status: "unknown" } as const
+  type Case = [string, typeof shown | { lines: null; scope: null }, string | null, typeof bound | typeof unknown, string | null, "kept" | "cleared" | "new"]
+  test.each<Case>([
+    ["same account, resolved: the new lines", shown, A, bound, A, "new"],
+    ["same account, unknown: left as it is", shown, A, unknown, A, "kept"],
+    ["another account, unknown: the old account's lines go", shown, B, unknown, B, "cleared"],
+    ["another account, resolved: the new account's lines", shown, B, bound, B, "new"],
+    ["account moved during the pass: dropped, nothing paired", shown, A, bound, B, "kept"],
+    ["moved to another account during the pass: cleared, nothing committed", shown, B, bound, A, "cleared"],
+    ["credentials unreadable this instant: not another account", shown, null, unknown, null, "kept"],
+    ["first pass, resolved", { lines: null, scope: null }, A, bound, A, "new"],
+  ])("%s", (_label, prev, scopeBefore, outcome, scopeAfter, expected) => {
+    const next = nextWelcomeState(prev, { scopeBefore, outcome, snapshot: undefined, scopeAfter })
+    if (expected === "kept") expect(next).toBe(prev)
+    if (expected === "cleared") expect(next).toEqual({ lines: null, scope: null })
+    if (expected === "new") {
+      expect(next.lines?.mode).toStartWith("Workspace mode · linked to")
+      expect(next.scope).toBe(scopeBefore)
+    }
+  })
+})
+