Keep mosaic session ids across workspace restore

- Persist the desktop session id on every saved tab (sid only when the
  engine persisted the conversation); restore reuses the id, spawning
  empty windows fresh, so a saved chat split survives switches/restarts
- Serialize workspace swaps with a busy flag + generation token; disable
  the workspace tab bar while one is in flight
- Re-validate nested tab chrome in sanitizeProjects; reject url(...)
  attribute values in sanitizeSvg
- Use i18n strings for workspace/sidebar aria-labels

Co-authored-by: Gao Yu <gaoyu06@users.noreply.github.com>

Author: cursoragent

src/lib/Sidebar.svelte

@@ -120,7 +120,7 @@
 	<div class="sess-head">
 		<span>{t('shell.sessionsByProject')}</span>
 		<div class="sess-actions">
-			<button class:on={searchOpen} onclick={toggleSearch} aria-label="search sessions" title={t('shell.searchSessions')}><Search size={14} /></button>
+			<button class:on={searchOpen} onclick={toggleSearch} aria-label={t('shell.searchSessions')} title={t('shell.searchSessions')}><Search size={14} /></button>
 			<button onclick={onNewProject} aria-label="new project" title={t('shell.newProjectTitle')}><Plus size={15} /></button>
 		</div>
 	</div>

src/lib/backends/session-backend.test.ts

@@ -89,8 +89,8 @@ describe('SessionStore × backends', () => {
 		const snap = store.serialize();
 		expect(snap[0].lastBackend).toBe('codex');
 		expect(snap[0].tabs).toEqual([
-			{ sid: 'sid-0', title: 't0' },
-			{ sid: 'sid-1', title: 't1', backend: 'codex' }
+			{ id: p.sessions[0].id, sid: 'sid-0', title: 't0' },
+			{ id: p.sessions[1].id, sid: 'sid-1', title: 't1', backend: 'codex' }
 		]);
 	});
 

src/lib/session.svelte.ts

@@ -17,12 +17,15 @@ export interface SavedTabChrome {
 	titleLocked?: boolean;
 }
 
-// The persisted shape of a project + its open tabs (engine session id + title).
+// The persisted shape of a project + its open tabs. `id` is the desktop
+// session id (stable across restore so layout chat tiles keep matching);
+// `sid` is the engine conversation to resume, present only when the engine
+// actually persisted one.
 export interface SavedProject {
 	id: string;
 	name: string;
 	path: string;
-	tabs?: ({ sid: string; title: string; backend?: string; archived?: boolean } & SavedTabChrome)[];
+	tabs?: ({ id?: string; sid?: string; title: string; backend?: string; archived?: boolean } & SavedTabChrome)[];
 	/** 并行任务 worktree 项目的元数据（isWorktree/mainRepoPath/branch/baseBranch/slug）。 */
 	worktree?: WorktreeMeta;
 	/** 本项目最近一次新建会话所用的引擎后端（缺省 = jucode）。 */
@@ -84,9 +87,11 @@ export class SessionStore {
 
 	/** Builds a session record (chat + per-session adapter) and registers the
 	 *  adapter with the op router. `acpAgent` (acp backend only) records which
-	 *  registry agent backs the session, for spawn opts and display. */
-	#newSession(backendId: BackendId, acpAgent?: { id: string; name: string }): Session {
-		const id = this.uid();
+	 *  registry agent backs the session, for spawn opts and display. `reuseId`
+	 *  re-applies a persisted desktop id (layout chat tiles key on it) unless
+	 *  this run already spawned it. */
+	#newSession(backendId: BackendId, acpAgent?: { id: string; name: string }, reuseId?: string): Session {
+		const id = reuseId && !this.allSessions.some((s) => s.id === reuseId) ? reuseId : this.uid();
 		const chat = new ChatState();
 		chat.backendId = backendId;
 		if (acpAgent) {
@@ -281,9 +286,10 @@ export class SessionStore {
 		title: string,
 		backend: BackendId = 'jucode',
 		archived = false,
-		chrome?: SavedTabChrome
+		chrome?: SavedTabChrome,
+		reuseId?: string
 	) {
-		const s = this.#newSession(backend);
+		const s = this.#newSession(backend, undefined, reuseId);
 		if (title) s.chat.title = title;
 		s.archived = archived;
 		if (chrome?.color) s.color = chrome.color;
@@ -306,6 +312,31 @@ export class SessionStore {
 		return s.id;
 	}
 
+	/** Spawn a fresh session for a persisted tab that has no engine
+	 *  conversation to resume (never sent a turn), reusing the saved desktop
+	 *  id so layout chat tiles keep matching across workspace switches. */
+	#spawnSaved(
+		project: Project,
+		reuseId: string,
+		title: string,
+		backend: BackendId = 'jucode',
+		archived = false,
+		chrome?: SavedTabChrome
+	) {
+		const s = this.#newSession(backend, undefined, reuseId);
+		if (title) s.chat.title = title;
+		s.archived = archived;
+		if (chrome?.color) s.color = chrome.color;
+		if (chrome?.icon) s.icon = chrome.icon;
+		if (chrome?.titleLocked) s.chat.titleLocked = true;
+		project.sessions.push(s);
+		// Same rationale as addSession: pin a resumable uuid for claude.
+		const extra = backend === 'claude' ? { session_id: newUuid() } : undefined;
+		if (extra) s.chat.sessionId = extra.session_id;
+		this.#spawn(s, project.path, undefined, extra).catch((e) => this.#engineFailed(s.chat, e));
+		return s.id;
+	}
+
 	/** Best-effort transcript replay for a resumed claude session: the session
 	 *  file's user/assistant text becomes the message list (caps.transcriptReplay).
 	 *  Failures are silent — `--resume` already restored the engine-side context,
@@ -527,9 +558,11 @@ export class SessionStore {
 		dispatch(id, { op: 'command', input: '/resume' });
 	}
 
-	/** Snapshot of the layout + open tabs for persistence. The backend id is
-	 *  only written when it isn't the default, so pre-existing layouts stay
-	 *  byte-identical. */
+	/** Snapshot of the layout + open tabs for persistence. Every session is
+	 *  written (empty windows survive a workspace switch under their desktop
+	 *  id); `sid` only when the engine actually persisted the conversation —
+	 *  never `/resume` one it didn't. The backend id is only written when it
+	 *  isn't the default, so pre-existing layouts stay byte-identical. */
 	serialize(): SavedProject[] {
 		return this.projects.map((p) => ({
 			id: p.id,
@@ -539,9 +572,9 @@ export class SessionStore {
 			...(p.lastBackend && p.lastBackend !== 'jucode' ? { lastBackend: p.lastBackend } : {}),
 			...(p.lastBackend === 'acp' && p.lastAcpAgent ? { lastAcpAgent: p.lastAcpAgent } : {}),
 			tabs: p.sessions
-				.filter((s) => s.chat.resumable)
 				.map((s) => ({
-					sid: s.chat.sessionId,
+					id: s.id,
+					...(s.chat.resumable ? { sid: s.chat.sessionId } : {}),
 					title: s.chat.title,
 					...(s.backendId !== 'jucode' ? { backend: s.backendId } : {}),
 					...(s.archived ? { archived: true } : {}),
@@ -582,15 +615,21 @@ export class SessionStore {
 				this.projects.push(proj);
 				if (proj.stale) continue;
 				for (const t of p.tabs ?? []) {
-					if (!t.sid) continue;
+					if (!t.sid && !t.id) continue;
 					// Tabs saved before multi-backend support carry no backend field →
 					// jucode (normalizeBackendId maps unknown/missing to the default).
 					// Chrome fields are re-validated here (the file is user-editable).
-					const id = this.restoreSession(proj, t.sid, t.title, normalizeBackendId(t.backend), !!t.archived, {
+					const backend = normalizeBackendId(t.backend);
+					const chrome = {
 						color: normalizeColor(t.color),
 						icon: parseTabIcon(t.icon),
 						titleLocked: !!t.titleLocked
-					});
+					};
+					// With a conversation to resume, resume it; an empty window spawns
+					// fresh. Both keep the saved desktop id (pre-id files mint anew).
+					const id = t.sid
+						? this.restoreSession(proj, t.sid, t.title, backend, !!t.archived, chrome, t.id)
+						: this.#spawnSaved(proj, t.id!, t.title, backend, !!t.archived, chrome);
 					if (!first && !t.archived) first = id;
 				}
 			}

src/lib/session.test.ts

@@ -67,13 +67,13 @@ describe('SessionStore lifecycle', () => {
 		const store = new SessionStore();
 		const p = proj();
 		store.projects.push(p);
-		store.addSession(p);
+		const id = store.addSession(p);
 		p.sessions[0].chat.sessionId = 'sid-0';
 		p.sessions[0].chat.title = 'kept';
 		p.sessions[0].chat.messages.push({ kind: 'user', text: 'hi' });
-		store.archiveSession(p.sessions[0].id);
+		store.archiveSession(id);
 		const snap = store.serialize();
-		expect(snap[0].tabs).toEqual([{ sid: 'sid-0', title: 'kept', archived: true }]);
+		expect(snap[0].tabs).toEqual([{ id, sid: 'sid-0', title: 'kept', archived: true }]);
 	});
 
 	it('a flagged resume failure makes the next claude restart come up fresh', () => {
@@ -149,21 +149,31 @@ describe('SessionStore lifecycle', () => {
 		expect(msgs[msgs.length - 1]).toMatchObject({ kind: 'error', text: expect.stringContaining('已暂停自动重启') });
 	});
 
-	it('serialize keeps only resumable tabs (session id + a real turn)', () => {
+	it('serialize writes every tab with its desktop id; sid only when resumable', () => {
 		const store = new SessionStore();
 		const p = proj();
 		store.projects.push(p);
 		store.addSession(p);
 		store.addSession(p);
-		p.sessions[0].chat.sessionId = 'sid-0';
-		p.sessions[0].chat.title = 'first';
-		p.sessions[0].chat.messages.push({ kind: 'user', text: 'hi' });
-		// second session has an id but no user turn → never persisted by the engine,
-		// so it's dropped (resuming it would fail with "No such file").
-		p.sessions[1].chat.sessionId = 'sid-1';
+		const [a, b] = p.sessions;
+		a.chat.sessionId = 'sid-0';
+		a.chat.title = 'first';
+		a.chat.messages.push({ kind: 'user', text: 'hi' });
+		// second session has an engine id but no user turn → never persisted by
+		// the engine, so no sid is written (resuming it would fail); the tab
+		// still survives as an empty window under its desktop id.
+		b.chat.sessionId = 'sid-1';
 		const snap = store.serialize();
 		expect(snap).toEqual([
-			{ id: 'p1', name: 'p1', path: '/tmp/p1', tabs: [{ sid: 'sid-0', title: 'first' }] }
+			{
+				id: 'p1',
+				name: 'p1',
+				path: '/tmp/p1',
+				tabs: [
+					{ id: a.id, sid: 'sid-0', title: 'first' },
+					{ id: b.id, title: 'New session' }
+				]
+			}
 		]);
 	});
 
@@ -186,6 +196,46 @@ describe('SessionStore lifecycle', () => {
 		expect(store.loaded).toBe(true);
 	});
 
+	it('restore reuses persisted desktop ids so a saved chat split still matches', async () => {
+		const store = new SessionStore();
+		await store.restore([
+			{
+				id: 'p1',
+				name: 'p1',
+				path: '/tmp/p1',
+				tabs: [
+					{ id: 'live-a', sid: 's-a', title: 'A' },
+					{ id: 'live-b', title: 'B' } // empty window — nothing to resume
+				]
+			}
+		]);
+		expect(store.projects[0].sessions.map((s) => s.id)).toEqual(['live-a', 'live-b']);
+		expect(store.activeId).toBe('live-a');
+		await Promise.resolve(); // let the spawn continuations run
+		// The resumable tab resumes; the empty one spawns fresh with no /resume.
+		expect(sendOp).toHaveBeenCalledWith('live-a', { op: 'command', input: '/resume s-a' });
+		expect(sendOp).not.toHaveBeenCalledWith('live-b', expect.anything());
+		expect(store.projects[0].sessions[1].chat.title).toBe('B');
+	});
+
+	it('restore mints a fresh id when the persisted one is already live', async () => {
+		const store = new SessionStore();
+		await store.restore([
+			{
+				id: 'p1',
+				name: 'p1',
+				path: '/tmp/p1',
+				tabs: [
+					{ id: 'dup', sid: 's-a', title: 'A' },
+					{ id: 'dup', sid: 's-b', title: 'B' }
+				]
+			}
+		]);
+		const ids = store.projects[0].sessions.map((s) => s.id);
+		expect(ids[0]).toBe('dup');
+		expect(ids[1]).not.toBe('dup');
+	});
+
 	it('serialize includes tab chrome only when set, and restore re-applies it', async () => {
 		const store = new SessionStore();
 		const p = proj();
@@ -198,6 +248,7 @@ describe('SessionStore lifecycle', () => {
 		const snap = store.serialize();
 		expect(snap[0].tabs).toEqual([
 			{
+				id,
 				sid: 'sid-0',
 				title: 'Release train',
 				color: '#db2777',

src/lib/workbench/WorkspaceTabs.svelte

@@ -14,6 +14,7 @@
 		workspaces,
 		activeId,
 		shifted = false,
+		busy = false,
 		onSwitch,
 		onNew,
 		onRename,
@@ -24,6 +25,8 @@
 		activeId: string;
 		/** Sidebar hidden: pad past the traffic lights / toggle overlay. */
 		shifted?: boolean;
+		/** A workspace swap is in flight: ignore switch / new / delete clicks. */
+		busy?: boolean;
 		onSwitch: (id: string) => void;
 		onNew: () => void;
 		onRename: (id: string, name: string) => void;
@@ -77,8 +80,8 @@
 				tabindex="0"
 				aria-selected={w.id === activeId}
 				title={w.isDefault ? t('shell.workspace.defaultBadge') : w.name}
-				onclick={() => renaming !== w.id && onSwitch(w.id)}
-				onkeydown={(e) => e.key === 'Enter' && onSwitch(w.id)}
+				onclick={() => !busy && renaming !== w.id && onSwitch(w.id)}
+				onkeydown={(e) => e.key === 'Enter' && !busy && onSwitch(w.id)}
 				oncontextmenu={(e) => openMenu(w, e)}
 			>
 				<TabGlyph
@@ -103,7 +106,7 @@
 				{/if}
 				<button
 					class="wsbtn chev"
-					aria-label="workspace menu"
+					aria-label={t('shell.workspace.menu')}
 					title={t('shell.workspace.menu')}
 					onclick={(e) => {
 						e.stopPropagation();
@@ -116,8 +119,9 @@
 				{#if !w.isDefault}
 					<button
 						class="wsbtn close"
-						aria-label="delete workspace"
+						aria-label={t('shell.workspace.delete')}
 						title={t('shell.workspace.delete')}
+						disabled={busy}
 						onclick={(e) => {
 							e.stopPropagation();
 							onDelete(w.id);
@@ -129,7 +133,7 @@
 				{/if}
 			</div>
 		{/each}
-		<button class="wsadd" aria-label="new workspace" title={t('shell.workspace.new')} onclick={onNew}>
+		<button class="wsadd" aria-label={t('shell.workspace.new')} title={t('shell.workspace.new')} disabled={busy} onclick={onNew}>
 			<Plus size={13} />
 		</button>
 	</div>

src/lib/workbench/canvas.test.ts

@@ -83,6 +83,16 @@ describe('reconcileLayout', () => {
 		expect(chatSessionsIn(next)).toEqual(['live']);
 	});
 
+	it('keeps a persisted 2-chat split intact when both session ids are live', () => {
+		// Restore with persisted tab ids re-spawns sessions under the same ids,
+		// so a workspace switch (or restart) must not collapse the split.
+		const base = singleLeafLayout([chatTab('live-a')]);
+		const split = splitLeaf(base, leavesOf(base.root)[0].id, 'right', chatTab('live-b')).layout;
+		const next = reconcileLayout(serializeLayout(split), ['live-a', 'live-b'], 'live-a');
+		expect(next).toEqual(split);
+		expect(chatSessionsIn(next)).toEqual(['live-a', 'live-b']);
+	});
+
 	it('re-seeds one chat leaf when every persisted chat session is dead', () => {
 		const layout = openChatTab(dockOnlyLayout(), null, 'old-run');
 		const next = reconcileLayout(serializeLayout(layout), ['fresh'], 'fresh');

src/lib/workbench/canvas.ts

@@ -57,8 +57,10 @@ export function openChatTab(
 
 /**
  * Build the canvas from a persisted layout blob when a workspace loads:
- * - chat tiles whose session no longer exists this run are dropped (session
- *   ids are minted per run, so most restarts land here);
+ * - chat tiles whose session is not live are dropped — desktop session ids
+ *   are stable across restore when the saved tabs carry `id` (see
+ *   SavedProject.tabs), so only truly missing sessions (and legacy files
+ *   saved without ids) lose their tile;
  * - a layout left without any chat tile gets one seeded for `seedSessionId` —
  *   an old dock-only layout keeps its panel arrangement and gains a chat leaf
  *   on the left (the pre-canvas shape, chat | panels);

src/lib/workbench/tabChrome.test.ts

@@ -33,6 +33,11 @@ describe('sanitizeSvg', () => {
 		expect(sanitizeSvg('<svg><path href="#x" d="M0 0"/></svg>')).toBeNull();
 	});
 
+	it('rejects url(...) paint servers (external resource references)', () => {
+		expect(sanitizeSvg('<svg><path fill="url(#grad)" d="M0 0"/></svg>')).toBeNull();
+		expect(sanitizeSvg('<svg><rect x="0" y="0" stroke="URL(http://evil)"/></svg>')).toBeNull();
+	});
+
 	it('rejects non-svg roots, comments and oversized markup', () => {
 		expect(sanitizeSvg('<div>hi</div>')).toBeNull();
 		expect(sanitizeSvg('<svg><!-- sneaky --><path d="M0 0"/></svg>')).toBeNull();

src/lib/workbench/tabChrome.ts

@@ -63,7 +63,8 @@ export function sanitizeSvg(markup: string): string | null {
 			const name = a[1].toLowerCase();
 			if (name.startsWith('on') || !SVG_ATTRS.has(name)) return null;
 			const value = (a[2] ?? a[3] ?? a[4] ?? '').toLowerCase();
-			if (value.includes('javascript:') || value.includes('data:')) return null;
+			// url(...) paint servers can reference external resources.
+			if (value.includes('javascript:') || value.includes('data:') || value.includes('url(')) return null;
 		}
 	}
 	if (/[<>]/.test(s.slice(last))) return null;