fix: follow runtime session identity after model fallback

app/api/agent/[id]/events/route.ts

@@ -51,7 +51,7 @@ export async function GET(
       };
 
       // Send initial connected event
-      encode({ type: "connected", sessionId: id });
+      encode({ type: "connected", sessionId: session.sessionId, runtimeId: session.runtimeId });
 
       const unsubscribe = session.onEvent((event) => {
         const clientEvent = toClientEvent(event);

app/api/agent/[id]/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { resolveSessionPath } from "@/lib/session-reader";
-import { startRpcSession, getRpcSession } from "@/lib/rpc-manager";
+import { startRpcSession, getRpcSession, getFinalRpcSessionId } from "@/lib/rpc-manager";
 import { hasJsonContentType, isApiRequestAllowed } from "@/lib/request-security";
 
 // POST /api/agent/[id] - Send a command to an existing session
@@ -28,7 +28,15 @@ export async function POST(
     if (existing?.isAlive()) {
       const result = await existing.send(body);
       promptAccepted = body.type === "prompt";
-      return NextResponse.json({ success: true, data: result });
+      existing.syncSessionIdentity();
+      return NextResponse.json({ success: true, data: result, sessionId: existing.sessionId, runtimeId: existing.runtimeId });
+    }
+
+    if (id.startsWith("runtime:")) {
+      return NextResponse.json({
+        error: "Runtime session expired", code: "runtime_expired", accepted: false,
+        sessionId: getFinalRpcSessionId(id),
+      }, { status: 404 });
     }
 
     const filePath = await resolveSessionPath(id);
@@ -45,7 +53,8 @@ export async function POST(
     const result = await session.send(body);
     promptAccepted = body.type === "prompt";
 
-    return NextResponse.json({ success: true, data: result });
+    session.syncSessionIdentity();
+    return NextResponse.json({ success: true, data: result, sessionId: session.sessionId, runtimeId: session.runtimeId });
   } catch (error) {
     return NextResponse.json({
       error: error instanceof Error ? error.message : String(error),
@@ -64,9 +73,13 @@ export async function GET(
   const { id } = await params;
 
   try {
-    const session = getRpcSession(id);
+    let session = getRpcSession(id);
     if (!session || !session.isAlive()) {
-      return NextResponse.json({ running: false });
+      const sessionId = getFinalRpcSessionId(id);
+      session = sessionId ? getRpcSession(sessionId) : undefined;
+      if (!session?.isAlive()) {
+        return NextResponse.json({ running: false, ...(sessionId ? { state: { sessionId } } : {}) });
+      }
     }
 
     const state = await session.send({ type: "get_state" });

app/api/agent/new/route.ts

@@ -65,7 +65,7 @@ export async function POST(req: Request) {
     // that share a key onto one session. Date.now() (ms resolution) collides for
     // requests in the same millisecond, merging two new sessions into one.
     const tempKey = `__new__${randomUUID()}`;
-    const { session, realSessionId } = await startRpcSession(tempKey, "", cwd, {
+    const { session } = await startRpcSession(tempKey, "", cwd, {
       ...(toolNames ? { toolNames } : {}),
       ...(provider && modelId ? { initialModel: { provider, modelId } } : {}),
       ...(explicitThinkingLevel ? { thinkingLevel: explicitThinkingLevel } : {}),
@@ -86,7 +86,8 @@ export async function POST(req: Request) {
     if (promptCommand.type === "ensure_session") {
       return NextResponse.json({
         success: true,
-        sessionId: realSessionId,
+        sessionId: session.sessionId,
+        runtimeId: session.runtimeId,
         data: null,
         model: state.model
           ? { provider: state.model.provider, modelId: state.model.id }
@@ -101,7 +102,8 @@ export async function POST(req: Request) {
 
     return NextResponse.json({
       success: true,
-      sessionId: realSessionId,
+      sessionId: session.sessionId,
+      runtimeId: session.runtimeId,
       data: result,
       model: state.model
         ? { provider: state.model.provider, modelId: state.model.id }

app/api/agent/running/route.ts

@@ -1,12 +1,12 @@
 import { NextResponse } from "next/server";
-import { getRunningRpcSessionIds } from "@/lib/rpc-manager";
+import { getRpcSessionActivitySnapshot } from "@/lib/rpc-manager";
 
 export const dynamic = "force-dynamic";
 
 // GET /api/agent/running - Lightweight snapshot for visible-tab polling.
 export async function GET() {
   return NextResponse.json(
-    { runningSessionIds: getRunningRpcSessionIds() },
+    getRpcSessionActivitySnapshot(),
     { headers: { "Cache-Control": "no-store" } },
   );
 }

app/api/sessions/[id]/auto-name/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { generateSessionTitle } from "@/lib/session-title";
-import { getRpcSession, startRpcSession } from "@/lib/rpc-manager";
+import { getRpcSession, startRpcSession, getFinalRpcSessionId } from "@/lib/rpc-manager";
 import { invalidateSessionListCache, resolveSessionPath } from "@/lib/session-reader";
 
 export async function POST(
@@ -10,16 +10,16 @@ export async function POST(
   const { id } = await params;
 
   try {
-    const filePath = await resolveSessionPath(id);
-    if (!filePath) {
-      return NextResponse.json({ error: "Session not found" }, { status: 404 });
+    let session = getRpcSession(id);
+    if (!session?.isAlive()) {
+      const canonicalId = id.startsWith("runtime:") ? getFinalRpcSessionId(id) : id;
+      const filePath = canonicalId ? await resolveSessionPath(canonicalId) : undefined;
+      if (!canonicalId || !filePath) {
+        return NextResponse.json({ error: "Session not found" }, { status: 404 });
+      }
+      ({ session } = await startRpcSession(canonicalId, filePath, undefined));
     }
 
-    const existing = getRpcSession(id);
-    const { session } = existing?.isAlive()
-      ? { session: existing }
-      : await startRpcSession(id, filePath, undefined);
-
     // globalThis keeps wrappers alive across dev hot reloads; older instances
     // may predate waitUntilReady(), but those have already completed startup.
     await session.waitUntilReady?.();
@@ -40,7 +40,7 @@ export async function POST(
 
     await session.inner.sessionManager.setSessionName(result.title, "auto");
     invalidateSessionListCache();
-    return NextResponse.json({ title: result.title });
+    return NextResponse.json({ title: result.title, sessionId: session.sessionId, runtimeId: session.runtimeId });
   } catch (error) {
     return NextResponse.json(
       { error: error instanceof Error ? error.message : String(error) },

app/api/sessions/[id]/context/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from "next/server";
 import { SessionManager } from "@oh-my-pi/pi-coding-agent";
 import { resolveSessionPath, buildSessionContext, getHistoricalContextUsage } from "@/lib/session-reader";
-import { getRpcSession } from "@/lib/rpc-manager";
+import { getRpcSession, getFinalRpcSessionId } from "@/lib/rpc-manager";
 
 export async function GET(
   req: Request,
@@ -14,9 +14,11 @@ export async function GET(
   const deferToolResultImages = url.searchParams.has("deferMedia");
 
   try {
-    const rpc = getRpcSession(id);
+    const directRpc = getRpcSession(id);
+    const canonicalId = directRpc?.sessionId ?? getFinalRpcSessionId(id) ?? id;
+    const rpc = directRpc ?? getRpcSession(canonicalId);
     const liveRpc = rpc?.isAlive() ? rpc : undefined;
-    const filePath = liveRpc ? null : await resolveSessionPath(id);
+    const filePath = liveRpc ? null : await resolveSessionPath(canonicalId);
     if (!liveRpc && !filePath) {
       return NextResponse.json({ error: "Session not found" }, { status: 404 });
     }
@@ -30,6 +32,8 @@ export async function GET(
     const contextUsage = await getHistoricalContextUsage(entries, leafId);
 
     return NextResponse.json({
+      sessionId: liveRpc?.sessionId ?? sm.getSessionId(),
+      runtimeId: liveRpc?.runtimeId ?? null,
       context,
       ...(contextUsage ? { contextUsage } : {}),
     });

app/api/sessions/[id]/export/route.ts

@@ -7,6 +7,7 @@ import { promisify } from "util";
 import { fileURLToPath, pathToFileURL } from "url";
 import { NextResponse } from "next/server";
 import { isApiRequestAllowed } from "@/lib/request-security";
+import { getRpcSession, getFinalRpcSessionId } from "@/lib/rpc-manager";
 import { resolveSessionPath } from "@/lib/session-reader";
 
 const execFileAsync = promisify(execFile);
@@ -114,7 +115,9 @@ export async function GET(
   const inline = new URL(req.url).searchParams.get("inline") === "1";
 
   try {
-    const filePath = await resolveSessionPath(id);
+    const canonicalId = getRpcSession(id)?.sessionId ?? getFinalRpcSessionId(id)
+      ?? (id.startsWith("runtime:") ? undefined : id);
+    const filePath = canonicalId ? await resolveSessionPath(canonicalId) : null;
     if (!filePath) {
       return NextResponse.json({ error: "Session not found" }, { status: 404 });
     }

app/api/sessions/[id]/route.ts

@@ -44,6 +44,10 @@ export async function GET(
     const deferThinking = searchParams.has("deferThinking");
     const deferToolResultImages = searchParams.has("deferMedia");
     const context = buildSessionContext(entries, leafId, { deferThinking, deferToolResultImages });
+    // A runtime fallback can differ from the last persisted model selector.
+    if (liveRpc?.inner.model) {
+      context.model = { provider: liveRpc.inner.model.provider, modelId: liveRpc.inner.model.id };
+    }
     const contextUsage = await getHistoricalContextUsage(entries, leafId);
     const totalActiveMs = computeSessionTotalActiveMs(entries);
     const header = sm.getHeader();
@@ -72,7 +76,8 @@ export async function GET(
     } : null;
 
     return NextResponse.json({
-      sessionId: id,
+      sessionId: liveRpc?.sessionId ?? sm.getSessionId(),
+      runtimeId: liveRpc?.runtimeId,
       filePath,
       info,
       leafId,

app/api/sessions/export-route.test.mjs

@@ -0,0 +1,124 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import { createJiti } from "jiti";
+
+const jiti = createJiti(import.meta.url, {
+  alias: { "@": process.cwd() },
+  interopDefault: true,
+  moduleCache: false,
+});
+const { GET: getExport } = await jiti.import("./[id]/export/route.ts");
+
+function exportFixture(t) {
+  const stateKeys = [
+    "__ompSessions", "__ompFinalSessionIds", "__ompSessionPathCache",
+    "__ompPathToSessionIdCache", "__ompSessionListCache",
+  ];
+  const previousState = stateKeys.map((key) => [key, globalThis[key]]);
+  const dir = mkdtempSync(join(tmpdir(), "omp-web-export-test-"));
+  const a = "export-history-a";
+  const b = "export-current-b";
+  const runtimeId = "runtime:export-r";
+  const timestamp = "2026-08-12T01:02:03.000Z";
+  const paths = new Map();
+  for (const id of [a, b]) {
+    const path = join(dir, `${id}.jsonl`);
+    paths.set(id, path);
+    writeFileSync(path, [
+      { type: "session", version: 3, id, timestamp, cwd: dir },
+      {
+        type: "message", id: "u1", parentId: null, timestamp,
+        message: { role: "user", content: `transcript ${id}` },
+      },
+    ].map((entry) => JSON.stringify(entry)).join("\n") + "\n");
+  }
+  globalThis.__ompSessions = new Map([[a, {
+    sessionId: b,
+    runtimeId,
+    sessionFile: paths.get(b),
+    isAlive: () => true,
+    syncSessionIdentity: () => {},
+  }]]);
+  globalThis.__ompFinalSessionIds = new Map();
+  globalThis.__ompSessionPathCache = new Map(paths);
+  globalThis.__ompPathToSessionIdCache = new Map([...paths].map(([id, path]) => [path, id]));
+  // Missing files must not scan the user's session directory.
+  globalThis.__ompSessionListCache = { data: [], ts: Date.now() };
+  t.after(() => {
+    for (const [key, value] of previousState) globalThis[key] = value;
+    rmSync(dir, { recursive: true, force: true });
+  });
+  return { a, b, runtimeId, paths };
+}
+
+function requestExport(id, headers = { host: "localhost" }) {
+  return getExport(
+    new Request(`http://localhost/api/sessions/${encodeURIComponent(id)}/export?inline=1`, { headers }),
+    { params: Promise.resolve({ id }) },
+  );
+}
+
+async function assertTranscript(response, id) {
+  assert.equal(response.status, 200, await response.clone().text());
+  assert.equal(response.headers.get("Content-Type"), "text/html; charset=utf-8");
+  assert.match(response.headers.get("Content-Disposition"), /^inline;/);
+  const html = await response.text();
+  const encoded = html.match(/<script id="session-data" type="application\/json">([^<]+)<\/script>/)?.[1];
+  assert.ok(encoded, "export contains the SDK's embedded transcript");
+  const data = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+  assert.equal(data.header.id, id);
+  assert.deepEqual(data.entries.map((entry) => entry.message?.content), [`transcript ${id}`]);
+}
+
+test("export follows a live runtime to its current transcript after a missed identity update", async (t) => {
+  const { runtimeId, b } = exportFixture(t);
+  await assertTranscript(await requestExport(runtimeId), b);
+});
+
+test("export follows a destroyed runtime's final identity", async (t) => {
+  const { runtimeId, b } = exportFixture(t);
+  globalThis.__ompSessions.clear();
+  globalThis.__ompFinalSessionIds.set(runtimeId, b);
+  await assertTranscript(await requestExport(runtimeId), b);
+});
+
+test("exporting a historical ID still returns its original transcript", async (t) => {
+  const { a } = exportFixture(t);
+  await assertTranscript(await requestExport(a), a);
+});
+
+test("unknown runtime handles cannot be treated as historical file IDs", async (t) => {
+  const { a, paths } = exportFixture(t);
+  globalThis.__ompSessionPathCache.set("runtime:unknown", paths.get(a));
+  const response = await requestExport("runtime:unknown");
+  assert.equal(response.status, 404);
+  assert.deepEqual(await response.json(), { error: "Session not found" });
+});
+
+for (const alive of [true, false]) {
+  test(`export never falls back to the old file when the ${alive ? "live" : "destroyed"} runtime's current file is missing`, async (t) => {
+    const { runtimeId, a, b, paths } = exportFixture(t);
+    if (!alive) {
+      globalThis.__ompSessions.clear();
+      globalThis.__ompFinalSessionIds.set(runtimeId, b);
+    }
+    globalThis.__ompSessionPathCache.set(runtimeId, paths.get(a));
+    rmSync(paths.get(b));
+    const response = await requestExport(runtimeId);
+    assert.equal(response.status, 404);
+    assert.deepEqual(await response.json(), { error: "Session not found" });
+  });
+}
+
+test("export rejects untrusted requests before accessing the runtime registry", async (t) => {
+  const { runtimeId } = exportFixture(t);
+  globalThis.__ompSessions.values().next().value.syncSessionIdentity = () => {
+    assert.fail("untrusted request must not access runtimes");
+  };
+  const response = await requestExport(runtimeId, { host: "untrusted.invalid" });
+  assert.equal(response.status, 403);
+  assert.deepEqual(await response.json(), { error: "Untrusted API request" });
+});

app/api/sessions/route.ts

@@ -4,7 +4,7 @@ import {
   listAllSessions,
   mergeSessionLists,
 } from "@/lib/session-reader";
-import { getRpcSessionInfos, getRunningRpcSessionIds } from "@/lib/rpc-manager";
+import { getRpcSessionInfos, getRpcSessionActivitySnapshot } from "@/lib/rpc-manager";
 import { readArchivedIds } from "@/lib/session-archive";
 
 export const dynamic = "force-dynamic";
@@ -21,7 +21,7 @@ export async function GET(req: Request) {
     const sessions = mergeSessionLists(persistedSessions, runtimeSessions)
       .filter((s) => (showArchived ? archived.has(s.id) : !archived.has(s.id)));
     return NextResponse.json(
-      { sessions, runningSessionIds: getRunningRpcSessionIds() },
+      { sessions, ...getRpcSessionActivitySnapshot() },
       { headers: { "Cache-Control": "no-store" } },
     );
   } catch (error) {