Repository navigation
Copilot CLI session import: decide history, stopped-session ownership and live-owner handling #33
Description
Goal
Evaluate and implement an explicit workflow for bringing existing Copilot CLI
sessions into t3code. When this issue is picked up, first decide which semantics
to support for each case below. Do not treat history import, native-session
resumption, and attachment to a live owner as interchangeable operations.
Cases requiring a decision
| Case | Decision needed |
|---|---|
| Import historical messages for viewing | Snapshot versus refreshable read-only history; provenance, completeness, unsupported events and deduplication semantics. Viewing must not resume or acquire the source session. |
| Continue imported history as a new conversation | Decide whether to support this separately, explain any context loss, and retain lineage without pretending the new conversation has the original native identity. |
| Resume a stopped native Copilot session under t3code ownership | Decide how to establish confirmed release, acquire ownership, retain native identity and reconcile existing t3code records/history before accepting input. |
| Session still owned by Herdr or another CLI/controller | Do not independently resume/write the same native session. Decide whether to offer read-only access, defer, or design an explicit fenced handoff. |
| Owner unavailable, disconnected, crashed or ownership uncertain | Define fail-closed behavior and explicit recovery. A stale record, disconnected UI or screen-derived idle state is not proof of release. |
These are design alternatives to assess, not a requirement to implement every
mode in the first delivery. Record the chosen modes, rejected/deferred modes,
and ownership rules in this issue before implementation.
Initial research and baseline verification
Earlier inspection of build/fork-native-preview at
1ba8423c8611d65dc9739a970fe84c78c9892710 found:
- External-session import contracts
covered Claude/Codex, not Copilot. - The Copilot adapter
rejected analreadyInUsenative session. Preserve equivalent conflict refusal.
These observations are pinned historical findings, not claims about the latest
fork. Recheck the target branch, shipped client/server builds, CLI/SDK versions,
current import implementation and provider APIs before selecting an approach.
Reuse existing import UI/contracts where their semantics fit; do not assume
provider parity from a shared button or schema.
Safety and acceptance boundaries
- Correlate by environment identity, provider and native session ID. Keep Windows
and WSL environments distinct, even when paths or titles look similar. - Preserve origin/lineage, full versus partial history status and current owner.
Never identify a session solely by cwd, display name or newest timestamp. - Read-only discovery/history access has no prompts, approvals, ownership changes
or implicit resume side effects. - If native ownership transfer is selected, define source admission freeze,
confirmed release, fencing and destination admission; handle races and
uncertain disconnects explicitly. Existing process/storage locks are not a
complete cross-controller handoff protocol. - Prevent duplicate t3code threads and duplicate history across retries,
refreshes and reconnects. Define how existing native-to-thread mappings behave. - Do not use shared session storage as synchronization or silently downgrade a
failed native resume into a newly reconstructed conversation. - Use bounded disposable tests for owned-active, stopped, concurrent-claim,
stale-owner and disconnected-owner cases, plus history completeness,
repeat import, reconnect and Windows/WSL identity separation. - Keep credentials, raw private transcripts and machine-specific details out of
issue reports, fixtures and published evidence.
Related work
- Herdr integration: discover external sessions and provide read-only remote access first #29: Herdr discovery and read-only remote access first. This issue is the
separate Copilot import/continuation decision, not permission to bypass that
issue's ownership boundary. - [A-009] Inventory native provider capabilities versus T3 exposure #16: native provider capability versus t3code exposure inventory.
- Fork workspace backlog: stable reconciliation, attention, TWS and tags #1: fork workspace backlog.
Definition of ready
Before coding, document the current evidence and the decision for each case:
supported now, explicitly refused, or deferred. Define user-visible labels and
conflict/recovery behavior so "import" never implies safe shared live ownership.
Activity
jdbencardinop commentedon Nov 11, 2026
Implementation scope recorded before coding for the approved four-hour window ending 2026-11-11 05:09 UTC.
Selected modes: explicit bounded history snapshot import and continuation of confirmed-stopped native Copilot sessions, preserving native identity and provider-instance/account-home isolation. Discovery/history access must not resume a session, acquire ownership, prompt, or invoke tools. Partial history must be identified honestly, and repeated imports must not duplicate threads or messages.
Refused/deferred modes: no writable attachment to an active or uncertain external owner; no inference that a disconnected UI, idle-looking process, stale record, or old timestamp proves release. Live-owner handoff and creating a new conversation from imported history are deferred. Failed native resume must not silently become a reconstructed conversation. If supported APIs cannot establish safe ownership, native continuation remains blocked rather than weakening the guarantee.
Baseline and workflow: scoped
tpatch/copilot-session-importbranch from validatedmainat0490e7bb2753ee455d58f9832f6ea943af81b0e0; existing steering/display-name candidates remain untouched. Follow patch-flow lifecycle, focused regressions and affected-package checks, independent code/evidence review, scoped patch/recipe recording and exact replay including file modes. Preserve genuine verifier failures rather than relabeling them successful.Qualification: bounded disposable tests for stopped/active/concurrent/uncertain ownership, continuity, deduplication, partial history, multiple provider homes and Windows/WSL identity separation; preserve Claude/Codex behavior. Isolated web/iOS verification and at most four minimal disposable Copilot model turns are authorized. Real conversations and live installations are not test targets. Private transcripts, credentials, machine paths and screenshots remain private.
Publication boundary: scoped commits and feature-branch push plus updates here; no PR, main merge, release, deployment or live migration. Stop earlier if complete or blocked. Source acceptance and receiving-platform qualification remain separate gates.
jdbencardinop commentedon Nov 11, 2026
Window outcome: blocked before implementation by the worktree handoff lifecycle. The dedicated feature branch/worktree was successfully created at the approved main commit, but remains clean with no feature registration, implementation commits, pushes, native test turns or review runs.
Read-only inspection of the durable journal establishes this sequence on 2026-11-11 UTC: workspace binding and expected provider detach at 01:11:40.552; continuation queued at 01:11:40.558; old run failed with an unknown-class provider-stream closure at 01:11:40.562; continuation explicitly held at 01:11:40.654. It remained held until the user returned at about 06:11:55, after the 05:09:38 deadline.
The matching source explains the interaction: workspace change detaches/releases the single-thread provider session; subscriber failure becomes a run failure; the normal same-provider failure guard holds the queued continuation. Thus the continuation was not lost and Git did not spend five hours creating a worktree. The handoff itself stranded its continuation behind the provider-failure queue guard. The screenshot also shows a lingering tool wait, but that separate UI lifecycle cause has not been established.
Diagnosis is recorded privately with exact event sequences and source locations. No fix is claimed and no live state was modified. A separate lifecycle regression should prove that intentional handoff starts exactly one continuation while genuine provider failures retain the ordinary queue hold. This should not be hidden inside the import patch. The original implementation deadline has expired and has not been silently restarted.
jdbencardinop commentedon Nov 11, 2026
The maintainer renewed the unattended window for ten hours starting 2026-11-11 06:21:15 UTC, ending 16:21:15 UTC (08:21 Pacific). Original implementation scope, safety boundaries, four disposable inference-turn budget, bounded independent review, and feature-branch-only publication permissions remain unchanged. The dedicated worktree is already bound; no further handoff is needed. Resume implementation here, with handoff diagnosis retained separately and no live-chat repair or main promotion inferred.
jdbencardinop commentedon Nov 11, 2026
Ownership boundary verified with SDK 1.0.28 using two disposable native runtimes and one minimal fixture inference turn: while runtime A retained the session, runtime B checkInUse reported it in use, but B resumeSession still succeeded and reported alreadyInUse=true. The SDK permits constructing the conflicting session; a post-resume indicator is not exclusive admission. No real session was resumed and both disposable runtimes were stopped.
Accordingly native continuation remains blocked under the approved fail-closed rule. Implementation is proceeding as an explicitly read-only, bounded text snapshot candidate, with immutable provenance and server-side refusal of execution/fork/merge paths; no native ownership or resumable cursor is assigned to snapshots. This is useful history access, not complete continuation parity. The issue stays open for a supported fenced ownership mechanism. Three of the four disposable inference-turn allowances remain unused.
jdbencardinop commentedon Nov 12, 2026
The maintainer authorized a new eight-hour implementation window on November 12, 2026, from 20:39:14 UTC to November 13 at 04:39:14 UTC (12:39 PM–8:39 PM Pacific). The final 45 minutes are reserved for checkpointing and handback.
Priority: finish the preserved read-only import candidate and its three review findings (import-time containment, selected-model provenance, malformed-journal validation), then a separately scoped recovery candidate for #42. Naming/explicit-Steer qualification is conditional on completing higher-priority gates.
Approved: scoped feature commits/pushes after checking CI side effects, sanitized existing-issue updates, isolated web/iOS Simulator evidence, at most four disposable native test turns, one independent reviewer and one follow-up. No PR, main merge, release/deployment, physical-device update, live database modification, force-push, or native-session takeover. No active-session worktree handoff.
The original external-owner SDK limitation remains a hard boundary: history import stays explicitly read-only; unsafe native continuation is not an acceptable shortcut. Existing dirty candidates and historical replay records will be preserved. Incomplete checks and the known native verifier limitation will not be reported as passes.