fix: harden journal repair, task detach, subagent prompts, and login cancel

- Retry a failed wire journal repair before accepting new appends, and surface
  the discarded record to flush callers.
- Carry the orchestrator's prompt on subagent turns in the transcript.
- Add a task detach action to the server API so a running foreground task can
  move to the background.
- Serialize per-view session opens in the VS Code extension to stop duplicated
  streaming events.
- Report a denied OpenAI Codex authorization as cancelled in the CLI, the SDK
  login flow, and the web sign-in page.

Author: elkaix

.changeset/codex-login-denied-cancelled.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Report a denied OpenAI Codex sign-in as cancelled instead of asking for the redirect URL.

.changeset/subagent-turn-prompts.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Show the prompt that started a subagent turn in the transcript.

.changeset/task-detach-action.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": minor
+---
+
+Add a task detach action to the server API. Call `POST /api/v1/sessions/{session_id}/tasks/{task_id}:detach` to move a running foreground task to the background.

.changeset/vscode-duplicated-stream-events.md

@@ -0,0 +1,5 @@
+---
+"pythinker": patch
+---
+
+Fix duplicated streaming output when a session is opened twice at the same time.

.changeset/wire-journal-repair-retry.md

@@ -0,0 +1,5 @@
+---
+"@pymodel/pythinker-code": patch
+---
+
+Retry a failed session journal repair before writing new records, so no message is appended behind a corrupted tail.

apps/pythinker-code/dist-web/.web-bundle-manifest.json

@@ -1,4 +1,4 @@
 {
-  "sourceHash": "c05b9ce73324f5a446966d9f931dc804f0f1e73e78daf14e1479d86e58669c1a",
+  "sourceHash": "693510f7263b3cef6e70c25a90556d7c82f206bec2e96e402ccedee6045f5924",
   "sourceFileCount": 404
 }

apps/vscode/src/runtime/pythinker-runtime.ts

@@ -48,6 +48,7 @@ export class PythinkerRuntime {
   private readonly log: PythinkerRuntimeOptions["log"];
   private readonly sessions = new Map<string, SessionRuntime>();
   private readonly sessionByView = new Map<string, string>();
+  private readonly viewChains = new Map<string, Promise<void>>();
   private readonly pendingPermissionByView = new Map<string, PermissionMode>();
   private closed = false;
 
@@ -101,6 +102,10 @@ export class PythinkerRuntime {
   }
 
   async openSession(options: OpenSessionOptions): Promise<SessionRuntime> {
+    return this.serializeView(options.webviewId, () => this.openSessionInner(options));
+  }
+
+  private async openSessionInner(options: OpenSessionOptions): Promise<SessionRuntime> {
     this.ensureOpen();
     const current = this.getSessionForView(options.webviewId);
     const requestedId = options.sessionId ?? current?.id;
@@ -119,7 +124,7 @@ export class PythinkerRuntime {
     if (runtime !== undefined) {
       assertSessionWorkDir(runtime.session, options.workDir);
       await applySessionPermission(runtime.session, runtime.permissionMode);
-      await this.detachView(options.webviewId);
+      await this.detachViewInner(options.webviewId);
     } else {
       const seedMode = defaultPermissionMode(options.yoloMode);
       const session =
@@ -135,7 +140,7 @@ export class PythinkerRuntime {
       try {
         assertSessionWorkDir(session, options.workDir);
         const mode = await restorePermissionMode(session, seedMode);
-        await this.detachView(options.webviewId);
+        await this.detachViewInner(options.webviewId);
         runtime = this.wrapSession(session, mode);
       } catch (error) {
         await session.close().catch((closeError: unknown) => {
@@ -156,14 +161,24 @@ export class PythinkerRuntime {
     webviewId: string,
     session: Session,
     yoloModeSetting = false,
+  ): Promise<SessionRuntime> {
+    return this.serializeView(webviewId, () =>
+      this.attachResumedSessionInner(webviewId, session, yoloModeSetting),
+    );
+  }
+
+  private async attachResumedSessionInner(
+    webviewId: string,
+    session: Session,
+    yoloModeSetting: boolean,
   ): Promise<SessionRuntime> {
     const existing = this.sessions.get(session.id);
     if (existing !== undefined && this.sessionByView.get(webviewId) === session.id) {
       existing.subscribe(webviewId);
       await existing.announceStatus(webviewId);
       return existing;
     }
-    await this.detachView(webviewId);
+    await this.detachViewInner(webviewId);
     let runtime = existing ?? this.sessions.get(session.id);
     if (runtime === undefined) {
       try {
@@ -184,6 +199,10 @@ export class PythinkerRuntime {
   }
 
   async detachView(webviewId: string): Promise<void> {
+    return this.serializeView(webviewId, () => this.detachViewInner(webviewId));
+  }
+
+  private async detachViewInner(webviewId: string): Promise<void> {
     const id = this.sessionByView.get(webviewId);
     if (id === undefined) return;
     this.sessionByView.delete(webviewId);
@@ -196,6 +215,23 @@ export class PythinkerRuntime {
     }
   }
 
+  // A view attaches to at most one session, so opens/detaches for one view
+  // must never overlap: concurrent callers that both miss `this.sessions`
+  // would wrap the same SDK session twice and double every streamed event.
+  private serializeView<T>(webviewId: string, work: () => Promise<T>): Promise<T> {
+    const prev = this.viewChains.get(webviewId) ?? Promise.resolve();
+    const run = prev.then(work, work);
+    const next = run.then(
+      () => undefined,
+      () => undefined,
+    );
+    this.viewChains.set(webviewId, next);
+    void next.finally(() => {
+      if (this.viewChains.get(webviewId) === next) this.viewChains.delete(webviewId);
+    });
+    return run;
+  }
+
   async closeSession(id: string): Promise<void> {
     const runtime = this.sessions.get(id);
     if (runtime === undefined) {

apps/vscode/test/pythinker-runtime.test.ts

@@ -382,6 +382,91 @@ describe("Pythinker runtime (owns shared SDK sessions for Webviews)", () => {
     expect(boundary.handlerInstallations).toEqual({ approval: 1, question: 1 });
   });
 
+  it("does not double-wrap the SDK session when two opens race for it", async () => {
+    const sdk = createFakeHarness();
+    const broadcasts: { event: string; data: unknown; webviewId?: string }[] = [];
+    const runtime = new PythinkerRuntime({
+      version: "0.6.0",
+      harness: sdk.harness,
+      broadcast: (event, data, webviewId) => {
+        broadcasts.push({ event, data, webviewId });
+      },
+      captureBaseline: () => undefined,
+      log: () => undefined,
+    });
+    const boundary = sdk.addSession("saved-1", "/workspace");
+
+    const [first, second] = await Promise.all([
+      runtime.openSession(openOptions({ sessionId: "saved-1" })),
+      runtime.openSession(openOptions({ sessionId: "saved-1" })),
+    ]);
+
+    expect(second).toBe(first);
+    expect(boundary.subscriptionCount()).toBe(1);
+
+    boundary.emit({
+      type: "assistant.delta",
+      sessionId: "saved-1",
+      agentId: "main",
+      turnId: 1,
+      delta: "Hello",
+    });
+
+    const parts = broadcasts.filter(
+      ({ data }) => (data as { type?: string }).type === "ContentPart",
+    );
+    expect(parts).toHaveLength(1);
+  });
+
+  it("coalesces two concurrent new-session opens for one view onto one session", async () => {
+    const { runtime, sdk } = createRuntime();
+
+    const [first, second] = await Promise.all([
+      runtime.openSession(openOptions()),
+      runtime.openSession(openOptions()),
+    ]);
+
+    expect(second).toBe(first);
+    expect(sdk.createInputs).toHaveLength(1);
+    expect(first.subscribers).toEqual(["view-1"]);
+  });
+
+  it("does not double-wrap the SDK session when two attaches race for it", async () => {
+    const sdk = createFakeHarness();
+    const broadcasts: { event: string; data: unknown; webviewId?: string }[] = [];
+    const runtime = new PythinkerRuntime({
+      version: "0.6.0",
+      harness: sdk.harness,
+      broadcast: (event, data, webviewId) => {
+        broadcasts.push({ event, data, webviewId });
+      },
+      captureBaseline: () => undefined,
+      log: () => undefined,
+    });
+    const boundary = sdk.addSession("saved-1", "/workspace");
+
+    const [first, second] = await Promise.all([
+      runtime.attachResumedSession("view-1", boundary.session),
+      runtime.attachResumedSession("view-1", boundary.session),
+    ]);
+
+    expect(second).toBe(first);
+    expect(boundary.subscriptionCount()).toBe(1);
+
+    boundary.emit({
+      type: "assistant.delta",
+      sessionId: "saved-1",
+      agentId: "main",
+      turnId: 1,
+      delta: "Hello",
+    });
+
+    const parts = broadcasts.filter(
+      ({ data }) => (data as { type?: string }).type === "ContentPart",
+    );
+    expect(parts).toHaveLength(1);
+  });
+
   it("preserves the resumed session's model instead of reapplying the configured default", async () => {
     const { runtime, sdk } = createRuntime();
     const session = sdk.addSession("saved-1", "/workspace", { model: "old-model" });

docs/reference/server-api.md

@@ -177,6 +177,7 @@ Endpoints are grouped by resource below. A `:{action}` suffix in a path is the a
 | `GET /api/v1/sessions/{session_id}/tasks` | List background tasks |
 | `GET /api/v1/sessions/{session_id}/tasks/{task_id}` | Read a task (optional output preview) |
 | `POST /api/v1/sessions/{session_id}/tasks/{task_id}:cancel` | Cancel a task |
+| `POST /api/v1/sessions/{session_id}/tasks/{task_id}:detach` | Move a foreground task to the background |
 
 ### Skills, tools, and MCP
 

packages/agent-core-v2/docs/state-manifest.d.ts

@@ -1353,6 +1353,7 @@ export interface AgentStateSnapshot {
     readonly command: string;
     readonly pid: number;
     readonly exitCode: number | null;
+    readonly parentToolCallId?: string;
     readonly taskId: string;
     readonly description: string;
     readonly status: /* AgentTaskStatus — packages/agent-core-v2/src/agent/task/types.ts */ 'completed' | 'failed' | 'running' | 'timed_out' | 'killed' | 'lost';
@@ -1400,6 +1401,7 @@ export interface AgentStateSnapshot {
     readonly command: string;
     readonly pid: number;
     readonly exitCode: number | null;
+    readonly parentToolCallId?: string;
     readonly taskId: string;
     readonly description: string;
     readonly status: /* AgentTaskStatus — packages/agent-core-v2/src/agent/task/types.ts */ 'completed' | 'failed' | 'running' | 'timed_out' | 'killed' | 'lost';