From 4d8c5e29025414c0b88bc6cfe7a320ef29cf9933 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 14:36:32 +0700
Subject: [PATCH 1/7] feat(app): unmount a Work folder from its own menu, and
 colour it as destructive

A project row on Work is a folder mounted into a sandbox, but its menu
offered Close, which only took the row out of this window's sidebar. The
folder stayed mounted, stayed listed under Folders..., and the row could
come back on the next launch -- the removal gesture that looked most like
removal did the least, while the real one was buried in a dialog.

The row's trailing separator and item now come from the fork-only
ProjectRemovalMenuItems, so pages/home.tsx keeps one mount point instead
of a branch:

- a plain server renders upstream's Close, unchanged;
- an extra mounted folder gets Unmount, in the same danger colour the
  server and session menus use, which removes it from SandboxConfig.mounts
  and then drops the row;
- the folder the sandbox was created with offers neither. It is fixed for
  the sandbox's life, and a disabled item that can never be enabled says
  less than no item at all;
- a row whose folder is already gone -- unmounted from the dialog instead,
  which deliberately leaves the row behind -- keeps Close, or it could
  never be cleared away.

The row is dropped with projects.remove(), not the menu's close(): the
folder is leaving the sandbox, which is the internal, non-user removal
that store documents. close() would also record it as user-closed and the
seeding effect honours that, so remounting the folder would leave the user
with no project for it.

Also colours the sandbox Delete item (Settings -> Servers) red, which the
generic and WSL server rows already were.

Driven against the real app over CDP: Work rows offer Unmount in
rgb(241, 116, 113) and the sandbox's own folder offers nothing, Code still
offers Close, unmounting takes the folder out of the config and the row out
of the sidebar, and remounting brings both back. That run also caught the
IPC rejecting Solid store proxies ("An object could not be cloned"), so the
mount list is rebuilt as plain objects before it crosses.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  | 13 +++
 DIVERGENCES.md                                |  1 +
 packages/app/src/i18n/en.ts                   |  1 +
 packages/app/src/i18n/es.ts                   |  1 +
 packages/app/src/pages/home.tsx               | 15 ++-
 packages/app/src/sandbox/mounts-model.test.ts | 59 ++++++++++-
 packages/app/src/sandbox/mounts-model.ts      | 30 ++++++
 packages/app/src/sandbox/project-menu.tsx     | 98 +++++++++++++++++++
 packages/app/src/sandbox/settings.tsx         |  9 +-
 packages/app/src/workspace/tabs.tsx           |  5 +-
 10 files changed, 224 insertions(+), 8 deletions(-)
 create mode 100644 packages/app/src/sandbox/project-menu.tsx

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0979de5e3c..6e6aad8136 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,19 @@ file is the human-readable summary of what changed and why.
 
 ### Desktop / Web UI
 
+- **A folder on Work is unmounted from its own menu** — the menu on a **Work**
+  project offered **Close**, which only took the row out of the sidebar while
+  the sandbox went on holding the folder: the folder was still mounted, still
+  listed under **Folders…**, and the row could come back on the next launch.
+  That entry is now **Unmount**, in red, and it does what it says — the folder
+  leaves the sandbox, and the row goes with it. Mounting the folder again
+  brings its project back. The folder the sandbox was created with is fixed for
+  its life, so its menu offers neither; deleting the sandbox is still the way
+  to be rid of that one. On macOS and Linux unmounting restarts the sandbox, as
+  it does from the Folders… dialog. **Code** keeps Close, unchanged.
+- **Deleting a sandbox now looks destructive** — **Delete** in a sandbox's menu
+  (Settings → Servers) sat in the same colour as Reset and Mount project. It is
+  now red, matching ordinary and WSL servers.
 - **A new sandbox's project no longer flashes "workspace"** — a sandbox's
   project folder is mounted inside the guest at a fixed path, and until the
   app finished renaming the project after your folder — a round trip through
diff --git a/DIVERGENCES.md b/DIVERGENCES.md
index 7002bb8b8d..d72a6fbde7 100644
--- a/DIVERGENCES.md
+++ b/DIVERGENCES.md
@@ -126,6 +126,7 @@ from the squash message first, or use a plain merge.
 | `packages/ui/src/theme/context.tsx`, `packages/app/public/oc-theme-preload.js`, `packages/app/src/theme-preload.test.ts`, `packages/app/src/pages/layout.tsx`, `packages/app/src/components/settings-general.tsx`, `packages/app/src/components/settings-v2/general.tsx` | **One theme in the web/desktop UI; light and dark are the only axis.** Upstream ships 36 selectable palettes with a Settings → Appearance **Theme** picker and command-palette entries. The fork exposes none of them: OC-2 is the theme, `colorScheme` (system/light/dark) is the only appearance choice. The lock lives at `normalize()` in `theme/context.tsx`, renamed to the exported `normalizeThemeID()` and returning the exported `SHIPPED_THEME_ID` unconditionally — that one function is already on every path (provider init, the `onMount` migration, `load`, the cross-tab `storage` listener, `setTheme`, `previewTheme`), so a stored id from before the picker was removed, or one written by another tab, resolves to OC-2 without a second guard. It is exported (and the six call sites renamed) so `theme/context.test.ts` can cover the invariant directly instead of only through its call sites — the module imports cleanly under `bun test` because `import.meta.glob` is called lazily inside `getFiles()`. It also gives the migration for free: `onMount` already rewrites `opencode-theme-id` and calls `clear()` when the raw value differs from the normalized one, which now drops the stale `opencode-theme-css-{light,dark}` cache. `ids()` returns `["oc-2"]` and `loadThemes()` loads only OC-2 instead of all 36 (it was `Promise.all(themeIDs().map(load))`). The bundled theme JSON, the `names` map and `registerTheme` are **left alone** — unreferenced data costs nothing and keeps upstream's theme edits applying cleanly. `oc-theme-preload.js` does the same rewrite *before* mount, so the first launch after upgrading does not paint the user's old palette for a frame; with no other theme reachable its cached-CSS `<style>` injection is gone and it only sets the mode attributes. Removed surfaces: the **Theme** `SettingsRow`/`SettingsRowV2` in both Settings screens (with the `…/themes` docs "Learn more" link, `themeOptions`, the `ThemeOption` type and the `onMount(loadThemes)` that fed them), and in `pages/layout.tsx` the `theme.cycle` command with its `mod+shift+t` keybind, the `cycleTheme` helper and the `theme.set.<id>` command loop (with `availableThemeEntries`). The **colour-scheme** commands stay: `theme.scheme.cycle` (`mod+shift+s`), the three `theme.scheme.<scheme>` entries and their preview/commit wiring. i18n keys (`settings.general.row.theme.*`, `command.theme.cycle`, `command.theme.set`, `toast.theme.title`) are left in the dicts — unused keys are harmless and removing them only creates conflicts. | Every fork surface — the brand, the icons, the screenshots, the docs — is drawn against OC-2. A palette picker means 36 combinations nobody verifies, and a user on Synthwave '84 files bug reports about a UI the fork never shipped. Light/dark still covers the real need. | Keep ours. Take upstream's surrounding changes; re-apply the `normalize()` constant, the `ids()`/`loadThemes()` narrowing, the preload rewrite, and the removed rows/commands. If upstream adds a new theme-selection surface, remove it rather than wiring it up. Do not "fix" `normalize()` back to the `oc-1 → oc-2` mapping — that mapping is a subset of what it does now. Leave the bundled theme files and `names` map in place; deleting them is a much bigger conflict surface for no gain. |
 | `packages/app/src/pages/session/timeline/message-timeline.tsx` | **Session actions menu extracted.** The ⋯ menu beside the session title — both renderings, the legacy `DropdownMenu` and the v2 `MenuV2`, ~145 lines — and the `DialogDeleteSession` closure move to the fork-only `packages/app/src/components/session-actions-menu.tsx` (verbatim at extraction; the v2 Delete item has since dropped its ellipsis and taken the danger colour, so do not diff the two expecting a match), and this file renders `<SessionActionsMenu>` instead, passing its existing `openTitleEditor` / share / `archiveSession` / `deleteSession` as callbacks and its trigger element out through `triggerRef` (the share popover still anchors to it). The extracted dialog takes a resolved `title` and an `onConfirm` rather than a `sessionID`, so the caller supplies `sessionTitle(sync().session.get(id)?.title)`. The `title` store loses `pendingRename`/`pendingShare`: deferring Rename and Share until the menu's `onCloseAutoFocus` is now the component's job, since every caller needs it (a list row's inline editor is blurred by the returning focus exactly as the header's was). Also gains one fork-only `createEffect` that consumes `consumeSessionShareRequest(sessionID())` and opens the share popover — the session rows' Share routes through it. | The sidebar's Recents rows and the home session list open the same menu; three copies of four items would drift. Only this file rendered the menu, so extraction is the smallest way to share it. | Keep the extraction. On conflict, take upstream's `message-timeline.tsx` wholesale and re-apply: delete both inline menu blocks and the local `DialogDeleteSession`, mount `<SessionActionsMenu>` with the same callbacks, drop the two `pending*` store fields, and re-add the share-request effect. If upstream adds a menu item, add it to `session-actions-menu.tsx` (both variants) rather than back here. Do not "simplify" the component's deferred rename/share into a plain `onSelect` — focus return is what it exists to survive. |
 | `packages/app/src/pages/home.tsx` | `HomeSessionRow` gains the same `<SessionActionsMenu>` (hover/focus/menu-open revealed, vertical dots) and inline rename: while renaming, the row renders a `div` with `InlineEditor` instead of the `button`, because an input inside a button is invalid markup and swallows keystrokes into the open-session handler. `NewHome` holds one `createInlineEditorController()` for the list and passes it plus the model down. Its local `archiveSession` is deleted — `createHomeModel()` owns `archiveSession`/`renameSession`/`deleteSession` now, so the sidebar and this screen run one implementation (extends the "state both screens need moves to home-model.tsx" split in the persistent-sidebar row above); the call site becomes `model.archiveSession`. Upstream's `SHOW_HOME_SESSION_ARCHIVE` block is left exactly as-is — the flag is `false`, so it renders nothing, and touching it would widen the diff for no gain. `data-component="home-session-row"` and every other selector are untouched (`packages/app/e2e` binds to them); the menu adds `data-action="session-menu"`. | The Recents rows and "View all" are the same list at two sizes; a menu on one and not the other makes "View all" a dead end. | Keep our row structure. On conflict take upstream's row and re-apply the menu, the editing branch, and the `model.*` action wiring. Never let a `data-component`/`data-action` hook drift. If upstream re-enables `SHOW_HOME_SESSION_ARCHIVE`, drop that block instead — its absolutely-positioned archive button would sit on top of the menu. |
+| `packages/app/src/pages/home.tsx` | `HomeProjectRow`'s menu ends with `<ProjectRemovalMenuItems>` (fork-only `src/sandbox/project-menu.tsx`) in place of the `<MenuV2.Separator />` + **Close** item. The component owns the separator too, because a sandbox's own project folder offers neither. On a plain server it renders upstream's Close verbatim; on a sandbox an extra mounted folder gets a destructive **Unmount** that removes the folder from `SandboxConfig.mounts` through `api.sandboxes.updateMounts` and then drops the row with `projects.remove()`. `src/workspace/tabs.tsx` exports `primaryFolder` so the component can ask which folder cannot be unmounted; the decision itself is the pure `projectRemoval` in `src/sandbox/mounts-model.ts`. | On Work a project row *is* a folder mounted into a sandbox, so Close — which only hid the row while the sandbox kept the folder — described nothing the user wanted. Removal there means unmounting. Keeping the branch inside a fork-only component leaves this file with one import and one element. | Keep the element and the import; take upstream's other menu changes. If upstream adds items after Close, put them **before** the component — it must stay last, since it owns the trailing separator. Do not pass the row's close handler as the unmount path: `close()` records the folder as user-closed and `src/sandbox/projects.ts` honours that, so remounting it would leave the user with no project. |
 | `packages/app/src/pages/home.tsx` (again) | **Session lists keyed by id.** The "View all" list iterates `groups().map((group) => group.id)` and, within each group, `group.sessions.map((record) => record.session.id)`, resolving each back through a `createMemo` + `<Show>` rather than handing the objects to `<For>`. `groupSessions` mints new group objects on every call and `createHomeModel`'s records memo mints a new `{session, project, projectName}` wrapper per session on every recompute — the `projects` memo alone returns a fresh array on a pointerdown — and `<For>` keys on reference, so the rows were torn down and rebuilt on recomputes that changed nothing visible. When that landed between a pointerdown and its mouseup the browser had no surviving common ancestor to fire `click` on, so a row's ⋮ menu ignored its first click; the same rebuild could close an open menu or drop an in-progress rename. `data-component="home-session-row"`, `data-action="session-menu"` and the group header refs / opacity keys are unchanged. The fork-only `packages/app/src/components/app-sidebar.tsx` carries the same shape for the Recents list. | A menu that swallows the first click reads as broken, and the cause is structural rather than incidental: any refresh of the session index rebuilt every row. | Keep the id keying. On conflict take upstream's list body and re-apply both `<For>` wrappers. Do not "simplify" back to `<For each={groups()}>` / `<For each={group.sessions}>` — that is the bug. If upstream ever makes groups or records referentially stable this can go, but prove it with `packages/app/e2e/regression/home-session-menu-first-click.spec.ts` before removing it. |
 | Pinned sessions: `packages/app/src/pages/home.tsx`, `packages/app/src/pages/session/timeline/message-timeline.tsx`, `packages/app/src/pages/layout-new.tsx`, `packages/app/src/i18n/{en,es}.ts` | **Pin a session to a sidebar section of its own.** The fork-only `src/context/pinned-sessions.tsx` holds the pinned ids — one `Persist.global("sidebar.pinned")` record keyed by `ServerConnection.Key`, newest pin first — and `layout-new.tsx` mounts its provider inside `AppSidebarProvider`; that is the nearest point covering all three surfaces, since `NewAppLayout` is the router root. It has to be context rather than state in `createHomeModel()`: the sidebar and the home screen each hold their own model, so two `persisted` stores over one key would write the same storage without sharing memory and a pin would not cross between them until a reload — the same reason the project selection lives in `useLayout()`. `home-model.tsx` (fork-only) derives `pinnedRecords()` / `recentRecords()` from it and `deleteSession` drops the pins of the whole deleted subtree. In `home.tsx`, `groupSessions` takes the pinned records and emits a leading `pinned` group, and pinned sessions are filtered out of the today/yesterday/older groups so they appear once; `HomeSessionRow` passes `pinned`/`onPin` into `<SessionActionsMenu>`. `message-timeline.tsx` passes the same pair, resolving the server the pin belongs to as `params.serverKey ? requireServerKey(params.serverKey) : useServer().key` — it must match what the sidebar's selection resolves to or the header would toggle a pin the sidebar cannot see. New i18n keys `common.pin`, `common.unpin`, `sidebar.pinned`, `home.sessions.group.pinned` in `en` + `es`. Every `data-component`/`data-action` hook is untouched; the new ones are `data-section="pinned"` and `data-slot="sidebar-pinned-list"`. The Pinned list is keyed by session id for the same reason the row above keys the View all lists — it renders the same rebuilt record wrappers. | A purely chronological Recents buries the handful of sessions someone actually returns to, and "View all" is the only way back. Pinning is the smallest fix, and it has to be offered wherever a session's menu is or it is undiscoverable. | Keep our structure. On conflict take upstream's `home.tsx` / `message-timeline.tsx` wholesale and re-apply: the `pinned` group id and its filter in `groupSessions`, the `pinnedRecords` argument at the `groups` memo, and the two `pinned`/`onPin` props. If upstream adds its own grouping ahead of Today, fold the pinned group in above it rather than replacing it. Never resolve the header's server key differently from the sidebar's — mismatched keys silently split one user's pins in two. |
 | `packages/app/e2e/regression/remote-session-settings.spec.ts` | Both tests pick the settings-shortcut modifier by asking the page — `/(Mac|iPod|iPhone|iPad)/.test(navigator.platform)` — through a local `openSettingsDialog(page)` helper, instead of branching on the Node-side `process.platform`. | Upstream's version pressed `Meta+,` whenever the *host* was macOS, but the app resolves `mod` from `navigator.platform` (`IS_MAC` in `src/context/command.tsx`) and Playwright's `devices["Desktop Chrome"]` profile ships a Windows user agent, so the page always reports `Win32`. On a macOS machine the suite therefore pressed Meta while the app listened for Control: the settings dialog never opened and both tests failed, while Linux CI stayed green because there the host branch happened to pick Control anyway. A real macOS browser reports `MacIntel`, so the app is right and only the test was wrong. | Keep our helper. On conflict take upstream's spec and re-apply it. If upstream fixes this itself, drop the row. Worth submitting upstream — it breaks the suite for every macOS developer. |
diff --git a/packages/app/src/i18n/en.ts b/packages/app/src/i18n/en.ts
index bacaa6d2ad..0febcb283f 100644
--- a/packages/app/src/i18n/en.ts
+++ b/packages/app/src/i18n/en.ts
@@ -443,6 +443,7 @@ export const dict = {
   "sandbox.mounts.empty": "No extra folders are mounted.",
   "sandbox.mounts.add": "Add folder...",
   "sandbox.mounts.remove": "Remove folder",
+  "sandbox.mounts.unmount": "Unmount",
   "sandbox.mounts.save": "Save",
   "sandbox.mounts.restartWarning":
     "Saving restarts the sandbox. Files on disk are kept; running terminals and in-flight work in the sandbox stop.",
diff --git a/packages/app/src/i18n/es.ts b/packages/app/src/i18n/es.ts
index f67bd1443c..036f56c788 100644
--- a/packages/app/src/i18n/es.ts
+++ b/packages/app/src/i18n/es.ts
@@ -436,6 +436,7 @@ export const dict = {
   "sandbox.mounts.empty": "No hay carpetas adicionales montadas.",
   "sandbox.mounts.add": "Añadir carpeta...",
   "sandbox.mounts.remove": "Quitar carpeta",
+  "sandbox.mounts.unmount": "Desmontar",
   "sandbox.mounts.save": "Guardar",
   "sandbox.mounts.restartWarning":
     "Al guardar se reinicia el sandbox. Los archivos en disco se conservan; las terminales abiertas y el trabajo en curso dentro del sandbox se detienen.",
diff --git a/packages/app/src/pages/home.tsx b/packages/app/src/pages/home.tsx
index fcb8c5e24d..914133327d 100644
--- a/packages/app/src/pages/home.tsx
+++ b/packages/app/src/pages/home.tsx
@@ -57,6 +57,7 @@ import { type ServerHealth } from "@/utils/server-health"
 import { useMarked } from "@opencode-ai/ui/context/marked"
 import { preloadMarkdown } from "@opencode-ai/session-ui/markdown-cache"
 import { createHomeModel, isBackgroundOpen, type HomeSessionRecord, type OpenSessionOptions } from "./home-model"
+import { ProjectRemovalMenuItems } from "@/sandbox/project-menu"
 import { showToast } from "@/utils/toast"
 import { fileManagerApp } from "@/utils/file-manager"
 
@@ -852,10 +853,16 @@ function HomeProjectRow(props: {
               >
                 {props.language.t("sidebar.project.clearNotifications")}
               </MenuV2.Item>
-              <MenuV2.Separator />
-              <MenuV2.Item onSelect={() => props.closeProject(props.server, props.project.worktree)}>
-                {props.language.t("common.close")}
-              </MenuV2.Item>
+              {/* Fork: on Work a project row is a folder mounted into a
+                  sandbox, so its removal is Unmount rather than the
+                  client-side Close. The separator belongs to the item, since
+                  the sandbox's own project folder offers neither. Code is
+                  unchanged. */}
+              <ProjectRemovalMenuItems
+                server={props.server}
+                worktree={props.project.worktree}
+                close={() => props.closeProject(props.server, props.project.worktree)}
+              />
             </MenuV2.Content>
           </MenuV2.Portal>
         </MenuV2>
diff --git a/packages/app/src/sandbox/mounts-model.test.ts b/packages/app/src/sandbox/mounts-model.test.ts
index 5e02761500..c540ba3ef7 100644
--- a/packages/app/src/sandbox/mounts-model.test.ts
+++ b/packages/app/src/sandbox/mounts-model.test.ts
@@ -1,5 +1,6 @@
 import { expect, test } from "bun:test"
-import { validateSandboxMounts } from "./mounts-model"
+import type { ServerConnection } from "@/context/server"
+import { projectRemoval, validateSandboxMounts } from "./mounts-model"
 
 test("accepts distinct sibling folders", () => {
   expect(validateSandboxMounts("/home/user/project", ["/home/user/docs", "/srv/data"])).toBeNull()
@@ -35,3 +36,59 @@ test("rejects nesting in either direction, against the project dir and other mou
 test("rejects UNC paths", () => {
   expect(validateSandboxMounts("C:\\p", ["\\\\server\\share"])).toEqual({ code: "unc", path: "\\\\server\\share" })
 })
+
+const sandbox = (mounts: { path: string; guestPath: string }[]): ServerConnection.Any => ({
+  displayName: "test1",
+  type: "sidecar",
+  variant: "sandbox",
+  name: "test1",
+  projectDir: "/Users/me/backend",
+  mounts,
+  http: { url: "http://127.0.0.1:1" },
+})
+
+const local: ServerConnection.Any = {
+  displayName: "Local",
+  type: "sidecar",
+  variant: "base",
+  http: { url: "http://127.0.0.1:2" },
+}
+
+test("a plain server keeps Close", () => {
+  expect(projectRemoval({ server: local, worktree: "/Users/me/backend", primary: undefined })).toEqual({
+    kind: "close",
+  })
+})
+
+test("a mounted folder offers Unmount, carrying the host path to remove", () => {
+  const server = sandbox([{ path: "/Users/me/hub", guestPath: "/mnt/hub" }])
+  expect(projectRemoval({ server, worktree: "/mnt/hub", primary: "/workspace" })).toEqual({
+    kind: "unmount",
+    path: "/Users/me/hub",
+  })
+})
+
+// The folder the sandbox was created with is fixed for its life, so the menu
+// offers nothing rather than an item that can never do anything.
+test("the sandbox's own project folder offers neither", () => {
+  const server = sandbox([{ path: "/Users/me/hub", guestPath: "/mnt/hub" }])
+  expect(projectRemoval({ server, worktree: "/workspace", primary: "/workspace" })).toBeNull()
+})
+
+// Unmounting from the Folders dialog leaves the row behind on purpose —
+// sessions may still reference it — so Close has to stay reachable for it.
+test("a row whose folder is no longer mounted falls back to Close", () => {
+  const server = sandbox([{ path: "/Users/me/hub", guestPath: "/mnt/hub" }])
+  expect(projectRemoval({ server, worktree: "/mnt/gone", primary: "/workspace" })).toEqual({ kind: "close" })
+})
+
+// The primary is only known once the guest has reported its own directory; a
+// row must not silently become unmountable in that gap.
+test("with no primary known yet, a mounted folder still resolves by its mount", () => {
+  const server = sandbox([{ path: "/Users/me/hub", guestPath: "/mnt/hub" }])
+  expect(projectRemoval({ server, worktree: "/mnt/hub", primary: undefined })).toEqual({
+    kind: "unmount",
+    path: "/Users/me/hub",
+  })
+  expect(projectRemoval({ server, worktree: "/workspace", primary: undefined })).toEqual({ kind: "close" })
+})
diff --git a/packages/app/src/sandbox/mounts-model.ts b/packages/app/src/sandbox/mounts-model.ts
index 2d4655a984..dba83229b6 100644
--- a/packages/app/src/sandbox/mounts-model.ts
+++ b/packages/app/src/sandbox/mounts-model.ts
@@ -1,3 +1,6 @@
+import type { ServerConnection } from "@/context/server"
+import { pathKey } from "@/utils/path-key"
+
 // Pure validation for the manage-mounts dialog, mirroring validateMountPaths
 // in @codev/sandbox (the app must never import that node-flavored package —
 // see types.ts). The main process re-validates on save; this copy exists for
@@ -24,6 +27,33 @@ export function validateSandboxMounts(projectDir: string, paths: string[]): Sand
   return null
 }
 
+// What a project row's menu offers as its way of getting rid of the project.
+// On Code that is upstream's Close, which only takes the row out of this
+// window's list. On Work a project row *is* a mounted folder, so hiding the
+// row while the sandbox went on holding the folder was the confusing half of
+// the old behaviour — there, removal means unmounting.
+//
+// `primary` is the folder the sandbox was created with, as the guest reports
+// its own working directory. It is fixed for the sandbox's life, so it offers
+// nothing: deleting the sandbox is the only way to be rid of it, and a
+// disabled item that can never be enabled says less than no item at all.
+//
+// A folder that is neither the primary nor currently mounted still gets Close.
+// That is the row left behind when a folder is unmounted from the Folders
+// dialog instead — sessions may still reference it, so it is not removed for
+// the user, and without this it could never be removed at all.
+export function projectRemoval(input: {
+  server: ServerConnection.Any
+  worktree: string
+  primary: string | undefined
+}): { kind: "close" } | { kind: "unmount"; path: string } | null {
+  if (input.server.type !== "sidecar" || input.server.variant !== "sandbox") return { kind: "close" }
+  if (input.primary && pathKey(input.worktree) === pathKey(input.primary)) return null
+  const mount = input.server.mounts?.find((entry) => pathKey(entry.guestPath) === pathKey(input.worktree))
+  if (!mount) return { kind: "close" }
+  return { kind: "unmount", path: mount.path }
+}
+
 // Windows paths compare case-insensitively; detection is by shape (drive
 // letter or backslash) so the model needs no platform flag.
 function comparableMountPath(path: string) {
diff --git a/packages/app/src/sandbox/project-menu.tsx b/packages/app/src/sandbox/project-menu.tsx
new file mode 100644
index 0000000000..55e8074fb1
--- /dev/null
+++ b/packages/app/src/sandbox/project-menu.tsx
@@ -0,0 +1,98 @@
+import { MenuV2 } from "@opencode-ai/ui/v2/menu-v2"
+import { createMemo, Show } from "solid-js"
+import { useGlobal } from "@/context/global"
+import { useLanguage } from "@/context/language"
+import { usePlatform } from "@/context/platform"
+import { ServerConnection } from "@/context/server"
+import { showToast } from "@/utils/toast"
+import { pathKey } from "@/utils/path-key"
+import { primaryFolder } from "@/workspace/tabs"
+import { useSandboxes } from "./context"
+import { projectRemoval } from "./mounts-model"
+
+// The tail of a project row's menu (packages/app/src/pages/home.tsx): its
+// separator and the one item that gets rid of the project. Everything that
+// makes Work different from Code lives here, so the upstream row keeps one
+// mount point rather than a branch.
+export function ProjectRemovalMenuItems(props: {
+  server: ServerConnection.Any
+  worktree: string
+  close: () => void
+}) {
+  const language = useLanguage()
+  const platform = usePlatform()
+  const global = useGlobal()
+  const sandboxes = useSandboxes()
+
+  const removal = createMemo(() =>
+    projectRemoval({
+      server: props.server,
+      worktree: props.worktree,
+      primary: primaryFolder(global.ensureServerCtx(props.server)),
+    }),
+  )
+  const unmountPath = () => {
+    const value = removal()
+    return value?.kind === "unmount" ? value.path : undefined
+  }
+  // A sandbox has at most one lifecycle job, and updateMounts is refused while
+  // one is in flight — the same reason the settings menu greys its actions out.
+  const busy = () =>
+    !!sandboxes.state.data?.jobs.some((job) => job.id === ServerConnection.key(props.server))
+
+  const unmount = async (path: string) => {
+    const id = ServerConnection.key(props.server)
+    const item = sandboxes.state.data?.sandboxes.find((entry) => entry.config.id === id)
+    if (!platform.sandboxes || !item) return
+    // Rebuilt as plain objects, not filtered in place: config.mounts are Solid
+    // store proxies, and the structured clone behind ipcRenderer.invoke refuses
+    // them ("An object could not be cloned"). The mounts dialog is accidentally
+    // safe here — it builds its list from strings.
+    const remaining = (item.config.mounts ?? [])
+      .filter((mount) => pathKey(mount.path) !== pathKey(path))
+      .map((mount) => ({ path: mount.path }))
+    try {
+      await platform.sandboxes.updateMounts(id, remaining)
+    } catch (error) {
+      showToast({
+        variant: "error",
+        title: language.t("common.requestFailed"),
+        description: error instanceof Error ? error.message : String(error),
+      })
+      return
+    }
+    // Only once the folder has actually left the sandbox: a failed unmount
+    // must not hide a row whose folder is still mounted.
+    //
+    // remove(), not the menu's close(): the row is going because its folder
+    // left the sandbox, which is the "internal, non-user removal" that store
+    // documents. close() would also record it as closed, and the seeding
+    // effect honours that — mounting the folder again would leave the user
+    // with no project for it.
+    global.ensureServerCtx(props.server).projects.remove(props.worktree)
+  }
+
+  return (
+    <Show when={removal()}>
+      <MenuV2.Separator />
+      <Show
+        when={unmountPath()}
+        fallback={<MenuV2.Item onSelect={props.close}>{language.t("common.close")}</MenuV2.Item>}
+      >
+        {(path) => (
+          // Danger colour comes from the item's own `--menu-v2-fg` rather than
+          // a text utility: menu-v2.css colours the label span directly, so a
+          // class on the item would not reach it (same hook as the server and
+          // session menus).
+          <MenuV2.Item
+            disabled={busy()}
+            style={{ "--menu-v2-fg": "var(--v2-state-fg-danger)" }}
+            onSelect={() => void unmount(path())}
+          >
+            {language.t("sandbox.mounts.unmount")}
+          </MenuV2.Item>
+        )}
+      </Show>
+    </Show>
+  )
+}
diff --git a/packages/app/src/sandbox/settings.tsx b/packages/app/src/sandbox/settings.tsx
index b17e6d1eb9..7a95ae32eb 100644
--- a/packages/app/src/sandbox/settings.tsx
+++ b/packages/app/src/sandbox/settings.tsx
@@ -142,7 +142,14 @@ export function SandboxServerSettings(props: {
                           </MenuV2.Item>
                         </Show>
                         <MenuV2.Separator />
-                        <MenuV2.Item disabled={busy()} onSelect={() => request.mutate(() => props.controller.handleRemove(key))}>
+                        {/* Same danger hook the generic and WSL server rows
+                            use: menu-v2.css colours the label span, so a text
+                            utility on the item would not reach it. */}
+                        <MenuV2.Item
+                          disabled={busy()}
+                          style={{ "--menu-v2-fg": "var(--v2-state-fg-danger)" }}
+                          onSelect={() => request.mutate(() => props.controller.handleRemove(key))}
+                        >
                           {language.t("dialog.server.menu.delete")}
                         </MenuV2.Item>
                       </MenuV2.Group>
diff --git a/packages/app/src/workspace/tabs.tsx b/packages/app/src/workspace/tabs.tsx
index 7d6c9e5b2c..35f21f2cf4 100644
--- a/packages/app/src/workspace/tabs.tsx
+++ b/packages/app/src/workspace/tabs.tsx
@@ -34,8 +34,9 @@ type FolderServerCtx = {
 // A sandbox's own project folder, as the guest reports its working directory.
 // Deliberately not projects.list()[0]: projects.open() prepends, so that is
 // whichever mount was added most recently, not the folder the sandbox was
-// created with.
-function primaryFolder(ctx: FolderServerCtx) {
+// created with. Exported because the project row's menu asks the same question
+// — that folder is the one that cannot be unmounted.
+export function primaryFolder(ctx: FolderServerCtx) {
   return ctx.sync.data.path.directory || ctx.sync.data.path.worktree || undefined
 }
 

From 7783a5b744982c1aa2eef5a022f5957e59600b8b Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 15:00:29 +0700
Subject: [PATCH 2/7] fix(app): make a draft wait for its sandbox instead of
 falling back to the local server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A restart -- mounting or unmounting a folder -- takes a sandbox out of the
server list for a second or two. Session tabs already waited for it
(TargetServerRoute renders ServerAway), but the draft route did not: its
providers took `conn` as undefined and resolved to whichever server is
selected instead, so a New session tab belonging to a sandbox rendered the
local machine's composer. The sidebar said Work and the screen was Code --
and sending the prompt would have run it on the user's own machine.

ResolvedDraftRoute gets the same guard, so both server-scoped routes wait
in the same way and come back on their own.

ServerAway gains a LoaderV2 over its copy: this state always ends by
itself, so it should read as waiting rather than as something to act on.
Its description now says "this tab" rather than "this session" — the draft
route shares the screen and has no session yet.

Verified in the app with a sandbox draft open: while the sandbox is away
the pane is the waiting screen, spinner and all, with no composer; the
composer returns on its own, still on the sandbox, once it is back.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                             |  7 +++++
 DIVERGENCES.md                           |  2 +-
 packages/app/src/app.tsx                 | 37 +++++++++++++++---------
 packages/app/src/i18n/en.ts              |  2 +-
 packages/app/src/i18n/es.ts              |  2 +-
 packages/app/src/sandbox/server-away.tsx | 18 ++++++++----
 6 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6e6aad8136..9937a31d74 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,13 @@ file is the human-readable summary of what changed and why.
   its life, so its menu offers neither; deleting the sandbox is still the way
   to be rid of that one. On macOS and Linux unmounting restarts the sandbox, as
   it does from the Folders… dialog. **Code** keeps Close, unchanged.
+- **A restarting sandbox no longer shows you the wrong machine** — mounting or
+  unmounting a folder restarts the sandbox, and while it was away a **New
+  session** tab belonging to it quietly rendered the local machine's composer:
+  the sidebar said Work, the screen was Code, and sending the prompt would have
+  run it on your own machine. Those tabs now wait, with a spinner, and come back
+  on their own once the sandbox does — the same screen open sessions already
+  showed.
 - **Deleting a sandbox now looks destructive** — **Delete** in a sandbox's menu
   (Settings → Servers) sat in the same colour as Reset and Mount project. It is
   now red, matching ordinary and WSL servers.
diff --git a/DIVERGENCES.md b/DIVERGENCES.md
index d72a6fbde7..03ae0a35c9 100644
--- a/DIVERGENCES.md
+++ b/DIVERGENCES.md
@@ -221,7 +221,7 @@ from the squash message first, or use a plain merge.
 
 | `packages/app/src/pages/layout/project-avatar-state.ts` | Both `ensureServerState` lookups are gated on `connection()`: `unread` before `notification.ensureServerState`, and the `permissionState` memo before `permission.ensureServerState` (which also moves below `connection`, and its consumer in `hasPermissions` handles the undefined state). Matches the guard `hasPermissions`/`hasQuestions`/`loading` already apply to `sync()`. | `ensureServerState` throws on a key absent from the connection list, and the throw propagates out of a render-time memo, killing the whole renderer. Sidecar connections are listed only while healthy — `readySandboxConnections`/`readyWslConnections` publish a sandbox or WSL server only in the `ready` state — so any removal, restart, or crash of one drops its key while its session tabs are still mounted. Reproduced by removing a sandbox that had an open session tab: `Error: Notification server not found: sandbox:<name>`. The permission lookup is the sharper of the two because `createMemo` computes eagerly: for a tab mounted after its server disappeared it throws during construction, before any downstream guard runs — `Error: Permission server not found: sandbox:<name>`, reproduced by deleting a sandbox from Settings while the Work side was open. | Keep the guard; take upstream's other changes to the hook. This is an upstream bug (WSL servers hit the identical path), so if upstream fixes it their way, drop ours in favour of theirs. |
 | `packages/app/src/components/titlebar.tsx` | The effect that opens a tab for the session the route points at now skips servers that are not in `global.servers.list()`. | The tab store prunes tabs whose server left the list (`context/tabs.tsx`), and this effect adds one back for whatever the route names — so a route pointing at a server that is momentarily absent puts the two in a loop: prune, re-add, prune, at about a thousand rounds a second. The renderer never yields, so it also never processes the IPC event that would bring the server back, and the window stays wedged until it is killed. Sidecar connections are published only while healthy (`readySandboxConnections`/`readyWslConnections`), so any restart drops one: reproduced by adding a folder to a sandbox while one of its sessions was open, which restarts the guest to apply the mount. The route is deliberately left alone — the tab returns on its own when the server comes back. This is an upstream bug (WSL servers hit the identical path). | Keep the guard; take upstream's other changes to the effect. If upstream fixes it their way, drop ours in favour of theirs. Do not "simplify" the guard away — an unguarded add against the pruner is the hang. |
-| Tabs that outlive a sandbox restart: `packages/app/src/context/{server,tabs}.tsx`, `packages/app/src/app.tsx`, `packages/app/src/i18n/{en,es}.ts`, `packages/desktop/src/renderer/index.tsx` | `server.tsx` takes a `retainedServers` prop and exposes it as `retained` — servers that exist but are not connected; `tabs.tsx` reconciles both of its prune effects (open tabs and the closed-tab stack) against `list` **plus** `retained` through a shared `knownServers()`; `app.tsx` threads `retainedServers` from `AppInterface` into `ServerProvider`, and `TargetServerRoute` renders the fork-only `packages/app/src/sandbox/server-away.tsx` instead of mounting its providers when the route's server is retained but absent; i18n gains `session.error.disconnected{,.description}`; `renderer/index.tsx` passes `retainedSandboxServers(...)` (fork-only, in `renderer/sandbox/connections.ts`) — every sandbox that exists, whatever its runtime state. | A sandbox is published as a connection only while it is ready, so applying a mount — which restarts the guest — takes it out of `server.list` for a second or two. The tab pruner read that as "this server is gone" and deleted every tab belonging to it, discarding each tab's memory: the typed prompt, terminal and scroll state. Retention draws the line where the user does — the sandbox still exists, so its tabs do — and explicit removal is unaffected because `dialog-select-server` already calls `tabs.removeServer(key)` and the sandbox then leaves `retained` as well. The route guard is the other half: a retained server has no connection, and mounting `ServerSDKProvider`/`ServerSyncProvider` with `undefined` sends the session's requests to whichever server is selected instead, which answered "this session cannot be found" about a healthy session and bounced the route home through a burst of ~250 navigations. WSL servers are deliberately not retained — same latent problem, but the WSL vertical has no equivalent restart in normal use. | Keep all five edits together — retention without the route guard just moves the confusing state, and the guard without retention is unreachable. Take upstream's other changes to these files. `retained` must stay a superset relationship with `list` (a server can be in both mid-transition); if upstream reworks the pruner, re-apply the union. The web build passes no `retainedServers`, so `retained` is empty there and every one of these paths collapses to upstream behaviour. |
+| Tabs that outlive a sandbox restart: `packages/app/src/context/{server,tabs}.tsx`, `packages/app/src/app.tsx`, `packages/app/src/i18n/{en,es}.ts`, `packages/desktop/src/renderer/index.tsx` | `server.tsx` takes a `retainedServers` prop and exposes it as `retained` — servers that exist but are not connected; `tabs.tsx` reconciles both of its prune effects (open tabs and the closed-tab stack) against `list` **plus** `retained` through a shared `knownServers()`; `app.tsx` threads `retainedServers` from `AppInterface` into `ServerProvider`, and **both** server-scoped routes — `TargetServerRoute` and `ResolvedDraftRoute` — render the fork-only `packages/app/src/sandbox/server-away.tsx` (a `LoaderV2` over the copy, since the state always ends by itself) instead of mounting their providers when the route's server is retained but absent; i18n gains `session.error.disconnected{,.description}`, worded around "this tab" rather than "this session" because the draft route shares the screen; `renderer/index.tsx` passes `retainedSandboxServers(...)` (fork-only, in `renderer/sandbox/connections.ts`) — every sandbox that exists, whatever its runtime state. | A sandbox is published as a connection only while it is ready, so applying a mount — which restarts the guest — takes it out of `server.list` for a second or two. The tab pruner read that as "this server is gone" and deleted every tab belonging to it, discarding each tab's memory: the typed prompt, terminal and scroll state. Retention draws the line where the user does — the sandbox still exists, so its tabs do — and explicit removal is unaffected because `dialog-select-server` already calls `tabs.removeServer(key)` and the sandbox then leaves `retained` as well. The route guard is the other half: a retained server has no connection, and mounting `ServerSDKProvider`/`ServerSyncProvider` with `undefined` sends the session's requests to whichever server is selected instead, which answered "this session cannot be found" about a healthy session and bounced the route home through a burst of ~250 navigations. WSL servers are deliberately not retained — same latent problem, but the WSL vertical has no equivalent restart in normal use. | Keep all five edits together — retention without the route guards just moves the confusing state, and the guards without retention are unreachable. Both routes need the guard: they are the two places a tab can point at a server, and the draft one is worse without it — a draft resolves to whichever server is selected, so the prompt would be sent to the local machine rather than the sandbox the tab belongs to. Take upstream's other changes to these files. `retained` must stay a superset relationship with `list` (a server can be in both mid-transition); if upstream reworks the pruner, re-apply the union. The web build passes no `retainedServers`, so `retained` is empty there and every one of these paths collapses to upstream behaviour. |
 | `script/publish.ts` | The `if (Script.release)` block calling `packages/desktop/scripts/finalize-latest-{json,yml}.ts` removed, replaced by a comment. | Both finalizers existed to assemble update metadata into a GitHub release, which the fork no longer publishes to. electron-builder already writes a correct per-platform `latest*.yml` next to each installer, and the fork builds one arch per platform (macOS is universal — see the universal-builds row), so there is nothing left to merge. | Keep removed. If upstream adds further desktop release steps here, drop them unless they target the bucket. |
 | `packages/desktop/scripts/finalize-latest-json.ts`, `packages/desktop/scripts/finalize-latest-yml.ts` | Deleted. | Both `gh release upload` into a GitHub release the fork does not use. `finalize-latest-yml.ts` merged per-arch `latest*.yml` from an upstream build matrix the fork does not run; `finalize-latest-json.ts` additionally built a Tauri-style `latest.json` signed with `@tauri-apps/cli signer` that nothing in the Electron updater path ever reads, and had gone stale besides — it hardcoded `opencode-desktop-mac-{x64,arm64}.app.tar.gz`, an artifact name and format this fork never produces. Leaving them in place is a trap: they look like the release path and upload to the wrong place. | Keep deleted (`git rm` the upstream side of modify/delete conflicts). If a future build matrix produces two `latest.yml` files for one platform (Windows x64 + arm64), write a bucket-targeted merge step rather than restoring these. |
 | `packages/desktop/src/renderer/index.tsx` | Desktop notification icon `https://opencode.ai/favicon-96x96-v3.png` → the relative `./favicon-96x96-v3.png`. The renderer's `publicDir` is `packages/app/public`, whose `favicon-96x96-v3.png` symlinks to the rebranded `packages/ui/src/assets/favicon/` mark, so the file is emitted next to `index.html` and resolves against the renderer origin (`oc://renderer/` packaged, the vite dev server otherwise) — the same asset and the same relative form `src/renderer/index.html` already uses for `<link rel="icon">`. | A desktop app should not reach out to a remote host to draw its own notification icon (it fails offline and leaks a request per notification), and the remote file is upstream-branded while the bundled one is the codev mark. | Keep our relative path. If upstream changes the URL, re-point it at the bundled asset rather than taking a new remote host. `packages/app/src/entry.tsx` and `pages/layout/helpers.ts` keep their remote `opencode.ai/favicon*` sources — same bug class, not yet fixed. |
diff --git a/packages/app/src/app.tsx b/packages/app/src/app.tsx
index fa961ef0fb..86dac443bd 100644
--- a/packages/app/src/app.tsx
+++ b/packages/app/src/app.tsx
@@ -234,25 +234,36 @@ function DraftRoute() {
 
 function ResolvedDraftRoute(props: { draft: DraftTab }) {
   const global = useGlobal()
+  const server = useServer()
   const conn = createMemo(() => global.servers.list().find((item) => ServerConnection.key(item) === props.draft.server))
   const directory = () => props.draft.directory
   const serverKey = () => props.draft.server
 
   return (
     <Show when={`${props.draft.server}\0${props.draft.directory}`} keyed>
-      <ServerSDKProvider server={conn}>
-        <ServerSyncProvider server={conn}>
-          <ModelsProvider directory={directory}>
-            <SDKProvider directory={directory}>
-              <DirectoryDataProvider directory={directory} server={serverKey}>
-                <DraftProviders>
-                  <NewSession />
-                </DraftProviders>
-              </DirectoryDataProvider>
-            </SDKProvider>
-          </ModelsProvider>
-        </ServerSyncProvider>
-      </ServerSDKProvider>
+      {/* Fork: the same wait TargetServerRoute does, for the draft half of the
+          route table. Without it a draft on a restarting sandbox mounts its
+          providers with no connection, which resolves to whichever server is
+          selected instead: the Work side quietly renders the local machine's
+          new-session screen, and sending the prompt would have run it there. */}
+      <Show
+        when={conn() || !server.retained.includes(props.draft.server)}
+        fallback={<ServerAway name={props.draft.server} />}
+      >
+        <ServerSDKProvider server={conn}>
+          <ServerSyncProvider server={conn}>
+            <ModelsProvider directory={directory}>
+              <SDKProvider directory={directory}>
+                <DirectoryDataProvider directory={directory} server={serverKey}>
+                  <DraftProviders>
+                    <NewSession />
+                  </DraftProviders>
+                </DirectoryDataProvider>
+              </SDKProvider>
+            </ModelsProvider>
+          </ServerSyncProvider>
+        </ServerSDKProvider>
+      </Show>
     </Show>
   )
 }
diff --git a/packages/app/src/i18n/en.ts b/packages/app/src/i18n/en.ts
index 0febcb283f..a153e2b98c 100644
--- a/packages/app/src/i18n/en.ts
+++ b/packages/app/src/i18n/en.ts
@@ -724,7 +724,7 @@ export const dict = {
   // that gap, so its sessions need something truer to say than "not found".
   "session.error.disconnected": "Waiting for this server",
   "session.error.disconnected.description":
-    "This session is on a server that is not running right now. It comes back on its own once the server does.",
+    "This tab is on a server that is not running right now. It comes back on its own once the server does.",
   "session.error.serverConnection": "Can't connect to this server",
   "session.review.filesChanged": "Files Changed {{count}}",
   "session.review.change.one": "Change",
diff --git a/packages/app/src/i18n/es.ts b/packages/app/src/i18n/es.ts
index 036f56c788..e821374099 100644
--- a/packages/app/src/i18n/es.ts
+++ b/packages/app/src/i18n/es.ts
@@ -704,7 +704,7 @@ export const dict = {
   "session.error.notFound.closeTab": "Cerrar pestaña",
   "session.error.disconnected": "Esperando a este servidor",
   "session.error.disconnected.description":
-    "Esta sesión está en un servidor que no está en ejecución ahora mismo. Vuelve por sí sola cuando el servidor lo haga.",
+    "Esta pestaña está en un servidor que no está en ejecución ahora mismo. Vuelve por sí sola cuando el servidor lo haga.",
   "session.error.serverConnection": "No se puede conectar a este servidor",
   "session.review.filesChanged": "{{count}} Archivos Cambiados",
   "session.review.change.one": "Cambio",
diff --git a/packages/app/src/sandbox/server-away.tsx b/packages/app/src/sandbox/server-away.tsx
index 23fe4072ae..78ae38c4e8 100644
--- a/packages/app/src/sandbox/server-away.tsx
+++ b/packages/app/src/sandbox/server-away.tsx
@@ -1,19 +1,25 @@
+import { LoaderV2 } from "@opencode-ai/ui/v2/loader-v2"
 import { useLanguage } from "@/context/language"
 
 // Stands in for a server-scoped route whose server exists but is not connected
-// right now — a sandbox restarting to apply a new mounted folder is gone for a
+// right now — a sandbox restarting to apply a mounted folder is gone for a
 // second or two, and its tabs stay open across that gap (context/tabs.tsx).
 //
-// The alternative is what the route did before: mount its providers with no
-// connection, which sends the session's requests to whichever server is
-// selected instead, and answers "this session cannot be found" about a session
-// that is fine. This says what is actually happening, and the route swaps back
-// to the real thing on its own the moment the server answers again.
+// The alternative is what the routes did before: mount their providers with no
+// connection, which sends the tab's requests to whichever server is selected
+// instead — answering "this session cannot be found" about a session that is
+// fine, or handing a sandbox draft the local machine's composer. This says what
+// is actually happening, and the route swaps back to the real thing on its own
+// the moment the server answers again.
+//
+// The spinner is the point: this state always ends by itself, so it should read
+// as waiting rather than as something the user has to act on.
 export function ServerAway(props: { name: string }) {
   const language = useLanguage()
   return (
     <div class="flex-1 min-h-0 overflow-hidden">
       <div class="h-full px-6 pb-42 flex flex-col items-center justify-center text-center gap-2">
+        <LoaderV2 class="mb-1 text-v2-icon-icon-muted" width={20} height={20} />
         <div class="text-16-medium text-text max-w-md">{language.t("session.error.disconnected")}</div>
         <div class="text-13-regular text-text-weak max-w-md">
           {language.t("session.error.disconnected.description")}

From c1c010862720f080a42c033821601dfa69018f74 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 15:15:12 +0700
Subject: [PATCH 3/7] fix(app): hold the Work sidebar and tab strip still while
 a sandbox restarts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The waiting screen fixed the main pane, but the rest of the window still
treated a restarting sandbox as one that had gone. Two more places:

home-model's "keep the selection on a server that still exists" effect
moved it to the local server, and every focused* memo falls back to the
current server anyway — so the Work sidebar showed the local machine's
projects, pinned and recents for the second or two the sandbox was away,
then switched back. A retained server now holds the selection, and the
sections render empty instead of someone else's sessions: the Projects
area already says the sandbox is not running yet, and an empty list beside
that reads as waiting. `projects`, `recentlyClosed` and `indexedSessions`
answer before their fallbacks rather than through them, because each falls
back to the current server by a different route.

useWorkspaceScope lost its sandbox with the connection, so the tab strip
widened from one folder to every folder of the sandbox and then narrowed
again. The scope memo keeps its previous value while the server it names
is retained.

Verified in the app across a stop/start with Work selected: the strip
holds at three tabs (it went to six), pinned and recents stay empty (they
listed the local machine's sessions), and Code is unchanged -- its own
pinned and recents still populate.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                          |  6 +++-
 DIVERGENCES.md                        |  2 +-
 packages/app/src/pages/home-model.tsx | 49 +++++++++++++++++++++------
 packages/app/src/workspace/tabs.tsx   | 11 ++++--
 4 files changed, 54 insertions(+), 14 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9937a31d74..f36718a6b5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,7 +32,11 @@ file is the human-readable summary of what changed and why.
   the sidebar said Work, the screen was Code, and sending the prompt would have
   run it on your own machine. Those tabs now wait, with a spinner, and come back
   on their own once the sandbox does — the same screen open sessions already
-  showed.
+  showed. The sidebar went the same way: **Pinned** and **Recents** switched to
+  the local machine's sessions for those seconds and then switched back, and the
+  tab strip briefly widened to every folder of the sandbox. Both now hold still
+  — the sections stay empty beside "Your sandbox is not running yet", and the
+  strip keeps the folder you were in.
 - **Deleting a sandbox now looks destructive** — **Delete** in a sandbox's menu
   (Settings → Servers) sat in the same colour as Reset and Mount project. It is
   now red, matching ordinary and WSL servers.
diff --git a/DIVERGENCES.md b/DIVERGENCES.md
index 03ae0a35c9..a753805352 100644
--- a/DIVERGENCES.md
+++ b/DIVERGENCES.md
@@ -221,7 +221,7 @@ from the squash message first, or use a plain merge.
 
 | `packages/app/src/pages/layout/project-avatar-state.ts` | Both `ensureServerState` lookups are gated on `connection()`: `unread` before `notification.ensureServerState`, and the `permissionState` memo before `permission.ensureServerState` (which also moves below `connection`, and its consumer in `hasPermissions` handles the undefined state). Matches the guard `hasPermissions`/`hasQuestions`/`loading` already apply to `sync()`. | `ensureServerState` throws on a key absent from the connection list, and the throw propagates out of a render-time memo, killing the whole renderer. Sidecar connections are listed only while healthy — `readySandboxConnections`/`readyWslConnections` publish a sandbox or WSL server only in the `ready` state — so any removal, restart, or crash of one drops its key while its session tabs are still mounted. Reproduced by removing a sandbox that had an open session tab: `Error: Notification server not found: sandbox:<name>`. The permission lookup is the sharper of the two because `createMemo` computes eagerly: for a tab mounted after its server disappeared it throws during construction, before any downstream guard runs — `Error: Permission server not found: sandbox:<name>`, reproduced by deleting a sandbox from Settings while the Work side was open. | Keep the guard; take upstream's other changes to the hook. This is an upstream bug (WSL servers hit the identical path), so if upstream fixes it their way, drop ours in favour of theirs. |
 | `packages/app/src/components/titlebar.tsx` | The effect that opens a tab for the session the route points at now skips servers that are not in `global.servers.list()`. | The tab store prunes tabs whose server left the list (`context/tabs.tsx`), and this effect adds one back for whatever the route names — so a route pointing at a server that is momentarily absent puts the two in a loop: prune, re-add, prune, at about a thousand rounds a second. The renderer never yields, so it also never processes the IPC event that would bring the server back, and the window stays wedged until it is killed. Sidecar connections are published only while healthy (`readySandboxConnections`/`readyWslConnections`), so any restart drops one: reproduced by adding a folder to a sandbox while one of its sessions was open, which restarts the guest to apply the mount. The route is deliberately left alone — the tab returns on its own when the server comes back. This is an upstream bug (WSL servers hit the identical path). | Keep the guard; take upstream's other changes to the effect. If upstream fixes it their way, drop ours in favour of theirs. Do not "simplify" the guard away — an unguarded add against the pruner is the hang. |
-| Tabs that outlive a sandbox restart: `packages/app/src/context/{server,tabs}.tsx`, `packages/app/src/app.tsx`, `packages/app/src/i18n/{en,es}.ts`, `packages/desktop/src/renderer/index.tsx` | `server.tsx` takes a `retainedServers` prop and exposes it as `retained` — servers that exist but are not connected; `tabs.tsx` reconciles both of its prune effects (open tabs and the closed-tab stack) against `list` **plus** `retained` through a shared `knownServers()`; `app.tsx` threads `retainedServers` from `AppInterface` into `ServerProvider`, and **both** server-scoped routes — `TargetServerRoute` and `ResolvedDraftRoute` — render the fork-only `packages/app/src/sandbox/server-away.tsx` (a `LoaderV2` over the copy, since the state always ends by itself) instead of mounting their providers when the route's server is retained but absent; i18n gains `session.error.disconnected{,.description}`, worded around "this tab" rather than "this session" because the draft route shares the screen; `renderer/index.tsx` passes `retainedSandboxServers(...)` (fork-only, in `renderer/sandbox/connections.ts`) — every sandbox that exists, whatever its runtime state. | A sandbox is published as a connection only while it is ready, so applying a mount — which restarts the guest — takes it out of `server.list` for a second or two. The tab pruner read that as "this server is gone" and deleted every tab belonging to it, discarding each tab's memory: the typed prompt, terminal and scroll state. Retention draws the line where the user does — the sandbox still exists, so its tabs do — and explicit removal is unaffected because `dialog-select-server` already calls `tabs.removeServer(key)` and the sandbox then leaves `retained` as well. The route guard is the other half: a retained server has no connection, and mounting `ServerSDKProvider`/`ServerSyncProvider` with `undefined` sends the session's requests to whichever server is selected instead, which answered "this session cannot be found" about a healthy session and bounced the route home through a burst of ~250 navigations. WSL servers are deliberately not retained — same latent problem, but the WSL vertical has no equivalent restart in normal use. | Keep all five edits together — retention without the route guards just moves the confusing state, and the guards without retention are unreachable. Both routes need the guard: they are the two places a tab can point at a server, and the draft one is worse without it — a draft resolves to whichever server is selected, so the prompt would be sent to the local machine rather than the sandbox the tab belongs to. Take upstream's other changes to these files. `retained` must stay a superset relationship with `list` (a server can be in both mid-transition); if upstream reworks the pruner, re-apply the union. The web build passes no `retainedServers`, so `retained` is empty there and every one of these paths collapses to upstream behaviour. |
+| Tabs that outlive a sandbox restart: `packages/app/src/context/{server,tabs}.tsx`, `packages/app/src/app.tsx`, `packages/app/src/i18n/{en,es}.ts`, `packages/desktop/src/renderer/index.tsx` | `server.tsx` takes a `retainedServers` prop and exposes it as `retained` — servers that exist but are not connected; `tabs.tsx` reconciles both of its prune effects (open tabs and the closed-tab stack) against `list` **plus** `retained` through a shared `knownServers()`; `app.tsx` threads `retainedServers` from `AppInterface` into `ServerProvider`, and **both** server-scoped routes — `TargetServerRoute` and `ResolvedDraftRoute` — render the fork-only `packages/app/src/sandbox/server-away.tsx` (a `LoaderV2` over the copy, since the state always ends by itself) instead of mounting their providers when the route's server is retained but absent; i18n gains `session.error.disconnected{,.description}`, worded around "this tab" rather than "this session" because the draft route shares the screen; `retained` is read by three fork-only consumers besides the routes — `pages/home-model.tsx` keeps the sidebar's selection on an away server and renders its projects/pinned/recents empty rather than the current server's, and `workspace/tabs.tsx` keeps the tab strip's folder scope — so a restart no longer swaps the sidebar to the local machine and back; `renderer/index.tsx` passes `retainedSandboxServers(...)` (fork-only, in `renderer/sandbox/connections.ts`) — every sandbox that exists, whatever its runtime state. | A sandbox is published as a connection only while it is ready, so applying a mount — which restarts the guest — takes it out of `server.list` for a second or two. The tab pruner read that as "this server is gone" and deleted every tab belonging to it, discarding each tab's memory: the typed prompt, terminal and scroll state. Retention draws the line where the user does — the sandbox still exists, so its tabs do — and explicit removal is unaffected because `dialog-select-server` already calls `tabs.removeServer(key)` and the sandbox then leaves `retained` as well. The route guard is the other half: a retained server has no connection, and mounting `ServerSDKProvider`/`ServerSyncProvider` with `undefined` sends the session's requests to whichever server is selected instead, which answered "this session cannot be found" about a healthy session and bounced the route home through a burst of ~250 navigations. WSL servers are deliberately not retained — same latent problem, but the WSL vertical has no equivalent restart in normal use. | Keep all five edits together — retention without the route guards just moves the confusing state, and the guards without retention are unreachable. Both routes need the guard: they are the two places a tab can point at a server, and the draft one is worse without it — a draft resolves to whichever server is selected, so the prompt would be sent to the local machine rather than the sandbox the tab belongs to. Take upstream's other changes to these files. `retained` must stay a superset relationship with `list` (a server can be in both mid-transition); if upstream reworks the pruner, re-apply the union. The web build passes no `retainedServers`, so `retained` is empty there and every one of these paths collapses to upstream behaviour. |
 | `script/publish.ts` | The `if (Script.release)` block calling `packages/desktop/scripts/finalize-latest-{json,yml}.ts` removed, replaced by a comment. | Both finalizers existed to assemble update metadata into a GitHub release, which the fork no longer publishes to. electron-builder already writes a correct per-platform `latest*.yml` next to each installer, and the fork builds one arch per platform (macOS is universal — see the universal-builds row), so there is nothing left to merge. | Keep removed. If upstream adds further desktop release steps here, drop them unless they target the bucket. |
 | `packages/desktop/scripts/finalize-latest-json.ts`, `packages/desktop/scripts/finalize-latest-yml.ts` | Deleted. | Both `gh release upload` into a GitHub release the fork does not use. `finalize-latest-yml.ts` merged per-arch `latest*.yml` from an upstream build matrix the fork does not run; `finalize-latest-json.ts` additionally built a Tauri-style `latest.json` signed with `@tauri-apps/cli signer` that nothing in the Electron updater path ever reads, and had gone stale besides — it hardcoded `opencode-desktop-mac-{x64,arm64}.app.tar.gz`, an artifact name and format this fork never produces. Leaving them in place is a trap: they look like the release path and upload to the wrong place. | Keep deleted (`git rm` the upstream side of modify/delete conflicts). If a future build matrix produces two `latest.yml` files for one platform (Windows x64 + arm64), write a bucket-targeted merge step rather than restoring these. |
 | `packages/desktop/src/renderer/index.tsx` | Desktop notification icon `https://opencode.ai/favicon-96x96-v3.png` → the relative `./favicon-96x96-v3.png`. The renderer's `publicDir` is `packages/app/public`, whose `favicon-96x96-v3.png` symlinks to the rebranded `packages/ui/src/assets/favicon/` mark, so the file is emitted next to `index.html` and resolves against the renderer origin (`oc://renderer/` packaged, the vite dev server otherwise) — the same asset and the same relative form `src/renderer/index.html` already uses for `<link rel="icon">`. | A desktop app should not reach out to a remote host to draw its own notification icon (it fails offline and leaks a request per notification), and the remote file is upstream-branded while the bundled one is the codev mark. | Keep our relative path. If upstream changes the URL, re-point it at the bundled asset rather than taking a new remote host. `packages/app/src/entry.tsx` and `pages/layout/helpers.ts` keep their remote `opencode.ai/favicon*` sources — same bug class, not yet fixed. |
diff --git a/packages/app/src/pages/home-model.tsx b/packages/app/src/pages/home-model.tsx
index 247d0d68ab..2feba0c118 100644
--- a/packages/app/src/pages/home-model.tsx
+++ b/packages/app/src/pages/home-model.tsx
@@ -113,9 +113,22 @@ export function createHomeModel() {
 
   const selection = layout.home.selection
 
-  const focusedServer = createMemo(
-    () => global.servers.list().find((conn) => ServerConnection.key(conn) === selection().server) ?? server.current,
+  // Fork: the selected server exists but is not connected — a sandbox
+  // restarting to apply a mounted folder. Every fallback below then resolves to
+  // the current server instead, which put the local machine's projects, pinned
+  // and recents under a Work sidebar for the second or two it takes to come
+  // back. Nothing is a better answer than someone else's sessions: the Projects
+  // area already says the sandbox is not running yet, and the sections read
+  // empty beside it.
+  const focusedAway = createMemo(
+    () =>
+      !global.servers.list().some((conn) => ServerConnection.key(conn) === selection().server) &&
+      server.retained.includes(selection().server),
   )
+  const focusedServer = createMemo(() => {
+    if (focusedAway()) return undefined
+    return global.servers.list().find((conn) => ServerConnection.key(conn) === selection().server) ?? server.current
+  })
   const focusedServerCtx = createMemo(() => {
     const conn = focusedServer()
     if (!conn) return
@@ -123,9 +136,13 @@ export function createHomeModel() {
   })
   const focusedSync = () => focusedServerCtx()?.sync ?? sync()
   const homeSessions = () => focusedSync().homeSessions
-  const projects = createMemo(() => focusedServerCtx()?.projects.list() ?? layout.projects.list())
-  const recentlyClosed = createMemo(
-    () => focusedServerCtx()?.projects.recentlyClosed() ?? layout.projects.recentlyClosed(),
+  // `layout.projects` is the *current* server's, so the away case has to answer
+  // before the fallback rather than through it.
+  const projects = createMemo(() =>
+    focusedAway() ? [] : (focusedServerCtx()?.projects.list() ?? layout.projects.list()),
+  )
+  const recentlyClosed = createMemo(() =>
+    focusedAway() ? [] : (focusedServerCtx()?.projects.recentlyClosed() ?? layout.projects.recentlyClosed()),
   )
   const homedir = createMemo(() => focusedSync().data.path.home ?? "")
   // Per session, not a memo over the server config: `share` only appears on the
@@ -183,12 +200,17 @@ export function createHomeModel() {
   const projectByID = createMemo(
     () => new Map(projects().flatMap((project) => (project.id ? [[project.id, project] as const] : []))),
   )
+  // Away, `homeSessions()` is the current server's cache and its query is
+  // disabled, so this would hand the sidebar that server's sessions — the same
+  // leak `projects` guards against, one layer down.
   const indexedSessions = createMemo(() =>
-    retainHomeSessions(
-      homeSessions().sessions(sessionLoad.data, sessionEventLoad.data),
-      HOME_SESSION_LIMIT,
-      Date.now(),
-    ),
+    focusedAway()
+      ? []
+      : retainHomeSessions(
+          homeSessions().sessions(sessionLoad.data, sessionEventLoad.data),
+          HOME_SESSION_LIMIT,
+          Date.now(),
+        ),
   )
   const allRecords = createMemo(() =>
     buildHomeSessionRecords({
@@ -217,9 +239,16 @@ export function createHomeModel() {
 
   // Keeps the selection pointing at a server that still exists. Idempotent, so
   // it is safe with both the sidebar and the home screen holding a model.
+  //
+  // Fork: existing, not connected. A sandbox restarting to apply a mount is
+  // absent from the list for a second or two, and moving the selection off it
+  // sent the sidebar to the local server — then back again, which is a jump the
+  // user did not ask for either way. Retained servers hold their selection and
+  // the sections render empty until they answer again.
   createEffect(() => {
     const list = global.servers.list()
     if (list.some((conn) => ServerConnection.key(conn) === selection().server)) return
+    if (server.retained.includes(selection().server)) return
     const conn = list.find((conn) => ServerConnection.key(conn) === server.key) ?? list[0]
     if (conn) setSelection({ server: ServerConnection.key(conn) })
   })
diff --git a/packages/app/src/workspace/tabs.tsx b/packages/app/src/workspace/tabs.tsx
index 35f21f2cf4..8c03a5e785 100644
--- a/packages/app/src/workspace/tabs.tsx
+++ b/packages/app/src/workspace/tabs.tsx
@@ -4,7 +4,7 @@ import { useNavigate } from "@solidjs/router"
 import { useGlobal } from "@/context/global"
 import { useLanguage } from "@/context/language"
 import { useLayout } from "@/context/layout"
-import { ServerConnection } from "@/context/server"
+import { ServerConnection, useServer } from "@/context/server"
 import { useTabs } from "@/context/tabs"
 import { findOpenDraft } from "@/pages/home-draft-reuse"
 import { isLocalSessionNotFoundError, isSessionNotFoundError } from "@/utils/server-errors"
@@ -148,6 +148,7 @@ export function useWorkspaceFolder() {
 export function useWorkspaceScope(routeDirectory: () => string | undefined): Accessor<TabScope> {
   const layout = useLayout()
   const global = useGlobal()
+  const server = useServer()
   const side = useWorkspaceSide()
 
   const sandbox = createMemo(() => {
@@ -158,8 +159,14 @@ export function useWorkspaceScope(routeDirectory: () => string | undefined): Acc
     return { key: ServerConnection.key(conn), ctx: global.ensureServerCtx(conn) }
   })
 
-  const scope = createMemo<TabScope>(() => {
+  const scope = createMemo<TabScope>((previous) => {
     const current = sandbox()
+    // A sandbox that is merely away — restarting to apply a mounted folder —
+    // keeps the scope it had. Its folder list lives on the connection, which is
+    // gone for those seconds, and falling through would widen the strip to
+    // every folder of the sandbox and then narrow it again: a reshuffle in the
+    // middle of an operation the user is waiting on.
+    if (!current && previous?.type === "folder" && server.retained.includes(previous.server)) return previous
     // No sandbox selected yet — one is still starting, or the last was removed.
     // Falling back to the side keeps today's behaviour for a state the sidebar
     // already reports through WorkspaceEmpty.

From 016ba8acbbf3d1eaa3bfd4e0e96a1ae10b76d82c Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 15:34:58 +0700
Subject: [PATCH 4/7] fix(app): centre the waiting screen in its pane

The block inherited `pb-42` from the session-not-found screen it was
modelled on. That padding is there to clear the composer underneath, but
this screen replaces the whole route and has nothing below it, so the
offset only pushed the block above the middle -- about 80px on a full
window.

Measured after: content centre and pane centre are the same pixel.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/app/src/sandbox/server-away.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/app/src/sandbox/server-away.tsx b/packages/app/src/sandbox/server-away.tsx
index 78ae38c4e8..2f884a3a7e 100644
--- a/packages/app/src/sandbox/server-away.tsx
+++ b/packages/app/src/sandbox/server-away.tsx
@@ -18,7 +18,11 @@ export function ServerAway(props: { name: string }) {
   const language = useLanguage()
   return (
     <div class="flex-1 min-h-0 overflow-hidden">
-      <div class="h-full px-6 pb-42 flex flex-col items-center justify-center text-center gap-2">
+      {/* No bottom padding, unlike the session-not-found screen it is modelled
+          on: that one sits above a composer and has to clear it, while this
+          replaces the whole route, so the offset only pushed the block off
+          centre. */}
+      <div class="h-full px-6 flex flex-col items-center justify-center text-center gap-2">
         <LoaderV2 class="mb-1 text-v2-icon-icon-muted" width={20} height={20} />
         <div class="text-16-medium text-text max-w-md">{language.t("session.error.disconnected")}</div>
         <div class="text-13-regular text-text-weak max-w-md">

From 41104ce6d4557b8fd9399bfe16274f3214c727f7 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 15:38:10 +0700
Subject: [PATCH 5/7] fix(app): drop the server key from the waiting screen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The faint third line was the routing key (`sandbox:<name>`), not a name
anyone chose: the connection that would carry a display name is exactly
what is missing while the server is away, so there was nothing to resolve
it against. An internal id shown to someone waiting a second or two is
noise, and the tab they are looking at already says which server it is.

The prop goes with it — both call sites passed the key only for this.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/app/src/app.tsx                 | 4 ++--
 packages/app/src/sandbox/server-away.tsx | 9 +++++++--
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/packages/app/src/app.tsx b/packages/app/src/app.tsx
index 86dac443bd..6e92ac6183 100644
--- a/packages/app/src/app.tsx
+++ b/packages/app/src/app.tsx
@@ -138,7 +138,7 @@ function TargetServerRoute(props: ParentProps) {
         // reachable, and mounting the providers with no connection would send
         // this session's requests to whatever server is selected instead. Wait
         // for it: the route swaps back the moment it is connected again.
-        <Show when={conn() || !server.retained.includes(current)} fallback={<ServerAway name={current} />}>
+        <Show when={conn() || !server.retained.includes(current)} fallback={<ServerAway />}>
           <ServerSDKProvider server={conn}>
             <ServerSyncProvider server={conn}>{props.children}</ServerSyncProvider>
           </ServerSDKProvider>
@@ -248,7 +248,7 @@ function ResolvedDraftRoute(props: { draft: DraftTab }) {
           new-session screen, and sending the prompt would have run it there. */}
       <Show
         when={conn() || !server.retained.includes(props.draft.server)}
-        fallback={<ServerAway name={props.draft.server} />}
+        fallback={<ServerAway />}
       >
         <ServerSDKProvider server={conn}>
           <ServerSyncProvider server={conn}>
diff --git a/packages/app/src/sandbox/server-away.tsx b/packages/app/src/sandbox/server-away.tsx
index 2f884a3a7e..b95c3be74b 100644
--- a/packages/app/src/sandbox/server-away.tsx
+++ b/packages/app/src/sandbox/server-away.tsx
@@ -14,7 +14,13 @@ import { useLanguage } from "@/context/language"
 //
 // The spinner is the point: this state always ends by itself, so it should read
 // as waiting rather than as something the user has to act on.
-export function ServerAway(props: { name: string }) {
+//
+// Deliberately says nothing about *which* server. The only name available here
+// is the routing key (`sandbox:<name>`) — the connection that would carry a
+// display name is exactly what is missing — and printing an internal id at
+// someone waiting a second or two is noise. The tab they are looking at already
+// says which one it is.
+export function ServerAway() {
   const language = useLanguage()
   return (
     <div class="flex-1 min-h-0 overflow-hidden">
@@ -28,7 +34,6 @@ export function ServerAway(props: { name: string }) {
         <div class="text-13-regular text-text-weak max-w-md">
           {language.t("session.error.disconnected.description")}
         </div>
-        <div class="max-w-full text-11-regular text-text-faint break-all">{props.name}</div>
       </div>
     </div>
   )

From 6f4217c0af8768dc2019c81966f4167c66adce84 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 15:51:58 +0700
Subject: [PATCH 6/7] fix(app): centre the waiting screen across the pane, not
 just down it

The block was centred vertically but sat hard against the sidebar. The
shell's <main> is `flex flex-col items-start`, so a child that does not
claim the width shrinks to its content -- 496px here, the description's
max-w-md plus padding -- and centres inside that instead of the pane. The
session page claims the width the same way; this one did not.

Measured after: content centre and pane centre are the same pixel on both
axes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 packages/app/src/sandbox/server-away.tsx | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/packages/app/src/sandbox/server-away.tsx b/packages/app/src/sandbox/server-away.tsx
index b95c3be74b..edef192271 100644
--- a/packages/app/src/sandbox/server-away.tsx
+++ b/packages/app/src/sandbox/server-away.tsx
@@ -22,8 +22,12 @@ import { useLanguage } from "@/context/language"
 // says which one it is.
 export function ServerAway() {
   const language = useLanguage()
+  // `w-full` because the shell's <main> is `flex flex-col items-start`: a child
+  // that does not claim the width shrinks to its content and sits against the
+  // sidebar, which centred this block inside its own 496px instead of in the
+  // pane. The session page claims the width the same way.
   return (
-    <div class="flex-1 min-h-0 overflow-hidden">
+    <div class="w-full flex-1 min-h-0 overflow-hidden">
       {/* No bottom padding, unlike the session-not-found screen it is modelled
           on: that one sits above a composer and has to clear it, while this
           replaces the whole route, so the offset only pushed the block off

From bb846ca0eb7779279d5e3e6c2ad6cffdb6be6ee5 Mon Sep 17 00:00:00 2001
From: minhn4 <nguyenm.cuny@gmail.com>
Date: Mon, 17 Aug 2026 18:21:10 +0700
Subject: [PATCH 7/7] fix(app): keep Code's sessions off the Work side before
 its sandbox is ready

The retained-server guard covered a sandbox that is restarting, but not a
sandbox that does not exist yet: addSandbox puts it in the controller's
state only after create resolves, so while one is being created the Work
side has no server at all and the selection is still whatever Code left
behind. Every focused* fallback then resolved to the current server and
the sidebar filled with the local machine's projects, pinned and recents.

The guard is now "nothing the selected server owns can be on screen",
which covers both: the selection belongs to the side that is not showing,
or it is on this side and away.

The main area had the same gap from the other end. enter() returns early
when the side has no connected server, which left the previous side's
session on screen -- composer and all -- under a sidebar that had already
switched. It navigates home instead, the destination the no-project branch
below it already used.

Verified in the app: on Work with its sandbox down and the selection on a
Code project, the sidebar shows the "not running" message with Pinned and
Recents empty, and the pane shows the home screen's "Nothing here yet"
rather than the Code session. Code is unchanged, and Work's own content
comes back when the sandbox does.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                          |  8 +++++
 packages/app/src/pages/home-model.tsx | 51 ++++++++++++++++-----------
 packages/app/src/workspace/tabs.tsx   | 10 +++++-
 3 files changed, 47 insertions(+), 22 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f36718a6b5..ba5efad922 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,14 @@ file is the human-readable summary of what changed and why.
   its life, so its menu offers neither; deleting the sandbox is still the way
   to be rid of that one. On macOS and Linux unmounting restarts the sandbox, as
   it does from the Folders… dialog. **Code** keeps Close, unchanged.
+- **Work stops borrowing Code's sessions before its sandbox is ready** — while
+  a sandbox is being created or started, the **Work** side has no server of its
+  own, and the sidebar filled **Pinned** and **Recents** with the local
+  machine's sessions while the main area kept whatever Code session was open,
+  composer and all. Both belonged to the side you had just left. The sections
+  now stay empty next to the message explaining the sandbox is not ready, and
+  switching to a side with nothing connected lands on its home screen instead
+  of the other side's session.
 - **A restarting sandbox no longer shows you the wrong machine** — mounting or
   unmounting a folder restarts the sandbox, and while it was away a **New
   session** tab belonging to it quietly rendered the local machine's composer:
diff --git a/packages/app/src/pages/home-model.tsx b/packages/app/src/pages/home-model.tsx
index 2feba0c118..8dfaecf33b 100644
--- a/packages/app/src/pages/home-model.tsx
+++ b/packages/app/src/pages/home-model.tsx
@@ -31,7 +31,7 @@ import { notifySessionTabsRemoved } from "@/components/titlebar-session-events"
 import { pathKey } from "@/utils/path-key"
 import { showToast } from "@/utils/toast"
 import { sideForServerKey } from "@/workspace/side"
-import { useWorkspaceFolder } from "@/workspace/tabs"
+import { useWorkspaceFolder, useWorkspaceSide } from "@/workspace/tabs"
 import { archiveHomeSession } from "./home-session-archive"
 import { findOpenDraft } from "./home-draft-reuse"
 import { shouldOpenSessionInBackground } from "./home-session-open"
@@ -110,23 +110,32 @@ export function createHomeModel() {
   const pickDirectory = useDirectoryPicker()
   const pinned = usePinnedSessions()
   const folder = useWorkspaceFolder()
+  const side = useWorkspaceSide()
 
   const selection = layout.home.selection
 
-  // Fork: the selected server exists but is not connected — a sandbox
-  // restarting to apply a mounted folder. Every fallback below then resolves to
-  // the current server instead, which put the local machine's projects, pinned
-  // and recents under a Work sidebar for the second or two it takes to come
-  // back. Nothing is a better answer than someone else's sessions: the Projects
-  // area already says the sandbox is not running yet, and the sections read
-  // empty beside it.
-  const focusedAway = createMemo(
-    () =>
+  // Fork: nothing the selected server owns can be on screen. Two ways to get
+  // there, and both used to fall through to the *current* server, which put the
+  // local machine's projects, pinned and recents under a Work sidebar:
+  //
+  //  - the selection belongs to the side that is not showing. Work has no
+  //    server of its own until its first sandbox is ready, so the selection is
+  //    still whatever Code left behind while one is being created or started;
+  //  - it is on this side and exists, but is not connected — a sandbox
+  //    restarting to apply a mounted folder is gone for a second or two.
+  //
+  // Nothing is a better answer than someone else's sessions: the Projects area
+  // already says the sandbox is not ready, and the sections read empty beside
+  // it. Both collapse to false on the web build, where every server is Code.
+  const focusedUnavailable = createMemo(() => {
+    if (sideForServerKey(selection().server) !== side()) return true
+    return (
       !global.servers.list().some((conn) => ServerConnection.key(conn) === selection().server) &&
-      server.retained.includes(selection().server),
-  )
+      server.retained.includes(selection().server)
+    )
+  })
   const focusedServer = createMemo(() => {
-    if (focusedAway()) return undefined
+    if (focusedUnavailable()) return undefined
     return global.servers.list().find((conn) => ServerConnection.key(conn) === selection().server) ?? server.current
   })
   const focusedServerCtx = createMemo(() => {
@@ -136,13 +145,13 @@ export function createHomeModel() {
   })
   const focusedSync = () => focusedServerCtx()?.sync ?? sync()
   const homeSessions = () => focusedSync().homeSessions
-  // `layout.projects` is the *current* server's, so the away case has to answer
-  // before the fallback rather than through it.
+  // `layout.projects` is the *current* server's, so the unavailable case has to
+  // answer before the fallback rather than through it.
   const projects = createMemo(() =>
-    focusedAway() ? [] : (focusedServerCtx()?.projects.list() ?? layout.projects.list()),
+    focusedUnavailable() ? [] : (focusedServerCtx()?.projects.list() ?? layout.projects.list()),
   )
   const recentlyClosed = createMemo(() =>
-    focusedAway() ? [] : (focusedServerCtx()?.projects.recentlyClosed() ?? layout.projects.recentlyClosed()),
+    focusedUnavailable() ? [] : (focusedServerCtx()?.projects.recentlyClosed() ?? layout.projects.recentlyClosed()),
   )
   const homedir = createMemo(() => focusedSync().data.path.home ?? "")
   // Per session, not a memo over the server config: `share` only appears on the
@@ -200,11 +209,11 @@ export function createHomeModel() {
   const projectByID = createMemo(
     () => new Map(projects().flatMap((project) => (project.id ? [[project.id, project] as const] : []))),
   )
-  // Away, `homeSessions()` is the current server's cache and its query is
-  // disabled, so this would hand the sidebar that server's sessions — the same
-  // leak `projects` guards against, one layer down.
+  // Unavailable, `homeSessions()` is the current server's cache and its query
+  // is disabled, so this would hand the sidebar that server's sessions — the
+  // same leak `projects` guards against, one layer down.
   const indexedSessions = createMemo(() =>
-    focusedAway()
+    focusedUnavailable()
       ? []
       : retainHomeSessions(
           homeSessions().sessions(sessionLoad.data, sessionEventLoad.data),
diff --git a/packages/app/src/workspace/tabs.tsx b/packages/app/src/workspace/tabs.tsx
index 8c03a5e785..ebad254b80 100644
--- a/packages/app/src/workspace/tabs.tsx
+++ b/packages/app/src/workspace/tabs.tsx
@@ -215,7 +215,15 @@ export function useWorkspaceSwitch() {
   const enter = async (side: WorkspaceSide) => {
     layout.home.setWorkspace(side)
     const target = selectionForSide(global.servers.list(), side, layout.home.selection().server)
-    if (!target) return
+    // Nothing on this side is connected yet — Work while its first sandbox is
+    // still being created or started. Leaving the route alone kept the other
+    // side's session on screen, composer and all, under a sidebar that had
+    // switched: the home screen is the honest destination, the same one the
+    // no-project branch below settles on.
+    if (!target) {
+      navigate("/")
+      return
+    }
     const server = ServerConnection.key(target)
     if (layout.home.selection().server !== server) layout.home.setSelection({ server })