Add side-by-side chat sessions (Amicode: New Chat)

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}

packages/amico-run/src/agent_spawn.ts

@@ -31,8 +31,12 @@ import type { Finding } from "./lenses.js";
 
 export const DEFAULT_CRITIC_MODEL = "anthropic/claude-opus-5";
 export const DEFAULT_CRITIC_VARIANT = "high";
-/** Per-child ceiling (§3.7). A critic that has not answered in two minutes has failed. */
-export const CRITIC_TIMEOUT_MS = 120_000;
+/** Per-child ceiling (§3.7). A critic that has not answered in four minutes has failed.
+ * 240s, not 120s: a frontier-class review of a full spec on a free-tier model takes
+ * ~3 minutes measured (178s for a 13k-token decomposition pass, 2026-07-31) — the
+ * two-minute ceiling read legitimate slow answers as failures and silently degraded
+ * every review to approved-mechanical/degraded. */
+export const CRITIC_TIMEOUT_MS = 240_000;
 
 /** Why a lens has no findings, which is NOT the same question as whether it ran.
  *
@@ -99,6 +103,13 @@ export function resolveAgentBin(env: NodeJS.ProcessEnv = process.env): string |
  * already authenticated against. */
 const ENV_ALLOWLIST = ["HOME", "PATH", "TMPDIR", "SHELL", "LANG", "LC_ALL", "TERM"];
 const ENV_ALLOW_PREFIXES = ["XDG_", "OPENCODE_"];
+/** Live-session pointers: when amico runs INSIDE a live Amicode session, these
+ * ride the OPENCODE_ prefix allowance into the child, and the child's headless
+ * `run` tries to resolve the PARENT's session — failing with "Session not
+ * found" before the critic ever starts. The child spawns its own runtime; the
+ * parent's session pointers are never valid for it. Config vars
+ * (OPENCODE_CONFIG_CONTENT/DIR) stay — those are the legitimate prefix users. */
+const ENV_DENYLIST = new Set(["OPENCODE", "OPENCODE_PID", "OPENCODE_SERVER_PASSWORD"]);
 
 export function buildChildEnv(
  parent: NodeJS.ProcessEnv = process.env,
@@ -107,6 +118,7 @@ export function buildChildEnv(
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(parent)) {
  if (v === undefined) continue;
+ if (ENV_DENYLIST.has(k)) continue;
  if (ENV_ALLOWLIST.includes(k) || ENV_ALLOW_PREFIXES.some((p) => k.startsWith(p))) out[k] = v;
  }
  return { ...out, ...extra };

packages/amico-run/src/plan_compile.ts

@@ -469,8 +469,16 @@ function defaultPlanner(specPath: string, env?: NodeJS.ProcessEnv): ((specText:
  agent: "planner",
  model: criticModel(e),
  env: e,
+ // Plan generation is a bigger output than a critic pass (a full gated
+ // plan JSON, not findings) — measured beyond the 240s critic ceiling on
+ // a free-tier model, so the planner gets its own ceiling (2026-07-31).
+ timeoutMs: PLANNER_TIMEOUT_MS,
  prompt: "Compile the spec in your working directory into a plan. Reply with the JSON object only.",
  specText,
  specFilename: specPath.split("/").pop() ?? "spec.md",
  });
 }
+
+/** Planner-only spawn ceiling: ~2.7× the measured 178s critic pass at the same
+ * tier (2026-07-31). Anything longer is a hung child, not a slow answer. */
+export const PLANNER_TIMEOUT_MS = 480_000;

packages/amico-run/test/agent_spawn.test.ts

@@ -348,4 +348,17 @@ describe("buildChildEnv", () => {
  it("lets explicit extras through", () => {
  expect(buildChildEnv({ HOME: "/h" }, { OPENCODE_CONFIG_CONTENT: "{}" }).OPENCODE_CONFIG_CONTENT).toBe("{}");
  });
+ it("strips live-session pointers even though they carry the OPENCODE_ prefix", () => {
+ // Regression: spawned from inside a live Amicode session, these vars made
+ // the child's headless `run` resolve the PARENT's session → "Session not
+ // found", killing every critic before it started. Config vars must stay.
+ const env = buildChildEnv({
+ HOME: "/h",
+ OPENCODE: "1",
+ OPENCODE_PID: "3434",
+ OPENCODE_SERVER_PASSWORD: "live-pw",
+ OPENCODE_CONFIG_CONTENT: "{}",
+ });
+ expect(env).toEqual({ HOME: "/h", OPENCODE_CONFIG_CONTENT: "{}" });
+ });
 });

packages/extension/esbuild.config.mjs

@@ -86,6 +86,18 @@ const targets = [
  logLevel: "info",
  loader: { ".svg": "text" },
  },
+ // Chat Deck webview bundle — pane-manager shell (src/deck/shell.ts + model)
+ {
+ entryPoints: ["src/deck/shell.ts"],
+ bundle: true,
+ platform: "browser",
+ target: "es2022",
+ format: "iife",
+ outfile: "dist/deck_shell.js",
+ sourcemap: true,
+ minify: false,
+ logLevel: "info",
+ },
 ];
 
 if (watch) {

packages/extension/package.json

@@ -31,6 +31,8 @@
  ],
  "activationEvents": [
  "onCommand:amicode.openChat",
+ "onCommand:amicode.newChat",
+ "onCommand:amicode.chatDeck",
  "onCommand:amicode.openInspector",
  "onView:amicode.runInspector",
  "onView:amicode.deviceInspector",
@@ -92,6 +94,16 @@
  "title": "Amicode: Open Chat",
  "icon": "$(comment-discussion)"
  },
+ {
+ "command": "amicode.newChat",
+ "title": "Amicode: New Chat (Side by Side)",
+ "icon": "$(add)"
+ },
+ {
+ "command": "amicode.chatDeck",
+ "title": "Amicode: Open Chat Deck (Panes in One Tab)",
+ "icon": "$(layout)"
+ },
  {
  "command": "amicode.setupVault",
  "title": "Amicode: Set up a personal vault"

packages/extension/src/chat_bridge.ts

@@ -0,0 +1,138 @@
+import * as vscode from "vscode";
+import * as path from "node:path";
+import * as os from "node:os";
+
+// ============================================================================
+// The amicode iframe⇄extension command bridge, shared by ChatPanel (one
+// iframe) and DeckPanel (N panes). The framed app renders LLM output, so the
+// handler is paranoid by construction: strict command allowlist, https-only
+// externals, visibility-gated clipboard reads, bounded payloads. Panes tag
+// their messages with an opaque `tab` id; replies ECHO it so the shell can
+// route the answer back to the asking pane. Single-iframe panels leave `tab`
+// undefined and their relay simply forwards to the one iframe.
+// ============================================================================
+
+// Commands the in-app palette (opencode "Amico" command group) may trigger via
+// the iframe→parent→extension postMessage bridge. STRICT allowlist: the framed
+// app renders LLM output, so we never executeCommand anything outside this set.
+export const BRIDGE_ALLOWED_COMMANDS: ReadonlySet<string> = new Set([
+ "amicode.restartServer",
+ "amicode.distillNow",
+ "amicode.stopRun",
+ "amicode.savePulse",
+ "amicode.openRunDir",
+ "amicode.openInspector",
+ // ⌘⇧P inside the chat iframe lands in the APP's palette, not VS Code's —
+ // the fork forwards it here so the editor's Command Palette (where every
+ // Amicode: command lives) opens as users expect.
+ "workbench.action.showCommands",
+]);
+
+/** Side channels the handler needs from its host panel. */
+export interface BridgeIo {
+ /** Clipboard reads only answer while the user can see the chat. */
+ visible(): boolean;
+ /** Replies (clipboard text) go back to the host webview; `tab` echoes along. */
+ postToWebview(msg: unknown): void;
+}
+
+const isAmicode = (msg: unknown): msg is { source: "amicode"; kind: string; tab?: string } =>
+ !!msg && typeof msg === "object" && (msg as { source?: unknown }).source === "amicode";
+
+/** Handle one envelope from a framed app. Returns true when the message was
+ * consumed (hosts log the rest). */
+export function handleAmicodeBridgeMessage(msg: unknown, io: BridgeIo): boolean {
+ if (!isAmicode(msg)) return false;
+
+ // target=_blank/window.open are dead inside the framed app — open https
+ // links via the editor (system browser). https-only; scheme is
+ // case-insensitive (RFC 3986).
+ if (
+ msg.kind === "open-external" &&
+ typeof (msg as { url?: unknown }).url === "string" &&
+ /^https:\/\//i.test((msg as unknown as { url: string }).url)
+ ) {
+ void vscode.env.openExternal(vscode.Uri.parse((msg as unknown as { url: string }).url));
+ return true;
+ }
+
+ // Paste bridge: navigator.clipboard is unavailable to the framed app (the
+ // webview parent has no clipboard-read to delegate), so the app asks US —
+ // the extension host reads the OS clipboard and replies. Visibility gate:
+ // the app renders LLM-driven content, so a hidden panel must not be able to
+ // sample the clipboard in the background.
+ if (msg.kind === "clipboard-request") {
+ if (!io.visible()) return true;
+ void vscode.env.clipboard.readText().then((text) =>
+ io.postToWebview({
+ source: "amicode",
+ kind: "clipboard",
+ nonce: (msg as { nonce?: string }).nonce,
+ text,
+ tab: msg.tab,
+ }),
+ );
+ return true;
+ }
+
+ // Copy bridge (mirror of clipboard-request): the framed app's native copy
+ // can't reach the OS clipboard, so an in-chat ⌘C posts the text here and we
+ // write it via vscode.env.clipboard — otherwise the paste bridge above reads
+ // back stale content. Same visibility gate; payload is untrusted, so bound it.
+ if (msg.kind === "clipboard-write" && typeof (msg as { text?: unknown }).text === "string") {
+ if (!io.visible()) return true;
+ const text = (msg as unknown as { text: string }).text;
+ if (text.length > 5_000_000) return true;
+ void vscode.env.clipboard.writeText(text);
+ return true;
+ }
+
+ // Save bridge (run-card PNG export): downloads are dead inside the framed
+ // app — the extension shows a save dialog and writes the file. PNG-only,
+ // basename-only, bounded size: the payload is untrusted.
+ if (
+ msg.kind === "save-file" &&
+ typeof (msg as { filename?: unknown }).filename === "string" &&
+ typeof (msg as { dataUrl?: unknown }).dataUrl === "string"
+ ) {
+ const raw = msg as unknown as { filename: string; dataUrl: string };
+ const prefix = "data:image/png;base64,";
+ const base64 = raw.dataUrl.startsWith(prefix) ? raw.dataUrl.slice(prefix.length) : undefined;
+ const name = path.basename(raw.filename).replace(/[^\w.-]+/g, "-");
+ if (!base64 || base64.length > 24_000_000 || !name.endsWith(".png")) return true;
+ void (async () => {
+ const target = await vscode.window.showSaveDialog({
+ defaultUri: vscode.Uri.file(path.join(os.homedir(), "Downloads", name)),
+ filters: { Images: ["png"] },
+ });
+ if (!target) return;
+ await vscode.workspace.fs.writeFile(target, Buffer.from(base64, "base64"));
+ const pick = await vscode.window.showInformationMessage(`Amicode: saved ${path.basename(target.fsPath)}`, "Reveal");
+ if (pick === "Reveal") await vscode.commands.executeCommand("revealFileInOS", target);
+ })();
+ return true;
+ }
+
+ // The "Amico" palette group — allowlisted commands only.
+ if (msg.kind === "command") {
+ const command = (msg as unknown as { command?: unknown }).command;
+ if (typeof command === "string" && BRIDGE_ALLOWED_COMMANDS.has(command)) {
+ void vscode.commands.executeCommand(command);
+ return true;
+ }
+ return false;
+ }
+
+ // Dashboard "Default model" control mirrors its choice into the
+ // amicode.defaultModel setting, so the config pin (headless / first turn)
+ // tracks the UI. "provider/model-id" only, bounded — untrusted.
+ if (msg.kind === "set-default-model" && typeof (msg as { model?: unknown }).model === "string") {
+ const model = (msg as unknown as { model: string }).model.trim();
+ if (model.length > 0 && model.length <= 200 && /^[\w.-]+\/[\w.:-]+$/.test(model)) {
+ void vscode.workspace.getConfiguration("amicode").update("defaultModel", model, vscode.ConfigurationTarget.Global);
+ }
+ return true;
+ }
+
+ return false;
+}