TUI: add a project-aware context switcher to Ctrl-R

[tony]

Summary

Expand the existing Ctrl+R search-history recall into a pi-minimal, project-aware search context switcher. A context restores the query text, content scope (prompts, conversations, or all), and any origin narrowing (cwd, repository, worktree, or branch), so moving between projects does not require reconstructing query predicates by hand.

Interaction

Ctrl+A all projects · Ctrl+B current branch · Ctrl+W all worktrees · Space preview · Ctrl+R rename · Type to search · Esc cancel

• Global Ctrl+R opens the switcher; modal-local Ctrl+R renames the highlighted context.
• Up / Down moves through contexts and Enter applies the highlighted context.
• Typing filters by local alias, query text, home-elided working directory, repository/worktree identity, and branch.
• Space lazily previews the resolved query, content scope, agent coverage, and home-elided origin metadata without running a new search.
• Esc closes without changing the active query or scope and restores the previously focused widget.

Scope semantics

• A context is one immutable snapshot of query text, SearchScope, selected agents, and optional origin filters; applying one updates those values atomically and dispatches through the normal search workflow.
• Ctrl+A removes project-origin narrowing while preserving the query, agents, and content scope.
• Ctrl+B narrows to the active repository and branch; when branch identity is unavailable, show the action as unavailable rather than guessing.
• Ctrl+W shows every known worktree for the active repository regardless of branch, while exact rows can still select one recorded cwd, worktree, or branch.
• Renaming creates an agentgrep-local display alias for the saved context. It must never rename a directory, Git worktree, Git branch, or upstream agent session, preserving agentgrep's read-only source-store contract.
• Existing history entries without structured scope metadata remain readable and migrate as query-only contexts with the current/default scope.

Product behavior

• Keep the modal flush and keyboard-first; do not add a second command palette or a nested settings screen.
• Keep origin labels privacy-safe by using the existing display-path collapsing rules and never emit raw absolute paths in logs, telemetry, screenshots used as fixtures, or error messages.
• Open immediately from in-memory history/current-context data, then progressively add discovered contexts. Filesystem, Git, store discovery, sorting over a large corpus, and preview construction must stay off the Textual message pump per ADR 0011.
• Preserve the frontend-neutral SearchQuery / origin-filter semantics so CLI, TUI, Python, and MCP do not acquire different meanings for scope, cwd, worktree, or branch. This issue adds TUI navigation; it does not require a new MCP primitive.

Open-source precedent

• Codex's resume picker combines typed search, backend working-directory filtering, pagination, and lazy transcript previews in one keyboard-first surface: https://github.com/openai/codex/blob/41efc63/codex-rs/tui/src/resume_picker.rs#L288-L303
• Codex renders an explicit Cwd / All filter and loads a selected transcript preview only when expanded: https://github.com/openai/codex/blob/41efc63/codex-rs/tui/src/resume_picker.rs#L1622-L1635 and https://github.com/openai/codex/blob/41efc63/codex-rs/tui/src/resume_picker.rs#L1678-L1696
• Crush's session dialog uses a filterable list, modal-local Ctrl+R rename, Esc cancellation, and plain typing for fuzzy search: https://github.com/charmbracelet/crush/blob/cd592e8/internal/ui/dialog/sessions.go#L80-L131 and https://github.com/charmbracelet/crush/blob/cd592e8/internal/ui/dialog/sessions.go#L176-L217
• OpenCode keeps session listing and session renaming as explicit, independently configurable actions, with Ctrl+R as the default rename binding: https://github.com/sst/opencode/blob/9976269/packages/web/src/content/docs/keybinds.mdx#L35-L46

Acceptance criteria

• Ctrl+R opens one switcher from the supported HUD without replacing the mounted shell or losing the active search state.
• The footer exposes exactly the modal-local controls above, adapting labels for narrow terminals without hiding the active scope.
• All-project, current-branch, all-worktree, exact-cwd, exact-worktree, and exact-branch contexts can be searched and selected.
• Selecting a context updates query/scope/origin state once and starts the corresponding search; cancelling changes nothing.
• Preview is lazy, bounded, privacy-safe, and never blocks input or spinner animation.
• Rename persists only an agentgrep-local alias and survives restart without touching upstream stores or Git state.
• Wide and stacked Textual tests cover filtering, preview, rename, selection, cancellation, unavailable branch identity, focus restoration, legacy history migration, and pump classification.

Goal

Idempotent completion condition for /goal. It asserts an end state, not an action: if the state already holds, the first evaluation passes and nothing is edited.

/goal Work only in a worktree on a new local branch tui-context-switcher cut from master, never in the shared master tree; never push. FIRST report there: git rev-parse --abbrev-ref HEAD, then NO_COLOR=1 AGENTGREP_TUI_WATCHDOG=1 env -u VIRTUAL_ENV -u UV_NO_SYNC .venv/bin/python -m pytest tests/test_ui_context_switcher.py -v. That module does not exist today; do not gate on the -m tui lane, 11 tests already green on master. End state: HEAD is that branch, that module passes with cases for filtering, preview, rename, selection, cancellation, unknown branch, focus restore and legacy migration, the -m tui lane still exits 0, and uv run ty check is clean. Per issue #126: Ctrl-R opens one project-aware switcher; a context snapshots query text, SearchScope, agents and optional origin narrowing (cwd, repo, worktree, branch) applied in one update; Ctrl-A, Ctrl-B and Ctrl-W give all projects, current branch and worktrees, branch shown unavailable rather than guessed when unknown; Space previews lazily; modal-local Ctrl-R renames an agentgrep-local alias only; Esc restores focus. Stores and Git stay read-only; no absolute path reaches a label or log. ADR 0011: no file open, subprocess, sqlite3, network, filesystem walk, lock or queue wait, .result(), json load/dump or unbounded CPU reachable from a pump callable even one helper hop down; new pump entrypoints carry @pump_only, run_worker targets carry @offload with a stable group, bulk updates use stream_apply. The hook arms only under a truthy AGENTGREP_TUI_WATCHDOG and is blind to open, os.scandir and CPU spin, so also name the entrypoints and hops you traced. Keep scope and origin separate; add no effort axis, persistent index or MCP primitive, and leave SearchQuery semantics unchanged. Or stop after 25 turns and report what remains.

• Proof — NO_COLOR=1 AGENTGREP_TUI_WATCHDOG=1 env -u VIRTUAL_ENV -u UV_NO_SYNC .venv/bin/python -m pytest tests/test_ui_context_switcher.py -v (run in the tui-context-switcher worktree, after git rev-parse --abbrev-ref HEAD names that branch)
• Idempotence — Re-running once the switcher exists reports the same branch name and the same passing -v case list, and no file is touched.
• Blocked by — nothing
• Blocks — nothing; the new module and branch do not queue deltas against hud.py regions Expose deterministic IDs and tighten TUI controls #111/Add durable bookmarks across CLI and TUI #121/Add portable record export across surfaces #122/agentgrep(feat[tui]): Chat layout and deductive search #89 already contend for
• Preserves — Non-blocking TUI stays enforced with the audit hook actually armed (AGENTGREP_TUI_WATCHDOG=1) rather than only the placement decorators; scope and origin stay separate normalized fields so a later effort axis can be added; no persistent-index requirement, so the Persistent SQLite DB index with cache-aware search #47-vs-Durable prompt corpus and derived search indexes (ADR 0019) #142 storage slot stays open; no new MCP primitive and no change to frontend-neutral SearchQuery semantics.