feat(renderer): pin permission/question displays to bottom and add tests

Add pinned_bottom_message_ids and is_pinned_bottom_message to the buffer renderer so
permission-display-message and question-display-message are kept pinned below later
messages when rendering. Update get_message_insert_line logic to respect pinned messages
and to prefer rendered pinned positions when available.

Author: sudo-tee

lua/opencode/ui/renderer/buffer.lua

@@ -4,6 +4,17 @@ local output_window = require('opencode.ui.output_window')
 
 local M = {}
 
+local pinned_bottom_message_ids = {
+  ['permission-display-message'] = true,
+  ['question-display-message'] = true,
+}
+
+---@param message_id string|nil
+---@return boolean
+local function is_pinned_bottom_message(message_id)
+  return message_id ~= nil and pinned_bottom_message_ids[message_id] == true
+end
+
 ---@param extmarks table<number, OutputExtmark[]|fun(): OutputExtmark>[]|table<number, OutputExtmark[]>|nil
 ---@return boolean
 local function has_extmarks(extmarks)
@@ -259,19 +270,48 @@ local function get_message_insert_line(message_id)
   end
 
   if not message_index then
+    if is_pinned_bottom_message(message_id) then
+      return append_at
+    end
+
+    for _, pinned_message_id in ipairs({ 'permission-display-message', 'question-display-message' }) do
+      local pinned_rendered = ctx.render_state:get_message(pinned_message_id)
+      if pinned_rendered and pinned_rendered.line_start then
+        return pinned_rendered.line_start
+      end
+    end
+
+    return append_at
+  end
+
+  if is_pinned_bottom_message(message_id) then
     return append_at
   end
 
   for i = message_index + 1, #messages do
     local next_message = messages[i]
     if next_message and next_message.info and next_message.info.id then
+      if is_pinned_bottom_message(next_message.info.id) then
+        local next_rendered = ctx.render_state:get_message(next_message.info.id)
+        if next_rendered and next_rendered.line_start then
+          return next_rendered.line_start
+        end
+      end
+
       local next_rendered = ctx.render_state:get_message(next_message.info.id)
       if next_rendered and next_rendered.line_start then
         return next_rendered.line_start
       end
     end
   end
 
+  for _, pinned_message_id in ipairs({ 'permission-display-message', 'question-display-message' }) do
+    local pinned_rendered = ctx.render_state:get_message(pinned_message_id)
+    if pinned_rendered and pinned_rendered.line_start then
+      return pinned_rendered.line_start
+    end
+  end
+
   return append_at
 end
 

lua/opencode/ui/renderer/events.lua

@@ -414,14 +414,14 @@ end
 ---Handle permission.updated / permission.asked
 ---@param permission OpencodePermission
 function M.on_permission_updated(permission)
+  if not permission or not permission.id then
+    return
+  end
+
   local tool = permission.tool
   local callID = tool and tool.callID or permission.callID
   local messageID = tool and tool.messageID or permission.messageID
 
-  if not permission or not messageID or not callID then
-    return
-  end
-
   if not state.pending_permissions then
     state.renderer.set_pending_permissions({})
   end

tests/unit/permission_integration_spec.lua

@@ -2,6 +2,9 @@ local state = require('opencode.state')
 local permission_window = require('opencode.ui.permission_window')
 local events = require('opencode.ui.renderer.events')
 local ctx = require('opencode.ui.renderer.ctx')
+local output_window = require('opencode.ui.output_window')
+local flush = require('opencode.ui.renderer.flush')
+local helpers = require('tests.helpers')
 
 describe('permission_integration', function()
   local mock_update_permission_from_part
@@ -402,3 +405,104 @@ describe('permission_integration', function()
     end)
   end)
 end)
+
+describe('permission and question display ordering', function()
+  before_each(function()
+    helpers.replay_setup()
+    state.session.set_active({ id = 'session_123' })
+  end)
+
+  after_each(function()
+    if state.windows then
+      require('opencode.ui.ui').close_windows(state.windows)
+    end
+  end)
+
+  it('keeps the permission display pinned below later messages', function()
+    events.on_message_updated({
+      info = {
+        id = 'msg_user',
+        sessionID = 'session_123',
+        role = 'user',
+      },
+    })
+    events.on_part_updated({
+      part = {
+        id = 'part_user',
+        messageID = 'msg_user',
+        sessionID = 'session_123',
+        type = 'text',
+        text = 'first',
+      },
+    })
+
+    events.on_permission_updated({
+      id = 'perm_1',
+      permission = 'bash',
+      title = 'Run command',
+      metadata = {},
+    })
+
+    events.on_message_updated({
+      info = {
+        id = 'msg_assistant',
+        sessionID = 'session_123',
+        role = 'assistant',
+      },
+    })
+    events.on_part_updated({
+      part = {
+        id = 'part_assistant',
+        messageID = 'msg_assistant',
+        sessionID = 'session_123',
+        type = 'text',
+        text = 'later message',
+      },
+    })
+
+    flush.flush()
+
+    local actual = helpers.capture_output(state.windows.output_buf, output_window.namespace)
+    local permission_line = nil
+    local assistant_line = nil
+    for i, line in ipairs(actual.lines) do
+      if line:find('Permission Required', 1, true) then
+        permission_line = i
+      elseif line == 'later message' then
+        assistant_line = i
+      end
+    end
+
+    assert.is_not_nil(permission_line)
+    assert.is_not_nil(assistant_line)
+    assert.is_true(permission_line > assistant_line)
+  end)
+end)
+
+describe('permission prompt rendering', function()
+  before_each(function()
+    state.renderer.set_messages({})
+    state.renderer.set_pending_permissions({})
+    state.session.set_active({ id = 'session_123' })
+
+    permission_window._permission_queue = {}
+    permission_window._dialog = nil
+    permission_window._processing = false
+
+    ctx.render_state:reset()
+    ctx.prev_line_count = 0
+  end)
+
+  it('tracks and renders permissions without message correlation metadata', function()
+    events.on_permission_updated({
+      id = 'perm_no_meta',
+      permission = 'bash',
+      title = 'Run command',
+      metadata = {},
+    })
+
+    assert.are.equal(1, #state.pending_permissions)
+    assert.are.equal('perm_no_meta', state.pending_permissions[1].id)
+    assert.are.equal(1, permission_window.get_permission_count())
+  end)
+end)