fix: remove rel=noopener from all session/instance links to enable tab reuse

rel=noopener forces a fresh browsing context, breaking target name matching
and window reference tracking across browsers.

Changes:
- use-instance-actions.ts: track opened tabs in Map, call .focus() on existing
- session-card.tsx: all Open buttons now go through handleOpen callback
- app-shell.tsx: sidebar session links use target='session-{id}' + noreferrer
- workspace-instance-chips.tsx: remove noopener from chip links
- instance-list.tsx: remove noopener from Open links
- WorkspaceDetailPage.tsx: use named target + noreferrer

Quality gates: tsc --noEmit pass, npm run build pass, 80/80 tests pass

apps/web/src/components/app-shell.tsx

@@ -50,8 +50,8 @@ const SessionItem = ({ session }: { session: Session }) => {
 	return (
 		<a
 			href={href}
-			target="_blank"
+			target={`session-${session.id}`}
-			rel="noopener noreferrer"
+			rel="noreferrer"
 			className="nav-item session-item"
 			title={`${session.display_name} (${session.status})`}
 		>

apps/web/src/components/features/session/session-card.tsx

@@ -58,11 +58,6 @@ export function SessionCard({
 	const isTerminalOnly =
 		session.tool_type_interfaces?.includes("terminal") &&
 		!session.tool_type_interfaces?.includes("web");
-	const openHref = session.url
-		? session.url
-		: isTerminalOnly
-			? `/instances/${session.id}/terminal`
-			: undefined;
 	const hasTunnelError =
 		!isTerminalOnly && tunnelHealth?.tunnel_status === "unreachable";
 	const hasAppError =
@@ -138,13 +133,13 @@ export function SessionCard({
 					)}
 					{session.url && (
 						<p className="session-card-url">
-							<a
+							<button
-								href={session.url}
+								type="button"
-								target={`session-${session.id}`}
+								className="link-button"
-								rel="noopener noreferrer"
+								onClick={() => onOpen?.(session)}
 							>
 								{session.url}
-							</a>
+							</button>
 						</p>
 					)}
 					{session.created_at && (
@@ -159,27 +154,15 @@ export function SessionCard({
 				<div className="session-card-actions mobile">
 					{isActive && (
 						<>
-							{openHref ? (
+							<button
-								<a
+								className="secondary-button mobile-primary"
-									href={openHref}
+								onClick={() => onOpen?.(session)}
-									target={`session-${session.id}`}
+								type="button"
-									rel="noopener noreferrer"
+								disabled={isBusy}
-									className="secondary-button mobile-primary"
+							>
-								>
+								<Icon name="external" size="sm" />
-									<Icon name="external" size="sm" />
+								Open
-									Open
+							</button>
-								</a>
-							) : (
-								<button
-									className="secondary-button mobile-primary"
-									onClick={() => onOpen?.(session)}
-									type="button"
-									disabled={isBusy}
-								>
-									<Icon name="external" size="sm" />
-									Open
-								</button>
-							)}
 							<button
 								className="ghost-button mobile-more"
 								onClick={() => setShowActionSheet(true)}
@@ -216,27 +199,15 @@ export function SessionCard({
 				<div className="session-card-actions">
 					{isActive && (
 						<>
-							{openHref ? (
+							<button
-								<a
+								className="secondary-button small"
-									href={openHref}
+								onClick={() => onOpen?.(session)}
-									target={`session-${session.id}`}
+								type="button"
-									rel="noopener noreferrer"
+								disabled={isBusy}
-									className="secondary-button small"
+							>
-								>
+								<Icon name="external" size="sm" />
-									<Icon name="external" size="sm" />
+								<span className="action-label">Open</span>
-									<span className="action-label">Open</span>
+							</button>
-								</a>
-							) : (
-								<button
-									className="secondary-button small"
-									onClick={() => onOpen?.(session)}
-									type="button"
-									disabled={isBusy}
-								>
-									<Icon name="external" size="sm" />
-									<span className="action-label">Open</span>
-								</button>
-							)}
 
 							{!isTerminalOnly && onRecreateTunnel && (
 								<button

apps/web/src/components/features/tool/instance-list.tsx

@@ -286,7 +286,7 @@ export const InstanceList = ({
 														: `${API_BASE_URL}${instance.url}`
 												}
 												target={`instance-${instance.id}`}
-												rel="noopener noreferrer"
+												rel="noreferrer"
 												className="secondary-button small"
 											>
 												<Icon name="external" size="sm" />

apps/web/src/components/features/workspace/workspace-instance-chips.tsx

@@ -44,7 +44,7 @@ export function WorkspaceInstanceChips({
 						<a
 							href={inst.url}
 							target={`instance-${inst.id}`}
-							rel="noopener noreferrer"
+							rel="noreferrer"
 							onClick={(e) => e.stopPropagation()}
 						>
 							↗

apps/web/src/hooks/use-instance-actions.ts

@@ -1,4 +1,4 @@
-import { useState, useCallback } from "react";
+import { useState, useCallback, useRef } from "react";
 import {
 	stopInstance,
 	deleteInstance,
@@ -33,18 +33,27 @@ export function useInstanceActions(
 		null,
 	);
 	const [dirtyDeleteFiles, setDirtyDeleteFiles] = useState<string[]>([]);
+	const tabRefs = useRef<Map<string, Window | null>>(new Map());
 
 	const handleOpen = useCallback((session: Session) => {
-		const tabName = `session-${session.id}`;
+		const key = session.id;
+		const existing = tabRefs.current.get(key);
+		if (existing && !existing.closed) {
+			existing.focus();
+			return;
+		}
+
+		let url: string;
 		if (session.url) {
-			window.open(session.url, tabName);
+			url = session.url;
-			return;
+		} else if (session.tool_type_interfaces?.includes("terminal")) {
+			url = `/instances/${session.id}/terminal`;
+		} else {
+			url = `/projects/${session.project_id}`;
 		}
-		if (session.tool_type_interfaces?.includes("terminal")) {
+
-			window.open(`/instances/${session.id}/terminal`, tabName);
+		const w = window.open(url, `session-${session.id}`);
-			return;
+		tabRefs.current.set(key, w);
-		}
-		window.open(`/projects/${session.project_id}`, tabName);
 	}, []);
 
 	const handleStart = useCallback(

apps/web/src/pages/WorkspaceDetailPage.tsx

@@ -343,8 +343,8 @@ function ToolsTab({ workspace }: { workspace: Workspace }) {
 								{instance.url && (
 									<a
 										href={instance.url}
-										target="_blank"
+										target={`instance-${instance.id}`}
-										rel="noopener noreferrer"
+										rel="noreferrer"
 									>
 										Open
 									</a>