@averyyy/pi-coding-agent 0.82.1-piclient.2 → 0.82.1-piclient.4

package/dist/core/pi-server-client.js

@@ -1,8 +1,12 @@
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
+import { resolve } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
+import { buildSessionContext, convertToLlm, } from "@earendil-works/pi-agent-core";
 import { EventStream, parseStreamingJson, } from "@earendil-works/pi-ai";
-import { buildPiServerTreePrefixHashes, hashPiServerSessionEntries, hashPiServerStaticContext, } from "./pi-server-protocol.js";
-import { ChunkRequest } from "./pi-server-request.js";
+import { acknowledgePiServerPendingCompact, readPiServerPendingCompact, writePiServerAppliedCompact, writePiServerPendingCompact, writePiServerTerminalCompact, } from "./pi-server-compact-state.js";
+import { appendPiServerTreeHash, canonicalJsonStringify, hashPiServerSessionEntries, hashPiServerStaticContext, hashPiServerTreeEntry, PI_SERVER_EMPTY_TREE_HASH, PI_SERVER_PROTOCOL_VERSION, } from "./pi-server-protocol.js";
+import { ChunkRequest, PiServerTransportBodyLimitError, readPiServerResponseText } from "./pi-server-request.js";
+import { acknowledgePiServerPendingRun, acquirePiServerRunStateLease, hashPiServerIdentity, readPiServerPendingRun, releasePiServerRunStateLease, writePiServerPendingRun, } from "./pi-server-run-state.js";
 class PiServerEventStream extends EventStream {
     constructor() {
         super((event) => event.type === "done" || event.type === "error", (event) => {
@@ -28,14 +32,25 @@ function createPiServerRequest(signal) {
     });
 }
 const sessionStaticContextHashes = new Map();
-const sessionSyncedEntryIds = new Map();
 const sessionTreeHashes = new Map();
 const sessionTreeEntryCounts = new Map();
 const sessionTreeLeafIds = new Map();
+const sessionTreeRevisions = new Map();
 const sessionHasTemporaryTree = new Set();
+const sessionLocalTreeHashes = new Map();
+const sessionPendingRuns = new Map();
+const activePersistentRunLeases = new Map();
 const RESPONSE_BODY_EXCERPT_CHARS = 500;
+const PI_SERVER_CANCEL_TIMEOUT_MS = 5000;
+const PI_SERVER_COMPACT_DEFAULT_RECOVERY_WINDOW_MS = 6 * 60 * 60_000;
+const PI_SERVER_COMPACT_MAX_RECONNECT_DELAY_MS = 30_000;
+const PI_SERVER_STREAM_DEFAULT_RECOVERY_WINDOW_MS = 6 * 60 * 60_000;
+const PI_SERVER_STREAM_MAX_RECONNECT_DELAY_MS = 30_000;
+const PI_SERVER_RESPONSE_NO_PROGRESS_TIMEOUT_MS = 90_000;
+const PI_SERVER_ERROR_BODY_MAX_BYTES = 64 * 1024;
+const PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES = 256 * 1024 * 1024;
 const TRANSIENT_PI_SERVER_RETRY_DELAYS_MS = [250, 750, 1500];
-const TRANSIENT_PI_SERVER_STATUS_CODES = new Set([502, 503, 504, 530]);
+const TRANSIENT_PI_SERVER_STATUS_CODES = new Set([408, 425, 429, 502, 503, 504, 530]);
 export function hashStaticContext(ctx) {
     return hashPiServerStaticContext(ctx);
 }
@@ -60,23 +75,224 @@ function getLinearTreeFromMessages(messages) {
 }
 export function resetSessionTracking(sessionId) {
     sessionStaticContextHashes.delete(sessionId);
-    sessionSyncedEntryIds.delete(sessionId);
     sessionTreeHashes.delete(sessionId);
     sessionTreeEntryCounts.delete(sessionId);
     sessionTreeLeafIds.delete(sessionId);
+    sessionTreeRevisions.delete(sessionId);
     sessionHasTemporaryTree.delete(sessionId);
+    sessionLocalTreeHashes.delete(sessionId);
 }
 export function resetAllSessionTracking() {
+    for (const { lease } of activePersistentRunLeases.values()) {
+        releasePiServerRunStateLease(lease);
+    }
+    activePersistentRunLeases.clear();
     sessionStaticContextHashes.clear();
-    sessionSyncedEntryIds.clear();
     sessionTreeHashes.clear();
     sessionTreeEntryCounts.clear();
     sessionTreeLeafIds.clear();
+    sessionTreeRevisions.clear();
     sessionHasTemporaryTree.clear();
+    sessionLocalTreeHashes.clear();
+    sessionPendingRuns.clear();
+}
+function acquirePersistentRunLease(sessionId, path) {
+    const normalizedPath = resolve(path);
+    if (activePersistentRunLeases.has(normalizedPath)) {
+        throw new Error(`Cannot start pi-server run for ${sessionId}; this process already owns the session lease`);
+    }
+    const lease = acquirePiServerRunStateLease(normalizedPath);
+    activePersistentRunLeases.set(normalizedPath, { sessionId, lease, scope: "run" });
+    return lease;
+}
+export function releasePiServerRunLease(sessionId, path) {
+    if (!path)
+        return;
+    const normalizedPath = resolve(path);
+    const active = activePersistentRunLeases.get(normalizedPath);
+    if (!active || active.sessionId !== sessionId || active.scope !== "run")
+        return;
+    activePersistentRunLeases.delete(normalizedPath);
+    releasePiServerRunStateLease(active.lease);
+}
+export function acquirePiServerSessionLease(sessionId, path) {
+    const normalizedPath = resolve(path);
+    if (activePersistentRunLeases.has(normalizedPath)) {
+        throw new Error(`Cannot start pi-server session ${sessionId}; this process already owns the session lease`);
+    }
+    const lease = acquirePiServerRunStateLease(normalizedPath);
+    activePersistentRunLeases.set(normalizedPath, { sessionId, lease, scope: "session" });
+}
+export function releasePiServerSessionLease(sessionId, path) {
+    if (!path)
+        return;
+    const normalizedPath = resolve(path);
+    const active = activePersistentRunLeases.get(normalizedPath);
+    if (!active || active.sessionId !== sessionId || active.scope !== "session")
+        return;
+    activePersistentRunLeases.delete(normalizedPath);
+    releasePiServerRunStateLease(active.lease);
+}
+function getPersistentRunLease(sessionId, path) {
+    const active = activePersistentRunLeases.get(resolve(path));
+    if (!active)
+        return undefined;
+    if (active.sessionId !== sessionId) {
+        throw new Error(`Pi-server run lease belongs to session ${active.sessionId}, not ${sessionId}`);
+    }
+    return active;
+}
+class PiServerCompactOperationError extends Error {
+    payload;
+    constructor(message, payload) {
+        super(message);
+        this.name = "PiServerCompactOperationError";
+        this.payload = payload;
+    }
+}
+class PiServerCompactProtocolError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PiServerCompactProtocolError";
+    }
+}
+class PiServerCompactInterruptionError extends Error {
+    observedProgress;
+    constructor(message, observedProgress) {
+        super(message);
+        this.name = "PiServerCompactInterruptionError";
+        this.observedProgress = observedProgress;
+    }
+}
+class PiServerStreamProtocolError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PiServerStreamProtocolError";
+    }
+}
+class PiServerHttpResponseError extends Error {
+    status;
+    retryable;
+    constructor(message, status, retryable) {
+        super(message);
+        this.name = "PiServerHttpResponseError";
+        this.status = status;
+        this.retryable = retryable;
+    }
 }
 function isObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isNonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+function validateProviderExecutionFingerprint(value) {
+    if (value !== undefined && !/^[a-f0-9]{64}$/u.test(value)) {
+        throw new Error("pi-server provider execution fingerprint must be a lowercase SHA-256 digest");
+    }
+}
+export function getPiServerRunDiagnostic(message) {
+    const diagnostics = message.diagnostics?.filter((diagnostic) => diagnostic.type === "pi_server_run") ?? [];
+    if (diagnostics.length === 0)
+        return undefined;
+    if (diagnostics.length !== 1) {
+        throw new Error("pi-server assistant message contained multiple run diagnostics");
+    }
+    const details = diagnostics[0].details;
+    if (!isObject(details) ||
+        typeof details.sessionId !== "string" ||
+        details.sessionId.length === 0 ||
+        typeof details.runId !== "string" ||
+        details.runId.length === 0 ||
+        typeof details.requestMac !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(details.requestMac) ||
+        (details.restartUnknown !== undefined && typeof details.restartUnknown !== "boolean")) {
+        throw new Error("pi-server assistant message contained an invalid run diagnostic");
+    }
+    return {
+        sessionId: details.sessionId,
+        runId: details.runId,
+        requestMac: details.requestMac,
+        restartUnknown: details.restartUnknown === true,
+    };
+}
+function hashPiServerStreamRequest(value) {
+    const serialized = canonicalJsonStringify(value);
+    if (serialized === undefined) {
+        throw new Error("Failed to serialize pi-server stream request identity");
+    }
+    return createHash("sha256").update(serialized).digest("hex");
+}
+function parsePiServerSessionSummary(value, expectedSessionId, errorPrefix) {
+    if (!isObject(value)) {
+        throw new Error(`${errorPrefix} (response was not an object)`);
+    }
+    if (value.protocolVersion !== PI_SERVER_PROTOCOL_VERSION) {
+        const received = value.protocolVersion === undefined ? "missing" : JSON.stringify(value.protocolVersion);
+        throw new Error(`${errorPrefix} (unsupported pi-server protocol version: ${received}; expected ${PI_SERVER_PROTOCOL_VERSION})`);
+    }
+    if (value.sessionId !== expectedSessionId) {
+        throw new Error(`${errorPrefix} (response sessionId did not match the requested session)`);
+    }
+    if (typeof value.staticContextHash !== "string" ||
+        (value.staticContextHash !== "" && !/^[a-f0-9]{64}$/i.test(value.staticContextHash))) {
+        throw new Error(`${errorPrefix} (response staticContextHash was not a valid digest)`);
+    }
+    if (typeof value.treeHash !== "string" || !/^[a-f0-9]{64}$/i.test(value.treeHash)) {
+        throw new Error(`${errorPrefix} (response treeHash was not a valid digest)`);
+    }
+    if (!isNonNegativeInteger(value.messageCount)) {
+        throw new Error(`${errorPrefix} (response messageCount was not a non-negative integer)`);
+    }
+    if (!isNonNegativeInteger(value.entryCount)) {
+        throw new Error(`${errorPrefix} (response entryCount was not a non-negative integer)`);
+    }
+    if (value.leafId !== null && typeof value.leafId !== "string") {
+        throw new Error(`${errorPrefix} (response leafId was not a string or null)`);
+    }
+    if (!isNonNegativeInteger(value.revision)) {
+        throw new Error(`${errorPrefix} (response revision was not a non-negative integer)`);
+    }
+    return value;
+}
+function recordPiServerSessionSummary(sessionId, summary) {
+    sessionTreeHashes.set(sessionId, summary.treeHash);
+    sessionTreeEntryCounts.set(sessionId, summary.entryCount);
+    sessionTreeLeafIds.set(sessionId, summary.leafId);
+    sessionTreeRevisions.set(sessionId, summary.revision);
+}
+function extendsCachedImmutableTree(cachedEntries, entries) {
+    if (cachedEntries.length > entries.length)
+        return false;
+    if (cachedEntries.length === 0)
+        return true;
+    return cachedEntries[cachedEntries.length - 1] === entries[cachedEntries.length - 1];
+}
+function hashLocalTree(sessionId, entries) {
+    const cached = sessionLocalTreeHashes.get(sessionId);
+    let treeHash = PI_SERVER_EMPTY_TREE_HASH;
+    let startIndex = 0;
+    if (cached && extendsCachedImmutableTree(cached.entries, entries)) {
+        treeHash = cached.treeHash;
+        startIndex = cached.entries.length;
+    }
+    for (let index = startIndex; index < entries.length; index++) {
+        treeHash = appendPiServerTreeHash(treeHash, hashPiServerTreeEntry(entries[index]));
+    }
+    sessionLocalTreeHashes.set(sessionId, { entries, treeHash });
+    return treeHash;
+}
+function hashLocalTreePrefix(sessionId, entries, entryCount) {
+    const cached = sessionLocalTreeHashes.get(sessionId);
+    if (cached && cached.entries.length === entryCount && extendsCachedImmutableTree(cached.entries, entries)) {
+        return cached.treeHash;
+    }
+    let treeHash = PI_SERVER_EMPTY_TREE_HASH;
+    for (let index = 0; index < entryCount; index++) {
+        treeHash = appendPiServerTreeHash(treeHash, hashPiServerTreeEntry(entries[index]));
+    }
+    return treeHash;
+}
 function getResponseStatus(response) {
     const status = response.statusText ? `${response.status} ${response.statusText}` : String(response.status);
     return response.status >= 500 ? `${status} (server error)` : status;
@@ -91,6 +307,60 @@ function getBodyExcerpt(text) {
     const excerpt = trimmed.slice(0, RESPONSE_BODY_EXCERPT_CHARS);
     return excerpt.length < trimmed.length ? `${excerpt}...` : excerpt;
 }
+function getPiServerResponseNoProgressTimeoutMs() {
+    const environmentValue = process.env.PI_SERVER_RESPONSE_NO_PROGRESS_TIMEOUT_MS;
+    const value = environmentValue === undefined ? PI_SERVER_RESPONSE_NO_PROGRESS_TIMEOUT_MS : Number(environmentValue);
+    if (!Number.isFinite(value) || value <= 0) {
+        throw new Error("PI_SERVER_RESPONSE_NO_PROGRESS_TIMEOUT_MS must be positive finite milliseconds");
+    }
+    return value;
+}
+function createPiServerBodyNoProgressState() {
+    const timeoutMs = getPiServerResponseNoProgressTimeoutMs();
+    return { timeoutMs, deadlineMs: Date.now() + timeoutMs };
+}
+function createPiServerResponseNoProgressError(timeoutMs) {
+    const error = new Error(`pi-server response made no progress for ${timeoutMs}ms`);
+    error.name = "PiServerResponseNoProgressError";
+    return error;
+}
+async function readPiServerBodyChunk(reader, state) {
+    while (true) {
+        const remainingMs = state.deadlineMs - Date.now();
+        if (remainingMs <= 0) {
+            throw createPiServerResponseNoProgressError(state.timeoutMs);
+        }
+        const result = await new Promise((resolve, reject) => {
+            let settled = false;
+            const timer = setTimeout(() => {
+                if (settled)
+                    return;
+                settled = true;
+                reject(createPiServerResponseNoProgressError(state.timeoutMs));
+            }, remainingMs);
+            timer.unref();
+            void reader.read().then((value) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                resolve(value);
+            }, (error) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                reject(error);
+            });
+        });
+        if (result.done || result.value.byteLength > 0) {
+            if (!result.done)
+                state.deadlineMs = Date.now() + state.timeoutMs;
+            return result;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+}
 function getJsonErrorText(text) {
     if (!text)
         return undefined;
@@ -110,16 +380,17 @@ function formatResponseDetails(response, bodyText) {
     return `${getResponseStatus(response)}; content-type: ${getResponseContentType(response)}; body excerpt: ${body}`;
 }
 async function readPiServerFailure(response) {
-    const bodyText = await response.text();
+    const bodyText = await readPiServerResponseText(response, PI_SERVER_ERROR_BODY_MAX_BYTES);
     return {
         details: formatResponseDetails(response, bodyText),
         matchText: getJsonErrorText(bodyText) ?? bodyText,
+        bodyText,
     };
 }
 async function readPiServerJson(response, errorPrefix) {
-    const bodyText = await response.text();
+    const bodyText = await readPiServerResponseText(response, response.ok ? Number.POSITIVE_INFINITY : PI_SERVER_ERROR_BODY_MAX_BYTES);
     if (!response.ok) {
-        throw new Error(`${errorPrefix} (${formatResponseDetails(response, bodyText)})`);
+        throw new PiServerHttpResponseError(`${errorPrefix} (${formatResponseDetails(response, bodyText)})`, response.status, isTransientPiServerResponse(response, bodyText));
     }
     try {
         return JSON.parse(bodyText);
@@ -133,41 +404,41 @@ function getServerSentEventFieldValue(line, field) {
     const value = line.slice(prefix.length);
     return value.startsWith(" ") ? value.slice(1) : value;
 }
-function parseServerSentEvents(bodyText) {
-    const events = [];
-    let event = "message";
-    let dataLines = [];
-    const flush = () => {
-        if (dataLines.length === 0)
-            return;
-        events.push({ event, data: dataLines.join("\n") });
-        event = "message";
-        dataLines = [];
-    };
-    for (const line of bodyText.split(/\r?\n/)) {
-        if (line === "") {
-            flush();
-            continue;
-        }
-        if (line.startsWith(":"))
-            continue;
-        if (line.startsWith("event:")) {
-            event = getServerSentEventFieldValue(line, "event");
+function updateEventStreamLineBytes(chunk, currentLineBytes) {
+    let lineBytes = currentLineBytes;
+    for (const byte of chunk) {
+        if (byte === 0x0a) {
+            lineBytes = 0;
             continue;
         }
-        if (line.startsWith("data:")) {
-            dataLines.push(getServerSentEventFieldValue(line, "data"));
-        }
+        lineBytes++;
+        if (lineBytes > PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES)
+            return -1;
+    }
+    return lineBytes;
+}
+function extractDecodedEventStreamLines(decoded, incompleteLineParts) {
+    const lines = [];
+    let start = 0;
+    let newlineIndex = decoded.indexOf("\n");
+    while (newlineIndex >= 0) {
+        incompleteLineParts.push(decoded.slice(start, newlineIndex));
+        lines.push(incompleteLineParts.join(""));
+        incompleteLineParts.length = 0;
+        start = newlineIndex + 1;
+        newlineIndex = decoded.indexOf("\n", start);
+    }
+    if (start < decoded.length) {
+        incompleteLineParts.push(decoded.slice(start));
     }
-    flush();
-    return events;
+    return lines;
 }
 function parseServerSentEventData(event, errorPrefix) {
     try {
         return JSON.parse(event.data);
     }
     catch {
-        throw new Error(`${errorPrefix} (invalid event-stream JSON data: ${getBodyExcerpt(event.data)})`);
+        throw new PiServerCompactProtocolError(`${errorPrefix} (invalid event-stream JSON data: ${getBodyExcerpt(event.data)})`);
     }
 }
 function formatServerSentEventError(response, payload) {
@@ -175,37 +446,139 @@ function formatServerSentEventError(response, payload) {
     return `${getResponseStatus(response)}; content-type: ${getResponseContentType(response)}; body excerpt: ${getBodyExcerpt(message)}`;
 }
 async function readPiServerEventStreamJson(response, errorPrefix) {
-    const bodyText = await response.text();
-    for (const event of parseServerSentEvents(bodyText)) {
+    if (!response.body) {
+        throw new PiServerCompactInterruptionError(`${errorPrefix} (response body was missing)`, false);
+    }
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    const noProgress = createPiServerBodyNoProgressState();
+    let observedProgress = false;
+    const incompleteLineParts = [];
+    let eventName = "message";
+    let dataLines = [];
+    let eventDataBytes = 0;
+    let incompleteLineBytes = 0;
+    const dispatchEvent = () => {
+        if (dataLines.length === 0) {
+            eventName = "message";
+            return undefined;
+        }
+        const event = { event: eventName, data: dataLines.join("\n") };
+        eventName = "message";
+        dataLines = [];
+        eventDataBytes = 0;
         if (event.event === "error") {
-            throw new Error(`${errorPrefix} (${formatServerSentEventError(response, parseServerSentEventData(event, errorPrefix))})`);
+            const payload = parseServerSentEventData(event, errorPrefix);
+            throw new PiServerCompactOperationError(`${errorPrefix} (${formatServerSentEventError(response, payload)})`, payload);
         }
         if (event.event === "result") {
-            return parseServerSentEventData(event, errorPrefix);
+            return { result: parseServerSentEventData(event, errorPrefix) };
+        }
+        return undefined;
+    };
+    const consumeLine = (rawLine) => {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        if (line === "")
+            return dispatchEvent();
+        if (line.startsWith(":"))
+            return undefined;
+        if (line.startsWith("event:")) {
+            eventName = getServerSentEventFieldValue(line, "event");
+        }
+        else if (line.startsWith("data:")) {
+            const data = getServerSentEventFieldValue(line, "data");
+            eventDataBytes += Buffer.byteLength(data, "utf-8") + (dataLines.length === 0 ? 0 : 1);
+            if (eventDataBytes > PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES) {
+                throw new PiServerCompactProtocolError(`${errorPrefix} (event-stream frame exceeded ${PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES} bytes)`);
+            }
+            dataLines.push(data);
+        }
+        return undefined;
+    };
+    try {
+        while (true) {
+            let readResult;
+            try {
+                readResult = await readPiServerBodyChunk(reader, noProgress);
+            }
+            catch (error) {
+                throw new PiServerCompactInterruptionError(error instanceof Error ? error.message : String(error), observedProgress);
+            }
+            if (readResult.done) {
+                const finalLines = extractDecodedEventStreamLines(decoder.decode(), incompleteLineParts);
+                for (const line of finalLines) {
+                    const result = consumeLine(line);
+                    if (result)
+                        return result.result;
+                }
+                if (incompleteLineParts.length > 0) {
+                    const result = consumeLine(incompleteLineParts.join(""));
+                    if (result)
+                        return result.result;
+                    incompleteLineParts.length = 0;
+                }
+                const result = dispatchEvent();
+                if (result)
+                    return result.result;
+                throw new PiServerCompactInterruptionError(`${errorPrefix} (event stream ended before a result event)`, observedProgress);
+            }
+            if (readResult.value.byteLength > 0)
+                observedProgress = true;
+            incompleteLineBytes = updateEventStreamLineBytes(readResult.value, incompleteLineBytes);
+            if (incompleteLineBytes < 0) {
+                throw new PiServerCompactProtocolError(`${errorPrefix} (event-stream line exceeded ${PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES} bytes)`);
+            }
+            const lines = extractDecodedEventStreamLines(decoder.decode(readResult.value, { stream: true }), incompleteLineParts);
+            for (const line of lines) {
+                const result = consumeLine(line);
+                if (result)
+                    return result.result;
+            }
         }
     }
-    throw new Error(`${errorPrefix} (${formatResponseDetails(response, bodyText)}; expected result event)`);
+    finally {
+        void reader.cancel().catch(() => undefined);
+    }
 }
 async function readPiServerCompactResponse(response, errorPrefix) {
     const contentType = getResponseContentType(response).toLowerCase().split(";")[0]?.trim();
     if (contentType === "text/event-stream") {
         return readPiServerEventStreamJson(response, errorPrefix);
     }
-    return readPiServerJson(response, errorPrefix);
+    let bodyText;
+    try {
+        bodyText = await readPiServerResponseText(response);
+    }
+    catch (error) {
+        throw new PiServerCompactInterruptionError(error instanceof Error ? error.message : String(error), false);
+    }
+    try {
+        return JSON.parse(bodyText);
+    }
+    catch {
+        throw new PiServerCompactProtocolError(`${errorPrefix} (${formatResponseDetails(response, bodyText)}; expected JSON)`);
+    }
 }
 function isAbortError(error, signal) {
     return signal?.aborted === true || (error instanceof Error && error.name === "AbortError");
 }
 function isTransientPiServerFetchError(error) {
     const message = error instanceof Error ? error.message : String(error);
-    return /fetch failed|network|socket hang up|terminated|ECONNRESET|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|CONNECT timeout/i.test(message);
+    return /fetch failed|network|socket (?:hang up|closed|lost)|terminated|ECONNRESET|ECONNREFUSED|ETIMEDOUT|EAI_AGAIN|CONNECT timeout|response made no progress/i.test(message);
 }
-function isTransientPiServerResponse(response, bodyText) {
-    if (!TRANSIENT_PI_SERVER_STATUS_CODES.has(response.status))
-        return false;
-    if (response.status === 530)
+function isTransientPiServerResponse(response, _bodyText) {
+    return TRANSIENT_PI_SERVER_STATUS_CODES.has(response.status);
+}
+function isRetryablePiServerInterruption(error) {
+    if (error instanceof PiServerHttpResponseError)
+        return error.retryable;
+    if (error instanceof PiServerCompactInterruptionError)
         return true;
-    return /CONNECT timeout|Bad Gateway|upstream|timeout/i.test(`${response.statusText}\n${bodyText}`);
+    if (error instanceof PiServerCompactProtocolError || error instanceof PiServerStreamProtocolError)
+        return false;
+    if (error instanceof PiServerTransportBodyLimitError)
+        return false;
+    return isTransientPiServerFetchError(error);
 }
 async function waitForPiServerRetry(attempt, signal) {
     await sleep(TRANSIENT_PI_SERVER_RETRY_DELAYS_MS[attempt], undefined, { signal });
@@ -225,7 +598,19 @@ async function postPiServerJsonWithTransientRetry(request, endpoint, body, error
             }
             throw error;
         }
-        const bodyText = await response.text();
+        let bodyText;
+        try {
+            bodyText = await readPiServerResponseText(response, response.ok ? Number.POSITIVE_INFINITY : PI_SERVER_ERROR_BODY_MAX_BYTES);
+        }
+        catch (error) {
+            if (attempt < TRANSIENT_PI_SERVER_RETRY_DELAYS_MS.length &&
+                !request.options.signal?.aborted &&
+                isTransientPiServerFetchError(error)) {
+                await waitForPiServerRetry(attempt, request.options.signal);
+                continue;
+            }
+            throw error;
+        }
         if (!response.ok) {
             if (attempt < TRANSIENT_PI_SERVER_RETRY_DELAYS_MS.length &&
                 !request.options.signal?.aborted &&
@@ -233,7 +618,7 @@ async function postPiServerJsonWithTransientRetry(request, endpoint, body, error
                 await waitForPiServerRetry(attempt, request.options.signal);
                 continue;
             }
-            throw new Error(`${errorPrefix} (${formatResponseDetails(response, bodyText)})`);
+            throw new PiServerHttpResponseError(`${errorPrefix} (${formatResponseDetails(response, bodyText)})`, response.status, isTransientPiServerResponse(response, bodyText));
         }
         try {
             return JSON.parse(bodyText);
@@ -248,46 +633,37 @@ async function ensurePiServerEventStream(response) {
     if (contentType.toLowerCase().split(";")[0]?.trim() === "text/event-stream") {
         return;
     }
-    const bodyText = await response.text();
+    const bodyText = await readPiServerResponseText(response, PI_SERVER_ERROR_BODY_MAX_BYTES);
     throw new Error(`pi-server error: ${formatResponseDetails(response, bodyText)}; expected text/event-stream`);
 }
 async function ensureSessionInit(sessionId, context, request) {
     const currentHash = hashStaticContext(context);
     const previousHash = sessionStaticContextHashes.get(sessionId);
     if (previousHash === currentHash) {
-        return {
-            sessionId,
-            staticContextHash: previousHash,
-            messageCount: 0,
-            fromCache: true,
-        };
+        return;
     }
     const staticContext = {
         systemPrompt: context.systemPrompt,
         tools: context.tools,
     };
-    const endpoint = previousHash === undefined ? "/api/session/init" : "/api/session/update";
-    const result = await postPiServerJsonWithTransientRetry(request, endpoint, { sessionId, staticContext }, "Session init failed");
-    sessionStaticContextHashes.set(sessionId, currentHash);
-    if (result.treeHash !== undefined) {
-        sessionTreeHashes.set(sessionId, result.treeHash);
-        sessionTreeLeafIds.set(sessionId, result.leafId ?? null);
-        if (result.entryCount !== undefined) {
-            sessionTreeEntryCounts.set(sessionId, result.entryCount);
-        }
+    const probeValue = await postPiServerJsonWithTransientRetry(request, "/api/session/init", { sessionId, staticContextHash: currentHash }, "Session init failed");
+    const probe = parsePiServerSessionSummary(probeValue, sessionId, "Session init failed");
+    if (!isObject(probeValue) || typeof probeValue.staticContextRequired !== "boolean") {
+        throw new Error("Session init failed (protocol v2 response did not include staticContextRequired)");
     }
-    return result;
-}
-function getStaticContext(context) {
-    return {
-        systemPrompt: context.systemPrompt,
-        tools: context.tools,
-    };
+    let result = probe;
+    if (probeValue.staticContextRequired) {
+        const updateValue = await postPiServerJsonWithTransientRetry(request, "/api/session/update", { sessionId, staticContext }, "Session static context update failed");
+        result = parsePiServerSessionSummary(updateValue, sessionId, "Session static context update failed");
+    }
+    if (result.staticContextHash !== currentHash) {
+        throw new Error("Session init failed (server staticContextHash did not match the requested context)");
+    }
+    sessionStaticContextHashes.set(sessionId, currentHash);
+    recordPiServerSessionSummary(sessionId, result);
 }
 function markTreeSynced(sessionId, tree) {
-    sessionSyncedEntryIds.set(sessionId, new Set(tree.entries.map((entry) => entry.id)));
-    const prefixHashes = buildPiServerTreePrefixHashes(tree.entries);
-    sessionTreeHashes.set(sessionId, prefixHashes[prefixHashes.length - 1]);
+    sessionTreeHashes.set(sessionId, hashLocalTree(sessionId, tree.entries));
     sessionTreeEntryCounts.set(sessionId, tree.entries.length);
     sessionTreeLeafIds.set(sessionId, tree.leafId);
     if (tree.replace) {
@@ -298,58 +674,275 @@ function markTreeSynced(sessionId, tree) {
     }
 }
 async function postTreeJson(request, endpoint, body, errorPrefix) {
-    await postPiServerJsonWithTransientRetry(request, endpoint, body, errorPrefix);
+    if (!isObject(body) || typeof body.sessionId !== "string") {
+        throw new Error(`${errorPrefix} (request sessionId was missing)`);
+    }
+    const value = await postPiServerJsonWithTransientRetry(request, endpoint, body, errorPrefix);
+    const summary = parsePiServerSessionSummary(value, body.sessionId, errorPrefix);
+    recordPiServerSessionSummary(body.sessionId, summary);
+}
+function parsePiServerTreeEntries(value, errorPrefix) {
+    if (!Array.isArray(value) ||
+        value.some((entry) => !isObject(entry) ||
+            typeof entry.type !== "string" ||
+            typeof entry.id !== "string" ||
+            (entry.parentId !== null && typeof entry.parentId !== "string") ||
+            typeof entry.timestamp !== "string")) {
+        throw new Error(`${errorPrefix} (response entries were not a valid session tree array)`);
+    }
+    return value;
+}
+function buildPiServerActiveBranch(entries, leafId, errorPrefix) {
+    const entriesById = new Map();
+    for (const entry of entries) {
+        if (entriesById.has(entry.id)) {
+            throw new Error(`${errorPrefix} (response session tree contained duplicate entry ids)`);
+        }
+        entriesById.set(entry.id, entry);
+    }
+    const branch = [];
+    const branchIds = new Set();
+    let current = leafId === null ? undefined : entriesById.get(leafId);
+    if (leafId !== null && !current) {
+        throw new Error(`${errorPrefix} (response leafId did not exist in the session tree)`);
+    }
+    while (current) {
+        if (branchIds.has(current.id)) {
+            throw new Error(`${errorPrefix} (response session tree contained a parent cycle)`);
+        }
+        branchIds.add(current.id);
+        branch.push(current);
+        if (current.parentId === null)
+            break;
+        const parent = entriesById.get(current.parentId);
+        if (!parent) {
+            throw new Error(`${errorPrefix} (response session tree contained a missing parent)`);
+        }
+        current = parent;
+    }
+    branch.reverse();
+    return branch;
+}
+function buildPiServerHistorySnapshot(summary, entries, errorPrefix) {
+    if (entries.length !== summary.entryCount) {
+        throw new Error(`${errorPrefix} (response entryCount did not match the session tree)`);
+    }
+    if (hashEntries(entries) !== summary.treeHash) {
+        throw new Error(`${errorPrefix} (response treeHash did not match the session tree)`);
+    }
+    const branch = buildPiServerActiveBranch(entries, summary.leafId, errorPrefix);
+    const messages = convertToLlm(buildSessionContext(branch).messages);
+    if (messages.length !== summary.messageCount) {
+        throw new Error(`${errorPrefix} (response messageCount did not match the active session branch)`);
+    }
+    return {
+        entries,
+        leafId: summary.leafId,
+        messages,
+        treeHash: summary.treeHash,
+        revision: summary.revision,
+    };
 }
 async function fetchPiServerHistory(sessionId, request, localTree) {
-    const prefixHashes = localTree ? buildPiServerTreePrefixHashes(localTree.entries) : undefined;
-    const historyUrl = localTree && prefixHashes
-        ? `/api/session/${encodeURIComponent(sessionId)}/history?entriesFrom=${localTree.entries.length}&baseTreeHash=${encodeURIComponent(prefixHashes[prefixHashes.length - 1])}`
-        : `/api/session/${encodeURIComponent(sessionId)}/history`;
+    const query = new URLSearchParams({ protocolVersion: String(PI_SERVER_PROTOCOL_VERSION) });
+    if (localTree) {
+        query.set("entriesFrom", String(localTree.entries.length));
+        query.set("baseTreeHash", hashLocalTree(sessionId, localTree.entries));
+        const revision = sessionTreeRevisions.get(sessionId);
+        if (revision !== undefined)
+            query.set("revision", String(revision));
+    }
+    const historyUrl = `/api/session/${encodeURIComponent(sessionId)}/history?${query.toString()}`;
     const response = await request.getJson(historyUrl);
     if (response.status === 404) {
-        return undefined;
+        const failure = await readPiServerFailure(response);
+        if (/session not found/i.test(failure.matchText))
+            return undefined;
+        throw new Error(`Session history reconciliation failed (pi-server protocol v${PI_SERVER_PROTOCOL_VERSION} history endpoint unavailable; ${failure.details})`);
     }
-    const history = await readPiServerJson(response, "Session history reconciliation failed");
-    if (history.treePatch && localTree) {
-        return {
-            entries: [...localTree.entries.slice(0, history.treePatch.entriesFrom), ...history.treePatch.entries],
-            leafId: history.treePatch.leafId,
-            messages: history.messages ?? [],
-        };
+    const historyValue = await readPiServerJson(response, "Session history reconciliation failed");
+    const summary = parsePiServerSessionSummary(historyValue, sessionId, "Session history reconciliation failed");
+    const expectedStaticContextHash = sessionStaticContextHashes.get(sessionId);
+    if (expectedStaticContextHash !== undefined && summary.staticContextHash !== expectedStaticContextHash) {
+        throw new Error("Session history reconciliation failed (server staticContextHash changed unexpectedly)");
     }
-    if (!history.entries || history.leafId === undefined || !history.messages) {
-        throw new Error("Session history reconciliation failed (response did not include the session tree)");
+    const history = historyValue;
+    if (history.treePatch !== undefined) {
+        if (!localTree || !isObject(history.treePatch)) {
+            throw new Error("Session history reconciliation failed (unexpected tree patch response)");
+        }
+        const patch = history.treePatch;
+        const expectedBaseRevision = sessionTreeRevisions.get(sessionId);
+        if (!isNonNegativeInteger(patch.entriesFrom) ||
+            patch.entriesFrom !== localTree.entries.length ||
+            !isNonNegativeInteger(patch.revision) ||
+            patch.revision !== summary.revision ||
+            (patch.baseRevision !== undefined && !isNonNegativeInteger(patch.baseRevision)) ||
+            (expectedBaseRevision !== undefined && patch.baseRevision !== expectedBaseRevision) ||
+            (patch.leafId !== null && typeof patch.leafId !== "string") ||
+            patch.leafId !== summary.leafId) {
+            throw new Error("Session history reconciliation failed (response tree patch metadata was invalid)");
+        }
+        const patchEntries = parsePiServerTreeEntries(patch.entries, "Session history reconciliation failed");
+        return buildPiServerHistorySnapshot(summary, [...localTree.entries.slice(0, patch.entriesFrom), ...patchEntries], "Session history reconciliation failed");
     }
-    return {
-        entries: history.entries,
-        leafId: history.leafId,
-        messages: history.messages,
-    };
+    return buildPiServerHistorySnapshot(summary, parsePiServerTreeEntries(history.entries, "Session history reconciliation failed"), "Session history reconciliation failed");
 }
 async function applyPiServerHistory(sessionId, snapshot, onHistoryReconciled) {
     markTreeSynced(sessionId, snapshot);
+    sessionTreeRevisions.set(sessionId, snapshot.revision);
     await onHistoryReconciled?.(snapshot);
 }
 async function fetchPiServerRun(sessionId, runId, request) {
     const response = await request.getJson(`/api/session/${encodeURIComponent(sessionId)}/runs/${encodeURIComponent(runId)}`);
     if (response.status === 404) {
-        return undefined;
+        const contentType = getResponseContentType(response).toLowerCase();
+        const failure = await readPiServerFailure(response);
+        if (contentType.includes("application/json") && /stream run not found|run not found/i.test(failure.matchText)) {
+            return undefined;
+        }
+        throw new Error(`Session run recovery failed (${failure.details}; expected structured run-not-found response)`);
+    }
+    const value = await readPiServerJson(response, "Session run recovery failed");
+    if (!isObject(value)) {
+        throw new Error("Session run recovery failed (response was not an object)");
+    }
+    if (value.sessionId !== sessionId) {
+        throw new Error("Session run recovery failed (response sessionId did not match the requested session)");
+    }
+    if (value.runId !== runId) {
+        throw new Error("Session run recovery failed (response runId did not match the requested run)");
+    }
+    if (typeof value.requestMac !== "string" || !/^[a-f0-9]{64}$/u.test(value.requestMac)) {
+        throw new Error("Session run recovery failed (response requestMac was not a lowercase SHA-256 digest)");
+    }
+    if (value.status !== "running" && value.status !== "completed" && value.status !== "failed") {
+        throw new Error("Session run recovery failed (response included an unsupported run status)");
+    }
+    if (!isNonNegativeInteger(value.nextSeq)) {
+        throw new Error("Session run recovery failed (response nextSeq was not a non-negative integer)");
+    }
+    if (value.message !== undefined && !isObject(value.message)) {
+        throw new Error("Session run recovery failed (response message was not an object)");
+    }
+    if (value.errorMessage !== undefined && typeof value.errorMessage !== "string") {
+        throw new Error("Session run recovery failed (response errorMessage was not a string)");
+    }
+    if (value.acknowledgedAt !== undefined && !isNonNegativeInteger(value.acknowledgedAt)) {
+        throw new Error("Session run recovery failed (response acknowledgedAt was not a non-negative integer)");
+    }
+    return value;
+}
+async function cancelPiServerRun(sessionId, runId) {
+    const request = createPiServerRequest(AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS));
+    const response = await request.postJson("/api/session/run/cancel", { sessionId, runId });
+    await readPiServerJson(response, "Session run cancel failed");
+}
+export async function acknowledgePiServerRunMessage(sessionId, message, runStatePath, signal) {
+    const activeLease = runStatePath ? getPersistentRunLease(sessionId, runStatePath) : undefined;
+    let lease = activeLease?.lease;
+    let releaseLeaseAfterAcknowledgement = activeLease?.scope === "run";
+    try {
+        const diagnostic = getPiServerRunDiagnostic(message);
+        if (!diagnostic)
+            return;
+        if (runStatePath && !lease) {
+            lease = acquirePersistentRunLease(sessionId, runStatePath);
+            releaseLeaseAfterAcknowledgement = true;
+        }
+        const pending = runStatePath ? readPiServerPendingRun(runStatePath, lease) : sessionPendingRuns.get(sessionId);
+        if (!pending)
+            return;
+        if (diagnostic.sessionId !== sessionId ||
+            diagnostic.sessionId !== pending.sessionId ||
+            diagnostic.runId !== pending.runId ||
+            diagnostic.requestMac !== pending.requestHash) {
+            throw new Error("Cannot acknowledge pi-server run: terminal diagnostic did not match durable pending state");
+        }
+        const ackSignal = signal?.aborted ? AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS) : signal;
+        const request = createPiServerRequest(ackSignal);
+        const response = await request.postJson("/api/session/run/ack", { sessionId, runId: pending.runId });
+        if (response.status === 404) {
+            const failure = await readPiServerFailure(response);
+            if (!/stream run not found|run not found/i.test(failure.matchText)) {
+                throw new Error(`Session run acknowledgement failed (${failure.details})`);
+            }
+            // The caller only reaches this point after the matching terminal assistant and tree
+            // are fsynced locally. A server-side acknowledged journal may already have expired.
+            if (runStatePath) {
+                acknowledgePiServerPendingRun(runStatePath, pending.runId, Date.now(), lease);
+            }
+            else {
+                sessionPendingRuns.delete(sessionId);
+            }
+            return;
+        }
+        const value = await readPiServerJson(response, "Session run acknowledgement failed");
+        if (!isObject(value) ||
+            value.acknowledged !== true ||
+            value.sessionId !== sessionId ||
+            value.runId !== pending.runId ||
+            value.requestMac !== pending.requestHash ||
+            (value.status !== "completed" && value.status !== "failed") ||
+            !isNonNegativeInteger(value.acknowledgedAt)) {
+            throw new Error("Session run acknowledgement failed (response did not match the terminal pending run)");
+        }
+        if (runStatePath) {
+            acknowledgePiServerPendingRun(runStatePath, pending.runId, Date.now(), lease);
+        }
+        else {
+            sessionPendingRuns.delete(sessionId);
+        }
+    }
+    finally {
+        if (runStatePath && lease && releaseLeaseAfterAcknowledgement) {
+            releasePiServerRunLease(sessionId, runStatePath);
+        }
+    }
+}
+async function cancelPiServerCompact(sessionId, operationId, requestHash) {
+    const request = createPiServerRequest(AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS));
+    const response = await request.postJson("/api/session/compact/cancel", { sessionId, operationId, requestHash });
+    const value = await readPiServerJson(response, "Session compaction cancel failed");
+    if (!isObject(value) ||
+        (value.canceled !== true && value.canceled !== false) ||
+        value.sessionId !== sessionId ||
+        value.operationId !== operationId ||
+        value.requestHash !== requestHash ||
+        value.status !== "failed" ||
+        value.resultStatus !== 499) {
+        throw new PiServerCompactProtocolError("Session compaction cancel failed (response identity was invalid)");
+    }
+    return parsePiServerCompactTerminalPayload(value.terminal, sessionId, operationId, requestHash, "Session compaction cancel failed");
+}
+async function recoverPiServerRun(sessionId, runId, request, signal) {
+    try {
+        const run = await fetchPiServerRun(sessionId, runId, request);
+        return run ? { status: run.status, requestMac: run.requestMac } : { status: "not_found" };
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            throw error;
+        }
+        if (!isRetryablePiServerInterruption(error)) {
+            throw error;
+        }
+        return {
+            status: "unavailable",
+            details: `recovery request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
     }
-    return readPiServerJson(response, "Session run recovery failed");
 }
-function getKnownServerPrefixIds(sessionId, entries) {
+function getKnownServerPrefixCount(sessionId, entries) {
     const entryCount = sessionTreeEntryCounts.get(sessionId);
     const treeHash = sessionTreeHashes.get(sessionId);
     if (entryCount === undefined || treeHash === undefined || entryCount > entries.length) {
         return undefined;
     }
-    const prefixHashes = buildPiServerTreePrefixHashes(entries);
-    if (prefixHashes[entryCount] !== treeHash) {
+    if (hashLocalTreePrefix(sessionId, entries, entryCount) !== treeHash) {
         return undefined;
     }
-    const ids = new Set(entries.slice(0, entryCount).map((entry) => entry.id));
-    sessionSyncedEntryIds.set(sessionId, ids);
-    return ids;
+    return entryCount;
 }
 function isRecoverableTreeDivergenceError(error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -360,19 +953,18 @@ function isRecoverableMissingServerState(response, errorBody) {
         return false;
     return /Session has no static context|session not found|parent entry .* does not exist|leafId .* does not exist|entry .* already exists/i.test(errorBody);
 }
-async function syncFullPiServerTree(sessionId, context, tree, request) {
+async function syncFullPiServerTree(sessionId, tree, request) {
     await postTreeJson(request, "/api/session/tree/sync", {
         sessionId,
         entries: tree.entries,
         leafId: tree.leafId,
-        staticContext: getStaticContext(context),
     }, "Session tree sync failed");
     markTreeSynced(sessionId, tree);
 }
 function shouldUseServerHistory(sessionId, tree) {
     return !tree.replace && !sessionHasTemporaryTree.has(sessionId) && (sessionTreeEntryCounts.get(sessionId) ?? 0) > 0;
 }
-async function recoverPiServerTreeDivergence(sessionId, context, tree, request, onHistoryReconciled) {
+async function recoverPiServerTreeDivergence(sessionId, tree, request, onHistoryReconciled) {
     if (shouldUseServerHistory(sessionId, tree)) {
         const snapshot = await fetchPiServerHistory(sessionId, request, tree);
         if (snapshot && snapshot.entries.length > 0) {
@@ -380,16 +972,19 @@ async function recoverPiServerTreeDivergence(sessionId, context, tree, request,
             throw new Error("pi-server history differed from local history; local session was reconciled to server history");
         }
     }
-    await syncFullPiServerTree(sessionId, context, tree, request);
+    await syncFullPiServerTree(sessionId, tree, request);
 }
 export async function syncPiServerTree(sessionId, context, tree, options) {
     const request = createPiServerRequest(options?.signal);
     await ensureSessionInit(sessionId, context, request);
-    await syncPiServerTreeWithRequest(sessionId, context, tree, request, options?.onHistoryReconciled);
+    await syncPiServerTreeWithRequest(sessionId, tree, request, options?.onHistoryReconciled);
 }
-async function syncPiServerTreeWithRequest(sessionId, context, tree, request, onHistoryReconciled) {
+async function syncPiServerTreeWithRequest(sessionId, tree, request, onHistoryReconciled) {
     const syncTree = tree;
-    const currentHash = hashEntries(syncTree.entries);
+    const knownServerPrefixCount = !tree.replace && !sessionHasTemporaryTree.has(sessionId)
+        ? getKnownServerPrefixCount(sessionId, syncTree.entries)
+        : undefined;
+    const currentHash = hashLocalTree(sessionId, syncTree.entries);
     const previousHash = sessionTreeHashes.get(sessionId);
     const previousLeafId = sessionTreeLeafIds.get(sessionId);
     if (!tree.replace && previousHash === currentHash) {
@@ -401,7 +996,7 @@ async function syncPiServerTreeWithRequest(sessionId, context, tree, request, on
                 if (!isRecoverableTreeDivergenceError(error)) {
                     throw error;
                 }
-                await recoverPiServerTreeDivergence(sessionId, context, syncTree, request, onHistoryReconciled);
+                await recoverPiServerTreeDivergence(sessionId, syncTree, request, onHistoryReconciled);
                 return;
             }
             sessionTreeLeafIds.set(sessionId, syncTree.leafId);
@@ -409,32 +1004,28 @@ async function syncPiServerTreeWithRequest(sessionId, context, tree, request, on
         markTreeSynced(sessionId, syncTree);
         return;
     }
-    const syncedIds = !tree.replace && !sessionHasTemporaryTree.has(sessionId)
-        ? (sessionSyncedEntryIds.get(sessionId) ?? getKnownServerPrefixIds(sessionId, syncTree.entries))
-        : undefined;
-    if (syncedIds) {
-        const deltaEntries = syncTree.entries.filter((entry) => !syncedIds.has(entry.id));
+    if (knownServerPrefixCount !== undefined) {
+        const deltaEntries = syncTree.entries.slice(knownServerPrefixCount);
         if (deltaEntries.length > 0) {
             try {
                 await postTreeJson(request, "/api/session/tree/append", {
                     sessionId,
                     entries: deltaEntries,
                     leafId: syncTree.leafId,
-                    staticContext: getStaticContext(context),
                 }, "Session tree append failed");
             }
             catch (error) {
                 if (!isRecoverableTreeDivergenceError(error)) {
                     throw error;
                 }
-                await recoverPiServerTreeDivergence(sessionId, context, syncTree, request, onHistoryReconciled);
+                await recoverPiServerTreeDivergence(sessionId, syncTree, request, onHistoryReconciled);
                 return;
             }
             markTreeSynced(sessionId, syncTree);
             return;
         }
     }
-    await recoverPiServerTreeDivergence(sessionId, context, syncTree, request, onHistoryReconciled);
+    await recoverPiServerTreeDivergence(sessionId, syncTree, request, onHistoryReconciled);
 }
 function serializeOptions(options) {
     return {
@@ -452,93 +1043,1104 @@ function serializeOptions(options) {
         websocketConnectTimeoutMs: options?.websocketConnectTimeoutMs,
         maxRetries: options?.maxRetries,
         maxRetryDelayMs: options?.maxRetryDelayMs,
+        env: options?.env,
     };
 }
-export async function compactPiServer(model, context, options) {
-    const sessionId = options?.sessionId ?? "default";
-    const request = createPiServerRequest(options?.signal);
-    await ensureSessionInit(sessionId, context, request);
-    const tree = options?.sessionTree ?? getLinearTreeFromMessages(context.messages);
-    await syncPiServerTreeWithRequest(sessionId, context, tree, request, options?.onHistoryReconciled);
-    const makeBody = () => ({
-        sessionId,
-        model,
-        options: serializeOptions(options),
-        settings: options?.settings,
-        preparation: options?.preparation,
-        customInstructions: options?.customInstructions,
-        baseTreeHash: sessionTreeHashes.get(sessionId) ?? hashEntries(tree.entries),
-        streamResponse: true,
+export function hashPiServerCompactRequest(body) {
+    const serialized = canonicalJsonStringify({
+        protocolVersion: body.protocolVersion,
+        sessionId: body.sessionId,
+        providerExecutionFingerprint: body.providerExecutionFingerprint,
+        model: body.model,
+        options: body.options,
+        settings: body.settings,
+        preparation: body.preparation,
+        extensionCompaction: body.extensionCompaction,
+        customInstructions: body.customInstructions,
+        baseStaticContextHash: body.baseStaticContextHash,
+        baseTreeHash: body.baseTreeHash,
+        baseEntryCount: body.baseEntryCount,
+        baseLeafId: body.baseLeafId,
+        baseRevision: body.baseRevision,
+        streamResponse: body.streamResponse,
+        retry: body.retry,
     });
-    let response = await request.postJson("/api/session/compact", makeBody());
-    if (!response.ok) {
-        let failure = await readPiServerFailure(response);
-        if (!options?.signal?.aborted && isRecoverableMissingServerState(response, failure.matchText)) {
-            resetSessionTracking(sessionId);
-            await ensureSessionInit(sessionId, context, request);
-            await syncPiServerTreeWithRequest(sessionId, context, tree, request, options?.onHistoryReconciled);
-            response = await request.postJson("/api/session/compact", makeBody());
-            if (response.ok) {
-                failure = { details: "", matchText: "" };
-            }
-            else {
-                failure = await readPiServerFailure(response);
-            }
-        }
-        if (!response.ok) {
-            throw new Error(`Server compaction failed (${failure.details})`);
-        }
+    if (serialized === undefined) {
+        throw new Error("Failed to serialize pi-server compaction request identity");
     }
-    const result = await readPiServerCompactResponse(response, "Server compaction failed");
-    if (!result.compaction) {
-        throw new Error("Server compaction response did not include a compaction result");
+    return createHash("sha256").update(serialized).digest("hex");
+}
+function createPiServerCompactAbortError(cancelFailure) {
+    const cancelDetails = cancelFailure === undefined
+        ? ""
+        : ` (cancel request failed: ${cancelFailure instanceof Error ? cancelFailure.message : String(cancelFailure)})`;
+    const error = new Error(`Compaction cancelled${cancelDetails}`);
+    error.name = "AbortError";
+    return error;
+}
+function getPiServerCompactReconnectDelay(attempt) {
+    if (attempt === 0)
+        return 0;
+    return Math.min(1000 * 2 ** Math.min(attempt - 1, 5), PI_SERVER_COMPACT_MAX_RECONNECT_DELAY_MS);
+}
+function getPiServerCompactRecoveryWindowMs(configuredWindowMs) {
+    const environmentValue = process.env.PI_SERVER_COMPACT_RECOVERY_WINDOW_MS;
+    const value = configuredWindowMs ??
+        (environmentValue === undefined ? PI_SERVER_COMPACT_DEFAULT_RECOVERY_WINDOW_MS : Number(environmentValue));
+    if ((!Number.isFinite(value) && value !== Number.POSITIVE_INFINITY) || value <= 0) {
+        throw new Error("pi-server compact recovery window must be positive milliseconds or Infinity (PiServerCompactOptions.piServerRecoveryWindowMs or PI_SERVER_COMPACT_RECOVERY_WINDOW_MS)");
     }
-    const resultEntries = result.entries ??
-        (result.treePatch
-            ? [...tree.entries.slice(0, result.treePatch.entriesFrom), ...result.treePatch.entries]
-            : undefined);
-    const resultLeafId = result.leafId ?? result.treePatch?.leafId;
-    if (!result.compactionEntry || !resultEntries || resultLeafId === undefined) {
-        throw new Error("Server compaction response did not include the updated session tree");
+    return value;
+}
+async function waitForPiServerCompactReconnect(delayMs, signal) {
+    if (signal?.aborted) {
+        throw createPiServerCompactAbortError();
     }
-    markTreeSynced(sessionId, { entries: resultEntries, leafId: resultLeafId });
-    return {
-        compaction: result.compaction,
-        compactionEntry: result.compactionEntry,
-        entries: resultEntries,
-        leafId: resultLeafId,
-        messages: result.messages ?? [],
-    };
+    if (delayMs === 0)
+        return;
+    await new Promise((resolve, reject) => {
+        let timer;
+        const onAbort = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(createPiServerCompactAbortError());
+        };
+        timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMs);
+        timer.unref();
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            onAbort();
+    });
 }
-export async function dropLastPiServerAssistantError(sessionId) {
-    const request = createPiServerRequest();
-    const response = await request.postJson("/api/session/drop-last-assistant-error", { sessionId });
-    await readPiServerJson(response, "Dropping server assistant error failed");
+function getPiServerStreamReconnectDelay(attempt) {
+    if (attempt === 0)
+        return 0;
+    return Math.min(1000 * 2 ** Math.min(attempt - 1, 5), PI_SERVER_STREAM_MAX_RECONNECT_DELAY_MS);
 }
-export async function streamPiServer(model, context, options) {
-    const sessionId = options?.sessionId ?? randomUUID();
-    const runId = randomUUID();
-    const isEphemeralSession = options?.sessionId === undefined;
-    const stream = new PiServerEventStream();
-    const partial = {
-        role: "assistant",
-        stopReason: "stop",
-        content: [],
-        api: model.api,
-        provider: model.provider,
-        model: model.id,
-        usage: {
-            input: 0,
-            output: 0,
-            cacheRead: 0,
-            cacheWrite: 0,
-            totalTokens: 0,
-            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+function getPiServerStreamRecoveryWindowMs(configuredWindowMs) {
+    const environmentValue = process.env.PI_SERVER_STREAM_RECOVERY_WINDOW_MS;
+    const value = configuredWindowMs ??
+        (environmentValue === undefined ? PI_SERVER_STREAM_DEFAULT_RECOVERY_WINDOW_MS : Number(environmentValue));
+    if ((!Number.isFinite(value) && value !== Number.POSITIVE_INFINITY) || value <= 0) {
+        throw new Error("pi-server stream recovery window must be positive milliseconds or Infinity (PiServerStreamOptions.piServerRecoveryWindowMs or PI_SERVER_STREAM_RECOVERY_WINDOW_MS)");
+    }
+    return value;
+}
+function createPiServerStreamAbortError() {
+    const error = new Error("Request aborted by user");
+    error.name = "AbortError";
+    return error;
+}
+async function waitForPiServerStreamReconnect(delayMs, signal) {
+    if (signal?.aborted) {
+        throw createPiServerStreamAbortError();
+    }
+    if (delayMs === 0)
+        return;
+    await new Promise((resolve, reject) => {
+        let timer;
+        const onAbort = () => {
+            if (timer !== undefined)
+                clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            reject(createPiServerStreamAbortError());
+        };
+        timer = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, delayMs);
+        timer.unref();
+        signal?.addEventListener("abort", onAbort, { once: true });
+        if (signal?.aborted)
+            onAbort();
+    });
+}
+function isRecoverablePiServerCompactResponse(response) {
+    return response.status >= 500 || response.status === 408 || response.status === 425 || response.status === 429;
+}
+function parsePiServerCompactTerminalPayload(value, sessionId, operationId, requestHash, errorPrefix) {
+    if (!isObject(value) ||
+        value.protocolVersion !== PI_SERVER_PROTOCOL_VERSION ||
+        value.sessionId !== sessionId ||
+        value.operationId !== operationId ||
+        value.requestHash !== requestHash ||
+        (value.operationDisposition !== "terminal" && value.operationDisposition !== "not_started") ||
+        (value.status !== "failed" && value.status !== "rejected") ||
+        (value.operationDisposition === "terminal" && value.status !== "failed") ||
+        (value.operationDisposition === "not_started" && value.status !== "rejected") ||
+        !Number.isSafeInteger(value.httpStatus) ||
+        value.httpStatus < 100 ||
+        value.httpStatus > 599 ||
+        typeof value.error !== "string" ||
+        value.error.length === 0) {
+        throw new PiServerCompactProtocolError(`${errorPrefix} (terminal operation identity was invalid)`);
+    }
+    return value;
+}
+function normalizePiServerCompactionResult(result, sessionId, operationId, requestHash, tree, base, compactStatePath) {
+    const errorPrefix = "Server compaction failed";
+    const protocolError = (details) => new PiServerCompactProtocolError(`${errorPrefix} (${details})`);
+    if (!isObject(result)) {
+        throw protocolError("protocol v2 response was not an object");
+    }
+    if (result.protocolVersion !== PI_SERVER_PROTOCOL_VERSION) {
+        const received = result.protocolVersion === undefined ? "missing" : JSON.stringify(result.protocolVersion);
+        throw protocolError(`unsupported pi-server protocol version: ${received}; expected ${PI_SERVER_PROTOCOL_VERSION}`);
+    }
+    if (result.sessionId !== sessionId) {
+        throw protocolError("response sessionId did not match the requested session");
+    }
+    if (result.operationId !== operationId) {
+        throw protocolError("response operationId did not match the requested operation");
+    }
+    if (result.requestHash !== requestHash) {
+        throw protocolError("response requestHash did not match the requested operation");
+    }
+    if (!isObject(result.treePatch)) {
+        throw protocolError("protocol v2 response did not include a treePatch");
+    }
+    const patch = result.treePatch;
+    if (patch.baseStaticContextHash !== base.staticContextHash) {
+        throw protocolError("treePatch baseStaticContextHash did not match the submitted context");
+    }
+    if (patch.baseTreeHash !== base.treeHash) {
+        throw protocolError("treePatch baseTreeHash did not match the submitted tree");
+    }
+    if (patch.baseEntryCount !== base.entryCount ||
+        patch.entriesFrom !== base.entryCount ||
+        base.entryCount !== tree.entries.length) {
+        throw protocolError("treePatch entriesFrom did not match the submitted tree");
+    }
+    if (patch.baseLeafId !== base.leafId || tree.leafId !== base.leafId) {
+        throw protocolError("treePatch baseLeafId did not match the submitted tree");
+    }
+    if (patch.baseRevision !== base.revision) {
+        throw protocolError("treePatch baseRevision did not match the submitted revision");
+    }
+    if (!Array.isArray(patch.entries) || patch.entries.length !== 1) {
+        throw protocolError("treePatch must contain exactly one compaction entry");
+    }
+    const rawEntry = patch.entries[0];
+    if (!isObject(rawEntry) ||
+        rawEntry.type !== "compaction" ||
+        typeof rawEntry.id !== "string" ||
+        rawEntry.id.length === 0 ||
+        typeof rawEntry.timestamp !== "string" ||
+        typeof rawEntry.summary !== "string" ||
+        typeof rawEntry.firstKeptEntryId !== "string" ||
+        rawEntry.firstKeptEntryId.length === 0 ||
+        typeof rawEntry.tokensBefore !== "number" ||
+        !Number.isFinite(rawEntry.tokensBefore) ||
+        rawEntry.tokensBefore < 0 ||
+        (rawEntry.retainedTail !== undefined && !Array.isArray(rawEntry.retainedTail)) ||
+        (rawEntry.usage !== undefined && !isObject(rawEntry.usage)) ||
+        (rawEntry.fromHook !== undefined && typeof rawEntry.fromHook !== "boolean") ||
+        !isObject(rawEntry.piServerCompactOperation)) {
+        throw protocolError("treePatch entry was not a valid compaction entry");
+    }
+    const operation = rawEntry.piServerCompactOperation;
+    if (operation.version !== 1 ||
+        operation.operationId !== operationId ||
+        operation.requestHash !== requestHash ||
+        operation.baseStaticContextHash !== base.staticContextHash ||
+        operation.baseTreeHash !== base.treeHash ||
+        operation.baseEntryCount !== base.entryCount ||
+        operation.baseLeafId !== base.leafId ||
+        operation.baseRevision !== base.revision) {
+        throw protocolError("compaction entry durable operation metadata did not match the request");
+    }
+    if (rawEntry.parentId !== tree.leafId) {
+        throw protocolError("compaction entry parentId did not match the submitted leaf");
+    }
+    if (tree.entries.some((entry) => entry.id === rawEntry.id)) {
+        throw protocolError("compaction entry id already existed in the submitted tree");
+    }
+    if (patch.leafId !== rawEntry.id) {
+        throw protocolError("treePatch leafId did not match the compaction entry");
+    }
+    if (!isNonNegativeInteger(patch.revision) || patch.revision !== base.revision + 1) {
+        throw protocolError("treePatch revision did not advance the submitted revision exactly once");
+    }
+    const compactionEntry = rawEntry;
+    const entries = [...tree.entries, compactionEntry];
+    if (typeof patch.treeHash !== "string" || !/^[a-f0-9]{64}$/i.test(patch.treeHash)) {
+        throw protocolError("treePatch treeHash was not a valid digest");
+    }
+    if (hashEntries(entries) !== patch.treeHash) {
+        throw protocolError("treePatch treeHash did not match the updated tree");
+    }
+    const branch = buildPiServerActiveBranch(entries, compactionEntry.id, errorPrefix);
+    const compaction = {
+        summary: compactionEntry.summary,
+        firstKeptEntryId: compactionEntry.firstKeptEntryId,
+        tokensBefore: compactionEntry.tokensBefore,
+        retainedTail: compactionEntry.retainedTail,
+        details: compactionEntry.details,
+        usage: compactionEntry.usage,
+    };
+    return {
+        sessionId,
+        compaction,
+        compactionEntry,
+        entries,
+        leafId: compactionEntry.id,
+        messages: convertToLlm(buildSessionContext(branch).messages),
+        operationId,
+        requestHash,
+        revision: patch.revision,
+        treeHash: patch.treeHash,
+        compactStatePath,
+    };
+}
+function parseCompactTerminalFailureBody(bodyText, sessionId, operationId, requestHash, errorPrefix) {
+    let value;
+    try {
+        value = JSON.parse(bodyText);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isObject(value) || value.operationDisposition === undefined)
+        return undefined;
+    return parsePiServerCompactTerminalPayload(value, sessionId, operationId, requestHash, errorPrefix);
+}
+async function acknowledgeObservedPiServerCompactTerminal(pending, compactStatePath, signal) {
+    const observation = pending.observation;
+    if (!observation || observation.kind !== "terminal") {
+        throw new Error("Cannot acknowledge pi-server compaction failure without a durable terminal observation");
+    }
+    if (observation.operationDisposition === "not_started") {
+        acknowledgePiServerPendingCompact(compactStatePath, pending.operationId, "server_rejected_not_started");
+        return;
+    }
+    const ackSignal = signal?.aborted ? AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS) : signal;
+    const request = createPiServerRequest(ackSignal);
+    const response = await request.postJson("/api/session/compact/ack", {
+        sessionId: pending.sessionId,
+        operationId: pending.operationId,
+        requestHash: pending.requestHash,
+    });
+    if (response.status === 404) {
+        const contentType = getResponseContentType(response).toLowerCase();
+        const failure = await readPiServerFailure(response);
+        if (!contentType.includes("application/json") || !/compaction operation not found/i.test(failure.matchText)) {
+            throw new Error(`Session compaction acknowledgement failed (${failure.details})`);
+        }
+        acknowledgePiServerPendingCompact(compactStatePath, pending.operationId, "server_missing_after_terminal_failure");
+        return;
+    }
+    const value = await readPiServerJson(response, "Session compaction acknowledgement failed");
+    if (!isObject(value) ||
+        value.acknowledged !== true ||
+        value.sessionId !== pending.sessionId ||
+        value.operationId !== pending.operationId ||
+        value.requestHash !== pending.requestHash ||
+        value.status !== "failed" ||
+        !isNonNegativeInteger(value.acknowledgedAt)) {
+        throw new Error("Session compaction acknowledgement failed (terminal response identity was invalid)");
+    }
+    acknowledgePiServerPendingCompact(compactStatePath, pending.operationId);
+}
+async function persistAndCompletePiServerCompactTerminal(payload, compactStatePath, signal) {
+    await persistAndAcknowledgePiServerCompactTerminal(payload, compactStatePath, signal);
+    throw new PiServerCompactOperationError(`Server compaction failed (${payload.error})`, payload);
+}
+async function persistAndAcknowledgePiServerCompactTerminal(payload, compactStatePath, signal) {
+    if (!compactStatePath) {
+        throw new Error("Cannot complete pi-server compaction failure without a durable compact-state path");
+    }
+    writePiServerTerminalCompact(compactStatePath, {
+        operationId: payload.operationId,
+        requestHash: payload.requestHash,
+        httpStatus: payload.httpStatus,
+        error: payload.error,
+        operationDisposition: payload.operationDisposition,
+        status: payload.status,
+    });
+    const pending = readPiServerPendingCompact(compactStatePath);
+    if (!pending) {
+        throw new Error("Pi-server compact terminal observation disappeared before acknowledgement");
+    }
+    await acknowledgeObservedPiServerCompactTerminal(pending, compactStatePath, signal);
+}
+export async function compactPiServer(model, context, options) {
+    validateProviderExecutionFingerprint(options?.providerExecutionFingerprint);
+    const sessionId = options?.sessionId ?? "default";
+    const signal = options?.signal;
+    const recoveryWindowMs = getPiServerCompactRecoveryWindowMs(options?.piServerRecoveryWindowMs);
+    const request = createPiServerRequest(options?.signal);
+    const tree = options?.sessionTree ?? getLinearTreeFromMessages(context.messages);
+    const compactStatePath = options?.piServerCompactStatePath;
+    if (!compactStatePath) {
+        throw new Error("Durable pi-server compaction requires a compact-state path");
+    }
+    const recovered = await recoverPendingPiServerCompaction(sessionId, tree, compactStatePath, {
+        signal,
+        recoveryWindowMs,
+    });
+    if (recovered)
+        return recovered;
+    const operationId = randomUUID();
+    let operationSubmissionStarted = false;
+    let requestHash;
+    let cancelPromise;
+    const cancelOperation = () => {
+        if (!operationSubmissionStarted || !requestHash)
+            return Promise.resolve(undefined);
+        cancelPromise ??= cancelPiServerCompact(sessionId, operationId, requestHash);
+        void cancelPromise.catch(() => undefined);
+        return cancelPromise;
+    };
+    const onAbort = () => {
+        void cancelOperation();
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+        await ensureSessionInit(sessionId, context, request);
+        await syncPiServerTreeWithRequest(sessionId, tree, request, options?.onHistoryReconciled);
+        const base = {
+            staticContextHash: sessionStaticContextHashes.get(sessionId) ?? hashStaticContext(context),
+            treeHash: sessionTreeHashes.get(sessionId) ?? hashEntries(tree.entries),
+            entryCount: sessionTreeEntryCounts.get(sessionId) ?? tree.entries.length,
+            leafId: sessionTreeLeafIds.get(sessionId) ?? tree.leafId,
+            revision: sessionTreeRevisions.get(sessionId) ?? 0,
+        };
+        if (base.entryCount !== tree.entries.length || base.leafId !== tree.leafId) {
+            throw new Error("Cannot begin pi-server compaction from an unverified local/server tree identity");
+        }
+        const body = Object.freeze(JSON.parse(JSON.stringify({
+            protocolVersion: PI_SERVER_PROTOCOL_VERSION,
+            sessionId,
+            operationId,
+            providerExecutionFingerprint: options?.providerExecutionFingerprint,
+            model,
+            options: serializeOptions(options),
+            settings: options?.settings,
+            preparation: options?.preparation,
+            extensionCompaction: options?.extensionCompaction,
+            customInstructions: options?.customInstructions,
+            retry: options?.retry,
+            baseStaticContextHash: base.staticContextHash,
+            baseTreeHash: base.treeHash,
+            baseEntryCount: base.entryCount,
+            baseLeafId: base.leafId,
+            baseRevision: base.revision,
+            streamResponse: true,
+        })));
+        const compactRequestHash = hashPiServerCompactRequest(body);
+        requestHash = compactRequestHash;
+        writePiServerPendingCompact(compactStatePath, {
+            serverHash: hashPiServerIdentity(getServerUrl()),
+            sessionId,
+            operationId,
+            requestHash: compactRequestHash,
+            baseStaticContextHash: base.staticContextHash,
+            baseTreeHash: base.treeHash,
+            baseEntryCount: base.entryCount,
+            baseLeafId: base.leafId,
+            baseRevision: base.revision,
+        });
+        let recoveryDeadline;
+        let reconnectAttempt = 0;
+        let lastInterruption;
+        for (;;) {
+            if (signal?.aborted) {
+                throw createPiServerCompactAbortError();
+            }
+            if (recoveryDeadline !== undefined) {
+                const remainingMs = recoveryDeadline - Date.now();
+                if (remainingMs <= 0) {
+                    const details = lastInterruption instanceof Error ? lastInterruption.message : String(lastInterruption);
+                    throw new Error(`Server compaction recovery exhausted for operation ${operationId}: ${details}`);
+                }
+                const delayMs = Math.min(getPiServerCompactReconnectDelay(reconnectAttempt), remainingMs);
+                reconnectAttempt++;
+                await waitForPiServerCompactReconnect(delayMs, signal);
+                if (Date.now() >= recoveryDeadline) {
+                    const details = lastInterruption instanceof Error ? lastInterruption.message : String(lastInterruption);
+                    throw new Error(`Server compaction recovery exhausted for operation ${operationId}: ${details}`);
+                }
+            }
+            let response;
+            try {
+                operationSubmissionStarted = true;
+                response = await request.postJson("/api/session/compact", body);
+            }
+            catch (error) {
+                if (isAbortError(error, signal)) {
+                    throw error;
+                }
+                if (!isRetryablePiServerInterruption(error)) {
+                    throw error;
+                }
+                lastInterruption = error;
+                recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                continue;
+            }
+            if (!response.ok) {
+                let failure;
+                try {
+                    failure = await readPiServerFailure(response);
+                }
+                catch (error) {
+                    if (isAbortError(error, signal)) {
+                        throw error;
+                    }
+                    if (!isRecoverablePiServerCompactResponse(response) || !isRetryablePiServerInterruption(error)) {
+                        throw error;
+                    }
+                    lastInterruption = error;
+                    recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                    continue;
+                }
+                const terminal = parseCompactTerminalFailureBody(failure.bodyText, sessionId, operationId, compactRequestHash, "Server compaction failed");
+                if (terminal) {
+                    if (terminal.httpStatus !== response.status) {
+                        throw new PiServerCompactProtocolError("Server compaction failed (terminal HTTP status did not match the response)");
+                    }
+                    return await persistAndCompletePiServerCompactTerminal(terminal, compactStatePath, signal);
+                }
+                if (isRecoverablePiServerCompactResponse(response)) {
+                    lastInterruption = new Error(`Server compaction failed (${failure.details})`);
+                    recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                    continue;
+                }
+                throw new Error(`Server compaction failed (${failure.details})`);
+            }
+            try {
+                const responseResult = await readPiServerCompactResponse(response, "Server compaction failed");
+                const result = normalizePiServerCompactionResult(responseResult, sessionId, operationId, compactRequestHash, tree, base, compactStatePath);
+                if (signal?.aborted) {
+                    throw createPiServerCompactAbortError();
+                }
+                markTreeSynced(sessionId, { entries: result.entries, leafId: result.leafId });
+                sessionTreeRevisions.set(sessionId, result.revision);
+                return result;
+            }
+            catch (error) {
+                if (error instanceof PiServerCompactOperationError) {
+                    const terminal = parsePiServerCompactTerminalPayload(error.payload, sessionId, operationId, compactRequestHash, "Server compaction failed");
+                    return await persistAndCompletePiServerCompactTerminal(terminal, compactStatePath, signal);
+                }
+                if (error instanceof PiServerCompactProtocolError) {
+                    throw error;
+                }
+                if (isAbortError(error, signal)) {
+                    throw error;
+                }
+                if (!isRetryablePiServerInterruption(error)) {
+                    throw error;
+                }
+                lastInterruption = error;
+                if (error instanceof PiServerCompactInterruptionError && error.observedProgress) {
+                    recoveryDeadline = Date.now() + recoveryWindowMs;
+                    reconnectAttempt = 0;
+                }
+                else {
+                    recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                }
+            }
+        }
+    }
+    catch (error) {
+        if (isAbortError(error, signal)) {
+            let cancelFailure;
+            try {
+                if (!operationSubmissionStarted && requestHash) {
+                    await persistAndAcknowledgePiServerCompactTerminal({
+                        protocolVersion: PI_SERVER_PROTOCOL_VERSION,
+                        sessionId,
+                        operationId,
+                        requestHash,
+                        status: "rejected",
+                        httpStatus: 499,
+                        operationDisposition: "not_started",
+                        error: "Compaction cancelled before server submission",
+                    }, compactStatePath);
+                }
+                else {
+                    const terminal = await cancelOperation();
+                    if (terminal) {
+                        await persistAndAcknowledgePiServerCompactTerminal(terminal, compactStatePath, AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS));
+                    }
+                }
+            }
+            catch (cancelError) {
+                cancelFailure = cancelError;
+            }
+            throw createPiServerCompactAbortError(cancelFailure);
+        }
+        throw error;
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
+    }
+}
+function assertPendingPiServerCompactMatches(pending, sessionId, tree) {
+    if (pending.serverHash !== hashPiServerIdentity(getServerUrl()) ||
+        pending.sessionId !== sessionId ||
+        pending.baseEntryCount > tree.entries.length) {
+        throw new Error(`Cannot safely resume pending pi-server compaction ${pending.operationId}: server, session, or tree identity changed`);
+    }
+    const baseEntries = tree.entries.slice(0, pending.baseEntryCount);
+    if (hashEntries(baseEntries) !== pending.baseTreeHash ||
+        (pending.baseLeafId !== null && !baseEntries.some((entry) => entry.id === pending.baseLeafId))) {
+        throw new Error(`Cannot safely resume pending pi-server compaction ${pending.operationId}: local base tree no longer matches its durable marker`);
+    }
+    if (!pending.observation || pending.observation.kind === "terminal") {
+        if (tree.entries.length !== pending.baseEntryCount || tree.leafId !== pending.baseLeafId) {
+            throw new Error(`Cannot safely resume pending pi-server compaction ${pending.operationId}: local tree changed before a committed compaction was observed`);
+        }
+    }
+    return { entries: baseEntries, leafId: pending.baseLeafId };
+}
+function recoverLocallyAppliedPiServerCompaction(pending, tree, baseTree, compactStatePath) {
+    const applied = pending.observation;
+    if (!applied || applied.kind !== "applied") {
+        throw new Error("Pending pi-server compaction does not contain a durable local apply observation");
+    }
+    const entry = tree.entries[pending.baseEntryCount];
+    if (tree.entries.length !== pending.baseEntryCount + 1 ||
+        !entry ||
+        entry.id !== applied.entryId ||
+        hashPiServerTreeEntry(entry) !== applied.entryHash ||
+        tree.leafId !== applied.updatedLeafId ||
+        applied.updatedLeafId !== applied.entryId ||
+        hashEntries(tree.entries) !== applied.updatedTreeHash ||
+        applied.updatedRevision !== pending.baseRevision + 1) {
+        throw new Error(`Cannot safely resume pending pi-server compaction ${pending.operationId}: local applied tree does not match its durable observation`);
+    }
+    return normalizePiServerCompactionResult({
+        protocolVersion: PI_SERVER_PROTOCOL_VERSION,
+        sessionId: pending.sessionId,
+        operationId: pending.operationId,
+        requestHash: pending.requestHash,
+        treePatch: {
+            baseStaticContextHash: pending.baseStaticContextHash,
+            baseTreeHash: pending.baseTreeHash,
+            baseEntryCount: pending.baseEntryCount,
+            baseLeafId: pending.baseLeafId,
+            baseRevision: pending.baseRevision,
+            entriesFrom: pending.baseEntryCount,
+            entries: [entry],
+            leafId: applied.updatedLeafId,
+            revision: applied.updatedRevision,
+            treeHash: applied.updatedTreeHash,
+        },
+    }, pending.sessionId, pending.operationId, pending.requestHash, baseTree, {
+        staticContextHash: pending.baseStaticContextHash,
+        treeHash: pending.baseTreeHash,
+        entryCount: pending.baseEntryCount,
+        leafId: pending.baseLeafId,
+        revision: pending.baseRevision,
+    }, compactStatePath);
+}
+export async function recoverPendingPiServerCompaction(sessionId, tree, compactStatePath, options) {
+    const pending = readPiServerPendingCompact(compactStatePath);
+    if (!pending)
+        return undefined;
+    const baseTree = assertPendingPiServerCompactMatches(pending, sessionId, tree);
+    const locallyApplied = pending.observation?.kind === "applied"
+        ? recoverLocallyAppliedPiServerCompaction(pending, tree, baseTree, compactStatePath)
+        : undefined;
+    if (pending.observation?.kind === "terminal" && pending.observation.operationDisposition === "not_started") {
+        return await persistAndCompletePiServerCompactTerminal({
+            protocolVersion: PI_SERVER_PROTOCOL_VERSION,
+            sessionId: pending.sessionId,
+            operationId: pending.operationId,
+            requestHash: pending.requestHash,
+            status: pending.observation.status,
+            httpStatus: pending.observation.httpStatus,
+            operationDisposition: pending.observation.operationDisposition,
+            error: pending.observation.error,
+        }, compactStatePath, options?.signal);
+    }
+    const recoveryWindowMs = getPiServerCompactRecoveryWindowMs(options?.recoveryWindowMs);
+    const request = createPiServerRequest(options?.signal);
+    let recoveryDeadline;
+    let reconnectAttempt = 0;
+    let lastInterruption = new Error("pending compaction has not reached a terminal response");
+    for (;;) {
+        if (options?.signal?.aborted) {
+            let cancelFailure;
+            try {
+                const terminal = await cancelPiServerCompact(sessionId, pending.operationId, pending.requestHash);
+                await persistAndAcknowledgePiServerCompactTerminal(terminal, compactStatePath, AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS));
+            }
+            catch (error) {
+                cancelFailure = error;
+            }
+            throw createPiServerCompactAbortError(cancelFailure);
+        }
+        if (recoveryDeadline !== undefined) {
+            const remainingMs = recoveryDeadline - Date.now();
+            if (remainingMs <= 0) {
+                throw new Error(`Pending server compaction recovery exhausted for operation ${pending.operationId}: ${lastInterruption instanceof Error ? lastInterruption.message : String(lastInterruption)}`);
+            }
+            await waitForPiServerCompactReconnect(Math.min(getPiServerCompactReconnectDelay(reconnectAttempt), remainingMs), options?.signal);
+            reconnectAttempt++;
+        }
+        let response;
+        try {
+            response = await request.getJson(`/api/session/${encodeURIComponent(sessionId)}/compactions/${encodeURIComponent(pending.operationId)}?requestHash=${encodeURIComponent(pending.requestHash)}`);
+        }
+        catch (error) {
+            if (!isRetryablePiServerInterruption(error))
+                throw error;
+            lastInterruption = error;
+            recoveryDeadline ??= Date.now() + recoveryWindowMs;
+            continue;
+        }
+        if (!response.ok) {
+            const failure = await readPiServerFailure(response);
+            if (response.status === 404) {
+                if (locallyApplied)
+                    return locallyApplied;
+                if (pending.observation?.kind === "terminal") {
+                    await acknowledgeObservedPiServerCompactTerminal(pending, compactStatePath, options?.signal);
+                    throw new PiServerCompactOperationError(`Pending server compaction failed (${pending.observation.error})`, pending.observation);
+                }
+                throw new Error(`Pending pi-server compaction ${pending.operationId} is missing from the durable server journal; ` +
+                    "the local marker was retained and automatic provider resubmission is disabled");
+            }
+            if (!isRecoverablePiServerCompactResponse(response)) {
+                throw new Error(`Pending server compaction recovery failed (${failure.details})`);
+            }
+            lastInterruption = new Error(`Pending server compaction recovery failed (${failure.details})`);
+            recoveryDeadline ??= Date.now() + recoveryWindowMs;
+            continue;
+        }
+        try {
+            const responseResult = await readPiServerCompactResponse(response, "Pending server compaction recovery failed");
+            const result = normalizePiServerCompactionResult(responseResult, sessionId, pending.operationId, pending.requestHash, baseTree, {
+                staticContextHash: pending.baseStaticContextHash,
+                treeHash: pending.baseTreeHash,
+                entryCount: pending.baseEntryCount,
+                leafId: pending.baseLeafId,
+                revision: pending.baseRevision,
+            }, compactStatePath);
+            if (locallyApplied &&
+                (canonicalJsonStringify(result.compactionEntry) !==
+                    canonicalJsonStringify(locallyApplied.compactionEntry) ||
+                    result.treeHash !== locallyApplied.treeHash ||
+                    result.revision !== locallyApplied.revision)) {
+                throw new PiServerCompactProtocolError("Pending server compaction recovery returned a result that differed from the durably applied tree");
+            }
+            markTreeSynced(sessionId, { entries: result.entries, leafId: result.leafId });
+            sessionTreeRevisions.set(sessionId, result.revision);
+            return result;
+        }
+        catch (error) {
+            if (error instanceof PiServerCompactOperationError) {
+                const terminal = parsePiServerCompactTerminalPayload(error.payload, sessionId, pending.operationId, pending.requestHash, "Pending server compaction recovery failed");
+                return await persistAndCompletePiServerCompactTerminal(terminal, compactStatePath, options?.signal);
+            }
+            if (error instanceof PiServerCompactProtocolError) {
+                throw error;
+            }
+            if (!isRetryablePiServerInterruption(error))
+                throw error;
+            lastInterruption = error;
+            if (error instanceof PiServerCompactInterruptionError && error.observedProgress) {
+                recoveryDeadline = Date.now() + recoveryWindowMs;
+                reconnectAttempt = 0;
+            }
+            else {
+                recoveryDeadline ??= Date.now() + recoveryWindowMs;
+            }
+        }
+    }
+}
+export function recordPiServerCompactionApplied(result) {
+    const compactStatePath = result.compactStatePath;
+    if (!compactStatePath) {
+        throw new Error("Cannot record pi-server compaction apply without a durable compact-state path");
+    }
+    const pending = readPiServerPendingCompact(compactStatePath);
+    if (!pending ||
+        pending.sessionId !== result.sessionId ||
+        pending.operationId !== result.operationId ||
+        pending.requestHash !== result.requestHash) {
+        throw new Error("Cannot record pi-server compaction apply: durable pending marker did not match the result");
+    }
+    writePiServerAppliedCompact(compactStatePath, {
+        operationId: result.operationId,
+        requestHash: result.requestHash,
+        entryId: result.compactionEntry.id,
+        entryHash: hashPiServerTreeEntry(result.compactionEntry),
+        updatedTreeHash: result.treeHash,
+        updatedLeafId: result.compactionEntry.id,
+        updatedRevision: result.revision,
+    });
+}
+export async function acknowledgePiServerCompaction(result, signal) {
+    const compactStatePath = result.compactStatePath;
+    if (!compactStatePath) {
+        throw new Error("Cannot acknowledge pi-server compaction without a durable compact-state path");
+    }
+    const pending = readPiServerPendingCompact(compactStatePath);
+    if (!pending ||
+        pending.sessionId !== result.sessionId ||
+        pending.operationId !== result.operationId ||
+        pending.requestHash !== result.requestHash) {
+        throw new Error("Cannot acknowledge pi-server compaction: durable pending marker did not match the result");
+    }
+    const applied = pending.observation;
+    if (!applied ||
+        applied.kind !== "applied" ||
+        applied.entryId !== result.compactionEntry.id ||
+        applied.entryHash !== hashPiServerTreeEntry(result.compactionEntry) ||
+        applied.updatedTreeHash !== result.treeHash ||
+        applied.updatedLeafId !== result.leafId ||
+        applied.updatedRevision !== result.revision ||
+        result.entries.length !== pending.baseEntryCount + 1 ||
+        hashEntries(result.entries) !== result.treeHash) {
+        throw new Error("Cannot acknowledge pi-server compaction: durable local apply observation did not match the result");
+    }
+    const request = createPiServerRequest(signal);
+    const response = await request.postJson("/api/session/compact/ack", {
+        sessionId: pending.sessionId,
+        operationId: pending.operationId,
+        requestHash: pending.requestHash,
+    });
+    if (response.status === 404) {
+        const contentType = getResponseContentType(response).toLowerCase();
+        const failure = await readPiServerFailure(response);
+        if (!contentType.includes("application/json") || !/compaction operation not found/i.test(failure.matchText)) {
+            throw new Error(`Session compaction acknowledgement failed (${failure.details})`);
+        }
+        acknowledgePiServerPendingCompact(compactStatePath, pending.operationId, "server_missing_after_tree_applied");
+        return;
+    }
+    const value = await readPiServerJson(response, "Session compaction acknowledgement failed");
+    if (!isObject(value) ||
+        value.acknowledged !== true ||
+        value.sessionId !== pending.sessionId ||
+        value.operationId !== pending.operationId ||
+        value.requestHash !== pending.requestHash ||
+        value.status !== "completed" ||
+        !isNonNegativeInteger(value.acknowledgedAt)) {
+        throw new Error("Session compaction acknowledgement failed (response identity was invalid)");
+    }
+    acknowledgePiServerPendingCompact(compactStatePath, pending.operationId);
+}
+export async function dropLastPiServerAssistantError(sessionId) {
+    const request = createPiServerRequest();
+    const response = await request.postJson("/api/session/drop-last-assistant-error", { sessionId });
+    await readPiServerJson(response, "Dropping server assistant error failed");
+}
+function findPendingPiServerRunTerminal(entries, pending) {
+    for (let index = entries.length - 1; index >= 0; index--) {
+        const entry = entries[index];
+        if (entry.type !== "message" || entry.message.role !== "assistant")
+            continue;
+        const message = entry.message;
+        const diagnostic = getPiServerRunDiagnostic(message);
+        if (!diagnostic || diagnostic.runId !== pending.runId)
+            continue;
+        if (diagnostic.sessionId !== pending.sessionId || diagnostic.requestMac !== pending.requestHash) {
+            throw new Error("Cannot recover pi-server run: persisted terminal diagnostic did not match pending state");
+        }
+        return message;
+    }
+    return undefined;
+}
+function assertPendingPiServerRunMatches(pending, serverHash, sessionId, tree) {
+    if (pending.serverHash !== serverHash ||
+        pending.sessionId !== sessionId ||
+        pending.baseEntryCount > tree.entries.length ||
+        hashLocalTreePrefix(sessionId, tree.entries, pending.baseEntryCount) !== pending.baseTreeHash ||
+        pending.baseLeafId !== tree.leafId) {
+        throw new Error(`Cannot safely resume pending pi-server run ${pending.runId}: server, tree, or provider request identity changed`);
+    }
+}
+function missingDurablePiServerRunError(runId, cause) {
+    const prefix = cause ? `${cause}; ` : "";
+    return new Error(`${prefix}pi-server no longer has durable journal for pending run ${runId}. ` +
+        "The provider outcome is unknown and the pending marker was retained. Restore the server journal, " +
+        "or after independently verifying that the provider did not execute, start an explicit new session or fork; " +
+        "automatic provider resubmission is disabled.");
+}
+export async function streamPiServer(model, context, options) {
+    validateProviderExecutionFingerprint(options?.providerExecutionFingerprint);
+    const runMode = options?.runMode;
+    if (runMode === "auxiliary-transient" && options?.piServerRunStatePath) {
+        throw new Error("Auxiliary pi-server streams cannot use the main durable run-state path");
+    }
+    const sessionId = options?.sessionId ?? randomUUID();
+    let runId = randomUUID();
+    const recoveryWindowMs = getPiServerStreamRecoveryWindowMs(options?.piServerRecoveryWindowMs);
+    const isEphemeralSession = runMode === "auxiliary-transient" || options?.sessionId === undefined;
+    const stream = new PiServerEventStream();
+    const partial = {
+        role: "assistant",
+        stopReason: "stop",
+        content: [],
+        api: model.api,
+        provider: model.provider,
+        model: model.id,
+        usage: {
+            input: 0,
+            output: 0,
+            cacheRead: 0,
+            cacheWrite: 0,
+            totalTokens: 0,
+            cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
         },
         timestamp: Date.now(),
     };
     (async () => {
         let phase = "session_init";
+        let receivedProxyEventCount = 0;
+        let runSubmissionStarted = false;
+        let unresolvedRunPending = false;
+        let cancelFailure;
+        let cancelPromise;
+        let transientRunAcknowledged = false;
+        let pendingTransientTerminalEvent;
+        const runStatePath = options?.piServerRunStatePath;
+        let runStateLease;
+        const attachRunStateLease = () => {
+            if (!runStatePath)
+                return;
+            const active = getPersistentRunLease(sessionId, runStatePath);
+            if (active) {
+                if (active.scope !== "session") {
+                    throw new Error(`Cannot start another pi-server run while session ${sessionId} is already streaming`);
+                }
+                runStateLease = active.lease;
+                return;
+            }
+            runStateLease = acquirePersistentRunLease(sessionId, runStatePath);
+        };
+        const releaseRunStateLease = () => {
+            if (!runStatePath || !runStateLease)
+                return;
+            releasePiServerRunLease(sessionId, runStatePath);
+            runStateLease = undefined;
+        };
+        const requestRunCancel = () => {
+            if (!runSubmissionStarted)
+                return Promise.resolve();
+            cancelPromise ??= cancelPiServerRun(sessionId, runId).catch((error) => {
+                cancelFailure = error;
+            });
+            return cancelPromise;
+        };
+        const onAbort = () => {
+            void requestRunCancel();
+        };
+        options?.signal?.addEventListener("abort", onAbort, { once: true });
+        const endStream = () => {
+            options?.signal?.removeEventListener("abort", onAbort);
+            if (isEphemeralSession) {
+                resetSessionTracking(sessionId);
+            }
+            stream.end();
+        };
+        const validateTerminalPendingRun = () => {
+            const diagnostic = getPiServerRunDiagnostic(partial);
+            const pending = runStatePath
+                ? readPiServerPendingRun(runStatePath, runStateLease)
+                : sessionPendingRuns.get(sessionId);
+            if (!diagnostic ||
+                !pending ||
+                diagnostic.sessionId !== sessionId ||
+                diagnostic.sessionId !== pending.sessionId ||
+                diagnostic.runId !== pending.runId ||
+                diagnostic.requestMac !== pending.requestHash) {
+                throw new PiServerStreamProtocolError("Pi-server terminal run diagnostic did not match the pending run");
+            }
+            return runStatePath !== undefined && runStateLease !== undefined;
+        };
+        const getDurableRunEvents = (request, eventCursor) => request.getJson(`/api/session/${encodeURIComponent(sessionId)}/runs/${encodeURIComponent(runId)}/events?from=${eventCursor}`);
+        const acknowledgeTransientTerminal = async (event) => {
+            const message = event.type === "done" ? event.message : event.error;
+            if (!transientRunAcknowledged) {
+                validateTerminalPendingRun();
+                await acknowledgePiServerRunMessage(sessionId, message, undefined, options?.signal);
+                if (sessionPendingRuns.has(sessionId)) {
+                    throw new PiServerStreamProtocolError("Auxiliary pi-server terminal acknowledgement did not clear transient pending state");
+                }
+                transientRunAcknowledged = true;
+            }
+            const cleanupSignal = options?.signal?.aborted
+                ? AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS)
+                : options?.signal;
+            const cleanupRequest = createPiServerRequest(cleanupSignal);
+            const cleanupResponse = await cleanupRequest.deleteJson(`/api/session/${encodeURIComponent(sessionId)}`);
+            const cleanupResult = await readPiServerJson(cleanupResponse, "Auxiliary pi-server session cleanup failed");
+            if (!isObject(cleanupResult) || cleanupResult.deleted !== sessionId) {
+                throw new PiServerStreamProtocolError("Auxiliary pi-server session cleanup response did not match the transient session");
+            }
+            unresolvedRunPending = false;
+            pendingTransientTerminalEvent = undefined;
+            stream.push(event);
+        };
+        const settleStreamFailure = async (failure, retryable = phase === "provider_stream") => {
+            const reason = options?.signal?.aborted ? "aborted" : "error";
+            if (reason === "aborted") {
+                await requestRunCancel();
+                if (cancelFailure === undefined && runSubmissionStarted) {
+                    try {
+                        const recoveryRequest = createPiServerRequest(AbortSignal.timeout(PI_SERVER_CANCEL_TIMEOUT_MS));
+                        const response = await getDurableRunEvents(recoveryRequest, receivedProxyEventCount);
+                        if (response.ok) {
+                            const recovered = await readStreamResponse(response, receivedProxyEventCount, true);
+                            if (recovered.terminal) {
+                                endStream();
+                                return;
+                            }
+                            cancelFailure = recovered.failure;
+                        }
+                        else {
+                            const cancelRecoveryFailure = await readPiServerFailure(response);
+                            cancelFailure = new Error(`pi-server canceled run replay failed: ${cancelRecoveryFailure.details}`);
+                        }
+                    }
+                    catch (error) {
+                        cancelFailure = error;
+                    }
+                }
+            }
+            const initialErrorMessage = failure instanceof Error ? failure.message : String(failure);
+            const errorMessage = cancelFailure === undefined
+                ? initialErrorMessage
+                : `${initialErrorMessage}; pi-server run cancel failed: ${cancelFailure instanceof Error ? cancelFailure.message : String(cancelFailure)}`;
+            partial.stopReason = reason;
+            partial.errorMessage = errorMessage;
+            partial.diagnostics = partial.diagnostics?.filter((diagnostic) => diagnostic.type !== "pi_server_run");
+            partial.diagnostics = [
+                ...(partial.diagnostics ?? []),
+                {
+                    type: "pi_server_failure",
+                    timestamp: Date.now(),
+                    error: { name: failure instanceof Error ? failure.name : "Error", message: errorMessage },
+                    details: {
+                        phase,
+                        source: "pi-server",
+                        retryable: reason === "aborted" ? false : retryable,
+                        runUnresolved: unresolvedRunPending,
+                    },
+                },
+            ];
+            stream.push({
+                type: "error",
+                reason,
+                error: partial,
+            });
+            releaseRunStateLease();
+            endStream();
+        };
+        const readStreamResponse = async (response, eventCursor, ignoreCallerAbort = false) => {
+            let reader;
+            let observedProgress = false;
+            try {
+                try {
+                    await ensurePiServerEventStream(response);
+                }
+                catch (error) {
+                    throw new PiServerStreamProtocolError(`Invalid pi-server stream response: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                reader = response.body.getReader();
+                const decoder = new TextDecoder();
+                const noProgress = createPiServerBodyNoProgressState();
+                const incompleteLineParts = [];
+                let incompleteLineBytes = 0;
+                let replayEventIndex = eventCursor;
+                while (true) {
+                    const { done, value } = await readPiServerBodyChunk(reader, noProgress);
+                    if (done) {
+                        return {
+                            terminal: false,
+                            failure: new Error("pi-server stream ended before a terminal event"),
+                            observedProgress,
+                            recoverable: true,
+                        };
+                    }
+                    if (value.byteLength > 0)
+                        observedProgress = true;
+                    if (!ignoreCallerAbort && options?.signal?.aborted) {
+                        throw new Error("Request aborted by user");
+                    }
+                    incompleteLineBytes = updateEventStreamLineBytes(value, incompleteLineBytes);
+                    if (incompleteLineBytes < 0) {
+                        throw new PiServerStreamProtocolError(`Invalid pi-server stream response: event line exceeded ${PI_SERVER_EVENT_STREAM_MAX_LINE_BYTES} bytes`);
+                    }
+                    const lines = extractDecodedEventStreamLines(decoder.decode(value, { stream: true }), incompleteLineParts);
+                    for (const rawLine of lines) {
+                        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+                        if (!line.startsWith("data: "))
+                            continue;
+                        const data = line.slice(6).trim();
+                        if (!data)
+                            continue;
+                        const eventIndex = replayEventIndex;
+                        replayEventIndex++;
+                        if (eventIndex < receivedProxyEventCount)
+                            continue;
+                        let proxyEvent;
+                        try {
+                            proxyEvent = JSON.parse(data);
+                        }
+                        catch {
+                            throw new PiServerStreamProtocolError(`Invalid pi-server stream event JSON: ${getBodyExcerpt(data)}`);
+                        }
+                        let event;
+                        try {
+                            event = processProxyEvent(proxyEvent, partial);
+                        }
+                        catch (error) {
+                            throw new PiServerStreamProtocolError(`Invalid pi-server stream event: ${error instanceof Error ? error.message : String(error)}`);
+                        }
+                        receivedProxyEventCount++;
+                        if (!event)
+                            continue;
+                        if (event.type === "done" || event.type === "error") {
+                            if (runMode === "auxiliary-transient") {
+                                pendingTransientTerminalEvent = event;
+                                try {
+                                    await acknowledgeTransientTerminal(event);
+                                }
+                                catch (error) {
+                                    return {
+                                        terminal: false,
+                                        failure: error,
+                                        observedProgress: true,
+                                        recoverable: isRetryablePiServerInterruption(error),
+                                    };
+                                }
+                            }
+                            else {
+                                const retainLease = runMode === "main-durable" || runStatePath !== undefined
+                                    ? validateTerminalPendingRun()
+                                    : false;
+                                if (!retainLease) {
+                                    releaseRunStateLease();
+                                }
+                                stream.push(event);
+                            }
+                            void reader.cancel().catch(() => undefined);
+                            return { terminal: true };
+                        }
+                        stream.push(event);
+                    }
+                }
+            }
+            catch (error) {
+                void reader?.cancel().catch(() => undefined);
+                return {
+                    terminal: false,
+                    failure: error,
+                    observedProgress,
+                    recoverable: isRetryablePiServerInterruption(error),
+                };
+            }
+        };
         try {
             const request = createPiServerRequest(options?.signal);
             await ensureSessionInit(sessionId, context, request);
@@ -547,120 +2149,287 @@ export async function streamPiServer(model, context, options) {
                 replace: true,
             };
             const syncTree = tree;
-            phase = "tree_sync";
-            await syncPiServerTreeWithRequest(sessionId, context, syncTree, request, options?.onHistoryReconciled);
-            const makeBody = () => ({
+            if (runStatePath) {
+                attachRunStateLease();
+            }
+            let pending = runStatePath
+                ? readPiServerPendingRun(runStatePath, runStateLease)
+                : sessionPendingRuns.get(sessionId);
+            unresolvedRunPending = pending !== undefined;
+            let treeSynced = false;
+            if (pending) {
+                const persistedTerminal = findPendingPiServerRunTerminal(syncTree.entries, pending);
+                if (persistedTerminal) {
+                    phase = "tree_sync";
+                    await syncPiServerTreeWithRequest(sessionId, syncTree, request, options?.onHistoryReconciled);
+                    treeSynced = true;
+                    await acknowledgePiServerRunMessage(sessionId, persistedTerminal, runStatePath, options?.signal);
+                    if (runStatePath) {
+                        attachRunStateLease();
+                    }
+                    pending = undefined;
+                    unresolvedRunPending = false;
+                }
+            }
+            const buildRequestIdentity = (baseTreeHash, baseEntryCount, baseLeafId, baseStaticContextHash, baseRevision) => JSON.parse(JSON.stringify({
                 sessionId,
-                runId,
+                runMode,
                 model,
                 options: serializeOptions(options),
+                providerExecutionFingerprint: options?.providerExecutionFingerprint,
                 ephemeralMessages: options?.ephemeralMessages,
                 contextOverlay: options?.contextOverlay,
+                baseTreeHash,
+                baseEntryCount,
+                baseLeafId,
+                baseStaticContextHash,
+                baseRevision,
+            }));
+            let baseTreeHash = pending?.baseTreeHash ?? hashLocalTree(sessionId, syncTree.entries);
+            let baseEntryCount = pending?.baseEntryCount ?? syncTree.entries.length;
+            let baseLeafId = pending?.baseLeafId ?? syncTree.leafId;
+            let baseStaticContextHash = hashStaticContext(context);
+            let baseRevision = sessionTreeRevisions.get(sessionId) ?? 0;
+            let requestIdentity = buildRequestIdentity(baseTreeHash, baseEntryCount, baseLeafId, baseStaticContextHash, baseRevision);
+            let requestHash = hashPiServerStreamRequest(requestIdentity);
+            let resumedPendingRun = false;
+            let recoveredPendingRun;
+            if (pending) {
+                assertPendingPiServerRunMatches(pending, hashPiServerIdentity(getServerUrl()), sessionId, syncTree);
+                runId = pending.runId;
+                phase = "provider_stream";
+                recoveredPendingRun = await recoverPiServerRun(sessionId, runId, request, options?.signal);
+                if (recoveredPendingRun.status === "not_found") {
+                    throw missingDurablePiServerRunError(pending.runId);
+                }
+                else {
+                    resumedPendingRun = true;
+                    runSubmissionStarted = true;
+                    requestHash = pending.requestHash;
+                }
+            }
+            if (!pending) {
+                if (!treeSynced) {
+                    phase = "tree_sync";
+                    await syncPiServerTreeWithRequest(sessionId, syncTree, request, options?.onHistoryReconciled);
+                    treeSynced = true;
+                }
+                baseTreeHash = hashLocalTree(sessionId, syncTree.entries);
+                baseEntryCount = syncTree.entries.length;
+                baseLeafId = syncTree.leafId;
+                baseStaticContextHash = sessionStaticContextHashes.get(sessionId) ?? hashStaticContext(context);
+                baseRevision = sessionTreeRevisions.get(sessionId) ?? 0;
+                requestIdentity = buildRequestIdentity(baseTreeHash, baseEntryCount, baseLeafId, baseStaticContextHash, baseRevision);
+                requestHash = hashPiServerStreamRequest(requestIdentity);
+                const pendingInput = {
+                    serverHash: hashPiServerIdentity(getServerUrl()),
+                    sessionId,
+                    runId,
+                    baseTreeHash,
+                    baseEntryCount,
+                    baseLeafId,
+                    requestHash,
+                };
+                const newPending = runStatePath
+                    ? writePiServerPendingRun(runStatePath, pendingInput, runStateLease)
+                    : {
+                        version: 1,
+                        kind: "run",
+                        sequence: 0,
+                        timestamp: Date.now(),
+                        ...pendingInput,
+                    };
+                if (!runStatePath)
+                    sessionPendingRuns.set(sessionId, newPending);
+                unresolvedRunPending = true;
+            }
+            const makeBody = (eventCursor) => ({
+                ...requestIdentity,
+                runId,
+                eventCursor,
             });
+            const getRunEvents = (eventCursor) => getDurableRunEvents(request, eventCursor);
             phase = "provider_stream";
-            let response = await request.postJson("/api/stream", makeBody());
-            if (!response.ok) {
+            const postStream = async (eventCursor) => {
+                runSubmissionStarted = true;
+                if (options?.signal?.aborted) {
+                    throw new Error("Request aborted by user");
+                }
+                return request.postJson("/api/stream", makeBody(eventCursor));
+            };
+            let response;
+            let activeResponse;
+            let activeEventCursor = 0;
+            let interruption = new Error("pi-server stream ended before a terminal event");
+            try {
+                if (resumedPendingRun) {
+                    if (recoveredPendingRun?.status === "running" ||
+                        recoveredPendingRun?.status === "completed" ||
+                        recoveredPendingRun?.status === "failed") {
+                        if (recoveredPendingRun.requestMac !== requestHash) {
+                            throw new Error("Pending pi-server run request identity did not match durable server state");
+                        }
+                        response = await getRunEvents(0);
+                    }
+                    else {
+                        interruption = new Error(`pi-server pending run recovery was unavailable: ${recoveredPendingRun?.status === "unavailable"
+                            ? recoveredPendingRun.details
+                            : "unknown recovery state"}`);
+                    }
+                }
+                else {
+                    response = await postStream(0);
+                }
+            }
+            catch (error) {
+                if (isAbortError(error, options?.signal))
+                    throw error;
+                if (!isRetryablePiServerInterruption(error))
+                    throw error;
+                interruption = error;
+            }
+            if (response && !response.ok) {
                 let failure = await readPiServerFailure(response);
                 if (!options?.signal?.aborted && isRecoverableMissingServerState(response, failure.matchText)) {
                     resetSessionTracking(sessionId);
+                    phase = "session_init";
                     await ensureSessionInit(sessionId, context, request);
-                    await syncPiServerTreeWithRequest(sessionId, context, syncTree, request, options?.onHistoryReconciled);
-                    response = await request.postJson("/api/stream", makeBody());
-                    if (response.ok) {
-                        failure = { details: "", matchText: "" };
+                    phase = "tree_sync";
+                    await syncPiServerTreeWithRequest(sessionId, syncTree, request, options?.onHistoryReconciled);
+                    phase = "provider_stream";
+                    try {
+                        response = await postStream(receivedProxyEventCount);
                     }
-                    else {
+                    catch (error) {
+                        if (isAbortError(error, options?.signal))
+                            throw error;
+                        if (!isRetryablePiServerInterruption(error))
+                            throw error;
+                        response = undefined;
+                        interruption = error;
+                    }
+                    if (response && !response.ok) {
                         failure = await readPiServerFailure(response);
                     }
                 }
-                if (!response.ok) {
-                    throw new Error(`pi-server error: ${failure.details}`);
+                if (response && !response.ok) {
+                    const retryable = isTransientPiServerResponse(response, failure.bodyText);
+                    const responseError = new PiServerHttpResponseError(`pi-server error: ${failure.details}`, response.status, retryable);
+                    if (!retryable)
+                        throw responseError;
+                    interruption = responseError;
                 }
             }
-            await ensurePiServerEventStream(response);
-            const reader = response.body.getReader();
-            const decoder = new TextDecoder();
-            let buffer = "";
+            if (response?.ok) {
+                activeResponse = response;
+                activeEventCursor = receivedProxyEventCount;
+            }
+            let reconnectAttempt = 0;
+            let recoveryDeadline;
             while (true) {
-                const { done, value } = await reader.read();
-                if (done)
-                    break;
+                if (pendingTransientTerminalEvent) {
+                    try {
+                        await acknowledgeTransientTerminal(pendingTransientTerminalEvent);
+                        endStream();
+                        return;
+                    }
+                    catch (error) {
+                        if (!isRetryablePiServerInterruption(error)) {
+                            await settleStreamFailure(error, false);
+                            return;
+                        }
+                        interruption = error;
+                        recoveryDeadline = Date.now() + recoveryWindowMs;
+                        reconnectAttempt = 0;
+                    }
+                }
+                if (activeResponse) {
+                    const result = await readStreamResponse(activeResponse, activeEventCursor);
+                    if (result.terminal) {
+                        endStream();
+                        return;
+                    }
+                    if (!result.recoverable) {
+                        await settleStreamFailure(result.failure, false);
+                        return;
+                    }
+                    interruption = result.failure;
+                    activeResponse = undefined;
+                    if (result.observedProgress) {
+                        recoveryDeadline = Date.now() + recoveryWindowMs;
+                        reconnectAttempt = 0;
+                    }
+                    else {
+                        recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                    }
+                }
                 if (options?.signal?.aborted) {
                     throw new Error("Request aborted by user");
                 }
-                buffer += decoder.decode(value, { stream: true });
-                const lines = buffer.split("\n");
-                buffer = lines.pop() || "";
-                for (const line of lines) {
-                    if (line.startsWith("data: ")) {
-                        const data = line.slice(6).trim();
-                        if (!data)
-                            continue;
-                        const proxyEvent = JSON.parse(data);
-                        const event = processProxyEvent(proxyEvent, partial);
-                        if (event) {
-                            stream.push(event);
-                        }
-                    }
+                recoveryDeadline ??= Date.now() + recoveryWindowMs;
+                const recoveredRun = await recoverPiServerRun(sessionId, runId, request, options?.signal);
+                const hasDurableRun = recoveredRun.status === "running" ||
+                    recoveredRun.status === "completed" ||
+                    recoveredRun.status === "failed";
+                if (hasDurableRun && recoveredRun.requestMac !== requestHash) {
+                    await settleStreamFailure(new Error("pi-server recovered run request identity did not match the pending provider request"), false);
+                    return;
+                }
+                if (recoveredRun.status === "not_found") {
+                    const failureMessage = interruption instanceof Error ? interruption.message : String(interruption);
+                    await settleStreamFailure(missingDurablePiServerRunError(runId, failureMessage), false);
+                    return;
+                }
+                if (recoveredRun.status === "unavailable") {
+                    const failureMessage = interruption instanceof Error ? interruption.message : String(interruption);
+                    interruption = new Error(`${failureMessage}; pi-server run recovery was unavailable: ${recoveredRun.details}`);
+                }
+                const remainingMs = recoveryDeadline - Date.now();
+                if (remainingMs <= 0) {
+                    const failureMessage = interruption instanceof Error ? interruption.message : String(interruption);
+                    await settleStreamFailure(new Error(`${failureMessage}; pi-server stream recovery exhausted after ${recoveryWindowMs}ms`), false);
+                    return;
+                }
+                const delayMs = Math.min(getPiServerStreamReconnectDelay(reconnectAttempt), remainingMs);
+                reconnectAttempt++;
+                await waitForPiServerStreamReconnect(delayMs, options?.signal);
+                if (Date.now() >= recoveryDeadline) {
+                    const failureMessage = interruption instanceof Error ? interruption.message : String(interruption);
+                    await settleStreamFailure(new Error(`${failureMessage}; pi-server stream recovery exhausted after ${recoveryWindowMs}ms`), false);
+                    return;
                 }
-            }
-            if (options?.signal?.aborted) {
-                throw new Error("Request aborted by user");
-            }
-            if (isEphemeralSession) {
-                resetSessionTracking(sessionId);
-            }
-            stream.end();
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            if (!options?.signal?.aborted && phase === "provider_stream") {
                 try {
-                    const recoveredRun = await fetchPiServerRun(sessionId, runId, createPiServerRequest());
-                    if (recoveredRun?.status === "completed" && recoveredRun.message) {
-                        switch (recoveredRun.message.stopReason) {
-                            case "stop":
-                            case "length":
-                            case "toolUse":
-                                stream.push({
-                                    type: "done",
-                                    reason: recoveredRun.message.stopReason,
-                                    message: recoveredRun.message,
-                                });
-                                break;
-                            case "aborted":
-                                stream.push({ type: "error", reason: "aborted", error: recoveredRun.message });
-                                break;
-                            case "error":
-                                stream.push({ type: "error", reason: "error", error: recoveredRun.message });
-                                break;
+                    const eventCursor = receivedProxyEventCount;
+                    if (recoveredRun.status === "unavailable") {
+                        continue;
+                    }
+                    const reconnectResponse = await getRunEvents(eventCursor);
+                    if (!reconnectResponse.ok) {
+                        const failure = await readPiServerFailure(reconnectResponse);
+                        if (!isTransientPiServerResponse(reconnectResponse, failure.bodyText)) {
+                            await settleStreamFailure(new Error(`pi-server reconnect failed: ${failure.details}`), false);
+                            return;
                         }
-                        stream.end();
-                        return;
+                        interruption = new Error(`pi-server reconnect failed: ${failure.details}`);
+                        continue;
                     }
+                    activeResponse = reconnectResponse;
+                    activeEventCursor = eventCursor;
                 }
-                catch {
-                    // Keep the original stream error authoritative.
+                catch (error) {
+                    if (isAbortError(error, options?.signal)) {
+                        throw error;
+                    }
+                    if (!isRetryablePiServerInterruption(error)) {
+                        await settleStreamFailure(error, false);
+                        return;
+                    }
+                    interruption = error;
                 }
             }
-            const reason = options?.signal?.aborted ? "aborted" : "error";
-            partial.stopReason = reason;
-            partial.errorMessage = errorMessage;
-            partial.diagnostics = [
-                ...(partial.diagnostics ?? []),
-                {
-                    type: "pi_server_failure",
-                    timestamp: Date.now(),
-                    error: { name: error instanceof Error ? error.name : "Error", message: errorMessage },
-                    details: { phase, source: "pi-server", retryable: phase === "provider_stream" },
-                },
-            ];
-            stream.push({
-                type: "error",
-                reason,
-                error: partial,
-            });
-            stream.end();
+        }
+        catch (error) {
+            await settleStreamFailure(error, false);
         }
     })();
     return stream;
@@ -683,6 +2452,8 @@ function processProxyEvent(proxyEvent, partial) {
         case "text_end": {
             const content = partial.content[proxyEvent.contentIndex];
             if (content?.type === "text") {
+                if (proxyEvent.content !== undefined)
+                    content.text = proxyEvent.content;
                 content.textSignature = proxyEvent.contentSignature;
                 return { type: "text_end", contentIndex: proxyEvent.contentIndex, content: content.text, partial };
             }
@@ -702,25 +2473,34 @@ function processProxyEvent(proxyEvent, partial) {
         case "thinking_end": {
             const content = partial.content[proxyEvent.contentIndex];
             if (content?.type === "thinking") {
+                if (proxyEvent.content !== undefined)
+                    content.thinking = proxyEvent.content;
                 content.thinkingSignature = proxyEvent.contentSignature;
+                content.redacted = proxyEvent.redacted;
                 return { type: "thinking_end", contentIndex: proxyEvent.contentIndex, content: content.thinking, partial };
             }
             throw new Error("Received thinking_end for non-thinking content");
         }
-        case "toolcall_start":
-            partial.content[proxyEvent.contentIndex] = {
+        case "toolcall_start": {
+            const partialToolCall = {
                 type: "toolCall",
                 id: proxyEvent.id,
                 name: proxyEvent.toolName,
                 arguments: {},
                 partialJson: "",
             };
+            partial.content[proxyEvent.contentIndex] = partialToolCall;
             return { type: "toolcall_start", contentIndex: proxyEvent.contentIndex, partial };
+        }
         case "toolcall_delta": {
             const content = partial.content[proxyEvent.contentIndex];
             if (content?.type === "toolCall") {
-                content.partialJson += proxyEvent.delta;
-                content.arguments = parseStreamingJson(content.partialJson) || {};
+                const partialToolCall = content;
+                if (partialToolCall.partialJson === undefined) {
+                    throw new Error("Received toolcall_delta without an active partial tool call");
+                }
+                partialToolCall.partialJson += proxyEvent.delta;
+                content.arguments = parseStreamingJson(partialToolCall.partialJson) || {};
                 partial.content[proxyEvent.contentIndex] = { ...content };
                 return { type: "toolcall_delta", contentIndex: proxyEvent.contentIndex, delta: proxyEvent.delta, partial };
             }
@@ -729,24 +2509,46 @@ function processProxyEvent(proxyEvent, partial) {
         case "toolcall_end": {
             const content = partial.content[proxyEvent.contentIndex];
             if (content?.type === "toolCall") {
-                delete content.partialJson;
-                return { type: "toolcall_end", contentIndex: proxyEvent.contentIndex, toolCall: content, partial };
+                const toolCall = proxyEvent.toolCall ?? content;
+                delete toolCall.partialJson;
+                toolCall.thoughtSignature = proxyEvent.thoughtSignature ?? toolCall.thoughtSignature;
+                partial.content[proxyEvent.contentIndex] = toolCall;
+                return { type: "toolcall_end", contentIndex: proxyEvent.contentIndex, toolCall, partial };
             }
             return undefined;
         }
         case "done":
+            if (proxyEvent.reason !== "stop" && proxyEvent.reason !== "length" && proxyEvent.reason !== "toolUse") {
+                throw new Error(`Received invalid terminal done reason: ${String(proxyEvent.reason)}`);
+            }
             partial.stopReason = proxyEvent.reason;
             partial.usage = proxyEvent.usage;
+            partial.api = proxyEvent.api ?? partial.api;
+            partial.provider = proxyEvent.provider ?? partial.provider;
+            partial.model = proxyEvent.model ?? partial.model;
+            partial.timestamp = proxyEvent.timestamp ?? partial.timestamp;
+            partial.responseModel = proxyEvent.responseModel;
+            partial.responseId = proxyEvent.responseId;
+            partial.diagnostics = proxyEvent.diagnostics;
             return { type: "done", reason: proxyEvent.reason, message: partial };
         case "error":
+            if (proxyEvent.reason !== "aborted" && proxyEvent.reason !== "error") {
+                throw new Error(`Received invalid terminal error reason: ${String(proxyEvent.reason)}`);
+            }
             partial.stopReason = proxyEvent.reason;
             partial.errorMessage = proxyEvent.errorMessage;
             partial.usage = proxyEvent.usage;
+            partial.api = proxyEvent.api ?? partial.api;
+            partial.provider = proxyEvent.provider ?? partial.provider;
+            partial.model = proxyEvent.model ?? partial.model;
+            partial.timestamp = proxyEvent.timestamp ?? partial.timestamp;
+            partial.responseModel = proxyEvent.responseModel;
+            partial.responseId = proxyEvent.responseId;
+            partial.diagnostics = proxyEvent.diagnostics;
             return { type: "error", reason: proxyEvent.reason, error: partial };
         default: {
             const _exhaustiveCheck = proxyEvent;
-            console.warn(`Unhandled proxy event type: ${proxyEvent.type}`);
-            return undefined;
+            throw new Error(`Unhandled proxy event: ${String(_exhaustiveCheck)}`);
         }
     }
 }