@blackbelt-technology/pi-agent-dashboard 0.5.2 → 0.5.4

package/packages/extension/src/__tests__/fixtures/usage-limit-error-strings.ts

@@ -0,0 +1,127 @@
+/**
+ * Real-world usage-limit / quota / billing error strings extracted from
+ * production session logs (~/.pi/agent/sessions/**\/*.jsonl) plus
+ * representative samples from provider docs. Used as fixtures for the
+ * USAGE_LIMIT_PATTERN regex coverage tests.
+ *
+ * See change: fix-retry-banner-stuck-on-limit-exceeded.
+ */
+
+export interface UsageLimitFixture {
+  provider: string;
+  /** A short label for the test name. */
+  label: string;
+  /** The verbatim errorMessage string as it appears on the wire. */
+  error: string;
+}
+
+/**
+ * Strings the broadened USAGE_LIMIT_PATTERN MUST match (terminal —
+ * dashboard shows red banner, no retry).
+ */
+export const USAGE_LIMIT_FIXTURES: UsageLimitFixture[] = [
+  {
+    provider: "google-generative-ai",
+    label: "Gemini monthly spending cap (real fixture, BME-szakdoga session)",
+    error: JSON.stringify({
+      error: {
+        message:
+          "Your project has exceeded its monthly spending cap. Please go to AI Studio at https://ai.studio/spend to manage your project spend cap. Learn more at https://ai.google.dev/gemini-api/docs/billing#project-spend-caps. ",
+        status: "RESOURCE_EXHAUSTED",
+      },
+      code: 429,
+      status: "Too Many Requests",
+    }),
+  },
+  {
+    provider: "google-generative-ai",
+    label: "Gemini RESOURCE_EXHAUSTED standalone",
+    error: '{"error":{"status":"RESOURCE_EXHAUSTED","code":429}}',
+  },
+  {
+    provider: "google",
+    label: "Cloud Code Assist quota reset after Nh",
+    error:
+      "Cloud Code Assist API error (429): You have exhausted your capacity on this model. Your quota will reset after 50h27m20s.",
+  },
+  {
+    provider: "openai-codex-responses",
+    label: "Codex usage_limit_reached",
+    error: "usage_limit_reached: 5000 RPM exceeded",
+  },
+  {
+    provider: "openai-codex-responses",
+    label: "Codex usage_not_included",
+    error: "usage_not_included for this account",
+  },
+  {
+    provider: "openai",
+    label: "OpenAI insufficient_quota",
+    error:
+      'You exceeded your current quota, please check your plan and billing details. {"code":"insufficient_quota"}',
+  },
+  {
+    provider: "anthropic",
+    label: "Anthropic credit balance too low",
+    error:
+      'Your credit balance is too low to access the Anthropic API. Please go to https://console.anthropic.com/billing to add credits.',
+  },
+  {
+    provider: "github-copilot",
+    label: "Copilot daily limit",
+    error: "You have reached the daily limit for free GitHub Copilot users",
+  },
+  {
+    provider: "anthropic",
+    label: "Anthropic quota_exceeded snake-case",
+    error: "quota_exceeded: monthly token allotment used",
+  },
+];
+
+/**
+ * Strings the broadened USAGE_LIMIT_PATTERN MUST NOT match (transient —
+ * pi-coding-agent retries internally; dashboard shows yellow banner only).
+ */
+export const NON_USAGE_LIMIT_FIXTURES: UsageLimitFixture[] = [
+  {
+    provider: "anthropic",
+    label: "Anthropic transient overloaded",
+    error: '{"type":"overloaded_error","message":"Anthropic is currently overloaded"}',
+  },
+  {
+    provider: "google",
+    label: "Gemini 503 transient high demand",
+    error:
+      '{"error":{"code":503,"message":"This model is currently experiencing high demand. Spikes in demand are usually temporary. Please try again later.","status":"UNAVAILABLE"}}',
+  },
+  {
+    provider: "unknown",
+    label: "Generic fetch failed",
+    error: "fetch failed",
+  },
+  {
+    provider: "unknown",
+    label: "Generic timeout",
+    error: "Request timed out.",
+  },
+  {
+    provider: "unknown",
+    label: "Generic connection error",
+    error: "Connection error.",
+  },
+  {
+    provider: "unknown",
+    label: "Tool execution failed (not a provider error)",
+    error: "tool execution failed",
+  },
+  {
+    provider: "anthropic",
+    label: "Anthropic 502 Bad Gateway",
+    error: "502 Bad Gateway",
+  },
+  {
+    provider: "unknown",
+    label: "Empty error message",
+    error: "",
+  },
+];

package/packages/extension/src/__tests__/source-detector.test.ts

@@ -26,6 +26,21 @@ describe("detectSessionSource", () => {
     expect(detectSessionSource(undefined, sessionFile)).toBe("dashboard");
   });
 
+  it("should return 'tui' (not 'dashboard') when a TUI is attached, even if .meta.json says dashboard", () => {
+    // Defends against event-wiring's pendingDashboardSpawns by-cwd matcher
+    // mis-tagging a CLI pi launched in the same cwd as a dashboard Spawn.
+    const sessionFile = path.join(tmpDir, "test.jsonl");
+    writeSessionMeta(sessionFile, { source: "dashboard" });
+    expect(detectSessionSource(true, sessionFile)).toBe("tui");
+  });
+
+  it("should return 'tmux' when TUI is attached inside tmux, even if .meta.json says dashboard", () => {
+    process.env.TMUX = "/tmp/tmux/default";
+    const sessionFile = path.join(tmpDir, "test.jsonl");
+    writeSessionMeta(sessionFile, { source: "dashboard" });
+    expect(detectSessionSource(true, sessionFile)).toBe("tmux");
+  });
+
   it("should return 'zed' when ZED_TERM is set and hasUI is false", () => {
     process.env.ZED_TERM = "1";
     expect(detectSessionSource(false)).toBe("zed");

package/packages/extension/src/__tests__/usage-limit-orderer.test.ts

@@ -1,5 +1,6 @@
 import { describe, it, expect } from "vitest";
 import { UsageLimitOrderer, USAGE_LIMIT_PATTERN } from "../usage-limit-orderer.js";
+import { USAGE_LIMIT_FIXTURES, NON_USAGE_LIMIT_FIXTURES } from "./fixtures/usage-limit-error-strings.js";
 
 describe("UsageLimitOrderer", () => {
   it("returns null when no retry was pending", () => {
@@ -60,6 +61,17 @@ describe("UsageLimitOrderer", () => {
     expect(USAGE_LIMIT_PATTERN.test(msg)).toBe(false);
   });
 
+  // Real production-log fixtures — see change: fix-retry-banner-stuck-on-limit-exceeded.
+  describe("USAGE_LIMIT_PATTERN broadened coverage (production fixtures)", () => {
+    it.each(USAGE_LIMIT_FIXTURES)("matches terminal: [$provider] $label", ({ error }) => {
+      expect(USAGE_LIMIT_PATTERN.test(error)).toBe(true);
+    });
+
+    it.each(NON_USAGE_LIMIT_FIXTURES)("does not match transient: [$provider] $label", ({ error }) => {
+      expect(USAGE_LIMIT_PATTERN.test(error)).toBe(false);
+    });
+  });
+
   it("clears pending after agent_end (no double-synthesis on subsequent agent_end)", () => {
     const o = new UsageLimitOrderer();
     o.noteRetryStart("s1");

package/packages/extension/src/bridge-default-model-gate.ts

@@ -0,0 +1,32 @@
+/**
+ * Pure gate predicate for the bridge's default-model application.
+ *
+ * Decides whether the bridge should call `pi.setModel()` with `config.defaultModel`
+ * at `session_start` time.
+ *
+ * Rule: apply default only on brand-new sessions (no prior entries on disk).
+ * Resumed (`--session`), forked (`--fork`, parent entries copied by
+ * `SessionManager.forkFrom`), and reloaded sessions all have entries > 0 and
+ * SHALL keep their existing model. Mirrors pi's own `!hasExistingSession`
+ * gate in `buildSessionOptions` (`pi-coding-agent/dist/main.js`).
+ *
+ * See change: fix-resume-keeps-session-model.
+ */
+export interface DefaultModelGateInput {
+  /** `event.reason` from the pi `session_start` event. */
+  reason: string | undefined;
+  /** `ctx.sessionManager.getEntries().length` at session_start. */
+  entryCount: number;
+  /** Whether the bridge has captured a model registry from pi yet. */
+  hasModelRegistry: boolean;
+  /** Whether `config.defaultModel` is set to a non-empty string. */
+  hasDefaultModel: boolean;
+}
+
+export function shouldApplyDefaultModel(args: DefaultModelGateInput): boolean {
+  if (args.reason !== "startup") return false;
+  if (args.entryCount !== 0) return false;
+  if (!args.hasModelRegistry) return false;
+  if (!args.hasDefaultModel) return false;
+  return true;
+}

package/packages/extension/src/bridge.ts

@@ -10,6 +10,7 @@ import { ConnectionManager } from "./connection.js";
 import { detectSessionSource } from "./source-detector.js";
 import { mapEventToProtocol } from "./event-forwarder.js";
 import { createCommandHandler } from "./command-handler.js";
+import { shouldApplyDefaultModel } from "./bridge-default-model-gate.js";
 import { RetryTracker } from "./retry-tracker.js";
 import { UsageLimitOrderer } from "./usage-limit-orderer.js";
 import fs from "node:fs";
@@ -41,6 +42,7 @@ import { sendModelUpdateIfChanged as _sendModelUpdateIfChanged, sendSessionNameI
 import { registerFlowEventListeners, FLOW_EVENT_MAP, SUBAGENT_EVENT_MAP } from "./flow-event-wiring.js";
 import { refreshUiModules, subscribeUiInvalidate, handleUiManagement, type UiModulesBridgeCtx } from "./ui-modules.js";
 import { inlineMessageText, type ReadFileOutcome } from "./markdown-image-inliner.js";
+import type { ImageContent } from "@blackbelt-technology/pi-dashboard-shared/types.js";
 
 const HEARTBEAT_INTERVAL = 15_000;
 const GIT_POLL_INTERVAL = 30_000;
@@ -200,6 +202,74 @@ function initBridge(pi: ExtensionAPI) {
   const retryTracker = new RetryTracker();
   const usageLimitOrderer = new UsageLimitOrderer();
 
+  // Bridge-owned shadow queues. Pi's ExtensionAPI does NOT forward
+  // `queue_update` events to extensions (verified in pi-coding-agent 0.71+),
+  // so the bridge tracks steering + follow-up state itself by mirroring every
+  // mutation it performs on pi (sends, clears, edits) plus the natural drain
+  // boundaries (turn_end clears steering, agent_end clears followUp).
+  // The bridge is the source of truth that all browser clients converge on
+  // via `queue_update` ExtensionToServerMessage.
+  // See change: add-followup-edit-and-steer-cancel.
+  let bridgeSteering: string[] = [];
+  let bridgeFollowUp: string[] = [];
+  function emitQueueUpdate(): void {
+    if (!isActive() || !sessionReady) return;
+    connection.send({
+      type: "queue_update",
+      sessionId,
+      steering: [...bridgeSteering],
+      followUp: [...bridgeFollowUp],
+    });
+  }
+  function recordSteerSent(text: string): void {
+    // Only record when the agent was actually streaming at send time. Idle
+    // sends start a new turn directly — pi doesn't queue them, so the
+    // shadow queue must not show a chip. See change: add-followup-edit-and-steer-cancel.
+    if (!getBridgeState().isAgentStreaming) return;
+    bridgeSteering.push(text);
+    emitQueueUpdate();
+  }
+  /** v2 soft cap on follow-up queue depth. See design.md Decision 8. */
+  const FOLLOWUP_QUEUE_CAP = 20;
+  function recordFollowupSent(text: string): void {
+    if (!getBridgeState().isAgentStreaming) return;
+    // v2: multi-entry queue (was cap-1 in v1). Soft-cap; drop silently when over.
+    if (bridgeFollowUp.length >= FOLLOWUP_QUEUE_CAP) {
+      console.warn("[dashboard] follow-up queue at soft cap (" + FOLLOWUP_QUEUE_CAP + "); dropping new entry");
+      return;
+    }
+    bridgeFollowUp.push(text);
+    emitQueueUpdate();
+  }
+  /**
+   * Mirror of pi's `_getUserMessageText` (pi-coding-agent agent-session.js).
+   * Used by the per-entry shadow-queue drain matcher in the `message_start`
+   * handler. Joining all text blocks (and dropping non-text content) keeps
+   * matching parity with pi's internal queue logic.
+   */
+  function extractUserMessageText(message: any): string {
+    if (!message || message.role !== "user") return "";
+    const content = message.content;
+    if (typeof content === "string") return content;
+    if (!Array.isArray(content)) return "";
+    return content
+      .filter((c: any) => c && c.type === "text")
+      .map((c: any) => c.text ?? "")
+      .join("");
+  }
+
+  /** v2 helper: rewrite the entire follow-up queue + replay to pi. */
+  function rewriteFollowupQueue(newEntries: string[]): void {
+    const capped = newEntries.slice(0, FOLLOWUP_QUEUE_CAP);
+    const clearFn = (pi as any).clearFollowUpQueue;
+    if (typeof clearFn === "function") clearFn.call(pi);
+    for (const t of capped) {
+      (pi.sendUserMessage as any)(t, { deliverAs: "followUp" });
+    }
+    bridgeFollowUp = [...capped];
+    emitQueueUpdate();
+  }
+
   /** Forward a synthesized auto_retry_* event using the standard event_forward shape. */
   const sendSyntheticRetryEvent = (eventType: string, data: Record<string, unknown>): void => {
     if (!isActive() || !sessionReady) return;
@@ -572,6 +642,64 @@ function initBridge(pi: ExtensionAPI) {
         }
         return;
       }
+      // Pi-native queue control: route the three new browser messages
+      // straight to pi's clear/send APIs. See change: add-followup-edit-and-steer-cancel.
+      if (msg.type === "clear_steering_queue") {
+        if (msg.sessionId === sessionId) {
+          const fn = (pi as any).clearSteeringQueue;
+          if (typeof fn === "function") fn.call(pi);
+          else console.warn("[dashboard] pi.clearSteeringQueue unavailable (pi version)");
+          bridgeSteering = [];
+          emitQueueUpdate();
+        }
+        return;
+      }
+      if (msg.type === "clear_followup_slot") {
+        if (msg.sessionId === sessionId) {
+          const fn = (pi as any).clearFollowUpQueue;
+          if (typeof fn === "function") fn.call(pi);
+          else console.warn("[dashboard] pi.clearFollowUpQueue unavailable (pi version)");
+          bridgeFollowUp = [];
+          emitQueueUpdate();
+        }
+        return;
+      }
+      if (msg.type === "edit_followup_slot") {
+        // v1 backward-compat path: "replace ALL follow-up entries with this one text."
+        // v2 clients prefer `edit_followup_entry { index: 0 }`. See change: add-followup-edit-and-steer-cancel.
+        if (msg.sessionId === sessionId) {
+          rewriteFollowupQueue([msg.text]);
+        }
+        return;
+      }
+      if (msg.type === "promote_followup_entry") {
+        if (msg.sessionId === sessionId) {
+          const idx = msg.index;
+          if (idx < 0 || idx >= bridgeFollowUp.length) return;
+          const head = bridgeFollowUp[idx];
+          const rest = bridgeFollowUp.filter((_, i) => i !== idx);
+          rewriteFollowupQueue([head, ...rest]);
+        }
+        return;
+      }
+      if (msg.type === "remove_followup_entry") {
+        if (msg.sessionId === sessionId) {
+          const idx = msg.index;
+          if (idx < 0 || idx >= bridgeFollowUp.length) return;
+          const surviving = bridgeFollowUp.filter((_, i) => i !== idx);
+          rewriteFollowupQueue(surviving);
+        }
+        return;
+      }
+      if (msg.type === "edit_followup_entry") {
+        if (msg.sessionId === sessionId) {
+          const idx = msg.index;
+          if (idx < 0 || idx >= bridgeFollowUp.length) return;
+          const next = bridgeFollowUp.map((t, i) => (i === idx ? msg.text : t));
+          rewriteFollowupQueue(next);
+        }
+        return;
+      }
       const response = await commandHandler.handle(msg);
       if (response) connection.send(response);
       // Immediately send model/thinking update after handling set_thinking_level
@@ -656,6 +784,33 @@ function initBridge(pi: ExtensionAPI) {
       setTimeout(() => sendModelUpdateIfChanged(), 50);
     },
     shutdown: () => {
+      // Reset shadow queues + clear pi's native queues BEFORE cachedCtx.shutdown()
+      // so the bridge is still in a known-good state when the final queue_update
+      // is emitted. Pi's own teardown may fire events the bridge no longer
+      // processes after cachedCtx.shutdown(). Mirrors the session-change reset
+      // pattern at handleSessionChange (~bridge.ts:1709). See change:
+      // reset-shadow-queues-on-shutdown and capability mid-turn-prompt-queue
+      // requirement "Session shutdown resets shadow queues and clears pi's
+      // native queues".
+      try {
+        if (typeof (pi as any).clearSteeringQueue === "function") {
+          (pi as any).clearSteeringQueue();
+        }
+      } catch (err) {
+        console.warn("[dashboard] pi.clearSteeringQueue threw during shutdown:", err);
+      }
+      try {
+        if (typeof (pi as any).clearFollowUpQueue === "function") {
+          (pi as any).clearFollowUpQueue();
+        }
+      } catch (err) {
+        console.warn("[dashboard] pi.clearFollowUpQueue threw during shutdown:", err);
+      }
+      if (bridgeSteering.length > 0 || bridgeFollowUp.length > 0) {
+        bridgeSteering = [];
+        bridgeFollowUp = [];
+        emitQueueUpdate();
+      }
       if (cachedCtx?.shutdown) {
         cachedCtx.shutdown();
       }
@@ -664,6 +819,28 @@ function initBridge(pi: ExtensionAPI) {
       setTimeout(() => process.exit(0), 500);
     },
     abort: () => {
+      // Mirror shutdown-time reset: clear pi's native queues + bridge shadows
+      // so queued steers/follow-ups don't deliver after the user clicked Stop.
+      // See change: reset-shadow-queues-on-shutdown (extended scope).
+      try {
+        if (typeof (pi as any).clearSteeringQueue === "function") {
+          (pi as any).clearSteeringQueue();
+        }
+      } catch (err) {
+        console.warn("[dashboard] pi.clearSteeringQueue threw during abort:", err);
+      }
+      try {
+        if (typeof (pi as any).clearFollowUpQueue === "function") {
+          (pi as any).clearFollowUpQueue();
+        }
+      } catch (err) {
+        console.warn("[dashboard] pi.clearFollowUpQueue threw during abort:", err);
+      }
+      if (bridgeSteering.length > 0 || bridgeFollowUp.length > 0) {
+        bridgeSteering = [];
+        bridgeFollowUp = [];
+        emitQueueUpdate();
+      }
       if (cachedCtx?.abort) {
         cachedCtx.abort();
       }
@@ -695,7 +872,7 @@ function initBridge(pi: ExtensionAPI) {
     spawnNew: () => {
       connection.send({ type: "spawn_new_session", sessionId, cwd: process.cwd() });
     },
-    sessionPrompt: async (text) => {
+    sessionPrompt: async (text, delivery) => {
       // Route slash commands: management events, flow:run, extension dispatch, then fallback.
       // See change: fix-extension-slash-commands-in-dashboard.
       if (text.startsWith("/") && pi.events) {
@@ -727,12 +904,24 @@ function initBridge(pi: ExtensionAPI) {
       if (handled) return;
 
       // Fallback: send as user message (template-expanded).
-      // Uses deliverAs:followUp so it queues properly when agent is streaming.
-      // expandPromptTemplateFromDisk handles skill commands (/skill:xxx) and
-      // prompt templates by reading the file content from disk.
+      // Uses delivery param to choose deliverAs: "steer" or "followUp".
+      // Defaults to "followUp" when delivery is absent (backward compatible).
+      // v2: follow-up sends APPEND to the queue (capacity-1 invariant dropped).
+      // See change: add-followup-edit-and-steer-cancel design.md Decision 8.
+      // Capture pre-send streaming state BEFORE pi.sendUserMessage — idle
+      // sends synchronously fire agent_start which flips the flag.
+      const deliverAs = delivery ?? ("followUp" as const);
+      const wasStreaming = getBridgeState().isAgentStreaming;
       const expanded = expandPromptTemplateFromDisk(text, process.cwd(), pi);
-      (pi.sendUserMessage as any)(expanded, { deliverAs: "followUp" });
+      (pi.sendUserMessage as any)(expanded, { deliverAs });
+      if (wasStreaming) {
+        if (deliverAs === "steer") recordSteerSent(expanded);
+        else recordFollowupSent(expanded);
+      }
     },
+    onSteerSent: recordSteerSent,
+    onFollowupSent: recordFollowupSent,
+    isStreaming: () => getBridgeState().isAgentStreaming === true,
   });
 
   // Reload support: extension events only provide ExtensionContext (no reload).
@@ -858,6 +1047,12 @@ function initBridge(pi: ExtensionAPI) {
             sendSyntheticRetryEvent(trackerSynth.eventType, trackerSynth.data);
           }
         }
+        // Bridge shadow follow-up queue: the per-entry drain matcher in
+        // the `message_start` handler removes each entry as pi delivers it
+        // (mirrors pi's internal `_processAgentEvent`). No bulk clear here
+        // — it would wipe entries the user adds DURING the drain window.
+        // See change: add-followup-edit-and-steer-cancel (per-entry-drain).
+
       }
       // For model_select, enrich the event data with thinkingLevel
       if (eventType === "model_select") {
@@ -883,6 +1078,17 @@ function initBridge(pi: ExtensionAPI) {
       // We do NOT attach entryId here — the message has no id yet on pi
       // 0.69+ (persistence is deferred to message_end). See change:
       // fix-per-message-fork.
+      //
+      // USER message_start sends are deferred via setTimeout(0) so they
+      // land on the wire AFTER any pending message_end deferrals (which
+      // also use setTimeout(0) — timer FIFO preserves order). Without this,
+      // a follow-up user message_start emitted synchronously by pi during
+      // an agent_end drain would arrive BEFORE the preceding assistant
+      // message_end, and the client reducer would append the user bubble
+      // above the assistant's final response. ASSISTANT message_start stays
+      // sync because message_update events fire sync and the reducer's
+      // streamingTextFlushed reset depends on message_start being processed
+      // first. See change: add-followup-edit-and-steer-cancel (chat-order).
       if (eventType === "message_start") {
         wrapAppendMessageForCtx(ctx);
         const messageRef = (event as any).message;
@@ -891,7 +1097,40 @@ function initBridge(pi: ExtensionAPI) {
           pendingNonces.set(messageRef as object, nonce);
           const enriched = { ...event, nonce };
           const msg = mapEventToProtocol(sessionId, enriched);
-          connection.send(msg);
+          const role = (messageRef as any).role;
+          if (role === "user") {
+            // Per-entry shadow-queue drain: mirror pi's internal logic
+            // (`_processAgentEvent` in pi-coding-agent agent-session.js).
+            // When pi delivers a queued user message, find its text in
+            // `bridgeSteering` first then `bridgeFollowUp`, remove the
+            // first occurrence, and emit a fresh `queue_update` so the
+            // dashboard shrinks the visible queue immediately rather than
+            // bulk-clearing it at the final agent_end/turn_end. This is
+            // the only mechanism that updates the shadow on drain — the
+            // previous bulk clears were removed because they would also
+            // wipe entries the user adds DURING a drain. See change:
+            // add-followup-edit-and-steer-cancel (per-entry-drain).
+            const text = extractUserMessageText(messageRef);
+            if (text) {
+              const sIdx = bridgeSteering.indexOf(text);
+              if (sIdx !== -1) {
+                bridgeSteering.splice(sIdx, 1);
+                emitQueueUpdate();
+              } else {
+                const fIdx = bridgeFollowUp.indexOf(text);
+                if (fIdx !== -1) {
+                  bridgeFollowUp.splice(fIdx, 1);
+                  emitQueueUpdate();
+                }
+              }
+            }
+            setTimeout(() => {
+              if (!isActive() || !sessionReady) return;
+              connection.send(msg);
+            }, 0);
+          } else {
+            connection.send(msg);
+          }
           return;
         }
       }
@@ -919,6 +1158,30 @@ function initBridge(pi: ExtensionAPI) {
         // messages immediately so they precede the deferred message_end
         // send below. See change: chat-markdown-local-images-and-math.
         maybeInlineAssistantImages(event);
+        // Run retry-tracker / usage-limit-orderer SYNCHRONOUSLY here, BEFORE
+        // the handler returns. Both the state update AND the synth event
+        // send must be sync so they land on the wire BEFORE the next
+        // `agent_end` (which pi fires synchronously back-to-back, see
+        // pi-coding-agent agent-session.js:298–331).
+        //
+        // Previously these ran inside the setTimeout(0) macrotask intended
+        // for entryId capture, so `agent_end` was processed (and shipped)
+        // BEFORE the synthesizers had marked the retry as in-flight —
+        // leaving the dashboard's `retryState` stuck (yellow + red banners
+        // both visible). The message_end body itself stays deferred for
+        // the entryId workaround (`fix-per-message-fork`); it doesn't
+        // affect retry-state ordering since the reducer's message_end arm
+        // does not touch retryState/lastError.
+        // See change: fix-retry-banner-stuck-on-limit-exceeded.
+        const synthetic = retryTracker.observeMessageEnd(sessionId, messageRef as any);
+        if (synthetic) {
+          if (synthetic.eventType === "auto_retry_start") {
+            usageLimitOrderer.noteRetryStart(sessionId);
+          } else {
+            usageLimitOrderer.noteRetryEnd(sessionId);
+          }
+          sendSyntheticRetryEvent(synthetic.eventType, synthetic.data);
+        }
         setTimeout(() => {
           if (!isActive() || !sessionReady) return;
           const entryId =
@@ -928,18 +1191,6 @@ function initBridge(pi: ExtensionAPI) {
           const enriched = { ...event, entryId, nonce };
           const protoMsg = mapEventToProtocol(sessionId, enriched);
           connection.send(protoMsg);
-          // After forwarding the original message_end, ask the retry tracker
-          // whether to synthesize an auto_retry_* event. See change:
-          // fix-provider-retry-infinite-loop.
-          const synthetic = retryTracker.observeMessageEnd(sessionId, messageRef as any);
-          if (synthetic) {
-            sendSyntheticRetryEvent(synthetic.eventType, synthetic.data);
-            if (synthetic.eventType === "auto_retry_start") {
-              usageLimitOrderer.noteRetryStart(sessionId);
-            } else {
-              usageLimitOrderer.noteRetryEnd(sessionId);
-            }
-          }
         }, 0);
         return;
       }
@@ -967,6 +1218,17 @@ function initBridge(pi: ExtensionAPI) {
     }));
   }
 
+  // Pi does NOT forward `queue_update` events to extensions (verified in
+  // pi-coding-agent 0.71+ — see _emitExtensionEvent allowlist). Bridge
+  // tracks the shadow queues itself; drain happens on observed boundaries:
+  // turn_end drains steering (pi's mode:"all" delivers all queued steers),
+  // agent_end drains follow-up (pi has no more tool calls).
+  // See change: add-followup-edit-and-steer-cancel.
+  // Bridge shadow steering queue: per-entry drain matcher in the
+  // `message_start` handler removes each entry as pi delivers it. No bulk
+  // clear here — it would wipe entries the user adds DURING the drain.
+  // See change: add-followup-edit-and-steer-cancel (per-entry-drain).
+
   // EventBus catch-all: intercept pi.events.emit to forward all EventBus
   // traffic (flow events, subagent events, custom extension events).
   // Known channels get renamed via EVENT_BUS_MAP; unknown channels use the
@@ -1333,8 +1595,18 @@ function initBridge(pi: ExtensionAPI) {
       } catch { /* modelRegistry not available */ }
     }
 
-    // Apply default model on new sessions only (not reload/resume/fork)
-    if (_event?.reason === "startup" && cachedModelRegistry) {
+    // Apply default model only on brand-new sessions (no prior entries on disk).
+    // Resume (--session) and fork (--fork) both load parent entries, so entryCount > 0
+    // and we keep their existing model. Mirrors pi's own !hasExistingSession gate.
+    // See change: fix-resume-keeps-session-model.
+    const entryCount = ctx.sessionManager.getEntries?.()?.length ?? 0;
+    const freshConfig = loadConfig();
+    if (shouldApplyDefaultModel({
+      reason: _event?.reason,
+      entryCount,
+      hasModelRegistry: Boolean(cachedModelRegistry),
+      hasDefaultModel: Boolean(freshConfig.defaultModel),
+    })) {
       pendingDefaultModel = applyDefaultModel();
     }
 
@@ -1482,6 +1754,13 @@ function initBridge(pi: ExtensionAPI) {
 
   // Shared handler for session changes (new/fork/resume)
   function handleSessionChange(ctx: any) {
+    // Bridge shadow queues reset on session change so the new session
+    // starts with empty chips. See change: add-followup-edit-and-steer-cancel.
+    if (bridgeSteering.length > 0 || bridgeFollowUp.length > 0) {
+      bridgeSteering = [];
+      bridgeFollowUp = [];
+      emitQueueUpdate();
+    }
     const bc = syncBc();
     _handleSessionChange(bc, ctx, getFlowsList);
     applyBc(bc);