@chainingintention/pi-web-cn 2.0.0 → 2.202610.0

package/dist/server/sessiond.js

@@ -1,37 +1,50 @@
 #!/usr/bin/env node
 import { mkdir, rm } from "node:fs/promises";
+import { loadNodeTranslator } from "../localization.js";
 import { dirname, join } from "node:path";
 import { homedir } from "node:os";
 import Fastify from "fastify";
 import fastifyWebsocket from "@fastify/websocket";
+import { handleWebSocketError, installPluginBackendChannelWebSocketPayloadLimit } from "./webSocketBridge.js";
 import { WorkspaceActivityService } from "./activity/workspaceActivityService.js";
 import { registerWorkspaceActivityRoutes } from "./activity/workspaceActivityRoutes.js";
 import { MachineStatusService } from "./status/machineStatusService.js";
 import { registerMachineStatusRoutes } from "./status/machineStatusRoutes.js";
 import { CachedWorkspaceAttribution } from "./status/workspaceAttribution.js";
 import { SessionEventHub } from "./realtime/sessionEventHub.js";
-import { AuthService, createLocalOnlyModelRuntime } from "./sessions/authService.js";
+import { ServerNoticeStore } from "./notices/serverNoticeStore.js";
+import { ServerNoticeService } from "./notices/serverNoticeService.js";
+import { registerServerNoticeRoutes } from "./notices/serverNoticeRoutes.js";
+import { AuthService } from "./sessions/authService.js";
 import { ProjectAuthService } from "./sessions/projectAuthService.js";
+import { ModelCatalogRefresher } from "./sessions/modelCatalogRefresher.js";
+import { SessionArchiveStore, defaultSessionArchiveFilePath } from "./sessions/sessionArchiveStore.js";
+import { SessionNotificationStore } from "./sessions/sessionNotificationStore.js";
 import { registerAuthRoutes } from "./sessions/authRoutes.js";
+import { registerMcpAuthRoutes } from "./sessions/mcpAuthRoutes.js";
 import { PiSessionService } from "./sessions/piSessionService.js";
 import { createPiSessionManagerGateway } from "./sessions/piSessionManagerGateway.js";
 import { registerSessionRoutes } from "./sessions/sessionRoutes.js";
 import { ProjectScopedSpawnTargetResolver } from "./sessions/spawnTargetResolver.js";
 import { ProjectService } from "./projects/projectService.js";
-import { ProjectStore } from "./storage/projectStore.js";
-import { WorkspaceService } from "./workspaces/workspaceService.js";
+import { ProjectLifecycleService } from "./projects/projectLifecycleService.js";
+import { ProjectStore, projectStorePath } from "./storage/projectStore.js";
+import { FileSessionUnreadPersistence, SessionUnreadStore, defaultSessionUnreadFilePath } from "./sessions/sessionUnreadStore.js";
 import { sessiondSocketPath } from "../sessiond/config.js";
-import { TerminalService } from "./terminals/terminalService.js";
-import { registerTerminalRoutes } from "./terminals/terminalRoutes.js";
+import { ManagementCommandRunService } from "./terminals/managementCommandRunService.js";
+import { registerManagementTerminalRoutes } from "./terminals/managementTerminalRoutes.js";
+import { REQUIRED_TERMINAL_SERVICE_CAPABILITY, unavailableRequiredTerminalService } from "./terminals/requiredTerminalService.js";
 import { getPiWebRuntimeComponent } from "./piWebStatus.js";
 import { SESSIOND_RUNTIME_CAPABILITIES } from "../shared/capabilities.js";
-import { DEFAULT_MANAGEMENT_AUDIT_INDEX_PREFIX, DEFAULT_MANAGEMENT_AUDIT_RETENTION_DAYS, DEFAULT_NORMAL_TOOL_AUDIT_MAX_ROWS, DEFAULT_NORMAL_TOOL_AUDIT_RETENTION_DAYS, PI_CODING_AGENT_DIR_ENV, PI_CODING_AGENT_SESSION_DIR_ENV, agentSessionDirEnvKeys, agentSessionDirEnvOverride, effectivePiWebConfig, maxUploadBytes, piWebDataDir } from "../config.js";
-import { createActiveAgentProfileDescriptor } from "../sessiond/activeAgentProfile.js";
+import { DEFAULT_MANAGEMENT_AUDIT_INDEX_PREFIX, DEFAULT_MANAGEMENT_AUDIT_RETENTION_DAYS, DEFAULT_NORMAL_TOOL_AUDIT_MAX_ROWS, DEFAULT_NORMAL_TOOL_AUDIT_RETENTION_DAYS, PI_CODING_AGENT_DIR_ENV, PI_CODING_AGENT_SESSION_DIR_ENV, agentSessionDirEnvKeys, agentSessionDirEnvOverride, effectivePiWebConfig, maxUploadBytes, offlineModeEnabled, piWebDataDir, sessionArchiveDirectory } from "../config.js";
+import { createActiveAgentProfileDescriptor, publicActiveAgentProfileDescriptor } from "../sessiond/activeAgentProfile.js";
 import { scrubNonAgentVisibleEnvKeys } from "./sessiond/agentProcessEnvironment.js";
 import { claimSessiondStateOwnership } from "./sessiond/sessiondStateOwnership.js";
 import { dockerEnvironmentPromptSections } from "./sessions/dockerEnvironmentFacts.js";
 import { PI_WEB_SESSION_ENV, sessionEnvironmentPromptSections } from "./sessions/sessionEnvironmentFacts.js";
 import { runSessionDaemonStartup } from "./sessiond/sessionDaemonStartup.js";
+import { runSessionDaemonShutdown } from "./sessiond/sessionDaemonShutdown.js";
+import { applyAgentHttpIdleTimeout } from "./sessiond/agentHttpDispatcher.js";
 import { requestLoggerOptions } from "./requestLogging.js";
 import { WorkbenchAccessStateStore } from "./workbench/accessStateStore.js";
 import { registerWorkbenchAccessStateRoutes } from "./workbench/accessStateRoutes.js";
@@ -42,19 +55,45 @@ import { NormalToolAuditStore, normalToolAuditDatabasePath } from "./audit/norma
 import { ManagementAuditStore } from "./audit/managementAuditStore.js";
 import { managementProjectIdForCwd, projectsFromManagedEmbedContext } from "./managementEmbed.js";
 import { managementContextFromEventScope, NORMAL_SESSION_EVENT_SCOPE } from "./realtime/sessionEventScope.js";
-import { PiWebPluginCatalog } from "./piWebPluginCatalog.js";
+import { DefaultPiPackageProvider, PiWebPluginCatalog } from "./piWebPluginCatalog.js";
+import { createDefaultPiPackageService } from "./piPackageService.js";
+import { PiPackageDismissalStore, piPackageDismissalStorePath } from "./storage/piPackageDismissalStore.js";
+import { reconcileAutoInstallablePiPackages } from "./sessiond/autoInstallPiPackages.js";
 import { loadServerPluginRecoveryConfig } from "../serverPluginRecovery.js";
 import { createServerPluginExecFile } from "./plugins/serverPluginExec.js";
+import { PI_WEB_HOST_PI_SESSION_EVENTS_CAPABILITY, PI_WEB_HOST_PI_SESSIONS_CAPABILITY, PI_WEB_HOST_WORKSPACES_CAPABILITY, } from "../server-plugin-api.js";
 import { createServerPluginRuntime } from "./plugins/serverPluginRuntime.js";
+import { ProjectPluginSettingsSnapshots } from "./plugins/projectPluginSettings.js";
+import { createWorkspaceNotificationCommandFactory } from "./workspaces/workspaceNotificationCommand.js";
+import { WorkspaceChangeNotifier } from "./workspaces/workspaceChangeNotifier.js";
+import { registerWorkspaceNotificationRoutes } from "./sessiond/workspaceNotificationRoutes.js";
+import { createServerPluginPiSessionEventsCapabilityFactory } from "./plugins/serverPluginPiSessionEventsCapability.js";
+import { createServerPluginPiSessionsCapabilityFactory } from "./plugins/serverPluginPiSessionsCapability.js";
+import { createServerPluginWorkspacesCapabilityFactory } from "./plugins/serverPluginWorkspacesCapability.js";
 import { eligibleWorkspaceProviderContributions, WorkspaceProviderRegistry } from "./workspaces/workspaceProviderRegistry.js";
+import { eligiblePluginBackendContributions, PluginBackendRegistry } from "./plugins/pluginBackendRegistry.js";
+import { createServerPluginCatalogCapabilityFactory } from "./plugins/serverPluginCatalogCapability.js";
+import { PI_WEB_HOST_CATALOG_CAPABILITY } from "../shared/pluginCatalogTypes.js";
+import { registerPluginCatalogRoutes } from "./sessiond/pluginCatalogRoutes.js";
+import { PiSessionEventConnections } from "./sessions/piSessionEventConnections.js";
+import { bindCompanionBackend } from "./sessions/companionBackend.js";
 import { createWorkspaceProviderRuntimeSnapshot } from "./workspaces/workspaceCatalog.js";
 import { WorkspaceRemovalService } from "./workspaces/workspaceRemovalService.js";
 import { registerPluginBackendRoutes } from "./sessiond/pluginBackendRoutes.js";
+import { registerPluginBackendChannelRoutes } from "./sessiond/pluginBackendChannelRoutes.js";
 import { registerWorkspaceCatalogRoutes } from "./sessiond/workspaceCatalogRoutes.js";
 import { registerWorkspaceRemovalRoutes } from "./sessiond/workspaceRemovalRoutes.js";
+import { registerProjectMutationRoutes } from "./sessiond/projectMutationRoutes.js";
+import { createFilePiWebConfigService } from "./configRoutes.js";
 const daemonEnvironment = { ...process.env };
 const serverPluginRecovery = loadServerPluginRecoveryConfig({ env: daemonEnvironment });
-const { config } = effectivePiWebConfig({ env: daemonEnvironment });
+const { config, deprecatedAgentInputs } = effectivePiWebConfig({ env: daemonEnvironment });
+const configuredManagementProjectRoot = config.managementEmbed === undefined
+    ? undefined
+    : config.managementEmbed.projectRoot ?? join(homedir(), "PiWeb");
+const translator = loadNodeTranslator("server", config);
+// Request-time defaults must observe Settings edits without restarting sessiond.
+const configService = createFilePiWebConfigService({ env: daemonEnvironment });
 // The embedded Pi SDK and every child process use the same resolved profile.
 daemonEnvironment[PI_CODING_AGENT_DIR_ENV] = config.agent.dir;
 process.env[PI_CODING_AGENT_DIR_ENV] = config.agent.dir;
@@ -65,51 +104,144 @@ if (sessionDirOverride !== undefined) {
 }
 process.env[PI_WEB_SESSION_ENV] = "1";
 daemonEnvironment[PI_WEB_SESSION_ENV] = "1";
-scrubNonAgentVisibleEnvKeys(process.env);
+const scrubbedEnvKeys = scrubNonAgentVisibleEnvKeys(process.env);
 let stateOwnership;
 const activeAgentProfile = createActiveAgentProfileDescriptor({
     command: config.agent.command,
     dir: config.agent.dir,
     sessionDirEnvKeys: agentSessionDirEnvKeys(config.agent.command),
 });
+Object.freeze(daemonEnvironment);
 const app = Fastify({ logger: requestLoggerOptions(), bodyLimit: maxUploadBytes(daemonEnvironment, config) });
+if (deprecatedAgentInputs.length > 0) {
+    app.log.warn({ deprecatedAgentInputs }, "deprecated agent configuration inputs detected; support will be removed in a future release");
+}
+app.log.info({ scrubbedEnvKeys }, "daemon-only environment keys hidden from agent processes");
+if (serverPluginRecovery.safeStartDiagnostic !== undefined) {
+    app.log.error({ component: "server-plugins", configPath: serverPluginRecovery.path }, serverPluginRecovery.safeStartDiagnostic);
+}
+let serverQuiescing = false;
+app.addHook("onRequest", async (_request, reply) => {
+    if (serverQuiescing)
+        await reply.code(503).send({ error: "Session daemon is shutting down" });
+});
 const serverPluginCatalog = new PiWebPluginCatalog({
     cwd: process.cwd(),
     agentDir: activeAgentProfile.dir,
     configProvider: () => config,
     warningSink: (message) => { app.log.warn({ component: "server-plugins" }, message); },
 });
-await app.register(fastifyWebsocket);
+await app.register(fastifyWebsocket, { errorHandler: handleWebSocketError });
+installPluginBackendChannelWebSocketPayloadLimit(app.websocketServer);
+let runtimeShutdown;
+let pendingShutdownSignal;
+let shutdownStarted = false;
+async function requestShutdown(signal) {
+    if (shutdownStarted)
+        return;
+    if (runtimeShutdown === undefined) {
+        pendingShutdownSignal = signal;
+        return;
+    }
+    shutdownStarted = true;
+    app.log.info({ signal }, "shutting down session daemon");
+    await runtimeShutdown();
+}
+process.once("SIGINT", (signal) => { void requestShutdown(signal); });
+process.once("SIGTERM", (signal) => { void requestShutdown(signal); });
 await runSessionDaemonStartup({
     logger: app.log,
-    async createRuntime() {
+    async createRuntime(registerCleanup) {
         stateOwnership = await claimSessiondStateOwnership({ env: daemonEnvironment, logger: app.log });
+        registerCleanup(() => stateOwnership?.release());
+        registerCleanup(() => app.close());
+        const appliedHttpIdleTimeout = applyAgentHttpIdleTimeout({ agentDir: activeAgentProfile.dir, cwd: process.cwd() });
+        if (appliedHttpIdleTimeout.warning !== undefined) {
+            app.log.warn({ httpIdleTimeoutMs: appliedHttpIdleTimeout.timeoutMs }, appliedHttpIdleTimeout.warning);
+        }
+        else {
+            app.log.info({ httpIdleTimeoutMs: appliedHttpIdleTimeout.timeoutMs }, "applied agent profile HTTP idle timeout to the session daemon HTTP stack");
+        }
+        void reconcileAutoInstallablePiPackages({
+            profileDir: activeAgentProfile.dir,
+            packageProvider: new DefaultPiPackageProvider(process.cwd(), activeAgentProfile.dir),
+            installer: createDefaultPiPackageService(process.cwd(), activeAgentProfile.dir),
+            dismissalChecker: new PiPackageDismissalStore(piPackageDismissalStorePath(daemonEnvironment)),
+            logger: app.log,
+        }).catch((error) => {
+            app.log.warn({ err: error }, "Pi package auto-install reconciliation failed unexpectedly; continuing without it");
+        });
         const eventHub = new SessionEventHub();
+        const serverNotices = new ServerNoticeService(new ServerNoticeStore(), eventHub);
         const workspaceActivity = new WorkspaceActivityService(eventHub, (scope) => { machineStatus.notifyChanged(scope); });
-        const projects = new ProjectService(new ProjectStore());
-        const workspaces = new WorkspaceService();
+        const projects = new ProjectService(new ProjectStore(projectStorePath(daemonEnvironment)));
+        const projectSettings = new ProjectPluginSettingsSnapshots(projects);
+        await projectSettings.initialize(await projects.list());
+        const unreadStore = new SessionUnreadStore({
+            persistence: new FileSessionUnreadPersistence(defaultSessionUnreadFilePath(daemonEnvironment)),
+            onPersistenceError(operation, error) {
+                app.log.error({ err: error, operation }, "session unread persistence failed");
+            },
+        });
+        await unreadStore.load();
+        registerCleanup(() => unreadStore.flush());
+        let normalToolAudit;
+        let managementAudit;
+        const constructed = {};
+        // Construction failures must keep auth and sessions alive until plugin cleanup finishes.
+        registerCleanup(() => normalToolAudit?.close());
+        registerCleanup(() => managementAudit?.close());
+        registerCleanup(() => constructed.projectAuth?.dispose());
+        registerCleanup(() => { constructed.managementAuth?.dispose(); });
+        registerCleanup(() => constructed.sessions?.dispose());
         const serverPlugins = await createServerPluginRuntime({
+            translator,
             catalog: serverPluginCatalog,
+            dataDir: piWebDataDir(daemonEnvironment),
             ...(serverPluginRecovery.safeStart === undefined ? {} : { safeStart: serverPluginRecovery.safeStart }),
             logger: app.log,
             execFile: createServerPluginExecFile({ env: daemonEnvironment }),
+            projectSettingsResolver: (pluginId, settings, project, signal) => projectSettings.resolve(pluginId, settings, project, signal),
+            workspaceNotificationsFactory: createWorkspaceNotificationCommandFactory({
+                env: daemonEnvironment,
+                listeningPort: () => {
+                    const address = app.server.address();
+                    return typeof address === "object" && address !== null ? address.port : undefined;
+                },
+            }),
+            noticeSink: (source, input) => { serverNotices.record({ ...input, source }); },
+            lateHostCapabilities: [
+                PI_WEB_HOST_WORKSPACES_CAPABILITY,
+                PI_WEB_HOST_PI_SESSIONS_CAPABILITY,
+                PI_WEB_HOST_PI_SESSION_EVENTS_CAPABILITY,
+                PI_WEB_HOST_CATALOG_CAPABILITY,
+            ],
         });
-        const providerHealth = await serverPlugins.inspectHealth();
+        registerCleanup(() => serverPlugins.stop());
+        const providerContributions = serverPlugins.providerContributions();
+        const providerPluginIds = providerContributions.map(({ pluginId }) => pluginId);
+        const providerHealth = await serverPlugins.inspectHealth(providerPluginIds);
         const workspaceProviders = new WorkspaceProviderRegistry({
-            contributions: eligibleWorkspaceProviderContributions(serverPlugins.providerContributions(), providerHealth),
+            contributions: eligibleWorkspaceProviderContributions(providerContributions, providerHealth),
             logger: app.log,
         });
-        const workspaceProviderRuntime = createWorkspaceProviderRuntimeSnapshot(serverPlugins.healthRecords(), providerHealth, serverPlugins.safeStartLevel(), serverPlugins.catalogDiagnostics());
-        const projectAuth = new ProjectAuthService({ projects, workspaces });
-        const managementAuth = new AuthService({
-            modelRuntime: await createLocalOnlyModelRuntime({
-                authPath: join(piWebDataDir(), "management-embed", "auth.json"),
-                modelsPath: join(activeAgentProfile.dir, "models.json"),
-            }),
+        registerCleanup(() => workspaceProviders.closeAll());
+        const projectAuth = new ProjectAuthService({ projects, workspaces: workspaceProviders, globalAgentDir: activeAgentProfile.dir, logger: app.log, offline: offlineModeEnabled(daemonEnvironment) });
+        constructed.projectAuth = projectAuth;
+        const managementAuth = await AuthService.create({
+            agentDir: join(piWebDataDir(daemonEnvironment), "management-embed"),
         });
+        constructed.managementAuth = managementAuth;
+        const managementCatalogRefresher = new ModelCatalogRefresher({
+            runtime: managementAuth.runtime,
+            logger: app.log,
+            offline: offlineModeEnabled(daemonEnvironment),
+        });
+        registerCleanup(() => { managementCatalogRefresher.dispose(); });
+        managementCatalogRefresher.start();
+        managementAuth.subscribe(() => { managementCatalogRefresher.requestRefresh(); });
         const accessStates = new WorkbenchAccessStateStore();
         const normalAuditConfig = config.auditLog?.normalMode;
-        let normalToolAudit;
         if (normalAuditConfig?.enabled !== false) {
             try {
                 normalToolAudit = new NormalToolAuditStore({
@@ -126,7 +258,6 @@ await runSessionDaemonStartup({
             }
         }
         const managementAuditConfig = config.auditLog?.managementMode;
-        let managementAudit;
         if (managementAuditConfig?.enabled === true && managementAuditConfig.baseUrl !== undefined) {
             const apiKeyValue = daemonEnvironment["PI_WEB_AUDIT_ES_API_KEY"]?.trim();
             const usernameValue = daemonEnvironment["PI_WEB_AUDIT_ES_USERNAME"]?.trim();
@@ -156,13 +287,14 @@ await runSessionDaemonStartup({
                 requestTimeoutMs: config.workbenchIntegration.requestTimeoutMs ?? 10_000,
             });
             return {
+                translator,
                 accessStates,
                 client,
                 mcp: new WorkbenchMcpClient({
                     mcpUrl: config.workbenchIntegration.mcpUrl,
                     timeoutMs: config.workbenchIntegration.capabilityTimeoutMs ?? 30_000,
                 }),
-                skills: new WorkbenchSkillSynchronizer(config.workbenchIntegration, client, piWebDataDir(daemonEnvironment), fetch, app.log),
+                skills: new WorkbenchSkillSynchronizer(config.workbenchIntegration, client, piWebDataDir(daemonEnvironment), fetch, app.log, translator),
             };
         })();
         const projectsForScope = (scope = NORMAL_SESSION_EVENT_SCOPE) => {
@@ -174,11 +306,22 @@ await runSessionDaemonStartup({
             return projectsFromManagedEmbedContext(config.managementEmbed.projectRoot ?? join(homedir(), "PiWeb"), managementContext);
         };
         const spawnTargets = config.spawnSessions
-            ? new ProjectScopedSpawnTargetResolver({ projects: { list: projectsForScope }, workspaces })
+            ? new ProjectScopedSpawnTargetResolver({ projects: { list: projectsForScope }, workspaces: workspaceProviders })
             : undefined;
+        const managementAllowPrivileged = config.managementEmbed?.allowPrivileged === true;
+        const companionOptions = {};
+        const sessionEvents = new PiSessionEventConnections((bus) => bindCompanionBackend(bus, () => {
+            if (companionOptions.current === undefined)
+                throw new Error("PI WEB companion backends are not ready during daemon startup");
+            return companionOptions.current;
+        }));
+        const projectLifecycleRef = {};
         const sessions = new PiSessionService(eventHub, {
+            sessionEvents,
+            translator,
             modelRuntime: managementAuth.modelRuntime,
             managementModelRuntime: managementAuth.modelRuntime,
+            ...(configuredManagementProjectRoot === undefined ? {} : { managementProjectRoot: configuredManagementProjectRoot }),
             normalModelRuntimeForCwd: async (cwd) => (await projectAuth.forCwd(cwd)).modelRuntime,
             projectPathForCwd: async (cwd) => {
                 try {
@@ -190,10 +333,18 @@ await runSessionDaemonStartup({
                     return undefined;
                 }
             },
-            dataDir: piWebDataDir(),
+            dataDir: piWebDataDir(daemonEnvironment),
             agentDir: activeAgentProfile.dir,
             workspaceActivity,
-            onUnreadChanged: (scope) => { machineStatus.notifyChanged(scope); },
+            unreadStore,
+            archiveStore: new SessionArchiveStore(defaultSessionArchiveFilePath(daemonEnvironment), sessionArchiveDirectory(daemonEnvironment, config)),
+            notificationStore: new SessionNotificationStore(),
+            catalogRefreshStatus: projectAuth,
+            onUnreadChanged: (scope, hasNewCompletion) => {
+                machineStatus.notifyChanged(scope);
+                if (scope === NORMAL_SESSION_EVENT_SCOPE && hasNewCompletion)
+                    projectLifecycleRef.current?.scheduleCleanup();
+            },
             logger: app.log,
             ...(normalToolAudit === undefined ? {} : { normalToolAudit }),
             ...(managementAudit === undefined ? {} : {
@@ -204,17 +355,20 @@ await runSessionDaemonStartup({
             subsessionsEnabled: spawnTargets !== undefined && config.subsessions,
             askUserEnabled: config.askUser,
             extensionDialogsTimeoutMs: config.extensionDialogsTimeoutMs,
+            config: configService,
             appendSystemPromptSections: [
                 ...sessionEnvironmentPromptSections({ env: daemonEnvironment, enabled: config.environmentFacts }),
                 ...dockerEnvironmentPromptSections({ env: daemonEnvironment, enabled: config.environmentFacts, logger: app.log }),
             ],
             ...(workbench === undefined ? {} : { workbench }),
+            managementAllowPrivileged,
             sessionManager: createPiSessionManagerGateway({
                 agentDir: activeAgentProfile.dir,
                 env: daemonEnvironment,
                 sessionDirEnvKeys: activeAgentProfile.sessionDirEnvKeys,
             }),
         });
+        constructed.sessions = sessions;
         const statusAttribution = new CachedWorkspaceAttribution({
             projects: { list: projectsForScope },
             workspaces: { list: (project) => workspaceProviders.list(project) },
@@ -228,30 +382,134 @@ await runSessionDaemonStartup({
             logger: app.log,
         });
         eventHub.setGlobalJoinFrame((scope) => ({ type: "machine.status", status: machineStatus.snapshot(scope) }));
+        const workspaceChanges = new WorkspaceChangeNotifier({
+            attribution: statusAttribution,
+            status: machineStatus,
+            publish: (event) => { eventHub.publishRealtime(event, NORMAL_SESSION_EVENT_SCOPE); },
+        });
+        await serverPlugins.resumeWithHostCapabilityFactories([
+            createServerPluginWorkspacesCapabilityFactory({ projects, workspaces: workspaceProviders }),
+            createServerPluginCatalogCapabilityFactory({ projects, workspaces: workspaceProviders, sessions }),
+            createServerPluginPiSessionsCapabilityFactory({ projects, workspaces: workspaceProviders, sessions }),
+            createServerPluginPiSessionEventsCapabilityFactory({ projects, workspaces: workspaceProviders, sessions }),
+        ]);
+        const projectLifecycle = new ProjectLifecycleService({
+            projects,
+            workspaces: workspaceProviders,
+            hasUnread: () => unreadStore.hasUnread(),
+            reconcileUnreadWorkspaces: (cwds) => sessions.reconcileUnreadWorkspaces(cwds),
+            logger: app.log,
+            onProjectsChanged: () => {
+                statusAttribution.invalidate();
+                machineStatus.notifyChanged();
+            },
+        });
+        projectLifecycleRef.current = projectLifecycle;
+        registerCleanup(() => projectLifecycle.closeAll());
         machineStatus.notifyChanged();
         projectAuth.subscribe((change) => { sessions.applyAuthChange(change); });
         managementAuth.subscribe((change) => { sessions.applyAuthChange(change); });
-        const terminals = new TerminalService(eventHub, workspaceActivity);
-        const workspaceRemovals = new WorkspaceRemovalService(workspaceProviders, terminals);
+        const managementTerminals = new ManagementCommandRunService(eventHub, workspaceActivity, undefined, managementAllowPrivileged);
+        registerCleanup(() => { managementTerminals.dispose(); });
+        const terminals = serverPlugins.safeStartLevel() === "none"
+            ? unavailableRequiredTerminalService()
+            : serverPlugins.resolve(REQUIRED_TERMINAL_SERVICE_CAPABILITY);
+        terminals.bindActivitySink({
+            updateTerminal: (terminal) => { workspaceActivity.updateTerminal(terminal); },
+            removeTerminal: (terminalId, cwd) => { workspaceActivity.removeTerminal(terminalId, cwd); },
+        });
+        const providerPluginIdSet = new Set(providerPluginIds);
+        const remainingActivePluginIds = serverPlugins.healthRecords()
+            .filter(({ pluginId, state }) => state === "active" && !providerPluginIdSet.has(pluginId))
+            .map(({ pluginId }) => pluginId);
+        const remainingHealth = await serverPlugins.inspectHealth(remainingActivePluginIds);
+        const pluginHealth = Object.freeze([...providerHealth, ...remainingHealth]
+            .sort((left, right) => left.pluginId.localeCompare(right.pluginId)));
+        const workspaceProviderRuntime = createWorkspaceProviderRuntimeSnapshot(serverPlugins.healthRecords(), pluginHealth, serverPlugins.safeStartLevel(), serverPlugins.catalogDiagnostics());
+        const pluginBackends = new PluginBackendRegistry({
+            contributions: eligiblePluginBackendContributions(serverPlugins.pairedBackendContributions(), pluginHealth),
+            workspaces: workspaceProviders,
+            logger: app.log,
+        });
+        companionOptions.current = { backends: pluginBackends, contributions: eligiblePluginBackendContributions(serverPlugins.pairedBackendContributions(), pluginHealth), projects };
+        const workspaceRemovals = new WorkspaceRemovalService(workspaceProviders, {
+            closeForCwd(cwd, managementContext) {
+                if (managementContext === undefined)
+                    terminals.closeForCwd(cwd);
+                else
+                    managementTerminals.closeForCwd(cwd, managementContext);
+            },
+            runCommand: (options) => options.managementContext === undefined
+                ? terminals.runCommand(options)
+                : managementTerminals.runCommand(options),
+        }, { notices: serverNotices });
+        registerCleanup(() => pluginBackends.closeAll());
+        registerCleanup(() => workspaceRemovals.closeAll());
         const runtimeComponent = Object.freeze({
-            ...getPiWebRuntimeComponent("sessiond", SESSIOND_RUNTIME_CAPABILITIES),
-            activeAgentProfile,
+            ...getPiWebRuntimeComponent("sessiond", SESSIOND_RUNTIME_CAPABILITIES, deprecatedAgentInputs),
+            activeAgentProfile: publicActiveAgentProfileDescriptor(activeAgentProfile),
         });
-        return { eventHub, machineStatus, statusAttribution, workspaceActivity, projectAuth, managementAuth, sessions, terminals, accessStates, normalToolAudit, managementAudit, activeAgentProfile, runtimeComponent, serverPlugins, workspaceProviders, workspaceProviderRuntime, workspaceRemovals, projects };
+        projectLifecycle.scheduleCleanup();
+        let shutdownPromise;
+        const shutdown = () => {
+            shutdownPromise ??= runSessionDaemonShutdown({
+                logger: app.log,
+                onFailure: () => { process.exitCode = 1; },
+                dependencies: {
+                    quiesceServer: async () => {
+                        serverQuiescing = true;
+                        await projectLifecycle.closeAll();
+                    },
+                    serverPlugins,
+                    catalogRefresher: managementCatalogRefresher,
+                    auth: managementAuth,
+                    projectAuth,
+                    sessions,
+                    terminals: managementTerminals,
+                    unreadStore,
+                    pluginBackends,
+                    workspaceProviders,
+                    workspaceRemovals,
+                    closeServer: () => app.close(),
+                    ...(normalToolAudit === undefined ? {} : { normalToolAudit }),
+                    ...(managementAudit === undefined ? {} : { managementAudit }),
+                    releaseStateOwnership: () => stateOwnership?.release(),
+                },
+            });
+            return shutdownPromise;
+        };
+        return { eventHub, machineStatus, statusAttribution, workspaceChanges, projectLifecycle, workspaceActivity, projectAuth, managementAuth, sessions, managementTerminals, serverNotices, accessStates, normalToolAudit, managementAudit, activeAgentProfile, runtimeComponent, serverPlugins, workspaceProviders, pluginBackends, workspaceProviderRuntime, workspaceRemovals, projects, shutdown };
     },
-    registerRoutes({ eventHub, machineStatus, statusAttribution, workspaceActivity, projectAuth, managementAuth, sessions, terminals, accessStates, runtimeComponent, projects, workspaceProviders, workspaceProviderRuntime, workspaceRemovals }) {
+    disposeRuntime: ({ shutdown }) => shutdown(),
+    registerRoutes({ eventHub, machineStatus, statusAttribution, workspaceChanges, projectLifecycle, workspaceActivity, projectAuth, managementAuth, sessions, managementTerminals, serverNotices, accessStates, runtimeComponent, projects, workspaceProviders, pluginBackends, workspaceProviderRuntime, workspaceRemovals }) {
+        registerProjectMutationRoutes(app, projectLifecycle, translator);
+        registerPluginCatalogRoutes(app, { projects, workspaces: workspaceProviders, sessions });
         registerWorkspaceActivityRoutes(app, workspaceActivity);
         registerMachineStatusRoutes(app, machineStatus);
+        registerServerNoticeRoutes(app, serverNotices);
         registerAuthRoutes(app, { normal: projectAuth, management: managementAuth });
+        registerMcpAuthRoutes(app, sessions);
         registerSessionRoutes(app, sessions, eventHub);
-        registerTerminalRoutes(app, terminals);
+        registerManagementTerminalRoutes(app, managementTerminals);
         registerWorkbenchAccessStateRoutes(app, accessStates);
         const managementProjectRoot = config.managementEmbed?.enabled === true
-            ? config.managementEmbed.projectRoot ?? join(homedir(), "PiWeb")
+            ? configuredManagementProjectRoot
             : undefined;
-        registerWorkspaceCatalogRoutes(app, { projects, workspaces: workspaceProviders, providerRuntime: workspaceProviderRuntime, managementProjectRoot });
-        registerPluginBackendRoutes(app, { projects, backends: workspaceProviders, managementProjectRoot, onWorkspacesMutated: (scope) => { statusAttribution.invalidate(); machineStatus.notifyChanged(scope); } });
-        registerWorkspaceRemovalRoutes(app, { projects, removals: workspaceRemovals, managementProjectRoot, onWorkspacesMutated: (scope) => { statusAttribution.invalidate(); machineStatus.notifyChanged(scope); } });
+        registerWorkspaceCatalogRoutes(app, { projects, workspaces: workspaceProviders, providerRuntime: workspaceProviderRuntime, managementProjectRoot, translator });
+        registerWorkspaceNotificationRoutes(app, { projects, workspaces: workspaceProviders, changes: workspaceChanges, translator });
+        registerPluginBackendRoutes(app, { projects, backends: pluginBackends, managementProjectRoot, onWorkspacesMutated: (scope) => {
+                statusAttribution.invalidate();
+                machineStatus.notifyChanged(scope);
+                if (scope === NORMAL_SESSION_EVENT_SCOPE)
+                    projectLifecycle.scheduleCleanup();
+            } });
+        registerPluginBackendChannelRoutes(app, { projects, backends: pluginBackends, managementProjectRoot });
+        registerWorkspaceRemovalRoutes(app, { projects, removals: workspaceRemovals, managementProjectRoot, onWorkspacesMutated: (scope) => {
+                statusAttribution.invalidate();
+                machineStatus.notifyChanged(scope);
+                if (scope === NORMAL_SESSION_EVENT_SCOPE)
+                    projectLifecycle.scheduleCleanup();
+            } });
         app.get("/health", () => ({
             ok: true,
             activeSessions: sessions.activeCount(),
@@ -260,41 +518,19 @@ await runSessionDaemonStartup({
                 component: runtimeComponent.component,
                 label: runtimeComponent.label,
                 ...(runtimeComponent.runtimeVersion === undefined ? {} : { runtimeVersion: runtimeComponent.runtimeVersion }),
+                ...(runtimeComponent.piVersion === undefined ? {} : { piVersion: runtimeComponent.piVersion }),
                 stale: false,
                 available: runtimeComponent.available,
             },
         }));
         app.get("/runtime", () => runtimeComponent);
     },
-    async listen({ projectAuth, managementAuth, sessions, terminals, normalToolAudit, managementAudit, serverPlugins }) {
-        let shuttingDown = false;
-        async function shutdown(signal) {
-            if (shuttingDown)
-                return;
-            shuttingDown = true;
-            app.log.info({ signal }, "shutting down session daemon");
-            terminals.dispose();
-            await serverPlugins.stop();
-            await projectAuth.dispose();
-            managementAuth.dispose();
-            await sessions.dispose();
-            try {
-                normalToolAudit?.close();
-            }
-            catch (error) {
-                app.log.info({ error: error instanceof Error ? error.message : String(error) }, "failed to close ordinary-mode tool audit database");
-            }
-            try {
-                await managementAudit?.close();
-            }
-            catch (error) {
-                app.log.info({ error: error instanceof Error ? error.message : String(error) }, "failed to flush management audit Elasticsearch queue");
-            }
-            await stateOwnership?.release();
-            await app.close();
+    async listen({ shutdown, projects, workspaceProviders }) {
+        runtimeShutdown = shutdown;
+        if (pendingShutdownSignal !== undefined) {
+            await requestShutdown(pendingShutdownSignal);
+            return;
         }
-        process.once("SIGINT", (signal) => { void shutdown(signal); });
-        process.once("SIGTERM", (signal) => { void shutdown(signal); });
         const portValue = daemonEnvironment["PI_WEB_SESSIOND_PORT"];
         const port = portValue !== undefined && portValue !== "" ? Number(portValue) : undefined;
         const host = daemonEnvironment["PI_WEB_SESSIOND_HOST"] ?? "127.0.0.1";
@@ -302,12 +538,20 @@ await runSessionDaemonStartup({
             await app.listen({ port, host });
         }
         else {
-            const path = sessiondSocketPath();
+            const path = sessiondSocketPath(daemonEnvironment);
             await mkdir(dirname(path), { recursive: true });
             await rm(path, { force: true });
             await app.listen({ path });
             process.on("exit", () => void rm(path, { force: true }));
         }
+        // Hooks need the actual bound endpoint, including ephemeral TCP listeners.
+        try {
+            await Promise.all((await projects.list()).map((project) => workspaceProviders.reconcileProject(project)));
+        }
+        catch (error) {
+            if (!shutdownStarted)
+                throw error;
+        }
     },
 });
 //# sourceMappingURL=sessiond.js.map