@computesdk/loops 0.1.10 → 0.1.11

package/dist/server.mjs

@@ -1,8 +1,8 @@
 // server/index.ts
 import fs9 from "node:fs";
-import { randomBytes, randomUUID } from "node:crypto";
+import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
 import http from "node:http";
-import path9 from "node:path";
+import path10 from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFile as execFile2, execFileSync as execFileSync2, spawn as spawn6 } from "node:child_process";
 
@@ -107,26 +107,26 @@ var throwNestingLimitExceeded = () => {
 };
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/utils/url.js
-var splitPath = (path10) => {
-  const paths = path10.split("/");
+var splitPath = (path11) => {
+  const paths = path11.split("/");
   if (paths[0] === "") paths.shift();
   return paths;
 };
 var splitRoutingPath = (routePath) => {
-  const { groups, path: path10 } = extractGroupsFromPath(routePath);
-  const paths = splitPath(path10);
+  const { groups, path: path11 } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path11);
   return replaceGroupMarks(paths, groups);
 };
-var extractGroupsFromPath = (path10) => {
+var extractGroupsFromPath = (path11) => {
   const groups = [];
-  path10 = path10.replace(/\{[^}]+\}/g, (match2, index) => {
+  path11 = path11.replace(/\{[^}]+\}/g, (match2, index) => {
     const mark = `@${index}`;
     groups.push([mark, match2]);
     return mark;
   });
   return {
     groups,
-    path: path10
+    path: path11
   };
 };
 var replaceGroupMarks = (paths, groups) => {
@@ -189,8 +189,8 @@ var getPath = (request) => {
       const queryIndex = url.indexOf("?", i);
       const hashIndex = url.indexOf("#", i);
       const end = queryIndex === -1 ? hashIndex === -1 ? void 0 : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
-      const path10 = url.slice(start, end);
-      return tryDecodeURI(path10.includes("%25") ? path10.replace(/%25/g, "%2525") : path10);
+      const path11 = url.slice(start, end);
+      return tryDecodeURI(path11.includes("%25") ? path11.replace(/%25/g, "%2525") : path11);
     } else if (charCode === 63 || charCode === 35) break;
   }
   return url.slice(start, i);
@@ -203,9 +203,9 @@ var mergePath = (base, sub, ...rest) => {
   if (rest.length) sub = mergePath(sub, ...rest);
   return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
 };
-var checkOptionalParameter = (path10) => {
-  if (path10.charCodeAt(path10.length - 1) !== 63 || !path10.includes(":")) return null;
-  const segments = path10.split("/");
+var checkOptionalParameter = (path11) => {
+  if (path11.charCodeAt(path11.length - 1) !== 63 || !path11.includes(":")) return null;
+  const segments = path11.split("/");
   const results = [];
   let basePath = "";
   segments.forEach((segment) => {
@@ -316,9 +316,9 @@ var HonoRequest = class {
   */
   path;
   bodyCache = {};
-  constructor(request, path10 = "/", matchResult = [[]]) {
+  constructor(request, path11 = "/", matchResult = [[]]) {
     this.raw = request;
-    this.path = path10;
+    this.path = path11;
     this.#matchResult = matchResult;
   }
   param(key) {
@@ -1048,8 +1048,8 @@ var Hono = class Hono2 {
         return this;
       };
     });
-    this.on = (method, path10, ...handlers) => {
-      for (const p of [path10].flat()) {
+    this.on = (method, path11, ...handlers) => {
+      for (const p of [path11].flat()) {
         this.#path = p;
         for (const m of [method].flat()) {
           const methodName = m.toUpperCase();
@@ -1103,8 +1103,8 @@ var Hono = class Hono2 {
   * app.route("/api", app2) // GET /api/user
   * ```
   */
-  route(path10, app2) {
-    const subApp = this.basePath(path10);
+  route(path11, app2) {
+    const subApp = this.basePath(path11);
     app2.routes.map((r) => {
       let handler;
       if (app2.errorHandler === errorHandler) handler = r.handler;
@@ -1129,9 +1129,9 @@ var Hono = class Hono2 {
   * const api = new Hono().basePath('/api')
   * ```
   */
-  basePath(path10) {
+  basePath(path11) {
     const subApp = this.#clone();
-    subApp._basePath = mergePath(this._basePath, path10);
+    subApp._basePath = mergePath(this._basePath, path11);
     return subApp;
   }
   /**
@@ -1207,7 +1207,7 @@ var Hono = class Hono2 {
   * })
   * ```
   */
-  mount(path10, applicationHandler, options) {
+  mount(path11, applicationHandler, options) {
     let replaceRequest;
     let optionHandler;
     if (options) {
@@ -1230,7 +1230,7 @@ var Hono = class Hono2 {
       return [c.env, executionContext];
     };
     replaceRequest ||= (() => {
-      const mergedPath = mergePath(this._basePath, path10);
+      const mergedPath = mergePath(this._basePath, path11);
       const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
       return (request) => {
         const url = new URL(request.url);
@@ -1243,18 +1243,18 @@ var Hono = class Hono2 {
       if (res) return res;
       await next();
     };
-    this.#addRoute("ALL", mergePath(path10, "*"), handler);
+    this.#addRoute("ALL", mergePath(path11, "*"), handler);
     return this;
   }
-  #addRoute(method, path10, handler, baseRoutePath) {
-    path10 = mergePath(this._basePath, path10);
+  #addRoute(method, path11, handler, baseRoutePath) {
+    path11 = mergePath(this._basePath, path11);
     const r = {
       basePath: baseRoutePath !== void 0 ? mergePath(this._basePath, baseRoutePath) : this._basePath,
-      path: path10,
+      path: path11,
       method,
       handler
     };
-    this.router.add(method, path10, [handler, r]);
+    this.router.add(method, path11, [handler, r]);
     this.routes.push(r);
   }
   #handleError(err, c) {
@@ -1263,10 +1263,10 @@ var Hono = class Hono2 {
   }
   #dispatch(request, executionCtx, env, method) {
     if (method === "HEAD") return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
-    const path10 = this.getPath(request, { env });
-    const matchResult = this.router.match(method, path10);
+    const path11 = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path11);
     const c = new Context(request, {
-      path: path10,
+      path: path11,
       matchResult,
       env,
       executionCtx,
@@ -1320,10 +1320,10 @@ var Hono = class Hono2 {
   * ```
   * @see https://hono.dev/docs/api/hono#request
   */
-  request = (input, requestInit, Env, executionCtx) => {
-    if (input instanceof Request) return this.fetch(requestInit ? new Request(input, requestInit) : input, Env, executionCtx);
-    input = input.toString();
-    return this.fetch(new Request(/^https?:\/\//.test(input) ? input : `http://localhost${mergePath("/", input)}`, requestInit), Env, executionCtx);
+  request = (input2, requestInit, Env, executionCtx) => {
+    if (input2 instanceof Request) return this.fetch(requestInit ? new Request(input2, requestInit) : input2, Env, executionCtx);
+    input2 = input2.toString();
+    return this.fetch(new Request(/^https?:\/\//.test(input2) ? input2 : `http://localhost${mergePath("/", input2)}`, requestInit), Env, executionCtx);
   };
   /**
   * `.fire()` automatically adds a global fetch event listener.
@@ -1354,19 +1354,19 @@ var createNullObject = () => /* @__PURE__ */ Object.create(null);
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/matcher.js
 var emptyParam = [];
-function match(method, path10) {
+function match(method, path11) {
   const matchers = this.buildAllMatchers();
-  const match2 = ((method2, path11) => {
+  const match2 = ((method2, path12) => {
     const matcher = matchers[method2] || matchers["ALL"];
-    const staticMatch = matcher[2][path11];
+    const staticMatch = matcher[2][path12];
     if (staticMatch) return staticMatch;
-    const match3 = path11.match(matcher[0]);
+    const match3 = path12.match(matcher[0]);
     if (!match3) return [[], emptyParam];
     const index = match3.indexOf("", 1);
     return [matcher[1][index], match3];
   });
   this.match = match2;
-  return match2(method, path10);
+  return match2(method, path11);
 }
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/node.js
@@ -1456,14 +1456,14 @@ var Trie = class {
   #root = new Node();
   #index = 0;
   paths = createNullObject();
-  insert(path10, isStatic) {
+  insert(path11, isStatic) {
     if (isStatic) {
-      this.#root.insert(path10.split(""), 0, [], this.#context, true);
+      this.#root.insert(path11.split(""), 0, [], this.#context, true);
       return;
     }
     const paramAssoc = [];
     const groups = [];
-    let markedPath = path10;
+    let markedPath = path11;
     for (let i = 0; ; ) {
       let replaced = false;
       markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
@@ -1484,7 +1484,7 @@ var Trie = class {
       }
     }
     this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-    this.paths[path10] = [this.#index++, paramAssoc];
+    this.paths[path11] = [this.#index++, paramAssoc];
   }
   buildRegExp() {
     let regexp = this.#root.buildRegExpStr();
@@ -1517,11 +1517,11 @@ var Trie = class {
 
 // ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/router/reg-exp-router/router.js
 var wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path10) {
-  return wildcardRegExpCache[path10] ??= new RegExp(`^${path10.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
+function buildWildcardRegExp(path11) {
+  return wildcardRegExpCache[path11] ??= new RegExp(`^${path11.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match2, metaChar) => metaChar ? `\\${metaChar}` : match2 === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match2 === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
 }
-function findMiddleware(middleware, path10) {
-  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path10)) return [...middleware[k]];
+function findMiddleware(middleware, path11) {
+  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path11)) return [...middleware[k]];
 }
 var RegExpRouter = class {
   name = "RegExpRouter";
@@ -1533,14 +1533,14 @@ var RegExpRouter = class {
     this.#routes = { ["ALL"]: createNullObject() };
     this.#tries = { ["ALL"]: new Trie() };
   }
-  #insertPath(method, path10) {
+  #insertPath(method, path11) {
     try {
-      this.#tries[method].insert(path10, !/\*|\/:/.test(path10));
+      this.#tries[method].insert(path11, !/\*|\/:/.test(path11));
     } catch (e) {
-      throw e === PATH_ERROR ? new UnsupportedPathError(path10) : e;
+      throw e === PATH_ERROR ? new UnsupportedPathError(path11) : e;
     }
   }
-  add(method, path10, handler) {
+  add(method, path11, handler) {
     const middleware = this.#middleware;
     const routes = this.#routes;
     if (!middleware) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
@@ -1554,24 +1554,24 @@ var RegExpRouter = class {
         }
       }
     }
-    if (path10 === "/*") path10 = "*";
+    if (path11 === "/*") path11 = "*";
     const methods = method === "ALL" ? Object.keys(middleware) : [method];
-    if (/\*$/.test(path10)) {
-      const re = buildWildcardRegExp(path10);
-      for (const m of methods) if (!middleware[m][path10]) {
-        this.#insertPath(m, path10);
-        middleware[m][path10] = findMiddleware(middleware[m], path10) || findMiddleware(middleware["ALL"], path10) || [];
+    if (/\*$/.test(path11)) {
+      const re = buildWildcardRegExp(path11);
+      for (const m of methods) if (!middleware[m][path11]) {
+        this.#insertPath(m, path11);
+        middleware[m][path11] = findMiddleware(middleware[m], path11) || findMiddleware(middleware["ALL"], path11) || [];
       }
-      for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path10]);
+      for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path11]);
       return;
     }
-    const paths = checkOptionalParameter(path10) || [path10];
-    for (const path11 of paths) for (const m of methods) {
-      if (!routes[m][path11]) {
-        this.#insertPath(m, path11);
-        routes[m][path11] = findMiddleware(middleware[m], path11) || findMiddleware(middleware["ALL"], path11) || [];
+    const paths = checkOptionalParameter(path11) || [path11];
+    for (const path12 of paths) for (const m of methods) {
+      if (!routes[m][path12]) {
+        this.#insertPath(m, path12);
+        routes[m][path12] = findMiddleware(middleware[m], path12) || findMiddleware(middleware["ALL"], path12) || [];
       }
-      routes[m][path11].push([handler, path11]);
+      routes[m][path12].push([handler, path12]);
     }
   }
   match = match;
@@ -1589,11 +1589,11 @@ var RegExpRouter = class {
     const staticMap = createNullObject();
     const handlerData = [];
     const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-    for (const r of [middleware, routes]) for (const path10 in r) {
-      const handlers = r[path10];
-      const pathData = trie.paths[path10];
+    for (const r of [middleware, routes]) for (const path11 in r) {
+      const handlers = r[path11];
+      const pathData = trie.paths[path11];
       if (!pathData) {
-        staticMap[path10] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
+        staticMap[path11] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
         continue;
       }
       handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [h, trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
@@ -1617,15 +1617,15 @@ var SmartRouter = class {
   constructor(init) {
     this.#routers = init.routers;
   }
-  add(method, path10, handler) {
+  add(method, path11, handler) {
     if (!this.#routes) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
     this.#routes.push([
       method,
-      path10,
+      path11,
       handler
     ]);
   }
-  match(method, path10) {
+  match(method, path11) {
     if (!this.#routes) throw new Error("Fatal error");
     const routers = this.#routers;
     const routes = this.#routes;
@@ -1636,7 +1636,7 @@ var SmartRouter = class {
       const router = routers[i];
       try {
         for (let i2 = 0, len2 = routes.length; i2 < len2; i2++) router.add(...routes[i2]);
-        res = router.match(method, path10);
+        res = router.match(method, path11);
       } catch (e) {
         if (e instanceof UnsupportedPathError) continue;
         throw e;
@@ -1665,9 +1665,9 @@ var Node3 = class Node4 {
   #patterns = [];
   #pattern;
   #params = emptyParams;
-  insert(method, path10, handler) {
+  insert(method, path11, handler) {
     let curNode = this;
-    const parts = splitRoutingPath(path10);
+    const parts = splitRoutingPath(path11);
     const possibleKeys = /* @__PURE__ */ new Set();
     let i = 0;
     for (const p of parts) {
@@ -1703,11 +1703,11 @@ var Node3 = class Node4 {
       }
     }
   }
-  search(method, path10) {
+  search(method, path11) {
     const handlerSets = [];
     this.#params = emptyParams;
     let curNodes = [this];
-    const parts = splitPath(path10);
+    const parts = splitPath(path11);
     const curNodesQueue = [];
     const len = parts.length;
     let partOffsets = null;
@@ -1743,13 +1743,13 @@ var Node3 = class Node4 {
           if (matcher !== true) {
             if (!partOffsets) {
               partOffsets = [];
-              let offset = path10[0] === "/" ? 1 : 0;
+              let offset = path11[0] === "/" ? 1 : 0;
               for (let p = 0; p < len; p++) {
                 partOffsets[p] = offset;
                 offset += parts[p].length + 1;
               }
             }
-            const restPathString = path10.slice(partOffsets[i]);
+            const restPathString = path11.slice(partOffsets[i]);
             const m = matcher.exec(restPathString);
             if (m) {
               if (!Object.hasOwn(params, name)) params[name] = m[0];
@@ -1790,11 +1790,11 @@ var Node3 = class Node4 {
 var TrieRouter = class {
   name = "TrieRouter";
   #node = new Node3();
-  add(method, path10, handler) {
-    for (const result of checkOptionalParameter(path10) || [path10]) this.#node.insert(method, result, handler);
+  add(method, path11, handler) {
+    for (const result of checkOptionalParameter(path11) || [path11]) this.#node.insert(method, result, handler);
   }
-  match(method, path10) {
-    return this.#node.search(method, path10);
+  match(method, path11) {
+    return this.#node.search(method, path11);
   }
 };
 
@@ -1844,16 +1844,16 @@ var StreamingApi = class {
       }
     });
   }
-  async write(input) {
+  async write(input2) {
     try {
-      if (typeof input === "string") input = this.encoder.encode(input);
-      await this.writer.write(input);
+      if (typeof input2 === "string") input2 = this.encoder.encode(input2);
+      await this.writer.write(input2);
     } catch {
     }
     return this;
   }
-  async writeln(input) {
-    await this.write(input + "\n");
+  async writeln(input2) {
+    await this.write(input2 + "\n");
     return this;
   }
   sleep(ms) {
@@ -1979,15 +1979,15 @@ var toRequestError = (e) => {
 };
 var GlobalRequest = global.Request;
 var Request2 = class extends GlobalRequest {
-  constructor(input, options) {
-    if (typeof input === "object" && getRequestCache in input) {
-      input = input[getRequestCache]();
+  constructor(input2, options) {
+    if (typeof input2 === "object" && getRequestCache in input2) {
+      input2 = input2[getRequestCache]();
     }
     if (typeof options?.body?.getReader !== "undefined") {
       ;
       options.duplex ??= "half";
     }
-    super(input, options);
+    super(input2, options);
   }
 };
 var newHeadersFromIncoming = (incoming) => {
@@ -3166,6 +3166,26 @@ function buildRuns({ cwd, entries, live }) {
 }
 
 // server/chats.ts
+var SessionActionError = class extends Error {
+  status;
+  uncertain;
+  constructor(message, status = 409, uncertain = false) {
+    super(message);
+    this.status = status;
+    this.uncertain = uncertain;
+  }
+};
+var CLIENT_COMMANDS = /* @__PURE__ */ new Set(["login", "model", "compact", "new"]);
+async function boundedAction(operation, ms, name) {
+  let timer;
+  try {
+    return await Promise.race([operation, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new SessionActionError(`${name} is still awaiting Pi. Delivery/completion is uncertain; do not retry. Read the chat's latest state.`, 504, true)), ms);
+    })]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
 var toolLine = (name, args) => {
   const a = args ?? {};
   if (name === "bash") return `bash \xB7 ${String(a.command ?? "").split("\n")[0].slice(0, 90)}`;
@@ -3238,10 +3258,15 @@ var Chat = class {
   file = null;
   sessionName = null;
   autoNamed = false;
+  sessionReady = false;
+  action = null;
+  compaction = { status: "idle" };
+  currentModel;
+  modelRevision = 0;
+  modelsRequireRestart = false;
   constructor(id, options) {
     this.id = id;
     this.options = options;
-    this.model = options.model ?? null;
     this.pi = new PiRpc({
       command: options.piCommand,
       args: ["--session-dir", options.sessionDir, ...options.sessionFile ? ["--session", options.sessionFile] : ["--session-id", id], ...options.args ?? [], ...options.model ? ["--model", options.model] : []],
@@ -3281,6 +3306,12 @@ var Chat = class {
   get busy() {
     return !!this.live?.busy;
   }
+  get setupBlocked() {
+    return !this.sessionReady && this.dialogs.length > 0;
+  }
+  get sessionActions() {
+    return { setupBlocked: this.setupBlocked, busy: this.busy || this.runs.some((r) => r.alive) || this.liveLoops.size > 0 || !!this.action, compaction: { ...this.compaction } };
+  }
   touch() {
     try {
       this.options.onUpdate?.(this);
@@ -3325,22 +3356,25 @@ var Chat = class {
   }
   /** Re-read the session's entries (cursor-based) and messages, then rebuild the runs. */
   async refresh(full = false) {
+    if (this.stopping) return;
     if (this.refreshing) return this.refreshing;
     this.refreshing = (async () => {
       try {
         if (full) this.cursor = void 0;
-        const entries = await this.pi.send({ type: "get_entries", ...this.cursor ? { since: this.cursor } : {} });
+        const entries = await this.pi.send({ type: "get_entries", ...this.cursor ? { since: this.cursor } : {} }, 1e4);
         const got = entries.entries ?? [];
         if (this.cursor) this.entries = got.length ? [...this.entries, ...got] : this.entries;
         else this.entries = got;
         this.cursor = got.at(-1)?.id ?? this.cursor;
-        const messages = await this.pi.send({ type: "get_messages" });
+        const messages = await this.pi.send({ type: "get_messages" }, 1e4);
         if (process.env.LOOPS_UI_DEBUG) console.error(`[${this.id}] refresh: ${got.length} new entries, ${(messages.messages ?? []).map((m) => `${m.role}[${Array.isArray(m.content) ? m.content.map((c) => c.type).join("+") : typeof m.content}]`).join(" ")}`);
         this.items = itemsFromMessages(messages.messages ?? []);
-        const state = await this.pi.send({ type: "get_state" }).catch(() => ({}));
+        const modelRevision = this.modelRevision;
+        const state = await this.pi.send({ type: "get_state" }, 1e4).catch(() => null);
         const st = state;
         if (st?.sessionName) this.sessionName = String(st.sessionName);
-        if (st?.model?.id) this.model = `${st.model.provider ?? ""}/${st.model.id}`.replace(/^\//, "");
+        if (st) this.readModel(st.model, modelRevision);
+        this.sessionReady = true;
         this.runs = buildRuns({ cwd: this.options.cwd, entries: this.entries, live: this.liveLoops });
         const auto = autoNameFor(this.runs, this.sessionName, this.autoNamed);
         if (auto) {
@@ -3350,8 +3384,10 @@ var Chat = class {
         }
         this.refreshError = "";
       } catch (e) {
-        console.error(`[${this.id}] refresh failed:`, e.message ?? e);
-        this.refreshError = String(e.message ?? e);
+        if (!this.stopping) {
+          console.error(`[${this.id}] refresh failed:`, e.message ?? e);
+          this.refreshError = String(e.message ?? e);
+        }
       } finally {
         this.refreshing = null;
         this.broadcast(true);
@@ -3426,6 +3462,22 @@ var Chat = class {
     this.touch();
   }
   async prompt(text, behavior) {
+    const candidate = text.trimStart();
+    if (candidate.startsWith("/")) {
+      const slash = /^\/([^\s]+)([\s\S]*)$/.exec(candidate);
+      if (!slash) throw new SessionActionError("A discovered slash command name is required.", 400);
+      await this.validateCommand(slash[1]);
+      text = `/${slash[1]}${slash[2].replace(/^\s/, " ")}`;
+    }
+    if (this.action && !/^\s*\/loop\s+stop(?:\s|$)/.test(text)) throw new SessionActionError("A session action is in progress. Wait for Pi to finish.");
+    return this.dispatchPrompt(text, behavior);
+  }
+  /** A server-owned safety control, not an arbitrary slash/RPC bypass. Run ownership is checked by the route. */
+  async stopLoop(run3) {
+    if (!/^[\w.-]+$/.test(run3)) throw new SessionActionError("Exact run ID required.", 400);
+    return this.dispatchPrompt(`/loop stop ${run3}`);
+  }
+  async dispatchPrompt(text, behavior) {
     const previous = this.live;
     if (!text.startsWith("/") && !this.live) this.live = { busy: true, chat: this.id, startedAt: Date.now(), user: text, text: "", tools: [] };
     this.broadcast(true);
@@ -3508,19 +3560,148 @@ var Chat = class {
   stateFor(run3) {
     return stateFromEntries(this.entries, run3);
   }
-  /** The models this chat could run, and what each one can take (text only, or images too). */
+  readModel(model, revision = this.modelRevision) {
+    if (revision !== this.modelRevision) return;
+    if (typeof model?.id === "string" && typeof model?.provider === "string") {
+      this.currentModel = { provider: model.provider, id: model.id };
+      this.model = `${model.provider}/${model.id}`;
+    } else if (model == null) {
+      this.currentModel = void 0;
+      this.model = null;
+    }
+  }
+  /** Only Pi's dynamic prompt-invocable resources, never terminal-only builtins. */
+  async commands() {
+    if (this.setupBlocked) return { commands: [], supported: false, setupBlocked: true, error: "Complete Pi's startup decision before loading commands." };
+    try {
+      const result = await this.pi.send({ type: "get_commands" }, 1e4);
+      if (!Array.isArray(result?.commands)) return { commands: [], supported: false, setupBlocked: false, error: "This Pi executable does not support command discovery." };
+      return {
+        commands: result.commands.filter((c) => c && typeof c.name === "string" && !!c.name && !/[\s/]/.test(c.name) && ["extension", "prompt", "skill"].includes(c.source)).map((c) => ({ name: c.name, source: c.source, ...typeof c.description === "string" ? { description: c.description } : {} })),
+        supported: true,
+        setupBlocked: false
+      };
+    } catch (error) {
+      return { commands: [], supported: false, setupBlocked: false, error: String(error.message ?? error) };
+    }
+  }
+  async validateCommand(name) {
+    const catalog = await this.commands();
+    if (catalog.commands.some((command) => command.name === name)) return;
+    if (CLIENT_COMMANDS.has(name)) throw new SessionActionError(`/${name} is a browser action. Use ${name === "new" ? "New chat" : name === "login" ? "provider settings" : `the ${name} control`} instead.`, 400);
+    if (!catalog.supported) throw new SessionActionError(catalog.error ?? "Pi command discovery is unavailable; slash commands cannot be safely sent.", 409);
+    throw new SessionActionError(`Unknown or unsupported slash command: /${name}. It was not sent to the model.`, 400);
+  }
+  /** Public RPC returns Pi's available snapshot; never manufacture provider/model spellings. */
+  async models() {
+    if (this.setupBlocked) return { models: [], current: this.currentModel, setupBlocked: true, error: "Complete Pi's startup decision before loading models." };
+    const modelRevision = this.modelRevision;
+    const [available2, state] = await Promise.all([
+      this.pi.send({ type: "get_available_models" }, 1e4),
+      this.pi.send({ type: "get_state" }, 1e4)
+    ]);
+    this.readModel(state?.model, modelRevision);
+    return {
+      // Custom SDK models may carry API headers or credential-bearing base URLs. Only this display DTO crosses HTTP.
+      models: (available2?.models ?? []).filter((m) => m && typeof m.id === "string" && typeof m.provider === "string").map((m) => ({ id: m.id, provider: m.provider, ...typeof m.name === "string" ? { name: m.name } : {}, ...Array.isArray(m.input) ? { input: m.input.filter((v) => typeof v === "string") } : {} })),
+      current: this.currentModel,
+      setupBlocked: false,
+      ...this.modelsRequireRestart ? { requiresRestart: true, warning: "This Pi executable cannot refresh model credentials over RPC. Restart the agent explicitly after work finishes to see newly configured models." } : {}
+    };
+  }
+  /** The bundled compatibility runner refreshes through Pi's public ModelRuntime API, without network calls. */
+  async refreshModels() {
+    if (this.setupBlocked || this.sessionActions.busy) return this.models();
+    this.action = "metadata";
+    this.broadcast(true);
+    const operation = (async () => {
+      try {
+        await this.pi.send({ type: "refresh_available_models" });
+        this.modelsRequireRestart = false;
+      } catch (error) {
+        if (!/unknown command|unsupported|not supported/i.test(String(error.message ?? error))) throw error;
+        this.modelsRequireRestart = true;
+      } finally {
+        this.action = null;
+        this.broadcast(true);
+      }
+    })();
+    await boundedAction(operation, 1e4, "Model metadata refresh");
+    return this.models();
+  }
+  /** Compatibility for the existing config editor's composite model IDs. */
   async availableModels() {
     try {
-      const list = await this.pi.send({ type: "get_available_models" });
+      const list = await this.models();
       return (list.models ?? []).map((m) => ({ id: `${m.provider}/${m.id}`, provider: m.provider, model: m.id, images: Array.isArray(m.input) ? m.input.includes("image") : null }));
     } catch {
       return [];
     }
   }
-  async setModel(provider, model) {
-    await this.pi.send({ type: "set_model", provider, modelId: model });
-    this.model = `${provider}/${model}`;
+  async beginAction(action) {
+    if (this.setupBlocked) throw new SessionActionError("Complete Pi's startup decision first.");
+    if (this.action) throw new SessionActionError("A session action is already in progress. Do not retry until Pi finishes.");
+    this.action = action;
     this.broadcast(true);
+    try {
+      await this.refresh();
+      const state = await this.pi.send({ type: "get_state" }, 1e4);
+      if (this.busy || this.runs.some((r) => r.alive) || this.liveLoops.size || state.isStreaming || state.isCompacting || state.pendingMessageCount) {
+        throw new SessionActionError("Stop or finish the parent agent and background loops before changing the model or compacting.");
+      }
+    } catch (error) {
+      this.action = null;
+      this.broadcast(true);
+      throw error;
+    }
+  }
+  async setModel(provider, modelId) {
+    if (!provider || !modelId) throw new SessionActionError("Exact provider and modelId are required.", 400);
+    await this.beginAction("model");
+    const operation = (async () => {
+      try {
+        const models = await this.pi.send({ type: "get_available_models" }, 1e4);
+        if (!models.models?.some((m) => m.provider === provider && m.id === modelId)) throw new SessionActionError("The exact model is not in Pi's available catalog.", 400);
+        const result = await this.pi.send({ type: "set_model", provider, modelId });
+        this.modelRevision++;
+        this.readModel(result?.provider && result?.id ? result : { provider, id: modelId });
+        return this.currentModel;
+      } finally {
+        this.action = null;
+        this.broadcast(true);
+      }
+    })();
+    return boundedAction(operation, 2e4, "Model change");
+  }
+  async compact(customInstructions) {
+    if (customInstructions !== void 0 && typeof customInstructions !== "string") throw new SessionActionError("customInstructions must be text.", 400);
+    await this.beginAction("compact");
+    this.compaction = { status: "running", startedAt: Date.now() };
+    this.broadcast(true);
+    const operation = (async () => {
+      try {
+        const result = await this.pi.send({ type: "compact", ...customInstructions !== void 0 ? { customInstructions } : {} });
+        this.compaction = { ...this.compaction, status: "succeeded", finishedAt: Date.now(), result };
+        if (this.refreshing) await this.refreshing;
+        await this.refresh(true);
+        return result;
+      } catch (error) {
+        this.compaction = { ...this.compaction, status: "error", finishedAt: Date.now(), error: String(error.message ?? error) };
+        throw error;
+      } finally {
+        this.action = null;
+        this.broadcast(true);
+      }
+    })();
+    try {
+      return await boundedAction(operation, 12e4, "Compaction");
+    } catch (error) {
+      if (error instanceof SessionActionError && error.uncertain && this.compaction.status === "running") {
+        this.compaction = { ...this.compaction, status: "uncertain", error: error.message };
+        this.broadcast(true);
+      }
+      throw error;
+    }
   }
   /** An attempt's transcript, straight from the session file the attempt forked into. */
   sessionItems(file) {
@@ -3557,6 +3738,7 @@ var Chat = class {
       live: this.live,
       runs,
       model: this.model,
+      sessionActions: this.sessionActions,
       error: this.pi.running ? this.refreshError || void 0 : this.exitError || this.refreshError || void 0,
       questions: runs.flatMap((r) => r.questions),
       dialogs: this.dialogs,
@@ -3933,9 +4115,9 @@ async function connect(wsUrl) {
     sock.addEventListener("open", () => res());
     sock.addEventListener("error", () => rej(new Error("could not connect to the browser's DevTools endpoint")));
   });
-  const send = (method, params = {}, sessionId) => new Promise((ok, fail) => {
+  const send = (method, params = {}, sessionId) => new Promise((ok, fail2) => {
     const n = ++id;
-    pending.set(n, { ok, fail });
+    pending.set(n, { ok, fail: fail2 });
     sock.send(JSON.stringify({ id: n, method, params, ...sessionId ? { sessionId } : {} }));
   });
   return {
@@ -4733,9 +4915,377 @@ function originalBaseline(state) {
   return state.rounds?.find((round) => round.n === 1)?.from || state.baseCommit;
 }
 
+// server/session-actions.ts
+function createSessionActions(options) {
+  const routes = new Hono3();
+  const chat = async (id) => {
+    if (typeof id !== "string" || !id.trim()) throw new SessionActionError("chat required", 400);
+    return options.requireChat(id);
+  };
+  routes.onError((error, c) => {
+    if (error instanceof HTTPException) return c.json({ error: error.message }, error.status);
+    if (error instanceof SessionActionError) return c.json({ error: error.message, ...error.uncertain ? { uncertain: true } : {} }, error.status);
+    return c.json({ error: error.message }, 502);
+  });
+  routes.get("/commands", async (c) => c.json(await (await chat(c.req.query("chat"))).commands()));
+  routes.get("/models", async (c) => {
+    const target = await chat(c.req.query("chat"));
+    return c.json(await (target.sessionActions.busy ? target.models() : target.refreshModels()));
+  });
+  routes.post("/models", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (typeof body?.provider !== "string" || !body.provider || typeof body?.modelId !== "string" || !body.modelId) throw new SessionActionError("Exact provider and modelId are required.", 400);
+    const current = await (await chat(body.chat)).setModel(body.provider, body.modelId);
+    return c.json({ ok: true, current });
+  });
+  routes.post("/compact", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (body?.customInstructions !== void 0 && typeof body.customInstructions !== "string") throw new SessionActionError("customInstructions must be text.", 400);
+    const result = await (await chat(body?.chat)).compact(body?.customInstructions);
+    return c.json({ ok: true, result });
+  });
+  routes.post("/commands/run", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    if (typeof body?.name !== "string" || !body.name || /[\s/]/.test(body.name)) throw new SessionActionError("An exact discovered command name (without /) is required.", 400);
+    if (body.args !== void 0 && typeof body.args !== "string") throw new SessionActionError("Command args must be text.", 400);
+    const target = await chat(body.chat);
+    const disposition = await target.prompt(`/${body.name}${body.args ? ` ${body.args}` : ""}`);
+    return c.json({ disposition });
+  });
+  return routes;
+}
+
+// server/provider-auth.ts
+import { randomUUID } from "node:crypto";
+import path9 from "node:path";
+
+// ../../node_modules/.pnpm/hono@4.13.14/node_modules/hono/dist/middleware/body-limit/index.js
+var ERROR_MESSAGE = "Payload Too Large";
+var bodyLimit = (options) => {
+  const onError = options.onError || (() => {
+    const res = new Response(ERROR_MESSAGE, { status: 413 });
+    throw new HTTPException(413, { res });
+  });
+  const maxSize = options.maxSize;
+  return async function bodyLimit2(c, next) {
+    if (!c.req.raw.body) return next();
+    const hasTransferEncoding = c.req.raw.headers.has("transfer-encoding");
+    if (c.req.raw.headers.has("content-length") && !hasTransferEncoding) return parseInt(c.req.raw.headers.get("content-length") || "0", 10) > maxSize ? onError(c) : next();
+    let size = 0;
+    const chunks = [];
+    const rawReader = c.req.raw.body.getReader();
+    for (; ; ) {
+      const { done, value } = await rawReader.read();
+      if (done) break;
+      size += value.length;
+      if (size > maxSize) return onError(c);
+      chunks.push(value);
+    }
+    const requestInit = {
+      body: new ReadableStream({ start(controller) {
+        for (const chunk of chunks) controller.enqueue(chunk);
+        controller.close();
+      } }),
+      duplex: "half"
+    };
+    c.req.raw = new Request(c.req.raw, requestInit);
+    return next();
+  };
+};
+
+// server/provider-auth.ts
+var AuthRequestError = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.status = status;
+  }
+};
+var fail = (status, message) => {
+  throw new AuthRequestError(status, message);
+};
+var MAX_FLOW_MS = 15 * 6e4;
+var TERMINAL_MS = 6e4;
+var MAX_INPUT = 16384;
+var copy = (value) => structuredClone(value);
+function httpsUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol === "https:" && !url.username && !url.password && value.length <= MAX_INPUT) return url.href;
+  } catch {
+  }
+  return void 0;
+}
+function input(value, label, max = MAX_INPUT) {
+  if (typeof value !== "string" || !value.trim() || value.length > max || value.includes("\0")) fail(400, `Invalid ${label}`);
+  return value;
+}
+function keyInput(value) {
+  const key = input(value, "API key", 8192).trim();
+  if (key.startsWith("!") || /[\r\n]/.test(key)) fail(400, "A literal, single-line API key is required");
+  return key;
+}
+var ProviderAuth = class {
+  runtime;
+  options;
+  flow;
+  active;
+  waiting;
+  terminalAt = 0;
+  closed = false;
+  constructor(runtime, options = {}) {
+    this.runtime = runtime;
+    this.options = options;
+  }
+  async snapshot() {
+    const stored = new Set((await this.runtime.listCredentials()).map((c) => c.providerId));
+    const providers = this.runtime.getProviders().map((p) => ({
+      id: p.id,
+      name: p.name,
+      oauth: Boolean(p.auth.oauth),
+      apiKey: Boolean(p.auth.apiKey?.login),
+      connected: stored.has(p.id)
+    })).sort((a, b) => a.name.localeCompare(b.name));
+    if (!this.active && this.flow && Date.now() - this.terminalAt > TERMINAL_MS) this.flow = void 0;
+    return { providers, ...this.flow ? { flow: copy(this.flow) } : {} };
+  }
+  start(provider, key) {
+    if (this.closed) fail(503, "Provider login is unavailable");
+    if (this.active) fail(409, "A provider connection is already in progress");
+    const id = input(provider, "provider", 128);
+    const selected = this.runtime.getProviders().find((p) => p.id === id);
+    if (!selected) fail(400, "Unknown provider");
+    const type = key === void 0 ? "oauth" : "api_key";
+    if (type === "oauth" ? !selected.auth.oauth : !selected.auth.apiKey?.login) fail(400, "Login method is not supported");
+    let suppliedKey = type === "api_key" ? keyInput(key) : void 0;
+    const controller = new AbortController();
+    const flow = { id: randomUUID(), provider: id, status: "pending" };
+    this.flow = flow;
+    const interaction = {
+      signal: controller.signal,
+      notify: (event) => {
+        if (this.flow !== flow || flow.status !== "pending" || controller.signal.aborted) return;
+        this.notify(flow, event);
+      },
+      prompt: (prompt) => {
+        controller.signal.throwIfAborted();
+        prompt.signal?.throwIfAborted();
+        if (suppliedKey !== void 0 && prompt.type === "secret") {
+          const value = suppliedKey;
+          suppliedKey = void 0;
+          return Promise.resolve(value);
+        }
+        return this.prompt(flow, prompt, controller.signal, type === "api_key");
+      }
+    };
+    const timeout = Math.min(MAX_FLOW_MS, Math.max(1, this.options.timeoutMs ?? MAX_FLOW_MS));
+    const timer = setTimeout(() => this.stop(flow.id, "expired"), timeout);
+    timer.unref();
+    const active = { controller, timer, done: Promise.resolve(), deadline: Date.now() + timeout };
+    this.active = active;
+    active.done = Promise.resolve().then(async () => {
+      try {
+        await this.runtime.login(id, type, interaction, this.options.loginOptions);
+        if (flow.status === "pending") this.finish(flow, "succeeded");
+        this.changed(id);
+      } catch (error) {
+        if (error instanceof Error && error.name === "CredentialSynchronizationError") {
+          if (flow.status === "pending") this.finish(flow, "succeeded");
+          this.changed(id);
+        } else if (flow.status === "pending") {
+          this.finish(flow, "failed", "Connection failed. Check the provider sign-in requirements and try again.");
+        }
+      } finally {
+        suppliedKey = void 0;
+        clearTimeout(active.timer);
+        this.waiting?.reject(new Error("Login finished"));
+        if (this.active === active) this.active = void 0;
+      }
+    });
+    return copy(flow);
+  }
+  answer(id, promptId, value) {
+    const flow = this.current(id);
+    if (!this.waiting || this.waiting.id !== promptId || flow.prompt?.id !== promptId) fail(409, "This login prompt is no longer active");
+    if (typeof value !== "string" || value.length > MAX_INPUT || value.includes("\0")) fail(400, "Invalid login answer");
+    if (flow.prompt?.type === "select" && !flow.prompt.options?.some((o) => o.id === value)) fail(400, "Invalid login option");
+    this.waiting.resolve(value);
+    return copy(flow);
+  }
+  cancel(id) {
+    const flow = this.current(id);
+    this.stop(flow.id, "cancelled");
+    return copy(flow);
+  }
+  /** Abort pending SDK interactions during server shutdown (including loopback listeners). */
+  async close() {
+    this.closed = true;
+    const active = this.active;
+    if (active && this.flow?.status === "pending") this.stop(this.flow.id, "cancelled");
+    await active?.done;
+  }
+  current(id) {
+    if (typeof id !== "string" || id !== this.flow?.id) return fail(404, "Unknown or stale login flow");
+    if (!this.active || this.flow.status !== "pending") return fail(409, "This login flow is no longer active");
+    return this.flow;
+  }
+  changed(provider) {
+    void Promise.resolve().then(() => this.options.onCredentialsChanged?.(provider)).catch(() => {
+    });
+  }
+  stop(id, status) {
+    if (this.flow?.id !== id || this.flow.status !== "pending") return;
+    this.finish(this.flow, status, status === "expired" ? "Sign-in expired. Start a new connection." : void 0);
+    this.active?.controller.abort(new Error("Login cancelled"));
+    this.waiting?.reject(new Error("Login cancelled"));
+  }
+  finish(flow, status, error) {
+    for (const key of ["authorizationUrl", "instructions", "prompt", "deviceCode"]) delete flow[key];
+    flow.status = status;
+    if (error) flow.error = error;
+    this.terminalAt = Date.now();
+  }
+  notify(flow, event) {
+    if (event.type === "auth_url") {
+      const url = httpsUrl(event.url);
+      if (!url) throw new Error("Unsafe authorization URL");
+      flow.authorizationUrl = url;
+      flow.instructions = event.instructions?.slice(0, 4096);
+    } else if (event.type === "device_code") {
+      const url = httpsUrl(event.verificationUri);
+      if (!url) throw new Error("Unsafe verification URL");
+      const expires = event.expiresInSeconds;
+      const lifetime = typeof expires === "number" && Number.isFinite(expires) && expires > 0 ? expires : void 0;
+      flow.authorizationUrl = url;
+      flow.deviceCode = {
+        userCode: event.userCode.slice(0, 256),
+        verificationUri: url,
+        ...lifetime === void 0 ? {} : { expiresInSeconds: lifetime }
+      };
+      if (lifetime !== void 0 && this.active) {
+        const remaining = Math.min(this.active.deadline - Date.now(), lifetime * 1e3);
+        clearTimeout(this.active.timer);
+        this.active.deadline = Date.now() + remaining;
+        this.active.timer = setTimeout(() => this.stop(flow.id, "expired"), Math.max(1, remaining));
+        this.active.timer.unref();
+      }
+    } else if (event.type === "info") {
+      flow.instructions = event.message.slice(0, 4096);
+    }
+  }
+  prompt(flow, prompt, signal, apiKey) {
+    if (this.waiting) return Promise.reject(new Error("Concurrent login prompts are not supported"));
+    const id = randomUUID();
+    flow.prompt = {
+      id,
+      type: prompt.type,
+      message: prompt.message.slice(0, 4096),
+      // Pi text prompts include "blank for github.com" and "press Enter to
+      // continue". The public prompt API has no required flag; let the provider
+      // validate text input instead of inventing a browser-only restriction.
+      ...prompt.type === "text" ? { allowEmpty: true } : {},
+      ..."placeholder" in prompt ? { placeholder: prompt.placeholder?.slice(0, 1024) } : {},
+      ...prompt.type === "select" ? { options: prompt.options.map((o) => ({ ...o })) } : {}
+    };
+    return new Promise((resolve, reject) => {
+      const signals = [signal, ...prompt.signal ? [prompt.signal] : []];
+      const cleanup = () => {
+        signals.forEach((s) => s.removeEventListener("abort", abort));
+        if (this.waiting?.id === id) this.waiting = void 0;
+        if (flow.prompt?.id === id) delete flow.prompt;
+      };
+      const abort = () => {
+        cleanup();
+        reject(new Error("Login prompt cancelled"));
+      };
+      this.waiting = {
+        id,
+        resolve: (value) => {
+          if (apiKey && value.trim().startsWith("!")) {
+            cleanup();
+            reject(new Error("Literal input required"));
+            return;
+          }
+          cleanup();
+          resolve(value);
+        },
+        reject: (error) => {
+          cleanup();
+          reject(error);
+        }
+      };
+      signals.forEach((s) => s.addEventListener("abort", abort, { once: true }));
+      if (signals.some((s) => s.aborted)) abort();
+    });
+  }
+};
+async function createProviderAuth(options = {}) {
+  if (options.runtime) return new ProviderAuth(options.runtime, options);
+  const { ModelRuntime, SettingsManager, getAgentDir } = await import("@earendil-works/pi-coding-agent");
+  const runtime = await ModelRuntime.create({
+    authPath: options.authPath,
+    allowModelNetwork: false,
+    refreshOnCreate: false
+  });
+  let settings;
+  const agentDir3 = options.authPath ? path9.dirname(options.authPath) : getAgentDir();
+  return new ProviderAuth(runtime, {
+    ...options,
+    loginOptions: options.loginOptions ?? {
+      getDeviceId: () => {
+        settings ??= SettingsManager.create(agentDir3, agentDir3, { projectTrusted: false });
+        return settings.getOrCreateDeviceId();
+      }
+    }
+  });
+}
+function mountProviderAuthRoutes(api2, auth) {
+  api2.use("/providers", async (c, next) => {
+    c.header("Cache-Control", "no-store");
+    c.header("Referrer-Policy", "no-referrer");
+    await next();
+  });
+  api2.use("/providers/*", async (c, next) => {
+    c.header("Cache-Control", "no-store");
+    c.header("Referrer-Policy", "no-referrer");
+    await next();
+  });
+  api2.use("/providers/*", bodyLimit({ maxSize: 32768, onError: (c) => c.json({ error: "Login request is too large" }, 413) }));
+  const safe = async (fn, c) => {
+    try {
+      return c.json(await fn());
+    } catch (error) {
+      if (error instanceof AuthRequestError) return c.json({ error: error.message }, error.status);
+      return c.json({ error: "Provider connection is unavailable" }, 503);
+    }
+  };
+  const body = async (c, fields) => {
+    const value = await c.req.json().catch(() => null);
+    if (!value || typeof value !== "object" || Array.isArray(value) || Object.keys(value).some((k) => !fields.includes(k))) fail(400, "Invalid login request");
+    return value;
+  };
+  api2.get("/providers", (c) => safe(() => auth.snapshot(), c));
+  api2.post("/providers/login", (c) => safe(async () => {
+    const b = await body(c, ["provider"]);
+    return { flow: auth.start(b.provider) };
+  }, c));
+  api2.post("/providers/key", (c) => safe(async () => {
+    const b = await body(c, ["provider", "key"]);
+    return { flow: auth.start(b.provider, keyInput(b.key)) };
+  }, c));
+  api2.post("/providers/answer", (c) => safe(async () => {
+    const b = await body(c, ["id", "promptId", "value"]);
+    return { flow: auth.answer(b.id, b.promptId, b.value) };
+  }, c));
+  api2.post("/providers/cancel", (c) => safe(async () => {
+    const b = await body(c, ["id"]);
+    return { flow: auth.cancel(b.id) };
+  }, c));
+}
+
 // server/index.ts
-var HERE = path9.dirname(fileURLToPath(import.meta.url));
-var APP_ROOT = path9.resolve(HERE, "..");
+var HERE = path10.dirname(fileURLToPath(import.meta.url));
+var APP_ROOT = path10.resolve(HERE, "..");
 var arg = (name, fallback) => {
   const i = process.argv.indexOf(`--${name}`);
   return i >= 0 ? process.argv[i + 1] : process.env[`LOOPS_UI_${name.toUpperCase().replace(/-/g, "_")}`] ?? fallback;
@@ -4751,13 +5301,13 @@ var PUBLIC_ORIGINS = [...new Set((arg("public-origin", "") ?? "").split(",").map
   return url.origin;
 }))];
 var SEED = arg("cwd");
-var CWD = SEED ? path9.resolve(SEED) : null;
+var CWD = SEED ? path10.resolve(SEED) : null;
 var DEV = process.argv.includes("--dev") || process.env.NODE_ENV === "development";
 var VITE = arg("vite", "http://localhost:5173");
-var PI = arg("pi", path9.join(APP_ROOT, "bin", "pi-rpc.mjs"));
-var DATA = path9.resolve(arg("data", process.env.LOOPS_UI_DATA ?? path9.join(process.env.HOME ?? process.cwd(), ".pi", "loops-ui")));
+var PI = arg("pi", path10.join(APP_ROOT, "bin", "pi-rpc.mjs"));
+var DATA = path10.resolve(arg("data", process.env.LOOPS_UI_DATA ?? path10.join(process.env.HOME ?? process.cwd(), ".pi", "loops-ui")));
 var MODEL = arg("model", void 0) || null;
-var EXTENSIONS = (arg("extensions", path9.resolve(APP_ROOT, "../pi-loops/extensions/loop.ts")) ?? "").split(",").filter(Boolean);
+var EXTENSIONS = (arg("extensions", path10.resolve(APP_ROOT, "../pi-loops/extensions/loop.ts")) ?? "").split(",").filter(Boolean);
 function prerequisites() {
   const out = [];
   const onPath = PI.includes("/") || /^[A-Za-z]:\\/.test(PI) ? fs9.existsSync(PI) : (() => {
@@ -4778,7 +5328,7 @@ var PROBLEMS = prerequisites();
 fs9.mkdirSync(DATA, { recursive: true });
 var TOKEN = (() => {
   const explicit = arg("token", void 0);
-  const file = path9.join(DATA, "token");
+  const file = path10.join(DATA, "token");
   const stored = (() => {
     try {
       return fs9.readFileSync(file, "utf8").trim() || null;
@@ -4834,7 +5384,7 @@ var manager = new ChatManager({
 });
 var wsOf = (chat) => chat ? requireChatWorkspace(chat) : requireWorkspace();
 var wsOfRun = (run3) => {
-  const byIndex = workspaces.list().find((w) => fs9.existsSync(path9.join(w.path, STATE_DIR, `${run3}.json`)));
+  const byIndex = workspaces.list().find((w) => fs9.existsSync(path10.join(w.path, STATE_DIR, `${run3}.json`)));
   if (byIndex) return byIndex;
   const chat = manager.findRun(run3);
   if (chat) return requireChatWorkspace(chat.id);
@@ -4868,7 +5418,7 @@ var watchOf = (wsId) => {
   if (!w) {
     const read = () => {
       try {
-        return JSON.parse(fs9.readFileSync(path9.join(ws.path, ".pi", "loops.json"), "utf8"));
+        return JSON.parse(fs9.readFileSync(path10.join(ws.path, ".pi", "loops.json"), "utf8"));
       } catch {
         return {};
       }
@@ -4876,14 +5426,14 @@ var watchOf = (wsId) => {
     w = { cwd: ws.path, accepted: read() };
     watches.set(ws.id, w);
     try {
-      fs9.watch(path9.join(ws.path, ".pi"), (_e, name) => {
+      fs9.watch(path10.join(ws.path, ".pi"), (_e, name) => {
         if (name && name !== "loops.json") return;
         clearTimeout(watchTimers.get(ws.id));
         watchTimers.set(ws.id, setTimeout(() => {
           try {
             checkConfig(ws.id);
           } catch (e) {
-            configErrors.set(ws.id, { ws: ws.id, file: path9.join(ws.path, ".pi/loops.json"), error: `Could not validate settings: ${e.message}. Fix the file or save settings again.` });
+            configErrors.set(ws.id, { ws: ws.id, file: path10.join(ws.path, ".pi/loops.json"), error: `Could not validate settings: ${e.message}. Fix the file or save settings again.` });
             notifyProposals();
           }
         }, 120));
@@ -4911,7 +5461,7 @@ function notifyProposals() {
 }
 function checkConfig(wsId) {
   const w = watchOf(wsId);
-  const CONFIG = path9.join(w.cwd, ".pi", "loops.json");
+  const CONFIG = path10.join(w.cwd, ".pi", "loops.json");
   const raw2 = (() => {
     try {
       return fs9.readFileSync(CONFIG, "utf8");
@@ -4954,8 +5504,8 @@ function checkConfig(wsId) {
   notifyProposals();
 }
 var inside = (root, p) => {
-  const abs = path9.resolve(root, p);
-  return abs === root || abs.startsWith(root + path9.sep) ? abs : null;
+  const abs = path10.resolve(root, p);
+  return abs === root || abs.startsWith(root + path10.sep) ? abs : null;
 };
 var stateOf = (run3) => manager.findRun(run3)?.stateFor(run3) ?? readState(wsOfRun(run3).path, run3);
 var app = new Hono3();
@@ -5000,10 +5550,21 @@ app.use("/api/v1/*", async (c, next) => {
 var api = new Hono3();
 api.onError((error, c) => {
   if (error instanceof HTTPException) return c.json({ error: error.message }, error.status);
+  if (error instanceof SessionActionError) return c.json({ error: error.message, ...error.uncertain ? { uncertain: true } : {} }, error.status);
   console.error(error);
   return c.json({ error: error.message }, 500);
 });
 api.get("/health", (c) => c.json({ ok: PROBLEMS.length === 0, problems: PROBLEMS, cwd: CWD, data: DATA, pi: PI, extensions: EXTENSIONS, workspaces: workspaces.list() }));
+var providerAuth = await createProviderAuth({
+  onCredentialsChanged: async () => {
+    await Promise.allSettled(manager.openChats().filter((chat) => !chat.sessionActions.busy).map((chat) => chat.refreshModels()));
+  }
+});
+mountProviderAuthRoutes(api, providerAuth);
+api.route("/", createSessionActions({ requireChat: async (id) => {
+  requireChatWorkspace(id);
+  return manager.open(id);
+} }));
 api.get("/credentials", (c) => c.json({ dir: agentDir2(), providers: credentialStatus() }));
 api.post("/credentials", async (c) => {
   const body = await c.req.json().catch(() => ({}));
@@ -5073,7 +5634,7 @@ api.post("/chat", async (c) => {
     if (typeof body.ws !== "string" || !body.ws) return c.json({ error: "workspace required for a new chat" }, 400);
     ws = requireWorkspace(body.ws);
     if (!ws.open) return c.json({ error: "open the workspace before creating a chat" }, 409);
-    id = `chat-${randomUUID()}`;
+    id = `chat-${randomUUID2()}`;
     workspaces.bindChat(id, ws.id);
   }
   watchOf(ws.id);
@@ -5201,7 +5762,7 @@ api.post("/steer", async (c) => {
       // Pi executes extension commands before its streaming queue. Do not send this as a queued follow-up:
       // a background round must remain independently stoppable while the parent is in a long-running tool.
       case "stop":
-        return c.json({ ok: true, requested: true, sent: await slash(`/loop stop ${run3}`) });
+        return c.json({ ok: true, requested: true, sent: await chat.stopLoop(run3) });
       case "clean":
         return c.json({ ok: true, sent: await slash(`/loop clean ${run3}`) });
       case "rule":
@@ -5255,13 +5816,13 @@ api.get("/shot", (c) => {
   }
   const dir = attempt === "CURRENT" ? state?.best?.dir ?? null : state?.rounds?.flatMap((r) => r.attempts).find((a) => a.label === attempt || a.label?.toLowerCase() === attempt.toLowerCase())?.dir;
   if (!dir) return c.notFound();
-  const abs = inside(repo, path9.join(dir, file));
+  const abs = inside(repo, path10.join(dir, file));
   if (!abs || !fs9.existsSync(abs)) return c.notFound();
   return new Response(fs9.readFileSync(abs), { headers: { "content-type": abs.endsWith(".jpg") || abs.endsWith(".jpeg") ? "image/jpeg" : "image/png", "cache-control": "no-cache" } });
 });
 api.get("/sheet", (c) => {
   const file = c.req.query("f") ?? "";
-  const ws = c.req.query("run") ? wsOfRun(c.req.query("run")) : workspaces.list().find((w) => fs9.existsSync(path9.join(w.path, file)));
+  const ws = c.req.query("run") ? wsOfRun(c.req.query("run")) : workspaces.list().find((w) => fs9.existsSync(path10.join(w.path, file)));
   if (!ws) return c.notFound();
   const abs = inside(ws.path, file);
   if (!abs || !abs.includes(STATE_DIR) || !fs9.existsSync(abs)) return c.notFound();
@@ -5330,7 +5891,7 @@ api.post("/config", async (c) => {
     configErrors.delete(ws.id);
     const w = watchOf(ws.id);
     try {
-      w.accepted = JSON.parse(fs9.readFileSync(path9.join(ws.path, ".pi", "loops.json"), "utf8"));
+      w.accepted = JSON.parse(fs9.readFileSync(path10.join(ws.path, ".pi", "loops.json"), "utf8"));
     } catch {
     }
     notifyProposals();
@@ -5381,7 +5942,7 @@ api.get("/meta", (c) => c.json({
 app.route("/api", api);
 app.route("/api/v1", api);
 app.all("/api/*", (c) => c.json({ error: `unknown API route: ${c.req.path}` }, 404));
-var DIST = path9.join(APP_ROOT, "dist");
+var DIST = path10.join(APP_ROOT, "dist");
 app.get("*", async (c) => {
   const url = c.req.path;
   if (DEV) {
@@ -5391,11 +5952,11 @@ app.get("*", async (c) => {
   }
   const abs = inside(DIST, url === "/" ? "index.html" : url.replace(/^\//, ""));
   if (abs && fs9.existsSync(abs) && fs9.statSync(abs).isFile()) {
-    const ext = path9.extname(abs);
+    const ext = path10.extname(abs);
     const type = ext === ".js" ? "text/javascript" : ext === ".css" ? "text/css" : ext === ".woff2" ? "font/woff2" : ext === ".svg" ? "image/svg+xml" : ext === ".png" ? "image/png" : "text/html";
     return new Response(fs9.readFileSync(abs), { headers: { "content-type": type } });
   }
-  const index = path9.join(DIST, "index.html");
+  const index = path10.join(DIST, "index.html");
   if (!fs9.existsSync(index)) return c.text("run `npm run build` first", 500);
   return new Response(fs9.readFileSync(index), { headers: { "content-type": "text/html" } });
 });
@@ -5438,6 +5999,7 @@ server.listen(PORT, HOST, () => {
 });
 var shutdown = async () => {
   stopAllLive();
+  await providerAuth.close();
   await manager.closeAll();
   server.close(() => process.exit(0));
   setTimeout(() => process.exit(0), 1500);