@crouton-kit/crouter 0.3.68 → 0.3.78

package/dist/core/runtime/placement.d.ts

@@ -1,7 +1,7 @@
 import { type FocusRow } from '../canvas/index.js';
 export type { FocusRow };
-export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
-export type { RespawnPaneOpts } from './tmux.js';
+export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, installTmuxBindings, installTmuxBindings as installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
+export type { RespawnPaneOpts, TmuxInstalledPair, TmuxInstallDiagnostic, TmuxInstallResult } from './tmux.js';
 /** The viewer a node has on screen, or null. UNIQUE(node_id) ⇒ at most one. */
 export declare function focusOf(nodeId: string): FocusRow | null;
 /** Does this node have a live viewer on screen? */

package/dist/core/runtime/placement.js

@@ -48,7 +48,10 @@ import { isPidAlive } from '../canvas/pid.js';
 // re-exported for the same reason — callers building the seam's expected
 // bundled-pi command string (e.g. the M1 seam test) need the identical quoting
 // piCommand uses internally, without importing tmux.ts directly.
-export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
+export { splitWindow, breakPane, selectLayout, selectPane, focusWindow, selectWindow, switchClient, openNodeWindow, ensureSession, paneLocation, paneExists, paneRunning, paneCurrentPath, currentTmux, inTmux, installTmuxBindings, 
+// Compile seam for attach-cmd.ts, which still calls installMenuBinding();
+// deleted when the attach unit imports installTmuxBindings directly.
+installTmuxBindings as installMenuBinding, setPaneOption, getPaneOption, piCommand, shellQuote, respawnPaneSync, closePane, windowOfPane, renameWindow, paneOfWindow, windowAlive, listLivePanes, } from './tmux.js';
 // ---------------------------------------------------------------------------
 // Viewer registry reads — COMPOSE over the canvas focuses table (§2.3/§4).
 //

package/dist/core/runtime/promote.js

@@ -55,6 +55,10 @@ export function promote(nodeId, opts = {}) {
         // across the polymorph (the persona default is recomputed fresh for
         // targetKind).
         model: targetModel,
+        // Resolve kind/ladder config against the NODE's own cwd + profile, not
+        // this process's ambient scope.
+        cwd: node.cwd,
+        profileId: node.profile_id,
     });
     // Seed a barebones roadmap scaffold if absent so the file exists for a
     // refresh. Pre-fill its Goal from the node's goal doc when present (set at

package/dist/core/runtime/recap.d.ts

@@ -1,8 +1,8 @@
-/** Ask pi headlessly for a three-fragment recap of `conversation`, async. Invokes
- *  `onRecap` with the parsed fragment lines on success, or never (silent) on any
+/** Ask pi headlessly for a concise briefing of `conversation`, async. Invokes
+ *  `onRecap` with the parsed string on success, or never (silent) on any
  *  failure — non-zero exit, timeout, empty/garbled output. Owns the subprocess
  *  mechanics — crucially it hands pi an immediate stdin EOF: `pi -p` reads stdin,
  *  and execFile's default stdin is an OPEN pipe that never closes, so without
  *  this pi blocks waiting for EOF and the call exits non-zero (the same gotcha
  *  naming.ts documents). */
-export declare function generateRecap(conversation: string, onRecap: (lines: string[]) => void): void;
+export declare function generateRecap(conversation: string, onRecap: (briefing: string) => void, liveModel?: string): void;

package/dist/core/runtime/recap.js

@@ -1,9 +1,10 @@
-// Inactivity recap — turn a dormant node's conversation into a three-fragment
-// "where it left off" card (goal / doing-now / next) for the recap widget.
+// Inactivity recap — turn a dormant node's conversation into one concise
+// returning-developer briefing for the recap widget.
 //
 // One entry point: generateRecap — async (execFile, non-blocking), mirroring
-// naming.ts's headless-`pi -p` pattern exactly. It runs Haiku over the literal
-// back-and-forth (the caller concatenates user+assistant text) with a stripped-
+// naming.ts's headless-`pi -p` pattern exactly. It runs the live conversation's
+// working model over the literal back-and-forth (the caller concatenates user and
+// assistant text) with a stripped-
 // down pi invocation (no tools/session/context/extensions/skills), so it's fast
 // and side-effect free and can never recurse into another spawn.
 //
@@ -15,37 +16,48 @@
 // Plain TS-with-types — no imports from @earendil-works/* so it compiles inside
 // crouter's own tsc build without a dep on the pi packages.
 import { execFile } from 'node:child_process';
-import { resolveBundledPiCliPath } from './pi-cli.js';
+import { bundledPiSubprocessEnv, resolveBundledPiCliPath } from './pi-cli.js';
 /** Wall-clock budget for the headless pi call before we give up (no recap). */
 const RECAP_TIMEOUT_MS = 25_000;
-/** Default recap model — Haiku. A recap is a one-shot summarization, so we pin
- *  the small/fast model rather than the node's heavyweight default. Override
- *  with CRTR_RECAP_MODEL (mirrors CRTR_NAME_MODEL). */
+/** Fallback model when the live session has not resolved one yet. Ordinarily the
+ *  caller passes the provider/model that just completed the conversation's last
+ *  turn, avoiding a dead hard-pinned provider. CRTR_RECAP_MODEL overrides both. */
 const DEFAULT_RECAP_MODEL = 'anthropic/claude-haiku-4-5';
-const RECAP_SYSTEM_PROMPT = 'You write a terse "where we left off" recap of a coding-agent work session, ' +
-    'read at a glance by someone returning to a paused conversation. You are given ' +
-    'the literal back-and-forth between the user and the agent. Output EXACTLY three ' +
-    'lines, nothing else — no labels, no numbering, no bullets, no punctuation at the ' +
-    'end of a line, no prose:\n' +
-    '  Line 1: the GOAL — what this session is ultimately trying to achieve.\n' +
-    '  Line 2: DOING NOW — what was just happening / the active piece of work.\n' +
-    '  Line 3: NEXT — the immediate next step.\n' +
-    'Each line is a short FRAGMENT, not a sentence (e.g. `wire up recap widget above editor`, ' +
-    'not `We are wiring up the recap widget.`). Keep each under ~60 characters. ' +
-    'If the session has barely started or you cannot tell, still give your best three ' +
-    'fragments from whatever text exists. Output JUST the three lines.';
+const RECAP_SYSTEM_PROMPT = 'You brief a developer returning to a paused coding-agent conversation. They run ' +
+    'many agent sessions in parallel and have lost this one\'s thread; the brief is ' +
+    'pinned above their input box and must re-orient them in seconds, without ' +
+    're-reading the transcript. You are given the literal user/agent back-and-forth ' +
+    '(tool output omitted, most recent last).\n' +
+    '\n' +
+    'Output EXACTLY one concise plain-text briefing: no labels, numbering, bullets, ' +
+    'or line breaks. In one or two sentences, explain the overall goal, what has ' +
+    'actually happened, and the current next move or blocker. If the agent is ' +
+    'waiting on the developer, make the needed answer clear. Be concrete: use the ' +
+    'actual file names, commands, branches, option labels, and error messages from ' +
+    'the conversation — a developer re-orients on specifics, never abstractions. ' +
+    'Weight the end of the conversation, never narrate ("the user asked…"), hedge, ' +
+    'or pad. If the conversation has barely started, still emit your best briefing. ' +
+    'Output JUST the briefing.';
 /** Put the conversation FIRST in a delimited block, then the instruction, so the
  *  model reads the content before being told what to do. */
 function recapUserPrompt(conversation) {
-    return `<conversation>\n${conversation}\n</conversation>\n\nWrite the three-line recap of the session above (goal / doing-now / next). Output JUST the three lines.`;
+    return `<conversation>\n${conversation}\n</conversation>\n\nWrite the concise returning-developer briefing for the conversation above. Output JUST the briefing.`;
 }
 /** The pi argv for a headless recap request. Stripped down (no tools, session,
  *  context files, extensions, skills, templates, themes) so it's fast and
- *  side-effect free. Pinned to Haiku with thinking off. Override the model with
- *  CRTR_RECAP_MODEL. */
-function recapArgs(conversation) {
+ *  side-effect free. Thinking stays off; model precedence is explicit env
+ *  override → the conversation's live working model → the small fallback. */
+function recapArgs(conversation, liveModel) {
     const override = process.env['CRTR_RECAP_MODEL'];
-    const model = override !== undefined && override.trim() !== '' ? override.trim() : DEFAULT_RECAP_MODEL;
+    // An explicit operator override wins. Otherwise prefer the live conversation's
+    // current model: it just completed a successful turn, while a hard-pinned
+    // provider (the old Haiku-only path) may be rate-limited and silently produce
+    // no brief. The small default remains for sessions with no resolved model yet.
+    const model = override !== undefined && override.trim() !== ''
+        ? override.trim()
+        : liveModel !== undefined && liveModel.trim() !== ''
+            ? liveModel.trim()
+            : DEFAULT_RECAP_MODEL;
     const argv = [
         '-p',
         '--no-session',
@@ -63,40 +75,31 @@ function recapArgs(conversation) {
     ];
     return argv;
 }
-/** Parse the model's raw stdout into up to three short fragment lines. Strips any
- *  stray leading labels/bullets the model may have added despite instructions,
- *  drops empties, and hard-caps line length so a runaway line can't blow up the
- *  widget. Returns [] when nothing usable survives (→ no recap). */
+/** Normalize model stdout to one display string. Newlines are whitespace rather
+ *  than separate fields; the viewer wraps this string to its available width. */
 function parseRecap(stdout) {
-    const LINE_CAP = 72;
-    const lines = stdout
-        .split('\n')
-        .map((l) => l.trim())
-        // Strip a leading `goal:` / `now:` / `next:` / `- ` / `1.` style prefix.
-        .map((l) => l.replace(/^(?:[-*•]\s*)?(?:\d+[.)]\s*)?(?:goal|now|doing(?:[\s-]now)?|next)\s*[:\-]\s*/i, '').trim())
-        .filter((l) => l !== '');
-    return lines.slice(0, 3).map((l) => (l.length > LINE_CAP ? l.slice(0, LINE_CAP) : l));
+    return stdout.replace(/\s+/g, ' ').trim();
 }
-/** Ask pi headlessly for a three-fragment recap of `conversation`, async. Invokes
- *  `onRecap` with the parsed fragment lines on success, or never (silent) on any
+/** Ask pi headlessly for a concise briefing of `conversation`, async. Invokes
+ *  `onRecap` with the parsed string on success, or never (silent) on any
  *  failure — non-zero exit, timeout, empty/garbled output. Owns the subprocess
  *  mechanics — crucially it hands pi an immediate stdin EOF: `pi -p` reads stdin,
  *  and execFile's default stdin is an OPEN pipe that never closes, so without
  *  this pi blocks waiting for EOF and the call exits non-zero (the same gotcha
  *  naming.ts documents). */
-export function generateRecap(conversation, onRecap) {
+export function generateRecap(conversation, onRecap, liveModel) {
     const body = (conversation ?? '').trim();
     if (body === '')
         return;
     try {
-        const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...recapArgs(body)], { encoding: 'utf8', timeout: RECAP_TIMEOUT_MS }, (err, stdout) => {
+        const child = execFile(process.execPath, [resolveBundledPiCliPath(), ...recapArgs(body, liveModel)], { encoding: 'utf8', timeout: RECAP_TIMEOUT_MS, env: bundledPiSubprocessEnv() }, (err, stdout) => {
             if (err || typeof stdout !== 'string')
                 return; // silent — no recap
-            const lines = parseRecap(stdout);
-            if (lines.length === 0)
+            const briefing = parseRecap(stdout);
+            if (briefing === '')
                 return;
             try {
-                onRecap(lines);
+                onRecap(briefing);
             }
             catch { /* best-effort */ }
         });

package/dist/core/runtime/recycle.js

@@ -97,7 +97,11 @@ export async function recycleNode(nodeId, callerPane) {
         ensureDaemon();
     }
     catch { /* daemon is best-effort */ }
-    const { launch } = buildLaunchSpec('general', 'base', { lifecycle: 'resident', hasManager: false });
+    // Resolve against the RECYCLED node's cwd + profile (not this process's
+    // ambient scope) and carry the profile onto the fresh root — it is the same
+    // person's seat, so profile-scope defaults (e.g. a persisted /model default)
+    // must keep applying.
+    const { launch } = buildLaunchSpec('general', 'base', { lifecycle: 'resident', hasManager: false, cwd: meta.cwd, profileId: meta.profile_id });
     const root = spawnNode({
         kind: 'general',
         mode: 'base',
@@ -105,6 +109,7 @@ export async function recycleNode(nodeId, callerPane) {
         cwd: meta.cwd,
         name: 'general',
         parent: null,
+        profile_id: meta.profile_id,
         launch,
     });
     // Hand the viewport to the fresh root: reuse M's focus row over the SAME pane

package/dist/core/runtime/reset.js

@@ -86,6 +86,10 @@ export async function relaunchRoot(oldId, deps = {}) {
         lifecycle: 'resident',
         hasManager: false,
         model: old.model_override ?? undefined,
+        // The OLD root's cwd + profile, not this process's ambient scope — the
+        // relaunch is the same seat, so profile-scope kind defaults keep applying.
+        cwd: old.cwd,
+        profileId: old.profile_id,
     });
     const newMeta = spawnNode({
         kind: old.kind,
@@ -94,6 +98,7 @@ export async function relaunchRoot(oldId, deps = {}) {
         cwd: old.cwd,
         name: old.kind,
         parent: null,
+        profile_id: old.profile_id,
         launch,
         modelOverride: old.model_override ?? undefined,
     });

package/dist/core/runtime/revive.js

@@ -29,7 +29,7 @@ import { fanDoctrineWake } from './close.js';
 import { buildPiArgv } from './launch.js';
 import { buildReviveKickoff, drainBearings } from './kickoff.js';
 import { headlessBrokerHost } from './host.js';
-import { recordedPidLiveness } from '../canvas/pid.js';
+import { isRecordedPidAlive } from '../canvas/pid.js';
 import { reconcileBootLiveness } from '../canvas/boot.js';
 import { clearFault } from './fault.js';
 import { clearInjectedDocs } from '../substrate/injected-store.js';
@@ -118,24 +118,34 @@ export function reviveNode(nodeId, opts) {
     const db = openDb();
     db.exec('BEGIN IMMEDIATE');
     try {
-        // Double-revive guard: identity-aware liveness on pi_pid, requiring
-        // CONFIRMED alive — not the fail-open-to-alive boolean adapter. A node
-        // whose broker pid is CONFIRMED still running as that same broker (not a
-        // reused pid) was already revived by another path — re-launching would put
-        // a SECOND broker on the same session file. No-op. A bare isPidAlive would
-        // misread a reused pid (heavy forking, esp. Linux) as "still alive" and
-        // skip the relaunch forever; conversely, treating an INDETERMINATE read
-        // (can't confirm either way, e.g. a transient `ps` probe failure) as
-        // "alive" here would risk the opposite failure — silently skipping a
-        // needed relaunch and stranding the node with no engine. So this guard
-        // blocks ONLY on a positively confirmed-alive read; `dead` AND
-        // `indeterminate` both proceed to relaunch. We accept that tradeoff: an
-        // `indeterminate` read CAN come from a genuinely live broker whose identity
-        // `ps` probe transiently failed, so proceeding risks a rare double-launch —
-        // but stranding a truly-dead node with no engine is the worse failure, and
-        // recovering from it is far harder, so we bias toward relaunching.
+        // Double-revive guard: identity-aware liveness on pi_pid. Only a
+        // CONFIRMED-dead read proceeds to relaunch; `alive` AND `indeterminate`
+        // both no-op. A node whose broker pid is still running as that same broker
+        // was already revived by another path — re-launching would put a SECOND
+        // broker on the same session file.
+        //
+        // Why `indeterminate` must NOT relaunch (live incident, 2026-07-10, 4GB
+        // Hearth home): the `dead` verdict comes from the fork-free signal-0
+        // syscall (`isPidAlive`), which cannot fail under resource pressure — a
+        // truly dead broker ALWAYS reads `dead`. `indeterminate` therefore means
+        // "the pid EXISTS but the `ps` identity probe failed" — and the probe is a
+        // fork+exec, so it fails exactly when the host is out of memory (ENOMEM)
+        // or thrashing (>2s timeout). Those failures are CORRELATED and
+        // persistent, not transient: under sustained OOM every guard read went
+        // `indeterminate`, every daemon grace window relaunched a broker whose
+        // predecessor was still alive, and `recordPid` below overwrote the row's
+        // pid — leaking each older broker untracked. That compounded to 7 live
+        // engines on one node (35 total on the home), which itself sustained the
+        // OOM that kept the probes failing. Relaunching on uncertainty is
+        // self-amplifying in precisely the regime where uncertainty occurs.
+        //
+        // The cost of no-opping on `indeterminate` is bounded and small: the only
+        // dead-but-indeterminate cases are a zombie or a reused pid whose `ps`
+        // probe failed — both re-read next daemon tick, and read `dead` the
+        // moment a probe succeeds. `isRecordedPidAlive` is the exact adapter for
+        // this direction (false ONLY on confirmed `dead`).
         const live = getNode(nodeId) ?? meta;
-        if (recordedPidLiveness(live.pi_pid, live.pi_pid_identity) === 'alive') {
+        if (isRecordedPidAlive(live.pi_pid, live.pi_pid_identity)) {
             return {
                 window: null,
                 session: live.tmux_session ?? null,

package/dist/core/runtime/session-list-cache.d.ts

@@ -0,0 +1,23 @@
+import type { WireSessionInfo } from './broker-protocol.js';
+export declare function compactSessionSearchText(text: string): string;
+/** In-memory + file-backed cache keyed by absolute `.jsonl` path. One instance
+ *  per broker; the file is shared across brokers (last-writer-wins via atomic
+ *  rename — a lost update just costs one file's rebuild next open, never
+ *  corruption). */
+export declare class SessionListCache {
+    private readonly cacheFile;
+    private cache;
+    private loaded;
+    private persisting;
+    private persistAgain;
+    constructor(cacheFile: string);
+    /** Sessions for one cwd's session dir (the picker's default `cwd` scope). */
+    listDir(sessionDir: string): Promise<WireSessionInfo[]>;
+    /** Sessions across every cwd's dir under the sessions root (`all` scope). */
+    listAll(sessionsRoot: string): Promise<WireSessionInfo[]>;
+    private build;
+    private ensureLoaded;
+    /** Atomic write (temp + rename) so a concurrent reader never sees a partial
+     *  file. Coalesces overlapping writes into one trailing flush. */
+    private persist;
+}

package/dist/core/runtime/session-list-cache.js

@@ -0,0 +1,270 @@
+// Broker-side cache for the `/resume` session picker's `list_sessions` reply.
+//
+// pi's `SessionManager.list()` reads EVERY `.jsonl` in a cwd's session dir in
+// full, line-by-line, to build each session's `allMessagesText` search field.
+// On a large corpus (3.3k files / 1.1 GiB here) that is ~3.6s of CPU-bound
+// JSON.parse on EVERY picker open — pi exposes no per-file entry point and no
+// cache. This module keeps a `(mtimeMs, size)`-keyed cache of the already-wire-
+// shaped, search-text-bounded `WireSessionInfo`: on each open it stats every
+// file (cheap — ~260ms for 3.3k) and rebuilds info ONLY for new/changed files,
+// reusing cached entries for the rest and dropping deleted ones. The cache is
+// persisted to one global JSON file so the first open after a broker restart is
+// also fast.
+//
+// `buildWireSessionInfo` below is a faithful mirror of pi's private
+// `buildSessionInfo` (node_modules/@earendil-works/pi-coding-agent/dist/core/
+// session-manager.js) — it is not exported, so the only way to rebuild a single
+// file's info without re-reading the whole corpus is to reproduce its parse.
+// Keep it in sync with pi's session-file format (CURRENT_SESSION_VERSION).
+import { createReadStream } from 'node:fs';
+import { readFile, readdir, rename, stat, writeFile } from 'node:fs/promises';
+import { createInterface } from 'node:readline';
+import { join } from 'node:path';
+/** Search-text bound: `allMessagesText` is searched on every query edit; pi's
+ *  unbounded value retains gigabytes in the viewer and turns key-repeat into GC
+ *  jitter. The opening and latest text keep search useful. */
+const SESSION_SEARCH_TEXT_CHARS = 1024;
+export function compactSessionSearchText(text) {
+    if (text.length <= SESSION_SEARCH_TEXT_CHARS)
+        return text;
+    const half = SESSION_SEARCH_TEXT_CHARS / 2;
+    return `${text.slice(0, half)} … ${text.slice(-half)}`;
+}
+const MAX_CONCURRENT_INFO_LOADS = 10;
+// ---- faithful mirror of pi's private buildSessionInfo -----------------------
+function parseLine(line) {
+    if (!line.trim())
+        return null;
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+}
+function extractTextContent(message) {
+    const content = message['content'];
+    if (typeof content === 'string')
+        return content;
+    if (!Array.isArray(content))
+        return '';
+    return content
+        .filter((b) => b.type === 'text')
+        .map((b) => b.text)
+        .join(' ');
+}
+function messageActivityTime(entry) {
+    const message = entry['message'];
+    if (!message || !('content' in message))
+        return undefined;
+    const role = message['role'];
+    if (role !== 'user' && role !== 'assistant')
+        return undefined;
+    const ts = message['timestamp'];
+    if (typeof ts === 'number')
+        return ts;
+    const t = new Date(entry['timestamp']).getTime();
+    return Number.isNaN(t) ? undefined : t;
+}
+/** Build one session's wire info by streaming the file. Returns null for a
+ *  malformed/headerless file (matches pi, which drops those from the list). */
+async function buildWireSessionInfo(filePath) {
+    try {
+        const stats = await stat(filePath);
+        let header = null;
+        let messageCount = 0;
+        let firstMessage = '';
+        const allMessages = [];
+        let name;
+        let lastActivityTime;
+        const rl = createInterface({
+            input: createReadStream(filePath, { encoding: 'utf8' }),
+            crlfDelay: Infinity,
+        });
+        for await (const line of rl) {
+            const entry = parseLine(line);
+            if (!entry)
+                continue;
+            if (!header) {
+                if (entry['type'] !== 'session')
+                    return null;
+                header = entry;
+                continue;
+            }
+            if (entry['type'] === 'session_info') {
+                name = entry['name']?.trim() || undefined;
+            }
+            if (entry['type'] !== 'message')
+                continue;
+            messageCount++;
+            const activityTime = messageActivityTime(entry);
+            if (typeof activityTime === 'number') {
+                lastActivityTime = Math.max(lastActivityTime ?? 0, activityTime);
+            }
+            const message = entry['message'];
+            if (!message || !('content' in message))
+                continue;
+            const role = message['role'];
+            if (role !== 'user' && role !== 'assistant')
+                continue;
+            const textContent = extractTextContent(message);
+            if (!textContent)
+                continue;
+            allMessages.push(textContent);
+            if (!firstMessage && role === 'user')
+                firstMessage = textContent;
+        }
+        if (!header)
+            return null;
+        const cwd = typeof header['cwd'] === 'string' ? header['cwd'] : '';
+        const headerTime = typeof header['timestamp'] === 'string' ? new Date(header['timestamp']).getTime() : NaN;
+        const modified = typeof lastActivityTime === 'number' && lastActivityTime > 0
+            ? new Date(lastActivityTime)
+            : !Number.isNaN(headerTime)
+                ? new Date(headerTime)
+                : stats.mtime;
+        return {
+            path: filePath,
+            id: header['id'],
+            cwd,
+            name,
+            parentSessionPath: header['parentSession'],
+            created: new Date(header['timestamp']).toISOString(),
+            modified: modified.toISOString(),
+            messageCount,
+            firstMessage: firstMessage || '(no messages)',
+            // Cache the already-bounded wire form (the selector searches this field).
+            allMessagesText: compactSessionSearchText(allMessages.join(' ')),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// ---- the cache ---------------------------------------------------------------
+/** In-memory + file-backed cache keyed by absolute `.jsonl` path. One instance
+ *  per broker; the file is shared across brokers (last-writer-wins via atomic
+ *  rename — a lost update just costs one file's rebuild next open, never
+ *  corruption). */
+export class SessionListCache {
+    cacheFile;
+    cache = new Map();
+    loaded = false;
+    persisting = false;
+    persistAgain = false;
+    constructor(cacheFile) {
+        this.cacheFile = cacheFile;
+    }
+    /** Sessions for one cwd's session dir (the picker's default `cwd` scope). */
+    async listDir(sessionDir) {
+        return this.build(await jsonlFiles(sessionDir));
+    }
+    /** Sessions across every cwd's dir under the sessions root (`all` scope). */
+    async listAll(sessionsRoot) {
+        let dirEntries;
+        try {
+            dirEntries = (await readdir(sessionsRoot, { withFileTypes: true }))
+                .filter((e) => e.isDirectory())
+                .map((e) => join(sessionsRoot, e.name));
+        }
+        catch {
+            return [];
+        }
+        const files = [];
+        for (const dir of dirEntries)
+            files.push(...(await jsonlFiles(dir)));
+        return this.build(files);
+    }
+    async build(files) {
+        await this.ensureLoaded();
+        const present = new Set(files);
+        for (const key of this.cache.keys()) {
+            if (!present.has(key))
+                this.cache.delete(key);
+        }
+        const infos = [];
+        let changed = false;
+        let next = 0;
+        const worker = async () => {
+            while (next < files.length) {
+                const file = files[next++];
+                if (file === undefined)
+                    return;
+                const st = await stat(file).catch(() => null);
+                if (!st) {
+                    this.cache.delete(file);
+                    changed = true;
+                    continue;
+                }
+                const cached = this.cache.get(file);
+                if (cached && cached.mtimeMs === st.mtimeMs && cached.size === st.size) {
+                    infos.push(cached.info);
+                    continue;
+                }
+                const info = await buildWireSessionInfo(file);
+                changed = true;
+                if (!info) {
+                    this.cache.delete(file);
+                    continue;
+                }
+                this.cache.set(file, { mtimeMs: st.mtimeMs, size: st.size, info });
+                infos.push(info);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(MAX_CONCURRENT_INFO_LOADS, files.length) }, () => worker()));
+        if (changed)
+            void this.persist();
+        infos.sort((a, b) => new Date(b.modified).getTime() - new Date(a.modified).getTime());
+        return infos;
+    }
+    async ensureLoaded() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            const raw = JSON.parse(await readFile(this.cacheFile, 'utf8'));
+            for (const [path, entry] of Object.entries(raw))
+                this.cache.set(path, entry);
+        }
+        catch {
+            // Missing or corrupt cache file → start empty and rebuild. No lenient
+            // multi-path recovery: the cache is derivable, so a bad file is just
+            // overwritten on the next persist.
+        }
+    }
+    /** Atomic write (temp + rename) so a concurrent reader never sees a partial
+     *  file. Coalesces overlapping writes into one trailing flush. */
+    async persist() {
+        if (this.persisting) {
+            this.persistAgain = true;
+            return;
+        }
+        this.persisting = true;
+        try {
+            const obj = {};
+            for (const [path, entry] of this.cache)
+                obj[path] = entry;
+            const tmp = `${this.cacheFile}.${process.pid}.tmp`;
+            await writeFile(tmp, JSON.stringify(obj));
+            await rename(tmp, this.cacheFile);
+        }
+        catch {
+            // Best-effort: a failed persist only costs a rebuild next open.
+        }
+        finally {
+            this.persisting = false;
+            if (this.persistAgain) {
+                this.persistAgain = false;
+                void this.persist();
+            }
+        }
+    }
+}
+async function jsonlFiles(dir) {
+    try {
+        return (await readdir(dir)).filter((f) => f.endsWith('.jsonl')).map((f) => join(dir, f));
+    }
+    catch {
+        return [];
+    }
+}