@evandu/super-pi 0.1.129 → 0.1.130

package/dist/.super-pi-check-inputs.json

@@ -1,4 +1,4 @@
 {
-  "hash": "0220ac9d17fac45029d0f99c48d3202e59d847f64cc3c311840886684351c635",
-  "recordedAt": "2026-10-24T06:01:40.234Z"
+  "hash": "810acbfbefb53d8d64c63ed8b6bf194ce46c575d0cc9b1c259158e3a359b0bf8",
+  "recordedAt": "2026-10-24T11:40:43.712Z"
 }

package/dist/client/.super-pi-client-sources.json

@@ -31,5 +31,5 @@
     "src/client/types.ts": "7a99145ea7099ebf63a9009d855fbc1d432522b17e640a89c9596db40533dbd7",
     "src/client/vite-env.d.ts": "65996936fbb042915f7b74a200fcdde7e410f32a669b1ab9597cfaa4b0faddb5"
   },
-  "recordedAt": "2026-10-24T08:11:35.652Z"
+  "recordedAt": "2026-10-24T11:48:58.080Z"
 }

package/dist/server/active-memory.d.ts

@@ -70,6 +70,18 @@ export declare class ActiveMemory {
         content: string;
     }[];
     private ensureIndex;
+    /**
+     * Drops a workspace's search index so the next search rebuilds it from the store.
+     *
+     * WHY THIS EXISTS. `ensureIndex` builds once per workspace and `addToIndex` only ever adds, so the
+     * index outlives the messages it indexed: a revert removes messages from the store while the index
+     * keeps their text, and the next recall then hands the model a turn the user has just withdrawn -
+     * measured by scripts/revert-real-pi.test.mjs, where the withdrawn codeword came back as "recalled
+     * history" after a revert every file-level assertion proved had really truncated. The store is the
+     * source of truth; the index is a cache of it, and a cache that survives an event that invalidated
+     * its source is wrong by definition.
+     */
+    invalidateSearchIndex(workspaceId: string): void;
     private addToIndex;
     tool(token: string, body: {
         kind?: string;

package/dist/server/active-memory.js

@@ -71,7 +71,16 @@ export class ActiveMemory {
             // The live set is whatever SURVIVED, read back rather than derived from the dropped ids: deriving it
             // as "everything not dropped" would be wrong the moment an entry was removed by someone else.
             const live = new Set((await this.notes.apply(conversation.workspaceId, "", { target: "skills", action: "list" })).map((entry) => entry.id));
-            for (const name of await readdir(folder)) {
+            // The skills folder exists only once a skill has been written for this workspace, so its absence is
+            // the ordinary note-only case and not a failure. Throwing on it here used to discard the forget
+            // result above with it: the entries were already dropped, but the caller read the catch's zero as
+            // "nothing was withdrawn", and the log lied about the very rewind this method exists to do.
+            let skillFiles = [];
+            try {
+                skillFiles = await readdir(folder);
+            }
+            catch { /* no skill has ever been written for this workspace */ }
+            for (const name of skillFiles) {
                 if (name.endsWith(".md") && !live.has(name.slice(0, -3)))
                     await unlink(join(folder, name)).catch(() => { });
             }
@@ -135,6 +144,21 @@ export class ActiveMemory {
         this.inverted.set(workspaceId, index);
         this.indexedWorkspaces.add(workspaceId);
     }
+    /**
+     * Drops a workspace's search index so the next search rebuilds it from the store.
+     *
+     * WHY THIS EXISTS. `ensureIndex` builds once per workspace and `addToIndex` only ever adds, so the
+     * index outlives the messages it indexed: a revert removes messages from the store while the index
+     * keeps their text, and the next recall then hands the model a turn the user has just withdrawn -
+     * measured by scripts/revert-real-pi.test.mjs, where the withdrawn codeword came back as "recalled
+     * history" after a revert every file-level assertion proved had really truncated. The store is the
+     * source of truth; the index is a cache of it, and a cache that survives an event that invalidated
+     * its source is wrong by definition.
+     */
+    invalidateSearchIndex(workspaceId) {
+        this.indexedWorkspaces.delete(workspaceId);
+        this.inverted.delete(workspaceId);
+    }
     addToIndex(conversation, message) {
         if (!this.indexedWorkspaces.has(conversation.workspaceId) || (message.role !== "user" && message.role !== "assistant"))
             return;

package/dist/server/application/conversation-service.js

@@ -356,6 +356,11 @@ export class ConversationService {
         // so this runs on data that is settled and cannot be racing the store's own writes.
         const firstRemoved = conversation.messages[applied.boundaryIndex + 1];
         const forgotten = firstRemoved ? await this.memory?.forgetAfter(conversationId, firstRemoved.createdAt) ?? 0 : 0;
+        // The recall index is a cache of the store's messages, and the store just lost several: left alone it
+        // keeps answering the memory extension's searches with the withdrawn turns, so the model is told about
+        // history the person reverted away even though the transcript, Pi's file and the memory store all
+        // agree it is gone. Invalidate it and the next search rebuilds from what actually survived.
+        this.memory?.invalidateSearchIndex(workspaceId);
         console.log(`Super Pi: reverted conversation ${conversationId} to ${applied.boundaryIndex + 1} message(s): ` +
             `${plan.removedMessageIds.length} message(s) and ${applied.doomedRunIds.length} sub-agent run(s) dropped from state.json; ` +
             `Pi's file ${outcome.sessionFile} kept ${outcome.linesKept} line(s) and lost ${outcome.entriesDropped}; ` +

package/dist/server/pi-session.d.ts

@@ -184,6 +184,13 @@ export interface ExtensionEnvironment {
  * concurrent session's environment would otherwise land in the middle of this one.
  */
 export declare function withEnvironment<T>(values: Record<string, string>, work: () => Promise<T>): Promise<T>;
+/**
+ * `withEnvironment` for one session's extension load, serialized across all session creations.
+ *
+ * The extension factories run inside `work` and capture the values into their closures; after the
+ * window closes they never read `process.env` again, so only the WINDOW needs to be exclusive.
+ */
+export declare function withIsolatedSessionEnv<T>(values: Record<string, string>, work: () => Promise<T>): Promise<T>;
 /**
  * The live session for one conversation.
  *
@@ -363,14 +370,17 @@ export interface SessionCreation {
  *
  * The order of operations here IS the isolation mechanism, and each step is load-bearing:
  *
- * 1. The environment is applied, so the extension factories that run during the reload read this
- *    session's values rather than another session's.
- * 2. The loader is created and reloaded, which is when Pi calls the extension factories. The factories
- *    CAPTURE the values; they do not read them later.
+ * 1. The loader is created with Super Pi's extension paths, for PI to load - through its jiti
+ *    transpiler and virtual modules, the same machinery the spawned CLI used. Nothing here imports a
+ *    Super Pi extension file directly; see the comment at the loader below for why that must never
+ *    come back.
+ * 2. The reload runs inside this session's env window (`withIsolatedSessionEnv`), which is when Pi
+ *    calls the extension factories. The factories CAPTURE the values; they do not read them later.
  * 3. The session is created with that loader.
  *
- * Step 2 happening outside step 1 would give every session the same configuration, and step 1 happening
- * after step 2 would give every session no configuration at all. The window is the whole of the reload.
+ * Step 2 happening outside its env window would give every session the same configuration, and the
+ * window would give every session no configuration at all if two creations could interleave - which
+ * the serialization in `withIsolatedSessionEnv` prevents.
  *
  * THE FACTORY IS INJECTABLE. A test needs to drive a session without a real Pi behind it - to check what
  * a session was BUILT with (its working directory, its allowlist) rather than what it eventually

package/dist/server/pi-session.js

@@ -225,20 +225,39 @@ export async function withEnvironment(values, work) {
         }
     }
 }
+/**
+ * The env window of the session currently being built, so the next one queues behind it.
+ *
+ * `withEnvironment` alone is not safe here: its window is process-global, and two sessions created
+ * concurrently would interleave - A applies its capability, B applies its own, and A's extension
+ * factory captures B's credential. Chaining the windows means a concurrent creation waits for the
+ * other's `reload()` - milliseconds - instead of silently wearing its capability.
+ */
+let extensionEnvWindow = Promise.resolve();
+/**
+ * `withEnvironment` for one session's extension load, serialized across all session creations.
+ *
+ * The extension factories run inside `work` and capture the values into their closures; after the
+ * window closes they never read `process.env` again, so only the WINDOW needs to be exclusive.
+ */
+export function withIsolatedSessionEnv(values, work) {
+    const run = extensionEnvWindow.then(() => withEnvironment(values, work));
+    extensionEnvWindow = run.then(() => undefined, () => undefined);
+    return run;
+}
 export async function createPiSession(creation) {
     const startedAt = performance.now();
     traceSession(creation.sessionId, "sdk.load.begin", startedAt);
     const sdk = await loadSdk();
     traceSession(creation.sessionId, "sdk.load.end", startedAt);
     const agentDir = creation.agentDir ?? defaultAgentDir();
-    // Extension credentials are per-session capabilities. Do not temporarily mutate process.env here:
-    // two concurrent session creations otherwise race and can capture each other's capability.
-    const inlinePaths = creation.extensionPaths.filter((path) => /super-pi-(task|memory|knowledge)/.test(path.replaceAll("\\", "/")));
-    const externalPaths = creation.extensionPaths.filter((path) => !inlinePaths.includes(path));
-    const extensionFactories = await Promise.all(inlinePaths.map(async (path) => {
-        const mod = await import(pathToFileURL(path).href);
-        return async (pi) => mod.default?.(pi, creation.extensionEnv);
-    }));
+    // THE EXTENSIONS ARE PI'S TO LOAD. Every path goes to Pi's own resource loader, which imports them
+    // through its jiti transpiler with its virtual modules - and both of those are load-bearing:
+    // `@sinclair/typebox` is a Pi virtual module that NO node_modules anywhere can resolve, and Node's
+    // type stripping refuses .ts under any `node_modules` segment (which is where a published package
+    // lives). A native `import()` here survived neither - it broke every installed layout the moment it
+    // shipped, invisibly, because nothing in `npm run check` runs from an installed layout.
+    // `scripts/installed-layout.test.mjs` exists to keep that class of breakage visible.
     return (async () => {
         // THE AGENT'S PROMPT. Pi's loader takes the same two shapes the command line took: a `systemPrompt`
         // that REPLACES Pi's own, and an `appendSystemPrompt` list of files that are ADDED to it. An agent
@@ -249,15 +268,17 @@ export async function createPiSession(creation) {
         const loader = new sdk.DefaultResourceLoader({
             cwd: creation.cwd,
             agentDir,
-            ...(externalPaths.length ? { additionalExtensionPaths: externalPaths } : {}),
-            ...(extensionFactories.length ? { extensionFactories } : {}),
+            ...(creation.extensionPaths.length ? { additionalExtensionPaths: creation.extensionPaths } : {}),
             ...(creation.systemPromptFile && creation.systemPromptMode === "replace"
                 ? { systemPrompt: creation.systemPromptFile }
                 : creation.systemPromptFile
                     ? { appendSystemPrompt: [creation.systemPromptFile] }
                     : {}),
         });
-        await loader.reload();
+        // The extension factories run inside `reload()` and capture this session's env values into their
+        // closures; the window is serialized (`withIsolatedSessionEnv`) so a concurrent creation cannot
+        // land its own capability in the middle.
+        await withIsolatedSessionEnv(creation.extensionEnv, () => loader.reload());
         traceSession(creation.sessionId, "sdk.loader.reload", startedAt, `extensions=${creation.extensionPaths.length}`);
         const sessionManager = creation.persist === false
             ? sdk.SessionManager.inMemory(creation.cwd, { id: creation.sessionId })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evandu/super-pi",
-  "version": "0.1.129",
+  "version": "0.1.130",
   "description": "Web control plane and companion for Pi",
   "license": "MIT",
   "type": "module",
@@ -43,6 +43,8 @@
     "scripts/stream-checkpoint.test.mjs",
     "scripts/stream-transport.test.mjs",
     "scripts/pi-session.test.mjs",
+    "scripts/pi-session-isolation.test.mjs",
+    "scripts/installed-layout.test.mjs",
     "scripts/pi-model-switch.test.mjs",
     "scripts/pi-thinking-levels.test.mjs",
     "scripts/diagnose-cli.test.mjs",