@evandu/super-pi 0.1.138 → 0.1.140

package/dist/server/index.js

@@ -24,6 +24,8 @@ import { RunService } from "./application/run-service.js";
 import { FileChangeTracker } from "./file-changes.js";
 import { ConversationService } from "./application/conversation-service.js";
 import { ScheduledTaskService } from "./application/scheduled-task-service.js";
+import { SessionLedger } from "./session-ledger.js";
+import { SessionOrchestratorService } from "./application/session-orchestrator-service.js";
 import { WorkspaceService } from "./application/workspace-service.js";
 import { CommandHandler } from "./command-handler.js";
 import { TerminalService, terminalDisabledReason } from "./terminal.js";
@@ -114,6 +116,7 @@ const workflowEndpoint = `http://${internalHost}:${port}/api/workflow/run`;
 const questionEndpoint = `http://${internalHost}:${port}/api/question`;
 const toolsEndpoint = `http://${internalHost}:${port}/api/tools`;
 const documentsEndpoint = `http://${internalHost}:${port}/api/documents/tool`;
+const orchestratorEndpoint = `http://${internalHost}:${port}/api/orchestrator`;
 // ------------------------------------------------------------- Core singletons
 const store = await openStateStore(dataDir, process.env.SUPER_PI_PERSISTENCE ?? "sqlite");
 const toolRegistry = new ToolRegistry(dataDir);
@@ -136,11 +139,10 @@ const paths = {
 };
 const runtime = process.env.SUPER_PI_RUNTIME === "welcome"
     ? new WelcomeRuntime()
-    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, scheduledTaskEndpoint, uploadsDir });
-// THE CLIENT GETS THE VISIBLE STATE, NOT THE WHOLE STORE. `clientState()` is `snapshot()` minus the
-// workspaces that were taken out of the sidebar - they are still in the store (that is what lets the
-// same folder be added back with its history), but they are not part of the app any more.
-const broadcaster = new WsBroadcaster(() => store.clientState());
+    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, scheduledTaskEndpoint, orchestratorEndpoint, uploadsDir });
+// Closed workspaces stay in the store for reopening. Focused sockets receive all visible sidebar
+// summaries and only their selected transcript; legacy sockets retain the complete visible state.
+const broadcaster = new WsBroadcaster((scope) => store.clientState(scope));
 const memory = new ActiveMemory(join(dataDir, "memories"), store, runtime);
 process.env.SUPER_PI_MEMORY_ENDPOINT = `http://${internalHost}:${port}/api/memory/tool`;
 if (runtime instanceof PiRpcRuntime)
@@ -174,13 +176,24 @@ supervisor.setMemory(memory);
 const validateModel = (conversationId, selection) => validateConversationModel(store, runtime, conversationId, selection);
 runtime.setModelValidator?.(validateModel);
 supervisor.setModelValidator(validateModel);
+/**
+ * DIAGNOSTIC ONLY - reproduces the pre-fix flood wire-for-wire (a full `state` broadcast per
+ * `subagent.event`, uncapped live output) so probes and regression tests can A/B the fix. Never set
+ * outside a probe; see docs/SUBAGENT-WS-FLOOD-FIX-2026-10-29.md.
+ */
+const legacySubagentFlood = process.env.SUPER_PI_LEGACY_SUBAGENT_FLOOD === "1";
 const subagents = new SubagentRunRecorder(supervisor, {
     store,
     broadcast: (event) => {
         broadcaster.broadcast(event);
-        if (event.type === "subagent.event")
+        if (legacySubagentFlood && event.type === "subagent.event")
             broadcaster.broadcastState();
     },
+    // The full state broadcast moved from "every delta" to "on settle": a browser that reloads mid-run
+    // rebuilds the card from the store (written per delta); the settle frame is what puts the FINAL
+    // record into `state` so a reload after the finish sees it too.
+    onSettled: legacySubagentFlood ? undefined : () => broadcaster.broadcastState(),
+    liveTailCap: legacySubagentFlood ? Number.POSITIVE_INFINITY : undefined,
     host: (conversationId, runId) => extensionUiService.createHost(conversationId, runId),
 });
 /**
@@ -276,6 +289,8 @@ runService.setExecService(execService);
  * message takes.
  */
 const scheduledTaskService = new ScheduledTaskService(store, runService, conversationService, broadcaster);
+const sessionLedger = new SessionLedger();
+const sessionOrchestratorService = new SessionOrchestratorService(store, conversationService, runService, sessionLedger, broadcaster);
 const serverContext = {
     memory,
     knowledge,
@@ -295,6 +310,8 @@ const serverContext = {
     catalogService,
     providerService,
     scheduledTaskService,
+    sessionLedger,
+    sessionOrchestratorService,
     execService,
     toolRegistry,
     toolRunner,

package/dist/server/logging.js

@@ -69,11 +69,22 @@ export function installServerLogging(dataDir) {
      * server cannot even write "I died". This file answers the other half of the question: it is
      * touched every minute while the server lives, so its timestamp says "the server was alive until
      * this moment" - which is how a silent death gets a time on it.
+     *
+     * IT ALSO CARRIES THE MEMORY FINGERPRINT, because "the server died without a word" has two very
+     * different causes and they need different answers. A server killed by the operating system's OOM
+     * killer leaves a log that ends mid-sentence and nothing else - the kernel does not run JavaScript,
+     * and the message Node prints about a heap it could not grow goes to a standard error stream this
+     * process was started without. The last heartbeat before the silence is the only record of how much
+     * memory the process was holding when it went, so it says: the resident size, the heap in use and
+     * the heap that had been reserved. A death at 2 GB of resident size is a memory story; a death at
+     * 90 MB is something else.
      */
     const heartbeatFile = join(logDir, "heartbeat.txt");
     const touch = () => {
         try {
-            writeFileSync(heartbeatFile, `${Date.now()}\n`, "utf8");
+            const memory = process.memoryUsage();
+            const mb = (bytes) => Math.round(bytes / 1_048_576);
+            writeFileSync(heartbeatFile, `${Date.now()} rss=${mb(memory.rss)}MB heapUsed=${mb(memory.heapUsed)}MB heapTotal=${mb(memory.heapTotal)}MB external=${mb(memory.external)}MB\n`, "utf8");
         }
         catch { /* best effort */ }
     };
@@ -114,8 +125,21 @@ export function installServerLogging(dataDir) {
         write("fatal", `uncaughtException: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);
         process.exit(1);
     });
+    /**
+     * AN UNHANDLED REJECTION IS NOT FATAL, AND THE WORD MATTERS.
+     *
+     * Node hands an unhandled rejection to this hook and KEEPS RUNNING - the process does not die here.
+     * It was logged as `fatal` anyway, which made every one of them read like a crash report. One user
+     * report of "Super Pi crashed" turned out to be exactly this: a promise nobody was awaiting,
+     * refusing a path, once per agent write - and the log's `fatal` line is what made it look like the
+     * server had died.
+     *
+     * The line stays loud, because an unhandled rejection IS a bug - a promise that rejected with nobody
+     * listening - but it now says what actually happened, so the next reader is not sent looking for a
+     * dead process that is still alive.
+     */
     process.on("unhandledRejection", (reason) => {
-        write("fatal", `unhandledRejection: ${reason instanceof Error ? (reason.stack ?? reason.message) : String(reason)}`);
+        write("error", `unhandledRejection (the process is still running; a promise rejected with nobody listening): ${reason instanceof Error ? (reason.stack ?? reason.message) : String(reason)}`);
     });
     process.on("exit", (code) => {
         write("info", `server process exiting with code ${code}`);
@@ -123,8 +147,37 @@ export function installServerLogging(dataDir) {
     return { logFile, heartbeatFile, write };
 }
 function safeStringify(value) {
+    // JSON.stringify(new Error("boom")) is `{}` because Error's useful fields are
+    // non-enumerable.  That used to erase the only clue in a detached server's log
+    // whenever a service did `console.error(error)`.  Keep the diagnostic shape
+    // explicit and handle the other values that commonly make logging itself throw
+    // (cycles and BigInt).
+    if (value instanceof Error)
+        return value.stack ?? `${value.name}: ${value.message}`;
+    if (value === undefined)
+        return "undefined";
+    if (value === null)
+        return "null";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "bigint")
+        return `${value}n`;
     try {
-        return JSON.stringify(value);
+        const seen = new WeakSet();
+        const text = JSON.stringify(value, (_key, nested) => {
+            if (nested instanceof Error) {
+                return { name: nested.name, message: nested.message, stack: nested.stack, cause: nested.cause };
+            }
+            if (typeof nested === "bigint")
+                return `${nested}n`;
+            if (nested && typeof nested === "object") {
+                if (seen.has(nested))
+                    return "[Circular]";
+                seen.add(nested);
+            }
+            return nested;
+        });
+        return text ?? String(value);
     }
     catch {
         return String(value);

package/dist/server/pi-session-pool.d.ts

@@ -25,6 +25,8 @@ import { type PiSessionFactory, type PiSessionLike } from "./pi-session.js";
 export interface SessionRequest {
     conversationId: string;
     cwd: string;
+    /** The recorded transcript locator, verified against the real header before use. */
+    sessionFile?: string;
     /** The agent's id, or null. */
     agentId: string | null;
     /** The environment Super Pi's extensions read when they are loaded. */

package/dist/server/pi-session-pool.js

@@ -187,6 +187,7 @@ export class PiSessionPool {
             cwd: request.cwd,
             sessionId: request.conversationId,
             sessionDir: this.sessionDir,
+            ...(request.sessionFile ? { sessionFile: request.sessionFile } : {}),
             extensionPaths: superPiExtensionPaths(this.repositoryRoot),
             skillPaths: superPiSkillPaths(this.repositoryRoot),
             extensionEnv: request.extensionEnv,

package/dist/server/pi-session.d.ts

@@ -23,6 +23,85 @@
  * the transcript on disk while the live session still holds the old context in memory, and nothing in Pi
  * would notice the difference.
  */
+/**
+ * The Pi SDK, imported lazily.
+ *
+ * LAZY, and not for startup speed: Super Pi is also shipped as a package that runs against a Pi
+ * INSTALLED ON THE USER'S MACHINE, resolved by `pi-command.ts` (override -> PATH -> npm's global bin).
+ * That resolution finds a COMMAND; the SDK is a LIBRARY, and it has to come from somewhere specific.
+ * A static import would make the whole server fail to start when the library is absent, taking the
+ * terminal, the file panel and the git panel down with it - none of which need Pi.
+ *
+ * So the library is optional, and its absence is a REPORTED FACT rather than a crash. A Super Pi
+ * without the SDK cannot run a conversation, and says so in words; a Super Pi whose import throws at
+ * module scope cannot even start.
+ */
+/**
+ * The parts of Pi's SDK this file uses, described structurally.
+ *
+ * NOT `typeof import("@earendil-works/pi-coding-agent")`, and that is deliberate. The SDK is an
+ * OPTIONAL dependency: a Super Pi installed without it still has to COMPILE, because the compiler runs
+ * before anything can report that the library is missing. A type-only import of an absent package is a
+ * compile error, so the shapes are declared here instead, and the compiler checks them against the
+ * installed SDK's own declarations when it is present (see `scripts/pi-session.test.mjs`).
+ */
+interface PiSdk {
+    DefaultResourceLoader: new (options: {
+        cwd: string;
+        agentDir: string;
+        additionalExtensionPaths?: string[];
+        additionalSkillPaths?: string[];
+        systemPrompt?: string;
+        appendSystemPrompt?: string[];
+        extensionFactories?: unknown[];
+    }) => {
+        reload(): Promise<void>;
+        getPrompts?: () => {
+            prompts: Array<{
+                name: string;
+                description: string;
+                argumentHint?: string;
+                sourceInfo: {
+                    scope: string;
+                };
+                content: string;
+                filePath: string;
+            }>;
+        };
+    };
+    SessionManager: {
+        create(cwd: string, sessionDir?: string, options?: {
+            id?: string;
+        }): unknown;
+        open(path: string, sessionDir?: string, cwdOverride?: string): unknown;
+        inMemory(cwd?: string, options?: {
+            id?: string;
+        }): unknown;
+        findById(cwd: string, id: string, sessionDir?: string): string | undefined;
+    };
+    ModelRuntime: {
+        create(): Promise<{
+            getModel?: (provider: string, modelId: string) => unknown;
+            getAvailable?: () => Promise<unknown[]>;
+            getModels?: () => unknown[];
+            /**
+             * Pi's own verdict on its model configuration - the schema error that empties every picker
+             * when one entry in `models.json` is refused.
+             */
+            getError?: () => string | undefined;
+        }>;
+    };
+    SettingsManager: {
+        create(cwd: string, agentDir: string): {
+            getDefaultProvider?: () => string | undefined;
+            getDefaultModel?: () => string | undefined;
+            getDefaultThinkingLevel?: () => string | undefined;
+        };
+    };
+    createAgentSession(options: Record<string, unknown>): Promise<{
+        session: unknown;
+    }>;
+}
 /**
  * Loads Pi's SDK while the server is still starting.
  *
@@ -203,7 +282,10 @@ export interface PiSessionLike {
     prompt(message: string, options?: {
         images?: unknown[];
         streamingBehavior?: "steer" | "followUp";
+        preflightResult?: (success: boolean) => void;
     }): Promise<void>;
+    /** True when no agent run or compaction remains; also true when an input hook handled the prompt. */
+    readonly isIdle?: boolean;
     /**
      * Queues a message to be answered AFTER the current run finishes its pending work.
      *
@@ -341,6 +423,8 @@ export interface SessionCreation {
     sessionId: string;
     /** The directory Pi keeps its session files in. */
     sessionDir: string;
+    /** Previously recorded locator. Its actual header must still match this id and workspace. */
+    sessionFile?: string;
     /** Super Pi's extensions to mount, as absolute paths. */
     extensionPaths: string[];
     /** Super Pi's built-in skills to expose beside the user's and workspace's skills. */
@@ -391,6 +475,39 @@ export interface SessionCreation {
  */
 export type PiSessionFactory = (creation: SessionCreation) => Promise<PiSessionLike>;
 export declare function createPiSession(creation: SessionCreation): Promise<PiSessionLike>;
+/**
+ * Resolves the session manager for a conversation: the EXISTING transcript if there is one, a new one
+ * otherwise.
+ *
+ * WHY THIS IS NOT JUST `SessionManager.create`. A conversation's transcript outlives its session - Pi
+ * writes it to a file, and a session that was evicted (idle, or thrown away by a revert) is rebuilt from
+ * that file. So building a session is "reopen the conversation's transcript", and the id is what says
+ * which transcript: Super Pi's conversation id IS the session id, which is what makes `revert` and
+ * `fork` able to find the file without guessing at a filename.
+ *
+ * The recorded locator avoids directory discovery altogether. Both paths verify the actual header's
+ * exact id and cwd; a stale path or a workspace change must never reopen somebody else's transcript.
+ */
+export declare function resolveSessionManager(sdk: Pick<PiSdk, "SessionManager">, creation: SessionCreation): Promise<unknown>;
+type TranscriptHeader = {
+    type: "session";
+    id: string;
+    cwd?: string;
+};
+/** Pi's bounded header discovery contract, using async reads instead of synchronous disk I/O. */
+export declare function readTranscriptHeader(path: string): Promise<TranscriptHeader | undefined>;
+/**
+ * Session headers are immutable under Pi's append/rewrite contract. Cache their identities, refresh
+ * filenames every lookup, and recheck the selected header before opening. A newly created file is
+ * discovered even if stopping/crashing prevented Super Pi from persisting its locator. Arbitrary
+ * legacy filenames still work; filenames are never treated as proof of session identity.
+ */
+export declare class TranscriptFileIndex {
+    private readonly readHeader;
+    private readonly directories;
+    constructor(readHeader?: (path: string) => Promise<TranscriptHeader | undefined>);
+    find(cwd: string, id: string, sessionDir: string): Promise<string | undefined>;
+}
 /**
  * Pi's own global configuration directory, when it can be worked out without importing the SDK.
  *
@@ -424,3 +541,4 @@ export declare function loadPromptTemplateSummaries(cwd: string): Promise<Prompt
 export declare function superPiExtensionPaths(repositoryRoot: string): string[];
 /** Skills shipped by Super Pi itself. Paths are explicit so installed and development layouts agree. */
 export declare function superPiSkillPaths(repositoryRoot: string): string[];
+export {};

package/dist/server/pi-session.js

@@ -24,7 +24,9 @@
  * would notice the difference.
  */
 import { existsSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { open, readdir } from "node:fs/promises";
+import { StringDecoder } from "node:string_decoder";
+import { dirname, join, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 const traceSession = (conversationId, phase, startedAt, extra = "") => {
     if (process.env.SUPER_PI_TRACE_LATENCY !== "1")
@@ -153,8 +155,10 @@ function sessionLevels(session) {
  * to guess: a wrong path here would truncate somebody else's conversation.
  */
 export async function resolveTranscriptFile(cwd, conversationId, sessionDir) {
-    const sdk = await loadSdk();
-    return sdk.SessionManager.findById(cwd, conversationId, sessionDir);
+    // The caller still falls back to RPC when the SDK is unavailable. Discovery itself is async so
+    // a cold directory on a cloud filesystem does not block stop/send handling on the event loop.
+    await loadSdk();
+    return transcriptFiles.find(cwd, conversationId, sessionDir);
 }
 /** Whether the SDK could be loaded. Used by the server to report the reason instead of failing a turn. */
 export async function piSdkAvailable() {
@@ -352,16 +356,21 @@ function transcriptBytes(sessionManager) {
  * which transcript: Super Pi's conversation id IS the session id, which is what makes `revert` and
  * `fork` able to find the file without guessing at a filename.
  *
- * The existing file is found by EXACT id, not by listing the directory and matching a name. Pi's own
- * lookup (`SessionManager.findById`) is the authority for that, and it also enforces the rule that
- * matters here: a session is only found when it was recorded for the SAME working directory. A
- * conversation whose workspace changed therefore gets a fresh transcript rather than somebody else's.
+ * The recorded locator avoids directory discovery altogether. Both paths verify the actual header's
+ * exact id and cwd; a stale path or a workspace change must never reopen somebody else's transcript.
  */
-async function resolveSessionManager(sdk, creation) {
-    const existing = sdk.SessionManager.findById(creation.cwd, creation.sessionId, creation.sessionDir);
+export async function resolveSessionManager(sdk, creation) {
+    const cachedHeader = creation.sessionFile ? await readTranscriptHeader(creation.sessionFile) : undefined;
+    const cachedMatches = transcriptMatches(cachedHeader, creation.cwd, creation.sessionId);
+    const existing = cachedMatches ? creation.sessionFile
+        : await transcriptFiles.find(creation.cwd, creation.sessionId, creation.sessionDir);
     if (existing) {
         try {
-            return sdk.SessionManager.open(existing, creation.sessionDir, creation.cwd);
+            const manager = sdk.SessionManager.open(existing, creation.sessionDir, creation.cwd);
+            // Check Pi's loaded header too: the file may have changed between async discovery and open.
+            const header = manager.getHeader?.();
+            if (transcriptMatches(header ?? undefined, creation.cwd, creation.sessionId))
+                return manager;
         }
         catch {
             // A file that exists but cannot be opened is not a reason to fail the turn: falling through
@@ -371,6 +380,119 @@ async function resolveSessionManager(sdk, creation) {
     }
     return sdk.SessionManager.create(creation.cwd, creation.sessionDir, { id: creation.sessionId });
 }
+function transcriptMatches(header, cwd, id) {
+    return header?.id === id && typeof header.cwd === "string" && header.cwd !== "" && resolve(header.cwd) === resolve(cwd);
+}
+/** Pi's bounded header discovery contract, using async reads instead of synchronous disk I/O. */
+export async function readTranscriptHeader(path) {
+    const file = await open(path, "r").catch(() => undefined);
+    if (!file)
+        return undefined;
+    try {
+        const decoder = new StringDecoder("utf8");
+        const buffer = Buffer.allocUnsafe(4096);
+        let pending = "";
+        const parse = (line) => {
+            if (!line.trim())
+                return undefined;
+            let value;
+            try {
+                value = JSON.parse(line);
+            }
+            catch {
+                return undefined;
+            }
+            if (value && typeof value === "object" && value.type === "session"
+                && typeof value.id === "string")
+                return value;
+            return null;
+        };
+        let scanned = 0;
+        while (scanned < 1024 * 1024) {
+            const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, 1024 * 1024 - scanned), null);
+            if (!bytesRead)
+                return parse(pending + decoder.end()) ?? undefined;
+            scanned += bytesRead;
+            pending += decoder.write(buffer.subarray(0, bytesRead));
+            let newline;
+            while ((newline = pending.indexOf("\n")) !== -1) {
+                const header = parse(pending.slice(0, newline));
+                if (header !== undefined)
+                    return header ?? undefined;
+                pending = pending.slice(newline + 1);
+            }
+        }
+        // Match Pi's exact-boundary EOF case without reading an unbounded prefix or transcript body.
+        const probe = await file.read(buffer, 0, 1, null);
+        return probe.bytesRead ? undefined : parse(pending + decoder.end()) ?? undefined;
+    }
+    catch {
+        // Discovery is best-effort, like Pi's own readSessionHeaderForDiscovery.
+        return undefined;
+    }
+    finally {
+        await file.close();
+    }
+}
+/**
+ * Session headers are immutable under Pi's append/rewrite contract. Cache their identities, refresh
+ * filenames every lookup, and recheck the selected header before opening. A newly created file is
+ * discovered even if stopping/crashing prevented Super Pi from persisting its locator. Arbitrary
+ * legacy filenames still work; filenames are never treated as proof of session identity.
+ */
+export class TranscriptFileIndex {
+    readHeader;
+    directories = new Map();
+    constructor(readHeader = readTranscriptHeader) {
+        this.readHeader = readHeader;
+    }
+    async find(cwd, id, sessionDir) {
+        const dir = resolve(sessionDir);
+        let state = this.directories.get(dir);
+        if (!state) {
+            state = { headers: new Map(), lane: Promise.resolve() };
+            this.directories.set(dir, state);
+        }
+        const current = state;
+        let found;
+        const lookup = async () => {
+            const names = (await readdir(dir).catch(() => [])).filter(name => name.endsWith(".jsonl"));
+            const paths = new Set(names.map(name => join(dir, name)));
+            for (const path of current.headers.keys())
+                if (!paths.has(path))
+                    current.headers.delete(path);
+            const pending = [...paths].filter(path => !current.headers.has(path));
+            let next = 0;
+            await Promise.all(Array.from({ length: Math.min(8, pending.length) }, async () => {
+                while (next < pending.length) {
+                    const path = pending[next++];
+                    const header = await this.readHeader(path);
+                    // Empty/unreadable files may be in the middle of their first write; retry next time.
+                    if (header)
+                        current.headers.set(path, header);
+                }
+            }));
+            for (const path of paths) {
+                if (!transcriptMatches(current.headers.get(path), cwd, id))
+                    continue;
+                const header = await this.readHeader(path);
+                if (header)
+                    current.headers.set(path, header);
+                else
+                    current.headers.delete(path);
+                if (transcriptMatches(header, cwd, id)) {
+                    found = path;
+                    break;
+                }
+            }
+        };
+        const run = current.lane.then(lookup, lookup);
+        current.lane = run.then(() => { }, () => { });
+        await run;
+        return found;
+    }
+}
+const transcriptFiles = new TranscriptFileIndex();
 /**
  * Pi's own global configuration directory, when it can be worked out without importing the SDK.
  *

package/dist/server/runtime.d.ts

@@ -686,6 +686,18 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * it was started.
      */
     private readonly pi;
+    /**
+     * HOW MANY LIVE SESSIONS THIS CONVERSATION HAS, and whether it has one at all.
+     *
+     * A reader of this number learns whether a conversation's context is still in Pi's memory. That is
+     * the fact a revert has to change: it rewrites the transcript on disk, and a live session keeps the
+     * OLD context in memory, so a session that outlived the revert is a model that answers from
+     * history the person withdrew - with nothing saying so.
+     *
+     * It is here because that failure is invisible from the outside: the file is shorter, the state is
+     * clean, and only the model knows something the reader cannot see.
+     */
+    liveSessionCount(conversationId: string): number;
     canSteer(conversationId: string): boolean;
     constructor(sessionDir: string, command?: string, 
     /**
@@ -730,6 +742,7 @@ export declare class PiRpcRuntime implements AgentRuntime {
         toolsEndpoint?: string;
         documentsEndpoint?: string;
         scheduledTaskEndpoint?: string;
+        orchestratorEndpoint?: string;
         uploadsDir?: string;
         sessionFactory?: PiSessionFactory;
         sessionMode?: "sdk" | "oneshot";
@@ -999,6 +1012,26 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * separated at.
      */
     private answerTurn;
+    /**
+     * THE ONE-SHOT PATH, WITH THE INLINE THINKING SPLIT OUT OF IT.
+     *
+     * WHY THIS IS A SEPARATE FUNCTION AND NOT A LINE IN `answerTurn`. The reasoning of an inline-thinking
+     * model is a `<think>…</think>` region INSIDE the answer text, so splitting it is not a formatting
+     * step - it is a reading of the text, and the facts it produces ("the thinking started", "the thinking
+     * ended") belong where the text is read.
+     *
+     * WHEN IT WAS FORGOTTEN, IT COST THE PRODUCT A BUG. The splitter used to live one layer up, in
+     * `answer()`, where it covered EVERY path. It was moved down into the SDK session path to fix the
+     * ordering of "the thinking ended" against a tool call (UX-008), and in that move the ONE-SHOT
+     * CONVERSATION path - the path a server without the Pi SDK falls back to, and the path the whole test
+     * suite drives - lost the splitting altogether: the `<think>` tags reached the answer verbatim.
+     * `scripts/inline-thinking.test.mjs` caught it; the SDK path was fine, which is why it took a test
+     * suite running the other path to notice.
+     *
+     * SO EVERY ONE-SHOT PATH GOES THROUGH HERE, and the session path keeps its own splitter inside the
+     * queue's consumer, where the ORDER of "thinking ended" and a tool call is decided.
+     */
+    private answerOneShotWithInlineThinking;
     /**
      * The one-shot path: a fresh child process for a single turn.
      *
@@ -1062,6 +1095,21 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * revert is a rare, deliberate act, and a second Pi answers in well under a second. It buys the
      * elimination of an entire class of "we truncated the wrong file and nothing said so" failures.
      */
+    /**
+     * THE LIVE SESSION MUST GO WHEN A REVERT REWRITES THE TRANSCRIPT.
+     *
+     * A revert rewrites Pi's transcript on disk. A live Pi session holds the OLD context in memory, and
+     * nothing in Pi would notice the difference: the model would keep answering from history the user
+     * has just withdrawn, while `state.json` and the file on disk both said it was gone. Three views of
+     * the conversation, two of them wrong, and no error anywhere. So the session is destroyed and the
+     * next turn rebuilds it from the truncated file.
+     *
+     * THIS IS A CORRECTNESS REQUIREMENT, NOT AN OPTIMIZATION, and it is why it lives in one place
+     * called by EVERY branch of `revert`. It used to be inline in two of the three, and the third -
+     * the one taken when the transcript path was not cached - missed it, so a session reverted before
+     * its path was ever learned kept talking about the withdrawn turn with nothing saying so.
+     */
+    private evictAfterRevert;
     revert({ conversation, cwd, boundaryEntryId, beforeBoundary }: RevertRequest): Promise<RevertOutcome>;
     /**
      * Copies Pi's own transcript for one conversation into a second, independent file under a new id.