@evandu/super-pi 0.1.138 → 0.1.140

package/dist/server/runtime.js

@@ -21,7 +21,7 @@ import { describeDeliveredUserMessage, describePiQueue, handleSessionEvent, Turn
 // paths recognise a delivery identically. Re-exported because they were part of this module's surface.
 export { describeDeliveredUserMessage, describePiQueue } from "./pi-session-events.js";
 import { createPiSession, createSdkCatalog, piSdkAvailable, resolveTranscriptFile, superPiExtensionPaths } from "./pi-session.js";
-import { TASK_CONVERSATION_ENV, TASK_DEPTH_ENV, TASK_ENDPOINT_ENV, TASK_EXEC_ENDPOINT_ENV, TASK_ROSTER_ENV, TASK_TOOL_NAME, TODO_ENDPOINT_ENV, TODO_TOOL_NAME, SCHEDULED_TASK_ENDPOINT_ENV, SCHEDULED_TASK_TOOL_NAME, WORKFLOW_ENDPOINT_ENV, WORKFLOW_TOOL_NAME, RUN_ASYNC_TOOL_NAME, rosterPayload, } from "./task-tool.js";
+import { TASK_CONVERSATION_ENV, TASK_DEPTH_ENV, TASK_ENDPOINT_ENV, TASK_EXEC_ENDPOINT_ENV, TASK_ROSTER_ENV, TASK_TOOL_NAME, TODO_ENDPOINT_ENV, TODO_TOOL_NAME, SCHEDULED_TASK_ENDPOINT_ENV, SCHEDULED_TASK_TOOL_NAME, WORKFLOW_ENDPOINT_ENV, WORKFLOW_TOOL_NAME, RUN_ASYNC_TOOL_NAME, ORCHESTRATOR_ENDPOINT_ENV, SESSION_SPAWN_TOOL_NAME, SESSION_STATUS_TOOL_NAME, SESSION_DISPATCH_TOOL_NAME, SESSION_STOP_TOOL_NAME, rosterPayload, } from "./task-tool.js";
 import { BLOCKING_UI_METHODS, EXTENSION_UI_METHODS, } from "./types.js";
 import { loadConversationImages } from "./upload.js";
 import { describeToolCall, describeToolCallArgs, describeToolCallInProgress, extractPartialResultText, extractToolResultText, readQuestionCall } from "./tool-calls.js";
@@ -411,6 +411,20 @@ export class PiRpcRuntime {
      * it was started.
      */
     pi;
+    /**
+     * HOW MANY LIVE SESSIONS THIS CONVERSATION HAS, and whether it has one at all.
+     *
+     * A reader of this number learns whether a conversation's context is still in Pi's memory. That is
+     * the fact a revert has to change: it rewrites the transcript on disk, and a live session keeps the
+     * OLD context in memory, so a session that outlived the revert is a model that answers from
+     * history the person withdrew - with nothing saying so.
+     *
+     * It is here because that failure is invisible from the outside: the file is shorter, the state is
+     * clean, and only the model knows something the reader cannot see.
+     */
+    liveSessionCount(conversationId) {
+        return this.sessionPool.has(conversationId) ? 1 : 0;
+    }
     canSteer(conversationId) {
         // A steer is only meaningful while a turn is RUNNING. A live session with nothing running is not a
         // steer target: there is no current answer for the message to be inserted into, and the transcript's
@@ -695,6 +709,8 @@ export class PiRpcRuntime {
             [TODO_ENDPOINT_ENV]: this.options.todoEndpoint ?? "",
             [SCHEDULED_TASK_ENDPOINT_ENV]: this.options.scheduledTaskEndpoint ?? "",
             [WORKFLOW_ENDPOINT_ENV]: this.options.workflowEndpoint ?? "",
+            [ORCHESTRATOR_ENDPOINT_ENV]: this.options.orchestratorEndpoint ?? "",
+            SUPER_PI_ORCHESTRATOR_CONVERSATION: conversationId,
             SUPER_PI_QUESTION_ENDPOINT: this.options.questionEndpoint ?? "",
             SUPER_PI_TOOLS_ENDPOINT: this.options.toolsEndpoint ?? "",
             // The document tools' endpoint and the conversation they act for. The CREDENTIAL is not here:
@@ -801,6 +817,7 @@ export class PiRpcRuntime {
         const session = await this.sessionPool.acquire({
             conversationId: conversation.id,
             cwd: resolve(cwd),
+            ...(conversation.piSessionFile ? { sessionFile: conversation.piSessionFile } : {}),
             agentId: conversation.agentId ?? null,
             extensionEnv: configuration.extensionEnv,
             ...(configuration.tools ? { tools: configuration.tools } : {}),
@@ -898,20 +915,18 @@ export class PiRpcRuntime {
         // The turn has its OWN controller, and the caller's signal aborts it. A run can span several turns
         // on one session, so "the caller wants this run to stop" and "Pi has to be told about the turn in
         // flight" are two different facts, and only the second one is Pi's business.
-        //
-        // `abortDone` is the abort's OWN promise, kept so `stop()` can await Pi actually going idle rather
-        // than merely having been ASKED to. `AgentSession.abort()` resolves when the session is idle, which
-        // is the fact an interrupt needs before the next prompt: prompting earlier is refused by Pi with
-        // "Agent is already processing".
         const turnController = new AbortController();
         let abortDone = Promise.resolve();
+        const abortSession = () => {
+            abortDone = session.abort().catch((error) => {
+                console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} threw: ${error instanceof Error ? error.message : "unknown error"}`);
+            });
+        };
         const abortTurn = () => {
             if (turnController.signal.aborted)
                 return;
             turnController.abort();
-            abortDone = session.abort().catch((error) => {
-                console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} threw: ${error instanceof Error ? error.message : "unknown error"}`);
-            });
+            abortSession();
         };
         const onAbort = () => { abortTurn(); };
         if (signal.aborted)
@@ -936,11 +951,29 @@ export class PiRpcRuntime {
             }
         };
         let firstTextSeen = false;
+        let markPromptFinished;
+        const promptFinished = new Promise((resolvePromise) => { markPromptFinished = resolvePromise; });
         const finished = (async () => {
             try {
-                const promptOptions = images?.length
-                    ? { images: images, preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) }
-                    : { preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) };
+                let promptAccepted = false;
+                const promptOptions = {
+                    ...(images?.length ? { images: images } : {}),
+                    preflightResult: (success) => {
+                        if (!success)
+                            return;
+                        promptAccepted = true;
+                        traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize());
+                        // Pi calls this hook immediately BEFORE _runAgentPrompt synchronously marks the run
+                        // active. An abort during before_agent_start can have returned while Pi was idle. Repeat
+                        // it in the next microtask, after the active flag and the agent's controller exist. Waiting
+                        // for prompt() would wait for the entire answer and make the cancellation ineffective.
+                        if (turnController.signal.aborted)
+                            queueMicrotask(() => {
+                                if (!queue.isSettled)
+                                    abortSession();
+                            });
+                    },
+                };
                 // A STOP THAT ARRIVED WHILE THIS SESSION WAS BEING BUILT MUST NOT SEND THE PROMPT.
                 //
                 // The window between "the person pressed stop" and "the prompt goes out" is the whole session
@@ -962,38 +995,15 @@ export class PiRpcRuntime {
                     return;
                 }
                 await session.prompt(prompt, promptOptions);
-                // THE CANCELLATION MAY HAVE ARRIVED WHILE PI WAS PREPARING THE PROMPT.
-                //
-                // `session.prompt()` is not one step: it runs Pi's input handlers (the extensions' hooks -
-                // Super Pi's own memory search is one of them), the compaction check and the auth check before
-                // the agent's run starts. An abort that lands in that window finds a session that has NOT
-                // started running, so Pi's abort has nothing to abort - and the prompt goes on to the model,
-                // which answers a question the person cancelled.
-                //
-                // The run IS started by the time `prompt()` resolves, so the abort is said AGAIN here. The
-                // second one is the one that lands.
-                if (signal.aborted) {
-                    // The same 5s backstop `runtime.stop` uses: a wedged session must not hang the turn forever.
-                    await Promise.race([
-                        session.abort().catch((error) => {
-                            console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} after a late cancellation threw: ${error instanceof Error ? error.message : "unknown error"}`);
-                        }),
-                        new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000)),
-                    ]);
-                }
-                // `prompt()` RETURNING IS NOT THE TURN ENDING. Pi's `prompt` resolves when the message has
-                // been ACCEPTED and the run has been started; the agent is still streaming, still executing
-                // tools, still settling. A turn that ended here would release the reader while the model was
-                // still producing, and the NEXT turn would arrive at a session Pi considers busy - which Pi
-                // refuses with "Agent is already processing".
-                //
-                // The turn's end is the `agent_settled` EVENT, and the queue is what carries it: the bridge
-                // pushes the terminal item when Pi settles, and the consumer below reads it. This promise
-                // waits for that signal, and the race with the prompt's own failure is what keeps a turn that
-                // never settles from hanging forever - a hung turn is a conversation that never answers.
-                // `prompt()` only means Pi accepted the request. Do not end this generator on a wall-clock
-                // timeout: the session may still be streaming or executing a tool, and ending here drops
-                // subsequent events while falsely allowing the next prompt onto a busy session.
+                markPromptFinished();
+                // Pi 0.86's prompt() awaits the whole agent run. Input hooks and extension commands can also
+                // handle it without starting a run, in which case no agent_settled event is emitted. Pi's idle
+                // flag distinguishes that legitimate completion from an asynchronous session adapter whose
+                // prompt promise returns before its stream finishes.
+                if (promptAccepted && session.isIdle === true && !queue.isSettled)
+                    queue.push({ kind: "end" });
+                // Drain every queued callback and delta before releasing this turn, even if Pi already went
+                // idle. An adapter that returns early must still provide the authoritative settled event.
                 await queue.settledSignal;
                 traceLatency(conversation.id, "session.settled", latencyStartedAt);
                 // THE REVERT BOUNDARY, recorded at the same moment the one-shot path records it: the turn has
@@ -1008,9 +1018,22 @@ export class PiRpcRuntime {
             catch (error) {
                 queue.fail(error instanceof Error ? error : new Error(String(error)));
             }
+            finally {
+                // Also release preparation failures and a turn cancelled before prompt() was called.
+                markPromptFinished();
+            }
         })();
-        this.activeTurns.set(conversation.id, { queue, unsubscribe, finished, abort: abortTurn, get abortDone() { return abortDone; } });
+        this.activeTurns.set(conversation.id, { queue, unsubscribe, finished, promptFinished, abort: abortTurn, get abortDone() { return abortDone; } });
         try {
+            // THE SPLITTER LIVES HERE, INSIDE THE LOOP THAT DRAINS THE QUEUE, and its thinking events are
+            // applied IN LINE rather than deferred. Two producers write into this one queue - Pi's session
+            // events (text deltas, tool calls) and the splitter's reading of the text - and the deferred way
+            // was to announce the second producer's findings at the END of the queue, which put "the thinking
+            // ended" BEHIND the tool call that Pi had announced after the very text that ended it. The tool
+            // callback then ran while the turn still thought it was thinking, and the call was filed inside
+            // the thinking block (UX-008). In line, the thinking lifecycle happens where its text sits, so
+            // the order Pi announced is the order the turn sees.
+            const splitter = new InlineThinkingSplitter();
             for (;;) {
                 const item = await queue.next();
                 if (item.kind === "text") {
@@ -1018,7 +1041,17 @@ export class PiRpcRuntime {
                         firstTextSeen = true;
                         traceLatency(conversation.id, "session.first-text", latencyStartedAt);
                     }
-                    yield item.delta;
+                    for (const segment of splitter.push(item.delta)) {
+                        if (segment.kind === "text") {
+                            yield segment.text;
+                        }
+                        else if (segment.kind === "thinking") {
+                            await input.onThinking?.(segment.text);
+                        }
+                        else {
+                            input.onThinkingEnd?.();
+                        }
+                    }
                     continue;
                 }
                 if (item.kind === "callback") {
@@ -1027,6 +1060,19 @@ export class PiRpcRuntime {
                 }
                 if (item.kind === "error")
                     throw item.error;
+                // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed
+                // region behind, and it belongs in the block rather than in the answer.
+                for (const segment of splitter.flush()) {
+                    if (segment.kind === "text") {
+                        yield segment.text;
+                    }
+                    else if (segment.kind === "thinking") {
+                        await input.onThinking?.(segment.text);
+                    }
+                    else {
+                        input.onThinkingEnd?.();
+                    }
+                }
                 break;
             }
         }
@@ -1196,6 +1242,8 @@ export class PiRpcRuntime {
         // loaded-but-undeclared tool - broken with no error to explain it.
         if (process.env.SUPER_PI_FEISHU_ENDPOINT)
             names.push(FEISHU_READ_TOOL_NAME, FEISHU_WRITE_TOOL_NAME);
+        if (this.options.orchestratorEndpoint)
+            names.push(SESSION_SPAWN_TOOL_NAME, SESSION_STATUS_TOOL_NAME, SESSION_DISPATCH_TOOL_NAME, SESSION_STOP_TOOL_NAME);
         return names;
     }
     /**
@@ -1220,27 +1268,20 @@ export class PiRpcRuntime {
      * transcript all work without knowing where the reasoning came from.
      */
     async *answer(input) {
-        const splitter = new InlineThinkingSplitter();
-        for await (const chunk of this.answerTurn(input)) {
-            for (const segment of splitter.push(chunk)) {
-                if (segment.kind === "text")
-                    yield segment.text;
-                else if (segment.kind === "thinking")
-                    await input.onThinking?.(segment.text);
-                else
-                    input.onThinkingEnd?.();
-            }
-        }
-        // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed
-        // region behind, and it belongs in the block rather than in the answer.
-        for (const segment of splitter.flush()) {
-            if (segment.kind === "text")
-                yield segment.text;
-            else if (segment.kind === "thinking")
-                input.onThinking?.(segment.text);
-            else
-                input.onThinkingEnd?.();
-        }
+        // THE SPLITTING HAPPENS INSIDE `answerTurn`, NOT HERE - and the reason is ORDER.
+        //
+        // The reasoning of an inline-thinking model is a `<think>…</think>` region INSIDE the answer text,
+        // so "the thinking ended" is a fact that only exists once the text carrying the closing tag has
+        // been read. When that fact was produced out here - one layer ABOVE the queue that carries Pi's
+        // events - it was announced by DEFERRED, and a deferred announcement lands at the END of the
+        // queue: BEHIND the tool call that Pi had already announced. So the tool callback ran while the
+        // turn still believed it was thinking, and the call was filed INSIDE the thinking block - a
+        // question that came after the answer was drawn inside the fold above it (UX-008).
+        //
+        // Splitting inside the queue's consumer keeps the two producers in ONE order: the thinking
+        // lifecycle derived from a piece of text happens where that text sits, and a tool call Pi
+        // announced after that text is announced after it too.
+        yield* this.answerTurn(input);
     }
     /**
      * THE TURN ITSELF, on whichever path it runs. See `answer`, which is the seam the reasoning is
@@ -1252,7 +1293,7 @@ export class PiRpcRuntime {
         // lifetimes, and folding them into a conversation's session would give them that conversation's
         // context. They are identified by the flags that describe exactly that.
         if (input.memoryReview || input.knowledgeRerank) {
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         // WHICH PATH A CONVERSATION RUNS ON, and why it is NOT decided by which Pi was named.
@@ -1275,7 +1316,7 @@ export class PiRpcRuntime {
         // anyone who started Super Pi the way most people do. The version number said 0.1.95; the speed said
         // 0.1.84.
         if (this.sessionMode === "oneshot") {
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         // The main path: a persistent session, reused across turns. When the SDK cannot be loaded the turn
@@ -1287,11 +1328,53 @@ export class PiRpcRuntime {
                 this.warnedMissingSdk = true;
                 console.warn(`PiRpcRuntime: ${support.reason} Falling back to one-shot Pi processes for conversations.`);
             }
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         yield* this.answerOnSession(input);
     }
+    /**
+     * THE ONE-SHOT PATH, WITH THE INLINE THINKING SPLIT OUT OF IT.
+     *
+     * WHY THIS IS A SEPARATE FUNCTION AND NOT A LINE IN `answerTurn`. The reasoning of an inline-thinking
+     * model is a `<think>…</think>` region INSIDE the answer text, so splitting it is not a formatting
+     * step - it is a reading of the text, and the facts it produces ("the thinking started", "the thinking
+     * ended") belong where the text is read.
+     *
+     * WHEN IT WAS FORGOTTEN, IT COST THE PRODUCT A BUG. The splitter used to live one layer up, in
+     * `answer()`, where it covered EVERY path. It was moved down into the SDK session path to fix the
+     * ordering of "the thinking ended" against a tool call (UX-008), and in that move the ONE-SHOT
+     * CONVERSATION path - the path a server without the Pi SDK falls back to, and the path the whole test
+     * suite drives - lost the splitting altogether: the `<think>` tags reached the answer verbatim.
+     * `scripts/inline-thinking.test.mjs` caught it; the SDK path was fine, which is why it took a test
+     * suite running the other path to notice.
+     *
+     * SO EVERY ONE-SHOT PATH GOES THROUGH HERE, and the session path keeps its own splitter inside the
+     * queue's consumer, where the ORDER of "thinking ended" and a tool call is decided.
+     */
+    async *answerOneShotWithInlineThinking(input) {
+        const splitter = new InlineThinkingSplitter();
+        for await (const chunk of this.answerOneShot(input)) {
+            for (const segment of splitter.push(chunk)) {
+                if (segment.kind === "text")
+                    yield segment.text;
+                else if (segment.kind === "thinking")
+                    await input.onThinking?.(segment.text);
+                else
+                    await input.onThinkingEnd?.();
+            }
+        }
+        // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed region
+        // behind, and it belongs in the block rather than in the answer.
+        for (const segment of splitter.flush()) {
+            if (segment.kind === "text")
+                yield segment.text;
+            else if (segment.kind === "thinking")
+                await input.onThinking?.(segment.text);
+            else
+                await input.onThinkingEnd?.();
+        }
+    }
     /**
      * The one-shot path: a fresh child process for a single turn.
      *
@@ -1379,7 +1462,7 @@ export class PiRpcRuntime {
         // allowlist and naming a tool Pi has not registered would change the spawn line for every other
         // mode. The prompt asks for a bare JSON array and nothing else; if the model spends a turn on a
         // tool call anyway the reranker times out and falls back to the lexical order.
-        const agentArgs = memoryReview ? ["--no-extensions", "--no-skills", "--no-mcp", "--no-context-files", "--no-prompt-templates", "--tools", "memory,skill_manage,session_search"] : knowledgeRerank ? ["--no-extensions", "--no-skills", "--no-mcp", "--no-context-files", "--no-prompt-templates"] : await agentSpawnArgs(this.agents.promptDir, agent, { extraAllowedTools: [...(extensionArgs.length ? [TASK_TOOL_NAME, TODO_TOOL_NAME, WORKFLOW_TOOL_NAME, RUN_ASYNC_TOOL_NAME, SCHEDULED_TASK_TOOL_NAME, "question", "tool_register"] : []), ...(memoryEnabled ? ["memory", "skill_manage", "session_search"] : []), ...(knowledgeEnabled ? [KNOWLEDGE_TOOL_NAME, KNOWLEDGE_IMPORT_TOOL_NAME] : []), ...(documentsEnabled ? [DOCUMENT_READ_TOOL_NAME, DOCUMENT_WRITE_TOOL_NAME] : []), ...(webEnabled ? [WEB_SEARCH_TOOL_NAME, WEB_FETCH_TOOL_NAME] : []), ...(feishuEnabled ? [FEISHU_READ_TOOL_NAME, FEISHU_WRITE_TOOL_NAME] : [])] });
+        const agentArgs = memoryReview ? ["--no-extensions", "--no-skills", "--no-mcp", "--no-context-files", "--no-prompt-templates", "--tools", "memory,skill_manage,session_search"] : knowledgeRerank ? ["--no-extensions", "--no-skills", "--no-mcp", "--no-context-files", "--no-prompt-templates"] : await agentSpawnArgs(this.agents.promptDir, agent, { extraAllowedTools: [...(extensionArgs.length ? [TASK_TOOL_NAME, TODO_TOOL_NAME, WORKFLOW_TOOL_NAME, RUN_ASYNC_TOOL_NAME, SCHEDULED_TASK_TOOL_NAME, "question", "tool_register", ...(this.options.orchestratorEndpoint ? [SESSION_SPAWN_TOOL_NAME, SESSION_STATUS_TOOL_NAME, SESSION_DISPATCH_TOOL_NAME, SESSION_STOP_TOOL_NAME] : [])] : []), ...(memoryEnabled ? ["memory", "skill_manage", "session_search"] : []), ...(knowledgeEnabled ? [KNOWLEDGE_TOOL_NAME, KNOWLEDGE_IMPORT_TOOL_NAME] : []), ...(documentsEnabled ? [DOCUMENT_READ_TOOL_NAME, DOCUMENT_WRITE_TOOL_NAME] : []), ...(webEnabled ? [WEB_SEARCH_TOOL_NAME, WEB_FETCH_TOOL_NAME] : []), ...(feishuEnabled ? [FEISHU_READ_TOOL_NAME, FEISHU_WRITE_TOOL_NAME] : [])] });
         // Refused here, with the reason, rather than handed to the spawn: an ENOENT from `spawn` reads as
         // "the app is broken" and hides the one fact that matters, which is where it looked for Pi.
         if (!this.pi.found)
@@ -1967,6 +2050,23 @@ export class PiRpcRuntime {
      * revert is a rare, deliberate act, and a second Pi answers in well under a second. It buys the
      * elimination of an entire class of "we truncated the wrong file and nothing said so" failures.
      */
+    /**
+     * THE LIVE SESSION MUST GO WHEN A REVERT REWRITES THE TRANSCRIPT.
+     *
+     * A revert rewrites Pi's transcript on disk. A live Pi session holds the OLD context in memory, and
+     * nothing in Pi would notice the difference: the model would keep answering from history the user
+     * has just withdrawn, while `state.json` and the file on disk both said it was gone. Three views of
+     * the conversation, two of them wrong, and no error anywhere. So the session is destroyed and the
+     * next turn rebuilds it from the truncated file.
+     *
+     * THIS IS A CORRECTNESS REQUIREMENT, NOT AN OPTIMIZATION, and it is why it lives in one place
+     * called by EVERY branch of `revert`. It used to be inline in two of the three, and the third -
+     * the one taken when the transcript path was not cached - missed it, so a session reverted before
+     * its path was ever learned kept talking about the withdrawn turn with nothing saying so.
+     */
+    async evictAfterRevert(conversationId) {
+        await this.sessionPool.evict(conversationId);
+    }
     async revert({ conversation, cwd, boundaryEntryId, beforeBoundary }) {
         if (this.runs.has(conversation.id) || this.activeTurns.has(conversation.id))
             throw new Error("这个会话还有一轮任务在跑，先停止它再回退");
@@ -1981,14 +2081,7 @@ export class PiRpcRuntime {
             const exists = await stat(cached).catch(() => undefined);
             if (exists?.isFile()) {
                 const result = await truncateSessionFile(cached, boundaryEntryId, conversation.id, beforeBoundary);
-                // THE SESSION MUST GO. The truncation above changed the transcript ON DISK, and a live session
-                // holds the OLD context in memory. Nothing in Pi would notice the difference: the model would
-                // keep answering from history the user has just withdrawn, while `state.json` and the file on
-                // disk both said it was gone. Three views of the conversation, two of them wrong, and no error
-                // anywhere - so the session is destroyed here and the next turn rebuilds it from the truncated
-                // file. This is the one place where eviction is a correctness requirement and not an
-                // optimization.
-                await this.sessionPool.evict(conversation.id);
+                await this.evictAfterRevert(conversation.id);
                 return { sessionFile: cached, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
             }
         }
@@ -2014,7 +2107,7 @@ export class PiRpcRuntime {
             if (!found?.isFile())
                 throw new Error(`Pi 还没有为这个会话建立记录文件（${resolved}），没有可以回退的历史。`);
             const result = await truncateSessionFile(resolved, boundaryEntryId, conversation.id, beforeBoundary);
-            await this.sessionPool.evict(conversation.id);
+            await this.evictAfterRevert(conversation.id);
             return { sessionFile: resolved, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
         }
         // NO agent flags and NO extension on this spawn. It sends no prompt and must leave nothing behind:
@@ -2065,6 +2158,7 @@ export class PiRpcRuntime {
         if (!exists?.isFile())
             throw new Error(`Pi 还没有为这个会话建立记录文件（${sessionFile}），没有可以回退的历史。`);
         const result = await truncateSessionFile(sessionFile, boundaryEntryId, conversation.id, beforeBoundary);
+        await this.evictAfterRevert(conversation.id);
         return { sessionFile, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
     }
     /**
@@ -2236,12 +2330,21 @@ export class PiRpcRuntime {
         const turn = this.activeTurns.get(conversationId);
         if (turn) {
             turn.abort();
-            // WAIT FOR PI TO ACTUALLY GO IDLE, not merely to have been asked. `AgentSession.abort()` resolves
-            // when the session is idle, and idle is the fact the caller needs: an interrupt that starts the
-            // next turn before this one has unwound is refused by Pi with "Agent is already processing". The
-            // backstop keeps a wedged session from hanging a stop forever - the turn's own 5s safety net then
-            // still ends it.
-            await Promise.race([turn.abortDone, new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000))]);
+            // abort() can resolve during prompt preflight, before any agent exists. Await the prompt call
+            // as well, which includes that preflight and the actual run in Pi 0.86. For adapters returning
+            // earlier, abortDone still waits for idle. Do not wait for the caller to drain the event queue:
+            // a caller may stop while paused at a yielded delta. A deadline bounds only this request;
+            // RunService retains the real run slot until the reader ends.
+            let stopDeadline;
+            try {
+                await Promise.race([Promise.all([turn.promptFinished, turn.abortDone]), new Promise((resolvePromise) => {
+                        stopDeadline = setTimeout(resolvePromise, 5_000);
+                    })]);
+            }
+            finally {
+                if (stopDeadline !== undefined)
+                    clearTimeout(stopDeadline);
+            }
             return;
         }
         // The one-shot path: a child process that has to be told to abort over its stdin.

package/dist/server/server-context.d.ts

@@ -71,6 +71,8 @@ export interface ServerContext {
      * task of its own.
      */
     scheduledTaskService?: import("./application/scheduled-task-service.js").ScheduledTaskService;
+    sessionLedger?: import("./session-ledger.js").SessionLedger;
+    sessionOrchestratorService?: import("./application/session-orchestrator-service.js").SessionOrchestratorService;
     execService: ExecService;
     toolRegistry: ToolRegistry;
     toolRunner: ToolRunner;

package/dist/server/session-ledger.d.ts

@@ -0,0 +1,60 @@
+export type SessionOrigin = "user" | "orchestrator";
+export type SessionLedgerStatus = "idle" | "running" | "waiting" | "stopped" | "failed" | "completed";
+/**
+ * Metadata entry for a conversation managed or observed by the orchestrator.
+ * Crucially, NO transcript or message history is retained here to keep memory footprint bounded.
+ */
+export interface SessionLedgerEntry {
+    conversationId: string;
+    workspaceId: string;
+    /** Whether created manually by user or by orchestrator agent */
+    origin: SessionOrigin;
+    /** If created by orchestrator: the parent conversation that dispatched it */
+    parentConversationId?: string;
+    /** One-line task description assigned to this session */
+    task?: string;
+    /** Current status */
+    status: SessionLedgerStatus;
+    createdAt: number;
+    updatedAt: number;
+    /** High-level progress snippet or latest outcome */
+    lastProgress?: string;
+}
+/**
+ * In-memory relationship ledger for sibling and child sessions.
+ * Holds only metadata (parent-child relationships, tasks, statuses) - never transcripts.
+ */
+export declare class SessionLedger {
+    private readonly entries;
+    /**
+     * Registers a session into the ledger.
+     */
+    register(entry: Omit<SessionLedgerEntry, "createdAt" | "updatedAt"> & {
+        createdAt?: number;
+        updatedAt?: number;
+    }): SessionLedgerEntry;
+    /**
+     * Updates metadata for an existing session in the ledger.
+     */
+    update(conversationId: string, patch: Partial<Omit<SessionLedgerEntry, "conversationId" | "createdAt">>): SessionLedgerEntry | undefined;
+    /**
+     * Retrieves metadata for one session.
+     */
+    get(conversationId: string): SessionLedgerEntry | undefined;
+    /**
+     * Lists all sessions dispatched by a given parent conversation, sorted newest first.
+     */
+    listByParent(parentConversationId: string): SessionLedgerEntry[];
+    /**
+     * Lists all recorded sessions in the ledger, sorted newest first.
+     */
+    listAll(): SessionLedgerEntry[];
+    /**
+     * Removes a session from the ledger.
+     */
+    delete(conversationId: string): boolean;
+    /**
+     * Clears all ledger entries (primarily for test cleanup).
+     */
+    clear(): void;
+}

package/dist/server/session-ledger.js

@@ -0,0 +1,76 @@
+/**
+ * In-memory relationship ledger for sibling and child sessions.
+ * Holds only metadata (parent-child relationships, tasks, statuses) - never transcripts.
+ */
+export class SessionLedger {
+    entries = new Map();
+    /**
+     * Registers a session into the ledger.
+     */
+    register(entry) {
+        const now = Date.now();
+        const fullEntry = {
+            ...entry,
+            createdAt: entry.createdAt ?? now,
+            updatedAt: entry.updatedAt ?? now,
+        };
+        this.entries.set(entry.conversationId, fullEntry);
+        return { ...fullEntry };
+    }
+    /**
+     * Updates metadata for an existing session in the ledger.
+     */
+    update(conversationId, patch) {
+        const existing = this.entries.get(conversationId);
+        if (!existing)
+            return undefined;
+        const updated = {
+            ...existing,
+            ...patch,
+            updatedAt: Date.now(),
+        };
+        this.entries.set(conversationId, updated);
+        return { ...updated };
+    }
+    /**
+     * Retrieves metadata for one session.
+     */
+    get(conversationId) {
+        const entry = this.entries.get(conversationId);
+        return entry ? { ...entry } : undefined;
+    }
+    /**
+     * Lists all sessions dispatched by a given parent conversation, sorted newest first.
+     */
+    listByParent(parentConversationId) {
+        const result = [];
+        for (const entry of this.entries.values()) {
+            if (entry.parentConversationId === parentConversationId) {
+                result.push({ ...entry });
+            }
+        }
+        return result.sort((a, b) => b.createdAt - a.createdAt);
+    }
+    /**
+     * Lists all recorded sessions in the ledger, sorted newest first.
+     */
+    listAll() {
+        const result = [];
+        for (const entry of this.entries.values()) {
+            result.push({ ...entry });
+        }
+        return result.sort((a, b) => b.createdAt - a.createdAt);
+    }
+    /**
+     * Removes a session from the ledger.
+     */
+    delete(conversationId) {
+        return this.entries.delete(conversationId);
+    }
+    /**
+     * Clears all ledger entries (primarily for test cleanup).
+     */
+    clear() {
+        this.entries.clear();
+    }
+}