@evandu/super-pi 0.1.97 → 0.1.98

package/dist/client/.super-pi-client-sources.json

@@ -24,5 +24,5 @@
     "src/client/types.ts": "6487df00c164370550b5977f9b23b17e22aff4bfb59dfe1e52200042340e3769",
     "src/client/vite-env.d.ts": "65996936fbb042915f7b74a200fcdde7e410f32a669b1ab9597cfaa4b0faddb5"
   },
-  "recordedAt": "2026-10-20T17:20:14.918Z"
+  "recordedAt": "2026-10-21T02:50:44.453Z"
 }

package/dist/server/index.js

@@ -6,6 +6,7 @@ import { existsSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { openStateStore } from "./persistence/open-state-store.js";
 import { PiRpcRuntime, WelcomeRuntime } from "./runtime.js";
 import { resolveAgentDirectories } from "./agents.js";
@@ -30,6 +31,49 @@ import { ToolLlmService } from "./tool-llm.js";
 // ------------------------------------------------------------- Environment & paths
 const rootDir = resolve(import.meta.dirname, "../..");
 initRunningVersion(rootDir);
+// THE SECURITY PATCH, APPLIED WHERE IT CANNOT BREAK AN INSTALL.
+//
+// Pi's package pins a vulnerable `brace-expansion` in its own shrinkwrapped tree, and npm will not let
+// anything move it - not `overrides`, not `npm audit fix`. So Super Pi replaces that one copy with the
+// patched release itself.
+//
+// It runs HERE, at startup, and not as a `postinstall` script, because a postinstall that fails fails
+// the INSTALL - and on 2026-10-21 it did exactly that on somebody else's machine, leaving them unable
+// to install Super Pi at all. An install must not be breakable by a security patch.
+//
+// It is also deliberately ASYNCHRONOUS and off the startup path: the server is already serving by the
+// time this finishes, and a registry that is slow or unreachable must not delay the panel. The copy is
+// vulnerable for the few seconds until the patch lands, and the patched version is what every later
+// turn uses.
+void (async () => {
+    try {
+        // The specifier is built at runtime so the compiler does not need the file to exist: it lives in
+        // `scripts/`, which is not part of the compiled output.
+        const modulePath = resolve(rootDir, "scripts", "patch-brace-expansion.mjs");
+        const { patchBraceExpansion } = await import(pathToFileURL(modulePath).href);
+        await patchBraceExpansion();
+    }
+    catch (error) {
+        console.warn(`[super-pi] the brace-expansion patch did not run: ${error instanceof Error ? error.message : String(error)}`);
+    }
+})();
+// PI'S SDK, LOADED WHILE THE SERVER IS STILL STARTING.
+//
+// Importing Pi's SDK costs about 1.5 seconds the first time and is free afterwards, and it was being
+// paid by whichever user action happened to need it first - which, for most people, was opening the
+// model picker and wondering why it stayed grey. Here it is paid during startup, in parallel with
+// everything else the server does, so the first conversation does not pay for it.
+//
+// Warmup only: nothing here is required for the server to run, and a failure is one line.
+void (async () => {
+    try {
+        const { warmPiSdk } = await import(pathToFileURL(resolve(rootDir, "dist", "server", "pi-session.js")).href);
+        await warmPiSdk();
+    }
+    catch (error) {
+        console.warn(`[super-pi] Pi's SDK did not load during warmup: ${error instanceof Error ? error.message : String(error)}`);
+    }
+})();
 const cliArgs = parseServerArgs(process.argv);
 // A non-numeric SUPER_PI_PORT would parse to NaN and die later in `listen` with a confusing error;
 // like the other environment variables here, an unusable value falls back to the default port.

package/dist/server/model-filter.js

@@ -35,7 +35,12 @@ export async function validateConversationModel(store, runtime, conversationId,
     const workspace = conversationWorkspace(state, conversationId);
     if (!applicableRules(state.modelFilterRules, workspace).length)
         return;
+    const startedAt = performance.now();
+    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+        console.warn(`[super-pi latency] conversation=${conversationId} phase=model.validate.begin selection=${selection ? `${selection.provider}/${selection.modelId}` : "default"}`);
     const catalog = await runtime.catalog();
     const model = selection ? catalog.models.find(item => item.provider === selection.provider && item.modelId === selection.modelId) ?? selection : catalog.defaultModel;
     assertModelAllowed(store.snapshot().modelFilterRules, conversationWorkspace(store.snapshot(), conversationId), model);
+    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+        console.warn(`[super-pi latency] conversation=${conversationId} phase=model.validate.end elapsedMs=${Math.round(performance.now() - startedAt)}`);
 }

package/dist/server/pi-command.d.ts

@@ -21,7 +21,8 @@ export type PiCommandResolution = {
 } | {
     found: false;
     reason: string;
-    searched: string[];
+    searched: string[]; /** Whether a command was NAMED and did not resolve. A named Pi is a statement about which Pi runs a turn, and it stays true when the file is missing. */
+    explicit?: boolean;
 };
 /** Overridable so the resolution can be exercised for both platforms and both outcomes without a Pi install. */
 export interface PiCommandOptions {

package/dist/server/pi-command.js

@@ -113,8 +113,12 @@ export function resolvePiCommand(options = {}) {
                 return { found: true, command: full, via: label, explicit: true };
             return {
                 found: false,
-                reason: `${label} points at ${full}, and no such file exists. Fix ${command ? "that argument" : "SUPER_PI_PI_COMMAND"} or unset it to fall back to PATH and npm's global bin directory. This is an environment problem, not a defect in the agent mechanism.`,
+                reason: `${label} points at ${full}, and no such file exists. Fix ${command ? "that argument" : "SUPER_PI_PI_COMMAND"} or unset it to fall back to PATH and npm's global bin directory. This is an environment problem, not a defect of the agent mechanism.`,
                 searched: [full],
+                // STILL EXPLICIT. A Pi was NAMED, and naming one is a statement about which Pi runs a turn -
+                // so the fact survives the file being missing, and the honest answer to "that Pi cannot be
+                // asked" is "unavailable", never a list belonging to some other Pi.
+                explicit: true,
             };
         }
         const hit = firstHit([explicit], [...onPath, ...globalDirs], exists, platform);
@@ -122,8 +126,9 @@ export function resolvePiCommand(options = {}) {
             return { found: true, command: hit.command, via: `${label} (${hit.dir})`, explicit: true };
         return {
             found: false,
-            reason: `${label} names ${explicit}, which is on no PATH entry and in none of npm's global bin directories. This is an environment problem, not a defect in the agent mechanism.`,
+            reason: `${label} names ${explicit}, which is on no PATH entry and in none of npm's global bin directories. This is an environment problem, not a defect of the agent mechanism.`,
             searched: [...onPath, ...globalDirs],
+            explicit: true,
         };
     }
     // THE PI THAT IS HOSTING SUPER PI, when Super Pi was started from inside Pi itself.

package/dist/server/pi-session-pool.d.ts

@@ -114,6 +114,18 @@ export declare class PiSessionPool {
      */
     acquire(request: SessionRequest): Promise<PiSessionLike>;
     private build;
+    /**
+     * Puts a live session on the model and level the conversation is asking for.
+     *
+     * Best-effort in the way that matters: a session that cannot change its model is still a working
+     * session, and refusing the message because Pi declined a model switch would be a worse answer than
+     * running on the model that is loaded. So the failure is a warning, and the turn goes on.
+     *
+     * The comparison is against what the session is ALREADY running, because Pi can report its model in
+     * two shapes (an id or a provider/id pair) and a mismatch on shape alone would mean re-setting the
+     * model on every single turn.
+     */
+    private applyModelAndLevel;
     private fingerprintOf;
     /**
      * The live session for a conversation, without building one.

package/dist/server/pi-session-pool.js

@@ -94,18 +94,28 @@ export class PiSessionPool {
         const existing = this.sessions.get(request.conversationId);
         if (existing) {
             if (sameFingerprint(existing.fingerprint, fingerprint)) {
+                if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                    console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.reused`);
                 existing.lastUsedAt = Date.now();
                 // A session that is still being built is joined, not rebuilt: two sends arriving together must
                 // not produce two sessions, and the second one would be a duplicate model client talking to the
                 // same conversation.
                 if (existing.building)
                     return existing.building;
+                // THE MODEL AND THE LEVEL ARE APPLIED HERE, TO THE LIVE SESSION. They are not in the
+                // fingerprint because Pi can change them in place, and rebuilding the session to honour a
+                // change would replay the whole transcript - the single most expensive thing this runtime does.
+                // A person who picks a different model in the picker pays a few milliseconds here instead of
+                // waiting for their entire history to be re-read on the next message.
+                await this.applyModelAndLevel(existing.session, request);
                 return existing.session;
             }
             // STALE. The conversation's requirements changed underneath the live session, so it is thrown away
             // BEFORE the new one is built, and not after - a session that is being disposed of while the new
             // one starts would have two contexts for one conversation.
             await this.evict(request.conversationId);
+            if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.rebuild`);
         }
         // THE CREDENTIAL IS MINTED HERE, WHERE THE SESSION IS BORN. The capability travels in the
         // extension's environment, and the extension reads its environment when it is LOADED - which happens
@@ -119,9 +129,13 @@ export class PiSessionPool {
         const capability = this.mintCapability(request.conversationId);
         const extensionEnv = { ...request.extensionEnv, [CAPABILITY_ENV]: capability, [TOOLS_CAPABILITY_ENV]: capability };
         const building = this.build({ ...request, extensionEnv }, fingerprint);
+        if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+            console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.build.begin`);
         this.sessions.set(request.conversationId, { session: undefined, fingerprint, lastUsedAt: Date.now(), building });
         try {
             const session = await building;
+            if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.build.end`);
             const entry = this.sessions.get(request.conversationId);
             if (entry) {
                 entry.session = session;
@@ -156,15 +170,53 @@ export class PiSessionPool {
         };
         return this.factory(creation);
     }
+    /**
+     * Puts a live session on the model and level the conversation is asking for.
+     *
+     * Best-effort in the way that matters: a session that cannot change its model is still a working
+     * session, and refusing the message because Pi declined a model switch would be a worse answer than
+     * running on the model that is loaded. So the failure is a warning, and the turn goes on.
+     *
+     * The comparison is against what the session is ALREADY running, because Pi can report its model in
+     * two shapes (an id or a provider/id pair) and a mismatch on shape alone would mean re-setting the
+     * model on every single turn.
+     */
+    async applyModelAndLevel(session, request) {
+        const wanted = request.model;
+        if (wanted && session.setModel) {
+            const running = session.model;
+            const same = running?.provider === wanted.provider && (running?.id ?? running?.id) === wanted.modelId;
+            if (!same) {
+                try {
+                    await session.setModel({ provider: wanted.provider, id: wanted.modelId });
+                    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                        console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.model-applied model=${wanted.provider}/${wanted.modelId}`);
+                }
+                catch (error) {
+                    console.warn(`PiSessionPool: conversation ${request.conversationId} asked for ${wanted.provider}/${wanted.modelId} and Pi declined: ${error instanceof Error ? error.message : String(error)}. The turn will run on the model already loaded.`);
+                }
+            }
+        }
+        if (request.thinkingLevel && session.setThinkingLevel) {
+            try {
+                session.setThinkingLevel(request.thinkingLevel);
+            }
+            catch (error) {
+                console.warn(`PiSessionPool: conversation ${request.conversationId} asked for thinking level ${request.thinkingLevel} and Pi declined: ${error instanceof Error ? error.message : String(error)}.`);
+            }
+        }
+    }
     fingerprintOf(request) {
+        // The model and the thinking level are NOT here, and that is deliberate: Pi changes both on a
+        // live session, so they are applied to it rather than forcing a rebuild that would replay the whole
+        // transcript. The session is still CREATED with them (see `build`) - it just is not thrown away
+        // when they change.
         return {
             cwd: request.cwd,
             agentId: request.agentId,
             tools: request.tools,
             excludeTools: request.excludeTools,
             extensions: superPiExtensionPaths(this.repositoryRoot),
-            model: request.model,
-            thinkingLevel: request.thinkingLevel,
         };
     }
     /**

package/dist/server/pi-session.d.ts

@@ -23,6 +23,83 @@
  * the transcript on disk while the live session still holds the old context in memory, and nothing in Pi
  * would notice the difference.
  */
+/**
+ * Loads Pi's SDK while the server is still starting.
+ *
+ * Importing Pi costs about 1.5 seconds once and is free afterwards, and it used to be paid by whatever
+ * user action needed it FIRST - which for most people was opening the model picker and watching it stay
+ * grey. Paying it here, during startup, moves it off the path a person can see.
+ *
+ * Safe to call more than once, and safe to call on a server that never needs the SDK: it loads the
+ * module and returns, and the caller decides what to do with a failure.
+ */
+export declare function warmPiSdk(): Promise<boolean>;
+/**
+ * A model catalog read from Pi's SDK, with NO PROCESS.
+ *
+ * THE PROBLEM THIS SOLVES. The model picker used to be answered by starting a `pi --mode rpc` child,
+ * asking it three questions and killing it. That is a process start - measured at 866ms on a fast
+ * machine, and seconds on a slow one - paid every time the cache missed, and the cache key is the
+ * SELECTED MODEL, so it missed again for every model a person picked. A user who opened the picker and
+ * then created a conversation waited for a process to start.
+ *
+ * WHY IT IS SAFE. Pi's SDK is the same code Pi's RPC mode is built on, so the answers are the same:
+ * `ModelRuntime.getAvailable()` returned exactly the model list a spawned Pi reports, and a session's
+ * `getAvailableThinkingLevels()` returned exactly the level list. Both are checked field by field in
+ * `scripts/probe-catalog-equivalence.mjs` and `scripts/probe-levels.mjs`.
+ *
+ * WHAT IS STILL NEEDED FROM PI ITSELF. The thinking levels are a property of the SELECTED model, and a
+ * model that is not running has no session to ask. So the levels come from a short-lived in-memory
+ * session rather than from the model list - which costs a session, not a process, and is only needed
+ * when the caller actually wants levels for a model.
+ */
+export interface SdkCatalog {
+    /** Pi's own model objects, for the caller to reduce with the same helpers the RPC path used. */
+    models: unknown[];
+    /** The model Pi would use by default, if settings name one. */
+    defaultModel?: {
+        provider: string;
+        modelId: string;
+    };
+    /** The thinking level Pi would use by default, if settings name one. */
+    defaultThinkingLevel?: string;
+    /**
+     * The levels a model supports, read from a session running that model.
+     *
+     * Separate from the models because it is the expensive half: it needs a session, so a caller that
+     * only wants the list does not pay for it.
+     */
+    thinkingLevelsFor(model: {
+        provider: string;
+        modelId: string;
+    }): Promise<string[]>;
+}
+/**
+ * Builds a zero-process catalog reader.
+ *
+ * The ModelRuntime and the SettingsManager are created ONCE and reused: both read the auth store and
+ * the model store from disk, so a fresh one per call would put the same I/O back that this is here to
+ * remove. They are safe to share - they are read-mostly views of the same files.
+ *
+ * The MODEL LIST is read once, at build time, and the LEVELS are cached per model - both because
+ * re-reading them is the cost this exists to remove, and because the answer cannot change while the
+ * process runs: a person who edits `auth.json` or adds a model restarts Super Pi, exactly as they
+ * would for anything else in Pi's own configuration.
+ */
+export declare function createSdkCatalog(cwd: string): Promise<SdkCatalog>;
+/**
+ * The transcript file a conversation's session writes to, found WITHOUT starting a Pi process.
+ *
+ * THIS REPLACES A SPAWN. Revert and fork need to know which file holds a conversation's history, and
+ * they used to start a  child purely to be told. Pi's SDK answers it from the session
+ * manager's own state - and it answers it the same way Pi's RPC mode does, which is the only reason
+ * this is safe: Pi looks a session up BY ID and by WORKING DIRECTORY, so asking the library that
+ * resolves the session gives the same file the child would have named.
+ *
+ * Returns undefined when there is no such session, which is the caller's cue to fall back rather than
+ * to guess: a wrong path here would truncate somebody else's conversation.
+ */
+export declare function resolveTranscriptFile(cwd: string, conversationId: string, sessionDir: string): Promise<string | undefined>;
 /** Whether the SDK could be loaded. Used by the server to report the reason instead of failing a turn. */
 export declare function piSdkAvailable(): Promise<{
     available: true;
@@ -48,12 +125,6 @@ export interface SessionFingerprint {
     excludeTools: string[] | undefined;
     /** Which of Super Pi's own extensions were mounted. */
     extensions: string[];
-    /** The model and thinking level, when they were pinned at creation. */
-    model?: {
-        provider: string;
-        modelId: string;
-    };
-    thinkingLevel?: string;
 }
 /**
  * Fingerprints are compared by VALUE, and this is where that comparison is spelled out.
@@ -113,6 +184,31 @@ export interface PiSessionLike {
     readonly sessionFile?: string | undefined;
     /** The id of the session. */
     readonly sessionId?: string | undefined;
+    /**
+     * The model the session is running on.
+     *
+     * READ TO COMPARE, not to set: a model is chosen when the session is created, and a LATER change goes
+     * through `setModel`.
+     */
+    readonly model?: {
+        provider?: string;
+        id?: string;
+    } | undefined;
+    /**
+     * Switches the model on a LIVE session.
+     *
+     * THIS IS WHY THE MODEL IS NOT PART OF THE CONFIGURATION FINGERPRINT. Pi can change the model of a
+     * running session, so a model change does not need a new session - and making one would cost a
+     * transcript replay, which is the most expensive thing this runtime does. A user who picks a different
+     * model in the picker would otherwise pay for the whole conversation's history to be re-read.
+     */
+    setModel?(model: {
+        provider: string;
+        id: string;
+    }): Promise<void>;
+    /** The thinking levels the session's current model supports. Pi's own answer, not a derivation. */
+    getAvailableThinkingLevels?(): string[];
+    setThinkingLevel?(level: string): void;
     /**
      * The session's transcript, for naming a position in it.
      *

package/dist/server/pi-session.js

@@ -23,8 +23,32 @@
  * the transcript on disk while the live session still holds the old context in memory, and nothing in Pi
  * would notice the difference.
  */
-import { existsSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
+const traceSession = (conversationId, phase, startedAt, extra = "") => {
+    if (process.env.SUPER_PI_TRACE_LATENCY !== "1")
+        return;
+    console.warn(`[super-pi latency] conversation=${conversationId} phase=${phase} elapsedMs=${Math.round(performance.now() - startedAt)}${extra ? ` ${extra}` : ""}`);
+};
+/**
+ * Loads Pi's SDK while the server is still starting.
+ *
+ * Importing Pi costs about 1.5 seconds once and is free afterwards, and it used to be paid by whatever
+ * user action needed it FIRST - which for most people was opening the model picker and watching it stay
+ * grey. Paying it here, during startup, moves it off the path a person can see.
+ *
+ * Safe to call more than once, and safe to call on a server that never needs the SDK: it loads the
+ * module and returns, and the caller decides what to do with a failure.
+ */
+export async function warmPiSdk() {
+    try {
+        await loadSdk();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 let sdkPromise;
 let sdkFailure;
 async function loadSdk() {
@@ -44,6 +68,84 @@ async function loadSdk() {
     }
     return sdkPromise;
 }
+/**
+ * Builds a zero-process catalog reader.
+ *
+ * The ModelRuntime and the SettingsManager are created ONCE and reused: both read the auth store and
+ * the model store from disk, so a fresh one per call would put the same I/O back that this is here to
+ * remove. They are safe to share - they are read-mostly views of the same files.
+ *
+ * The MODEL LIST is read once, at build time, and the LEVELS are cached per model - both because
+ * re-reading them is the cost this exists to remove, and because the answer cannot change while the
+ * process runs: a person who edits `auth.json` or adds a model restarts Super Pi, exactly as they
+ * would for anything else in Pi's own configuration.
+ */
+export async function createSdkCatalog(cwd) {
+    const sdk = await loadSdk();
+    const agentDir = defaultAgentDir();
+    const modelRuntime = await sdk.ModelRuntime.create();
+    const settingsManager = sdk.SettingsManager.create(cwd, agentDir);
+    const models = (await modelRuntime.getAvailable?.()) ?? modelRuntime.getModels?.() ?? [];
+    const levelsByModel = new Map();
+    return {
+        models,
+        ...(settingsManager.getDefaultProvider?.() && settingsManager.getDefaultModel?.()
+            ? {
+                defaultModel: {
+                    provider: settingsManager.getDefaultProvider(),
+                    modelId: settingsManager.getDefaultModel(),
+                },
+            }
+            : {}),
+        ...(settingsManager.getDefaultThinkingLevel?.() ? { defaultThinkingLevel: settingsManager.getDefaultThinkingLevel() } : {}),
+        thinkingLevelsFor: async (model) => {
+            const key = `${model.provider}/${model.modelId}`;
+            const cached = levelsByModel.get(key);
+            if (cached)
+                return cached;
+            // A model that is not running has no levels of its own, so a short-lived in-memory session is
+            // built to ask Pi. It costs a session - measured at ~30ms warm, and no process at all - and it is
+            // paid once per model rather than once per picker open.
+            const { session } = await sdk.createAgentSession({
+                cwd,
+                agentDir,
+                modelRuntime,
+                settingsManager,
+                sessionManager: sdk.SessionManager.inMemory(cwd, { id: "catalog-levels" }),
+                model: modelRuntime.getModel?.(model.provider, model.modelId),
+            });
+            try {
+                const levels = sessionLevels(session);
+                levelsByModel.set(key, levels);
+                return levels;
+            }
+            finally {
+                session.dispose?.();
+            }
+        },
+    };
+}
+/** Reads the thinking levels off a session, tolerating a session that does not implement the call. */
+function sessionLevels(session) {
+    const levels = session.getAvailableThinkingLevels?.();
+    return Array.isArray(levels) ? levels.filter((level) => typeof level === "string") : [];
+}
+/**
+ * The transcript file a conversation's session writes to, found WITHOUT starting a Pi process.
+ *
+ * THIS REPLACES A SPAWN. Revert and fork need to know which file holds a conversation's history, and
+ * they used to start a  child purely to be told. Pi's SDK answers it from the session
+ * manager's own state - and it answers it the same way Pi's RPC mode does, which is the only reason
+ * this is safe: Pi looks a session up BY ID and by WORKING DIRECTORY, so asking the library that
+ * resolves the session gives the same file the child would have named.
+ *
+ * Returns undefined when there is no such session, which is the caller's cue to fall back rather than
+ * to guess: a wrong path here would truncate somebody else's conversation.
+ */
+export async function resolveTranscriptFile(cwd, conversationId, sessionDir) {
+    const sdk = await loadSdk();
+    return sdk.SessionManager.findById(cwd, conversationId, sessionDir);
+}
 /** Whether the SDK could be loaded. Used by the server to report the reason instead of failing a turn. */
 export async function piSdkAvailable() {
     try {
@@ -75,10 +177,6 @@ export function sameFingerprint(a, b) {
         return false;
     if (!sameSet(a.extensions, b.extensions))
         return false;
-    if (a.model?.provider !== b.model?.provider || a.model?.modelId !== b.model?.modelId)
-        return false;
-    if (a.thinkingLevel !== b.thinkingLevel)
-        return false;
     return true;
 }
 function sameSet(a, b) {
@@ -116,7 +214,10 @@ export async function withEnvironment(values, work) {
     }
 }
 export async function createPiSession(creation) {
+    const startedAt = performance.now();
+    traceSession(creation.sessionId, "sdk.load.begin", startedAt);
     const sdk = await loadSdk();
+    traceSession(creation.sessionId, "sdk.load.end", startedAt);
     const agentDir = creation.agentDir ?? defaultAgentDir();
     return withEnvironment(creation.extensionEnv, async () => {
         // THE AGENT'S PROMPT. Pi's loader takes the same two shapes the command line took: a `systemPrompt`
@@ -136,10 +237,13 @@ export async function createPiSession(creation) {
                     : {}),
         });
         await loader.reload();
+        traceSession(creation.sessionId, "sdk.loader.reload", startedAt, `extensions=${creation.extensionPaths.length}`);
         const sessionManager = creation.persist === false
             ? sdk.SessionManager.inMemory(creation.cwd, { id: creation.sessionId })
             : await resolveSessionManager(sdk, creation);
+        traceSession(creation.sessionId, "sdk.transcript.ready", startedAt, `bytes=${transcriptBytes(sessionManager)}`);
         const modelRuntime = await sdk.ModelRuntime.create();
+        traceSession(creation.sessionId, "sdk.model-runtime", startedAt);
         // THE MODEL IS RESOLVED, NOT PASSED THROUGH. Pi's SDK takes a whole Model object - the provider's
         // configuration, the endpoint, the capability list - and Super Pi only knows the pair
         // (provider, modelId) that the picker shows. The runtime is what turns that pair into the object
@@ -164,9 +268,21 @@ export async function createPiSession(creation) {
             ...(creation.thinkingLevel ? { thinkingLevel: creation.thinkingLevel } : {}),
         };
         const { session } = await sdk.createAgentSession(options);
+        traceSession(creation.sessionId, "sdk.session.created", startedAt);
         return session;
     });
 }
+function transcriptBytes(sessionManager) {
+    const file = sessionManager.getSessionFile?.();
+    if (!file)
+        return 0;
+    try {
+        return existsSync(file) ? statSync(file).size : 0;
+    }
+    catch {
+        return 0;
+    }
+}
 /**
  * Resolves the session manager for a conversation: the EXISTING transcript if there is one, a new one
  * otherwise.

package/dist/server/runtime.d.ts

@@ -402,7 +402,18 @@ export declare function killTree(pid: number): Promise<void>;
  * caller drop the message from the dock on the strength of a payload shape we did not recognise.
  */
 export declare function describeSteerDisposition(data: unknown): SteerDisposition | undefined;
-/** Keys Pi's model answers by. Exported so the store and the tests agree with the runtime. */
+/**
+ * Keys Pi's model answers by. Exported so the store and the tests agree with the runtime.
+ *
+ * THE MODEL IS NOT PART OF THE KEY, and that is the second half of why the picker no longer starts a
+ * process. The MODEL LIST is the same answer whichever model a conversation has selected - it is the
+ * list of models Pi offers, not the ones one conversation may use. The only thing that varies with the
+ * selection is the THINKING LEVELS, which belong to the model in use.
+ *
+ * So the key records just whether levels were asked for. Keying on the model (as this used to) meant a
+ * cache miss for every model a person ever picked, and every miss was a process start - so the picker
+ * went grey again after every model change, which is exactly when a person is moving between models.
+ */
 export declare const catalogKey: (selection?: ModelSelection) => string;
 /**
  * Where the `task` extension lives, as an ABSOLUTE path.
@@ -467,6 +478,8 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * in the pool, and a turn is a run ON that session rather than a process OF its own.
      */
     private readonly sessionPool;
+    /** Where Super Pi itself is installed, which is also where its own extensions are found. */
+    private readonly repositoryRoot;
     /**
      * The turn currently running on each conversation's session.
      *
@@ -509,8 +522,25 @@ export declare class PiRpcRuntime implements AgentRuntime {
     /** Distinguishes steer command ids. Never reused, so a late response cannot settle a later steer. */
     private steerSeq;
     private readonly catalogs;
-    /** In-flight reads, so N clients asking at once cost ONE Pi spawn rather than N. */
+    /**
+     * In-flight reads, so N clients asking at once cost ONE read rather than N.
+     *
+     * "One read", not "one Pi spawn": the catalog is answered out of Pi's SDK and no process is started
+     * at all. The wording here used to promise a shared spawn, which is what the old implementation did.
+     */
     private readonly pendingCatalogs;
+    /**
+     * Pi's SDK catalog reader, built once and reused.
+     *
+     * The ModelRuntime and SettingsManager it holds read the auth store and the model store from disk, so
+     * building a new one per call would put back the I/O this exists to avoid. They are read-mostly
+     * views of files that change rarely, and Pi's own long-lived session holds the same objects for its
+     * whole life.
+     *
+     * A FAILED build is remembered as a failure rather than retried per call: a broken SDK would
+     * otherwise be re-imported on every picker open.
+     */
+    private sdkCatalogPromise?;
     /** Latches the "no extension on disk" warning, so it is said once rather than once per turn. */
     private warnedMissingExtension;
     /** Latches the "Pi's SDK is not installed" warning, for the same reason. */
@@ -946,15 +976,47 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * killed as soon as it has answered - no long-lived process to keep warm.
      */
     catalog(selection?: ModelSelection): Promise<ModelCatalog>;
+    /**
+     * Reads the model catalog WITHOUT starting a Pi process, and falls back to a spawned Pi only when
+     * the SDK is not available.
+     *
+     * WHY THIS IS THE DEFAULT. The picker used to be answered by starting a `pi --mode rpc` child,
+     * asking it three questions and killing it: a process start, measured at 866ms on a fast machine and
+     * seconds on a slow one. And the cache key is the SELECTED MODEL, so it started again for every model
+     * a person picked - which is why "the picker stays grey for ten seconds" followed choosing a model,
+     * and not only the first time.
+     *
+     * Pi's SDK is the same code Pi's RPC mode is built on, so the answers are the same, and the two are
+     * compared field by field in `scripts/probe-catalog-equivalence.mjs`.
+     */
+    private readCatalog;
+    /**
+     * The transcript file for a conversation, out of Pi's SDK, or undefined when the SDK cannot answer.
+     *
+     * Undefined means "ask someone else", not "no such file": a missing SDK and a missing transcript
+     * are different facts, and only the first one should send the caller to the spawning path.
+     *
+     * For the same reason as the catalog, a NAMED Pi is not asked here: when something else will run the
+     * conversation, it is also the only one that knows which file that conversation's transcript is in.
+     */
+    private resolveTranscriptFileWithoutSpawn;
+    private sdkCatalog;
+    /**
+     * The catalog, out of Pi's SDK. Returns undefined when the SDK is not available, which is the only
+     * case in which the spawning path is reached.
+     */
+    private readCatalogFromSdk;
     /**
      * Asks one throwaway Pi for its model list, its thinking levels and its own current selection.
      *
+     * Only reached when Pi's SDK is not available - which is a broken installation, not a normal one.
+     *
      * The three commands are written back to back and only then awaited, so Pi works on them in
      * parallel - measured at 394ms for all three, against 714ms for the slowest one alone. A Pi
      * scoped to one conversation's model needs `set_model` FIRST and alone, because thinking levels are
      * a property of the selected model, not of Pi's default.
      */
-    private readCatalog;
+    private readCatalogBySpawningPi;
 }
 /**
  * Normalizes Pi's `Model[]`, keeping only entries that can actually be sent back as a `set_model`.