@evandu/super-pi 0.1.97 → 0.1.99

package/bin/super-pi.js

@@ -5,6 +5,7 @@ import { mkdir, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
+import { pathToFileURL } from "node:url";
 
 const execFileAsync = promisify(execFile);
 const root = resolve(import.meta.dirname, "..");
@@ -62,7 +63,7 @@ async function running(port) {
 }
 async function stop(port) { try { const headers = process.env.SUPER_PI_ACCESS_TOKEN ? { authorization: `Bearer ${process.env.SUPER_PI_ACCESS_TOKEN}` } : {}; const response = await fetch(`http://127.0.0.1:${port}/api/shutdown`, { method: "POST", headers, signal: AbortSignal.timeout(3000) }); return response.ok || response.status === 202; } catch { return false; } }
 function openBrowser(url) { const command = platform === "darwin" ? "open" : platform === "win32" ? "cmd.exe" : "xdg-open"; const args = platform === "darwin" ? [url] : platform === "win32" ? ["/c", "start", "", url] : [url]; spawn(command, args, { detached: true, stdio: "ignore", windowsHide: true }).unref(); }
-function usage() { console.log("Usage: super-pi|super_pi <start|stop|restart|update|autostart> [options]"); console.log("  autostart enable|disable|status  Configure startup at sign-in"); console.log("  --port PORT  Server port (default: 3080)"); console.log("  --host HOST  Server host (default: 0.0.0.0)"); console.log("  --no-browser  Do not open a browser"); }
+function usage() { console.log("Usage: super-pi|super_pi <start|stop|restart|update|diagnose|autostart> [options]"); console.log("  autostart enable|disable|status  Configure startup at sign-in"); console.log("  diagnose                       Measure where a message spends its time"); console.log("  --port PORT  Server port (default: 3080)"); console.log("  --host HOST  Server host (default: 0.0.0.0)"); console.log("  --no-browser  Do not open a browser"); }
 function paths() { if (platform === "win32") return { task: "Super Pi" }; if (platform === "darwin") return { file: join(home, "Library", "LaunchAgents", "com.evandu.super-pi.plist") }; return { file: join(process.env.XDG_CONFIG_HOME ?? join(home, ".config"), "systemd", "user", "super-pi.service") }; }
 async function system(command, args) { if (process.env.SUPER_PI_AUTOSTART_DRY_RUN === "1") { console.log(`[dry-run] ${command} ${args.join(" ")}`); return; } await execFileAsync(command, args, { windowsHide: true }); }
 async function enable(value) {
@@ -84,6 +85,25 @@ try {
   if (command === "help" || command === "--help" || command === "-h") { usage(); process.exit(0); }
   if (!command) { const value = options(args); await start(value); const url = `http://127.0.0.1:${value.port}`; if (value.browser) openBrowser(url); console.log(value.browser ? `Opened ${url}\n${runningBanner(url)}` : runningBanner(url)); process.exit(0); }
   if (command === "autostart" || command === "startup") { const action = args.shift()?.toLowerCase() ?? "status"; const value = options(args); if (action === "enable") await enable(value); else if (action === "disable") await disable(); else if (action === "status") await status(); else throw new Error("Autostart action must be enable, disable, or status."); process.exit(0); }
+  if (command === "diagnose" || command === "diagnose-latency") {
+    // MEASURE WHERE THE TIME GOES, ON THE MACHINE THAT IS COMPLAINING.
+    //
+    // It runs a throwaway server on its own port with its own data directory, so it never disturbs a
+    // session someone is in the middle of and never writes into their real conversations. What it prints
+    // is three spans that belong to DIFFERENT OWNERS - Super Pi, Super Pi, and the model - because
+    // conflating them is how two wrong root causes got written down before.
+    const turnsArg = args.find((a) => /^\d+$/.test(a));
+    const { diagnose, renderReport } = await import(pathToFileURL(join(root, "scripts", "diagnose.mjs")).href);
+    console.log(`Super Pi v${ownVersion().version} — diagnosing on ${process.platform}, node ${process.versions.node}`);
+    const result = await diagnose({
+      repositoryRoot: root,
+      turns: turnsArg ? Number.parseInt(turnsArg, 10) : 2,
+      onProgress: (line) => console.log(`  ${line}`),
+    });
+    console.log("");
+    console.log(renderReport(result));
+    process.exit(result.error ? 1 : 0);
+  }
   if (!["start", "stop", "restart", "update"].includes(command)) throw new Error(`Unknown command: ${command}`);
   if (command === "update") { const npm = platform === "win32" ? "npm.cmd" : "npm"; const args = prefix ? ["install", "--prefix", prefix, "@evandu/super-pi"] : ["install", "-g", "@evandu/super-pi"]; const child = spawn(npm, args, { stdio: "inherit", shell: platform === "win32", env: process.env }); const code = await new Promise((resolve) => child.on("close", resolve)); if (code !== 0) process.exit(code ?? 1); }
   const value = options(args);

package/dist/client/.super-pi-client-sources.json

@@ -24,5 +24,5 @@
     "src/client/types.ts": "6487df00c164370550b5977f9b23b17e22aff4bfb59dfe1e52200042340e3769",
     "src/client/vite-env.d.ts": "65996936fbb042915f7b74a200fcdde7e410f32a669b1ab9597cfaa4b0faddb5"
   },
-  "recordedAt": "2026-10-20T17:20:14.918Z"
+  "recordedAt": "2026-10-21T05:09:03.121Z"
 }

package/dist/server/index.js

@@ -6,6 +6,7 @@ import { existsSync } from "node:fs";
 import { mkdir } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { openStateStore } from "./persistence/open-state-store.js";
 import { PiRpcRuntime, WelcomeRuntime } from "./runtime.js";
 import { resolveAgentDirectories } from "./agents.js";
@@ -30,6 +31,49 @@ import { ToolLlmService } from "./tool-llm.js";
 // ------------------------------------------------------------- Environment & paths
 const rootDir = resolve(import.meta.dirname, "../..");
 initRunningVersion(rootDir);
+// THE SECURITY PATCH, APPLIED WHERE IT CANNOT BREAK AN INSTALL.
+//
+// Pi's package pins a vulnerable `brace-expansion` in its own shrinkwrapped tree, and npm will not let
+// anything move it - not `overrides`, not `npm audit fix`. So Super Pi replaces that one copy with the
+// patched release itself.
+//
+// It runs HERE, at startup, and not as a `postinstall` script, because a postinstall that fails fails
+// the INSTALL - and on 2026-10-21 it did exactly that on somebody else's machine, leaving them unable
+// to install Super Pi at all. An install must not be breakable by a security patch.
+//
+// It is also deliberately ASYNCHRONOUS and off the startup path: the server is already serving by the
+// time this finishes, and a registry that is slow or unreachable must not delay the panel. The copy is
+// vulnerable for the few seconds until the patch lands, and the patched version is what every later
+// turn uses.
+void (async () => {
+    try {
+        // The specifier is built at runtime so the compiler does not need the file to exist: it lives in
+        // `scripts/`, which is not part of the compiled output.
+        const modulePath = resolve(rootDir, "scripts", "patch-brace-expansion.mjs");
+        const { patchBraceExpansion } = await import(pathToFileURL(modulePath).href);
+        await patchBraceExpansion();
+    }
+    catch (error) {
+        console.warn(`[super-pi] the brace-expansion patch did not run: ${error instanceof Error ? error.message : String(error)}`);
+    }
+})();
+// PI'S SDK, LOADED WHILE THE SERVER IS STILL STARTING.
+//
+// Importing Pi's SDK costs about 1.5 seconds the first time and is free afterwards, and it was being
+// paid by whichever user action happened to need it first - which, for most people, was opening the
+// model picker and wondering why it stayed grey. Here it is paid during startup, in parallel with
+// everything else the server does, so the first conversation does not pay for it.
+//
+// Warmup only: nothing here is required for the server to run, and a failure is one line.
+void (async () => {
+    try {
+        const { warmPiSdk } = await import(pathToFileURL(resolve(rootDir, "dist", "server", "pi-session.js")).href);
+        await warmPiSdk();
+    }
+    catch (error) {
+        console.warn(`[super-pi] Pi's SDK did not load during warmup: ${error instanceof Error ? error.message : String(error)}`);
+    }
+})();
 const cliArgs = parseServerArgs(process.argv);
 // A non-numeric SUPER_PI_PORT would parse to NaN and die later in `listen` with a confusing error;
 // like the other environment variables here, an unusable value falls back to the default port.

package/dist/server/model-filter.js

@@ -35,7 +35,12 @@ export async function validateConversationModel(store, runtime, conversationId,
     const workspace = conversationWorkspace(state, conversationId);
     if (!applicableRules(state.modelFilterRules, workspace).length)
         return;
+    const startedAt = performance.now();
+    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+        console.warn(`[super-pi latency] conversation=${conversationId} phase=model.validate.begin selection=${selection ? `${selection.provider}/${selection.modelId}` : "default"}`);
     const catalog = await runtime.catalog();
     const model = selection ? catalog.models.find(item => item.provider === selection.provider && item.modelId === selection.modelId) ?? selection : catalog.defaultModel;
     assertModelAllowed(store.snapshot().modelFilterRules, conversationWorkspace(store.snapshot(), conversationId), model);
+    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+        console.warn(`[super-pi latency] conversation=${conversationId} phase=model.validate.end elapsedMs=${Math.round(performance.now() - startedAt)}`);
 }

package/dist/server/pi-command.d.ts

@@ -21,7 +21,8 @@ export type PiCommandResolution = {
 } | {
     found: false;
     reason: string;
-    searched: string[];
+    searched: string[]; /** Whether a command was NAMED and did not resolve. A named Pi is a statement about which Pi runs a turn, and it stays true when the file is missing. */
+    explicit?: boolean;
 };
 /** Overridable so the resolution can be exercised for both platforms and both outcomes without a Pi install. */
 export interface PiCommandOptions {

package/dist/server/pi-command.js

@@ -113,8 +113,12 @@ export function resolvePiCommand(options = {}) {
                 return { found: true, command: full, via: label, explicit: true };
             return {
                 found: false,
-                reason: `${label} points at ${full}, and no such file exists. Fix ${command ? "that argument" : "SUPER_PI_PI_COMMAND"} or unset it to fall back to PATH and npm's global bin directory. This is an environment problem, not a defect in the agent mechanism.`,
+                reason: `${label} points at ${full}, and no such file exists. Fix ${command ? "that argument" : "SUPER_PI_PI_COMMAND"} or unset it to fall back to PATH and npm's global bin directory. This is an environment problem, not a defect of the agent mechanism.`,
                 searched: [full],
+                // STILL EXPLICIT. A Pi was NAMED, and naming one is a statement about which Pi runs a turn -
+                // so the fact survives the file being missing, and the honest answer to "that Pi cannot be
+                // asked" is "unavailable", never a list belonging to some other Pi.
+                explicit: true,
             };
         }
         const hit = firstHit([explicit], [...onPath, ...globalDirs], exists, platform);
@@ -122,8 +126,9 @@ export function resolvePiCommand(options = {}) {
             return { found: true, command: hit.command, via: `${label} (${hit.dir})`, explicit: true };
         return {
             found: false,
-            reason: `${label} names ${explicit}, which is on no PATH entry and in none of npm's global bin directories. This is an environment problem, not a defect in the agent mechanism.`,
+            reason: `${label} names ${explicit}, which is on no PATH entry and in none of npm's global bin directories. This is an environment problem, not a defect of the agent mechanism.`,
             searched: [...onPath, ...globalDirs],
+            explicit: true,
         };
     }
     // THE PI THAT IS HOSTING SUPER PI, when Super Pi was started from inside Pi itself.

package/dist/server/pi-session-pool.d.ts

@@ -114,6 +114,18 @@ export declare class PiSessionPool {
      */
     acquire(request: SessionRequest): Promise<PiSessionLike>;
     private build;
+    /**
+     * Puts a live session on the model and level the conversation is asking for.
+     *
+     * Best-effort in the way that matters: a session that cannot change its model is still a working
+     * session, and refusing the message because Pi declined a model switch would be a worse answer than
+     * running on the model that is loaded. So the failure is a warning, and the turn goes on.
+     *
+     * The comparison is against what the session is ALREADY running, because Pi can report its model in
+     * two shapes (an id or a provider/id pair) and a mismatch on shape alone would mean re-setting the
+     * model on every single turn.
+     */
+    private applyModelAndLevel;
     private fingerprintOf;
     /**
      * The live session for a conversation, without building one.

package/dist/server/pi-session-pool.js

@@ -94,18 +94,28 @@ export class PiSessionPool {
         const existing = this.sessions.get(request.conversationId);
         if (existing) {
             if (sameFingerprint(existing.fingerprint, fingerprint)) {
+                if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                    console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.reused`);
                 existing.lastUsedAt = Date.now();
                 // A session that is still being built is joined, not rebuilt: two sends arriving together must
                 // not produce two sessions, and the second one would be a duplicate model client talking to the
                 // same conversation.
                 if (existing.building)
                     return existing.building;
+                // THE MODEL AND THE LEVEL ARE APPLIED HERE, TO THE LIVE SESSION. They are not in the
+                // fingerprint because Pi can change them in place, and rebuilding the session to honour a
+                // change would replay the whole transcript - the single most expensive thing this runtime does.
+                // A person who picks a different model in the picker pays a few milliseconds here instead of
+                // waiting for their entire history to be re-read on the next message.
+                await this.applyModelAndLevel(existing.session, request);
                 return existing.session;
             }
             // STALE. The conversation's requirements changed underneath the live session, so it is thrown away
             // BEFORE the new one is built, and not after - a session that is being disposed of while the new
             // one starts would have two contexts for one conversation.
             await this.evict(request.conversationId);
+            if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.rebuild`);
         }
         // THE CREDENTIAL IS MINTED HERE, WHERE THE SESSION IS BORN. The capability travels in the
         // extension's environment, and the extension reads its environment when it is LOADED - which happens
@@ -119,9 +129,13 @@ export class PiSessionPool {
         const capability = this.mintCapability(request.conversationId);
         const extensionEnv = { ...request.extensionEnv, [CAPABILITY_ENV]: capability, [TOOLS_CAPABILITY_ENV]: capability };
         const building = this.build({ ...request, extensionEnv }, fingerprint);
+        if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+            console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.build.begin`);
         this.sessions.set(request.conversationId, { session: undefined, fingerprint, lastUsedAt: Date.now(), building });
         try {
             const session = await building;
+            if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.build.end`);
             const entry = this.sessions.get(request.conversationId);
             if (entry) {
                 entry.session = session;
@@ -156,15 +170,53 @@ export class PiSessionPool {
         };
         return this.factory(creation);
     }
+    /**
+     * Puts a live session on the model and level the conversation is asking for.
+     *
+     * Best-effort in the way that matters: a session that cannot change its model is still a working
+     * session, and refusing the message because Pi declined a model switch would be a worse answer than
+     * running on the model that is loaded. So the failure is a warning, and the turn goes on.
+     *
+     * The comparison is against what the session is ALREADY running, because Pi can report its model in
+     * two shapes (an id or a provider/id pair) and a mismatch on shape alone would mean re-setting the
+     * model on every single turn.
+     */
+    async applyModelAndLevel(session, request) {
+        const wanted = request.model;
+        if (wanted && session.setModel) {
+            const running = session.model;
+            const same = running?.provider === wanted.provider && (running?.id ?? running?.id) === wanted.modelId;
+            if (!same) {
+                try {
+                    await session.setModel({ provider: wanted.provider, id: wanted.modelId });
+                    if (process.env.SUPER_PI_TRACE_LATENCY === "1")
+                        console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.model-applied model=${wanted.provider}/${wanted.modelId}`);
+                }
+                catch (error) {
+                    console.warn(`PiSessionPool: conversation ${request.conversationId} asked for ${wanted.provider}/${wanted.modelId} and Pi declined: ${error instanceof Error ? error.message : String(error)}. The turn will run on the model already loaded.`);
+                }
+            }
+        }
+        if (request.thinkingLevel && session.setThinkingLevel) {
+            try {
+                session.setThinkingLevel(request.thinkingLevel);
+            }
+            catch (error) {
+                console.warn(`PiSessionPool: conversation ${request.conversationId} asked for thinking level ${request.thinkingLevel} and Pi declined: ${error instanceof Error ? error.message : String(error)}.`);
+            }
+        }
+    }
     fingerprintOf(request) {
+        // The model and the thinking level are NOT here, and that is deliberate: Pi changes both on a
+        // live session, so they are applied to it rather than forcing a rebuild that would replay the whole
+        // transcript. The session is still CREATED with them (see `build`) - it just is not thrown away
+        // when they change.
         return {
             cwd: request.cwd,
             agentId: request.agentId,
             tools: request.tools,
             excludeTools: request.excludeTools,
             extensions: superPiExtensionPaths(this.repositoryRoot),
-            model: request.model,
-            thinkingLevel: request.thinkingLevel,
         };
     }
     /**

package/dist/server/pi-session.d.ts

@@ -23,6 +23,83 @@
  * the transcript on disk while the live session still holds the old context in memory, and nothing in Pi
  * would notice the difference.
  */
+/**
+ * Loads Pi's SDK while the server is still starting.
+ *
+ * Importing Pi costs about 1.5 seconds once and is free afterwards, and it used to be paid by whatever
+ * user action needed it FIRST - which for most people was opening the model picker and watching it stay
+ * grey. Paying it here, during startup, moves it off the path a person can see.
+ *
+ * Safe to call more than once, and safe to call on a server that never needs the SDK: it loads the
+ * module and returns, and the caller decides what to do with a failure.
+ */
+export declare function warmPiSdk(): Promise<boolean>;
+/**
+ * A model catalog read from Pi's SDK, with NO PROCESS.
+ *
+ * THE PROBLEM THIS SOLVES. The model picker used to be answered by starting a `pi --mode rpc` child,
+ * asking it three questions and killing it. That is a process start - measured at 866ms on a fast
+ * machine, and seconds on a slow one - paid every time the cache missed, and the cache key is the
+ * SELECTED MODEL, so it missed again for every model a person picked. A user who opened the picker and
+ * then created a conversation waited for a process to start.
+ *
+ * WHY IT IS SAFE. Pi's SDK is the same code Pi's RPC mode is built on, so the answers are the same:
+ * `ModelRuntime.getAvailable()` returned exactly the model list a spawned Pi reports, and a session's
+ * `getAvailableThinkingLevels()` returned exactly the level list. Both are checked field by field in
+ * `scripts/probe-catalog-equivalence.mjs` and `scripts/probe-levels.mjs`.
+ *
+ * WHAT IS STILL NEEDED FROM PI ITSELF. The thinking levels are a property of the SELECTED model, and a
+ * model that is not running has no session to ask. So the levels come from a short-lived in-memory
+ * session rather than from the model list - which costs a session, not a process, and is only needed
+ * when the caller actually wants levels for a model.
+ */
+export interface SdkCatalog {
+    /** Pi's own model objects, for the caller to reduce with the same helpers the RPC path used. */
+    models: unknown[];
+    /** The model Pi would use by default, if settings name one. */
+    defaultModel?: {
+        provider: string;
+        modelId: string;
+    };
+    /** The thinking level Pi would use by default, if settings name one. */
+    defaultThinkingLevel?: string;
+    /**
+     * The levels a model supports, read from a session running that model.
+     *
+     * Separate from the models because it is the expensive half: it needs a session, so a caller that
+     * only wants the list does not pay for it.
+     */
+    thinkingLevelsFor(model: {
+        provider: string;
+        modelId: string;
+    }): Promise<string[]>;
+}
+/**
+ * Builds a zero-process catalog reader.
+ *
+ * The ModelRuntime and the SettingsManager are created ONCE and reused: both read the auth store and
+ * the model store from disk, so a fresh one per call would put the same I/O back that this is here to
+ * remove. They are safe to share - they are read-mostly views of the same files.
+ *
+ * The MODEL LIST is read once, at build time, and the LEVELS are cached per model - both because
+ * re-reading them is the cost this exists to remove, and because the answer cannot change while the
+ * process runs: a person who edits `auth.json` or adds a model restarts Super Pi, exactly as they
+ * would for anything else in Pi's own configuration.
+ */
+export declare function createSdkCatalog(cwd: string): Promise<SdkCatalog>;
+/**
+ * The transcript file a conversation's session writes to, found WITHOUT starting a Pi process.
+ *
+ * THIS REPLACES A SPAWN. Revert and fork need to know which file holds a conversation's history, and
+ * they used to start a  child purely to be told. Pi's SDK answers it from the session
+ * manager's own state - and it answers it the same way Pi's RPC mode does, which is the only reason
+ * this is safe: Pi looks a session up BY ID and by WORKING DIRECTORY, so asking the library that
+ * resolves the session gives the same file the child would have named.
+ *
+ * Returns undefined when there is no such session, which is the caller's cue to fall back rather than
+ * to guess: a wrong path here would truncate somebody else's conversation.
+ */
+export declare function resolveTranscriptFile(cwd: string, conversationId: string, sessionDir: string): Promise<string | undefined>;
 /** Whether the SDK could be loaded. Used by the server to report the reason instead of failing a turn. */
 export declare function piSdkAvailable(): Promise<{
     available: true;
@@ -48,12 +125,6 @@ export interface SessionFingerprint {
     excludeTools: string[] | undefined;
     /** Which of Super Pi's own extensions were mounted. */
     extensions: string[];
-    /** The model and thinking level, when they were pinned at creation. */
-    model?: {
-        provider: string;
-        modelId: string;
-    };
-    thinkingLevel?: string;
 }
 /**
  * Fingerprints are compared by VALUE, and this is where that comparison is spelled out.
@@ -113,6 +184,31 @@ export interface PiSessionLike {
     readonly sessionFile?: string | undefined;
     /** The id of the session. */
     readonly sessionId?: string | undefined;
+    /**
+     * The model the session is running on.
+     *
+     * READ TO COMPARE, not to set: a model is chosen when the session is created, and a LATER change goes
+     * through `setModel`.
+     */
+    readonly model?: {
+        provider?: string;
+        id?: string;
+    } | undefined;
+    /**
+     * Switches the model on a LIVE session.
+     *
+     * THIS IS WHY THE MODEL IS NOT PART OF THE CONFIGURATION FINGERPRINT. Pi can change the model of a
+     * running session, so a model change does not need a new session - and making one would cost a
+     * transcript replay, which is the most expensive thing this runtime does. A user who picks a different
+     * model in the picker would otherwise pay for the whole conversation's history to be re-read.
+     */
+    setModel?(model: {
+        provider: string;
+        id: string;
+    }): Promise<void>;
+    /** The thinking levels the session's current model supports. Pi's own answer, not a derivation. */
+    getAvailableThinkingLevels?(): string[];
+    setThinkingLevel?(level: string): void;
     /**
      * The session's transcript, for naming a position in it.
      *

package/dist/server/pi-session.js

@@ -23,8 +23,32 @@
  * the transcript on disk while the live session still holds the old context in memory, and nothing in Pi
  * would notice the difference.
  */
-import { existsSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join } from "node:path";
+const traceSession = (conversationId, phase, startedAt, extra = "") => {
+    if (process.env.SUPER_PI_TRACE_LATENCY !== "1")
+        return;
+    console.warn(`[super-pi latency] conversation=${conversationId} phase=${phase} elapsedMs=${Math.round(performance.now() - startedAt)}${extra ? ` ${extra}` : ""}`);
+};
+/**
+ * Loads Pi's SDK while the server is still starting.
+ *
+ * Importing Pi costs about 1.5 seconds once and is free afterwards, and it used to be paid by whatever
+ * user action needed it FIRST - which for most people was opening the model picker and watching it stay
+ * grey. Paying it here, during startup, moves it off the path a person can see.
+ *
+ * Safe to call more than once, and safe to call on a server that never needs the SDK: it loads the
+ * module and returns, and the caller decides what to do with a failure.
+ */
+export async function warmPiSdk() {
+    try {
+        await loadSdk();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 let sdkPromise;
 let sdkFailure;
 async function loadSdk() {
@@ -44,6 +68,84 @@ async function loadSdk() {
     }
     return sdkPromise;
 }
+/**
+ * Builds a zero-process catalog reader.
+ *
+ * The ModelRuntime and the SettingsManager are created ONCE and reused: both read the auth store and
+ * the model store from disk, so a fresh one per call would put the same I/O back that this is here to
+ * remove. They are safe to share - they are read-mostly views of the same files.
+ *
+ * The MODEL LIST is read once, at build time, and the LEVELS are cached per model - both because
+ * re-reading them is the cost this exists to remove, and because the answer cannot change while the
+ * process runs: a person who edits `auth.json` or adds a model restarts Super Pi, exactly as they
+ * would for anything else in Pi's own configuration.
+ */
+export async function createSdkCatalog(cwd) {
+    const sdk = await loadSdk();
+    const agentDir = defaultAgentDir();
+    const modelRuntime = await sdk.ModelRuntime.create();
+    const settingsManager = sdk.SettingsManager.create(cwd, agentDir);
+    const models = (await modelRuntime.getAvailable?.()) ?? modelRuntime.getModels?.() ?? [];
+    const levelsByModel = new Map();
+    return {
+        models,
+        ...(settingsManager.getDefaultProvider?.() && settingsManager.getDefaultModel?.()
+            ? {
+                defaultModel: {
+                    provider: settingsManager.getDefaultProvider(),
+                    modelId: settingsManager.getDefaultModel(),
+                },
+            }
+            : {}),
+        ...(settingsManager.getDefaultThinkingLevel?.() ? { defaultThinkingLevel: settingsManager.getDefaultThinkingLevel() } : {}),
+        thinkingLevelsFor: async (model) => {
+            const key = `${model.provider}/${model.modelId}`;
+            const cached = levelsByModel.get(key);
+            if (cached)
+                return cached;
+            // A model that is not running has no levels of its own, so a short-lived in-memory session is
+            // built to ask Pi. It costs a session - measured at ~30ms warm, and no process at all - and it is
+            // paid once per model rather than once per picker open.
+            const { session } = await sdk.createAgentSession({
+                cwd,
+                agentDir,
+                modelRuntime,
+                settingsManager,
+                sessionManager: sdk.SessionManager.inMemory(cwd, { id: "catalog-levels" }),
+                model: modelRuntime.getModel?.(model.provider, model.modelId),
+            });
+            try {
+                const levels = sessionLevels(session);
+                levelsByModel.set(key, levels);
+                return levels;
+            }
+            finally {
+                session.dispose?.();
+            }
+        },
+    };
+}
+/** Reads the thinking levels off a session, tolerating a session that does not implement the call. */
+function sessionLevels(session) {
+    const levels = session.getAvailableThinkingLevels?.();
+    return Array.isArray(levels) ? levels.filter((level) => typeof level === "string") : [];
+}
+/**
+ * The transcript file a conversation's session writes to, found WITHOUT starting a Pi process.
+ *
+ * THIS REPLACES A SPAWN. Revert and fork need to know which file holds a conversation's history, and
+ * they used to start a  child purely to be told. Pi's SDK answers it from the session
+ * manager's own state - and it answers it the same way Pi's RPC mode does, which is the only reason
+ * this is safe: Pi looks a session up BY ID and by WORKING DIRECTORY, so asking the library that
+ * resolves the session gives the same file the child would have named.
+ *
+ * Returns undefined when there is no such session, which is the caller's cue to fall back rather than
+ * to guess: a wrong path here would truncate somebody else's conversation.
+ */
+export async function resolveTranscriptFile(cwd, conversationId, sessionDir) {
+    const sdk = await loadSdk();
+    return sdk.SessionManager.findById(cwd, conversationId, sessionDir);
+}
 /** Whether the SDK could be loaded. Used by the server to report the reason instead of failing a turn. */
 export async function piSdkAvailable() {
     try {
@@ -75,10 +177,6 @@ export function sameFingerprint(a, b) {
         return false;
     if (!sameSet(a.extensions, b.extensions))
         return false;
-    if (a.model?.provider !== b.model?.provider || a.model?.modelId !== b.model?.modelId)
-        return false;
-    if (a.thinkingLevel !== b.thinkingLevel)
-        return false;
     return true;
 }
 function sameSet(a, b) {
@@ -116,7 +214,10 @@ export async function withEnvironment(values, work) {
     }
 }
 export async function createPiSession(creation) {
+    const startedAt = performance.now();
+    traceSession(creation.sessionId, "sdk.load.begin", startedAt);
     const sdk = await loadSdk();
+    traceSession(creation.sessionId, "sdk.load.end", startedAt);
     const agentDir = creation.agentDir ?? defaultAgentDir();
     return withEnvironment(creation.extensionEnv, async () => {
         // THE AGENT'S PROMPT. Pi's loader takes the same two shapes the command line took: a `systemPrompt`
@@ -136,10 +237,13 @@ export async function createPiSession(creation) {
                     : {}),
         });
         await loader.reload();
+        traceSession(creation.sessionId, "sdk.loader.reload", startedAt, `extensions=${creation.extensionPaths.length}`);
         const sessionManager = creation.persist === false
             ? sdk.SessionManager.inMemory(creation.cwd, { id: creation.sessionId })
             : await resolveSessionManager(sdk, creation);
+        traceSession(creation.sessionId, "sdk.transcript.ready", startedAt, `bytes=${transcriptBytes(sessionManager)}`);
         const modelRuntime = await sdk.ModelRuntime.create();
+        traceSession(creation.sessionId, "sdk.model-runtime", startedAt);
         // THE MODEL IS RESOLVED, NOT PASSED THROUGH. Pi's SDK takes a whole Model object - the provider's
         // configuration, the endpoint, the capability list - and Super Pi only knows the pair
         // (provider, modelId) that the picker shows. The runtime is what turns that pair into the object
@@ -164,9 +268,21 @@ export async function createPiSession(creation) {
             ...(creation.thinkingLevel ? { thinkingLevel: creation.thinkingLevel } : {}),
         };
         const { session } = await sdk.createAgentSession(options);
+        traceSession(creation.sessionId, "sdk.session.created", startedAt);
         return session;
     });
 }
+function transcriptBytes(sessionManager) {
+    const file = sessionManager.getSessionFile?.();
+    if (!file)
+        return 0;
+    try {
+        return existsSync(file) ? statSync(file).size : 0;
+    }
+    catch {
+        return 0;
+    }
+}
 /**
  * Resolves the session manager for a conversation: the EXISTING transcript if there is one, a new one
  * otherwise.