@fitchmultz/pi-subagents 0.47.0 → 0.48.0

package/src/pi-intercom/bridge-rpc-process.ts

@@ -3,7 +3,7 @@ import { StringDecoder } from "node:string_decoder";
 import type { RpcCommand, RpcExtensionUIResponse } from "@earendil-works/pi-coding-agent";
 import { trySignalChildTree } from "../shared/post-exit-stdio-guard.ts";
 import { isRecord, type UnknownRecord } from "../shared/unknown.ts";
-import { Fault, log, wait } from "./bridge-protocol.ts";
+import { Fault, cancelled, log, wait } from "./bridge-protocol.ts";
 import type { LaunchPolicy } from "./bridge-launch-policy.ts";
 
 const FRAME_LIMIT = 4 * 1024 * 1024;
@@ -15,7 +15,7 @@ function launchEnvironment(packageRoot: string): NodeJS.ProcessEnv {
 }
 
 // Native RpcClient lacks public EOF/exit/UI control and retains/reprints unbounded stderr.
-// This owner implements only get_state and dialog cancellation, never a remote RPC proxy.
+// This owner implements state, owned-run cancellation and dialog dismissal, never a raw RPC proxy.
 export class RpcProcess {
   private readonly child: ChildProcessWithoutNullStreams;
   readonly exited: Promise<void>;
@@ -27,15 +27,17 @@ export class RpcProcess {
   private sequence = 0;
   private pending?: {
     readonly id: string;
+    readonly command: "get_state" | "abort";
     readonly resolve: (data: UnknownRecord) => void;
     readonly reject: (error: Readonly<Error>) => void;
   };
   private stopping?: Promise<void>;
   private stderrBytes = 0;
   private exitObserved = false;
+  private cancelling = false;
 
-  constructor(policy: LaunchPolicy, cwd: string, sessionFile: string) {
-    this.child = spawn(process.execPath, this.arguments(policy, sessionFile), {
+  constructor(policy: LaunchPolicy, cwd: string, sessionFile: string, resuming = false) {
+    this.child = spawn(process.execPath, this.arguments(policy, sessionFile, resuming), {
       cwd,
       detached: true,
       env: launchEnvironment(policy.packageRoot),
@@ -78,19 +80,19 @@ export class RpcProcess {
   get pid(): number | undefined {
     return this.child.pid;
   }
-  private arguments(policy: LaunchPolicy, sessionFile: string): string[] {
+  private arguments(policy: LaunchPolicy, sessionFile: string, resuming: boolean): string[] {
     const args = [
       policy.cli,
       "--mode",
       "rpc",
       "--session",
       sessionFile,
-      "--provider",
-      policy.provider,
-      "--model",
-      policy.model,
       policy.trustProject ? "--approve" : "--no-approve",
     ];
+    // Resume leaves native model/thinking restoration authoritative; never force the launch default.
+    if (!resuming && policy.provider !== undefined && policy.model !== undefined) {
+      args.push("--provider", policy.provider, "--model", policy.model);
+    }
     if (!policy.discoverResources) {
       args.push(
         "--no-extensions",
@@ -191,8 +193,12 @@ export class RpcProcess {
   private response(data: UnknownRecord): void {
     const pending = this.pending;
     this.pending = undefined;
-    if (data.success === true && data.command === "get_state" && isRecord(data.data)) {
-      pending?.resolve(data.data);
+    if (
+      data.success === true &&
+      data.command === pending?.command &&
+      (pending?.command !== "get_state" || isRecord(data.data))
+    ) {
+      pending?.resolve(isRecord(data.data) ? data.data : {});
     } else {
       pending?.reject(new Fault(503, "rpc_failed", "Pi RPC state request failed."));
     }
@@ -218,7 +224,7 @@ export class RpcProcess {
   }
   private write(
     command: Readonly<
-      | Extract<RpcCommand, { type: "get_state" }>
+      | Extract<RpcCommand, { type: "get_state" | "abort" }>
       | Extract<RpcExtensionUIResponse, { cancelled: true }>
     >,
   ): void {
@@ -228,14 +234,25 @@ export class RpcProcess {
       this.cleanup();
     }
   }
-  async state(signal: AbortSignal): Promise<UnknownRecord> {
+  private async command(
+    command: "get_state" | "abort",
+    signal: AbortSignal,
+  ): Promise<UnknownRecord> {
+    cancelled(signal);
     if (this.failure) {
       throw this.failure;
     }
-    const id = `state-${++this.sequence}`;
+    if (this.pending) {
+      throw new Fault(
+        409,
+        "control_in_progress",
+        "A native control operation is already in flight.",
+      );
+    }
+    const id = `control-${++this.sequence}`;
     const result = new Promise<UnknownRecord>((resolve, reject) => {
-      this.pending = { id, resolve, reject };
-      this.write({ type: "get_state", id });
+      this.pending = { id, command, resolve, reject };
+      this.write({ type: command, id });
     });
     try {
       return await wait(result, signal);
@@ -243,6 +260,26 @@ export class RpcProcess {
       this.pending = undefined;
     }
   }
+  async state(signal: AbortSignal): Promise<UnknownRecord> {
+    return this.command("get_state", signal);
+  }
+  async cancel(signal: AbortSignal): Promise<UnknownRecord> {
+    if (this.cancelling) {
+      throw new Fault(409, "control_in_progress", "Native cancellation is already in flight.");
+    }
+    this.cancelling = true;
+    try {
+      await this.command("abort", signal);
+      const state = await this.state(signal);
+      if (state.isStreaming !== false) {
+        throw new Fault(409, "cancel_unconfirmed", "Native Pi has not reached idle after abort.");
+      }
+      this.status = "idle";
+      return { isStreaming: false, pendingMessageCount: state.pendingMessageCount };
+    } finally {
+      this.cancelling = false;
+    }
+  }
   ready(): void {
     if (this.failure || this.exitObserved) {
       throw this.failure ?? new Fault(503, "session_exited", "Pi exited during startup.");

package/src/pi-intercom/bridge-session.ts

@@ -1,16 +1,16 @@
 import { randomUUID } from "node:crypto";
 import { IntercomClient } from "./broker/client.ts";
-import {
-  formatSessionTarget,
-  resolveSessionProjectId,
-  resolveSessionTarget,
-} from "./session-targets.ts";
+import { resolveSessionProjectId } from "./session-targets.ts";
 import type { Message, SendResult, SessionInfo } from "./types.ts";
 import type { Identity } from "./bridge-config.ts";
 import { Fault, cancelled, log, wait } from "./bridge-protocol.ts";
 import { Mailbox } from "./bridge-mailbox.ts";
 import type { UnknownRecord } from "../shared/unknown.ts";
 import type { MessagingOperation as Operation } from "./bridge-routes.ts";
+import type { RequestContext } from "./bridge-http.ts";
+import { resolveBridgeTarget, bridgeSessionList } from "./bridge-target.ts";
+import { ControlReplies } from "./bridge-control.ts";
+import type { NativeControlOperation } from "./native-control-protocol.ts";
 
 import { WaitingAsk } from "./bridge-ask.ts";
 const MAX_REQUESTS = 8;
@@ -18,11 +18,6 @@ const IDLE_TIMEOUT = 5 * 60 * 1000;
 const SEND_TIMEOUT = 8000;
 const LIST_TIMEOUT = 5000;
 
-interface RequestContext {
-  readonly signal: AbortSignal;
-  readonly requestId: string;
-  readonly onPeer: (peer: string) => void;
-}
 interface SendOptions {
   readonly messageId?: string;
   readonly replyTo?: string;
@@ -50,6 +45,7 @@ export class Session {
   private readonly inbox: Mailbox;
   private readonly replying = new Set<string>();
   private pending?: WaitingAsk;
+  private readonly controls = new ControlReplies();
   private closed = false;
   private connecting?: Promise<void>;
   private disconnecting?: Promise<void>;
@@ -86,6 +82,9 @@ export class Session {
     if (this.closed) {
       throw this.closeReason;
     }
+    this.authorize();
+  }
+  authorize(): void {
     if (!this.owner.allowed(this.identity)) {
       throw new Fault(403, "revoked", "Identity is no longer authorized.");
     }
@@ -197,21 +196,19 @@ export class Session {
     this.owner.retired(this.identity.fingerprint256, this.generation);
     log("session_closed", { ...this.fields(), result: this.closeReason.code });
   }
-  close(error: Readonly<Fault>): void {
+  close(fault: Readonly<Fault>): void {
     if (this.closed) {
       return;
     }
     this.closed = true;
-    this.closeReason = error;
+    this.closeReason = fault;
     clearTimeout(this.lease);
-    this.pending?.reject(error);
+    this.pending?.reject(fault);
+    this.controls.close(fault);
     for (const controller of this.requests) {
-      controller.abort(error);
+      controller.abort(fault);
     }
     // Retain the generation until acquisition/registration AND final disconnect settle.
-    this.startRetirement();
-  }
-  private startRetirement(): void {
     this.retirement = this.retire().catch((caught: unknown) => this.cleanupFailed(caught));
   }
   async settled(): Promise<void> {
@@ -219,6 +216,7 @@ export class Session {
   }
 
   private peerLeft(id: string): void {
+    this.controls.peerLeft(id);
     if (this.pending?.peer === id && !this.pending.settled) {
       this.pending.reject(
         new Fault(409, "peer_offline", "Ask recipient disconnected.", { id: this.pending.id }),
@@ -240,6 +238,9 @@ export class Session {
       );
       return;
     }
+    if (this.controls.receive(from.id, message)) {
+      return;
+    }
     if (!this.inbox.persistent && this.resolveReply(from, message)) {
       return;
     }
@@ -320,29 +321,29 @@ export class Session {
     await this.connect(signal);
     return this.peers(signal);
   }
+  async nativeControl(
+    operation: NativeControlOperation,
+    certificate: string,
+    context: RequestContext,
+  ): Promise<UnknownRecord> {
+    await this.connect(context.signal);
+    const peer = await this.target(operation.to, context.signal);
+    return this.controls.request(
+      this.client,
+      { ...operation, peer: peer.id, certificate },
+      { ...context, guard: () => this.guard(context.signal) },
+    );
+  }
   private async target(to: string, signal: AbortSignal): Promise<SessionInfo> {
-    const resolution = resolveSessionTarget(await this.peers(signal), to);
-    if (resolution.status === "none") {
-      throw new Fault(404, "peer_offline", "Peer is not connected.");
-    }
-    if (resolution.status !== "found" || !resolution.target) {
-      throw new Fault(
-        409,
-        "ambiguous_target",
-        "Use an unambiguous peer name or session ID (prefixes need at least 8 characters).",
-      );
-    }
-    if (resolution.target.id === this.client.sessionId) {
-      throw new Fault(400, "self_target", "Choose another peer.");
-    }
-    return resolution.target;
+    return resolveBridgeTarget(await this.peers(signal), to, this.client.sessionId);
   }
-  private async send(
+  async send(
     peer: string,
     message: string,
     context: RequestContext,
     options: SendOptions = {},
   ): Promise<SendResult> {
+    await this.connect(context.signal);
     const { signal, requestId } = context;
     context.onPeer(peer);
     this.guard(signal);
@@ -492,9 +493,7 @@ export class Session {
         const sessions = await this.peers(context.signal);
         return {
           sessionId: this.client.sessionId,
-          sessions: sessions.map(({ topics: _topics, subscriptions: _subscriptions, ...entry }) => {
-            return Object.assign(entry, { target: formatSessionTarget(entry, sessions) });
-          }),
+          sessions: bridgeSessionList(sessions),
         };
       }
       case "POST /v1/send":

package/src/pi-intercom/bridge-target.ts

@@ -0,0 +1,35 @@
+import { resolveSessionTarget, formatSessionTarget, nativePeerId } from "./session-targets.ts";
+import { Fault } from "./bridge-protocol.ts";
+import type { SessionInfo } from "./types.ts";
+
+export function bridgeSessionList(
+  peers: readonly SessionInfo[],
+): readonly (SessionInfo & { readonly target: string })[] {
+  return peers.map(({ topics: _topics, subscriptions: _subscriptions, ...entry }) => ({
+    ...entry,
+    target: formatSessionTarget(entry, peers),
+  }));
+}
+
+export function resolveBridgeTarget(
+  peers: readonly SessionInfo[],
+  to: string,
+  self: string | null,
+): SessionInfo {
+  const exactNative = peers.find((peer) => peer.id === nativePeerId(to));
+  const resolution = resolveSessionTarget(peers, exactNative?.id ?? to);
+  if (resolution.status === "none") {
+    throw new Fault(404, "peer_offline", "Peer is not connected.");
+  }
+  if (resolution.status !== "found" || !resolution.target) {
+    throw new Fault(
+      409,
+      "ambiguous_target",
+      "Use an unambiguous peer name or session ID (prefixes need at least 8 characters).",
+    );
+  }
+  if (resolution.target.id === self) {
+    throw new Fault(400, "self_target", "Choose another peer.");
+  }
+  return resolution.target;
+}

package/src/pi-intercom/bridge.ts

@@ -8,14 +8,23 @@ import { getBrokerSocketPath } from "./broker/paths.ts";
 import { loadConfig, sameListener, type Config, type Identity } from "./bridge-config.ts";
 import { ASK_TIMEOUT, Fault, fingerprint, log } from "./bridge-protocol.ts";
 import { Session } from "./bridge-session.ts";
-import { operationFor, routeFor, type Operation } from "./bridge-routes.ts";
-import { reply } from "./bridge-http.ts";
-import { Launcher, sameIdentity } from "./bridge-launch.ts";
+import { operationFor, routeFor } from "./bridge-routes.ts";
+import { reply, replyFault } from "./bridge-http.ts";
+import { sameIdentity } from "./bridge-launch.ts";
+import { BridgeOperations } from "./bridge-operations.ts";
+import { authenticatedCertificateChain } from "./native-control-auth.ts";
 import { PersistentPresence } from "./bridge-presence.ts";
 import { WakeDeliveries } from "./bridge-wake.ts";
 import { spawnBrokerIfNeeded } from "./broker/spawn.ts";
 
 const MAX_CONNECTIONS = 128;
+const LONG_ROUTES = new Set([
+  "POST /v1/start",
+  "POST /v1/spawn",
+  "POST /v1/resume",
+  "GET /v1/transcript",
+  "POST /v1/transcript",
+]);
 
 function validCertificateDates(starts: number, expires: number): boolean {
   return (
@@ -37,7 +46,7 @@ class Bridge {
   private readonly configPath: string;
   private readonly sessions = new Map<string, Session>();
   private readonly losses = new Map<string, number>();
-  private readonly launcher = new Launcher();
+  private readonly operations: BridgeOperations;
   private readonly sockets = new Set<Socket>();
   private readonly connections = new Map<TLSSocket, Connection>();
   private readonly server: Server;
@@ -49,6 +58,7 @@ class Bridge {
   constructor(config: Config, configPath: string) {
     this.config = config;
     this.configPath = configPath;
+    this.operations = new BridgeOperations(config.stateDir);
     this.deliveries = new WakeDeliveries(config.stateDir, (identity) => this.allowed(identity));
     if (config.stateDir !== undefined) {
       this.presence = new PersistentPresence({
@@ -245,12 +255,12 @@ class Bridge {
       }
       this.config = next;
       this.revokeRemoved();
-      this.launcher.revoke(next.clients).catch(() => log("launch_cleanup", { result: "failed" }));
+      this.operations.revoke(next.clients).catch(() => log("launch_cleanup", { result: "failed" }));
       log("allowlist_reloaded", { result: "accepted", clients: next.clients.size });
     } catch {
       this.config = { ...this.config, clients: new Map() };
       this.deliveries.reload();
-      this.launcher
+      this.operations
         .revoke(this.config.clients)
         .catch(() => log("launch_cleanup", { result: "failed" }));
       for (const session of this.sessions.values()) {
@@ -312,7 +322,7 @@ class Bridge {
     await Promise.all([
       ...this.handlers,
       ...sessions.map((session) => session.settled()),
-      this.launcher.shutdown(),
+      this.operations.shutdown(),
       this.presence?.stop(),
       this.deliveries.stop(),
     ]);
@@ -321,6 +331,7 @@ class Bridge {
   private admission(req: IncomingMessage): {
     readonly identity: Identity;
     readonly expires: number;
+    readonly certificate: string;
   } {
     const socket = req.socket;
     const connection = socket instanceof TLSSocket ? this.connections.get(socket) : undefined;
@@ -339,7 +350,11 @@ class Bridge {
       this.drop(connection.fingerprint, fault);
       throw fault;
     }
-    return { identity, expires: connection.expires };
+    return {
+      identity,
+      expires: connection.expires,
+      certificate: authenticatedCertificateChain(socket),
+    };
   }
   private async handle(req: IncomingMessage, res: ServerResponse): Promise<void> {
     const requestId = randomUUID();
@@ -372,7 +387,7 @@ class Bridge {
       );
     };
     try {
-      const { identity, expires } = this.admission(req);
+      const { identity, expires, certificate } = this.admission(req);
       const route = routeFor(req);
       session = this.session(identity, expires);
       controller = session.begin();
@@ -380,15 +395,18 @@ class Bridge {
       req.once("aborted", abort);
       res.once("close", onClose);
       const duration = route === "POST /v1/ask" ? ASK_TIMEOUT + 15000 : 15000;
-      setDeadline(route === "POST /v1/start" ? 75000 : duration);
+      setDeadline(LONG_ROUTES.has(route) ? 75000 : duration);
       const operation = await operationFor(req, route, signal);
       if (operation.route === "POST /v1/ask") {
         setDeadline(operation.timeoutMs + 15000);
+      } else if (operation.route === "GET /v1/transcript") {
+        setDeadline(75000);
       }
-      const data = await this.execute(operation, session, {
+      const data = await this.operations.execute(operation, session, {
         signal,
         requestId,
         expires,
+        certificate,
         onPeer: (id) => {
           peer = id;
         },
@@ -402,10 +420,7 @@ class Bridge {
           ? error
           : new Fault(503, "broker_unavailable", "Local broker operation failed.");
       log("request", { ...session?.fields(), requestId, peer, result: fault.code });
-      reply(res, requestId, fault.status, {
-        ok: false,
-        error: { code: fault.code, message: fault.message, ...fault.details },
-      });
+      replyFault(res, requestId, fault);
     } finally {
       clearTimeout(deadline);
       req.off("aborted", abort);
@@ -415,38 +430,6 @@ class Bridge {
       }
     }
   }
-  private async execute(
-    operation: Operation,
-    session: Readonly<Session>,
-    context: {
-      readonly signal: AbortSignal;
-      readonly requestId: string;
-      readonly expires: number;
-      readonly onPeer: (id: string) => void;
-    },
-  ) {
-    switch (operation.route) {
-      case "POST /v1/start":
-        return this.launcher.start(operation.name, {
-          identity: session.identity,
-          expires: context.expires,
-          signal: context.signal,
-          peers: (signal) => session.connectedPeers(signal),
-        });
-      case "GET /v1/sessions":
-        return this.launcher.list(session.identity);
-      case "POST /v1/stop":
-        return this.launcher.stop(session.identity, operation.sessionId);
-      case "GET /v1/list":
-      case "GET /v1/inbox":
-      case "POST /v1/register":
-      case "POST /v1/ask":
-      case "POST /v1/send":
-      case "POST /v1/reply":
-      case "POST /v1/ack":
-        return session.execute(operation, context);
-    }
-  }
 }
 
 function main(): void {

package/src/pi-intercom/broker/client.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from "events";
 import type net from "net";
 import { randomUUID } from "crypto";
+import type { NativeControlEnvelope } from "../native-control-protocol.ts";
 import { writeMessage } from "./framing.ts";
 import { BrokerConnection, connectBrokerSocket } from "./connection.ts";
 import { SnapshotReader } from "./snapshot-reader.ts";
@@ -51,6 +52,7 @@ interface SendOptions {
   readonly messageId?: string;
   readonly human?: HumanMessageOrigin;
   readonly topic?: TopicUpdate;
+  readonly control?: NativeControlEnvelope;
 }
 
 function toError(error: unknown): Error {
@@ -405,6 +407,7 @@ export class IntercomClient extends EventEmitter {
       expectsReply: options.expectsReply,
       ...(options.human ? { human: options.human } : {}),
       ...(options.topic ? { topic: options.topic } : {}),
+      ...(options.control ? { control: options.control } : {}),
       delivery: messageDelivery(options),
       queueMode: options.queueMode,
       threadId: options.threadId,

package/src/pi-intercom/connection.ts

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { IntercomClient } from "./broker/client.ts";
 import type { IntercomTransport } from "./transport.ts";
@@ -8,7 +7,7 @@ import type { IntercomLifecycle } from "./lifecycle.ts";
 import type { IntercomTopics } from "./topics.ts";
 import type { Message, SessionInfo, TopicChange } from "./types.ts";
 import { asError, errorMessage } from "./validation.ts";
-import { formatTargetOptions, resolveSessionTarget } from "./session-targets.ts";
+import { formatTargetOptions, resolveSessionTarget, nativePeerId } from "./session-targets.ts";
 
 export type ConnectionReason = "startup" | "background" | "tool" | "overlay" | "peer-awareness";
 type Lifecycle = Readonly<
@@ -233,7 +232,7 @@ export class IntercomConnection {
       }
       await next.connect(
         await this.lifecycle.registration(this.hooks.pendingAsks()),
-        `pi-${createHash("sha256").update(sessionId).digest("hex").slice(0, 32)}`,
+        nativePeerId(sessionId),
       );
       if (!this.lifecycle.live(ctx, generation)) {
         await next.disconnect();

package/src/pi-intercom/inbound.ts

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import type { IntercomConfig } from "./config.ts";
 import type { IntercomLifecycle } from "./lifecycle.ts";
@@ -13,6 +12,7 @@ import type { Message, SessionInfo } from "./types.ts";
 import { requestedDelivery, isBlockingSupervisorMessage } from "./inbound-record.ts";
 import { formatAttachments } from "./message-format.ts";
 import { readQuestionOwner } from "../runs/shared/supervisor-questions.ts";
+import { nativePeerId } from "./session-targets.ts";
 
 type Lifecycle = Readonly<
   Pick<IntercomLifecycle, "generation" | "isIdle" | "live" | "markActivity">
@@ -53,9 +53,7 @@ export class IntercomInbound {
     }
     const owner = readQuestionOwner(origin.runId);
     return (
-      owner?.sessionId === origin.ownerSessionId &&
-      from.id ===
-        `pi-${createHash("sha256").update(origin.ownerSessionId).digest("hex").slice(0, 32)}`
+      owner?.sessionId === origin.ownerSessionId && from.id === nativePeerId(origin.ownerSessionId)
     );
   }
   private normalize(from: SessionInfo, input: Message): Message {

package/src/pi-intercom/index.ts

@@ -9,6 +9,7 @@ import { InboundDeliveryOwner } from "./inbound-delivery.ts";
 import { ReplyWait } from "./reply-wait.ts";
 import { IntercomConnection } from "./connection.ts";
 import { IntercomInbound } from "./inbound.ts";
+import { NativeControls } from "./native-control.ts";
 import { IntercomOutbound } from "./outbound.ts";
 import { IntercomInspection } from "./inspection.ts";
 import { IntercomTopicActions } from "./topic-actions.ts";
@@ -33,7 +34,11 @@ export default function piIntercomExtension(pi: ExtensionAPI): void {
   const connection = new IntercomConnection(lifecycle, config, topics, {
     restoring: () => delivery.restoring,
     pendingAsks: () => replies.listPending().length,
-    incoming: (ctx, from, message) => inbound.receive(ctx, from, message),
+    incoming: async (ctx, from, message) => {
+      if (!(await controls.receive(ctx, from, message))) {
+        await inbound.receive(ctx, from, message);
+      }
+    },
     peerLeft: (id) => {
       wait.peerDisconnected(id);
       journal.peerLeft(id);
@@ -46,6 +51,7 @@ export default function piIntercomExtension(pi: ExtensionAPI): void {
       }
     },
   });
+  const controls = new NativeControls(lifecycle, connection);
   const delivery = new InboundDeliveryOwner(pi, lifecycle, journal, {
     replies,
     syncStatus: () => connection.syncStatus(),