@fitchmultz/pi-subagents 0.47.0 → 0.49.0

package/src/pi-intercom/bridge-rpc-process.ts

@@ -3,7 +3,7 @@ import { StringDecoder } from "node:string_decoder";
 import type { RpcCommand, RpcExtensionUIResponse } from "@earendil-works/pi-coding-agent";
 import { trySignalChildTree } from "../shared/post-exit-stdio-guard.ts";
 import { isRecord, type UnknownRecord } from "../shared/unknown.ts";
-import { Fault, log, wait } from "./bridge-protocol.ts";
+import { Fault, cancelled, log, wait } from "./bridge-protocol.ts";
 import type { LaunchPolicy } from "./bridge-launch-policy.ts";
 
 const FRAME_LIMIT = 4 * 1024 * 1024;
@@ -15,7 +15,7 @@ function launchEnvironment(packageRoot: string): NodeJS.ProcessEnv {
 }
 
 // Native RpcClient lacks public EOF/exit/UI control and retains/reprints unbounded stderr.
-// This owner implements only get_state and dialog cancellation, never a remote RPC proxy.
+// This owner implements state, owned-run cancellation and dialog dismissal, never a raw RPC proxy.
 export class RpcProcess {
   private readonly child: ChildProcessWithoutNullStreams;
   readonly exited: Promise<void>;
@@ -27,15 +27,17 @@ export class RpcProcess {
   private sequence = 0;
   private pending?: {
     readonly id: string;
+    readonly command: "get_state" | "abort";
     readonly resolve: (data: UnknownRecord) => void;
     readonly reject: (error: Readonly<Error>) => void;
   };
   private stopping?: Promise<void>;
   private stderrBytes = 0;
   private exitObserved = false;
+  private cancelling = false;
 
-  constructor(policy: LaunchPolicy, cwd: string, sessionFile: string) {
-    this.child = spawn(process.execPath, this.arguments(policy, sessionFile), {
+  constructor(policy: LaunchPolicy, cwd: string, sessionFile: string, resuming = false) {
+    this.child = spawn(process.execPath, this.arguments(policy, sessionFile, resuming), {
       cwd,
       detached: true,
       env: launchEnvironment(policy.packageRoot),
@@ -78,19 +80,19 @@ export class RpcProcess {
   get pid(): number | undefined {
     return this.child.pid;
   }
-  private arguments(policy: LaunchPolicy, sessionFile: string): string[] {
+  private arguments(policy: LaunchPolicy, sessionFile: string, resuming: boolean): string[] {
     const args = [
       policy.cli,
       "--mode",
       "rpc",
       "--session",
       sessionFile,
-      "--provider",
-      policy.provider,
-      "--model",
-      policy.model,
       policy.trustProject ? "--approve" : "--no-approve",
     ];
+    // Resume leaves native model/thinking restoration authoritative; never force the launch default.
+    if (!resuming && policy.provider !== undefined && policy.model !== undefined) {
+      args.push("--provider", policy.provider, "--model", policy.model);
+    }
     if (!policy.discoverResources) {
       args.push(
         "--no-extensions",
@@ -191,8 +193,12 @@ export class RpcProcess {
   private response(data: UnknownRecord): void {
     const pending = this.pending;
     this.pending = undefined;
-    if (data.success === true && data.command === "get_state" && isRecord(data.data)) {
-      pending?.resolve(data.data);
+    if (
+      data.success === true &&
+      data.command === pending?.command &&
+      (pending?.command !== "get_state" || isRecord(data.data))
+    ) {
+      pending?.resolve(isRecord(data.data) ? data.data : {});
     } else {
       pending?.reject(new Fault(503, "rpc_failed", "Pi RPC state request failed."));
     }
@@ -218,7 +224,7 @@ export class RpcProcess {
   }
   private write(
     command: Readonly<
-      | Extract<RpcCommand, { type: "get_state" }>
+      | Extract<RpcCommand, { type: "get_state" | "abort" }>
       | Extract<RpcExtensionUIResponse, { cancelled: true }>
     >,
   ): void {
@@ -228,14 +234,25 @@ export class RpcProcess {
       this.cleanup();
     }
   }
-  async state(signal: AbortSignal): Promise<UnknownRecord> {
+  private async command(
+    command: "get_state" | "abort",
+    signal: AbortSignal,
+  ): Promise<UnknownRecord> {
+    cancelled(signal);
     if (this.failure) {
       throw this.failure;
     }
-    const id = `state-${++this.sequence}`;
+    if (this.pending) {
+      throw new Fault(
+        409,
+        "control_in_progress",
+        "A native control operation is already in flight.",
+      );
+    }
+    const id = `control-${++this.sequence}`;
     const result = new Promise<UnknownRecord>((resolve, reject) => {
-      this.pending = { id, resolve, reject };
-      this.write({ type: "get_state", id });
+      this.pending = { id, command, resolve, reject };
+      this.write({ type: command, id });
     });
     try {
       return await wait(result, signal);
@@ -243,6 +260,26 @@ export class RpcProcess {
       this.pending = undefined;
     }
   }
+  async state(signal: AbortSignal): Promise<UnknownRecord> {
+    return this.command("get_state", signal);
+  }
+  async cancel(signal: AbortSignal): Promise<UnknownRecord> {
+    if (this.cancelling) {
+      throw new Fault(409, "control_in_progress", "Native cancellation is already in flight.");
+    }
+    this.cancelling = true;
+    try {
+      await this.command("abort", signal);
+      const state = await this.state(signal);
+      if (state.isStreaming !== false) {
+        throw new Fault(409, "cancel_unconfirmed", "Native Pi has not reached idle after abort.");
+      }
+      this.status = "idle";
+      return { isStreaming: false, pendingMessageCount: state.pendingMessageCount };
+    } finally {
+      this.cancelling = false;
+    }
+  }
   ready(): void {
     if (this.failure || this.exitObserved) {
       throw this.failure ?? new Fault(503, "session_exited", "Pi exited during startup.");

package/src/pi-intercom/bridge-session.ts

@@ -1,16 +1,17 @@
 import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
 import { IntercomClient } from "./broker/client.ts";
-import {
-  formatSessionTarget,
-  resolveSessionProjectId,
-  resolveSessionTarget,
-} from "./session-targets.ts";
+import { resolveSessionProjectId } from "./session-targets.ts";
 import type { Message, SendResult, SessionInfo } from "./types.ts";
 import type { Identity } from "./bridge-config.ts";
 import { Fault, cancelled, log, wait } from "./bridge-protocol.ts";
 import { Mailbox } from "./bridge-mailbox.ts";
 import type { UnknownRecord } from "../shared/unknown.ts";
 import type { MessagingOperation as Operation } from "./bridge-routes.ts";
+import type { RequestContext } from "./bridge-http.ts";
+import { resolveBridgeTarget, bridgeSessionList } from "./bridge-target.ts";
+import { ControlReplies } from "./bridge-control.ts";
+import type { NativeControlOperation } from "./native-control-protocol.ts";
 
 import { WaitingAsk } from "./bridge-ask.ts";
 const MAX_REQUESTS = 8;
@@ -18,19 +19,13 @@ const IDLE_TIMEOUT = 5 * 60 * 1000;
 const SEND_TIMEOUT = 8000;
 const LIST_TIMEOUT = 5000;
 
-interface RequestContext {
-  readonly signal: AbortSignal;
-  readonly requestId: string;
-  readonly onPeer: (peer: string) => void;
-}
-interface SendOptions {
+interface SendOptions extends Pick<Message, "replyTo" | "expectsReply" | "delivery"> {
   readonly messageId?: string;
-  readonly replyTo?: string;
-  readonly expectsReply?: boolean;
 }
 export interface SessionOwner {
   readonly stateDir?: string;
   readonly notifications?: boolean;
+  readonly mailboxChanged?: () => void;
   readonly allowed: (identity: Identity) => boolean;
   readonly lost: (fp: string, count?: number) => void;
   readonly retired: (fp: string, generation: string) => void;
@@ -48,8 +43,10 @@ export class Session {
   });
   private readonly requests = new Set<AbortController>();
   private readonly inbox: Mailbox;
+  private inboxChanged = new AbortController();
   private readonly replying = new Set<string>();
   private pending?: WaitingAsk;
+  private readonly controls = new ControlReplies();
   private closed = false;
   private connecting?: Promise<void>;
   private disconnecting?: Promise<void>;
@@ -80,12 +77,13 @@ export class Session {
   }
 
   guard(signal?: AbortSignal): void {
-    if (signal) {
-      cancelled(signal);
-    }
+    signal?.throwIfAborted();
     if (this.closed) {
       throw this.closeReason;
     }
+    this.authorize();
+  }
+  authorize(): void {
     if (!this.owner.allowed(this.identity)) {
       throw new Fault(403, "revoked", "Identity is no longer authorized.");
     }
@@ -197,21 +195,19 @@ export class Session {
     this.owner.retired(this.identity.fingerprint256, this.generation);
     log("session_closed", { ...this.fields(), result: this.closeReason.code });
   }
-  close(error: Readonly<Fault>): void {
+  close(fault: Readonly<Fault>): void {
     if (this.closed) {
       return;
     }
     this.closed = true;
-    this.closeReason = error;
+    this.closeReason = fault;
     clearTimeout(this.lease);
-    this.pending?.reject(error);
+    this.pending?.reject(fault);
+    this.controls.close(fault);
     for (const controller of this.requests) {
-      controller.abort(error);
+      controller.abort(fault);
     }
     // Retain the generation until acquisition/registration AND final disconnect settle.
-    this.startRetirement();
-  }
-  private startRetirement(): void {
     this.retirement = this.retire().catch((caught: unknown) => this.cleanupFailed(caught));
   }
   async settled(): Promise<void> {
@@ -219,6 +215,7 @@ export class Session {
   }
 
   private peerLeft(id: string): void {
+    this.controls.peerLeft(id);
     if (this.pending?.peer === id && !this.pending.settled) {
       this.pending.reject(
         new Fault(409, "peer_offline", "Ask recipient disconnected.", { id: this.pending.id }),
@@ -240,6 +237,9 @@ export class Session {
       );
       return;
     }
+    if (this.controls.receive(from.id, message)) {
+      return;
+    }
     if (!this.inbox.persistent && this.resolveReply(from, message)) {
       return;
     }
@@ -266,12 +266,22 @@ export class Session {
       );
       return;
     }
-    if (result === "lost" || (result === "duplicate" && !this.inbox.persistent)) {
-      this.owner.lost(this.identity.fingerprint256);
+    if (result !== "duplicate" || !this.inbox.persistent) {
+      if (result !== "stored") {
+        this.owner.lost(this.identity.fingerprint256);
+      }
+      this.inboxChanged.abort();
+      this.inboxChanged = new AbortController();
     }
-    this.recordReceive(from.id, message.id, result);
+    log(result === "lost" ? "inbox_overflow" : "received", {
+      ...this.fields(),
+      peer: from.id,
+      messageId: message.id,
+      result: result === "lost" && this.inbox.persistent ? "storage_failed" : result,
+    });
     if (result !== "lost") {
       this.resolveReply(from, message);
+      this.owner.mailboxChanged?.();
     }
     this.presence();
   }
@@ -283,18 +293,6 @@ export class Session {
     pending.resolve({ from, message });
     return true;
   }
-  private recordReceive(
-    peer: string,
-    messageId: string,
-    result: "stored" | "duplicate" | "lost",
-  ): void {
-    log(result === "lost" ? "inbox_overflow" : "received", {
-      ...this.fields(),
-      peer,
-      messageId,
-      result: result === "lost" && this.inbox.persistent ? "storage_failed" : result,
-    });
-  }
   private presence(): void {
     if (this.closed) {
       return;
@@ -320,29 +318,29 @@ export class Session {
     await this.connect(signal);
     return this.peers(signal);
   }
+  async nativeControl(
+    operation: NativeControlOperation,
+    certificate: string,
+    context: RequestContext,
+  ): Promise<UnknownRecord> {
+    await this.connect(context.signal);
+    const peer = await this.target(operation.to, context.signal);
+    return this.controls.request(
+      this.client,
+      { ...operation, peer: peer.id, certificate },
+      { ...context, guard: () => this.guard(context.signal) },
+    );
+  }
   private async target(to: string, signal: AbortSignal): Promise<SessionInfo> {
-    const resolution = resolveSessionTarget(await this.peers(signal), to);
-    if (resolution.status === "none") {
-      throw new Fault(404, "peer_offline", "Peer is not connected.");
-    }
-    if (resolution.status !== "found" || !resolution.target) {
-      throw new Fault(
-        409,
-        "ambiguous_target",
-        "Use an unambiguous peer name or session ID (prefixes need at least 8 characters).",
-      );
-    }
-    if (resolution.target.id === this.client.sessionId) {
-      throw new Fault(400, "self_target", "Choose another peer.");
-    }
-    return resolution.target;
+    return resolveBridgeTarget(await this.peers(signal), to, this.client.sessionId);
   }
-  private async send(
+  async send(
     peer: string,
     message: string,
     context: RequestContext,
     options: SendOptions = {},
   ): Promise<SendResult> {
+    await this.connect(context.signal);
     const { signal, requestId } = context;
     context.onPeer(peer);
     this.guard(signal);
@@ -392,22 +390,6 @@ export class Session {
     const waiting = new WaitingAsk();
     this.pending = waiting;
     const { signal } = context;
-    const abort = () => {
-      try {
-        cancelled(signal);
-      } catch (error) {
-        waiting.reject(
-          error instanceof Error
-            ? error
-            : new Fault(
-                499,
-                "client_aborted",
-                "HTTP client disconnected; delivery may be unknown.",
-              ),
-        );
-      }
-    };
-    signal.addEventListener("abort", abort, { once: true });
     try {
       await this.connect(signal);
       const peer = await this.target(operation.to, signal);
@@ -423,16 +405,39 @@ export class Session {
       return { ...waiting.receipt, replied: true, reply: answer };
     } finally {
       waiting.clear();
-      signal.removeEventListener("abort", abort);
-      if (this.pending === waiting) {
-        this.pending = undefined;
-      }
+      this.pending = undefined;
     }
   }
-  private ack(ids: readonly string[]): UnknownRecord {
-    const result = this.inbox.ack(ids);
-    this.presence();
-    return result;
+  private async readInbox(
+    operation: Extract<Operation, { readonly route: "GET /v1/inbox" }>,
+    context: RequestContext,
+  ): Promise<UnknownRecord> {
+    const read = (): ReturnType<Mailbox["page"]> & UnknownRecord => ({
+      ...this.inbox.page(operation.after, operation.limit),
+      ...this.inbox.status(this.owner.losses(this.identity.fingerprint256)),
+    });
+    const deadline = performance.now() + operation.waitMs;
+    const losses = read().lostMessages;
+    for (;;) {
+      // Subscribe to the post-commit signal before rereading the authoritative cursor page.
+      const signal = AbortSignal.any([this.inboxChanged.signal, context.signal]);
+      const page = read();
+      const remaining = deadline - performance.now();
+      if (page.messages.length > 0 || page.lostMessages !== losses || remaining <= 0) {
+        return page;
+      }
+      log("inbox_wait", { ...this.fields(), requestId: context.requestId, after: operation.after });
+      try {
+        // A nonmatching commit must rearm the same cursor, not start parallel readers.
+        // oxlint-disable-next-line no-await-in-loop
+        await delay(remaining, undefined, { signal });
+      } catch (error) {
+        if (!signal.aborted) {
+          throw error;
+        }
+      }
+      this.guard(context.signal);
+    }
   }
   private async answer(
     replyTo: string,
@@ -460,6 +465,7 @@ export class Session {
       }
       const data = { ...(await this.send(peer, message, context, { replyTo })) };
       this.inbox.remove(replyTo);
+      this.owner.mailboxChanged?.();
       this.presence();
       return data;
     } finally {
@@ -477,34 +483,30 @@ export class Session {
         await this.connect(context.signal);
       }
       if (operation.route === "POST /v1/ack") {
-        return this.ack(operation.ids);
+        const result = this.inbox.ack(operation.ids);
+        this.owner.mailboxChanged?.();
+        this.presence();
+        return result;
       }
-      return {
-        ...this.inbox.page(operation.after, operation.limit),
-        ...this.inbox.status(this.owner.losses(this.identity.fingerprint256)),
-      };
+      return this.readInbox(operation, context);
     }
     await this.connect(context.signal);
     switch (operation.route) {
       case "POST /v1/register":
         return { sessionId: this.client.sessionId, name: this.identity.name };
-      case "GET /v1/list": {
-        const sessions = await this.peers(context.signal);
+      case "GET /v1/list":
         return {
           sessionId: this.client.sessionId,
-          sessions: sessions.map(({ topics: _topics, subscriptions: _subscriptions, ...entry }) => {
-            return Object.assign(entry, { target: formatSessionTarget(entry, sessions) });
-          }),
+          sessions: bridgeSessionList(await this.peers(context.signal)),
         };
+      case "POST /v1/send": {
+        const peer = await this.target(operation.to, context.signal);
+        const receipt = await this.send(peer.id, operation.message, context, {
+          messageId: operation.messageId,
+          delivery: operation.passive === true ? "passive" : "steer",
+        });
+        return { ...receipt };
       }
-      case "POST /v1/send":
-        return {
-          ...(await this.send(
-            (await this.target(operation.to, context.signal)).id,
-            operation.message,
-            context,
-          )),
-        };
       case "POST /v1/reply":
         return this.answer(operation.replyTo, operation.message, context);
     }

package/src/pi-intercom/bridge-storage.ts

@@ -0,0 +1,83 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { isRecord } from "../shared/unknown.ts";
+import { label } from "./bridge-protocol.ts";
+
+export function stateDirectory(value: unknown): string | undefined {
+  if (value === undefined) {
+    return;
+  }
+  const path = label(value, "stateDir", 4096);
+  const stat = lstatSync(path);
+  if (
+    !isAbsolute(path) ||
+    !stat.isDirectory() ||
+    stat.uid !== process.getuid?.() ||
+    (stat.mode & 0o777) !== 0o700
+  ) {
+    throw new Error("stateDir must be an absolute owned directory with mode 0700, not a symlink.");
+  }
+  return realpathSync(path);
+}
+
+export function privateFile(path: string): void {
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const stat = fstatSync(fd);
+    if (
+      !stat.isFile() ||
+      stat.uid !== process.getuid?.() ||
+      (stat.mode & 0o777) !== 0o600 ||
+      stat.nlink !== 1
+    ) {
+      throw new Error("Storage files must be owned regular files with mode 0600 and one link.");
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+
+/** Native SQLite FULL commits own durability; never replace an unreadable existing database. */
+export function privateDatabase(
+  stateDir: string,
+  name: string,
+): { readonly db: DatabaseSync; readonly created: boolean } {
+  stateDirectory(stateDir);
+  const path = join(stateDir, name);
+  let created = false;
+  try {
+    const fd = openSync(
+      path,
+      constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,
+      0o600,
+    );
+    closeSync(fd);
+    created = true;
+  } catch (error) {
+    if (!isRecord(error) || error.code !== "EEXIST") {
+      throw error;
+    }
+  }
+  privateFile(path);
+  for (const suffix of ["-journal", "-wal", "-shm"]) {
+    try {
+      lstatSync(`${path}${suffix}`);
+    } catch (error) {
+      if (isRecord(error) && error.code === "ENOENT") {
+        continue;
+      }
+      throw error;
+    }
+    privateFile(`${path}${suffix}`);
+  }
+  const db = new DatabaseSync(path, { enableDoubleQuotedStringLiterals: false });
+  try {
+    db.exec(`PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA secure_delete=ON;
+      PRAGMA cache_size=-1024; PRAGMA busy_timeout=1000;`);
+    return { db, created };
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}

package/src/pi-intercom/bridge-target.ts

@@ -0,0 +1,35 @@
+import { resolveSessionTarget, formatSessionTarget, nativePeerId } from "./session-targets.ts";
+import { Fault } from "./bridge-protocol.ts";
+import type { SessionInfo } from "./types.ts";
+
+export function bridgeSessionList(
+  peers: readonly SessionInfo[],
+): readonly (SessionInfo & { readonly target: string })[] {
+  return peers.map(({ topics: _topics, subscriptions: _subscriptions, ...entry }) => ({
+    ...entry,
+    target: formatSessionTarget(entry, peers),
+  }));
+}
+
+export function resolveBridgeTarget(
+  peers: readonly SessionInfo[],
+  to: string,
+  self: string | null,
+): SessionInfo {
+  const exactNative = peers.find((peer) => peer.id === nativePeerId(to));
+  const resolution = resolveSessionTarget(peers, exactNative?.id ?? to);
+  if (resolution.status === "none") {
+    throw new Fault(404, "peer_offline", "Peer is not connected.");
+  }
+  if (resolution.status !== "found" || !resolution.target) {
+    throw new Fault(
+      409,
+      "ambiguous_target",
+      "Use an unambiguous peer name or session ID (prefixes need at least 8 characters).",
+    );
+  }
+  if (resolution.target.id === self) {
+    throw new Fault(400, "self_target", "Choose another peer.");
+  }
+  return resolution.target;
+}

package/src/pi-intercom/bridge-wake-owner.ts

@@ -0,0 +1,58 @@
+import { randomUUID } from "node:crypto";
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { privateDatabase, privateFile } from "./bridge-storage.ts";
+import { isRecord } from "../shared/unknown.ts";
+
+export const WAKE_OWNER_FILE = /^wake-owner-[0-9a-f-]{36}\.lock$/;
+
+/** SQLite's OS lock survives pauses and is released on exit, without PID reuse or stale leases. */
+export class WakeOwner {
+  readonly name = `wake-owner-${randomUUID()}.lock`;
+  private readonly db: DatabaseSync;
+  private readonly path: string;
+
+  constructor(stateDir: string) {
+    this.path = join(stateDir, this.name);
+    this.db = privateDatabase(stateDir, this.name).db;
+    try {
+      this.db.exec("BEGIN EXCLUSIVE");
+    } catch (error) {
+      this.db.close();
+      throw error;
+    }
+  }
+
+  close(): void {
+    this.db.close();
+    rmSync(this.path, { force: true });
+  }
+}
+
+export function stoppedWakeOwner(stateDir: string, name: string): boolean {
+  if (!WAKE_OWNER_FILE.test(name)) {
+    throw new Error("Invalid wake owner.");
+  }
+  const path = join(stateDir, name);
+  try {
+    privateFile(path);
+  } catch (error) {
+    if (isRecord(error) && error.code === "ENOENT") {
+      return true;
+    }
+    throw error;
+  }
+  const db = new DatabaseSync(path);
+  try {
+    db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE");
+    return true;
+  } catch (error) {
+    if (isRecord(error) && error.errcode === 5) {
+      return false;
+    }
+    throw error;
+  } finally {
+    db.close();
+  }
+}