@jmfederico/pi-web 1.202607.2 → 1.202608.0

package/dist/server/sessions/piSessionService.js

@@ -1,6 +1,6 @@
 import { statSync } from "node:fs";
 import { join } from "node:path";
-import { open, readFile, writeFile } from "node:fs/promises";
+import { readFile, stat, writeFile } from "node:fs/promises";
 import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEditToolDefinition, defineTool, readStoredCredential, SessionManager, } from "@earendil-works/pi-coding-agent";
 import { projectBrowserMessage } from "../browserMessageProjection.js";
 import { pageMessagesAtSafeBoundary } from "./messagePaging.js";
@@ -13,8 +13,16 @@ import { deterministicSessionName, fallbackSessionName, generateShortSessionName
 import { computeEditPreview } from "./editPreview.js";
 import { attachmentsToInlineImages, saveAttachmentsToWorkspace } from "./attachmentService.js";
 import { parsePromptAttachments } from "../../shared/promptAttachments.js";
-import { SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
+import { ASK_USER_ANSWERS_CUSTOM_TYPE, SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
+import { readSessionHeaderSummary } from "./sessionFileHeader.js";
+import { countOutOfListingChildren, locateOutOfListingParents } from "./parentSessionLocator.js";
+import { siblingWorkspaceCwds } from "../workspaces/projectWorkspaceCwds.js";
+import { createAskUserToolDefinition } from "./askUserTool.js";
+import { PendingAskStore, renderAskUserAnswersText } from "./pendingAskStore.js";
+import { PendingExtensionDialogStore } from "./pendingExtensionDialogStore.js";
+import { ExtensionDialogWaiters, effectiveExtensionDialogTimeoutMs, extensionDialogCancelValue } from "./extensionDialogWaiters.js";
+import { DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS } from "../../config.js";
 import { createSpawnSessionToolDefinition } from "./spawnSessionTool.js";
 import { createSubsessionToolDefinitions } from "./spawnSubsessionTool.js";
 import { buildTranscriptView } from "./subsessionTranscript.js";
@@ -24,6 +32,20 @@ import { plainTextTheme } from "./plainTextTheme.js";
 import { SessionUnreadStore } from "./sessionUnreadStore.js";
 const noopLogger = { info() { } };
 const DEFAULT_UNREAD_PUBLICATION_RETRY_MS = 1_000;
+/**
+ * User-facing names for the two phases of session startup PI WEB can prove it
+ * is inside: it awaits exactly one call for each, so the phase is a fact rather
+ * than a guess. Deliberately free of internal symbol names and file paths.
+ */
+const STARTUP_PHASE_RUNTIME = "Starting the Pi session";
+const STARTUP_PHASE_EXTENSIONS = "Loading session extensions";
+/**
+ * Appended to whichever phase is running when a background provider catalog
+ * refresh happens to be in flight. It is stated as a concurrent fact, never as
+ * the cause: PI WEB can verify that a refresh is running, but not that this
+ * particular startup is waiting on it.
+ */
+const STARTUP_CONCURRENT_CATALOG_REFRESH = "provider model lists are refreshing";
 const MAX_UNREAD_PUBLICATION_RETRY_MS = 30_000;
 const MAX_PENDING_UNREAD_MUTATIONS = SESSION_UNREAD_LIMIT + 1;
 function noop() {
@@ -34,17 +56,36 @@ function spawnTargetError(decision) {
         return new Error("Spawning session is not in a registered project");
     return new Error(`cwd must be a workspace of this project. Allowed: ${decision.allowedCwds.join(", ")}`);
 }
+function modelSpecOf(model) {
+    return `${model.provider}/${model.id}`;
+}
+/**
+ * Parse a strict `provider/model-id` spec: split on the first `/` (model ids
+ * may themselves contain `/`) and require both parts to be non-empty.
+ */
+function parseModelSpec(spec) {
+    const slash = spec.indexOf("/");
+    if (slash <= 0 || slash === spec.length - 1)
+        return undefined;
+    return { provider: spec.slice(0, slash), modelId: spec.slice(slash + 1) };
+}
+/**
+ * Error for a spawn-tool model spec that matched nothing. States the facts —
+ * the bad spec and the required format — with deliberately no model list
+ * (a list would invite guesses). The agent loop turns the throw into an
+ * error tool result; how to recover is the agent's call.
+ */
+function unknownSpawnModelError(modelSpec) {
+    return new Error(`Unknown model "${modelSpec}". Pass an exact "provider/model-id".`);
+}
 function authLossWarningKey(sessionId, provider, modelId) {
     return `${sessionId}:${provider}/${modelId}`;
 }
-function sessionIdFromLookup(ref) {
-    return typeof ref === "string" ? ref : ref.id;
-}
-function isPiSessionRef(ref) {
-    return typeof ref !== "string";
+function refMatchesActiveSession(ref, active) {
+    return cwdPathsEqual(active.runtime.cwd, ref.cwd);
 }
-function lookupMatchesActiveSession(ref, active) {
-    return !isPiSessionRef(ref) || cwdPathsEqual(active.runtime.cwd, ref.cwd);
+function refMatchesStartupSession(ref, session) {
+    return cwdPathsEqual(session.sessionManager.getCwd(), ref.cwd);
 }
 function sessionTreeNavigationOptions(request) {
     switch (request.summary.mode) {
@@ -195,49 +236,58 @@ export function dismissSessionWarning(session, dismissId) {
 function defaultCreateAgentRuntime(createRuntime, options) {
     if (!(options.sessionManager instanceof SessionManager))
         throw new Error("Default runtime creation requires an SDK SessionManager");
-    const runtimeFactory = createRuntimeWithOneShotSessionOptions(createRuntime, options.initialModel, options.delegationToolsEnabled);
+    const runtimeFactory = createRuntimeWithOneShotSessionOptions(createRuntime, options.initialModel, options.initialThinkingLevel, options.delegationToolsEnabled);
     return createAgentSessionRuntime(runtimeFactory, {
         cwd: options.cwd,
         agentDir: options.agentDir,
         sessionManager: options.sessionManager,
     });
 }
-function createRuntimeWithOneShotSessionOptions(createRuntime, initialModel, delegationToolsEnabled) {
+function createRuntimeWithOneShotSessionOptions(createRuntime, initialModel, initialThinkingLevel, delegationToolsEnabled) {
     // These inputs belong only to the session being opened. A later runtime
-    // replacement resolves its own model and delegation capability.
+    // replacement resolves its own model and delegation capability, and restores
+    // the thinking level from the existing session file.
     let pendingInitialModel = initialModel;
+    let pendingInitialThinkingLevel = initialThinkingLevel;
     let pendingDelegationToolsEnabled = delegationToolsEnabled;
     return async (options) => {
         const model = pendingInitialModel;
+        const thinkingLevel = pendingInitialThinkingLevel;
         const toolsEnabled = pendingDelegationToolsEnabled;
         pendingInitialModel = undefined;
+        pendingInitialThinkingLevel = undefined;
         pendingDelegationToolsEnabled = undefined;
         return createRuntime({
             ...options,
             ...(model === undefined ? {} : { initialModel: model }),
+            ...(thinkingLevel === undefined ? {} : { initialThinkingLevel: thinkingLevel }),
             ...(toolsEnabled === undefined ? {} : { delegationToolsEnabled: toolsEnabled }),
         });
     };
 }
-export function createPiWebCustomToolDefinitions(cwd, delegationEnabled, spawn, subsessions) {
+export function createPiWebCustomToolDefinitions(cwd, delegationEnabled, spawn, subsessions, askUser) {
     return [
         createPiWebEditToolDefinition(cwd),
         ...(delegationEnabled && spawn !== undefined ? [createSpawnSessionToolDefinition(cwd, { spawn })] : []),
         ...(delegationEnabled && subsessions !== undefined ? createSubsessionToolDefinitions(cwd, subsessions) : []),
+        // Asking the user is not delegation: the questions land in the session the
+        // user is already watching, so tracked children may ask too.
+        ...(askUser === undefined ? [] : [createAskUserToolDefinition(askUser)]),
     ];
 }
-function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions) {
-    return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, delegationToolsEnabled }) => {
+function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions, askUser) {
+    return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled }) => {
         const services = await createAgentSessionServices({ cwd, agentDir, modelRuntime });
         const resolvedDelegationToolsEnabled = delegationToolsEnabled
             ?? await sessionAllowsDelegationTools(sessionManager, sessionManagers);
-        const customTools = createPiWebCustomToolDefinitions(cwd, resolvedDelegationToolsEnabled, spawn, subsessions);
+        const customTools = createPiWebCustomToolDefinitions(cwd, resolvedDelegationToolsEnabled, spawn, subsessions, askUser);
         const result = await createAgentSessionFromServices({
             services,
             sessionManager,
             customTools,
             ...(sessionStartEvent === undefined ? {} : { sessionStartEvent }),
             ...(initialModel === undefined ? {} : { model: initialModel }),
+            ...(initialThinkingLevel === undefined ? {} : { thinkingLevel: initialThinkingLevel }),
         });
         return { ...result, services, diagnostics: services.diagnostics };
     };
@@ -268,6 +318,14 @@ export class PiSessionService {
         this.events = events;
         this.active = new Map();
         this.pendingSessionOpens = new Map();
+        /**
+         * Sessions whose extension binding is still in flight. A `session_start`
+         * dialog parks that window before the session ever becomes active, so this
+         * is the only way the dialog answer/cancel and status paths can reach it;
+         * {@link getOrOpen} never consults it, keeping every other operation gated
+         * on full readiness.
+         */
+        this.startupSessions = new Map();
         this.activities = new Map();
         /** Runtime-identity gate held while Pi may await abandoned-branch summarization. */
         this.treeNavigations = new WeakSet();
@@ -289,6 +347,13 @@ export class PiSessionService {
         this.subsessionLinks = new Map();
         /** Parent id/file identities whose persisted links have already been loaded. */
         this.subsessionHydratedParents = new Set();
+        /**
+         * Session file path -> its parsed header and the file identity at read
+         * time. Headers are written once, so identity-verified reads are cached.
+         */
+        this.sessionHeaderCache = new Map();
+        /** Session file path -> its in-flight header read, so concurrent scans share one read per file. */
+        this.pendingSessionHeaderReads = new Map();
         /**
          * Tracked subsession id -> whether a completion notification is armed.
          * Armed when the child starts working; firing on completion disarms it so a
@@ -296,18 +361,48 @@ export class PiSessionService {
          */
         this.subsessionNotifyArmed = new Map();
         this.notificationGenerationBySession = new WeakMap();
+        /** The parked extension Promise resolvers behind the store's open dialogs. */
+        this.dialogWaiters = new ExtensionDialogWaiters();
         this.pendingUnreadMutations = [];
         this.unreadPublicationFlushRequested = false;
         this.unreadPublicationStopped = false;
+        /**
+         * Read a session file header, memoized per path, with one in-flight read
+         * per path: concurrent scans of a shared session directory share the read
+         * instead of each opening the file. Pi writes the header once at session
+         * creation, so a successful read stays valid as long as the path still
+         * holds the same file: every hit re-checks the file's identity (dev/ino),
+         * and a replacement landed at a cached path is re-read instead of serving
+         * the previous file's header — the summary scanner detects such
+         * replacements, so the listing and the header reads must agree. The one
+         * thing identity cannot detect is an in-place rewrite that keeps the
+         * inode; detach, the only such writer, deletes the entry itself. Failures
+         * are not cached so a session file that appears later is picked up.
+         */
+        this.readCachedSessionHeader = (sessionFile) => {
+            const pending = this.pendingSessionHeaderReads.get(sessionFile);
+            if (pending !== undefined)
+                return pending;
+            const read = this.loadSessionHeader(sessionFile).finally(() => {
+                this.pendingSessionHeaderReads.delete(sessionFile);
+            });
+            this.pendingSessionHeaderReads.set(sessionFile, read);
+            return read;
+        };
         this.archiveStore = deps.archiveStore ?? new SessionArchiveStore();
         this.agentDir = deps.agentDir;
         this.sessionManager = deps.sessionManager;
         this.modelRuntime = deps.modelRuntime;
         this.spawnTargets = deps.spawnTargets;
+        this.projectWorkspaces = deps.projectWorkspaces;
         this.logger = deps.logger ?? noopLogger;
         this.now = deps.now ?? (() => new Date());
         this.notificationStore = deps.notificationStore ?? new SessionNotificationStore();
         this.unreadStore = deps.unreadStore ?? new SessionUnreadStore();
+        this.pendingAskStore = deps.pendingAskStore ?? new PendingAskStore();
+        this.pendingExtensionDialogStore = deps.pendingExtensionDialogStore ?? new PendingExtensionDialogStore();
+        this.extensionDialogsTimeoutMs = deps.extensionDialogsTimeoutMs ?? DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS;
+        this.catalogRefreshStatus = deps.catalogRefreshStatus;
         this.unreadPublicationRetryInitialMs = Math.max(0, deps.unreadPublicationRetryDelayMs ?? DEFAULT_UNREAD_PUBLICATION_RETRY_MS);
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
         // Subsessions are a beta capability gated behind their own flag, and they
@@ -318,11 +413,11 @@ export class PiSessionService {
             list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
             check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
             read: (parentSessionId, sessionId, query, parentSessionFile) => this.readSubsession(parentSessionId, sessionId, query, parentSessionFile),
-        });
+        }, deps.askUserEnabled === true ? { open: (input) => this.openAsk(input) } : undefined);
         this.createAgentRuntime = deps.createAgentRuntime ?? defaultCreateAgentRuntime;
         this.workspaceActivity = deps.workspaceActivity;
         this.heartbeat = setInterval(() => { this.publishHeartbeats(); }, deps.heartbeatIntervalMs ?? 2000);
-        this.commandService = new SessionCommandService((sessionId) => this.getActive(sessionId), (sessionId, text) => this.prompt(sessionId, text, undefined, undefined, { echoUserMessage: false }), events, {
+        this.commandService = new SessionCommandService((sessionId) => this.getActive(this.activeSessionRef(sessionId)), (sessionId, text) => this.prompt(this.activeSessionRef(sessionId), text, undefined, undefined, { echoUserMessage: false }), events, {
             onCompactionStart: (session) => {
                 this.beginSessionEntryMutation(session, "compact the session");
                 this.publishActivity(session, "compacting", "active");
@@ -406,7 +501,6 @@ export class PiSessionService {
             await this.closeActive(record.sessionId, { kind: "clear", reason: "delete" });
             readyDeleteRecords.push(record);
         }
-        await this.ensureArchivedRecordsMoved(readyDeleteRecords);
         const deletedSessionIds = new Set(await this.archiveStoreDeleteArchivedMany(readyDeleteRecords.map((record) => record.sessionId)));
         deleteRecords.push(...readyDeleteRecords.filter((record) => deletedSessionIds.has(record.sessionId)));
         await this.forgetUnreadSessions(deleteRecords);
@@ -423,14 +517,22 @@ export class PiSessionService {
         this.clearUnreadPublicationRetry();
         clearInterval(this.heartbeat);
         this.clearCompactionDrainTimers();
+        // Same startup-park hazard as closeActive(): settle `session_start` dialogs
+        // of sessions still binding extensions before awaiting their pending opens.
+        for (const sessionId of this.startupSessions.keys())
+            this.endSessionExtensionDialogs(sessionId);
         const pendingOpens = this.pendingSessionOpenPromises();
         if (pendingOpens.length > 0)
             await Promise.allSettled(pendingOpens);
         const activeSessions = Array.from(new Set(this.active.values()));
-        for (const active of activeSessions)
+        for (const active of activeSessions) {
             this.forgetUnreadActivity(active.runtime.session);
+            this.pendingAskStore.forgetSession(active.runtime.session.sessionId);
+            this.endSessionExtensionDialogs(active.runtime.session.sessionId);
+        }
         this.active.clear();
         this.pendingSessionOpens.clear();
+        this.startupSessions.clear();
         this.activities.clear();
         this.compactionPromptQueues.clear();
         this.authLossWarnings.clear();
@@ -439,6 +541,8 @@ export class PiSessionService {
         this.subsessionLinks.clear();
         this.subsessionHydratedParents.clear();
         this.subsessionNotifyArmed.clear();
+        this.sessionHeaderCache.clear();
+        this.pendingSessionHeaderReads.clear();
         this.notificationStore.clearAll("service-dispose");
         await Promise.all(activeSessions.map(async (active) => {
             active.unsubscribe();
@@ -456,9 +560,7 @@ export class PiSessionService {
     async list(cwd) {
         const [sessions, archivedRecords] = await Promise.all([this.sessionManager.list(cwd), this.archiveStore.list()]);
         const sessionsById = new Map(sessions.map((session) => [session.id, session]));
-        const archivedForCwd = await Promise.all(archivedRecords
-            .filter((record) => record.cwd === cwd)
-            .map((record) => this.ensureArchivedSessionMoved(record, sessionsById.get(record.sessionId))));
+        const archivedForCwd = archivedRecords.filter((record) => record.cwd === cwd);
         const archivedById = new Map(archivedForCwd.map((record) => [record.sessionId, record]));
         for (const record of archivedForCwd) {
             this.publishNotificationMutations(this.notificationStore.clearSession(record.sessionId, "archive-reconcile"));
@@ -471,14 +573,93 @@ export class PiSessionService {
             .sort(compareArchivedRecords)
             .map((record) => clientSessionFromArchivedRecord(record, sessionsById.get(record.sessionId)))
             .filter(isDefined);
-        return [...unarchivedSessions, ...archivedSessions];
+        return await this.withRelatedSessionsElsewhere([...unarchivedSessions, ...archivedSessions], cwd);
+    }
+    /**
+     * Annotate a listing with the session relationships that cross workspace
+     * boundaries: where an out-of-listing parent lives, and how many children a
+     * listed session has in sibling workspaces.
+     *
+     * Both directions are best-effort. An unreadable parent header or a sibling
+     * workspace that cannot be listed leaves the session unannotated rather than
+     * failing the listing, and the browser falls back to its generic states.
+     */
+    async withRelatedSessionsElsewhere(sessions, cwd) {
+        const [parentLocations, childCounts] = await Promise.all([
+            locateOutOfListingParents(sessions, cwd, this.readCachedSessionHeader),
+            this.countChildrenInSiblingWorkspaces(sessions, cwd),
+        ]);
+        return sessions.map((session) => {
+            const parent = session.parentSessionPath === undefined ? undefined : parentLocations.get(session.parentSessionPath);
+            const childrenElsewhere = childCounts.get(session.path);
+            if (parent === undefined && childrenElsewhere === undefined)
+                return session;
+            const annotated = { ...session };
+            if (parent !== undefined) {
+                annotated.parentSessionId = parent.parentSessionId;
+                annotated.parentSessionCwd = parent.parentSessionCwd;
+            }
+            if (childrenElsewhere !== undefined)
+                annotated.childSessionsElsewhere = childrenElsewhere;
+            return annotated;
+        });
+    }
+    /**
+     * Count children of the listed sessions that live in other workspaces of the
+     * same project.
+     *
+     * Only sibling workspaces are scanned: agents may only spawn into workspaces
+     * of the spawning session's own project, so that bounds where a child can be.
+     * Each sibling scan reads only the header line of every session file (the
+     * only place `parentSessionPath` is recorded), never the transcripts. Listing
+     * is skipped entirely when no project-workspace locator is configured or the
+     * cwd belongs to no registered project.
+     */
+    async countChildrenInSiblingWorkspaces(sessions, cwd) {
+        if (this.projectWorkspaces === undefined || sessions.length === 0)
+            return new Map();
+        try {
+            const siblingCwds = await siblingWorkspaceCwds(this.projectWorkspaces, cwd);
+            if (siblingCwds.length === 0)
+                return new Map();
+            const listings = await Promise.all(siblingCwds.map((siblingCwd) => this.sessionManager.listParentSessionPaths(siblingCwd, this.readCachedSessionHeader)));
+            return countOutOfListingChildren(sessions, listings.flat());
+        }
+        catch (error) {
+            this.logger.info({ cwd, error: error instanceof Error ? error.message : String(error) }, "failed to count child sessions in sibling workspaces");
+            return new Map();
+        }
+    }
+    async loadSessionHeader(sessionFile) {
+        let stats;
+        try {
+            stats = await stat(sessionFile);
+        }
+        catch {
+            // Gone or unreadable: report no header and forget any cached entry.
+            this.sessionHeaderCache.delete(sessionFile);
+            return undefined;
+        }
+        const cached = this.sessionHeaderCache.get(sessionFile);
+        if (cached?.dev === stats.dev && cached.ino === stats.ino)
+            return cached.header;
+        const header = await readSessionHeaderSummary(sessionFile);
+        if (header === undefined) {
+            this.sessionHeaderCache.delete(sessionFile);
+            return undefined;
+        }
+        this.sessionHeaderCache.set(sessionFile, { header, dev: stats.dev, ino: stats.ino });
+        return header;
     }
     async start(cwd, options = {}) {
         return this.startSession(cwd, options);
     }
     async startSession(cwd, options) {
         const active = await this.create(this.sessionManager.create(cwd, options.parentSession === undefined ? undefined : { parentSession: options.parentSession }), cwd, {
+            startupIntent: "create",
+            ...(options.startupToken === undefined ? {} : { startupToken: options.startupToken }),
             ...(options.initialModel === undefined ? {} : { initialModel: options.initialModel }),
+            ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
             ...(options.creationProvenance === undefined ? {} : { creationProvenance: options.creationProvenance }),
         });
         const { session } = active.runtime;
@@ -511,10 +692,23 @@ export class PiSessionService {
         const decision = await this.spawnTargets.resolveSpawnTarget(input.spawningCwd, input.cwd);
         if (!decision.allowed)
             throw spawnTargetError(decision);
-        const created = await this.start(decision.cwd, input.model === undefined ? {} : { initialModel: input.model });
-        await this.prompt(created.id, input.prompt);
+        // A model spec overrides the inherited model. Only a spec resolves
+        // against the spawning session; the default path must not depend on it.
+        const model = input.modelSpec === undefined
+            ? input.model
+            : await this.resolveSpawnModel({ id: input.spawningSessionId, cwd: input.spawningCwd }, input.modelSpec);
+        const created = await this.start(decision.cwd, {
+            ...(model === undefined ? {} : { initialModel: model }),
+            ...(input.thinkingLevel === undefined ? {} : { initialThinkingLevel: input.thinkingLevel }),
+        });
+        const modelUsed = this.active.get(created.id)?.runtime.session.model;
+        await this.prompt(created, input.prompt);
         this.logger.info({ spawningCwd: input.spawningCwd, sessionId: created.id, cwd: decision.cwd, promptLength: input.prompt.length }, "spawn_session started a new session");
-        return { sessionId: created.id, cwd: decision.cwd };
+        return {
+            sessionId: created.id,
+            cwd: decision.cwd,
+            ...(modelUsed === undefined ? {} : { model: modelSpecOf(modelUsed) }),
+        };
     }
     /**
      * Start a *tracked* child session on behalf of a LLM. Identical to
@@ -528,11 +722,18 @@ export class PiSessionService {
         const decision = await this.spawnTargets.resolveSpawnTarget(input.spawningCwd, input.cwd);
         if (!decision.allowed)
             throw spawnTargetError(decision);
+        // A model spec overrides the inherited model and is resolved against the
+        // parent's model runtime; only a spec resolves against the parent.
+        const model = input.modelSpec === undefined
+            ? input.model
+            : await this.resolveSpawnModel({ id: input.parentSessionId, cwd: input.spawningCwd }, input.modelSpec);
         const created = await this.startSession(decision.cwd, {
             ...(input.parentSessionFile === undefined ? {} : { parentSession: input.parentSessionFile }),
-            ...(input.model === undefined ? {} : { initialModel: input.model }),
+            ...(model === undefined ? {} : { initialModel: model }),
+            ...(input.thinkingLevel === undefined ? {} : { initialThinkingLevel: input.thinkingLevel }),
             creationProvenance: "tracked-subsession",
         });
+        const modelUsed = this.active.get(created.id)?.runtime.session.model;
         const parentSessionFile = nonEmptyString(input.parentSessionFile);
         const link = {
             parentSessionId: input.parentSessionId,
@@ -544,9 +745,254 @@ export class PiSessionService {
         await this.registerVerifiedSubsession(link);
         this.persistSubsessionLink(link);
         this.persistSubsessionChildMarker(input.parentSessionId, created.id);
-        await this.prompt(created.id, input.prompt);
+        await this.prompt(created, input.prompt);
         this.logger.info({ parentSessionId: input.parentSessionId, sessionId: created.id, cwd: decision.cwd, promptLength: input.prompt.length }, "spawn_subsession started a tracked child session");
-        return { sessionId: created.id, cwd: decision.cwd };
+        return {
+            sessionId: created.id,
+            cwd: decision.cwd,
+            ...(modelUsed === undefined ? {} : { model: modelSpecOf(modelUsed) }),
+        };
+    }
+    /**
+     * The models a session may pick from: its scoped set when model-scoped,
+     * otherwise the runtime's available snapshot. Refreshes the runtime catalog
+     * first so callers see newly configured providers and models.
+     */
+    async sessionModelCandidates(session) {
+        await session.modelRuntime.refresh();
+        return session.scopedModels.length > 0
+            ? session.scopedModels.map((scoped) => scoped.model)
+            : session.modelRuntime.getAvailableSnapshot();
+    }
+    /**
+     * Resolve a strict `provider/model-id` spec from a spawn tool against the
+     * *spawning* session's model runtime, using the same candidates
+     * {@link setModel} offers plus a direct runtime lookup as fallback. Unknown
+     * or malformed specs throw; the agent loop turns that into an error tool
+     * result the spawning agent can retry from.
+     */
+    async resolveSpawnModel(spawningRef, modelSpec) {
+        const session = await this.getOrOpen(spawningRef);
+        const parsed = parseModelSpec(modelSpec);
+        const candidates = await this.sessionModelCandidates(session);
+        const model = parsed === undefined
+            ? undefined
+            : candidates.find((candidate) => candidate.provider === parsed.provider && candidate.id === parsed.modelId)
+                ?? session.modelRuntime.getModel(parsed.provider, parsed.modelId);
+        if (model === undefined)
+            throw unknownSpawnModelError(modelSpec);
+        return model;
+    }
+    /**
+     * Register the question set an agent wants the user to answer as the session's
+     * open ask. Deliberately does not wait for the user: `ask_user` terminates the
+     * run and the submitted answers come back later as a follow-up message.
+     *
+     * Rejected question sets throw {@link PendingAskValidationError}, which the
+     * agent loop reports to the model as an error tool result.
+     */
+    // eslint-disable-next-line @typescript-eslint/require-await -- async so a rejected question set becomes a rejection rather than a synchronous throw from a promise-returning method.
+    async openAsk(input) {
+        const result = this.pendingAskStore.open(input);
+        // A supersede closes the earlier ask, so the browsers watching it must hear
+        // that before they hear about its replacement.
+        if (result.superseded !== undefined)
+            this.publishAskClosed(input.sessionId, result.superseded);
+        this.events.publish(input.sessionId, { type: "ask.opened", ask: result.ask });
+        this.publishStatusForSessionId(input.sessionId);
+        return result;
+    }
+    /**
+     * Record the user's answers to the session's open ask and hand them to the
+     * model. The answers travel as a system-authored custom message rather than a
+     * user message, so they are not attributed to the human in the transcript;
+     * they still wake an idle session (`triggerTurn`) and queue behind in-flight
+     * work (`deliverAs: "followUp"`), which is how the run that `ask_user`
+     * terminated continues.
+     */
+    async submitAsk(ref, askId, submission) {
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        // Checked before the store closes the ask so a refused delivery cannot
+        // discard answers the user already submitted.
+        this.assertTreeNavigationInactive(session, "answer questions");
+        return this.closeAsk(session, this.pendingAskStore.submit(session.sessionId, askId, submission));
+    }
+    /**
+     * Close the open ask without answers. The model is still told, naming every
+     * question as unanswered: it was promised a follow-up message and would
+     * otherwise wait for one that never comes.
+     */
+    async cancelAsk(ref, askId) {
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        this.assertTreeNavigationInactive(session, "dismiss questions");
+        return this.closeAsk(session, this.pendingAskStore.cancel(session.sessionId, askId));
+    }
+    /**
+     * Publish and deliver a closed ask. A stale close is reported rather than
+     * thrown: losing the race against a supersede, another browser, or a session
+     * that went away is ordinary, and the returned status tells the browser what
+     * the session's open ask is now.
+     */
+    async closeAsk(session, result) {
+        if (result.status === "stale")
+            return { result: "stale", sessionStatus: this.statusFromSession(session) };
+        const { outcome } = result;
+        this.publishAskClosed(session.sessionId, outcome);
+        await this.runSessionEntryMutation(session, "deliver answers to your questions", () => session.sendCustomMessage({ customType: ASK_USER_ANSWERS_CUSTOM_TYPE, content: renderAskUserAnswersText(outcome), display: true, details: outcome }, { triggerTurn: true, deliverAs: "followUp" }));
+        this.publishStatus(session);
+        return { result: "closed", outcome, sessionStatus: this.statusFromSession(session) };
+    }
+    publishAskClosed(sessionId, outcome) {
+        this.events.publish(sessionId, { type: "ask.closed", askId: outcome.askId, reason: outcome.reason });
+    }
+    /**
+     * Void the session's open ask because the user sent a chat message instead of
+     * answering it. Every browser closes the card as cancelled, and the model is
+     * told — without being woken — so the notice rides into the turn the message
+     * itself triggers rather than becoming a turn of its own.
+     */
+    async voidOpenAskForUserMessage(session) {
+        const outcome = this.pendingAskStore.cancelOpen(session.sessionId);
+        if (outcome === undefined)
+            return;
+        this.publishAskClosed(session.sessionId, outcome);
+        await this.runSessionEntryMutation(session, "void the open questions", () => session.sendCustomMessage({ customType: ASK_USER_ANSWERS_CUSTOM_TYPE, content: renderAskUserAnswersText(outcome), display: true, details: outcome }, { triggerTurn: false, deliverAs: "followUp" }));
+        this.publishStatus(session);
+    }
+    /**
+     * Record the user's answer to an open extension dialog and resolve the
+     * extension's parked Promise with it. Unlike an ask, nothing is delivered to
+     * the model: the waiter is extension code inside an already in-flight run
+     * (or an idle handler), so no custom message and no turn are triggered.
+     */
+    async answerDialog(ref, dialogId, value) {
+        await this.assertWritable(ref);
+        const session = await this.sessionForStatusOrDialogClose(ref);
+        const result = this.pendingExtensionDialogStore.answer(session.sessionId, dialogId, value);
+        if (result.status === "stale")
+            return { result: "stale", sessionStatus: this.statusFromSession(session) };
+        const { outcome } = result;
+        this.publishDialogClosed(session.sessionId, outcome);
+        // `value` is what the store validated and recorded as the outcome's answer.
+        this.dialogWaiters.settleWithAnswer(dialogId, value);
+        this.publishStatus(session);
+        return { result: "closed", outcome, sessionStatus: this.statusFromSession(session) };
+    }
+    /** Close an open extension dialog without an answer; the extension's wait settles with its kind's cancel value. */
+    async cancelDialog(ref, dialogId) {
+        await this.assertWritable(ref);
+        const session = await this.sessionForStatusOrDialogClose(ref);
+        const result = this.pendingExtensionDialogStore.cancel(session.sessionId, dialogId, "cancelled");
+        if (result.status === "stale")
+            return { result: "stale", sessionStatus: this.statusFromSession(session) };
+        const { outcome } = result;
+        this.publishDialogClosed(session.sessionId, outcome);
+        this.dialogWaiters.settleWithCancelValue(dialogId);
+        this.publishStatus(session);
+        return { result: "closed", outcome, sessionStatus: this.statusFromSession(session) };
+    }
+    /**
+     * Implement one `ctx.ui.select()`/`confirm()`/`input()` call from extension
+     * code: open the store record, tell the browsers, and park a Promise that
+     * settles when the browser answers or cancels, the extension's own
+     * `signal`/`timeout` dismisses the dialog, the daemon default timeout
+     * elapses, or the runtime goes away. `store.open` validates the dialog, so a
+     * malformed one rejects the extension's call rather than rendering garbage.
+     * `async` so a rejected dialog becomes a rejection rather than a synchronous
+     * throw from a promise-returning method.
+     */
+    async openExtensionDialog(session, request, opts) {
+        const signal = opts?.signal;
+        // A pre-aborted signal dismisses the dialog before it ever opens.
+        if (signal?.aborted === true)
+            return extensionDialogCancelValue(request.kind);
+        const timeoutMs = effectiveExtensionDialogTimeoutMs(opts?.timeout, this.extensionDialogsTimeoutMs);
+        const dialog = this.pendingExtensionDialogStore.open({
+            sessionId: session.sessionId,
+            kind: request.kind,
+            title: request.title,
+            ...(request.message === undefined ? {} : { message: request.message }),
+            ...(request.options === undefined ? {} : { options: request.options }),
+            ...(request.placeholder === undefined ? {} : { placeholder: request.placeholder }),
+            ...(timeoutMs === undefined ? {} : { timeoutMs }),
+            runScoped: session.isStreaming,
+        });
+        this.events.publish(session.sessionId, { type: "dialog.opened", dialog });
+        this.publishStatus(session);
+        return this.dialogWaiters.park(dialog, {
+            ...(timeoutMs === undefined ? {} : { timeoutMs }),
+            ...(signal === undefined ? {} : { signal }),
+            onTrigger: (reason) => {
+                if (this.closeExtensionDialogFromTrigger(session.sessionId, dialog.dialogId, reason))
+                    this.publishStatusForSessionId(session.sessionId);
+            },
+        });
+    }
+    /**
+     * Close a dialog whose wait ended without the browser (timeout, signal
+     * abort, run end, runtime teardown) and settle its parked Promise. Returns
+     * whether this call closed the dialog; a stale close means a browser answer
+     * or an earlier trigger already settled everything.
+     */
+    closeExtensionDialogFromTrigger(sessionId, dialogId, reason) {
+        const result = this.pendingExtensionDialogStore.cancel(sessionId, dialogId, reason);
+        if (result.status !== "closed")
+            return false;
+        this.publishDialogClosed(sessionId, result.outcome);
+        this.dialogWaiters.settleWithCancelValue(dialogId);
+        return true;
+    }
+    /**
+     * Settle the session's run-scoped dialogs as `"aborted"`. Runs at
+     * abort-request time (a user abort parks the agent loop behind the dialog
+     * handler, so `agent_end` would never arrive on its own) and again from
+     * the `agent_end` observer as the run-crash backstop — the store makes the
+     * second settlement a stale no-op. Idle-opened dialogs (a `session_start`
+     * probe, say) are not run-scoped and survive, because their waiter
+     * outlives the run.
+     */
+    abortRunScopedExtensionDialogs(sessionId) {
+        let closedAny = false;
+        for (const dialog of this.pendingExtensionDialogStore.pendingDialogs(sessionId)) {
+            if (dialog.runScoped)
+                closedAny = this.closeExtensionDialogFromTrigger(sessionId, dialog.dialogId, "aborted") || closedAny;
+        }
+        if (closedAny)
+            this.publishStatusForSessionId(sessionId);
+    }
+    /**
+     * Settle every dialog of the session as `"session-ended"`: the runtime
+     * whose extension code is parked on them is being closed, replaced, or
+     * disposed, so those Promises would otherwise never settle.
+     */
+    endSessionExtensionDialogs(sessionId) {
+        let closedAny = false;
+        for (const dialog of this.pendingExtensionDialogStore.pendingDialogs(sessionId)) {
+            closedAny = this.closeExtensionDialogFromTrigger(sessionId, dialog.dialogId, "session-ended") || closedAny;
+        }
+        // Publishes only while the session is still (or already re-)registered as
+        // active, so teardown paths stay silent and runtime replacement refreshes.
+        if (closedAny)
+            this.publishStatusForSessionId(sessionId);
+    }
+    publishDialogClosed(sessionId, outcome) {
+        this.events.publish(sessionId, {
+            type: "dialog.closed",
+            dialogId: outcome.dialogId,
+            reason: outcome.reason,
+            ...(outcome.answer === undefined ? {} : { answer: outcome.answer }),
+        });
+    }
+    /**
+     * Publish status for a session known only by id, as the ask tools are: they
+     * run inside the session's own runtime, so the active entry is the session.
+     */
+    publishStatusForSessionId(sessionId) {
+        const session = this.active.get(sessionId)?.runtime.session;
+        if (session !== undefined)
+            this.publishStatus(session);
     }
     /** Summaries of the tracked subsessions spawned by `parentSessionId`. */
     async listSubsessions(parentSessionId, parentSessionFile) {
@@ -885,7 +1331,7 @@ export class PiSessionService {
         return pageMessagesAtSafeBoundary(historyMessages(session), page);
     }
     async status(ref) {
-        return this.statusFromSession(await this.getOrOpen(ref));
+        return this.statusFromSession(await this.sessionForStatusOrDialogClose(ref));
     }
     /**
      * Join-time snapshot of the in-flight assistant stream. The `seq` watermark and
@@ -903,26 +1349,20 @@ export class PiSessionService {
         const streamingMessage = session.state.streamingMessage;
         const partial = streamingMessage === undefined || streamingMessage === null
             ? null
-            : projectBrowserMessage(streamingMessage);
+            : annotateAssistantThinkingLevel(projectBrowserMessage(streamingMessage), session.thinkingLevel);
         return { seq, partial };
     }
     async availableModels(ref) {
         const session = await this.getOrOpen(ref);
-        await session.modelRuntime.refresh();
-        const models = session.scopedModels.length > 0
-            ? session.scopedModels.map((scoped) => scoped.model)
-            : session.modelRuntime.getAvailableSnapshot();
+        const models = await this.sessionModelCandidates(session);
         return models.map(modelToClientModel);
     }
     async setModel(ref, provider, modelId) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
         this.assertTreeNavigationInactive(session, "change models");
-        await session.modelRuntime.refresh();
+        const candidates = await this.sessionModelCandidates(session);
         this.assertTreeNavigationInactive(session, "change models");
-        const candidates = session.scopedModels.length > 0
-            ? session.scopedModels.map((scoped) => scoped.model)
-            : session.modelRuntime.getAvailableSnapshot();
         const model = candidates.find((candidate) => candidate.provider === provider && candidate.id === modelId)
             ?? session.modelRuntime.getModel(provider, modelId);
         if (model === undefined)
@@ -1007,6 +1447,11 @@ export class PiSessionService {
             this.publishStatus(session);
             return;
         }
+        // A chat message answers the session's open ask in the user's own words, so
+        // the form is void: keeping it open would invite answers to questions the
+        // conversation has already moved past. Ignored duplicates skip this on
+        // purpose: they must not void an ask posted after the queued original.
+        await this.voidOpenAskForUserMessage(session);
         if (session.isCompacting) {
             this.enqueuePromptDuringCompaction(session, promptText, behavior ?? "followUp", images, echoUserMessage);
             return;
@@ -1090,7 +1535,7 @@ export class PiSessionService {
     async navigateTree(ref, request) {
         if (request.targetId.trim() === "")
             throw new Error("Session tree target is required");
-        if (this.isTreeExclusiveSessionIdentityActive(sessionIdFromLookup(ref))) {
+        if (this.isTreeExclusiveSessionIdentityActive(ref.id)) {
             throw new Error("Stop current session activity before navigating the session tree");
         }
         await this.assertWritable(ref);
@@ -1189,7 +1634,7 @@ export class PiSessionService {
         const uniqueRefs = uniqueBulkSessionRefs(refs);
         const [archivedRecords, sessionContext] = await Promise.all([
             this.archiveStore.list(),
-            this.bulkSessionLookupContext(uniqueRefs),
+            this.bulkSessionRefContext(uniqueRefs),
         ]);
         const failures = [];
         const alreadyArchivedSessionIds = [];
@@ -1203,7 +1648,7 @@ export class PiSessionService {
                 unreadArchivedIdentities.push(archived);
                 continue;
             }
-            const active = this.activeForLookup(bulkRefToLookup(ref));
+            const active = this.activeForRef(bulkRefToSessionRef(ref));
             const listed = findListedSessionForBulkRef(sessionContext, ref);
             const resolvedSessionId = active?.runtime.session.sessionId ?? listed?.id ?? ref.id;
             if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
@@ -1227,7 +1672,7 @@ export class PiSessionService {
         }
         const readyPlanItems = [];
         for (const item of planItems) {
-            const active = this.activeForLookup({ id: item.input.sessionId, cwd: item.input.cwd });
+            const active = this.activeForRef({ id: item.input.sessionId, cwd: item.input.cwd });
             if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
                 failures.push({ sessionId: item.input.sessionId, error: "Stop current session activity before archiving" });
                 continue;
@@ -1304,18 +1749,6 @@ export class PiSessionService {
         await this.archiveStore.restore(archived.sessionId);
         await this.forgetUnreadSessions([archived]);
     }
-    async deleteArchived(ref) {
-        const record = await this.getArchived(ref);
-        if (record === undefined)
-            throw new Error("Archived session not found");
-        if (this.archiveStore.deleteArchived === undefined)
-            throw new Error("Archive store does not support deletion");
-        await this.closeActive(record.sessionId, { kind: "clear", reason: "delete" });
-        if (record.archivePath === undefined)
-            await this.ensureArchivedRecordMoved(record);
-        await this.archiveStore.deleteArchived(record.sessionId);
-        await this.forgetUnreadSessions([record]);
-    }
     async deleteArchivedMany(refs) {
         if (this.archiveStore.deleteArchived === undefined && this.archiveStore.deleteArchivedMany === undefined)
             throw new Error("Archive store does not support deletion");
@@ -1329,7 +1762,7 @@ export class PiSessionService {
                 failures.push({ sessionId: ref.id, error: "Archived session not found" });
                 continue;
             }
-            const active = this.activeForLookup({ id: record.sessionId, cwd: record.cwd });
+            const active = this.activeForRef({ id: record.sessionId, cwd: record.cwd });
             if (active !== undefined && this.hasActiveWork(active.runtime.session)) {
                 failures.push({ sessionId: record.sessionId, error: "Stop current session activity before deleting archived session" });
                 continue;
@@ -1346,12 +1779,7 @@ export class PiSessionService {
                 failures.push({ sessionId: item.record.sessionId, error: errorMessage(error) });
             }
         }
-        const moveFailures = await this.moveLegacyArchivedRecordsForDelete(readyRecords);
-        failures.push(...moveFailures);
-        const moveFailureIds = new Set(moveFailures.map((failure) => failure.sessionId));
-        const deleteIds = readyRecords
-            .map((record) => record.sessionId)
-            .filter((sessionId) => !moveFailureIds.has(sessionId));
+        const deleteIds = readyRecords.map((record) => record.sessionId);
         let deletedSessionIds = [];
         try {
             deletedSessionIds = await this.archiveStoreDeleteArchivedMany(deleteIds);
@@ -1404,6 +1832,14 @@ export class PiSessionService {
         if (sessionFile === undefined || sessionFile === "")
             throw new Error("Session is not persisted");
         await clearParentSession(sessionFile);
+        // The header cache memoizes the first successful read, and detach is the
+        // only flow that rewrites a header; drop the stale entry so sibling child
+        // counts and parent locations observe the cleared parent immediately.
+        this.sessionHeaderCache.delete(sessionFile);
+        // The same in-place rewrite is invisible to the gateway's summary memo
+        // (same inode, possibly grown file), which would otherwise keep listing
+        // the old parent link and a stale message count until restart.
+        this.sessionManager.invalidateSessionFile(sessionFile);
         clearParentSessionHeader(session.sessionManager);
         this.unregisterSubsession(session.sessionId);
         await this.forgetUnreadSessions([{ sessionId: session.sessionId, cwd: session.sessionManager.getCwd() }]);
@@ -1423,12 +1859,18 @@ export class PiSessionService {
         return this.statusFromSession(session);
     }
     async abort(ref) {
-        const active = this.activeForLookup(ref);
+        const active = this.activeForRef(ref);
         if (active === undefined)
             return;
         const sessionId = active.runtime.session.sessionId;
         this.clearCompactionPromptQueue(sessionId);
         clearSessionQueue(active.runtime.session);
+        // Settle run-scoped dialogs now, at abort-request time: pi's agent loop
+        // waits for a parked `tool_call` dialog handler before it can emit
+        // `agent_end`, so leaving settlement to the `agent_end` observer would
+        // strand the dialog until its timeout. Settling before the runtime abort
+        // also means a failing or hung abort cannot strand the parked waiter.
+        this.abortRunScopedExtensionDialogs(sessionId);
         try {
             await this.abortSessionOperations(active.runtime.session);
             this.publishActivity(active.runtime.session, "stopped", "idle");
@@ -1443,31 +1885,26 @@ export class PiSessionService {
         }
     }
     async stop(ref) {
-        const active = this.activeForLookup(ref);
+        const active = this.activeForRef(ref);
         if (active !== undefined) {
             await this.closeActive(active.runtime.session.sessionId);
             return;
         }
-        if (isPiSessionRef(ref)) {
-            this.publishNotificationMutations(this.notificationStore.clearSessionIdentity(ref.id, canonicalizeStoredCwd(ref.cwd), "runtime-close"));
+        // A session whose open is parked (e.g. on a session_start dialog) is not
+        // active yet; close it through the same path so stopping cannot block
+        // behind the dialog timeout.
+        const startup = this.startupSessionForRef(ref);
+        if (startup !== undefined) {
+            await this.closeActive(startup.sessionId);
             return;
         }
-        await this.closeActive(ref);
+        this.publishNotificationMutations(this.notificationStore.clearSessionIdentity(ref.id, canonicalizeStoredCwd(ref.cwd), "runtime-close"));
     }
-    async bulkSessionLookupContext(refs) {
+    async bulkSessionRefContext(refs) {
         const cwdSet = new Set();
-        let needsAllSessions = false;
-        for (const ref of refs) {
-            if (ref.cwd === undefined)
-                needsAllSessions = true;
-            else
-                cwdSet.add(ref.cwd);
-        }
-        const [sessionsByCwd, allSessions] = await Promise.all([
-            this.listSessionsByCwd([...cwdSet]),
-            needsAllSessions ? this.sessionManager.listAll?.() ?? Promise.resolve([]) : Promise.resolve(undefined),
-        ]);
-        return allSessions === undefined ? { sessionsByCwd } : { sessionsByCwd, allSessions };
+        for (const ref of refs)
+            cwdSet.add(ref.cwd);
+        return { sessionsByCwd: await this.listSessionsByCwd([...cwdSet]) };
     }
     async listSessionsByCwd(cwds) {
         const uniqueCwds = uniqueStrings(cwds);
@@ -1495,36 +1932,8 @@ export class PiSessionService {
             await this.archiveStore.deleteArchived(sessionId);
         return [...sessionIds];
     }
-    async moveLegacyArchivedRecordsForDelete(records) {
-        const legacyRecords = records.filter((record) => record.archivePath === undefined);
-        if (legacyRecords.length === 0)
-            return [];
-        let sessionsByCwd;
-        try {
-            sessionsByCwd = await this.listSessionsByCwd(legacyRecords.map((record) => record.cwd));
-        }
-        catch (error) {
-            return legacyRecords.map((record) => ({ sessionId: record.sessionId, error: errorMessage(error) }));
-        }
-        const moveInputs = legacyRecords
-            .map((record) => findSessionByIdOrPrefix(sessionsByCwd.get(record.cwd) ?? [], record.sessionId))
-            .filter(isDefined)
-            .map(archiveInputFromListEntry);
-        if (moveInputs.length === 0)
-            return [];
-        try {
-            await this.archiveStoreArchiveMany(moveInputs);
-            return [];
-        }
-        catch (error) {
-            const failedIds = new Set(moveInputs.map((input) => input.sessionId));
-            return legacyRecords
-                .filter((record) => failedIds.has(record.sessionId))
-                .map((record) => ({ sessionId: record.sessionId, error: errorMessage(error) }));
-        }
-    }
     async cleanupPlan(request) {
-        const [sessions, archivedRecords] = await Promise.all([this.sessionManager.listAll?.() ?? [], this.archiveStore.list()]);
+        const [sessions, archivedRecords] = await Promise.all([this.sessionManager.listAll(), this.archiveStore.list()]);
         return planSessionCleanup({
             sessions,
             archivedRecords,
@@ -1553,34 +1962,6 @@ export class PiSessionService {
         }
         return [...sessionIds];
     }
-    async ensureArchivedSessionMoved(record, session) {
-        if (session === undefined || this.active.has(record.sessionId))
-            return record;
-        try {
-            return await this.archiveStore.archive(archiveInputFromListEntry(session));
-        }
-        catch {
-            return record;
-        }
-    }
-    async ensureArchivedRecordMoved(record) {
-        const session = (await this.sessionManager.list(record.cwd)).find((candidate) => candidate.id === record.sessionId);
-        if (session === undefined)
-            return record;
-        const [moved] = await this.archiveStoreArchiveMany([archiveInputFromListEntry(session)]);
-        return moved ?? record;
-    }
-    async ensureArchivedRecordsMoved(records) {
-        const legacyRecords = records.filter((record) => record.archivePath === undefined);
-        if (legacyRecords.length === 0)
-            return;
-        const sessionsByCwd = await this.listSessionsByCwd(legacyRecords.map((record) => record.cwd));
-        const moveInputs = legacyRecords
-            .map((record) => sessionsByCwd.get(record.cwd)?.find((candidate) => candidate.id === record.sessionId))
-            .filter(isDefined)
-            .map(archiveInputFromListEntry);
-        await this.archiveStoreArchiveMany(moveInputs);
-    }
     async archiveInputForSession(session) {
         const cwd = session.sessionManager.getCwd();
         const sessionFile = session.sessionFile;
@@ -1642,6 +2023,11 @@ export class PiSessionService {
         return [...names];
     }
     async closeActive(sessionId, notificationPolicy = CLEAR_RUNTIME_NOTIFICATIONS) {
+        // A session whose open is parked on a `session_start` dialog holds its
+        // pending open until the dialog settles; settle it first so closing cannot
+        // block behind the dialog timeout (which `0` makes infinite).
+        if (this.startupSessions.has(sessionId))
+            this.endSessionExtensionDialogs(sessionId);
         const pendingOpens = this.pendingSessionOpenPromises(sessionId);
         if (pendingOpens.length > 0)
             await Promise.allSettled(pendingOpens);
@@ -1656,6 +2042,12 @@ export class PiSessionService {
         if (!active)
             return;
         this.forgetUnreadActivity(active.runtime.session);
+        // An open ask is meaningful only while the runtime that posted it exists: no
+        // one is left to receive the answers, so it is dropped without an outcome.
+        this.pendingAskStore.forgetSession(sessionId);
+        // Open dialogs share that stance, but their extension waiters are parked
+        // Promises inside the dying runtime: settle them rather than dropping them.
+        this.endSessionExtensionDialogs(sessionId);
         this.active.delete(sessionId);
         this.activities.delete(sessionId);
         this.workspaceActivity?.removeSession(sessionId, active.runtime.session.sessionManager.getCwd());
@@ -1706,7 +2098,7 @@ export class PiSessionService {
         return (await this.getActive(ref)).runtime.session;
     }
     async getActive(ref, options = {}) {
-        const active = this.activeForLookup(ref);
+        const active = this.activeForRef(ref);
         if (active !== undefined)
             return active;
         const archived = await this.getArchived(ref);
@@ -1714,15 +2106,15 @@ export class PiSessionService {
             const { archivePath } = archived;
             return this.openExistingSession(archived.sessionId, archived.cwd, () => this.sessionManager.open(archivePath), { notifications: "disabled" });
         }
-        const match = isPiSessionRef(ref)
-            ? (await this.sessionManager.list(ref.cwd)).find((s) => s.id === ref.id || s.id.startsWith(ref.id))
-            : (await this.sessionManager.listAll?.() ?? []).find((s) => s.id === ref || s.id.startsWith(ref));
+        // Resolve the session file directly by id: opening one inactive session
+        // must not pay for a full transcript listing of its whole workspace.
+        const match = await this.sessionManager.resolveSessionFile(ref.cwd, ref.id, this.readCachedSessionHeader);
         if (!match)
             throw new Error("Session not found");
         return this.openExistingSession(match.id, match.cwd, () => this.sessionManager.open(match.path), options);
     }
     openExistingSession(sessionId, cwd, openSessionManager, options = {}) {
-        const active = this.activeForLookup({ id: sessionId, cwd });
+        const active = this.activeForRef({ id: sessionId, cwd });
         if (active !== undefined)
             return Promise.resolve(active);
         const key = JSON.stringify([canonicalizeStoredCwd(cwd), sessionId]);
@@ -1746,28 +2138,79 @@ export class PiSessionService {
             .map((pending) => pending.promise);
     }
     async getArchived(ref) {
-        const archived = await this.archiveStore.get(sessionIdFromLookup(ref));
+        const archived = await this.archiveStore.get(ref.id);
         if (archived === undefined)
             return undefined;
-        if (isPiSessionRef(ref) && archived.cwd !== ref.cwd)
+        if (archived.cwd !== ref.cwd)
             return undefined;
         return archived;
     }
     isCurrentActiveSession(session) {
         return this.active.get(session.sessionId)?.runtime.session === session;
     }
-    activeForLookup(ref) {
-        const sessionId = sessionIdFromLookup(ref);
+    /**
+     * The command service tracks sessions by id alone; its callbacks only ever
+     * run against a session the caller just resolved as active, so the cwd
+     * needed for a full ref comes from that active runtime.
+     */
+    activeSessionRef(sessionId) {
+        const active = this.active.get(sessionId);
+        if (active === undefined)
+            throw new Error("Session not found");
+        return { id: sessionId, cwd: active.runtime.cwd };
+    }
+    activeForRef(ref) {
+        const sessionId = ref.id;
         const exact = this.active.get(sessionId);
-        if (exact !== undefined && lookupMatchesActiveSession(ref, exact))
+        if (exact !== undefined && refMatchesActiveSession(ref, exact))
             return exact;
         for (const [candidateId, active] of this.active.entries()) {
-            if (candidateId.startsWith(sessionId) && lookupMatchesActiveSession(ref, active))
+            if (candidateId.startsWith(sessionId) && refMatchesActiveSession(ref, active))
                 return active;
         }
         return undefined;
     }
+    startupSessionForRef(ref) {
+        const sessionId = ref.id;
+        const exact = this.startupSessions.get(sessionId);
+        if (exact !== undefined && refMatchesStartupSession(ref, exact))
+            return exact;
+        for (const [candidateId, session] of this.startupSessions.entries()) {
+            if (candidateId.startsWith(sessionId) && refMatchesStartupSession(ref, session))
+                return session;
+        }
+        return undefined;
+    }
+    /**
+     * The session to serve a read-only status or a dialog close for, while it
+     * can still be found: active first, then still starting up, and only then
+     * the on-demand open path (which a stale close on an idle session needs for
+     * its status projection).
+     */
+    async sessionForStatusOrDialogClose(ref) {
+        const reachable = this.activeForRef(ref)?.runtime.session ?? this.startupSessionForRef(ref);
+        if (reachable !== undefined)
+            return reachable;
+        return this.getOrOpen(ref);
+    }
+    /**
+     * Construct a session while telling waiting browsers which phase of startup
+     * they are waiting on. The reporting wraps the *whole* construction rather
+     * than the inner bookkeeping `try`, because the runtime construction that runs
+     * first is both the slowest phase and one that can fail on its own; a clear
+     * that only ran for the later phases would leave a stale label behind.
+     */
     async create(sessionManager, cwd, options = {}) {
+        const startup = this.startupProgress(sessionManager, options.startupIntent ?? "open", options.startupToken);
+        try {
+            return await this.createSessionRuntime(sessionManager, cwd, options, startup);
+        }
+        finally {
+            startup.end();
+        }
+    }
+    async createSessionRuntime(sessionManager, cwd, options, startup) {
+        startup.report(STARTUP_PHASE_RUNTIME);
         const delegationToolsEnabled = options.creationProvenance !== "tracked-subsession"
             && await sessionAllowsDelegationTools(sessionManager, this.sessionManager);
         const runtime = await this.createAgentRuntime(this.createRuntime, {
@@ -1776,6 +2219,7 @@ export class PiSessionService {
             sessionManager,
             delegationToolsEnabled,
             ...(options.initialModel === undefined ? {} : { initialModel: options.initialModel }),
+            ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
         });
         const active = { runtime, unsubscribe: noop };
         let boundSession = runtime.session;
@@ -1807,6 +2251,7 @@ export class PiSessionService {
             else {
                 await this.recoverSubsessionTrackingForOpenedSession(runtime.session);
             }
+            startup.report(STARTUP_PHASE_EXTENSIONS);
             await this.bindSessionExtensions(runtime.session, notificationGeneration);
             this.bindRuntime(active);
             runtime.setRebindSession(async (session) => {
@@ -1820,6 +2265,10 @@ export class PiSessionService {
                         this.notificationGenerationBySession.set(session, candidateGeneration);
                     }
                     this.bindRuntime(active, session);
+                    // The runtime being replaced parked every dialog the store still
+                    // holds for this session; settle those waits before the new
+                    // runtime's extensions can open fresh dialogs under the same id.
+                    this.endSessionExtensionDialogs(boundSession.sessionId);
                     boundSession = session;
                     await this.bindSessionExtensions(session, candidateGeneration);
                     if (candidateGeneration !== undefined) {
@@ -1855,6 +2304,9 @@ export class PiSessionService {
             }
             active.unsubscribe();
             this.forgetUnreadActivity(boundSession);
+            // A session_start dialog may already be parked when a later startup
+            // step fails; its waiter dies with the runtime being torn down here.
+            this.endSessionExtensionDialogs(boundSession.sessionId);
             let removedActive = false;
             for (const [sessionId, candidate] of this.active.entries()) {
                 if (candidate !== active)
@@ -1879,15 +2331,25 @@ export class PiSessionService {
     }
     async bindSessionExtensions(session, generation) {
         const uiContext = this.sessionUiContext(session, generation);
-        await session.bindExtensions({
-            uiContext,
-            mode: "rpc",
-            onError: (error) => {
-                const message = `${error.extensionPath}: ${error.error}`;
-                this.publishActivity(session, "extension error", "error", message);
-                this.events.publish(session.sessionId, { type: "session.error", message });
-            },
-        });
+        // A `session_start` hook can park this bind on a dialog the browser has
+        // not answered yet. On the initial create/open path the session becomes
+        // active only after this returns, so register it for the duration: the
+        // answer that unblocks startup has to be reachable while it waits.
+        this.startupSessions.set(session.sessionId, session);
+        try {
+            await session.bindExtensions({
+                uiContext,
+                mode: "rpc",
+                onError: (error) => {
+                    const message = `${error.extensionPath}: ${error.error}`;
+                    this.publishActivity(session, "extension error", "error", message);
+                    this.events.publish(session.sessionId, { type: "session.error", message });
+                },
+            });
+        }
+        finally {
+            this.startupSessions.delete(session.sessionId);
+        }
     }
     replaceSessionNotificationContext(session, generation) {
         session.extensionRunner.setUIContext(this.sessionUiContext(session, generation), "rpc");
@@ -1905,24 +2367,27 @@ export class PiSessionService {
             }
             const added = this.notificationStore.addNotification(generation, message, type);
             this.publishNotificationMutations(added.mutations);
-            if (added.notification === undefined)
-                return;
-            this.events.publish(session.sessionId, {
-                type: "command.output",
-                level: type === "error" ? "error" : "info",
-                message,
-                notificationId: added.notification.id,
-            });
         };
-        // PI WEB owns the browser-facing notification and text-formatting
-        // boundaries. Delegate every other UI method to Pi's headless defaults so
-        // unsupported dialogs cancel safely instead of hanging.
+        // PI WEB owns the browser-facing dialog, notification, and text-formatting
+        // boundaries: the three dialog primitives park daemon-held Promises that
+        // the browser answers, while every other UI method delegates to Pi's
+        // headless defaults so unsupported surfaces cancel safely instead of
+        // hanging.
         return new Proxy(baseUiContext, {
-            get(target, property, receiver) {
+            get: (target, property, receiver) => {
                 if (property === "notify")
                     return notify;
                 if (property === "theme")
                     return plainTextTheme;
+                if (property === "confirm") {
+                    return (title, message, opts) => this.openExtensionDialog(session, { kind: "confirm", title, message }, opts);
+                }
+                if (property === "select") {
+                    return (title, options, opts) => this.openExtensionDialog(session, { kind: "select", title, options }, opts);
+                }
+                if (property === "input") {
+                    return (title, placeholder, opts) => this.openExtensionDialog(session, { kind: "input", title, placeholder }, opts);
+                }
                 const value = Reflect.get(target, property, receiver);
                 return value;
             },
@@ -2048,9 +2513,11 @@ export class PiSessionService {
             }
         }
         active.unsubscribe = session.subscribe((event) => {
-            this.events.publish(session.sessionId, toClientEvent(event));
+            this.events.publish(session.sessionId, toClientEvent(event, session.thinkingLevel));
             this.publishActivityForEvent(session, event);
             const eventType = getString(event, "type");
+            if (eventType === "agent_end")
+                this.abortRunScopedExtensionDialogs(session.sessionId);
             if (eventType === "compaction_end")
                 this.scheduleCompactionQueueDrain(session.sessionId);
             if (eventType === "agent_start" || eventType === "agent_end")
@@ -2387,6 +2854,54 @@ export class PiSessionService {
         if (this.hasActiveWork(session))
             this.publishActivity(session, eventType.replaceAll("_", " "), "active");
     }
+    /**
+     * Build the reporter for one session construction.
+     *
+     * The session id is known before any await — a `SessionManager` has its id
+     * from construction — so the daemon can name what it is starting even though
+     * the `PiAgentSession` that {@link publishActivity} needs does not exist yet.
+     * Without an id there is nothing to report against, so the reporter stays
+     * silent and the browser keeps its own generic wording.
+     */
+    startupProgress(sessionManager, intent, startupToken) {
+        const sessionId = sessionManager.getSessionId();
+        if (sessionId === "")
+            return { report: noop, end: noop };
+        const label = intent === "create" ? "Creating session" : "Opening session";
+        return {
+            report: (phase) => { this.publishStartupProgress(sessionId, startupToken, label, "active", this.startupDetail(phase)); },
+            end: () => {
+                // A real activity published during the window (an extension error, say)
+                // is the truth about this session and must survive the clear.
+                if (this.activities.has(sessionId))
+                    return;
+                this.publishStartupProgress(sessionId, startupToken, "idle", "idle", undefined);
+            },
+        };
+    }
+    startupDetail(phase) {
+        return this.catalogRefreshStatus?.isRefreshInFlight() === true
+            ? `${phase} · ${STARTUP_CONCURRENT_CATALOG_REFRESH}`
+            : phase;
+    }
+    /**
+     * Report startup progress on the global channel only, echoing the caller's
+     * correlation token so a waiting browser row recognises its own construction.
+     *
+     * Unlike {@link publishActivity} this deliberately records nothing: no
+     * `activities` entry, no workspace activity, no unread observation. There is
+     * no session to own that state, and a failed creation would leave it stranded.
+     *
+     * Every report is marked `startup`, which is what keeps a session that is
+     * merely opening from counting as one doing work. This is the only publisher
+     * that sets the marker, and because it writes no `activities` entry no later
+     * heartbeat re-publication can carry it.
+     */
+    publishStartupProgress(sessionId, startupToken, label, phase, detail) {
+        const at = new Date().toISOString();
+        const activity = detail === undefined ? { sessionId, phase, label, at, startup: true } : { sessionId, phase, label, detail, at, startup: true };
+        this.events.publishGlobal(startupToken === undefined ? { type: "session.startup", activity } : { type: "session.startup", startupToken, activity });
+    }
     publishActivity(session, label, phase, detail) {
         const at = new Date().toISOString();
         const stored = detail === undefined ? { phase, label, at } : { phase, label, detail, at };
@@ -2421,6 +2936,8 @@ export class PiSessionService {
         const model = session.model === undefined ? undefined : modelToClientModel(session.model);
         const contextUsage = session.getContextUsage();
         const warnings = this.warningsForSession(session);
+        const pendingAsk = this.pendingAskStore.pendingAsk(session.sessionId);
+        const pendingDialogs = this.pendingExtensionDialogStore.pendingDialogs(session.sessionId);
         return {
             sessionId: session.sessionId,
             persisted: sessionFileExists(session.sessionFile),
@@ -2436,6 +2953,8 @@ export class PiSessionService {
             cost: stats.cost,
             ...(contextUsage === undefined ? {} : { contextUsage }),
             ...(warnings.length === 0 ? {} : { warnings }),
+            ...(pendingAsk === undefined ? {} : { pendingAsk }),
+            ...(pendingDialogs.length === 0 ? {} : { pendingDialogs }),
         };
     }
     /**
@@ -2475,7 +2994,7 @@ function uniqueBulkSessionRefs(refs) {
     const seen = new Set();
     const unique = [];
     for (const ref of refs) {
-        const key = `${ref.cwd ?? ""}\0${ref.id}`;
+        const key = `${ref.cwd}\0${ref.id}`;
         if (seen.has(key))
             continue;
         seen.add(key);
@@ -2483,16 +3002,14 @@ function uniqueBulkSessionRefs(refs) {
     }
     return unique;
 }
-function bulkRefToLookup(ref) {
-    return ref.cwd === undefined ? ref.id : { id: ref.id, cwd: ref.cwd };
+function bulkRefToSessionRef(ref) {
+    return { id: ref.id, cwd: ref.cwd };
 }
 function findArchivedRecordForBulkRef(records, ref) {
-    return records.find((record) => (ref.cwd === undefined || record.cwd === ref.cwd) && (record.sessionId === ref.id || record.sessionId.startsWith(ref.id)));
+    return records.find((record) => record.cwd === ref.cwd && (record.sessionId === ref.id || record.sessionId.startsWith(ref.id)));
 }
 function findListedSessionForBulkRef(context, ref) {
-    if (ref.cwd !== undefined)
-        return findSessionByIdOrPrefix(context.sessionsByCwd.get(ref.cwd) ?? [], ref.id);
-    return context.allSessions === undefined ? undefined : findSessionByIdOrPrefix(context.allSessions, ref.id);
+    return findSessionByIdOrPrefix(context.sessionsByCwd.get(ref.cwd) ?? [], ref.id);
 }
 function findSessionByIdOrPrefix(sessions, sessionId) {
     return sessions.find((session) => session.id === sessionId) ?? sessions.find((session) => session.id.startsWith(sessionId));
@@ -2811,28 +3328,6 @@ function activeSessionFileMatches(active, expectedSessionFile) {
 function trackedLinkParentFileMatches(link, parentSessionFile) {
     return link.parentSessionFile !== undefined && sessionPathsEqual(link.parentSessionFile, parentSessionFile);
 }
-async function readSessionHeaderSummary(sessionFile) {
-    let file;
-    try {
-        file = await open(sessionFile, "r");
-        const buffer = Buffer.alloc(4096);
-        const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-        const firstLine = buffer.toString("utf8", 0, bytesRead).split("\n", 1)[0];
-        if (firstLine === undefined || firstLine === "")
-            return undefined;
-        const header = JSON.parse(firstLine);
-        if (!isRecord(header) || header["type"] !== "session" || typeof header["id"] !== "string")
-            return undefined;
-        const parentSession = getString(header, "parentSession");
-        return { id: header["id"], ...(parentSession === undefined ? {} : { parentSession }) };
-    }
-    catch {
-        return undefined;
-    }
-    finally {
-        await file?.close().catch(() => undefined);
-    }
-}
 async function sessionFileHeaderMatches(sessionFile, expected) {
     const header = await readSessionHeaderSummary(sessionFile);
     if (header?.id !== expected.sessionId)
@@ -2897,13 +3392,34 @@ function buildPromptOptions(behavior, images) {
 function stringValue(value) {
     return typeof value === "string" ? value : "";
 }
+/**
+ * Attach the thinking level in effect when an assistant message was generated,
+ * so chat bubbles can show it next to the model. Non-assistant messages pass
+ * through by reference; assistant messages are copied only when a level is set.
+ * "off" is the absence of thinking, not a level worth labeling on every bubble.
+ */
+function annotateAssistantThinkingLevel(message, thinkingLevel) {
+    if (thinkingLevel === undefined || thinkingLevel === "" || thinkingLevel === "off")
+        return message;
+    if (!isRecord(message) || message["role"] !== "assistant")
+        return message;
+    return { ...message, thinkingLevel };
+}
 function historyMessages(session) {
     const messages = [];
+    // Pi records the initial level at session creation and every later change, so
+    // walking the branch yields the level in effect for each assistant message.
+    let thinkingLevel;
     for (const entry of session.sessionManager.getBranch()) {
         if (!isRecord(entry))
             continue;
         if (entry["type"] === "message")
-            messages.push(entry["message"]);
+            messages.push(annotateAssistantThinkingLevel(entry["message"], thinkingLevel));
+        else if (entry["type"] === "thinking_level_change") {
+            const level = getString(entry, "thinkingLevel");
+            if (level !== undefined)
+                thinkingLevel = level;
+        }
         else if (entry["type"] === "custom_message" && entry["display"] === true)
             messages.push({ role: "custom", content: entry["content"], customType: entry["customType"], details: entry["details"] });
         else if (entry["type"] === "compaction")
@@ -2948,7 +3464,7 @@ function finalAssistantText(messages) {
     }
     return "";
 }
-function toClientEvent(event) {
+function toClientEvent(event, thinkingLevel) {
     const eventType = getString(event, "type");
     const assistantMessageEvent = getProperty(event, "assistantMessageEvent");
     if (eventType === "message_update" && getString(assistantMessageEvent, "type") === "text_delta") {
@@ -2975,7 +3491,9 @@ function toClientEvent(event) {
         return { type: "agent.end" };
     if (eventType === "message_end") {
         const message = getProperty(event, "message");
-        return message === undefined ? { type: "message.end" } : { type: "message.end", message };
+        if (message === undefined)
+            return { type: "message.end" };
+        return { type: "message.end", message: annotateAssistantThinkingLevel(message, thinkingLevel) };
     }
     return { type: "pi.event", eventType: eventType ?? "unknown" };
 }