@jmfederico/pi-web 1.202608.1 → 1.202609.0

package/dist/server/sessions/piSessionService.js

@@ -1,7 +1,7 @@
 import { statSync } from "node:fs";
 import { join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEditToolDefinition, defineTool, readStoredCredential, SessionManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEditToolDefinition, defineTool, hasTrustRequiringProjectResources, ProjectTrustStore, readStoredCredential, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { projectBrowserMessage } from "../browserMessageProjection.js";
 import { pageMessagesAtSafeBoundary } from "./messagePaging.js";
 import { BUILTIN_COMMANDS } from "./builtinCommands.js";
@@ -12,6 +12,7 @@ import { findArchiveCandidateByIdOrPrefix, planSessionArchiveTree } from "./sess
 import { deterministicSessionName, fallbackSessionName, generateShortSessionName } from "./sessionNameGenerator.js";
 import { computeEditPreview } from "./editPreview.js";
 import { attachmentsToInlineImages, saveAttachmentsToWorkspace } from "./attachmentService.js";
+import { loadEffectiveProjectAttachmentsConfig } from "../workspaces/projectPiWebConfig.js";
 import { parsePromptAttachments } from "../../shared/promptAttachments.js";
 import { ASK_USER_ANSWERS_CUSTOM_TYPE, SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
@@ -28,6 +29,7 @@ import { planSessionCleanup, summarizeSessionCleanupExecution } from "./sessionC
 import { SessionNotificationStore, } from "./sessionNotificationStore.js";
 import { plainTextTheme } from "./plainTextTheme.js";
 import { SessionUnreadStore } from "./sessionUnreadStore.js";
+import { applyEnabledModelToggle, catalogWithEnabledFirst, modelScopeId, persistedEnabledModelPatterns, resolveEnabledModelIds, resolveSessionModelOptions, scopedModelsFromEnabledIds } from "./sessionModelScope.js";
 const noopLogger = { info() { } };
 const DEFAULT_UNREAD_PUBLICATION_RETRY_MS = 1_000;
 /**
@@ -46,6 +48,15 @@ const STARTUP_PHASE_EXTENSIONS = "Loading session extensions";
 const STARTUP_CONCURRENT_CATALOG_REFRESH = "provider model lists are refreshing";
 const MAX_UNREAD_PUBLICATION_RETRY_MS = 30_000;
 const MAX_PENDING_UNREAD_MUTATIONS = SESSION_UNREAD_LIMIT + 1;
+/**
+ * Upper bound on how often one idle runtime re-resolves its transcript file.
+ * A runtime created in memory and never persisted has no session file, so
+ * every poll would otherwise rescan the session directory; throttling keeps
+ * steady-state polling of such a session O(1). The window can only delay
+ * noticing a file the runtime did not write itself: once the runtime
+ * persists, `getSessionFile()` answers and this throttle is bypassed.
+ */
+const IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS = 30_000;
 function noop() {
     // Intentionally empty default unsubscribe callback.
 }
@@ -281,13 +292,130 @@ export function createPiWebCustomToolDefinitions(cwd, delegationEnabled, spawn,
         ...(askUser === undefined ? [] : [createAskUserToolDefinition(askUser)]),
     ];
 }
+/**
+ * Run the `project_trust` event over a pre-trust extension set, mirroring
+ * `emitProjectTrustEvent` in the SDK's `dist/core/extensions/runner.js`. That
+ * helper is not part of the package's public exports (the main index exports
+ * only the `ProjectTrust*` types and `ProjectTrustStore`, and the package's
+ * `exports` map blocks subpath imports, so `resolveProjectTrusted`/
+ * `emitProjectTrustEvent` are not callable from here), so PI WEB reimplements
+ * its documented decision loop over the SDK-provided extension objects: per
+ * extension, the registered `project_trust` handlers run in order; the first
+ * handler returning `yes`/`no` decides and `undecided` falls through to the
+ * next handler/extension; a throwing handler is collected as an error and
+ * later handlers still get their chance.
+ */
+export async function emitWebProjectTrustEvent(extensionsResult, event, ctx) {
+    const errors = [];
+    for (const extension of extensionsResult.extensions) {
+        // A single extension may register multiple handlers for the same event.
+        // The handlers map is keyed exactly as the extension registered it, so a
+        // `project_trust` key guarantees `ProjectTrustHandler` entries — the same
+        // assumption the SDK's emitProjectTrustEvent makes.
+        const handlers = extension.handlers.get("project_trust");
+        if (handlers === undefined || handlers.length === 0)
+            continue;
+        for (const handler of handlers) {
+            try {
+                const handlerResult = await handler(event, ctx);
+                // The SDK reads `trusted` straight off the handler result, so a
+                // non-object would throw there; PI WEB reports it as a handler error
+                // and lets the next handler/extension try.
+                if (typeof handlerResult !== "object" || handlerResult === null) {
+                    errors.push({ extensionPath: extension.path, error: "project_trust handler returned a non-object result" });
+                    continue;
+                }
+                const trusted = "trusted" in handlerResult ? handlerResult.trusted : undefined;
+                if (trusted === "undecided") {
+                    continue;
+                }
+                // Rebuild the decision so only the documented `trusted`/`remember`
+                // fields carry over — the SDK's resolver reads exactly those two.
+                const remember = "remember" in handlerResult ? handlerResult.remember : undefined;
+                return {
+                    result: {
+                        trusted: trusted === "yes" ? "yes" : "no",
+                        ...(remember === true ? { remember: true } : {}),
+                    },
+                    errors,
+                };
+            }
+            catch (error) {
+                errors.push({
+                    extensionPath: extension.path,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+    }
+    return { errors };
+}
+/**
+ * PI WEB's headless project-trust context. `hasUI` is false because there is
+ * no browser trust prompt (chartered behavior: `ask` never loads untrusted
+ * resources), so the UI methods are inert — the same no-UI shape the SDK
+ * passes when pi runs without a trust UI. The host mode is `rpc`, mirroring
+ * how PI WEB binds its session extension contexts.
+ */
+function webProjectTrustContext(cwd) {
+    return {
+        cwd,
+        mode: "rpc",
+        hasUI: false,
+        ui: {
+            select: () => Promise.resolve(undefined),
+            confirm: () => Promise.resolve(false),
+            input: () => Promise.resolve(undefined),
+            notify: () => undefined,
+        },
+    };
+}
+/**
+ * Resolve whether a workspace's project-local `.pi/` resources may load, the
+ * way `pi` resolves it — a faithful mirror of the SDK's `resolveProjectTrusted`
+ * (`dist/core/project-trust.js`, also not a public export). PI WEB has no
+ * browser trust prompt, so the precedence is, in order:
+ *
+ * 1. Nothing trust-requiring under `cwd` → trusted.
+ * 2. Pre-trust extensions (user/global — project-local ones are not loaded
+ *    yet) may decide via the `project_trust` event; `remember: true` persists
+ *    the decision to the agent dir's `trust.json`. Handler errors are reported
+ *    through {@link WebProjectTrustResolution.onExtensionError} and never
+ *    abort resolution.
+ * 3. Otherwise the saved `trust.json` decision wins.
+ * 4. Otherwise `defaultProjectTrust` decides (`always` trusts; `never`/`ask`
+ *    do not — `ask` cannot prompt in the browser, matching `pi` run without a
+ *    trust UI).
+ */
+export async function resolveWebProjectTrusted(resolution) {
+    const { cwd, trustStore, settingsManager } = resolution;
+    if (!hasTrustRequiringProjectResources(cwd))
+        return true;
+    if (resolution.extensionsResult) {
+        const { result, errors } = await emitWebProjectTrustEvent(resolution.extensionsResult, { type: "project_trust", cwd }, webProjectTrustContext(cwd));
+        for (const error of errors) {
+            resolution.onExtensionError?.(`Extension "${error.extensionPath}" project_trust error: ${error.error}`);
+        }
+        if (result) {
+            const trusted = result.trusted === "yes";
+            if (result.remember === true) {
+                trustStore.set(cwd, trusted);
+            }
+            return trusted;
+        }
+    }
+    const saved = trustStore.get(cwd);
+    if (saved !== null)
+        return saved;
+    return settingsManager.getDefaultProjectTrust() === "always";
+}
 /**
  * Resource-loader options that append PI WEB's own system-prompt sections.
  *
  * `appendSystemPromptOverride` composes with what the loader already resolved,
  * so the operator's `SYSTEM.md` / `APPEND_SYSTEM.md` files keep their content
  * and PI WEB's sections land after them. Returns `undefined` when there is
- * nothing to add, leaving the loader exactly as pi configures it.
+ * nothing to append, leaving the loader exactly as pi configures it.
  */
 export function piWebResourceLoaderOptions(appendSystemPromptSections) {
     if (appendSystemPromptSections.length === 0)
@@ -297,12 +425,49 @@ export function piWebResourceLoaderOptions(appendSystemPromptSections) {
 function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions, askUser, appendSystemPromptSections = []) {
     const resourceLoaderOptions = piWebResourceLoaderOptions(appendSystemPromptSections);
     return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled }) => {
+        // PI WEB always honors pi's project-trust model. When the workspace ships
+        // trust-requiring resources, trust is resolved exactly once, mirroring the
+        // SDK's flow: the resource loader first loads the pre-trust extension set
+        // (user/global; project-local ones stay out) and calls back with it, so
+        // those extensions may decide via the `project_trust` event; the resolved
+        // value then lands in the SettingsManager before any project-local
+        // resource (extensions, packages, settings, prompts) loads. With no
+        // browser trust prompt, an untrusted project's resources are skipped
+        // (matching `pi` run without a UI). Projects without trust-requiring
+        // resources skip resolution entirely and are trusted, as before.
+        const projectTrustRequiring = hasTrustRequiringProjectResources(cwd);
+        const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted: !projectTrustRequiring });
+        // Pre-session-creation trust failures (`project_trust` handler errors)
+        // land in the runtime diagnostics next to the services diagnostics,
+        // exactly as the CLI appends its project-trust diagnostics.
+        const projectTrustDiagnostics = [];
         const services = await createAgentSessionServices({
             cwd,
             agentDir,
             modelRuntime,
+            settingsManager,
             ...(resourceLoaderOptions === undefined ? {} : { resourceLoaderOptions }),
+            ...(projectTrustRequiring
+                ? {
+                    resourceLoaderReloadOptions: {
+                        resolveProjectTrust: async ({ extensionsResult }) => resolveWebProjectTrusted({
+                            cwd,
+                            trustStore: new ProjectTrustStore(agentDir),
+                            settingsManager,
+                            extensionsResult,
+                            onExtensionError: (message) => projectTrustDiagnostics.push({ type: "warning", message }),
+                        }),
+                    },
+                }
+                : {}),
         });
+        const modelOptions = await resolveSessionModelOptions({
+            services,
+            hasExistingSession: sessionManager.buildSessionContext().messages.length > 0,
+            ...(initialModel === undefined ? {} : { initialModel }),
+            ...(initialThinkingLevel === undefined ? {} : { initialThinkingLevel }),
+        });
+        services.diagnostics.push(...modelOptions.diagnostics);
         const resolvedDelegationToolsEnabled = delegationToolsEnabled
             ?? await sessionAllowsDelegationTools(sessionManager, sessionManagers);
         const customTools = createPiWebCustomToolDefinitions(cwd, resolvedDelegationToolsEnabled, spawn, subsessions, askUser);
@@ -311,10 +476,11 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
             sessionManager,
             customTools,
             ...(sessionStartEvent === undefined ? {} : { sessionStartEvent }),
-            ...(initialModel === undefined ? {} : { model: initialModel }),
-            ...(initialThinkingLevel === undefined ? {} : { thinkingLevel: initialThinkingLevel }),
+            ...(modelOptions.model === undefined ? {} : { model: modelOptions.model }),
+            ...(modelOptions.thinkingLevel === undefined ? {} : { thinkingLevel: modelOptions.thinkingLevel }),
+            ...(modelOptions.scopedModels.length === 0 ? {} : { scopedModels: modelOptions.scopedModels }),
         });
-        return { ...result, services, diagnostics: services.diagnostics };
+        return { ...result, services, diagnostics: [...projectTrustDiagnostics, ...services.diagnostics] };
     };
 }
 function createPiWebEditToolDefinition(cwd) {
@@ -354,8 +520,24 @@ export class PiSessionService {
         this.activities = new Map();
         /** Runtime-identity gate held while Pi may await abandoned-branch summarization. */
         this.treeNavigations = new WeakSet();
+        /**
+         * Bare live leaf selected without an appended summary entry. Recording that
+         * leaf distinguishes the unpersisted move from a later runtime append that
+         * can anchor the selected branch on disk.
+         */
+        this.unpersistedTreeBranchLeaves = new WeakMap();
         /** Counts async operations that may append an entry before they settle. */
         this.sessionEntryMutationCounts = new WeakMap();
+        /** Settings-wide queue preventing enabled-model read/modify/write races across sessions. */
+        this.modelScopeMutationQueue = Promise.resolve();
+        /** Global and workspace-owned enabled-model states; live session scopes project one entry lazily. */
+        this.modelScopeStates = new Map();
+        /** Coalesces initialization reads independently for the global and each workspace scope. */
+        this.modelScopeInitializations = new Map();
+        /** Monotonic revision published for global scope changes and consumed by clients. */
+        this.modelScopeRevision = 0;
+        /** Last scope/catalog revision projected into each runtime, synchronized lazily on use. */
+        this.modelScopeCache = new WeakMap();
         /** Runtime/session-identity reservations for operations that must not overlap tree navigation. */
         this.treeExclusiveRuntimeOperationCounts = new WeakMap();
         this.treeExclusiveSessionOperationCounts = new Map();
@@ -379,6 +561,8 @@ export class PiSessionService {
          */
         this.subsessionNotifyArmed = new Map();
         this.notificationGenerationBySession = new WeakMap();
+        /** Last idle-poll transcript file resolution per runtime, throttled; entries die with their runtime. */
+        this.idleSessionFileResolutions = new WeakMap();
         /** The parked extension Promise resolvers behind the store's open dialogs. */
         this.dialogWaiters = new ExtensionDialogWaiters();
         this.pendingUnreadMutations = [];
@@ -398,6 +582,7 @@ export class PiSessionService {
         this.pendingExtensionDialogStore = deps.pendingExtensionDialogStore ?? new PendingExtensionDialogStore();
         this.extensionDialogsTimeoutMs = deps.extensionDialogsTimeoutMs ?? DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS;
         this.catalogRefreshStatus = deps.catalogRefreshStatus;
+        this.config = deps.config;
         this.unreadPublicationRetryInitialMs = Math.max(0, deps.unreadPublicationRetryDelayMs ?? DEFAULT_UNREAD_PUBLICATION_RETRY_MS);
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
         // Subsessions are gated behind their own flag, and they
@@ -678,17 +863,117 @@ export class PiSessionService {
         };
     }
     /**
-     * The models a session may pick from: its scoped set when model-scoped,
-     * otherwise the runtime's available snapshot. Refreshes the runtime catalog
-     * first so callers see newly configured providers and models. The refresh
-     * stays local (`allowNetwork: false`); network refreshes belong to the
-     * bounded background catalog refresher, not this request path.
+     * Resolve the settings domain for a session. Pi's settings manager deep-merges
+     * objects, but an `enabledModels` array in `.pi/settings.json` replaces the
+     * global array, so that workspace gets its own effective scope and is not
+     * affected by global picker edits.
+     */
+    modelScopeContext(session) {
+        const projectSettings = session.settingsManager.getProjectSettings?.() ?? {};
+        if (!Object.hasOwn(projectSettings, "enabledModels")) {
+            return { key: "global", source: "global", editable: true };
+        }
+        const workspace = canonicalizeStoredCwd(session.sessionManager.getCwd());
+        return { key: `workspace:${workspace}`, source: "workspace", editable: false };
+    }
+    /**
+     * Read the effective scope for one settings domain. Global sessions share one
+     * snapshot; project-overridden sessions share a snapshot keyed by workspace.
+     * Neither path enumerates or mutates other active sessions.
+     */
+    async modelScopeSnapshot(session, context = this.modelScopeContext(session)) {
+        const existing = this.modelScopeStates.get(context.key);
+        if (existing !== undefined)
+            return existing;
+        const pending = this.modelScopeInitializations.get(context.key);
+        if (pending !== undefined)
+            return pending;
+        const initialization = (async () => {
+            const enabledIds = await resolveEnabledModelIds(sessionScopeSource(session));
+            const snapshot = {
+                enabledIds: enabledIds === null ? null : [...enabledIds],
+                revision: 0,
+            };
+            this.modelScopeStates.set(context.key, snapshot);
+            return snapshot;
+        })();
+        this.modelScopeInitializations.set(context.key, initialization);
+        try {
+            return await initialization;
+        }
+        finally {
+            if (this.modelScopeInitializations.get(context.key) === initialization)
+                this.modelScopeInitializations.delete(context.key);
+        }
+    }
+    /**
+     * Project one settings-domain scope into one SDK session only when that
+     * session is used. `PiAgentSession` needs an in-memory array for cycling, but
+     * that array is a cache; the keyed snapshot above is the source of truth.
+     */
+    async synchronizeSessionModelScope(session, available) {
+        const context = this.modelScopeContext(session);
+        const snapshot = await this.modelScopeSnapshot(session, context);
+        const catalogKey = available.map(modelScopeId).join("\0");
+        const cached = this.modelScopeCache.get(session);
+        if (cached?.scopeKey === context.key && cached.revision === snapshot.revision && cached.catalogKey === catalogKey)
+            return;
+        session.setScopedModels(scopedModelsFromEnabledIds(available, snapshot.enabledIds, session.scopedModels));
+        this.modelScopeCache.set(session, { scopeKey: context.key, revision: snapshot.revision, catalogKey });
+    }
+    /**
+     * The models a session may pick from: its synchronized scoped set when
+     * model-scoped, otherwise the runtime's available snapshot. Refreshes the
+     * shared runtime catalog first so callers see newly configured providers and
+     * models. The refresh stays local (`allowNetwork: false`); network refreshes
+     * belong to the bounded background catalog refresher, not this request path.
      */
     async sessionModelCandidates(session) {
         await session.modelRuntime.refresh({ allowNetwork: false });
+        const available = session.modelRuntime.getAvailableSnapshot();
+        await this.synchronizeSessionModelScope(session, available);
         return session.scopedModels.length > 0
             ? session.scopedModels.map((scoped) => scoped.model)
-            : session.modelRuntime.getAvailableSnapshot();
+            : available;
+    }
+    /**
+     * The session machine's full available catalog with per-model enabled state,
+     * ordered enabled-first for scope semantics while retaining each model's
+     * natural catalog index for stable picker placement. The enabled state comes
+     * from the keyed scope snapshot rather than a session-local SettingsManager.
+     */
+    async enabledModelCatalog(session) {
+        await session.modelRuntime.refresh({ allowNetwork: false });
+        const available = session.modelRuntime.getAvailableSnapshot();
+        await this.synchronizeSessionModelScope(session, available);
+        const context = this.modelScopeContext(session);
+        const enabledIds = (await this.modelScopeSnapshot(session, context)).enabledIds;
+        return catalogWithEnabledFirst(available, enabledIds);
+    }
+    runModelScopeMutation(operation) {
+        const queued = this.modelScopeMutationQueue.then(operation);
+        this.modelScopeMutationQueue = queued.then(() => undefined, () => undefined);
+        return queued;
+    }
+    /** Persist one global enabled-model selection and publish its new revision. */
+    applyEnabledModelScope(session, available, enabledIds) {
+        const availableIds = available.map(modelScopeId);
+        const persisted = persistedEnabledModelPatterns(enabledIds, availableIds);
+        const nextState = {
+            // Pi normalizes a scope covering the complete current catalog to an
+            // omitted setting, which is the global canonical all-enabled state.
+            enabledIds: persisted === undefined ? null : enabledIds === null ? [] : [...enabledIds],
+            revision: ++this.modelScopeRevision,
+        };
+        session.settingsManager.setEnabledModels(persisted);
+        this.modelScopeStates.set("global", nextState);
+        session.setScopedModels(scopedModelsFromEnabledIds(available, nextState.enabledIds, session.scopedModels));
+        this.modelScopeCache.set(session, {
+            scopeKey: "global",
+            revision: nextState.revision,
+            catalogKey: available.map(modelScopeId).join("\0"),
+        });
+        this.events.publishGlobal({ type: "models.changed", revision: nextState.revision });
     }
     /**
      * Resolve a strict `provider/model-id` spec from a spawn tool against the
@@ -1254,10 +1539,14 @@ export class PiSessionService {
     }
     async messages(ref, page) {
         const session = await this.getOrOpen(ref);
-        return pageMessagesAtSafeBoundary(historyMessages(session), page);
+        return pageMessagesAtSafeBoundary(historyMessagesFromEntries(await this.readableSessionBranch(ref, session)), page);
     }
     async status(ref) {
-        return this.statusFromSession(await this.sessionForStatusOrDialogClose(ref));
+        const session = await this.sessionForStatusOrDialogClose(ref);
+        if (this.hasActiveWork(session))
+            return this.statusFromSession(session);
+        const branch = await this.readableSessionBranch(ref, session);
+        return this.statusFromSession(session, transcriptMessageCount(branch));
     }
     /**
      * Join-time snapshot of the in-flight assistant stream. The `seq` watermark and
@@ -1283,6 +1572,68 @@ export class PiSessionService {
         const models = await this.sessionModelCandidates(session);
         return models.map(modelToClientModel);
     }
+    async modelCatalog(ref) {
+        const session = await this.getOrOpen(ref);
+        const scope = this.modelScopeContext(session);
+        return (await this.enabledModelCatalog(session)).map((entry) => catalogEntryToClientModel(entry, scope.editable));
+    }
+    /**
+     * Add/remove one model to/from the global pi `enabledModels` scope. A
+     * workspace `.pi/settings.json` override remains authoritative for that
+     * workspace and is intentionally read-only in this picker.
+     */
+    async setModelEnabled(ref, provider, modelId, enabled) {
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        return this.runModelScopeMutation(async () => {
+            const scope = this.modelScopeContext(session);
+            if (scope.source !== "global")
+                throw new Error("Model availability is controlled by this workspace's .pi/settings.json");
+            this.assertTreeNavigationInactive(session, "change enabled models");
+            await session.modelRuntime.refresh({ allowNetwork: false });
+            const currentIds = (await this.modelScopeSnapshot(session, scope)).enabledIds;
+            const available = session.modelRuntime.getAvailableSnapshot();
+            const availableIds = available.map(modelScopeId);
+            const targetId = `${provider}/${modelId}`;
+            if (!availableIds.includes(targetId))
+                throw new Error(`Model not found: ${targetId}`);
+            if (!enabled && session.model !== undefined && modelScopeId(session.model) === targetId) {
+                throw new Error("Current model cannot be disabled");
+            }
+            const nextIds = applyEnabledModelToggle(currentIds, availableIds, targetId, enabled);
+            this.assertTreeNavigationInactive(session, "change enabled models");
+            if (nextIds !== currentIds)
+                this.applyEnabledModelScope(session, available, nextIds);
+            // Respond from a fresh post-edit read so the response is exactly what
+            // GET models/catalog returns after the edit, including pi's normalizations.
+            return (await this.enabledModelCatalog(session)).map((entry) => catalogEntryToClientModel(entry));
+        });
+    }
+    /** Atomically expose every model or narrow the global enabled scope to the current model. */
+    async setModelScope(ref, mode) {
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        return this.runModelScopeMutation(async () => {
+            const scope = this.modelScopeContext(session);
+            if (scope.source !== "global")
+                throw new Error("Model availability is controlled by this workspace's .pi/settings.json");
+            this.assertTreeNavigationInactive(session, "change enabled models");
+            await session.modelRuntime.refresh({ allowNetwork: false });
+            const available = session.modelRuntime.getAvailableSnapshot();
+            const availableIds = available.map(modelScopeId);
+            let nextIds = null;
+            if (mode === "current") {
+                const current = session.model;
+                if (current === undefined || !availableIds.includes(modelScopeId(current))) {
+                    throw new Error("Current model is unavailable");
+                }
+                nextIds = [modelScopeId(current)];
+            }
+            this.assertTreeNavigationInactive(session, "change enabled models");
+            this.applyEnabledModelScope(session, available, nextIds);
+            return (await this.enabledModelCatalog(session)).map((entry) => catalogEntryToClientModel(entry));
+        });
+    }
     async setModel(ref, provider, modelId) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
@@ -1301,7 +1652,11 @@ export class PiSessionService {
     async cycleModel(ref, direction) {
         await this.assertWritable(ref);
         const session = await this.getOrOpen(ref);
-        const result = await this.runSessionEntryMutation(session, "change models", () => session.cycleModel(direction));
+        const result = await this.runModelScopeMutation(async () => {
+            await session.modelRuntime.refresh({ allowNetwork: false });
+            await this.synchronizeSessionModelScope(session, session.modelRuntime.getAvailableSnapshot());
+            return this.runSessionEntryMutation(session, "change models", () => session.cycleModel(direction));
+        });
         if (result === undefined)
             throw new Error(session.scopedModels.length > 0 ? "Only one model in scope" : "Only one model available");
         this.publishActivity(session, `model: ${result.model.id}`, "idle", result.model.provider);
@@ -1410,7 +1765,25 @@ export class PiSessionService {
             return [];
         await this.assertWritable(ref);
         const active = await this.getActive(ref);
-        return saveAttachmentsToWorkspace(active.runtime.cwd, parsed, folder === undefined ? {} : { folder });
+        const cwd = active.runtime.cwd;
+        // An explicit request folder wins; the config lookup below is only the
+        // fallback for folder-less calls (see workspaceAttachmentsConfig).
+        const effectiveFolder = folder ?? (await this.workspaceAttachmentsConfig(cwd)).defaultFolder;
+        return saveAttachmentsToWorkspace(cwd, parsed, effectiveFolder === undefined ? {} : { folder: effectiveFolder });
+    }
+    /**
+     * Fallback attachments config for save requests that omit an explicit
+     * folder: the live global config merged with the session cwd's own
+     * project-local override. Unlike `workspaceEffectiveConfig` in app.ts (which
+     * resolves from the owning project's path), this lookup keys off the cwd
+     * itself, so for secondary (worktree) workspaces it cannot see the owning
+     * project's override. The composer therefore always sends the
+     * workspace-effective folder it displayed explicitly; this cwd-based
+     * resolution only governs folder-less API calls.
+     */
+    async workspaceAttachmentsConfig(cwd) {
+        const globalConfig = this.config === undefined ? {} : (await this.config.read()).effectiveConfig;
+        return loadEffectiveProjectAttachmentsConfig(cwd, globalConfig);
     }
     async shell(ref, text) {
         await this.assertWritable(ref);
@@ -1475,18 +1848,53 @@ export class PiSessionService {
         // may enter this runtime until Pi's potentially asynchronous summary settles.
         this.treeNavigations.add(session);
         try {
-            if (session.sessionManager.getLeafId() !== request.expectedLeafId) {
+            const oldLeafId = session.sessionManager.getLeafId();
+            if (oldLeafId !== request.expectedLeafId) {
                 throw new Error("The session changed since /tree was opened. Reopen /tree and try again.");
             }
+            const activeEditableTargetParentId = activeEditableTreeTargetParentId(session.sessionManager, request.targetId, oldLeafId);
             this.publishActivity(session, options.summarize ? "summarizing branch" : "navigating session tree", "active");
             this.publishStatus(session);
-            const result = await session.navigateTree(request.targetId, options);
+            let result = await session.navigateTree(request.targetId, options);
+            if (activeEditableTargetParentId !== undefined
+                && !result.cancelled
+                && result.editorText === undefined
+                && result.summaryEntry === undefined
+                && session.sessionManager.getLeafId() === oldLeafId) {
+                // Supported Pi versions can return early when the target is already the
+                // leaf, before applying their user/custom-message edit semantics. Move
+                // to the target's parent and delegate again so Pi still owns editor-text
+                // extraction, agent-context rebuilding, and tree extension events.
+                setSessionTreeLeaf(session.sessionManager, activeEditableTargetParentId);
+                try {
+                    result = await session.navigateTree(request.targetId, options);
+                }
+                catch (error) {
+                    session.sessionManager.branch(request.targetId);
+                    throw error;
+                }
+                if (result.cancelled)
+                    session.sessionManager.branch(request.targetId);
+            }
             if (result.cancelled) {
                 if (this.isCurrentActiveSession(session)) {
                     this.publishActivity(session, result.aborted === true ? "branch summary aborted" : "tree navigation cancelled", "idle");
                 }
                 return { cancelled: true, ...(result.aborted === undefined ? {} : { aborted: result.aborted }) };
             }
+            if (result.summaryEntry !== undefined) {
+                // A summary entry durably identifies the selected branch as the file's
+                // newest leaf, superseding any earlier bare selection.
+                this.unpersistedTreeBranchLeaves.delete(session);
+            }
+            else {
+                const selectedLeafId = session.sessionManager.getLeafId();
+                if (selectedLeafId !== oldLeafId) {
+                    // SessionManager.branch()/resetLeaf() only move Pi's in-memory leaf.
+                    // Keep that branch authoritative until a later append makes disk agree.
+                    this.unpersistedTreeBranchLeaves.set(session, selectedLeafId);
+                }
+            }
             if (this.isCurrentActiveSession(session))
                 this.publishActivity(session, "session tree navigated", "idle");
             return { cancelled: false, ...(result.editorText === undefined ? {} : { editorText: result.editorText }) };
@@ -2097,6 +2505,63 @@ export class PiSessionService {
     async getOrOpen(ref) {
         return (await this.getActive(ref)).runtime.session;
     }
+    /**
+     * An idle runtime is only Pi Web's cached control view. Another Pi process may
+     * keep appending to the same JSONL file, so transcript reads must open a fresh
+     * read-only snapshot rather than serving that cached branch forever. Active
+     * runtimes remain authoritative and are never replaced, reloaded, or aborted.
+     */
+    async readableSessionBranch(ref, session) {
+        if (this.hasActiveWork(session) || this.sessionManager.readBranch === undefined)
+            return session.sessionManager.getBranch();
+        const sessionFile = session.sessionFile ?? session.sessionManager.getSessionFile();
+        const resolvedPath = sessionFile === undefined ? await this.idleSessionFilePath(ref, session) : undefined;
+        if (this.hasActiveWork(session))
+            return session.sessionManager.getBranch();
+        const path = sessionFile ?? resolvedPath;
+        if (path === undefined)
+            return session.sessionManager.getBranch();
+        const snapshot = await this.sessionManager.readBranch(path);
+        // No snapshot exists when the transcript file is absent (a session known
+        // by path but never persisted, or externally removed): the runtime branch
+        // is the only readable branch then.
+        if (snapshot === undefined)
+            return session.sessionManager.getBranch();
+        // Reading also yields. A prompt that started meanwhile must still win over
+        // the completed disk snapshot and its potentially older event watermark.
+        if (this.hasActiveWork(session))
+            return session.sessionManager.getBranch();
+        const selectedLeafId = this.unpersistedTreeBranchLeaves.get(session);
+        if (selectedLeafId !== undefined) {
+            const runtimeLeafId = session.sessionManager.getLeafId();
+            const selectedBranchIsAnchored = runtimeLeafId !== null
+                && runtimeLeafId !== selectedLeafId
+                && transcriptBranchIncludesEntry(snapshot, runtimeLeafId);
+            if (!selectedBranchIsAnchored)
+                return session.sessionManager.getBranch();
+            // A later runtime append now anchors the live selection in this persisted
+            // branch. Resume ordinary idle snapshots, including external descendants.
+            this.unpersistedTreeBranchLeaves.delete(session);
+        }
+        return snapshot;
+    }
+    /**
+     * Resolve the transcript file for an idle runtime that does not know one,
+     * at most once per {@link IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS}. The
+     * negative result (no file yet) is the hot case: a never-persisted session
+     * is polled every few seconds, and re-scanning its directory each tick is
+     * pure waste. `getActive` never uses this path, so prompt routing always
+     * sees a fresh resolution.
+     */
+    async idleSessionFilePath(ref, session) {
+        const cached = this.idleSessionFileResolutions.get(session);
+        const at = this.now().getTime();
+        if (cached !== undefined && at - cached.at < IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS)
+            return cached.path;
+        const match = await this.sessionManager.resolveSessionFile(ref.cwd, ref.id);
+        this.idleSessionFileResolutions.set(session, { at, path: match?.path });
+        return match?.path;
+    }
     async getActive(ref, options = {}) {
         const active = this.activeForRef(ref);
         if (active !== undefined)
@@ -2938,7 +3403,7 @@ export class PiSessionService {
         this.events.publish(session.sessionId, { type: "activity.update", activity });
         this.events.publishGlobal({ type: "activity.update", activity });
     }
-    statusFromSession(session) {
+    statusFromSession(session, messageCount = session.messages.length) {
         const stats = session.getSessionStats();
         const model = session.model === undefined ? undefined : modelToClientModel(session.model);
         const contextUsage = session.getContextUsage();
@@ -2955,7 +3420,7 @@ export class PiSessionService {
             isBashRunning: session.isBashRunning,
             pendingMessageCount: this.pendingMessageCount(session),
             queuedMessages: queuedMessagesFromSession(session, this.compactionQueuedMessages(session.sessionId)),
-            messageCount: session.messages.length,
+            messageCount,
             tokens: stats.tokens,
             cost: stats.cost,
             ...(contextUsage === undefined ? {} : { contextUsage }),
@@ -3040,6 +3505,20 @@ function modelToClientModel(model) {
         ...(reasoning === undefined ? {} : { reasoning }),
     };
 }
+/** The scope source pi's enabled-id precedence reads from: live scope, settings patterns, runtime catalog. */
+function sessionScopeSource(session) {
+    return { settingsManager: session.settingsManager, modelRuntime: session.modelRuntime, scopedModels: session.scopedModels };
+}
+function catalogEntryToClientModel(entry, editable = true) {
+    return {
+        ...modelToClientModel(entry.model),
+        provider: entry.model.provider,
+        id: entry.model.id,
+        enabled: entry.enabled,
+        catalogIndex: entry.catalogIndex,
+        ...(editable ? {} : { editable: false }),
+    };
+}
 function notificationIdentityForSession(session) {
     return {
         sessionId: session.sessionId,
@@ -3413,11 +3892,14 @@ function annotateAssistantThinkingLevel(message, thinkingLevel) {
     return { ...message, thinkingLevel };
 }
 function historyMessages(session) {
+    return historyMessagesFromEntries(session.sessionManager.getBranch());
+}
+function historyMessagesFromEntries(entries) {
     const messages = [];
     // Pi records the initial level at session creation and every later change, so
     // walking the branch yields the level in effect for each assistant message.
     let thinkingLevel;
-    for (const entry of session.sessionManager.getBranch()) {
+    for (const entry of entries) {
         if (!isRecord(entry))
             continue;
         if (entry["type"] === "message")
@@ -3436,6 +3918,39 @@ function historyMessages(session) {
     }
     return messages;
 }
+function transcriptMessageCount(entries) {
+    let count = 0;
+    for (const entry of entries) {
+        if (isRecord(entry) && entry["type"] === "message")
+            count += 1;
+    }
+    return count;
+}
+function activeEditableTreeTargetParentId(manager, targetId, activeLeafId) {
+    if (activeLeafId !== targetId)
+        return undefined;
+    const entry = manager.getBranch().at(-1);
+    if (!isRecord(entry) || entry["id"] !== targetId)
+        return undefined;
+    const isUserMessage = entry["type"] === "message"
+        && isRecord(entry["message"])
+        && entry["message"]["role"] === "user";
+    if (!isUserMessage && entry["type"] !== "custom_message")
+        return undefined;
+    const parentId = entry["parentId"];
+    if (parentId === targetId)
+        return undefined;
+    return parentId === null || typeof parentId === "string" ? parentId : undefined;
+}
+function setSessionTreeLeaf(manager, leafId) {
+    if (leafId === null)
+        manager.resetLeaf();
+    else
+        manager.branch(leafId);
+}
+function transcriptBranchIncludesEntry(entries, entryId) {
+    return entries.some((entry) => isRecord(entry) && entry["id"] === entryId);
+}
 /** custom entry type used to persist parent -> child subsession links outside LLM context. */
 const SUBSESSION_LINK_CUSTOM_TYPE = "pi-web.subsession.link";
 /** custom entry type used to mark a child as created by spawn_subsession. */