@jmfederico/pi-web 1.202608.2 → 1.202609.1

package/dist/server/sessions/piSessionService.js

@@ -1,19 +1,24 @@
 import { statSync } from "node:fs";
 import { join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEditToolDefinition, defineTool, hasTrustRequiringProjectResources, ProjectTrustStore, readStoredCredential, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEventBus, createEditToolDefinition, defineTool, hasTrustRequiringProjectResources, ProjectTrustStore, readStoredCredential, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { projectBrowserMessage } from "../browserMessageProjection.js";
 import { pageMessagesAtSafeBoundary } from "./messagePaging.js";
+import { clientSessionFirstMessagePreview } from "./clientSessionPreview.js";
 import { BUILTIN_COMMANDS } from "./builtinCommands.js";
 import { SessionCommandService } from "./sessionCommandService.js";
+import { SessionActivityMarker } from "./sessionActivityMarker.js";
 import { projectSessionTree } from "./sessionTreeProjection.js";
 import { SessionArchiveStore } from "./sessionArchiveStore.js";
 import { findArchiveCandidateByIdOrPrefix, planSessionArchiveTree } from "./sessionArchiveTree.js";
+import { PiSessionEventConnections } from "./piSessionEventConnections.js";
 import { deterministicSessionName, fallbackSessionName, generateShortSessionName } from "./sessionNameGenerator.js";
 import { computeEditPreview } from "./editPreview.js";
 import { attachmentsToInlineImages, saveAttachmentsToWorkspace } from "./attachmentService.js";
+import { loadEffectiveProjectAttachmentsConfig } from "../workspaces/projectPiWebConfig.js";
 import { parsePromptAttachments } from "../../shared/promptAttachments.js";
 import { ASK_USER_ANSWERS_CUSTOM_TYPE, SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
+import { parseSessionDefaults, parseSessionDefaultsUpdate } from "../../shared/sessionDefaults.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
 import { readSessionHeaderSummary } from "./sessionFileHeader.js";
 import { createAskUserToolDefinition } from "./askUserTool.js";
@@ -24,6 +29,7 @@ import { DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS } from "../../config.js";
 import { createSpawnSessionToolDefinition } from "./spawnSessionTool.js";
 import { createSubsessionToolDefinitions } from "./spawnSubsessionTool.js";
 import { buildTranscriptView } from "./subsessionTranscript.js";
+import { annotateAssistantThinkingLevel, historyMessagesFromEntries } from "./transcriptMessages.js";
 import { planSessionCleanup, summarizeSessionCleanupExecution } from "./sessionCleanup.js";
 import { SessionNotificationStore, } from "./sessionNotificationStore.js";
 import { plainTextTheme } from "./plainTextTheme.js";
@@ -47,6 +53,15 @@ const STARTUP_PHASE_EXTENSIONS = "Loading session extensions";
 const STARTUP_CONCURRENT_CATALOG_REFRESH = "provider model lists are refreshing";
 const MAX_UNREAD_PUBLICATION_RETRY_MS = 30_000;
 const MAX_PENDING_UNREAD_MUTATIONS = SESSION_UNREAD_LIMIT + 1;
+/**
+ * Upper bound on how often one idle runtime re-resolves its transcript file.
+ * A runtime created in memory and never persisted has no session file, so
+ * every poll would otherwise rescan the session directory; throttling keeps
+ * steady-state polling of such a session O(1). The window can only delay
+ * noticing a file the runtime did not write itself: once the runtime
+ * persists, `getSessionFile()` answers and this throttle is bypassed.
+ */
+const IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS = 30_000;
 function noop() {
     // Intentionally empty default unsubscribe callback.
 }
@@ -412,7 +427,7 @@ export function piWebResourceLoaderOptions(appendSystemPromptSections) {
         return undefined;
     return { appendSystemPromptOverride: (base) => [...base, ...appendSystemPromptSections] };
 }
-function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions, askUser, appendSystemPromptSections = []) {
+function createDefaultRuntimeFactory(sessionEvents, modelRuntime, sessionManagers, spawn, subsessions, askUser, appendSystemPromptSections = []) {
     const resourceLoaderOptions = piWebResourceLoaderOptions(appendSystemPromptSections);
     return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled }) => {
         // PI WEB always honors pi's project-trust model. When the workspace ships
@@ -425,6 +440,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
         // browser trust prompt, an untrusted project's resources are skipped
         // (matching `pi` run without a UI). Projects without trust-requiring
         // resources skip resolution entirely and are trusted, as before.
+        const eventBus = createEventBus();
         const projectTrustRequiring = hasTrustRequiringProjectResources(cwd);
         const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted: !projectTrustRequiring });
         // Pre-session-creation trust failures (`project_trust` handler errors)
@@ -436,7 +452,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
             agentDir,
             modelRuntime,
             settingsManager,
-            ...(resourceLoaderOptions === undefined ? {} : { resourceLoaderOptions }),
+            resourceLoaderOptions: { ...resourceLoaderOptions, eventBus },
             ...(projectTrustRequiring
                 ? {
                     resourceLoaderReloadOptions: {
@@ -470,6 +486,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
             ...(modelOptions.thinkingLevel === undefined ? {} : { thinkingLevel: modelOptions.thinkingLevel }),
             ...(modelOptions.scopedModels.length === 0 ? {} : { scopedModels: modelOptions.scopedModels }),
         });
+        sessionEvents.register(result.session, eventBus);
         return { ...result, services, diagnostics: [...projectTrustDiagnostics, ...services.diagnostics] };
     };
 }
@@ -510,6 +527,12 @@ export class PiSessionService {
         this.activities = new Map();
         /** Runtime-identity gate held while Pi may await abandoned-branch summarization. */
         this.treeNavigations = new WeakSet();
+        /**
+         * Bare live leaf selected without an appended summary entry. Recording that
+         * leaf distinguishes the unpersisted move from a later runtime append that
+         * can anchor the selected branch on disk.
+         */
+        this.unpersistedTreeBranchLeaves = new WeakMap();
         /** Counts async operations that may append an entry before they settle. */
         this.sessionEntryMutationCounts = new WeakMap();
         /** Settings-wide queue preventing enabled-model read/modify/write races across sessions. */
@@ -545,6 +568,8 @@ export class PiSessionService {
          */
         this.subsessionNotifyArmed = new Map();
         this.notificationGenerationBySession = new WeakMap();
+        /** Last idle-poll transcript file resolution per runtime, throttled; entries die with their runtime. */
+        this.idleSessionFileResolutions = new WeakMap();
         /** The parked extension Promise resolvers behind the store's open dialogs. */
         this.dialogWaiters = new ExtensionDialogWaiters();
         this.pendingUnreadMutations = [];
@@ -557,6 +582,10 @@ export class PiSessionService {
         this.spawnTargets = deps.spawnTargets;
         this.logger = deps.logger ?? noopLogger;
         this.now = deps.now ?? (() => new Date());
+        this.activityMarker = new SessionActivityMarker({
+            now: () => this.now().getTime(),
+            onError: (error) => { this.logger.info({ err: error }, "Could not update advisory session activity marker"); },
+        });
         this.notificationStore = deps.notificationStore ?? new SessionNotificationStore();
         this.unreadStore = deps.unreadStore ?? new SessionUnreadStore();
         this.onUnreadChanged = deps.onUnreadChanged;
@@ -564,12 +593,14 @@ export class PiSessionService {
         this.pendingExtensionDialogStore = deps.pendingExtensionDialogStore ?? new PendingExtensionDialogStore();
         this.extensionDialogsTimeoutMs = deps.extensionDialogsTimeoutMs ?? DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS;
         this.catalogRefreshStatus = deps.catalogRefreshStatus;
+        this.config = deps.config;
         this.unreadPublicationRetryInitialMs = Math.max(0, deps.unreadPublicationRetryDelayMs ?? DEFAULT_UNREAD_PUBLICATION_RETRY_MS);
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
         // Subsessions are gated behind their own flag, and they
         // also require the spawn capability (they share its project-scope resolver).
         const subsessionsActive = this.spawnTargets !== undefined && deps.subsessionsEnabled === true;
-        this.createRuntime = deps.createRuntime ?? createDefaultRuntimeFactory(this.modelRuntime, this.sessionManager, this.spawnTargets === undefined ? undefined : (input) => this.spawnSession(input), !subsessionsActive ? undefined : {
+        this.sessionEvents = deps.sessionEvents ?? new PiSessionEventConnections();
+        this.createRuntime = deps.createRuntime ?? createDefaultRuntimeFactory(this.sessionEvents, this.modelRuntime, this.sessionManager, this.spawnTargets === undefined ? undefined : (input) => this.spawnSession(input), !subsessionsActive ? undefined : {
             spawn: (input) => this.spawnSubsession(input),
             list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
             check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
@@ -713,7 +744,7 @@ export class PiSessionService {
             finally {
                 await active.runtime.dispose();
             }
-        }));
+        })).finally(() => this.activityMarker.dispose());
         await this.publishUnreadMutations([]);
     }
     async list(cwd) {
@@ -729,14 +760,48 @@ export class PiSessionService {
         this.workspaceActivity?.reconcileSessionActivity(cwd, reconcilableSessionIds);
         await this.publishUnreadMutations(this.unreadStore.reconcileCwd(canonicalizeStoredCwd(cwd), reconcilableSessionIds));
         const archivedSessions = archivedForCwd
-            .sort(compareArchivedRecords)
             .map((record) => clientSessionFromArchivedRecord(record, sessionsById.get(record.sessionId)))
-            .filter(isDefined);
+            .filter(isDefined)
+            .sort((a, b) => Date.parse(b.modified) - Date.parse(a.modified));
         return [...unarchivedSessions, ...archivedSessions];
     }
     async start(cwd, options = {}) {
         return this.startSession(cwd, options);
     }
+    /** Publish a host-owned conversation without submitting an initial prompt. */
+    async createHostedSession(cwd, signal) {
+        const created = await this.startManagedSession(cwd, signal);
+        return Object.freeze({ id: created.id });
+    }
+    /** Atomically start and prompt one visible host-owned, non-delegating session. */
+    async startOneShotRun(cwd, text, signal) {
+        const promptText = requirePromptText(text);
+        return this.startManagedSession(cwd, signal, promptText);
+    }
+    async startManagedSession(cwd, signal, promptText) {
+        signal.throwIfAborted();
+        const active = await this.create(this.sessionManager.create(cwd), cwd, { startupIntent: "create", creationProvenance: "host-one-shot", startupSignal: signal });
+        const { session } = active.runtime;
+        try {
+            signal.throwIfAborted();
+            if (promptText !== undefined)
+                this.maybeGenerateSessionName(session, promptText);
+            const created = this.announceCreatedSession(active, cwd);
+            // Publication transfers lifetime ownership to normal hosting. Plugin
+            // cancellation after this point must not abort this or later user work.
+            const completion = promptText === undefined ? Promise.resolve() : this.submitInitialRunPrompt(session, promptText);
+            return Object.freeze({ id: created.id, completion });
+        }
+        catch (error) {
+            try {
+                await this.closeActive(session.sessionId);
+            }
+            catch (cleanupError) {
+                throw new AggregateError([error, cleanupError], `Failed to clean up managed session ${session.sessionId} after startup failed`, { cause: cleanupError });
+            }
+            throw error;
+        }
+    }
     async startSession(cwd, options) {
         const active = await this.create(this.sessionManager.create(cwd, options.parentSession === undefined ? undefined : { parentSession: options.parentSession }), cwd, {
             startupIntent: "create",
@@ -745,6 +810,9 @@ export class PiSessionService {
             ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
             ...(options.creationProvenance === undefined ? {} : { creationProvenance: options.creationProvenance }),
         });
+        return this.announceCreatedSession(active, cwd, options.parentSession);
+    }
+    announceCreatedSession(active, cwd, parentSession) {
         const { session } = active.runtime;
         const created = {
             id: session.sessionId,
@@ -757,7 +825,7 @@ export class PiSessionService {
             firstMessage: "",
             // Include the parent so listeners can nest the new session in the tree
             // immediately, instead of showing it flat until the next reload.
-            ...(options.parentSession === undefined ? {} : { parentSessionPath: options.parentSession }),
+            ...(parentSession === undefined ? {} : { parentSessionPath: parentSession }),
         };
         // Broadcast so other clients (and the spawning agent's UI) can add the new
         // session to their list without a manual reload.
@@ -1095,8 +1163,12 @@ export class PiSessionService {
      * `async` so a rejected dialog becomes a rejection rather than a synchronous
      * throw from a promise-returning method.
      */
-    async openExtensionDialog(session, request, opts) {
-        const signal = opts?.signal;
+    async openExtensionDialog(session, request, opts, startupSignal) {
+        const signal = opts?.signal === undefined
+            ? startupSignal
+            : startupSignal === undefined
+                ? opts.signal
+                : AbortSignal.any([opts.signal, startupSignal]);
         // A pre-aborted signal dismisses the dialog before it ever opens.
         if (signal?.aborted === true)
             return extensionDialogCancelValue(request.kind);
@@ -1520,10 +1592,15 @@ export class PiSessionService {
     }
     async messages(ref, page) {
         const session = await this.getOrOpen(ref);
-        return pageMessagesAtSafeBoundary(historyMessages(session), page);
+        return pageMessagesAtSafeBoundary(historyMessagesFromEntries(await this.readableSessionBranch(ref, session)), page);
     }
     async status(ref) {
-        return this.statusFromSession(await this.sessionForStatusOrDialogClose(ref));
+        const session = await this.sessionForStatusOrDialogClose(ref);
+        await this.activityMarker.refresh(session.sessionFile, this.hasActiveWork(session));
+        if (this.hasActiveWork(session))
+            return this.statusFromSession(session);
+        const branch = await this.readableSessionBranch(ref, session);
+        return this.statusFromSession(session, transcriptMessageCount(branch));
     }
     /**
      * Join-time snapshot of the in-flight assistant stream. The `seq` watermark and
@@ -1544,6 +1621,47 @@ export class PiSessionService {
             : annotateAssistantThinkingLevel(projectBrowserMessage(streamingMessage), session.thinkingLevel);
         return { seq, partial };
     }
+    async getSessionDefaults(ref) {
+        await this.getOrOpen(ref);
+        const settings = SettingsManager.create(ref.cwd, this.agentDir);
+        await settings.reload();
+        this.assertDefaultsSettingsHealthy(settings);
+        // Do not use merged getters: workspace overrides are not global pins.
+        return parseSessionDefaults(settings.getGlobalSettings());
+    }
+    async setSessionDefaults(ref, defaults) {
+        const update = parseSessionDefaultsUpdate({ ...defaults });
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        return this.runModelScopeMutation(async () => {
+            // A separate manager avoids mutating the active session's settings cache.
+            const settings = SettingsManager.create(ref.cwd, this.agentDir);
+            await settings.reload();
+            this.assertDefaultsSettingsHealthy(settings);
+            if (update.provider !== undefined && update.modelId !== undefined) {
+                await session.modelRuntime.refresh({ allowNetwork: false });
+                const target = `${update.provider}/${update.modelId}`;
+                const enabledIds = await resolveEnabledModelIds({ settingsManager: settings, modelRuntime: session.modelRuntime, scopedModels: [] });
+                if (!session.modelRuntime.getAvailableSnapshot().some((model) => modelScopeId(model) === target)) {
+                    throw new Error(`Model not found: ${target}`);
+                }
+                if (enabledIds !== null && !enabledIds.includes(target))
+                    throw new Error(`Model is not enabled: ${target}`);
+                settings.setDefaultModelAndProvider(update.provider, update.modelId);
+            }
+            else if (update.thinkingLevel !== undefined) {
+                settings.setDefaultThinkingLevel(update.thinkingLevel);
+            }
+            await settings.flush();
+            this.assertDefaultsSettingsHealthy(settings);
+            return parseSessionDefaults(settings.getGlobalSettings());
+        });
+    }
+    assertDefaultsSettingsHealthy(settings) {
+        const errors = settings.drainErrors();
+        if (errors.length > 0)
+            throw new Error(`Session defaults settings failed: ${errors.map(({ error }) => error.message).join("; ")}`);
+    }
     async availableModels(ref) {
         const session = await this.getOrOpen(ref);
         const models = await this.sessionModelCandidates(session);
@@ -1677,7 +1795,12 @@ export class PiSessionService {
             commands.push({ name: command.invocationName, ...(command.description === undefined ? {} : { description: command.description }), source: "extension" });
         }
         for (const template of session.promptTemplates) {
-            commands.push({ name: template.name, ...(template.description === undefined ? {} : { description: template.description }), source: "prompt" });
+            commands.push({
+                name: template.name,
+                ...(template.description === undefined ? {} : { description: template.description }),
+                ...(template.argumentHint === undefined ? {} : { argumentHint: template.argumentHint }),
+                source: "prompt",
+            });
         }
         for (const skill of session.resourceLoader.getSkills().skills) {
             commands.push({ name: `skill:${skill.name}`, ...(skill.description === undefined ? {} : { description: skill.description }), source: "skill" });
@@ -1717,18 +1840,69 @@ export class PiSessionService {
         void this.submitPrompt(session, promptText, behavior, images, echoUserMessage);
     }
     submitPrompt(session, text, behavior, images = [], echoUserMessage = true) {
+        return this.beginPromptSubmission(session, text, behavior, images, echoUserMessage).catch(() => undefined);
+    }
+    beginPromptSubmission(session, text, behavior, images = [], echoUserMessage = true) {
         this.publishActivity(session, behavior === "steer" ? "steering queued" : behavior === "followUp" ? "message queued" : "prompt accepted", "active");
         if (behavior === undefined && echoUserMessage)
             this.events.publish(session.sessionId, { type: "message.append", message: userMessage(text, images) });
         const promptOptions = buildPromptOptions(behavior, images);
-        const promptPromise = this.runSessionEntryMutation(session, "send a prompt", () => session.prompt(text, promptOptions)).catch((error) => {
+        const promptPromise = this.runSessionEntryMutation(session, "send a prompt", () => session.prompt(text, promptOptions));
+        void promptPromise.catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             this.publishActivity(session, "error", "error", message);
             this.events.publish(session.sessionId, { type: "session.error", message });
         });
-        void promptPromise;
         return promptPromise;
     }
+    async submitInitialRunPrompt(session, text) {
+        let failure;
+        let settled = false;
+        let sawInitialUserMessage = false;
+        const unsubscribe = session.subscribe((event) => {
+            if (settled || !isRecord(event))
+                return;
+            if (event["type"] === "agent_settled") {
+                // Freeze the initial outcome before a later user submission can change it.
+                settled = true;
+                return;
+            }
+            if (event["type"] === "auto_retry_end" && event["success"] === false && event["finalError"] === "Retry cancelled") {
+                // Native Pi cancels retry sleep without an aborted assistant message.
+                failure = new DOMException("Initial PI session run was aborted", "AbortError");
+                return;
+            }
+            const message = event["message"];
+            if (!isRecord(message))
+                return;
+            if (event["type"] === "message_start" && message["role"] === "user") {
+                // Pi can drain a queued user follow-up inside the same prompt promise.
+                // Its outcome belongs to that later submission, not this launcher.
+                if (sawInitialUserMessage)
+                    settled = true;
+                sawInitialUserMessage = true;
+                return;
+            }
+            if (event["type"] !== "message_end" || message["role"] !== "assistant")
+                return;
+            // A successful retry supersedes a transient provider failure. Pi's
+            // prompt promise can fulfill even when the final assistant is an error.
+            const reason = message["stopReason"];
+            failure = reason === "aborted"
+                ? new DOMException("Initial PI session run was aborted", "AbortError")
+                : reason === "error"
+                    ? new Error(typeof message["errorMessage"] === "string" ? message["errorMessage"] : "Initial PI session run failed")
+                    : undefined;
+        });
+        try {
+            await this.beginPromptSubmission(session, text, undefined);
+            if (failure !== undefined)
+                throw failure;
+        }
+        finally {
+            unsubscribe();
+        }
+    }
     enqueuePromptDuringCompaction(session, text, kind, images = [], echoUserMessage = true) {
         const queue = this.compactionPromptQueues.get(session.sessionId) ?? [];
         queue.push({ kind, text, ...(images.length > 0 ? { images } : {}), ...(echoUserMessage ? {} : { echoUserMessage: false }) });
@@ -1742,7 +1916,25 @@ export class PiSessionService {
             return [];
         await this.assertWritable(ref);
         const active = await this.getActive(ref);
-        return saveAttachmentsToWorkspace(active.runtime.cwd, parsed, folder === undefined ? {} : { folder });
+        const cwd = active.runtime.cwd;
+        // An explicit request folder wins; the config lookup below is only the
+        // fallback for folder-less calls (see workspaceAttachmentsConfig).
+        const effectiveFolder = folder ?? (await this.workspaceAttachmentsConfig(cwd)).defaultFolder;
+        return saveAttachmentsToWorkspace(cwd, parsed, effectiveFolder === undefined ? {} : { folder: effectiveFolder });
+    }
+    /**
+     * Fallback attachments config for save requests that omit an explicit
+     * folder: the live global config merged with the session cwd's own
+     * project-local override. Unlike `workspaceEffectiveConfig` in app.ts (which
+     * resolves from the owning project's path), this lookup keys off the cwd
+     * itself, so for secondary (worktree) workspaces it cannot see the owning
+     * project's override. The composer therefore always sends the
+     * workspace-effective folder it displayed explicitly; this cwd-based
+     * resolution only governs folder-less API calls.
+     */
+    async workspaceAttachmentsConfig(cwd) {
+        const globalConfig = this.config === undefined ? {} : (await this.config.read()).effectiveConfig;
+        return loadEffectiveProjectAttachmentsConfig(cwd, globalConfig);
     }
     async shell(ref, text) {
         await this.assertWritable(ref);
@@ -1807,18 +1999,60 @@ export class PiSessionService {
         // may enter this runtime until Pi's potentially asynchronous summary settles.
         this.treeNavigations.add(session);
         try {
-            if (session.sessionManager.getLeafId() !== request.expectedLeafId) {
+            const oldLeafId = session.sessionManager.getLeafId();
+            if (oldLeafId !== request.expectedLeafId) {
                 throw new Error("The session changed since /tree was opened. Reopen /tree and try again.");
             }
+            const activeEditableTargetParentId = activeEditableTreeTargetParentId(session.sessionManager, request.targetId, oldLeafId);
             this.publishActivity(session, options.summarize ? "summarizing branch" : "navigating session tree", "active");
             this.publishStatus(session);
-            const result = await session.navigateTree(request.targetId, options);
+            let result = await session.navigateTree(request.targetId, options);
+            if (activeEditableTargetParentId !== undefined
+                && !result.cancelled
+                && result.editorText === undefined
+                && result.summaryEntry === undefined
+                && session.sessionManager.getLeafId() === oldLeafId) {
+                // Supported Pi versions can return early when the target is already the
+                // leaf, before applying their user/custom-message edit semantics. Move
+                // to the target's parent and delegate again so Pi still owns editor-text
+                // extraction, agent-context rebuilding, and tree extension events.
+                setSessionTreeLeaf(session.sessionManager, activeEditableTargetParentId);
+                try {
+                    result = await session.navigateTree(request.targetId, options);
+                }
+                catch (error) {
+                    session.sessionManager.branch(request.targetId);
+                    throw error;
+                }
+                if (result.cancelled)
+                    session.sessionManager.branch(request.targetId);
+            }
             if (result.cancelled) {
                 if (this.isCurrentActiveSession(session)) {
                     this.publishActivity(session, result.aborted === true ? "branch summary aborted" : "tree navigation cancelled", "idle");
                 }
                 return { cancelled: true, ...(result.aborted === undefined ? {} : { aborted: result.aborted }) };
             }
+            if (session.sessionManager.getLeafId() !== oldLeafId) {
+                // Questions belong to the position we left. Close them for every browser
+                // without appending a cancellation message or waking the rewound session.
+                const outcome = this.pendingAskStore.cancelOpen(session.sessionId);
+                if (outcome !== undefined)
+                    this.publishAskClosed(session.sessionId, outcome);
+            }
+            if (result.summaryEntry !== undefined) {
+                // A summary entry durably identifies the selected branch as the file's
+                // newest leaf, superseding any earlier bare selection.
+                this.unpersistedTreeBranchLeaves.delete(session);
+            }
+            else {
+                const selectedLeafId = session.sessionManager.getLeafId();
+                if (selectedLeafId !== oldLeafId) {
+                    // SessionManager.branch()/resetLeaf() only move Pi's in-memory leaf.
+                    // Keep that branch authoritative until a later append makes disk agree.
+                    this.unpersistedTreeBranchLeaves.set(session, selectedLeafId);
+                }
+            }
             if (this.isCurrentActiveSession(session))
                 this.publishActivity(session, "session tree navigated", "idle");
             return { cancelled: false, ...(result.editorText === undefined ? {} : { editorText: result.editorText }) };
@@ -2246,10 +2480,12 @@ export class PiSessionService {
     async archiveStoreArchiveMany(inputs) {
         if (inputs.length === 0)
             return [];
+        // Work from the bottom of the activity-ordered list, using metadata already loaded.
+        const oldestFirst = [...inputs].sort((a, b) => Date.parse(a.modified) - Date.parse(b.modified));
         if (this.archiveStore.archiveMany !== undefined)
-            return this.archiveStore.archiveMany(inputs);
+            return this.archiveStore.archiveMany(oldestFirst);
         const records = [];
-        for (const input of inputs)
+        for (const input of oldestFirst)
             records.push(await this.archiveStore.archive(input));
         return records;
     }
@@ -2397,6 +2633,7 @@ export class PiSessionService {
             await this.abortSessionOperations(active.runtime.session);
         }
         finally {
+            await this.activityMarker.release(active.runtime.session.sessionFile);
             await active.runtime.dispose();
         }
     }
@@ -2429,8 +2666,68 @@ export class PiSessionService {
     async getOrOpen(ref) {
         return (await this.getActive(ref)).runtime.session;
     }
+    /**
+     * An idle runtime is only Pi Web's cached control view. Another Pi process may
+     * keep appending to the same JSONL file, so transcript reads must open a fresh
+     * read-only snapshot rather than serving that cached branch forever. Active
+     * runtimes remain authoritative and are never replaced, reloaded, or aborted.
+     */
+    async readableSessionBranch(ref, session) {
+        if (this.hasActiveWork(session) || this.sessionManager.readBranch === undefined)
+            return session.sessionManager.getBranch();
+        const sessionFile = session.sessionFile ?? session.sessionManager.getSessionFile();
+        const resolvedPath = sessionFile === undefined ? await this.idleSessionFilePath(ref, session) : undefined;
+        if (this.hasActiveWork(session))
+            return session.sessionManager.getBranch();
+        const path = sessionFile ?? resolvedPath;
+        if (path === undefined)
+            return session.sessionManager.getBranch();
+        const snapshot = await this.sessionManager.readBranch(path);
+        // No snapshot exists when the transcript file is absent (a session known
+        // by path but never persisted, or externally removed): the runtime branch
+        // is the only readable branch then.
+        if (snapshot === undefined)
+            return session.sessionManager.getBranch();
+        // Reading also yields. A prompt that started meanwhile must still win over
+        // the completed disk snapshot and its potentially older event watermark.
+        if (this.hasActiveWork(session))
+            return session.sessionManager.getBranch();
+        const selectedLeafId = this.unpersistedTreeBranchLeaves.get(session);
+        if (selectedLeafId !== undefined) {
+            const runtimeLeafId = session.sessionManager.getLeafId();
+            const selectedBranchIsAnchored = runtimeLeafId !== null
+                && runtimeLeafId !== selectedLeafId
+                && transcriptBranchIncludesEntry(snapshot, runtimeLeafId);
+            if (!selectedBranchIsAnchored)
+                return session.sessionManager.getBranch();
+            // A later runtime append now anchors the live selection in this persisted
+            // branch. Resume ordinary idle snapshots, including external descendants.
+            this.unpersistedTreeBranchLeaves.delete(session);
+        }
+        return snapshot;
+    }
+    /**
+     * Resolve the transcript file for an idle runtime that does not know one,
+     * at most once per {@link IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS}. The
+     * negative result (no file yet) is the hot case: a never-persisted session
+     * is polled every few seconds, and re-scanning its directory each tick is
+     * pure waste. `getActive` never uses this path, so prompt routing always
+     * sees a fresh resolution.
+     */
+    async idleSessionFilePath(ref, session) {
+        const cached = this.idleSessionFileResolutions.get(session);
+        const at = this.now().getTime();
+        if (cached !== undefined && at - cached.at < IDLE_SESSION_FILE_RESOLUTION_THROTTLE_MS)
+            return cached.path;
+        const match = await this.sessionManager.resolveSessionFile(ref.cwd, ref.id);
+        this.idleSessionFileResolutions.set(session, { at, path: match?.path });
+        return match?.path;
+    }
     async getActive(ref, options = {}) {
         const active = this.activeForRef(ref);
+        const pending = this.pendingSessionOpens.get(JSON.stringify([canonicalizeStoredCwd(ref.cwd), active?.runtime.session.sessionId ?? ref.id]));
+        if (pending !== undefined)
+            return pending.promise;
         if (active !== undefined)
             return active;
         const archived = await this.getArchived(ref);
@@ -2448,13 +2745,13 @@ export class PiSessionService {
         return this.openExistingSession(match.id, match.cwd, () => this.sessionManager.open(match.path), options);
     }
     openExistingSession(sessionId, cwd, openSessionManager, options = {}) {
-        const active = this.activeForRef({ id: sessionId, cwd });
-        if (active !== undefined)
-            return Promise.resolve(active);
         const key = JSON.stringify([canonicalizeStoredCwd(cwd), sessionId]);
         const existing = this.pendingSessionOpens.get(key);
         if (existing !== undefined)
             return existing.promise;
+        const active = this.activeForRef({ id: sessionId, cwd });
+        if (active !== undefined)
+            return Promise.resolve(active);
         const pending = {
             sessionId,
             promise: this.create(openSessionManager(), cwd, options),
@@ -2534,18 +2831,27 @@ export class PiSessionService {
      * first is both the slowest phase and one that can fail on its own; a clear
      * that only ran for the later phases would leave a stale label behind.
      */
-    async create(sessionManager, cwd, options = {}) {
+    create(sessionManager, cwd, options = {}) {
         const startup = this.startupProgress(sessionManager, options.startupIntent ?? "open", options.startupToken);
-        try {
-            return await this.createSessionRuntime(sessionManager, cwd, options, startup);
-        }
-        finally {
+        const key = JSON.stringify([canonicalizeStoredCwd(cwd), sessionManager.getSessionId()]);
+        // Early native observation must not admit ordinary operations before
+        // session_start finishes. Track new sessions as well as on-demand opens so
+        // close/dispose wait for startup before tearing down its runtime.
+        const pending = {
+            sessionId: sessionManager.getSessionId(),
+            promise: this.createSessionRuntime(sessionManager, cwd, options, startup),
+        };
+        pending.promise = pending.promise.finally(() => {
             startup.end();
-        }
+            if (this.pendingSessionOpens.get(key) === pending)
+                this.pendingSessionOpens.delete(key);
+        });
+        this.pendingSessionOpens.set(key, pending);
+        return pending.promise;
     }
     async createSessionRuntime(sessionManager, cwd, options, startup) {
         startup.report(STARTUP_PHASE_RUNTIME);
-        const delegationToolsEnabled = options.creationProvenance !== "tracked-subsession"
+        const delegationToolsEnabled = options.creationProvenance === undefined
             && await sessionAllowsDelegationTools(sessionManager, this.sessionManager);
         const runtime = await this.createAgentRuntime(this.createRuntime, {
             cwd,
@@ -2557,6 +2863,11 @@ export class PiSessionService {
         });
         const active = { runtime, unsubscribe: noop };
         let boundSession = runtime.session;
+        const startupSignal = options.startupSignal;
+        const cancelStartup = () => { this.endSessionExtensionDialogs(boundSession.sessionId); };
+        if (startupSignal !== undefined && !startupSignal.aborted) {
+            startupSignal.addEventListener("abort", cancelStartup, { once: true });
+        }
         let notificationGeneration = options.notificationGeneration;
         let notificationOwnership = options.notifications === "disabled"
             ? "disabled"
@@ -2579,15 +2890,20 @@ export class PiSessionService {
         if (notificationGeneration !== undefined)
             this.notificationGenerationBySession.set(runtime.session, notificationGeneration);
         try {
+            startupSignal?.throwIfAborted();
             if (options.creationProvenance === "tracked-subsession") {
                 await this.publishUnreadMutations(this.unreadStore.excludeSession(runtime.session.sessionId, canonicalizeStoredCwd(runtime.session.sessionManager.getCwd())));
             }
             else {
                 await this.recoverSubsessionTrackingForOpenedSession(runtime.session);
             }
+            startupSignal?.throwIfAborted();
             startup.report(STARTUP_PHASE_EXTENSIONS);
-            await this.bindSessionExtensions(runtime.session, notificationGeneration);
+            // session_start hooks use the same native agent as ordinary prompts.
+            // Observe them before binding extensions, including startup messages.
             this.bindRuntime(active);
+            await this.bindSessionExtensions(runtime.session, notificationGeneration, startupSignal);
+            startupSignal?.throwIfAborted();
             runtime.setRebindSession(async (session) => {
                 const priorGeneration = notificationGeneration;
                 let candidateGeneration;
@@ -2619,6 +2935,7 @@ export class PiSessionService {
                     throw error;
                 }
             });
+            startupSignal?.throwIfAborted();
             this.active.set(runtime.session.sessionId, active);
             if (notificationOwnership === "replacement" && notificationGeneration !== undefined) {
                 this.publishNotificationMutations(this.notificationStore.commitReplacement(notificationGeneration));
@@ -2662,13 +2979,16 @@ export class PiSessionService {
             }
             throw error;
         }
+        finally {
+            startupSignal?.removeEventListener("abort", cancelStartup);
+        }
     }
-    async bindSessionExtensions(session, generation) {
-        const uiContext = this.sessionUiContext(session, generation);
-        // A `session_start` hook can park this bind on a dialog the browser has
-        // not answered yet. On the initial create/open path the session becomes
-        // active only after this returns, so register it for the duration: the
-        // answer that unblocks startup has to be reachable while it waits.
+    async bindSessionExtensions(session, generation, startupSignal) {
+        const startupDialogs = { signal: startupSignal };
+        const uiContext = this.sessionUiContext(session, generation, startupDialogs);
+        // A session_start hook can park this bind on a browser dialog. Keep
+        // startup lookup and cancellation available for the duration of the bind,
+        // including paths which resolve a dialog before session creation returns.
         this.startupSessions.set(session.sessionId, session);
         try {
             await session.bindExtensions({
@@ -2682,13 +3002,16 @@ export class PiSessionService {
             });
         }
         finally {
+            // Even a captured startup UI context must not carry plugin cancellation
+            // into later user turns after startup has finished.
+            startupDialogs.signal = undefined;
             this.startupSessions.delete(session.sessionId);
         }
     }
     replaceSessionNotificationContext(session, generation) {
         session.extensionRunner.setUIContext(this.sessionUiContext(session, generation), "rpc");
     }
-    sessionUiContext(session, generation) {
+    sessionUiContext(session, generation, startupDialogs) {
         const baseUiContext = session.extensionRunner.getUIContext();
         const notify = (message, type) => {
             if (generation === undefined) {
@@ -2714,13 +3037,13 @@ export class PiSessionService {
                 if (property === "theme")
                     return plainTextTheme;
                 if (property === "confirm") {
-                    return (title, message, opts) => this.openExtensionDialog(session, { kind: "confirm", title, message }, opts);
+                    return (title, message, opts) => this.openExtensionDialog(session, { kind: "confirm", title, message }, opts, startupDialogs?.signal);
                 }
                 if (property === "select") {
-                    return (title, options, opts) => this.openExtensionDialog(session, { kind: "select", title, options }, opts);
+                    return (title, options, opts) => this.openExtensionDialog(session, { kind: "select", title, options }, opts, startupDialogs?.signal);
                 }
                 if (property === "input") {
-                    return (title, placeholder, opts) => this.openExtensionDialog(session, { kind: "input", title, placeholder }, opts);
+                    return (title, placeholder, opts) => this.openExtensionDialog(session, { kind: "input", title, placeholder }, opts, startupDialogs?.signal);
                 }
                 const value = Reflect.get(target, property, receiver);
                 return value;
@@ -2842,6 +3165,16 @@ export class PiSessionService {
         this.unreadPublicationRetryTimer = undefined;
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
     }
+    connectSessionEvents(ref, lifetime) {
+        const active = this.active.get(ref.id);
+        if (active?.runtime.session.sessionId !== ref.id
+            || !cwdPathsEqual(active.runtime.session.sessionManager.getCwd(), ref.cwd)) {
+            throw new Error("Selected session is not hosted in this workspace on this machine");
+        }
+        if (this.startupSessions.has(ref.id))
+            throw new Error("Selected session is still initializing its extensions");
+        return this.sessionEvents.connect(active.runtime.session, lifetime);
+    }
     bindRuntime(active, session = active.runtime.session) {
         active.unsubscribe();
         for (const [sessionId, candidate] of this.active.entries()) {
@@ -2851,7 +3184,7 @@ export class PiSessionService {
                     this.clearCompactionPromptQueue(sessionId);
             }
         }
-        active.unsubscribe = session.subscribe((event) => {
+        const unsubscribe = session.subscribe((event) => {
             this.events.publish(session.sessionId, toClientEvent(event, session.thinkingLevel));
             this.publishActivityForEvent(session, event);
             const eventType = getString(event, "type");
@@ -2864,6 +3197,10 @@ export class PiSessionService {
             this.publishStatus(session);
             this.updateSubsessionTracking(session);
         });
+        active.unsubscribe = () => {
+            this.sessionEvents.close(session);
+            unsubscribe();
+        };
         this.active.set(session.sessionId, active);
     }
     scheduleCompactionQueueDrain(sessionId, delayMs = 0) {
@@ -3025,6 +3362,7 @@ export class PiSessionService {
             // the session still reports active work transiently, so the event-driven
             // latch may not fire. The heartbeat re-checks once the session settles.
             this.updateSubsessionTracking(session);
+            void this.refreshActivityMarker(session);
             const activity = this.activities.get(session.sessionId);
             if (!this.hasActiveWork(session)) {
                 if (activity?.phase === "active")
@@ -3251,7 +3589,18 @@ export class PiSessionService {
         this.events.publishGlobal({ type: "activity.update", activity });
         this.observeUnreadActivityState(session);
     }
+    async refreshActivityMarker(session) {
+        if (this.active.get(session.sessionId)?.runtime.session !== session)
+            return;
+        const previous = this.activityMarker.isActiveElsewhere(session.sessionFile);
+        await this.activityMarker.refresh(session.sessionFile, this.hasActiveWork(session));
+        if (this.active.get(session.sessionId)?.runtime.session === session
+            && previous !== this.activityMarker.isActiveElsewhere(session.sessionFile)) {
+            this.publishStatus(session);
+        }
+    }
     publishStatus(session) {
+        void this.refreshActivityMarker(session);
         const status = this.statusFromSession(session);
         this.clearStaleActiveActivity(session);
         this.workspaceActivity?.applySessionStatus(session.sessionManager.getCwd(), status);
@@ -3270,7 +3619,7 @@ export class PiSessionService {
         this.events.publish(session.sessionId, { type: "activity.update", activity });
         this.events.publishGlobal({ type: "activity.update", activity });
     }
-    statusFromSession(session) {
+    statusFromSession(session, messageCount = session.messages.length) {
         const stats = session.getSessionStats();
         const model = session.model === undefined ? undefined : modelToClientModel(session.model);
         const contextUsage = session.getContextUsage();
@@ -3287,7 +3636,7 @@ export class PiSessionService {
             isBashRunning: session.isBashRunning,
             pendingMessageCount: this.pendingMessageCount(session),
             queuedMessages: queuedMessagesFromSession(session, this.compactionQueuedMessages(session.sessionId)),
-            messageCount: session.messages.length,
+            messageCount,
             tokens: stats.tokens,
             cost: stats.cost,
             ...(contextUsage === undefined ? {} : { contextUsage }),
@@ -3305,6 +3654,13 @@ export class PiSessionService {
     warningsForSession(session) {
         const runtime = this.active.get(session.sessionId)?.runtime;
         const warnings = runtime === undefined ? [] : collectRuntimeWarnings(runtime);
+        if (this.activityMarker.isActiveElsewhere(session.sessionFile)) {
+            warnings.push({
+                severity: "info",
+                message: "Recently active in another PI-WEB instance. Avoid working on this session in both instances at once.",
+                source: "PI-WEB",
+            });
+        }
         const anthropic = anthropicSubscriptionWarning(session, join(this.agentDir, "auth.json"));
         if (anthropic !== undefined)
             warnings.push(anthropic);
@@ -3402,7 +3758,7 @@ function clientSessionFromListEntry(session) {
         created: session.created.toISOString(),
         modified: session.modified.toISOString(),
         messageCount: session.messageCount,
-        firstMessage: session.firstMessage,
+        firstMessage: clientSessionFirstMessagePreview(session.firstMessage),
         ...(session.parentSessionPath === undefined ? {} : { parentSessionPath: session.parentSessionPath }),
     };
 }
@@ -3505,7 +3861,7 @@ function clientSessionFromArchivedRecord(record, fallback) {
         created,
         modified,
         messageCount,
-        firstMessage,
+        firstMessage: clientSessionFirstMessagePreview(firstMessage),
         ...(parentSessionPath === undefined ? {} : { parentSessionPath }),
         archived: true,
         archivedAt: record.archivedAt,
@@ -3516,13 +3872,6 @@ function addSessionName(names, name) {
     if (trimmed !== undefined && trimmed !== "")
         names.add(trimmed);
 }
-function compareArchivedRecords(a, b) {
-    return archivedTimestamp(b) - archivedTimestamp(a);
-}
-function archivedTimestamp(record) {
-    const time = Date.parse(record.archivedAt);
-    return Number.isNaN(time) ? 0 : time;
-}
 function isDefined(value) {
     return value !== undefined;
 }
@@ -3742,45 +4091,41 @@ function buildPromptOptions(behavior, images) {
         options.images = images;
     return Object.keys(options).length > 0 ? options : undefined;
 }
-function stringValue(value) {
-    return typeof value === "string" ? value : "";
+function historyMessages(session) {
+    return historyMessagesFromEntries(session.sessionManager.getBranch());
 }
-/**
- * Attach the thinking level in effect when an assistant message was generated,
- * so chat bubbles can show it next to the model. Non-assistant messages pass
- * through by reference; assistant messages are copied only when a level is set.
- * "off" is the absence of thinking, not a level worth labeling on every bubble.
- */
-function annotateAssistantThinkingLevel(message, thinkingLevel) {
-    if (thinkingLevel === undefined || thinkingLevel === "" || thinkingLevel === "off")
-        return message;
-    if (!isRecord(message) || message["role"] !== "assistant")
-        return message;
-    return { ...message, thinkingLevel };
+function transcriptMessageCount(entries) {
+    let count = 0;
+    for (const entry of entries) {
+        if (isRecord(entry) && entry["type"] === "message")
+            count += 1;
+    }
+    return count;
 }
-function historyMessages(session) {
-    const messages = [];
-    // Pi records the initial level at session creation and every later change, so
-    // walking the branch yields the level in effect for each assistant message.
-    let thinkingLevel;
-    for (const entry of session.sessionManager.getBranch()) {
-        if (!isRecord(entry))
-            continue;
-        if (entry["type"] === "message")
-            messages.push(annotateAssistantThinkingLevel(entry["message"], thinkingLevel));
-        else if (entry["type"] === "thinking_level_change") {
-            const level = getString(entry, "thinkingLevel");
-            if (level !== undefined)
-                thinkingLevel = level;
-        }
-        else if (entry["type"] === "custom_message" && entry["display"] === true)
-            messages.push({ role: "custom", content: entry["content"], customType: entry["customType"], details: entry["details"] });
-        else if (entry["type"] === "compaction")
-            messages.push({ role: "system", source: "compaction", content: `Compacted history:\n\n${stringValue(entry["summary"])}` });
-        else if (entry["type"] === "branch_summary")
-            messages.push({ role: "system", source: "branch_summary", content: `Branch summary:\n\n${stringValue(entry["summary"])}` });
-    }
-    return messages;
+function activeEditableTreeTargetParentId(manager, targetId, activeLeafId) {
+    if (activeLeafId !== targetId)
+        return undefined;
+    const entry = manager.getBranch().at(-1);
+    if (!isRecord(entry) || entry["id"] !== targetId)
+        return undefined;
+    const isUserMessage = entry["type"] === "message"
+        && isRecord(entry["message"])
+        && entry["message"]["role"] === "user";
+    if (!isUserMessage && entry["type"] !== "custom_message")
+        return undefined;
+    const parentId = entry["parentId"];
+    if (parentId === targetId)
+        return undefined;
+    return parentId === null || typeof parentId === "string" ? parentId : undefined;
+}
+function setSessionTreeLeaf(manager, leafId) {
+    if (leafId === null)
+        manager.resetLeaf();
+    else
+        manager.branch(leafId);
+}
+function transcriptBranchIncludesEntry(entries, entryId) {
+    return entries.some((entry) => isRecord(entry) && entry["id"] === entryId);
 }
 /** custom entry type used to persist parent -> child subsession links outside LLM context. */
 const SUBSESSION_LINK_CUSTOM_TYPE = "pi-web.subsession.link";
@@ -3838,6 +4183,13 @@ function toClientEvent(event, thinkingLevel) {
         const result = getProperty(event, "result");
         return { type: "tool.end", toolName: getString(event, "toolName") ?? "", toolCallId: getString(event, "toolCallId") ?? "", text: stringifyToolResult(result), content: toolResultContent(result), details: toolResultDetails(result), isError: getBoolean(event, "isError") === true };
     }
+    if (eventType === "entry_appended") {
+        // Boundary drafts do not emit message_end. Use the same raw-history
+        // projection as reconnects: context edits must not rewrite the transcript.
+        const [message] = historyMessagesFromEntries([getProperty(event, "entry")]);
+        if (message !== undefined)
+            return { type: "message.append", message };
+    }
     if (eventType === "agent_start")
         return { type: "agent.start" };
     if (eventType === "agent_end")