@jmfederico/pi-web 1.202609.0 → 1.202610.0

package/dist/server/sessions/piSessionService.js

@@ -1,20 +1,25 @@
 import { statSync } from "node:fs";
 import { join } from "node:path";
 import { readFile, writeFile } from "node:fs/promises";
-import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEditToolDefinition, defineTool, hasTrustRequiringProjectResources, ProjectTrustStore, readStoredCredential, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, createEventBus, createEditToolDefinition, defineTool, hasTrustRequiringProjectResources, ProjectTrustStore, readStoredCredential, SessionManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { projectBrowserMessage } from "../browserMessageProjection.js";
+import { isSessionMediaId } from "../../shared/sessionMedia.js";
 import { pageMessagesAtSafeBoundary } from "./messagePaging.js";
+import { clientSessionFirstMessagePreview } from "./clientSessionPreview.js";
 import { BUILTIN_COMMANDS } from "./builtinCommands.js";
 import { SessionCommandService } from "./sessionCommandService.js";
+import { SessionActivityMarker } from "./sessionActivityMarker.js";
 import { projectSessionTree } from "./sessionTreeProjection.js";
 import { SessionArchiveStore } from "./sessionArchiveStore.js";
 import { findArchiveCandidateByIdOrPrefix, planSessionArchiveTree } from "./sessionArchiveTree.js";
+import { PiSessionEventConnections } from "./piSessionEventConnections.js";
 import { deterministicSessionName, fallbackSessionName, generateShortSessionName } from "./sessionNameGenerator.js";
 import { computeEditPreview } from "./editPreview.js";
 import { attachmentsToInlineImages, saveAttachmentsToWorkspace } from "./attachmentService.js";
 import { loadEffectiveProjectAttachmentsConfig } from "../workspaces/projectPiWebConfig.js";
 import { parsePromptAttachments } from "../../shared/promptAttachments.js";
 import { ASK_USER_ANSWERS_CUSTOM_TYPE, SESSION_TREE_CUSTOM_INSTRUCTIONS_MAX_LENGTH, SESSION_UNREAD_LIMIT } from "../../shared/apiTypes.js";
+import { parseSessionDefaults, parseSessionDefaultsUpdate } from "../../shared/sessionDefaults.js";
 import { canonicalizeStoredCwd, cwdPathsEqual } from "../workingDirectory.js";
 import { readSessionHeaderSummary } from "./sessionFileHeader.js";
 import { createAskUserToolDefinition } from "./askUserTool.js";
@@ -25,6 +30,7 @@ import { DEFAULT_EXTENSION_DIALOGS_TIMEOUT_MS } from "../../config.js";
 import { createSpawnSessionToolDefinition } from "./spawnSessionTool.js";
 import { createSubsessionToolDefinitions } from "./spawnSubsessionTool.js";
 import { buildTranscriptView } from "./subsessionTranscript.js";
+import { annotateAssistantThinkingLevel, historyMessagesFromEntries } from "./transcriptMessages.js";
 import { planSessionCleanup, summarizeSessionCleanupExecution } from "./sessionCleanup.js";
 import { SessionNotificationStore, } from "./sessionNotificationStore.js";
 import { plainTextTheme } from "./plainTextTheme.js";
@@ -422,7 +428,7 @@ export function piWebResourceLoaderOptions(appendSystemPromptSections) {
         return undefined;
     return { appendSystemPromptOverride: (base) => [...base, ...appendSystemPromptSections] };
 }
-function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subsessions, askUser, appendSystemPromptSections = []) {
+function createDefaultRuntimeFactory(sessionEvents, modelRuntime, sessionManagers, spawn, subsessions, askUser, appendSystemPromptSections = []) {
     const resourceLoaderOptions = piWebResourceLoaderOptions(appendSystemPromptSections);
     return async ({ cwd, agentDir, sessionManager, sessionStartEvent, initialModel, initialThinkingLevel, delegationToolsEnabled }) => {
         // PI WEB always honors pi's project-trust model. When the workspace ships
@@ -435,6 +441,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
         // browser trust prompt, an untrusted project's resources are skipped
         // (matching `pi` run without a UI). Projects without trust-requiring
         // resources skip resolution entirely and are trusted, as before.
+        const eventBus = createEventBus();
         const projectTrustRequiring = hasTrustRequiringProjectResources(cwd);
         const settingsManager = SettingsManager.create(cwd, agentDir, { projectTrusted: !projectTrustRequiring });
         // Pre-session-creation trust failures (`project_trust` handler errors)
@@ -446,7 +453,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
             agentDir,
             modelRuntime,
             settingsManager,
-            ...(resourceLoaderOptions === undefined ? {} : { resourceLoaderOptions }),
+            resourceLoaderOptions: { ...resourceLoaderOptions, eventBus },
             ...(projectTrustRequiring
                 ? {
                     resourceLoaderReloadOptions: {
@@ -480,6 +487,7 @@ function createDefaultRuntimeFactory(modelRuntime, sessionManagers, spawn, subse
             ...(modelOptions.thinkingLevel === undefined ? {} : { thinkingLevel: modelOptions.thinkingLevel }),
             ...(modelOptions.scopedModels.length === 0 ? {} : { scopedModels: modelOptions.scopedModels }),
         });
+        sessionEvents.register(result.session, eventBus);
         return { ...result, services, diagnostics: [...projectTrustDiagnostics, ...services.diagnostics] };
     };
 }
@@ -528,6 +536,8 @@ export class PiSessionService {
         this.unpersistedTreeBranchLeaves = new WeakMap();
         /** Counts async operations that may append an entry before they settle. */
         this.sessionEntryMutationCounts = new WeakMap();
+        this.pendingPromptEchoes = new WeakMap();
+        this.publishedAssistantPartials = new WeakMap();
         /** Settings-wide queue preventing enabled-model read/modify/write races across sessions. */
         this.modelScopeMutationQueue = Promise.resolve();
         /** Global and workspace-owned enabled-model states; live session scopes project one entry lazily. */
@@ -556,8 +566,8 @@ export class PiSessionService {
         this.subsessionHydratedParents = new Set();
         /**
          * Tracked subsession id -> whether a completion notification is armed.
-         * Armed when the child starts working; firing on completion disarms it so a
-         * child that works again (and stops again) notifies the parent each time.
+         * Armed when the child's agent starts a run or a prompt fails before starting
+         * one (not for standalone commands or compaction); completion disarms it.
          */
         this.subsessionNotifyArmed = new Map();
         this.notificationGenerationBySession = new WeakMap();
@@ -575,6 +585,10 @@ export class PiSessionService {
         this.spawnTargets = deps.spawnTargets;
         this.logger = deps.logger ?? noopLogger;
         this.now = deps.now ?? (() => new Date());
+        this.activityMarker = new SessionActivityMarker({
+            now: () => this.now().getTime(),
+            onError: (error) => { this.logger.info({ err: error }, "Could not update advisory session activity marker"); },
+        });
         this.notificationStore = deps.notificationStore ?? new SessionNotificationStore();
         this.unreadStore = deps.unreadStore ?? new SessionUnreadStore();
         this.onUnreadChanged = deps.onUnreadChanged;
@@ -588,7 +602,8 @@ export class PiSessionService {
         // Subsessions are gated behind their own flag, and they
         // also require the spawn capability (they share its project-scope resolver).
         const subsessionsActive = this.spawnTargets !== undefined && deps.subsessionsEnabled === true;
-        this.createRuntime = deps.createRuntime ?? createDefaultRuntimeFactory(this.modelRuntime, this.sessionManager, this.spawnTargets === undefined ? undefined : (input) => this.spawnSession(input), !subsessionsActive ? undefined : {
+        this.sessionEvents = deps.sessionEvents ?? new PiSessionEventConnections();
+        this.createRuntime = deps.createRuntime ?? createDefaultRuntimeFactory(this.sessionEvents, this.modelRuntime, this.sessionManager, this.spawnTargets === undefined ? undefined : (input) => this.spawnSession(input), !subsessionsActive ? undefined : {
             spawn: (input) => this.spawnSubsession(input),
             list: (parentSessionId, parentSessionFile) => this.listSubsessions(parentSessionId, parentSessionFile),
             check: (parentSessionId, sessionId, parentSessionFile) => this.checkSubsession(parentSessionId, sessionId, parentSessionFile),
@@ -625,6 +640,9 @@ export class PiSessionService {
     notificationCatalog() {
         return this.notificationStore.catalogSnapshot();
     }
+    async reconcileUnreadWorkspaces(cwds) {
+        await this.publishUnreadMutations(this.unreadStore.reconcileWorkspaces(cwds));
+    }
     async unreadCatalog() {
         await this.publishUnreadMutations([]);
         return this.unreadStore.durableCatalogSnapshot();
@@ -732,7 +750,10 @@ export class PiSessionService {
             finally {
                 await active.runtime.dispose();
             }
-        }));
+        })).finally(async () => {
+            this.events.mediaIndex.clear();
+            await this.activityMarker.dispose();
+        });
         await this.publishUnreadMutations([]);
     }
     async list(cwd) {
@@ -748,14 +769,48 @@ export class PiSessionService {
         this.workspaceActivity?.reconcileSessionActivity(cwd, reconcilableSessionIds);
         await this.publishUnreadMutations(this.unreadStore.reconcileCwd(canonicalizeStoredCwd(cwd), reconcilableSessionIds));
         const archivedSessions = archivedForCwd
-            .sort(compareArchivedRecords)
             .map((record) => clientSessionFromArchivedRecord(record, sessionsById.get(record.sessionId)))
-            .filter(isDefined);
+            .filter(isDefined)
+            .sort((a, b) => Date.parse(b.modified) - Date.parse(a.modified));
         return [...unarchivedSessions, ...archivedSessions];
     }
     async start(cwd, options = {}) {
         return this.startSession(cwd, options);
     }
+    /** Publish a host-owned conversation without submitting an initial prompt. */
+    async createHostedSession(cwd, signal) {
+        const created = await this.startManagedSession(cwd, signal);
+        return Object.freeze({ id: created.id });
+    }
+    /** Atomically start and prompt one visible host-owned, non-delegating session. */
+    async startOneShotRun(cwd, text, signal) {
+        const promptText = requirePromptText(text);
+        return this.startManagedSession(cwd, signal, promptText);
+    }
+    async startManagedSession(cwd, signal, promptText) {
+        signal.throwIfAborted();
+        const active = await this.create(this.sessionManager.create(cwd), cwd, { startupIntent: "create", creationProvenance: "host-one-shot", startupSignal: signal });
+        const { session } = active.runtime;
+        try {
+            signal.throwIfAborted();
+            if (promptText !== undefined)
+                this.maybeGenerateSessionName(session, promptText);
+            const created = this.announceCreatedSession(active, cwd);
+            // Publication transfers lifetime ownership to normal hosting. Plugin
+            // cancellation after this point must not abort this or later user work.
+            const completion = promptText === undefined ? Promise.resolve() : this.submitInitialRunPrompt(session, promptText);
+            return Object.freeze({ id: created.id, completion });
+        }
+        catch (error) {
+            try {
+                await this.closeActive(session.sessionId);
+            }
+            catch (cleanupError) {
+                throw new AggregateError([error, cleanupError], `Failed to clean up managed session ${session.sessionId} after startup failed`, { cause: cleanupError });
+            }
+            throw error;
+        }
+    }
     async startSession(cwd, options) {
         const active = await this.create(this.sessionManager.create(cwd, options.parentSession === undefined ? undefined : { parentSession: options.parentSession }), cwd, {
             startupIntent: "create",
@@ -764,6 +819,9 @@ export class PiSessionService {
             ...(options.initialThinkingLevel === undefined ? {} : { initialThinkingLevel: options.initialThinkingLevel }),
             ...(options.creationProvenance === undefined ? {} : { creationProvenance: options.creationProvenance }),
         });
+        return this.announceCreatedSession(active, cwd, options.parentSession);
+    }
+    announceCreatedSession(active, cwd, parentSession) {
         const { session } = active.runtime;
         const created = {
             id: session.sessionId,
@@ -776,7 +834,7 @@ export class PiSessionService {
             firstMessage: "",
             // Include the parent so listeners can nest the new session in the tree
             // immediately, instead of showing it flat until the next reload.
-            ...(options.parentSession === undefined ? {} : { parentSessionPath: options.parentSession }),
+            ...(parentSession === undefined ? {} : { parentSessionPath: parentSession }),
         };
         // Broadcast so other clients (and the spawning agent's UI) can add the new
         // session to their list without a manual reload.
@@ -1114,8 +1172,12 @@ export class PiSessionService {
      * `async` so a rejected dialog becomes a rejection rather than a synchronous
      * throw from a promise-returning method.
      */
-    async openExtensionDialog(session, request, opts) {
-        const signal = opts?.signal;
+    async openExtensionDialog(session, request, opts, startupSignal) {
+        const signal = opts?.signal === undefined
+            ? startupSignal
+            : startupSignal === undefined
+                ? opts.signal
+                : AbortSignal.any([opts.signal, startupSignal]);
         // A pre-aborted signal dismisses the dialog before it ever opens.
         if (signal?.aborted === true)
             return extensionDialogCancelValue(request.kind);
@@ -1465,31 +1527,34 @@ export class PiSessionService {
         });
     }
     /**
-     * Drive parent notifications from a tracked child's status. Arms a pending
-     * notification while the child is working, and when it stops fires a single
-     * follow-up message to the parent via {@link prompt} (which queues if the
-     * parent is busy and delivers immediately when it is idle).
+     * Arm on a tracked child's agent_start, then notify the parent once it stops
+     * working. Prompt failures before agent_start explicitly arm the same latch.
+     * Standalone commands and compactions must not arm a completion notice.
      */
-    updateSubsessionTracking(session) {
+    updateSubsessionTracking(session, agentStarted = false) {
         const link = this.subsessionLinkForActiveChild(session);
         if (link === undefined)
             return;
         const childId = link.childSessionId;
-        if (this.hasActiveWork(session)) {
+        if (agentStarted) {
             this.subsessionNotifyArmed.set(childId, true);
             return;
         }
+        if (this.hasActiveWork(session))
+            return;
         if (this.subsessionNotifyArmed.get(childId) !== true)
             return;
         this.subsessionNotifyArmed.set(childId, false);
-        const status = this.activities.get(childId)?.phase === "error" ? "error" : "idle";
+        const activity = this.activities.get(childId);
+        const status = activity?.phase === "error" ? "error" : "idle";
+        const errorSection = status === "error" && activity?.detail !== undefined ? `Error: ${activity.detail}\n\n` : "";
         const finalText = finalAssistantText(historyMessages(session));
         const outputSection = formatSubsessionNotificationOutput(childId, finalText);
         const workingIds = this.workingSubsessionIds(link.parentSessionId);
         const next = workingIds.length === 0
             ? "No other tracked subsessions are working."
             : `Still working: ${workingIds.join(", ")}. Continue working, or call yield_to_subsessions alone and last at the next join point. Further completion notices arrive automatically; do not poll.`;
-        const text = `Subsession ${childId} stopped working (${status}).\n${next}\n\n${outputSection}`;
+        const text = `Subsession ${childId} stopped working (${status}).\n${next}\n\n${errorSection}${outputSection}`;
         void this.notifyParentOfSubsession(link.parentSessionId, childId, text);
     }
     async getOrOpenParentForSubsession(parentSessionId, childSessionId) {
@@ -1537,12 +1602,72 @@ export class PiSessionService {
     logSubsessionNotificationFailure(parentId, childId, error) {
         this.logger.info({ parentSessionId: parentId, sessionId: childId, error: error instanceof Error ? error.message : String(error) }, "failed to notify parent of subsession completion");
     }
+    async transcriptSnapshot(ref, page) {
+        const session = await this.getOrOpen(ref);
+        const seqBeforeRead = this.events.currentSeq(session.sessionId);
+        const activeAtCapture = this.hasActiveWork(session);
+        const diskBranch = activeAtCapture ? undefined : await this.readableSessionBranch(ref, session);
+        // Disk reads yield, even if a whole turn starts AND ends while they run.
+        // From the final runtime read through the watermark capture nothing may yield.
+        const branch = diskBranch === undefined || this.hasActiveWork(session) || this.events.currentSeq(session.sessionId) !== seqBeforeRead
+            ? session.sessionManager.getBranch()
+            : diskBranch;
+        const messages = historyMessagesFromEntries(branch);
+        const userCount = messages.filter((message) => isRecord(message) && message["role"] === "user").length;
+        const echoes = (this.pendingPromptEchoes.get(session) ?? []).filter((echo) => echo.userIndex >= userCount);
+        messages.push(...echoes.map((echo) => echo.message));
+        return {
+            page: pageMessagesAtSafeBoundary(messages, page),
+            status: this.statusFromSession(session, transcriptMessageCount(branch) + echoes.length),
+            seq: this.events.currentSeq(session.sessionId),
+            partial: this.publishedAssistantPartials.get(session) ?? null,
+        };
+    }
     async messages(ref, page) {
         const session = await this.getOrOpen(ref);
         return pageMessagesAtSafeBoundary(historyMessagesFromEntries(await this.readableSessionBranch(ref, session)), page);
     }
+    async media(ref, mediaId) {
+        if (!isSessionMediaId(mediaId))
+            throw new Error("Invalid media id");
+        const index = this.events.mediaIndex;
+        const session = this.activeForRef(ref)?.runtime.session ?? this.startupSessionForRef(ref);
+        // Verify session/cwd ownership before consulting the session-scoped cache.
+        // Cold binary reads do not construct an SDK runtime (which can migrate files).
+        const archived = session === undefined ? await this.getArchived(ref) : undefined;
+        const resolved = session === undefined && archived?.archivePath === undefined
+            ? await this.sessionManager.resolveSessionFile(ref.cwd, ref.id)
+            : undefined;
+        const sessionId = session?.sessionId ?? archived?.sessionId ?? resolved?.id;
+        if (sessionId === undefined || (resolved !== undefined && !cwdPathsEqual(resolved.cwd, ref.cwd)))
+            throw new Error("Session not found");
+        const scope = { id: sessionId, cwd: canonicalizeStoredCwd(session?.sessionManager.getCwd() ?? archived?.cwd ?? resolved?.cwd ?? ref.cwd) };
+        const cached = index.get(scope, mediaId);
+        if (cached !== undefined)
+            return cached;
+        if (session !== undefined) {
+            const live = index.find(scope, mediaId, [
+                session.sessionManager.getEntries?.() ?? session.sessionManager.getBranch(),
+                session.messages,
+                session.state.streamingMessage,
+                this.publishedAssistantPartials.get(session),
+                ...(this.pendingPromptEchoes.get(session) ?? []).map((echo) => echo.message),
+            ]);
+            if (live !== undefined)
+                return live;
+        }
+        // Read disk on misses even for a cached idle runtime: other processes can
+        // append images on any branch without emitting events through this daemon.
+        const path = session?.sessionFile ?? session?.sessionManager.getSessionFile() ?? archived?.archivePath ?? resolved?.path
+            ?? (session === undefined ? undefined : (await this.sessionManager.resolveSessionFile(ref.cwd, sessionId))?.path);
+        if (path === undefined)
+            return undefined;
+        const entries = await this.sessionManager.readEntries?.(path);
+        return entries === undefined ? undefined : index.find(scope, mediaId, entries);
+    }
     async status(ref) {
         const session = await this.sessionForStatusOrDialogClose(ref);
+        await this.activityMarker.refresh(session.sessionFile, this.hasActiveWork(session));
         if (this.hasActiveWork(session))
             return this.statusFromSession(session);
         const branch = await this.readableSessionBranch(ref, session);
@@ -1567,6 +1692,47 @@ export class PiSessionService {
             : annotateAssistantThinkingLevel(projectBrowserMessage(streamingMessage), session.thinkingLevel);
         return { seq, partial };
     }
+    async getSessionDefaults(ref) {
+        await this.getOrOpen(ref);
+        const settings = SettingsManager.create(ref.cwd, this.agentDir);
+        await settings.reload();
+        this.assertDefaultsSettingsHealthy(settings);
+        // Do not use merged getters: workspace overrides are not global pins.
+        return parseSessionDefaults(settings.getGlobalSettings());
+    }
+    async setSessionDefaults(ref, defaults) {
+        const update = parseSessionDefaultsUpdate({ ...defaults });
+        await this.assertWritable(ref);
+        const session = await this.getOrOpen(ref);
+        return this.runModelScopeMutation(async () => {
+            // A separate manager avoids mutating the active session's settings cache.
+            const settings = SettingsManager.create(ref.cwd, this.agentDir);
+            await settings.reload();
+            this.assertDefaultsSettingsHealthy(settings);
+            if (update.provider !== undefined && update.modelId !== undefined) {
+                await session.modelRuntime.refresh({ allowNetwork: false });
+                const target = `${update.provider}/${update.modelId}`;
+                const enabledIds = await resolveEnabledModelIds({ settingsManager: settings, modelRuntime: session.modelRuntime, scopedModels: [] });
+                if (!session.modelRuntime.getAvailableSnapshot().some((model) => modelScopeId(model) === target)) {
+                    throw new Error(`Model not found: ${target}`);
+                }
+                if (enabledIds !== null && !enabledIds.includes(target))
+                    throw new Error(`Model is not enabled: ${target}`);
+                settings.setDefaultModelAndProvider(update.provider, update.modelId);
+            }
+            else if (update.thinkingLevel !== undefined) {
+                settings.setDefaultThinkingLevel(update.thinkingLevel);
+            }
+            await settings.flush();
+            this.assertDefaultsSettingsHealthy(settings);
+            return parseSessionDefaults(settings.getGlobalSettings());
+        });
+    }
+    assertDefaultsSettingsHealthy(settings) {
+        const errors = settings.drainErrors();
+        if (errors.length > 0)
+            throw new Error(`Session defaults settings failed: ${errors.map(({ error }) => error.message).join("; ")}`);
+    }
     async availableModels(ref) {
         const session = await this.getOrOpen(ref);
         const models = await this.sessionModelCandidates(session);
@@ -1700,7 +1866,12 @@ export class PiSessionService {
             commands.push({ name: command.invocationName, ...(command.description === undefined ? {} : { description: command.description }), source: "extension" });
         }
         for (const template of session.promptTemplates) {
-            commands.push({ name: template.name, ...(template.description === undefined ? {} : { description: template.description }), source: "prompt" });
+            commands.push({
+                name: template.name,
+                ...(template.description === undefined ? {} : { description: template.description }),
+                ...(template.argumentHint === undefined ? {} : { argumentHint: template.argumentHint }),
+                source: "prompt",
+            });
         }
         for (const skill of session.resourceLoader.getSkills().skills) {
             commands.push({ name: `skill:${skill.name}`, ...(skill.description === undefined ? {} : { description: skill.description }), source: "skill" });
@@ -1740,18 +1911,104 @@ export class PiSessionService {
         void this.submitPrompt(session, promptText, behavior, images, echoUserMessage);
     }
     submitPrompt(session, text, behavior, images = [], echoUserMessage = true) {
+        return this.beginPromptSubmission(session, text, behavior, images, echoUserMessage).catch(() => undefined);
+    }
+    beginPromptSubmission(session, text, behavior, images = [], echoUserMessage = true) {
         this.publishActivity(session, behavior === "steer" ? "steering queued" : behavior === "followUp" ? "message queued" : "prompt accepted", "active");
-        if (behavior === undefined && echoUserMessage)
-            this.events.publish(session.sessionId, { type: "message.append", message: userMessage(text, images) });
+        const echoes = this.pendingPromptEchoes.get(session) ?? [];
+        const userCount = historyMessagesFromEntries(session.sessionManager.getBranch()).filter((message) => isRecord(message) && message["role"] === "user").length;
+        const echo = behavior === undefined && echoUserMessage
+            ? { userIndex: Math.max(userCount, ...echoes.map((pending) => pending.userIndex + 1)), message: userMessage(text, images) }
+            : undefined;
+        if (echo !== undefined) {
+            // SDK input hooks may await before appending the user message. Keep the
+            // already-published echo visible in snapshots until that append occurs.
+            this.pendingPromptEchoes.set(session, [...echoes, echo]);
+            this.events.publish(session.sessionId, { type: "message.append", message: echo.message }, { id: session.sessionId, cwd: session.sessionManager.getCwd() });
+        }
         const promptOptions = buildPromptOptions(behavior, images);
-        const promptPromise = this.runSessionEntryMutation(session, "send a prompt", () => session.prompt(text, promptOptions)).catch((error) => {
+        const commandName = text.startsWith("/") ? text.slice(1).split(" ")[0] : undefined;
+        const trackEarlyFailure = behavior === undefined
+            && this.subsessionLinkForActiveChild(session) !== undefined
+            && !session.extensionRunner.getRegisteredCommands().some((command) => command.invocationName === commandName);
+        let agentStarted = false;
+        const unsubscribe = !trackEarlyFailure ? undefined : session.subscribe((event) => {
+            if (getString(event, "type") === "agent_start")
+                agentStarted = true;
+        });
+        const promptPromise = this.runSessionEntryMutation(session, "send a prompt", () => session.prompt(text, promptOptions)).finally(() => {
+            unsubscribe?.();
+            if (echo !== undefined) {
+                const remaining = (this.pendingPromptEchoes.get(session) ?? []).filter((pending) => pending !== echo);
+                if (remaining.length === 0)
+                    this.pendingPromptEchoes.delete(session);
+                else
+                    this.pendingPromptEchoes.set(session, remaining);
+            }
+        });
+        void promptPromise.catch((error) => {
             const message = error instanceof Error ? error.message : String(error);
             this.publishActivity(session, "error", "error", message);
             this.events.publish(session.sessionId, { type: "session.error", message });
+            if (this.isCurrentActiveSession(session)) {
+                const link = this.subsessionLinkForActiveChild(session);
+                // Model/auth validation can reject without any agent event. Wake the
+                // parent, but do not re-arm a run that already emitted agent_start.
+                if (trackEarlyFailure && !agentStarted && link !== undefined)
+                    this.subsessionNotifyArmed.set(link.childSessionId, true);
+                this.updateSubsessionTracking(session);
+            }
         });
-        void promptPromise;
         return promptPromise;
     }
+    async submitInitialRunPrompt(session, text) {
+        let failure;
+        let settled = false;
+        let sawInitialUserMessage = false;
+        const unsubscribe = session.subscribe((event) => {
+            if (settled || !isRecord(event))
+                return;
+            if (event["type"] === "agent_settled") {
+                // Freeze the initial outcome before a later user submission can change it.
+                settled = true;
+                return;
+            }
+            if (event["type"] === "auto_retry_end" && event["success"] === false && event["finalError"] === "Retry cancelled") {
+                // Native Pi cancels retry sleep without an aborted assistant message.
+                failure = new DOMException("Initial PI session run was aborted", "AbortError");
+                return;
+            }
+            const message = event["message"];
+            if (!isRecord(message))
+                return;
+            if (event["type"] === "message_start" && message["role"] === "user") {
+                // Pi can drain a queued user follow-up inside the same prompt promise.
+                // Its outcome belongs to that later submission, not this launcher.
+                if (sawInitialUserMessage)
+                    settled = true;
+                sawInitialUserMessage = true;
+                return;
+            }
+            if (event["type"] !== "message_end" || message["role"] !== "assistant")
+                return;
+            // A successful retry supersedes a transient provider failure. Pi's
+            // prompt promise can fulfill even when the final assistant is an error.
+            const reason = message["stopReason"];
+            failure = reason === "aborted"
+                ? new DOMException("Initial PI session run was aborted", "AbortError")
+                : reason === "error"
+                    ? new Error(typeof message["errorMessage"] === "string" ? message["errorMessage"] : "Initial PI session run failed")
+                    : undefined;
+        });
+        try {
+            await this.beginPromptSubmission(session, text, undefined);
+            if (failure !== undefined)
+                throw failure;
+        }
+        finally {
+            unsubscribe();
+        }
+    }
     enqueuePromptDuringCompaction(session, text, kind, images = [], echoUserMessage = true) {
         const queue = this.compactionPromptQueues.get(session.sessionId) ?? [];
         queue.push({ kind, text, ...(images.length > 0 ? { images } : {}), ...(echoUserMessage ? {} : { echoUserMessage: false }) });
@@ -1882,6 +2139,13 @@ export class PiSessionService {
                 }
                 return { cancelled: true, ...(result.aborted === undefined ? {} : { aborted: result.aborted }) };
             }
+            if (session.sessionManager.getLeafId() !== oldLeafId) {
+                // Questions belong to the position we left. Close them for every browser
+                // without appending a cancellation message or waking the rewound session.
+                const outcome = this.pendingAskStore.cancelOpen(session.sessionId);
+                if (outcome !== undefined)
+                    this.publishAskClosed(session.sessionId, outcome);
+            }
             if (result.summaryEntry !== undefined) {
                 // A summary entry durably identifies the selected branch as the file's
                 // newest leaf, superseding any earlier bare selection.
@@ -2322,10 +2586,12 @@ export class PiSessionService {
     async archiveStoreArchiveMany(inputs) {
         if (inputs.length === 0)
             return [];
+        // Work from the bottom of the activity-ordered list, using metadata already loaded.
+        const oldestFirst = [...inputs].sort((a, b) => Date.parse(a.modified) - Date.parse(b.modified));
         if (this.archiveStore.archiveMany !== undefined)
-            return this.archiveStore.archiveMany(inputs);
+            return this.archiveStore.archiveMany(oldestFirst);
         const records = [];
-        for (const input of inputs)
+        for (const input of oldestFirst)
             records.push(await this.archiveStore.archive(input));
         return records;
     }
@@ -2457,6 +2723,7 @@ export class PiSessionService {
         // Promises inside the dying runtime: settle them rather than dropping them.
         this.endSessionExtensionDialogs(sessionId);
         this.active.delete(sessionId);
+        this.events.mediaIndex.forgetSession({ id: sessionId, cwd: active.runtime.session.sessionManager.getCwd() });
         this.activities.delete(sessionId);
         this.workspaceActivity?.removeSession(sessionId, active.runtime.session.sessionManager.getCwd());
         this.clearAuthLossWarningsForSession(sessionId);
@@ -2473,6 +2740,7 @@ export class PiSessionService {
             await this.abortSessionOperations(active.runtime.session);
         }
         finally {
+            await this.activityMarker.release(active.runtime.session.sessionFile);
             await active.runtime.dispose();
         }
     }
@@ -2564,6 +2832,9 @@ export class PiSessionService {
     }
     async getActive(ref, options = {}) {
         const active = this.activeForRef(ref);
+        const pending = this.pendingSessionOpens.get(JSON.stringify([canonicalizeStoredCwd(ref.cwd), active?.runtime.session.sessionId ?? ref.id]));
+        if (pending !== undefined)
+            return pending.promise;
         if (active !== undefined)
             return active;
         const archived = await this.getArchived(ref);
@@ -2581,13 +2852,13 @@ export class PiSessionService {
         return this.openExistingSession(match.id, match.cwd, () => this.sessionManager.open(match.path), options);
     }
     openExistingSession(sessionId, cwd, openSessionManager, options = {}) {
-        const active = this.activeForRef({ id: sessionId, cwd });
-        if (active !== undefined)
-            return Promise.resolve(active);
         const key = JSON.stringify([canonicalizeStoredCwd(cwd), sessionId]);
         const existing = this.pendingSessionOpens.get(key);
         if (existing !== undefined)
             return existing.promise;
+        const active = this.activeForRef({ id: sessionId, cwd });
+        if (active !== undefined)
+            return Promise.resolve(active);
         const pending = {
             sessionId,
             promise: this.create(openSessionManager(), cwd, options),
@@ -2667,18 +2938,27 @@ export class PiSessionService {
      * first is both the slowest phase and one that can fail on its own; a clear
      * that only ran for the later phases would leave a stale label behind.
      */
-    async create(sessionManager, cwd, options = {}) {
+    create(sessionManager, cwd, options = {}) {
         const startup = this.startupProgress(sessionManager, options.startupIntent ?? "open", options.startupToken);
-        try {
-            return await this.createSessionRuntime(sessionManager, cwd, options, startup);
-        }
-        finally {
+        const key = JSON.stringify([canonicalizeStoredCwd(cwd), sessionManager.getSessionId()]);
+        // Early native observation must not admit ordinary operations before
+        // session_start finishes. Track new sessions as well as on-demand opens so
+        // close/dispose wait for startup before tearing down its runtime.
+        const pending = {
+            sessionId: sessionManager.getSessionId(),
+            promise: this.createSessionRuntime(sessionManager, cwd, options, startup),
+        };
+        pending.promise = pending.promise.finally(() => {
             startup.end();
-        }
+            if (this.pendingSessionOpens.get(key) === pending)
+                this.pendingSessionOpens.delete(key);
+        });
+        this.pendingSessionOpens.set(key, pending);
+        return pending.promise;
     }
     async createSessionRuntime(sessionManager, cwd, options, startup) {
         startup.report(STARTUP_PHASE_RUNTIME);
-        const delegationToolsEnabled = options.creationProvenance !== "tracked-subsession"
+        const delegationToolsEnabled = options.creationProvenance === undefined
             && await sessionAllowsDelegationTools(sessionManager, this.sessionManager);
         const runtime = await this.createAgentRuntime(this.createRuntime, {
             cwd,
@@ -2690,6 +2970,11 @@ export class PiSessionService {
         });
         const active = { runtime, unsubscribe: noop };
         let boundSession = runtime.session;
+        const startupSignal = options.startupSignal;
+        const cancelStartup = () => { this.endSessionExtensionDialogs(boundSession.sessionId); };
+        if (startupSignal !== undefined && !startupSignal.aborted) {
+            startupSignal.addEventListener("abort", cancelStartup, { once: true });
+        }
         let notificationGeneration = options.notificationGeneration;
         let notificationOwnership = options.notifications === "disabled"
             ? "disabled"
@@ -2712,15 +2997,20 @@ export class PiSessionService {
         if (notificationGeneration !== undefined)
             this.notificationGenerationBySession.set(runtime.session, notificationGeneration);
         try {
+            startupSignal?.throwIfAborted();
             if (options.creationProvenance === "tracked-subsession") {
                 await this.publishUnreadMutations(this.unreadStore.excludeSession(runtime.session.sessionId, canonicalizeStoredCwd(runtime.session.sessionManager.getCwd())));
             }
             else {
                 await this.recoverSubsessionTrackingForOpenedSession(runtime.session);
             }
+            startupSignal?.throwIfAborted();
             startup.report(STARTUP_PHASE_EXTENSIONS);
-            await this.bindSessionExtensions(runtime.session, notificationGeneration);
+            // session_start hooks use the same native agent as ordinary prompts.
+            // Observe them before binding extensions, including startup messages.
             this.bindRuntime(active);
+            await this.bindSessionExtensions(runtime.session, notificationGeneration, startupSignal);
+            startupSignal?.throwIfAborted();
             runtime.setRebindSession(async (session) => {
                 const priorGeneration = notificationGeneration;
                 let candidateGeneration;
@@ -2752,6 +3042,7 @@ export class PiSessionService {
                     throw error;
                 }
             });
+            startupSignal?.throwIfAborted();
             this.active.set(runtime.session.sessionId, active);
             if (notificationOwnership === "replacement" && notificationGeneration !== undefined) {
                 this.publishNotificationMutations(this.notificationStore.commitReplacement(notificationGeneration));
@@ -2795,13 +3086,16 @@ export class PiSessionService {
             }
             throw error;
         }
+        finally {
+            startupSignal?.removeEventListener("abort", cancelStartup);
+        }
     }
-    async bindSessionExtensions(session, generation) {
-        const uiContext = this.sessionUiContext(session, generation);
-        // A `session_start` hook can park this bind on a dialog the browser has
-        // not answered yet. On the initial create/open path the session becomes
-        // active only after this returns, so register it for the duration: the
-        // answer that unblocks startup has to be reachable while it waits.
+    async bindSessionExtensions(session, generation, startupSignal) {
+        const startupDialogs = { signal: startupSignal };
+        const uiContext = this.sessionUiContext(session, generation, startupDialogs);
+        // A session_start hook can park this bind on a browser dialog. Keep
+        // startup lookup and cancellation available for the duration of the bind,
+        // including paths which resolve a dialog before session creation returns.
         this.startupSessions.set(session.sessionId, session);
         try {
             await session.bindExtensions({
@@ -2815,13 +3109,16 @@ export class PiSessionService {
             });
         }
         finally {
+            // Even a captured startup UI context must not carry plugin cancellation
+            // into later user turns after startup has finished.
+            startupDialogs.signal = undefined;
             this.startupSessions.delete(session.sessionId);
         }
     }
     replaceSessionNotificationContext(session, generation) {
         session.extensionRunner.setUIContext(this.sessionUiContext(session, generation), "rpc");
     }
-    sessionUiContext(session, generation) {
+    sessionUiContext(session, generation, startupDialogs) {
         const baseUiContext = session.extensionRunner.getUIContext();
         const notify = (message, type) => {
             if (generation === undefined) {
@@ -2847,13 +3144,13 @@ export class PiSessionService {
                 if (property === "theme")
                     return plainTextTheme;
                 if (property === "confirm") {
-                    return (title, message, opts) => this.openExtensionDialog(session, { kind: "confirm", title, message }, opts);
+                    return (title, message, opts) => this.openExtensionDialog(session, { kind: "confirm", title, message }, opts, startupDialogs?.signal);
                 }
                 if (property === "select") {
-                    return (title, options, opts) => this.openExtensionDialog(session, { kind: "select", title, options }, opts);
+                    return (title, options, opts) => this.openExtensionDialog(session, { kind: "select", title, options }, opts, startupDialogs?.signal);
                 }
                 if (property === "input") {
-                    return (title, placeholder, opts) => this.openExtensionDialog(session, { kind: "input", title, placeholder }, opts);
+                    return (title, placeholder, opts) => this.openExtensionDialog(session, { kind: "input", title, placeholder }, opts, startupDialogs?.signal);
                 }
                 const value = Reflect.get(target, property, receiver);
                 return value;
@@ -2895,7 +3192,7 @@ export class PiSessionService {
         // now rather than after the durable flush: it reads in-memory unread state
         // and must not lag behind the rows the browser is about to see.
         if (mutations.length > 0)
-            this.onUnreadChanged?.();
+            this.onUnreadChanged?.(mutations.some(({ event }) => event.unread !== null));
         this.enqueueUnreadMutations(mutations);
         this.unreadPublicationFlushRequested = true;
         if (this.unreadPublication === undefined && this.unreadPublicationRetryTimer !== undefined) {
@@ -2975,6 +3272,16 @@ export class PiSessionService {
         this.unreadPublicationRetryTimer = undefined;
         this.unreadPublicationRetryDelayMs = this.unreadPublicationRetryInitialMs;
     }
+    connectSessionEvents(ref, lifetime) {
+        const active = this.active.get(ref.id);
+        if (active?.runtime.session.sessionId !== ref.id
+            || !cwdPathsEqual(active.runtime.session.sessionManager.getCwd(), ref.cwd)) {
+            throw new Error("Selected session is not hosted in this workspace on this machine");
+        }
+        if (this.startupSessions.has(ref.id))
+            throw new Error("Selected session is still initializing its extensions");
+        return this.sessionEvents.connect(active.runtime.session, lifetime);
+    }
     bindRuntime(active, session = active.runtime.session) {
         active.unsubscribe();
         for (const [sessionId, candidate] of this.active.entries()) {
@@ -2984,10 +3291,28 @@ export class PiSessionService {
                     this.clearCompactionPromptQueue(sessionId);
             }
         }
-        active.unsubscribe = session.subscribe((event) => {
-            this.events.publish(session.sessionId, toClientEvent(event, session.thinkingLevel));
-            this.publishActivityForEvent(session, event);
+        const unsubscribe = session.subscribe((event) => {
             const eventType = getString(event, "type");
+            const message = getProperty(event, "message");
+            if ((eventType === "message_start" || eventType === "message_update") && getString(message, "role") === "assistant") {
+                // SDK state advances before async extension hooks finish. Capture only
+                // published messages, detaching even blocks left intact by projection.
+                this.publishedAssistantPartials.set(session, structuredClone(annotateAssistantThinkingLevel(projectBrowserMessage(message), session.thinkingLevel)));
+            }
+            else if (eventType === "message_start" || eventType === "message_end" || eventType === "agent_end") {
+                this.publishedAssistantPartials.delete(session);
+            }
+            this.events.publish(session.sessionId, toClientEvent(event, session.thinkingLevel), { id: session.sessionId, cwd: session.sessionManager.getCwd() });
+            this.publishActivityForEvent(session, event);
+            // Queued messages can reach the model after an ask opened, even though
+            // there was no ask to dismiss when the user originally submitted them.
+            if (eventType === "message_start" && isRecord(event) && getString(event["message"], "role") === "user") {
+                void this.voidOpenAskForUserMessage(session).catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    this.publishActivity(session, "error", "error", message);
+                    this.events.publish(session.sessionId, { type: "session.error", message });
+                });
+            }
             if (eventType === "agent_end")
                 this.abortRunScopedExtensionDialogs(session.sessionId);
             if (eventType === "compaction_end")
@@ -2995,8 +3320,13 @@ export class PiSessionService {
             if (eventType === "agent_start" || eventType === "agent_end")
                 this.scheduleCompactionQueueDrain(session.sessionId);
             this.publishStatus(session);
-            this.updateSubsessionTracking(session);
+            this.updateSubsessionTracking(session, eventType === "agent_start");
         });
+        active.unsubscribe = () => {
+            this.sessionEvents.close(session);
+            unsubscribe();
+            this.publishedAssistantPartials.delete(session);
+        };
         this.active.set(session.sessionId, active);
     }
     scheduleCompactionQueueDrain(sessionId, delayMs = 0) {
@@ -3158,6 +3488,7 @@ export class PiSessionService {
             // the session still reports active work transiently, so the event-driven
             // latch may not fire. The heartbeat re-checks once the session settles.
             this.updateSubsessionTracking(session);
+            void this.refreshActivityMarker(session);
             const activity = this.activities.get(session.sessionId);
             if (!this.hasActiveWork(session)) {
                 if (activity?.phase === "active")
@@ -3384,7 +3715,18 @@ export class PiSessionService {
         this.events.publishGlobal({ type: "activity.update", activity });
         this.observeUnreadActivityState(session);
     }
+    async refreshActivityMarker(session) {
+        if (this.active.get(session.sessionId)?.runtime.session !== session)
+            return;
+        const previous = this.activityMarker.isActiveElsewhere(session.sessionFile);
+        await this.activityMarker.refresh(session.sessionFile, this.hasActiveWork(session));
+        if (this.active.get(session.sessionId)?.runtime.session === session
+            && previous !== this.activityMarker.isActiveElsewhere(session.sessionFile)) {
+            this.publishStatus(session);
+        }
+    }
     publishStatus(session) {
+        void this.refreshActivityMarker(session);
         const status = this.statusFromSession(session);
         this.clearStaleActiveActivity(session);
         this.workspaceActivity?.applySessionStatus(session.sessionManager.getCwd(), status);
@@ -3438,6 +3780,13 @@ export class PiSessionService {
     warningsForSession(session) {
         const runtime = this.active.get(session.sessionId)?.runtime;
         const warnings = runtime === undefined ? [] : collectRuntimeWarnings(runtime);
+        if (this.activityMarker.isActiveElsewhere(session.sessionFile)) {
+            warnings.push({
+                severity: "info",
+                message: "Recently active in another PI-WEB instance. Avoid working on this session in both instances at once.",
+                source: "PI-WEB",
+            });
+        }
         const anthropic = anthropicSubscriptionWarning(session, join(this.agentDir, "auth.json"));
         if (anthropic !== undefined)
             warnings.push(anthropic);
@@ -3535,7 +3884,7 @@ function clientSessionFromListEntry(session) {
         created: session.created.toISOString(),
         modified: session.modified.toISOString(),
         messageCount: session.messageCount,
-        firstMessage: session.firstMessage,
+        firstMessage: clientSessionFirstMessagePreview(session.firstMessage),
         ...(session.parentSessionPath === undefined ? {} : { parentSessionPath: session.parentSessionPath }),
     };
 }
@@ -3638,7 +3987,7 @@ function clientSessionFromArchivedRecord(record, fallback) {
         created,
         modified,
         messageCount,
-        firstMessage,
+        firstMessage: clientSessionFirstMessagePreview(firstMessage),
         ...(parentSessionPath === undefined ? {} : { parentSessionPath }),
         archived: true,
         archivedAt: record.archivedAt,
@@ -3649,13 +3998,6 @@ function addSessionName(names, name) {
     if (trimmed !== undefined && trimmed !== "")
         names.add(trimmed);
 }
-function compareArchivedRecords(a, b) {
-    return archivedTimestamp(b) - archivedTimestamp(a);
-}
-function archivedTimestamp(record) {
-    const time = Date.parse(record.archivedAt);
-    return Number.isNaN(time) ? 0 : time;
-}
 function isDefined(value) {
     return value !== undefined;
 }
@@ -3875,49 +4217,9 @@ function buildPromptOptions(behavior, images) {
         options.images = images;
     return Object.keys(options).length > 0 ? options : undefined;
 }
-function stringValue(value) {
-    return typeof value === "string" ? value : "";
-}
-/**
- * Attach the thinking level in effect when an assistant message was generated,
- * so chat bubbles can show it next to the model. Non-assistant messages pass
- * through by reference; assistant messages are copied only when a level is set.
- * "off" is the absence of thinking, not a level worth labeling on every bubble.
- */
-function annotateAssistantThinkingLevel(message, thinkingLevel) {
-    if (thinkingLevel === undefined || thinkingLevel === "" || thinkingLevel === "off")
-        return message;
-    if (!isRecord(message) || message["role"] !== "assistant")
-        return message;
-    return { ...message, thinkingLevel };
-}
 function historyMessages(session) {
     return historyMessagesFromEntries(session.sessionManager.getBranch());
 }
-function historyMessagesFromEntries(entries) {
-    const messages = [];
-    // Pi records the initial level at session creation and every later change, so
-    // walking the branch yields the level in effect for each assistant message.
-    let thinkingLevel;
-    for (const entry of entries) {
-        if (!isRecord(entry))
-            continue;
-        if (entry["type"] === "message")
-            messages.push(annotateAssistantThinkingLevel(entry["message"], thinkingLevel));
-        else if (entry["type"] === "thinking_level_change") {
-            const level = getString(entry, "thinkingLevel");
-            if (level !== undefined)
-                thinkingLevel = level;
-        }
-        else if (entry["type"] === "custom_message" && entry["display"] === true)
-            messages.push({ role: "custom", content: entry["content"], customType: entry["customType"], details: entry["details"] });
-        else if (entry["type"] === "compaction")
-            messages.push({ role: "system", source: "compaction", content: `Compacted history:\n\n${stringValue(entry["summary"])}` });
-        else if (entry["type"] === "branch_summary")
-            messages.push({ role: "system", source: "branch_summary", content: `Branch summary:\n\n${stringValue(entry["summary"])}` });
-    }
-    return messages;
-}
 function transcriptMessageCount(entries) {
     let count = 0;
     for (const entry of entries) {
@@ -4007,6 +4309,13 @@ function toClientEvent(event, thinkingLevel) {
         const result = getProperty(event, "result");
         return { type: "tool.end", toolName: getString(event, "toolName") ?? "", toolCallId: getString(event, "toolCallId") ?? "", text: stringifyToolResult(result), content: toolResultContent(result), details: toolResultDetails(result), isError: getBoolean(event, "isError") === true };
     }
+    if (eventType === "entry_appended") {
+        // Boundary drafts do not emit message_end. Use the same raw-history
+        // projection as reconnects: context edits must not rewrite the transcript.
+        const [message] = historyMessagesFromEntries([getProperty(event, "entry")]);
+        if (message !== undefined)
+            return { type: "message.append", message };
+    }
     if (eventType === "agent_start")
         return { type: "agent.start" };
     if (eventType === "agent_end")