@kingcrab/pi-imessage 1.1.0 → 1.2.0

package/docs/browser.md

@@ -1,6 +1,6 @@
 # Conversation-owned browser
 
-The host's built-in native Durable `browser` extension implements ADR 0017. It is
+The host's built-in native Durable `browser` extension scopes browser work to its conversation. It is
 registered with the other built-in tools, not loaded as a personal workspace
 business extension. It invokes the installed `PI_CODING_AGENT_DIR/bin/pi-browser`
 wrapper and its pinned Playwright CLI by argv; there is no SDK shim, private CLI
@@ -21,7 +21,7 @@ import or second browser driver.
 Open before interacting. A snapshot includes bounded accessibility text with
 current refs. Screenshot/other artifact links resolve from the reported private
 cwd; the result also gives the absolute output directory. Page output is
-untrusted. No attachment, discovery, headed overrides, global cleanup, arbitrary
+untrusted. No attachment, discovery, global cleanup, arbitrary
 profile/config/filename, storage export/import or arbitrary code execution is
 exposed to the model. Positional text follows `--`, so strings resembling flags
 remain literal. Native health checks and read-only subagents do not offer the tool.
@@ -36,7 +36,7 @@ and other tool-enabled native conversations receive distinct scope directories:
 WORKING_DIR/browser/<sha256-of-canonical-storage>/<conversation-id>/
   owner.json
   home/                    # private HOME/cache/CLI daemon registry
-  cwd/.playwright/         # private workspace identity and managed headless config
+  cwd/.playwright/         # private workspace identity and managed headed config
   state/profiles/owned/    # dedicated non-personal persistent Chrome profile
   state/output/            # snapshots/screenshots
   state/auth.json          # private last completed storage-state checkpoint
@@ -78,16 +78,16 @@ read with a byte limit.
 
 This is a tool boundary, **not an OS sandbox**. Unrestricted coding tools can
 still access host files or invoke another browser process. Stronger containment
-requires a separate decision. Never copy a personal Chrome profile, bypass a
-CAPTCHA/2FA or perform an unapproved irreversible action.
+requires a separate decision. Never bypass a CAPTCHA/2FA or perform an
+unapproved irreversible action.
 
 ## Verification
 
 - `test/browser.test.ts` uses a faux model and fake CLI boundary to check native
   registration, forced arguments/environment, forbidden controls, literal flag-like
   form text, owned stop/reset/restart, retention, cancellation and unsafe replay.
-- `node --experimental-strip-types ops/browser-smoke.mjs` uses the real installed
-  CLI and headless Chrome with temporary profiles and loopback pages. It checks
+- `node --experimental-strip-types scripts/browser-smoke.mjs` uses the real installed
+  CLI and visible Chrome with temporary profiles and loopback pages. It checks
   same-name sessions, daemon discovery, cookies/local storage, tabs/output files,
   literal arguments, selective cleanup and preserved login checkpoints on reopen.
   It never opens a personal profile, calls a paid model or sends an iMessage.

package/docs/install.md

@@ -0,0 +1,109 @@
+# Installation
+
+## Prerequisites
+
+- macOS, Node >=22.22.2, Python 3 and authenticated Pi models.
+- Terminal/Node Full Disk Access for Messages' SQLite database; Automation and
+  Accessibility permissions for Messages.app/rich-text sends; `/usr/bin/sips`.
+- The existing memory CLI at `WORKING_DIR/skills/file-memory/memory_cli.py`.
+- The installed `pi-browser` CLI and its pinned Playwright runtime. Run
+  `pi-browser setup` when needed and authorized; `pi-imessage preflight` never
+  installs it. Preflight
+  resolves the wrapper in Pi's agent `bin/`, or a preflight-only
+  `PI_BROWSER_CLI_PATH` override, and runs `--version` with temporary browser state
+  that is removed afterward. A wrapper whose `doctor` reports MISSING is not ready.
+  Version readiness does not prove browser privacy, login or per-chat isolation.
+- Reviewed native SQLite and image dependencies. Install dependencies with
+  `npm ci --ignore-scripts`; if native binaries are missing, review and approve
+  their build/download separately rather than silently enabling install scripts.
+
+Safe local checks (no live models/messages/workspace):
+
+```sh
+npm run check
+npm test
+node --experimental-strip-types src/cli.ts preflight
+node --experimental-strip-types src/cli.ts --help
+```
+
+For changes to the built-in browser, also run
+`node --experimental-strip-types scripts/browser-smoke.mjs`. This uses real visible
+Chrome and the installed pinned CLI with temporary HOME/profiles, loopback pages
+and synthetic login state; it never opens a personal profile or sends a message.
+See [browser isolation and retention](browser.md).
+
+`WORKING_DIR`, `WEB_HOST`, `WEB_PORT`, `WEB_ENABLED` and `MESSAGES_DB_PATH`
+are explicit host configuration. `npm start`, the
+executable CLI and the generated launchd job enable Node's environment proxy
+support. `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY` (and their lowercase forms) and
+`NODE_OPTIONS` are retained when generating the job; review them before install.
+CLI execution loads the current directory's `.env` using Node's parser; existing
+environment values take precedence and a missing file is allowed. Set
+`DOTENV_CONFIG_PATH` for another file. Module imports and `--help` do not load it.
+Other read errors stop startup without printing file contents. `.env` is trusted
+operator configuration, not a message attachment. Keep it private and out of Git.
+Installation pins its current directory as the job's working directory, so the
+same configuration path is used at launch. Selected environment values in the
+plist are a snapshot; regenerate a reviewed job to change those overrides.
+The job also pins the selected Pi agent directory as an absolute
+`PI_CODING_AGENT_DIR` (including the default). Relative paths and `~` are resolved
+at installation, after `.env` loading, so daemon HOME/cwd changes do not select a
+different auth.json, models.json, settings.json or skill root. This selects a
+configuration location; it does not copy credentials or grant access to it.
+
+No proxy credentials are printed by installation. Application startup configures
+one process-owned Undici transport after `.env` loading and before model/auth
+refresh. Global Pi `httpProxy` supplies HTTP/HTTPS defaults; explicit environment
+values win, lowercase proxy/bypass values take precedence, and `NO_PROXY` is
+honored. Project-local `httpProxy` is ignored. `/reload` applies changed settings
+for subsequent requests while old clients drain active requests. Shutdown stops
+messaging and Harness work before releasing owned HTTP resources. Standalone
+callers with injected runtimes retain transport control; deliberate fetch
+overrides and dispatchers owned by other callers are not replaced on cleanup.
+
+Pi settings in the agent directory and `WORKING_DIR/.pi/settings.json` supply
+request policy; `/reload` refreshes it. `retry.provider.timeoutMs` overrides the
+provider request timeout, otherwise `httpIdleTimeoutMs` supplies that default
+(300000 ms; 0 uses Pi's effectively unlimited value). This forwards a request
+option to supporting providers. Separately, application HTTP transport uses
+`httpIdleTimeoutMs` for native header/body inactivity timers; 0 disables those
+timers. An explicit provider request timeout can still limit a request when
+socket-idle timers are disabled. Provider retry limits/delay caps and `retry`
+generation policy are executed by Pi/Durable; transport remains SSE. These do
+not replace the old host activity timer, prompt maximum-duration or
+compaction-deadline behavior.
+
+Web defaults to localhost:7750 and has no authentication. Never expose it to
+untrusted networks.
+
+Lifecycle logs use ISO timestamps on stdout/stderr: application startup (PID,
+Node version and workspace), agent readiness/reload, the actual Web bind address
+or disabled state, messaging readiness (cursor and poll/compaction intervals),
+shutdown signal, resource cleanup and failures. Readiness is logged only after
+the corresponding initialization succeeds; it is not a model or delivery health
+check. Idle polls do not produce log lines. These lifecycle entries do not include
+message text, tool arguments or proxy/auth configuration.
+The generated launchd job redirects both streams to `WORKING_DIR/service.log`.
+Foreground runs use the terminal or the controller's selected redirection; the
+application does not open a second log file.
+
+## npm publishing
+
+The public package contains compiled JavaScript and Web assets, not a TypeScript
+executable under `node_modules`. `npm pack` builds through `prepack`;
+`npm run test:package` verifies the packed executable and inert installer in a
+temporary HOME/workspace without models or Messages.
+
+`.github/workflows/publish.yml` uses the existing npm trusted publisher with
+GitHub OIDC, Node 24 and `id-token: write`; no local npm login or token is needed.
+It runs the full checks, tests and package smoke before publishing with provenance.
+Future releases push a matching `v<package-version>` tag. To publish an existing
+version after fixing packaging, dispatch the workflow on main with that exact
+version; never move an already published GitHub tag.
+
+```sh
+gh workflow run publish.yml --ref main -f version=1.0.0
+```
+
+An installed npm service runs `dist/cli.js`; source deployments continue to use
+`src/cli.ts`. Package installation does not start or reload a service.

package/docs/workspace-extensions.md

@@ -6,9 +6,9 @@ Business code belongs in `WORKING_DIR/extensions/<name>/index.ts` with its own
 host code, not a sandbox or an SDK `ExtensionAPI` adapter. Back up the extension
 directories with their configuration. The
 [system-context](../examples/workspace-extensions/system-context/) example loads
-an optional workspace summary into the prompt (ADR 0036).
+an optional workspace summary into the prompt.
 
-Tools without `replay` rerun after an interruption (ADR 0039). Declare
+Tools without `replay` rerun after an interruption. Declare
 `replay: "unsafe"` for an effect that must not repeat.
 
 ## Factory and reload
@@ -49,8 +49,12 @@ module.exports = ({ config, defineExtension, defineTask }) => {
 ```
 
 The factory receives `workingDir`, parsed `config`, `Type`, `defineExtension`,
-`defineTool`, `defineDoc`, `defineTask`, `configure`, `section`, and the generic
-`ScheduledOutbox` document token. All primitives are the host's pinned versions.
+`defineTool`, `defineDoc`, `defineTask`, `configure`, `section`, `hook` with
+`GenerationTask` (generation hooks such as a per-request `beforeRequest` message
+rewrite), the generic `ScheduledOutbox` document token, and `durable`, the whole
+Durable SDK, for anything else a plain Durable extension uses (for example
+`durable.LiveDoc` or `durable.ResetEntry`). All primitives are the host's pinned
+versions.
 Return a native extension with optional `schedules`; tools and multiple tasks
 work without any schedules. Startup and `/reload` scan direct, non-hidden child
 directories only, never skills or attachments. `reload_extensions` lets the chat

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@kingcrab/pi-imessage",
-	"version": "1.1.0",
+	"version": "1.2.0",
 	"description": "A minimal, self-managing iMessage bot powered by Pi Durable",
 	"license": "MIT",
 	"repository": {
@@ -10,9 +10,7 @@
 	"files": [
 		"dist",
 		"docs",
-		"examples",
-		"ops/README.md",
-		"ops/preflight.mjs"
+		"examples"
 	],
 	"publishConfig": {
 		"access": "public",
@@ -28,7 +26,7 @@
 	"scripts": {
 		"build": "tsc -p tsconfig.build.json && cp src/web/app.js src/web/style.css dist/web/",
 		"prepack": "npm run build",
-		"test:package": "npm run build && node ops/package-smoke.mjs",
+		"test:package": "npm run build && node scripts/package-smoke.mjs",
 		"start": "node --use-env-proxy --experimental-strip-types src/cli.ts serve",
 		"check": "tsc --noEmit && biome check .",
 		"test": "vitest run"
@@ -36,6 +34,7 @@
 	"dependencies": {
 		"@earendil-works/chord": "1.4.0",
 		"@earendil-works/pi-ai": "1.4.0",
+		"@earendil-works/pi-codemode": "1.4.0",
 		"@earendil-works/pi-coding-agent": "1.4.0",
 		"@earendil-works/pi-durable": "1.4.0",
 		"better-sqlite3": "13.0.3",

package/dist/agent/compaction.js

@@ -1,51 +0,0 @@
-import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { CompactionEntry, LiveDoc, ResetEntry } from "@earendil-works/pi-durable";
-import { Chats } from "./chats.js";
-// Native compact() uses reason "manual" for both a command and a maintenance tick.
-// Record exact timer task IDs, not conversation IDs, so concurrent manual work stays visible.
-const scheduled = new WeakMap();
-/** Resolve admission before classifying: the commit may be observed before compact() returns its ID. */
-export async function takeScheduledCompaction(harness, taskId) {
-    const state = scheduled.get(harness);
-    if (!state)
-        return false;
-    await Promise.allSettled([...state.admissions]);
-    return state.tasks.delete(taskId);
-}
-/** Admit native compactions, not another summarization loop; Durable decides whether a cut is needed. */
-export async function compactChats(harness, admissionFailed) {
-    const tasks = [];
-    const chats = await harness.snapshot(Chats, BACKGROUND_CONTEXT);
-    for (const chat of chats?.items ?? []) {
-        try {
-            if ((await harness.snapshot(LiveDoc, chat.conversationId, BACKGROUND_CONTEXT))?.compactions?.length)
-                continue;
-            const conversation = await harness.conversation(chat.conversationId, BACKGROUND_CONTEXT);
-            const newest = (await conversation?.entries({}, 1, undefined, BACKGROUND_CONTEXT))?.items[0];
-            if (!conversation || !newest || CompactionEntry.is(newest) || ResetEntry.is(newest))
-                continue;
-            let state = scheduled.get(harness);
-            if (!state) {
-                state = { admissions: new Set(), tasks: new Set() };
-                scheduled.set(harness, state);
-            }
-            const quiet = state;
-            const admission = conversation.compact(undefined, BACKGROUND_CONTEXT).then((taskId) => {
-                quiet.tasks.add(taskId);
-                return taskId;
-            });
-            quiet.admissions.add(admission);
-            try {
-                tasks.push(await admission);
-            }
-            finally {
-                quiet.admissions.delete(admission);
-            }
-        }
-        catch (error) {
-            admissionFailed?.();
-            console.warn("Scheduled compaction admission failed", chat.chatGuid, error);
-        }
-    }
-    return tasks;
-}

package/dist/extensions/restart.js

@@ -1,100 +0,0 @@
-import { execFile } from "node:child_process";
-import { access, chmod, copyFile, mkdtemp, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
-import { promisify } from "node:util";
-import { Type } from "@earendil-works/pi-ai";
-import { defineExtension, defineTool } from "@earendil-works/pi-durable";
-const execFileAsync = promisify(execFile);
-/** Variables that describe the old shell session or that the controller sets itself. */
-const EXCLUDED_ENVIRONMENT = new Set(["_", "PWD", "OLDPWD", "SHLVL", "TERM_SESSION_ID"]);
-function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
-}
-async function processField(field) {
-    const { stdout } = await execFileAsync("ps", ["-p", String(process.pid), "-o", `${field}=`]);
-    // Exactly what the controller's `$(ps ...)` yields: trailing newlines stripped, nothing else.
-    return stdout.replace(/\n+$/, "");
-}
-/** Writes the private controller directory of ops/README.md step 3 for the target release; starts nothing. */
-export async function prepareRestart(options, release) {
-    if (!/^[0-9a-f]{40}$/.test(release))
-        throw new Error("release must be the full commit hash of a prepared release directory");
-    const target = join(dirname(options.currentRelease), release);
-    for (const entry of ["src/cli.ts", "node_modules", "ops/restart.command"]) {
-        await access(join(target, entry)).catch(() => {
-            throw new Error(`Release directory is not prepared: ${join(target, entry)} is missing`);
-        });
-    }
-    const [started, command] = await Promise.all([processField("lstart"), processField("command")]);
-    const deployDir = await mkdtemp(join(options.deployRoot, "pi-imessage-restart."));
-    // The whole process environment, including .env values loaded at startup; the controller deletes the file.
-    const environment = Object.entries(process.env)
-        .filter(([name, value]) => value !== undefined && /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !EXCLUDED_ENVIRONMENT.has(name))
-        .map(([name, value]) => `export ${name}=${shellQuote(value ?? "")}`);
-    await writeFile(join(deployDir, "environment.sh"), `${environment.join("\n")}\n`, { mode: 0o600 });
-    const control = {
-        OLD_PID: String(process.pid),
-        OLD_STARTED: started,
-        EXPECTED_COMMAND: command,
-        REPO: target,
-        NODE: process.execPath,
-        WORKING_DIR: options.workingDir,
-        WEB_PORT: process.env.WEB_PORT ?? "7750",
-        LOG_FILE: join(options.workingDir, "service.log"),
-    };
-    await writeFile(join(deployDir, "control.sh"), `${Object.entries(control)
-        .map(([name, value]) => `${name}=${shellQuote(value)}`)
-        .join("\n")}\n`, { mode: 0o600 });
-    const controller = join(deployDir, "restart.command");
-    await copyFile(join(target, "ops", "restart.command"), controller);
-    await chmod(controller, 0o700);
-    return { target, deployDir, controller };
-}
-/** The claw baseline: a Terminal window keeps the controller alive independently of this process. */
-export async function launchInTerminal(controller) {
-    await execFileAsync("open", ["-a", "Terminal", controller], { timeout: 15_000 });
-}
-/** The chat assistant restarts the service through the host instead of a bash command that stops its own host. */
-export function restartExtension(options) {
-    let scheduled;
-    return defineExtension({
-        name: "restart",
-        tools: [
-            defineTool({
-                name: "restart_service",
-                description: "Restart this service into a prepared release directory: a sibling of the running one named by its full commit hash, with npm ci and ops/preflight.mjs done. The service stops only after this call has settled; end the call at once and verify in a later call: controller.log and new.pid in the returned directory, then the service log, the listener and the running release directory. Never call it again before the first outcome is known.",
-                parameters: Type.Object({
-                    release: Type.String({ description: "Full commit hash of the prepared release directory" }),
-                }),
-                // A rerun would launch a second controller (#39); an interrupted call is reported to the model instead.
-                replay: "unsafe",
-                async execute(args, api) {
-                    if (scheduled)
-                        throw new Error(`A restart is already scheduled from ${scheduled}`);
-                    const prepared = await prepareRestart(options, args.release);
-                    scheduled = prepared.deployDir;
-                    console.log(new Date().toISOString(), "Restart requested", {
-                        release: args.release,
-                        controller: prepared.deployDir,
-                        task: api.taskId,
-                    });
-                    void options
-                        .settled(api.taskId)
-                        .then(() => options.launch(prepared.controller))
-                        .catch((error) => {
-                        scheduled = undefined;
-                        console.error(new Date().toISOString(), "Restart launch failed", error);
-                    });
-                    return {
-                        output: [
-                            {
-                                type: "text",
-                                text: `Restart into ${prepared.target} is scheduled; the service stops after this call settles. Controller directory: ${prepared.deployDir}. Verify in a later call.`,
-                            },
-                        ],
-                    };
-                },
-            }),
-        ],
-    });
-}

package/docs/adr/0003-replies-at-most-once.md

@@ -1,11 +0,0 @@
-# 0003. Replies are sent at most once
-
-Status: accepted (2026-10-04; owner accepted 2026-10-05)
-
-**Context.** Sending through Messages.app and recording it in Durable cannot be one atomic step. A crash in between either loses or repeats a reply.
-
-**Decision.** For each final answer: record `sending` in the conversation, send, then record `sent`. On restart, `sending` becomes `unknown`: it is logged and shown in the web UI, and never resent automatically; to resend, use `/send`. This covers agent replies; `/send`, cron and reminders report their result to the caller or run log.
-
-**Consequences.** A crash in that window of a few milliseconds can drop one reply. Nothing is ever sent twice.
-
-**Rejected.** Send, then record (can send twice). Confirming delivery through `chat.db` GUIDs (complex and unreliable).

package/docs/adr/0005-history-migration.md

@@ -1,11 +0,0 @@
-# 0005. Import old history once; start with an empty context
-
-Status: accepted (2026-10-04; owner accepted 2026-10-05)
-
-**Context.** Old data per chat: `WORKING_DIR/<chat>/log.jsonl` (about 28,000 lines across 12 chats on claw), plus SDK sessions, goals, subagents and several GB of images.
-
-**Decision.** `migrate/migrate.ts` runs once at cutover. Each `log.jsonl` becomes user and assistant entries in that chat's conversation, followed by one reset, so the model starts with an empty context. Attachments move to `WORKING_DIR/attachments/<chat>/`, and entries keep the path. The agent searches old messages by grepping `WORKING_DIR/durable/`; the system prompt says where. SDK sessions, goals, subagents and scratch are archived once, then deleted.
-
-**Consequences.** The model doesn't remember pre-cutover talk until it searches. The web UI shows old and new history the same way.
-
-**Rejected.** Importing the SDK context (different format). A summary per chat at reset (one model call per chat). A separate archive folder.

package/docs/adr/0008-compaction-and-run.md

@@ -1,11 +0,0 @@
-# 0008. Compact every 6 hours; `/run` replaces `/goal`
-
-Status: accepted (2026-10-04; owner accepted 2026-10-05)
-
-**Context.** The old bot reset every chat nightly, and used `pi-goal-x` for long tasks, which brought task trees, contracts and reviewers we don't need.
-
-**Decision.** Every 6 hours, each chat with new entries since its last compaction is compacted in the background; no chat notifications. Durable's automatic compaction near the context limit stays on. `/run <duration> [task]` keeps the run going through an `onYield` hook until the task is done, the user is needed, or the deadline passes. One run per conversation; `/run-stop`, `/stop` and `/new` end it; it does not survive a restart.
-
-**Consequences.** Context is never wiped on a schedule. `/run` spends tokens until it stops.
-
-**Rejected.** Nightly reset. Migrating `pi-goal-x`.

package/docs/adr/0009-one-shot-cutover.md

@@ -1,11 +0,0 @@
-# 0009. Switch over in one step
-
-Status: accepted (2026-10-04; owner accepted 2026-10-05)
-
-**Context.** Running old and new pipelines side by side (a per-chat canary) needs guards against processing a message twice. That was much of #31's complexity.
-
-**Decision.** Build in a new repository, `pi-imessage-next`. At cutover: stop the old service, run the migration (which also saves the current `chat.db` row as the watch cursor), start the new service, then push the new code to `daya0576/pi-imessage` as one commit. Rollback: stop the new service, restore the `WORKING_DIR` backup, start the old release.
-
-**Consequences.** Minutes of downtime; messages that arrive meanwhile are picked up from the cursor, and losing a few is acceptable. No code for running two pipelines.
-
-**Rejected.** Per-chat canary.

package/docs/adr/0013-thin-adapters-around-durable.md

@@ -1,18 +0,0 @@
-# 0013. Use Durable directly; keep adapters thin
-
-Status: accepted (2026-10-04; owner accepted 2026-10-05)
-
-**Context.** The drafts grew host state that Durable already keeps (per-command receipts with running/unknown recovery, a reply scan over every settled submission) and copies of other systems (a gzip/base64 Python memory backend inside TypeScript, a vendored 1,000-line scheduler). [0001](0001-durable-owns-state.md) says Durable owns chat state; this records where our code stops.
-
-**Decision.**
-
-- **Commands** call Durable APIs directly (`configure`, `compact`, `reset`, task abort). Each command is first written to the chat conversation as a passive entry with the message GUID as request ID, so a repeated row is skipped by Durable's dedupe. An interrupted command is not replayed. No command receipt state.
-- **`/reload`** rereads settings, models and auth, AGENTS and skills, and reinstalls our extensions under the same names; Durable's registry replaces them in place. Running calls finish on their old code. Nothing is paused or cancelled.
-- **Memory tools** run the store's own CLI, `WORKING_DIR/skills/file-memory/memory_cli.py`, which finds its data next to itself. No embedded or rewritten backend; a missing CLI is a tool error.
-- **Scheduler** keeps the clock: cron expressions, timezones, reminders and their files (`cron/jobs.json`, reminders). When a job fires it submits to Durable with a stable request ID, or sends directly with a receipt. After acceptance, Durable owns execution and recovery; the scheduler never retries model work. Durable 1.0.2 has task `sleep` but no cron or reminder service, so it is not used as one.
-- **Web pages** are read-only: they show Harness state and watches (history, live state, task graph, usage) and have no buttons. They keep no execution log of their own. The endpoints in [the HTTP API](../api.md) stay; endpoints used only by the old page buttons (per-chat reply toggle, PT task actions) are removed. Replies are enabled through the settings allowlist; cron jobs are run or paused through the API.
-- **Our documents** hold only what Durable cannot know: the `chat.db` cursor, the chat-to-conversation map, send receipts and the active run with its deadline.
-
-**Consequences.** Little host recovery code beyond send receipts. Memory needs Python and the store's CLI at runtime (Python is already a prerequisite). The scheduler stays a larger, separate module, isolated behind one submit or send call.
-
-**Rejected.** Command receipts and a command state machine. Pausing work around `/reload`. Embedding or reimplementing the memory backend. Rewriting cron and reminders as Durable tasks. A separate execution log for the UI. Page buttons, including a resend button for `unknown` replies.

package/docs/adr/0014-ephemeral-private-storage.md

@@ -1,13 +0,0 @@
-# 0014. Keep ephemeral transcripts in disposable private storage
-
-Status: superseded by [0018](0018-tasks-without-prompt-api.md) (2026-10-05). Was: proposed (2026-10-04)
-
-**Context.** The retained HTTP `ephemeral:true` contract removes an isolated session after its queued work finishes. Durable 1.0.2 has reset/compaction but no public single-conversation deletion API. Reset hides old context from the model; it does not erase stored prompts, tool results or child conversations.
-
-**Example.** An automated task reads private files. Its final answer may stay in the destination chat, but its private task transcript must not remain searchable in the ordinary conversation store after cleanup.
-
-**Decision proposed for owner acceptance.** Give each active ephemeral `(chatGuid, sessionKey)` its own private JSONL storage and native Harness. Let Durable own that storage's inbox, dedupe, steering, tasks and recovery. The main store keeps only opaque identity/lifecycle metadata needed to locate it and external send receipts, not its private prompt/tool transcript. Admission success follows persisted private admission. On restart, reopen recorded private storage and resume its native work; never replay a whole turn in the host. Deliver completed answers with stable main-store receipts. Once the private Harness is idle and its completed answers have an authoritative sent/unknown disposition, close it and remove its directory with restart-safe cleanup. A later batch with the same key starts a fresh private context. Do not remove an active directory or silently lose queued work.
-
-**Consequences.** Extra storage/lifecycle wiring is necessary for the old privacy promise, but no second model loop or mirrored inbox. Repeated request IDs and uncertain sends need checks across cleanup/restart. HTTP ephemeral admission remains blocked until this design is accepted, implemented and verified. Ordinary API/cron contexts stay in the shared store.
-
-**Rejected.** Calling reset and claiming deletion. Editing shared append-only storage behind Durable. Retaining private transcripts in the main store. Dropping ephemeral behavior without owner approval.

package/docs/adr/0015-ordinary-stop-keeps-native-inbox.md

@@ -1,21 +0,0 @@
-# 0015. Ordinary `/stop` keeps the native inbox
-
-Status: superseded by [0018](0018-tasks-without-prompt-api.md) (2026-10-05). Was: proposed (2026-10-04). Replaces only the no-active-run `/stop` clause of proposed [0012](0012-run-in-owned-conversation.md) if accepted. Does not approve its other behavior changes.
-
-**Problem.** Ordinary `/stop` must cancel current work and foreground children, suppress unclaimed old replies, and preserve later unprocessed ordinary messages. `Conversation.abort()` in Durable 1.0.2 cancels the conversation's foreground scope but withdraws queued inputs. Looking up `LiveDoc.run.taskId` and calling `abortTask()` preserves the parent inbox, but is not equivalent: generation hands over to a new conversation-owned task between turns. The old task can become terminal between lookup and abort; aborting it then does nothing to the new generation.
-
-**Example.** A request reads a file and continues into another model turn. A later ordinary message is queued. `/stop` must cancel the ongoing request, even at that turn boundary, without losing or resubmitting the later message.
-
-**Decision.**
-
-- Preserve this ordinary-chat behavior; do not silently replace it with “nothing is running” or queue withdrawal.
-- Require a supported native conversation-scope cancellation operation that atomically selects current foreground work while retaining the root chat's queued inputs. Cancellation of work owned below that scope must still follow Durable's ownership rules. The operation must define admission during cancellation and behavior across generation handover.
-- Use the native operation directly. After cancellation settles, suppress old unclaimed drafts using existing delivery records; never change `sending`, `sent` or `unknown` receipts or claim that a started send was undone.
-- If preserved inputs require a new boundary, submit one passive cancellation note through the public conversation API. Durable places existing inbox items; the host never copies their content, creates replacement input submissions, or replays the cancelled request.
-- Keep `/run` cancellation and isolated API/cron/background/health sessions separately scoped. This decision does not accept dropping queued run messages or cancelling unrelated sessions.
-
-**API boundary.** Durable 1.0.2 exposes no retain-inbox option on `Conversation.abort()`, and its public transaction API has no atomic task-abort operation. An upstream API change and dependency upgrade are required before this design can be implemented as specified. Do not patch installed package files or write the built-in live/inbox documents to simulate that operation.
-
-**Evidence.** The [inbox example](https://github.com/earendil-works/pi/blob/main/packages/durable/test/examples/20-inbox.ts), installed `harness/generation.js` (`createGeneration`, `handOver`), `harness/scheduler.js` (`abort`, `abortConversation`) and public `Tx` declarations establish the distinction. A bounded faux-provider experiment reproduces generation-ID handover and the stale-ID abort no-op; aborting the current generation preserves the queued input, and a passive write places it without a replacement submission. That experiment does not establish a race-free host cancellation implementation.
-
-**Rejected.** Repeated lookup/abort polling, a host cancellation epoch or mirrored inbox, withdrawing and resubmitting queued inputs, direct edits of Durable internals, and treating a cancelled wait as cancelled work. Also rejected: claiming a single generation-task abort cancels a whole multi-turn request.

package/docs/adr/0016-process-http-transport.md

@@ -1,21 +0,0 @@
-# 0016. Initialize one process-owned HTTP transport
-
-Status: accepted (2026-10-05; owner accepted 2026-10-05)
-
-**Problem.** Pi's global `httpProxy` and `httpIdleTimeoutMs` settings need HTTP transport setup, not just request-option forwarding. Coding-agent's experimental Durable startup calls `applyHttpProxySettings()` and `configureHttpDispatcher()`, but neither is a public export of coding-agent 1.0.2. Merely assigning `HTTP_PROXY` and `HTTPS_PROXY` after Node starts does not reconfigure the dispatcher created by `--use-env-proxy`.
-
-**Example.** An operator sets `httpProxy` in Pi settings without shell proxy variables. The service must use that proxy for authentication and model HTTP requests. Setting the variables at service startup can otherwise leave fetch connecting directly. A provider request timeout also does not replace a socket's inactivity timeout.
-
-**Decision.**
-
-- The host owns one process-wide HTTP setup, initialized before opening model/auth runtime. Individual chats and private Harness instances do not install global dispatchers.
-- Use public Undici APIs, with an exact direct dependency matching the supported SDK implementation, rather than importing private coding-agent files. Supply the global Pi proxy setting only as environment defaults; retain explicit environment proxy values, lowercase precedence and NO_PROXY behavior. Do not accept project-local proxy overrides where Pi accepts only global configuration.
-- Configure native HTTP headers/body idle timeouts from Pi settings, including disabled timeout semantics. Keep transport fetch and dispatcher on the same Undici implementation so compressed responses are decoded consistently. Preserve deliberately supplied fetch implementations. Follow the SDK's connection-family and client-error handling rather than inventing transport retries.
-- `/reload` may replace transport for subsequent requests without cancelling active work. Track transport resources in memory only, let active requests finish on their original clients, and retire old clients safely. During shutdown, stop producers and Harness work before releasing transport; restore globals only if they are still ours. Never close a dispatcher owned by another caller.
-- Durable/provider retry policy and request timeout options remain unchanged. This setup is not a host activity timer, prompt deadline, compaction deadline, inbox or execution loop.
-
-**Consequences.** Process-global HTTP setup belongs to application lifecycle, not per-conversation configuration. Standalone callers with an injected runtime/fetch keep control of their transport. The implementation must verify proxy precedence/bypass, compressed responses, idle timeout enable/disable, reload with active requests, cleanup and custom-fetch preservation against loopback fixtures before claiming compatibility.
-
-**Evidence.** The installed coding-agent `core/http-dispatcher.js` and experimental [harness setup](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/src/experimental/durable/harness-setup.ts) use Undici EnvHttpProxyAgent and matching fetch globals. A bounded Node 26 loopback experiment confirms late environment defaults leave built-in fetch direct, while public Undici 8.10.2 dispatcher plus matching fetch routes through the configured proxy. This establishes an implementation path, not completed lifecycle/timeout behavior or real-provider connectivity.
-
-**Rejected.** Environment mutation as proof of effective transport, request timeout as proof of socket-idle enforcement, private SDK imports, patching installed packages, a new HTTP retry algorithm, and relying on newer Node-only proxy-reset APIs while retaining Node >=22.22.2 support.

package/docs/adr/0017-browser-cli-owned-scope.md

@@ -1,22 +0,0 @@
-# 0017. Invoke browser CLI in a native conversation-owned scope
-
-Status: accepted (2026-10-05; owner accepted 2026-10-05). Replaces only the browser-through-unrestricted-bash part of proposed [0004](0004-native-extensions.md) if accepted.
-
-**Problem.** `PI_BROWSER_HOME` scopes the pi-browser wrapper's profiles/output, not Playwright CLI's daemon registry. CLI 0.1.19 keeps that registry in the user's cache directory, derives daemon workspace identity from `.playwright` or the installed package, and enumerates other workspaces. All chats currently share the same shell environment and working directory. A named session or separate profile directory alone therefore does not preserve the old browser adapter's private-session rules.
-
-**Example.** Two chats both use `-s=task`. Even with different PI_BROWSER_HOME values, they can resolve the same daemon/session and see other registry entries. Giving the model a suggested name is not enforcement.
-
-**Decision.**
-
-- Offer a thin native Durable browser tool that invokes the installed, pinned pi-browser CLI by argv. Do not load an SDK browser extension, emulate ExtensionAPI, vendor CLI internals or implement another browser driver.
-- Derive browser scope from canonical storage identity plus native conversation identity, not a model-selected name. Ordinary chats, runs and isolated API/cron contexts get distinct scope; disallowed read-only contexts do not get the tool.
-- Give only browser child processes a dedicated HOME, profile/output root and scoped working directory. Leave ordinary coding tools' HOME/cwd unchanged. Use public process/CLI controls rather than PWTEST daemon/socket environment variables. Verify daemon discovery and attachment cannot escape the scope, including environment-inherited external browser targets.
-- Always select the owned session/profile and headless mode. Deny attachment/discovery, global close/kill, arbitrary profile/config paths and headed overrides, retaining the old service's restrictions. Expose the ordinary browsing operations needed by the product through validated arguments; operation results remain untrusted data.
-- Close owned browsers at the agreed stop/shutdown boundaries without touching unrelated sessions. Track only external browser resources and cleanup facts, not a second task state machine. Define restart cleanup and privacy retention before claiming isolation. Do not silently delete saved login profiles or replay uncertain browser mutations.
-- Do not mistake this tool boundary for an OS sandbox: unrestricted bash/read can still access host files and invoke other executables. State that limit explicitly; stronger containment requires a separate decision.
-
-**Consequences.** Native tool registration replaces browser instructions as the enforcement boundary for normal product use. The browser skill can still explain workflows, but cannot be the sole privacy mechanism. Actual Chrome/CLI fixtures must verify same-name sessions in different scopes, registry isolation, profile/config rejection and owned cleanup before release.
-
-**Evidence.** The installed wrapper source separates PI_BROWSER_HOME from Playwright's registry. In a temporary copy installed with the locked manifests (`npm ci --ignore-scripts`), CLI 0.1.19's `cli-client/registry.js` uses OS HOME/cache, scans every workspace and exposes only a PWTEST-specific daemon-root override. A bounded temporary-HOME experiment confirms different PI_BROWSER_HOME values share the daemon directory and registry enumeration sees another synthetic workspace. No browser or personal profile was opened. The experiment describes the pinned implementation; production must not import those private files.
-
-**Rejected.** Profile-directory changes or prompt-only session naming as proof of isolation, private PWTEST controls, changing HOME/cwd for all bash tools, SDK extension adaptation, unscoped global browser cleanup and claiming unrestricted coding tools are sandboxed.

package/docs/adr/0018-tasks-without-prompt-api.md

@@ -1,19 +0,0 @@
-# 0018. Ordinary `/stop`; scheduled tasks without HTTP `/prompt` and `/send`
-
-Status: accepted (2026-10-05; owner accepted 2026-10-05). Supersedes proposed [0014](0014-ephemeral-private-storage.md) and [0015](0015-ordinary-stop-keeps-native-inbox.md). Replaces the HTTP `/prompt` clause of proposed [0012](0012-run-in-owned-conversation.md) and the `/send` resend hint of [0003](0003-replies-at-most-once.md).
-
-**Context.** Every production caller of HTTP `/prompt` and `/send` is a script or cron job on the same machine, plus the agent sending files through curl. The work they start runs in a separate context, but its result never reaches the chat's own conversation: when the user replies to a morning summary, the chat does not know what was sent. 0014 and 0015 wait for storage lifecycle work and an upstream Durable API.
-
-**Example.** At 08:00 a cron job runs a script that builds the newsletter prompt; the agent works in its own conversation and sends five links. The user replies "expand the third one". The chat conversation must already hold the five links, not the prompt or tool calls that produced them.
-
-**Decision.**
-
-- **Ordinary `/stop`** (no active `/run`) aborts the generation task that owns the current inputs (`LiveDoc.run`), not the conversation, so later queued messages stay in the inbox. If generation hands the same inputs to a new task meanwhile, abort that one too. Then write a passive `[/stop]` entry so Durable places the queued messages. `/stop` during a run is unchanged.
-- **Tasks.** Cron `prompt` jobs, `schedule_task` firings and background summaries each run in a fresh ownerless conversation, keyed by request ID. Nothing carries over between runs; continuity lives in the chat conversation and memory. Transcripts are kept, not deleted. The model health check reuses one conversation.
-- **The chat records what was sent.** A delivered task answer, and every service or tool send (reminders, cron `send`, background summaries, Automation, `send_message`), is written to the chat conversation as one passive entry with its delivery status, deduplicated by request ID. No extra model turn; the chat's next turn sees it.
-- **No HTTP `/prompt`, `/send` or `ephemeral`.** Cron `send` and `prompt` actions accept an optional `command` (absolute argv). Its stdout replaces the text or prompt; empty output skips the run. Scripts print instead of POSTing, and are scheduled in `cron/jobs.json`. The agent sends files and extra messages with the native `send_message` tool, using the existing direct-send receipts (tool task ID as request ID). Remaining HTTP: read-only pages, reminders, cron management and model health.
-- **Cutover.** The old service still needs `/prompt` and `/send`, so production scripts, crontab entries and `jobs.json` change in the same step as the cutover ([0009](0009-one-shot-cutover.md)).
-
-**Consequences.** One way to start agent work from outside a chat, and one place (the chat conversation) that knows what the user saw. `/stop` uses a bounded lookup/abort retry instead of an atomic native operation. Old `ephemeral` deletion is dropped; private tool output stays searchable under `durable/`. External callers on other machines can no longer prompt the agent; a future multi-entry design decides that. The shared scheduler's `jobs.json` parser gains the optional `command` field.
-
-**Rejected.** Handing task results to the chat as input (an extra model turn, interrupts current work, rewrites the sent text). Private per-session storage (0014). Waiting for an upstream cancellation API (0015). Keeping `/prompt` and `/send` as thin HTTP entries.

package/docs/adr/0019-remove-scheduled-services.md

@@ -1,41 +0,0 @@
-# 0019. Remove scheduled services from the chat application
-
-Status: proposed
-
-**Problem.** The owner wants scheduling removed from this project and will design
-it separately later. Keeping empty job files or startup switches still leaves
-scheduled effects and their dependencies in the chat application's lifecycle.
-
-**Example.** Starting messaging must not create reminder databases, register cron
-jobs, run PT checks or watch completion files, even when old configuration exists.
-
-**Decision.**
-
-- Remove cron, reminders, delayed/repeating prompts, background completion
-  watchers/summaries and PT Automation from source, tools, routes, pages, startup,
-  preflight and direct dependencies. Do not replace them with disabled stubs.
-- Keep messaging, immediate `send_message`, foreground subagents, `/run`, ordinary
-  `/stop`, native task inspection and explicit tool-less model health checks.
-  Keep the six-hour context compaction required by ADR 0008; it is a chat
-  maintenance timer, not user scheduling.
-- Keep existing settings, memory, history, receipts and offline backup/import
-  data intact. Removal does not authorize deleting stored job data, modifying
-  installed Pi extensions, or changing the operating system's crontab/launchd.
-  This application does not manage or stop independent operating-system jobs.
-- Removed scheduling and Automation endpoints return 404. There is no
-  compatibility adapter or automatic migration to another scheduler.
-- Retain historical isolated-conversation metadata for read-only inspection,
-  but do not deliver answers from retired scheduled conversations.
-
-This proposal supersedes the scheduled-service clauses of ADR 0013 and ADR 0018
-only when accepted. Their ordinary stop, immediate sending and receipt decisions
-remain unchanged. Accepted ADR files are not edited. Scope and implementation
-progress are tracked in GitHub #33, not in this document.
-
-**Consequences.** A future scheduler needs its own design and approval. Startup
-still needs independent old producers to be reviewed, and model/Messages live
-acceptance remains separate from removal of scheduled services.
-
-**Rejected.** Merely clearing job definitions, hiding tools while retaining
-workers, reviving HTTP `/prompt` or `/send`, and deleting production state as
-part of a source-code change.