@oh-my-pi/pi-coding-agent 17.2.3 → 17.2.5

package/src/lsp/types.ts

@@ -1,4 +1,3 @@
-import type { ptree } from "@oh-my-pi/pi-utils";
 import { type } from "arktype";
 import { TOOL_TIMEOUTS } from "../tools/tool-timeouts";
 
@@ -370,6 +369,33 @@ export interface ServerConfig {
 	createClient?: LinterClientFactory;
 }
 
+// =============================================================================
+// Transport
+// =============================================================================
+
+/** Minimal write sink for the server-bound byte stream (satisfied by `Bun.FileSink` and the mux socket adapter). */
+export interface LspWriteSink {
+	write(data: string | Uint8Array): number | Promise<number>;
+	flush(): number | void | Promise<number | void>;
+}
+
+/**
+ * Byte transport carrying one LSP JSON-RPC link. Structurally satisfied by
+ * `ptree.ChildProcess<"pipe">` (local server spawn) and by the socket adapter
+ * in `mux/daemon.ts` (broker-shared server). `exited` may reject (ptree kill).
+ */
+export interface LspTransport {
+	readonly stdin: LspWriteSink;
+	readonly stdout: ReadableStream<Uint8Array>;
+	readonly exited: Promise<number>;
+	readonly exitCode: number | null;
+	readonly pid?: number;
+	/** Present and true on broker-shared mux links; `lsp reload` uses it to request a shared-server restart. */
+	readonly sharedMux?: boolean;
+	kill(): void;
+	peekStderr(): string;
+}
+
 // =============================================================================
 // Client State
 // =============================================================================
@@ -401,7 +427,7 @@ export interface LspClient {
 	name: string;
 	cwd: string;
 	config: ServerConfig;
-	proc: ptree.ChildProcess<"pipe">;
+	proc: LspTransport;
 	requestId: number;
 	diagnostics: Map<string, PublishedDiagnostics>;
 	diagnosticsVersion: number;

package/src/main.ts

@@ -41,6 +41,7 @@ import {
 	type ScopedModel,
 } from "./config/model-resolver";
 import { ModelsConfigFile } from "./config/models-config";
+import { serviceTierSettingToTier } from "./config/service-tier";
 import { getDefault, type SettingPath, Settings, type SettingValue, settings } from "./config/settings";
 import { initializeWithSettings } from "./discovery";
 import {
@@ -188,8 +189,9 @@ function applyAcpDefaultSettingOverrides(targetSettings: Settings = settings): v
 	applyDefaultSettingOverrides(HOST_DEFAULTED_SETTING_PATHS, targetSettings);
 }
 
-async function readPipedInput(): Promise<string | undefined> {
-	if (process.stdin.isTTY !== false) return undefined;
+/** Reads a non-TTY stdin stream as prompt text. */
+export async function readPipedInput(): Promise<string | undefined> {
+	if (process.stdin.isTTY === true) return undefined;
 	// stdin is a pipe: a producer that never writes nor closes would block
 	// startup forever with zero output. Say what we're blocked on after 1s.
 	const notice = setTimeout(() => {
@@ -862,6 +864,9 @@ export async function buildSessionOptions(
 		autoApprove: parsed.autoApprove ?? false,
 	};
 	const restoringSession = Boolean(parsed.continue || parsed.resume || isForeignSessionImport(parsed));
+	if (parsed.serviceTier !== undefined) {
+		options.openAIServiceTier = serviceTierSettingToTier(parsed.serviceTier) ?? null;
+	}
 	const cliDirs = parsed.addDir ?? [];
 	const settingsDirs = activeSettings.get("workspace.additionalDirectories");
 	if (cliDirs.length > 0 || settingsDirs.length > 0) {
@@ -1110,14 +1115,13 @@ export async function buildSessionOptions(
 	}
 
 	// Additional extension paths from CLI
-	const cliExtensionPaths = parsed.noExtensions ? [] : [...(parsed.extensions ?? []), ...(parsed.hooks ?? [])];
+	const cliExtensionPaths = [...(parsed.extensions ?? []), ...(parsed.hooks ?? [])];
 	if (cliExtensionPaths.length > 0) {
 		options.additionalExtensionPaths = cliExtensionPaths;
 	}
 
 	if (parsed.noExtensions) {
 		options.disableExtensionDiscovery = true;
-		options.additionalExtensionPaths = [];
 	}
 
 	return options;
@@ -1151,10 +1155,6 @@ export async function runRootCommand(
 
 	const notifs: (InteractiveModeNotify | null)[] = [];
 
-	// Create AuthStorage and ModelRegistry upfront
-	const authStorage = await logger.time("discoverAuthStorage", deps.discoverAuthStorage ?? discoverAuthStorage);
-	const modelRegistry = logger.time("modelRegistry:init", () => new ModelRegistry(authStorage));
-
 	if (parsedArgs.version) {
 		writeStartupNotice(parsedArgs, `${VERSION}\n`);
 		process.exit(0);
@@ -1197,15 +1197,31 @@ export async function runRootCommand(
 	// Register CLI-provided extension package paths (`--extension`, `--hook`) so
 	// the `omp-plugins` discovery provider can surface their `skills/`, `hooks/`,
 	// `tools/`, `commands/`, `rules/`, `prompts/`, and `.mcp.json` sub-trees.
-	// `--no-extensions` short-circuits both the factory load and the sub-discovery.
-	if (!parsedArgs.noExtensions) {
-		const cliExtensions = [...(parsedArgs.extensions ?? []), ...(parsedArgs.hooks ?? [])];
-		if (cliExtensions.length > 0) {
-			injectOmpExtensionCliRoots(cliExtensions, home, getProjectDir());
-		}
-	}
+	// Explicit roots remain authorized under `--no-extensions`; only ambient
+	// extension discovery is disabled.
+	const cliExtensions = [...(parsedArgs.extensions ?? []), ...(parsedArgs.hooks ?? [])];
+	injectOmpExtensionCliRoots(cliExtensions, home, getProjectDir(), {
+		mode: parsedArgs.noExtensions ? "explicit-only" : "merge",
+		replace: true,
+	});
 
 	let cwd = getProjectDir();
+	// Classify the host before opening auth or settings storage so every
+	// session-critical database connection picks the right busy timeout.
+	// See getDbBusyTimeoutMs().
+	const isProtocolMode = mode === "rpc" || mode === "rpc-ui" || mode === "acp";
+	// Protocol modes own stdin; treating it as prompt text would consume JSON-RPC frames before their transports start.
+	const pipedInput = isProtocolMode ? undefined : await logger.time("readPipedInput", readPipedInput);
+	const autoPrint = pipedInput !== undefined && !parsedArgs.print && parsedArgs.mode === undefined;
+	const isInteractive = !parsedArgs.print && !autoPrint && parsedArgs.mode === undefined;
+	// Only the interactive host renders a focusable Agent Hub / subagent session
+	// tree; declare it so headless subagent optimizations (e.g. skipping replan
+	// title refresh) can tell a focusable process from a print/RPC/eval one.
+	setInteractiveHost(isInteractive);
+	// Create AuthStorage and ModelRegistry upfront
+	const authStorage = await logger.time("discoverAuthStorage", deps.discoverAuthStorage ?? discoverAuthStorage);
+	const modelRegistry = logger.time("modelRegistry:init", () => new ModelRegistry(authStorage));
+
 	const settingsInstance =
 		deps.settings ?? (await logger.time("settings:init", Settings.init, { cwd, configFiles: parsedArgs.config }));
 	if (parsedArgs.approvalMode) {
@@ -1228,15 +1244,6 @@ export async function runRootCommand(
 	if (parsedArgs.noTitle || parsedArgs.mode === "rpc" || parsedArgs.mode === "rpc-ui" || parsedArgs.mode === "acp") {
 		Bun.env.PI_NO_TITLE = "1";
 	}
-	const isProtocolMode = mode === "rpc" || mode === "rpc-ui" || mode === "acp";
-	// Protocol modes own stdin; treating it as prompt text would consume JSON-RPC frames before their transports start.
-	const pipedInput = isProtocolMode ? undefined : await logger.time("readPipedInput", readPipedInput);
-	const autoPrint = pipedInput !== undefined && !parsedArgs.print && parsedArgs.mode === undefined;
-	const isInteractive = !parsedArgs.print && !autoPrint && parsedArgs.mode === undefined;
-	// Only the interactive host renders a focusable Agent Hub / subagent session
-	// tree; declare it so headless subagent optimizations (e.g. skipping replan
-	// title refresh) can tell a focusable process from a print/RPC/eval one.
-	setInteractiveHost(isInteractive);
 
 	// Initialize discovery system with settings for provider persistence
 	logger.time("initializeWithSettings", initializeWithSettings, settingsInstance);

package/src/mcp/config.ts

@@ -41,6 +41,7 @@ function convertToLegacyConfig(server: MCPServer): MCPServerConfig {
 	const shared = {
 		enabled: server.enabled,
 		timeout: server.timeout,
+		requestIdFormat: server.requestIdFormat,
 		auth: server.auth,
 		oauth: server.oauth,
 	};

package/src/mcp/oauth-flow.ts

@@ -489,12 +489,22 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 		}
 
 		const data = (await response.json()) as {
-			access_token: string;
+			access_token?: string;
 			refresh_token?: string;
 			expires_in?: number;
 			token_type?: string;
+			error?: string;
+			error_description?: string;
 		};
 
+		// Some providers (e.g. the Slack Web API) signal failure with HTTP 200 and
+		// an `{ ok: false, error }` body. Accepting such a response would store an
+		// empty access token and only surface `invalid_token` on a later request.
+		if (typeof data.access_token !== "string" || data.access_token.length === 0) {
+			const providerError = data.error_description ?? data.error;
+			throw new Error(`Token exchange returned no access token${providerError ? `: ${providerError}` : ""}`);
+		}
+
 		// Calculate expiry timestamp
 		const expiresIn = data.expires_in ?? 3600; // Default to 1 hour
 		const expires = Date.now() + expiresIn * 1000;

package/src/mcp/request-id.ts

@@ -0,0 +1,24 @@
+import { Snowflake } from "@oh-my-pi/pi-utils";
+import type { MCPRequestIdFormat } from "./types";
+
+/**
+ * Per-transport allocator for outgoing JSON-RPC request ids.
+ *
+ * JSON-RPC 2.0 permits String and Number ids equally, but the wider MCP
+ * ecosystem (reference SDKs included) issues incrementing integers, so servers
+ * are best tested against numbers — Apple's `xcrun mcpbridge` even logs
+ * `mcpbridge.DecodeError Code=1` and never answers a string id. Integers are
+ * therefore the default. `"string"` opts a server back into collision-resistant
+ * snowflake ids.
+ *
+ * The counter is per instance and never reset, so ids stay unique for the life
+ * of the transport even though a reconnect rejects and clears every pending
+ * request.
+ */
+export class RequestIdAllocator {
+	#previousNumeric = 0;
+
+	next(format: MCPRequestIdFormat | undefined): string | number {
+		return format === "string" ? Snowflake.next() : ++this.#previousNumeric;
+	}
+}

package/src/mcp/transports/http.ts

@@ -5,7 +5,7 @@
  * Based on MCP spec 2025-03-26.
  */
 import * as AIError from "@oh-my-pi/pi-ai/error";
-import { logger, readSseJson, Snowflake } from "@oh-my-pi/pi-utils";
+import { logger, readSseJson } from "@oh-my-pi/pi-utils";
 import type {
 	JsonRpcError,
 	JsonRpcMessage,
@@ -17,6 +17,7 @@ import type {
 	MCPTransport,
 } from "../../mcp/types";
 import { toJsonRpcError } from "../../mcp/types";
+import { RequestIdAllocator } from "../request-id";
 import { createMCPTimeout, getNeverAbortSignal, isMCPTimeoutEnabled, resolveMCPTimeoutMs } from "../timeout";
 
 const HTTP_SSE_CONNECT_TIMEOUT_MS = 1_000;
@@ -42,6 +43,7 @@ export class HttpTransport implements MCPTransport {
 	#connected = false;
 	#sessionId: string | null = null;
 	#sseConnection: AbortController | null = null;
+	readonly #requestIds = new RequestIdAllocator();
 
 	onClose?: () => void;
 	onError?: (error: Error) => void;
@@ -209,7 +211,7 @@ export class HttpTransport implements MCPTransport {
 			throw new Error("Transport not connected");
 		}
 
-		const id = Snowflake.next();
+		const id = this.#requestIds.next(this.config.requestIdFormat);
 		const body = {
 			jsonrpc: "2.0" as const,
 			id,

package/src/mcp/transports/sse.ts

@@ -1,5 +1,5 @@
 import * as AIError from "@oh-my-pi/pi-ai/error";
-import { logger, readSseEvents, Snowflake } from "@oh-my-pi/pi-utils";
+import { logger, readSseEvents } from "@oh-my-pi/pi-utils";
 import type {
 	JsonRpcError,
 	JsonRpcMessage,
@@ -10,6 +10,7 @@ import type {
 	MCPTransport,
 } from "../../mcp/types";
 import { toJsonRpcError } from "../../mcp/types";
+import { RequestIdAllocator } from "../request-id";
 import { createMCPTimeout, getNeverAbortSignal, resolveMCPTimeoutMs } from "../timeout";
 
 interface MCPTimeoutOperation {
@@ -32,6 +33,7 @@ export class LegacySseTransport implements MCPTransport {
 	#sseConnection: AbortController | null = null;
 	#pending = new Map<string | number, PendingLegacySseRequest>();
 	#config: MCPSseServerConfig;
+	readonly #requestIds = new RequestIdAllocator();
 
 	onClose?: () => void;
 	onError?: (error: Error) => void;
@@ -194,7 +196,7 @@ export class LegacySseTransport implements MCPTransport {
 			throw new Error("Transport not connected");
 		}
 
-		const id = Snowflake.next();
+		const id = this.#requestIds.next(this.#config.requestIdFormat);
 		const body = {
 			jsonrpc: "2.0" as const,
 			id,

package/src/mcp/transports/stdio.ts

@@ -7,7 +7,7 @@
 
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
-import { getProjectDir, readJsonl, Snowflake } from "@oh-my-pi/pi-utils";
+import { getProjectDir, readJsonl } from "@oh-my-pi/pi-utils";
 import type { Subprocess } from "bun";
 import { hostHasInheritableConsole } from "../../eval/py/spawn-options";
 import type {
@@ -20,6 +20,7 @@ import type {
 	MCPTransport,
 } from "../../mcp/types";
 import { toJsonRpcError } from "../../mcp/types";
+import { RequestIdAllocator } from "../request-id";
 import { isMCPTimeoutEnabled, resolveMCPTimeoutMs } from "../timeout";
 
 /** Subprocess argv and platform-derived spawn flags for an MCP stdio server. */
@@ -551,6 +552,7 @@ export class StdioTransport implements MCPTransport {
 	 * actually spawned into its own session may target it.
 	 */
 	#detached = false;
+	readonly #requestIds = new RequestIdAllocator();
 
 	onClose?: () => void;
 	onError?: (error: Error) => void;
@@ -734,7 +736,7 @@ export class StdioTransport implements MCPTransport {
 			throw new Error("Transport not connected");
 		}
 
-		const id = Snowflake.next();
+		const id = this.#requestIds.next(this.config.requestIdFormat);
 		const request = {
 			jsonrpc: "2.0" as const,
 			id,

package/src/mcp/types.ts

@@ -59,12 +59,27 @@ export interface MCPAuthConfig {
 	resource?: string;
 }
 
+/** Encoding used for outgoing JSON-RPC request ids. */
+export type MCPRequestIdFormat = "string" | "number";
+
 /** Base server config with shared options */
 interface MCPServerConfigBase {
 	/** Whether this server is enabled (default: true) */
 	enabled?: boolean;
 	/** MCP request timeout in milliseconds (default: 30000, 0 to disable) */
 	timeout?: number;
+	/**
+	 * Encoding for outgoing JSON-RPC request ids (default: `"number"`).
+	 *
+	 * Set `"string"` for servers that need collision-resistant snowflake string
+	 * ids instead of per-transport integers. See `RequestIdAllocator` in
+	 * `./request-id`.
+	 *
+	 * OMP-specific, so only the OMP-owned discovery providers parse it (native,
+	 * standalone `mcp.json`, OMP plugins). Providers that translate another
+	 * tool's config do not, since the key is not part of those formats.
+	 */
+	requestIdFormat?: MCPRequestIdFormat;
 	/** Authentication configuration (optional) */
 	auth?: MCPAuthConfig;
 	/** OAuth configuration for servers requiring explicit client credentials */

package/src/memory-backend/index.ts

@@ -12,6 +12,7 @@ export type {
 	MnemopiSessionStateOptions,
 } from "../mnemopi/state";
 export * from "./local-backend";
+export * from "./messages";
 export * from "./off-backend";
 export * from "./resolve";
 export * from "./runtime";

package/src/memory-backend/messages.ts

@@ -0,0 +1,19 @@
+import type { MemoryBackendId } from "./types";
+
+/**
+ * Fallback text for `/memory stats` and `/memory diagnose` when the active
+ * backend's hook is missing or returns nothing.
+ *
+ * The `off` backend isn't a real backend a user picked among several
+ * stats-capable options — it's the no-op state memory falls back to by
+ * default — so it gets its own message instead of the generic
+ * "not available for the X backend" template, which would otherwise read as
+ * the self-contradictory "not available for the off backend".
+ *
+ * Shared by both the TUI (`CommandController.handleMemoryCommand`) and the
+ * ACP/RPC slash-command handler so the two surfaces stay consistent.
+ */
+export function memoryStatsUnavailableMessage(backendId: MemoryBackendId, action: "stats" | "diagnose"): string {
+	if (backendId === "off") return "Memory backend is off — there is nothing to show.";
+	return `Memory ${action} is not available for the ${backendId} backend.`;
+}

package/src/mnemopi/embed-client.ts

@@ -84,6 +84,22 @@ export interface MnemopiSubprocessEmbeddingModel {
 	embed(texts: string[], batchSize?: number): AsyncIterable<number[][]>;
 }
 
+/**
+ * Upper bound on a steady-state embed IPC round-trip. Initialization is
+ * intentionally exempt: bundled installs may spend several minutes installing
+ * fastembed and bootstrapping the model, and killing that worker can strand the
+ * runtime install lock. Once initialization succeeds, a longer embed stall
+ * means a hung native runtime (issue #4792) that would otherwise pin whatever
+ * awaits the embed — a turn's memory recall or the headless shutdown
+ * consolidation — indefinitely, leaving the process alive with an unreaped
+ * `__omp_worker_mnemopi_embed` child (issue #7352). On expiry the embed fails
+ * and the worker is SIGKILL-reaped so the next request respawns a fresh one.
+ */
+const EMBED_REQUEST_TIMEOUT_MS = 120_000;
+
+/** Race marker for {@link MnemopiEmbedClient.#awaitRequest}. */
+const REQUEST_TIMED_OUT = Symbol("mnemopi.embed.timedOut");
+
 export class MnemopiEmbedClient {
 	#worker: MnemopiEmbedWorkerHandle | null = null;
 	#unsubscribeMessage: (() => void) | null = null;
@@ -91,9 +107,14 @@ export class MnemopiEmbedClient {
 	#pending = new Map<string, PendingRequest>();
 	#nextRequestId = 0;
 	#spawnWorker: () => MnemopiEmbedWorkerHandle;
+	#requestTimeoutMs: number;
 
-	constructor(spawnWorker: () => MnemopiEmbedWorkerHandle = spawnMnemopiEmbedWorker) {
+	constructor(
+		spawnWorker: () => MnemopiEmbedWorkerHandle = spawnMnemopiEmbedWorker,
+		requestTimeoutMs: number = EMBED_REQUEST_TIMEOUT_MS,
+	) {
 		this.#spawnWorker = spawnWorker;
+		this.#requestTimeoutMs = requestTimeoutMs;
 	}
 
 	/**
@@ -166,7 +187,7 @@ export class MnemopiEmbedClient {
 			// worker's "embed before init" guard. Worker `ensureLoaded` is
 			// idempotent so steady-state embeds pay no extra cost.
 			worker.send({ type: "embed", id, model, cacheDir, texts, batchSize });
-			const result = await promise;
+			const result = await this.#awaitRequest(promise);
 			if (result instanceof Error) throw result;
 			return result;
 		} finally {
@@ -174,6 +195,32 @@ export class MnemopiEmbedClient {
 		}
 	}
 
+	/**
+	 * Await one steady-state embed reply, bounded by
+	 * {@link EMBED_REQUEST_TIMEOUT_MS}. The timeout timer is `unref`'d so a
+	 * pending request never keeps the parent event loop alive on its own (the
+	 * awaiting caller does). On expiry the wedged worker is SIGKILL-reaped via
+	 * {@link terminate} — faulting any other in-flight request and letting the
+	 * next call respawn a fresh child — before the request rejects, so a hung
+	 * native runtime cannot pin a turn's recall or shutdown consolidation
+	 * forever (issue #7352).
+	 */
+	async #awaitRequest<T>(promise: Promise<T>): Promise<T> {
+		const { promise: timedOut, resolve: fire } = Promise.withResolvers<typeof REQUEST_TIMED_OUT>();
+		const timer = setTimeout(() => fire(REQUEST_TIMED_OUT), this.#requestTimeoutMs);
+		timer.unref();
+		try {
+			const winner = await Promise.race([promise, timedOut]);
+			if (winner === REQUEST_TIMED_OUT) {
+				void this.terminate();
+				throw new Error("mnemopi embed worker request timed out");
+			}
+			return winner;
+		} finally {
+			clearTimeout(timer);
+		}
+	}
+
 	async *#streamEmbed(
 		model: MnemopiEmbedModelId,
 		cacheDir: string | undefined,

package/src/mnemopi/state.ts

@@ -4,7 +4,7 @@ import type * as MnemopiNs from "@oh-my-pi/pi-mnemopi";
 import type { Mnemopi, RecallResult } from "@oh-my-pi/pi-mnemopi";
 import type * as MnemopiCoreNs from "@oh-my-pi/pi-mnemopi/core";
 import type { LocalModelInitializer } from "@oh-my-pi/pi-mnemopi/core";
-import { logger } from "@oh-my-pi/pi-utils";
+import { logger, toError } from "@oh-my-pi/pi-utils";
 import {
 	composeRecallQuery,
 	formatCurrentTime,
@@ -386,6 +386,8 @@ export class MnemopiSessionState {
 		const merged: RecallResult[] = [];
 		const byId = new Map<string, number>();
 		const byContent = new Map<string, number>();
+		const failures: Array<{ bank: string; error: Error }> = [];
+		let successfulTargets = 0;
 		const sharedFallbackQuery = deriveSharedRecallFallbackQuery(
 			query,
 			this.scoped.retain.bank,
@@ -394,24 +396,35 @@ export class MnemopiSessionState {
 		for (const target of this.scoped.recall) {
 			const queries =
 				target.bank === this.scoped.global?.bank && sharedFallbackQuery ? [query, sharedFallbackQuery] : [query];
+			let targetSucceeded = false;
 			try {
 				for (const recallQuery of queries) {
 					const results = await target.memory.recallEnhanced(recallQuery, this.config.recallLimit, {
 						includeFacts: true,
 						channelId: target.bank,
 					});
+					targetSucceeded = true;
 					for (const result of results) {
 						mergeRecallResult(merged, byId, byContent, result);
 					}
 				}
 			} catch (error) {
-				if (this.config.debug) {
-					logger.debug("Mnemopi: scoped recall target failed", {
-						bank: target.bank,
-						error: String(error),
-					});
-				}
+				const failure = toError(error);
+				failures.push({ bank: target.bank, error: failure });
+				logger.warn("Mnemopi: scoped recall target failed", {
+					bank: target.bank,
+					error: failure.message,
+				});
 			}
+			if (targetSucceeded) successfulTargets++;
+		}
+		if (successfulTargets === 0 && failures.length > 0) {
+			if (failures.length === 1) throw failures[0].error;
+			const details = failures.map(({ bank, error }) => `${bank}: ${error.message}`).join("; ");
+			throw new AggregateError(
+				failures.map(({ error }) => error),
+				`Mnemopi recall failed for all scoped targets (${details})`,
+			);
 		}
 		merged.sort(compareRecallResults);
 		if (merged.length > this.config.recallLimit) merged.length = this.config.recallLimit;
@@ -575,7 +588,16 @@ export class MnemopiSessionState {
 		if (!lastUser) return;
 		const query = composeRecallQuery(lastUser.content, messages, this.config.recallContextTurns);
 		const truncated = truncateRecallQuery(query, lastUser.content, this.config.recallMaxQueryChars);
-		const context = await this.recallForContext(truncated);
+		let context: string | undefined;
+		try {
+			context = await this.recallForContext(truncated);
+		} catch (error) {
+			logger.warn("Mnemopi: auto-recall failed", {
+				bank: this.config.bank,
+				error: toError(error).message,
+			});
+			return;
+		}
 		this.hasRecalledForFirstTurn = true;
 		if (!context) return;
 		this.lastRecallSnippet = context;
@@ -639,17 +661,26 @@ export class MnemopiSessionState {
 	 * tokens on memories that will be wiped on the next line is wasted work
 	 * (PR #2327 review).
 	 *
-	 * `timeoutMs` caps how long the consolidate await blocks the caller
-	 * (the user-visible `/quit` / `/exit` shutdown path passes this so
-	 * dispose returns within a UX budget — issue #3641). When the cap is
-	 * hit, dispose returns immediately and detaches the still-in-flight
-	 * consolidate; the SQLite handles are closed in the background once
-	 * the consolidate settles so writes never race a closed handle, and
-	 * any pending embeddings are SIGKILL'd along with the embed worker
+	 * `timeoutMs` caps both synchronous SQLite lock waits during final retention
+	 * and the asynchronous consolidation drain (the user-visible `/quit`,
+	 * `/exit`, and print paths pass this so disposal stays within their shutdown
+	 * budget). When the cap is hit, dispose returns immediately and detaches the
+	 * still-in-flight consolidate; the SQLite handles are closed in the
+	 * background once the consolidate settles so writes never race a closed handle,
+	 * and any pending embeddings are SIGKILL'd along with the embed worker
 	 * (a tolerable loss — working memory rows are durable; only the
 	 * episodic promotion / embedding for the LAST few turns is skipped,
 	 * and `maybeRetainOnAgentEnd` has already retained earlier turns).
 	 */
+	#boundOwnedBusyTimeout(timeoutMs: number): void {
+		// SQLite lock waits block the JS thread, so a Promise race cannot interrupt
+		// them. consolidate() flushes every owned bank, so bound each one — not just
+		// the retain bank — or a locked shared bank (per-project-tagged) still stalls
+		// teardown for Mnemopi's default 5s busy timeout (#7351 review).
+		const busyTimeoutMs = Math.max(1, Math.floor(timeoutMs));
+		for (const memory of this.scoped.owned) memory.beam.db.exec(`PRAGMA busy_timeout=${busyTimeoutMs}`);
+	}
+
 	async dispose(options: { consolidate?: boolean; timeoutMs?: number } = {}): Promise<void> {
 		this.unsubscribe?.();
 		this.unsubscribe = undefined;
@@ -661,19 +692,22 @@ export class MnemopiSessionState {
 			closeOwned();
 			return;
 		}
+		const { timeoutMs } = options;
+		const boundedTimeoutMs = timeoutMs !== undefined && timeoutMs > 0 ? timeoutMs : undefined;
+		const deadline = boundedTimeoutMs !== undefined ? performance.now() + boundedTimeoutMs : undefined;
+		if (boundedTimeoutMs !== undefined) this.#boundOwnedBusyTimeout(boundedTimeoutMs);
 		const consolidatePromise = this.consolidate({ full: false, extract: false, sleep: false }).catch(
 			(error: unknown) => {
 				logger.warn("Mnemopi: consolidation on dispose failed.", { error: String(error) });
 			},
 		);
-		const { timeoutMs } = options;
-		if (timeoutMs !== undefined && timeoutMs > 0) {
-			const TIMED_OUT = Symbol("mnemopi.dispose.timedOut");
-			const winner = await Promise.race([
-				consolidatePromise.then(() => undefined as unknown),
-				Bun.sleep(timeoutMs).then(() => TIMED_OUT as unknown),
-			]);
-			if (winner === TIMED_OUT) {
+		if (deadline !== undefined) {
+			const remainingMs = deadline - performance.now();
+			const completed =
+				remainingMs > 0
+					? await Promise.race([consolidatePromise.then(() => true), Bun.sleep(remainingMs).then(() => false)])
+					: false;
+			if (!completed) {
 				logger.warn("Mnemopi: consolidate-on-dispose exceeded shutdown budget; detaching to background.", {
 					timeoutMs,
 				});

package/src/modes/components/agent-hub.ts

@@ -636,7 +636,7 @@ export class AgentHubOverlayComponent extends Container {
 				if (ref.status === "running" && ref.session) {
 					await ref.session.abort({ reason: USER_INTERRUPT_LABEL });
 				}
-				await this.#lifecycle().release(ref.id, ref);
+				await this.#lifecycle().release(ref.id, ref, { tombstone: true });
 			} catch (error) {
 				logger.warn("Agent hub: kill failed", { id: ref.id, error: String(error) });
 				this.#notice = error instanceof Error ? error.message : String(error);

package/src/modes/components/assistant-message.ts

@@ -185,6 +185,7 @@ export class AssistantMessageComponent extends Container {
 	#toolImagesByCallId = new Map<string, ImageContent[]>();
 	#convertedKittyImages = new Map<string, ImageContent>();
 	#showImages = true;
+	#showToolResultImages = true;
 	#kittyConversionsInFlight = new Set<string>();
 	#transcriptBlockFinalized: boolean;
 	/**
@@ -578,6 +579,15 @@ export class AssistantMessageComponent extends Container {
 		}
 	}
 
+	/** Toggle only images produced by tool results; assistant-native images remain governed by setImagesVisible. */
+	setToolResultImagesVisible(visible: boolean): void {
+		if (this.#showToolResultImages === visible) return;
+		this.#showToolResultImages = visible;
+		if (this.#lastMessage) {
+			this.updateContent(this.#lastMessage, { transient: this.#lastUpdateTransient });
+		}
+	}
+
 	setToolResultImages(toolCallId: string, images: ImageContent[]): void {
 		if (!toolCallId) return;
 		const validImages = images.filter(img => img.type === "image" && img.data && img.mimeType);
@@ -649,6 +659,7 @@ export class AssistantMessageComponent extends Container {
 	}
 
 	#renderToolImages(): void {
+		if (!this.#showToolResultImages) return;
 		const entries = Array.from(this.#toolImagesByCallId.entries()).flatMap(([toolCallId, images]) =>
 			images.map((image, index) => ({ image, key: `${toolCallId}:${index}` })),
 		);