@pasko70/pibo 3.2.3 → 3.2.4

package/dist/agent-runtime/auth.js

@@ -1,11 +1,9 @@
+import { redactSensitiveText } from "../core/sensitive-data-redaction.js";
 export const AGENT_RUNTIME_AUTH_METHOD_IDS = ["device_code", "browser_oauth", "api_key"];
 export const AGENT_RUNTIME_AUTH_COMPLETION_MODES = ["immediate", "explicit", "notification"];
 export function redactAgentRuntimeAuthText(value, maxLength = 1_000) {
-    return value
-        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-        .replace(/\b(?:sk|pk|ghp|github_pat|pibo)[-_][A-Za-z0-9_-]{8,}\b/g, "[redacted]")
-        .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[redacted]")
-        .replace(/\b(access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password|account[_-]?id)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,}]+)/gi, "$1$2[redacted]")
+    return redactSensitiveText(value)
+        .replace(/\b(account[_-]?id)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,}]+)/gi, "$1$2[redacted]")
         .replace(/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, "[redacted account]")
         .replace(/`(?:\/|[A-Za-z]:[\\/])[^`\r\n]+`/g, "`[redacted path]`")
         .replace(/\bfile:\/\/\/?[^\s"'`,)]+/gi, "file://[redacted path]")

package/dist/agent-runtime/portable-history.js

@@ -432,7 +432,7 @@ function boundEntries(entries, limits) {
         const normalized = normalizeEntrySize(entry);
         const size = entryBytes(normalized);
         if (selected.length >= limits.maxEntries || bytes + size > limits.maxBytes)
-            continue;
+            break;
         selected.push(normalized);
         bytes += size;
     }

package/dist/agent-runtimes/codex-native/client.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { redactSensitiveText } from "../../core/sensitive-data-redaction.js";
 const DEFAULT_STARTUP_TIMEOUT_MS = 10_000;
 const DEFAULT_REQUEST_TIMEOUT_MS = 120_000;
 const DEFAULT_SHUTDOWN_TIMEOUT_MS = 2_000;
@@ -92,11 +93,7 @@ function validateInitializeResponse(value) {
     };
 }
 function redactCodexAppServerDiagnostic(value) {
-    return value
-        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-        .replace(/\b(?:sk|pk|ghp|github_pat|pibo)[-_][A-Za-z0-9_-]{8,}\b/g, "[redacted]")
-        .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[redacted]")
-        .replace(/\b(access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,}]+)/gi, "$1$2[redacted]")
+    return redactSensitiveText(value)
         .replace(/`(?:\/|[A-Za-z]:[\\/])[^`\r\n]+`/g, "`[redacted path]`")
         .replace(/\bfile:\/\/\/?[^\s"'`,)]+/gi, "file://[redacted path]")
         .slice(0, 4_000);

package/dist/agent-runtimes/codex-native/redaction.js

@@ -1,31 +1,7 @@
-const SENSITIVE_KEY_PATTERN = /(?:authorization|cookie|credential|access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password)/i;
+import { redactSensitiveText, redactSensitiveValue } from "../../core/sensitive-data-redaction.js";
 export function redactCodexNativeSensitiveText(value) {
-    return value
-        .replace(/Bearer\s+\S+/gi, "Bearer [redacted]")
-        .replace(/\b(?:sk|pk|ghp|github_pat|pibo)[-_][A-Za-z0-9_-]{8,}\b/g, "[redacted]")
-        .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[redacted]")
-        .replace(/\b(access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|token|secret|password)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,}]+)/gi, "$1$2[redacted]");
+    return redactSensitiveText(value);
 }
 export function redactCodexNativeValue(value, key, depth = 0) {
-    if (key && SENSITIVE_KEY_PATTERN.test(key))
-        return "[redacted]";
-    if (depth > 32)
-        return "[maximum depth reached]";
-    if (value === null || typeof value === "boolean")
-        return value;
-    if (typeof value === "string")
-        return redactCodexNativeSensitiveText(value);
-    if (typeof value === "number")
-        return Number.isFinite(value) ? value : String(value);
-    if (Array.isArray(value))
-        return value.map((entry) => redactCodexNativeValue(entry, undefined, depth + 1));
-    if (value && typeof value === "object") {
-        const result = {};
-        for (const [entryKey, entryValue] of Object.entries(value)) {
-            if (entryValue !== undefined)
-                result[entryKey] = redactCodexNativeValue(entryValue, entryKey, depth + 1);
-        }
-        return result;
-    }
-    return String(value);
+    return redactSensitiveValue(value, key, depth);
 }

package/dist/agent-runtimes/omp/client.js

@@ -1,4 +1,5 @@
 import { spawn } from "node:child_process";
+import { redactSensitiveText } from "../../core/sensitive-data-redaction.js";
 import { randomUUID } from "node:crypto";
 import { OMP_RPC_CHUNK_PAYLOAD_BYTES, OMP_RPC_MAX_FRAME_BYTES, OMP_RPC_PROTOCOL_VERSION, } from "./protocol-types.js";
 const DEFAULT_STARTUP_TIMEOUT_MS = 15_000;
@@ -109,10 +110,7 @@ export class OmpRpcClient {
      * stderr (which may echo prompts or provider keys) cannot leak secrets.
      */
     static redactDiagnostic(message) {
-        return message
-            .replace(/\b(?:sk|rk|pk|ghp|github_pat)[-_][A-Za-z0-9._~+/-]{8,}\b/g, "[redacted]")
-            .replace(/\bBearer\s+\S+/gi, "Bearer [redacted]")
-            .replace(/\b(?:api[_-]?key|secret|token|password)\b(?=[:=]\s*)\s*[^\s,;]+/gi, "$1 [redacted]");
+        return redactSensitiveText(message);
     }
     emitDiagnostic(message) {
         for (const listener of this.diagnosticListeners)

package/dist/agent-runtimes/pi/adapter.js

@@ -635,6 +635,7 @@ class PiAgentRuntimeAdapter {
         const intentTracing = piIntentTracingEnabled(profile.runtimeOptions);
         const runtime = await createPiboRuntime({
             cwd: input.workspace,
+            piPackageStoreCwd: compatibility?.piPackageStoreCwd,
             persistSession: compatibility?.persistSession,
             profile,
             thinkingLevel: compatibility?.thinkingLevel,

package/dist/agent-runtimes/pi/runtime.js

@@ -223,7 +223,7 @@ export async function createPiboRuntime(options = {}) {
         const skillPaths = options.resources
             ? [...options.resources.getSkillPaths("source")]
             : getEnabledSkillPaths(runtimeCwd, profile);
-        const piPackageOptions = getPiPackageRuntimeOptions(runtimeCwd, profile);
+        const piPackageOptions = getPiPackageRuntimeOptions(options.piPackageStoreCwd ?? runtimeCwd, profile);
         let runtimeSettingsManager;
         const services = await createAgentSessionServices({
             cwd: runtimeCwd,

package/dist/apps/chat/agent-store.js

@@ -62,7 +62,7 @@ export function previewCustomAgentUpdate(existing, input, options = {}) {
         profileName,
         displayName: input.displayName ?? existing.displayName,
         folderId: input.folderId === undefined ? existing.folderId : input.folderId ?? undefined,
-        description: input.description === undefined ? existing.description : input.description,
+        description: input.description === undefined ? existing.description : input.description ?? undefined,
         runtimeInstanceId: input.runtimeInstanceId === undefined ? existing.runtimeInstanceId : sanitizeRuntimeInstanceId(input.runtimeInstanceId),
         runtimeOptions: input.runtimeOptions === undefined ? existing.runtimeOptions : cloneRuntimeOptions(input.runtimeOptions),
         nativeSubagents: input.nativeSubagents === undefined ? existing.nativeSubagents : sanitizeBoolean(input.nativeSubagents),

package/dist/apps/chat/chat-files.js

@@ -6,7 +6,7 @@ import { protectPrivateDirectorySync, protectPrivateFileSync } from "../../core/
 import { PiboWebHttpError } from "../../web/http.js";
 import { imageMimeTypeFromBytes, TRACE_IMAGE_MAX_DECODED_BYTES } from "./trace-v2.js";
 export const CHAT_UPLOAD_DIR = piboHomePath("uploads");
-const CHAT_FILE_ATTACHMENT_LIMIT = 10;
+export const CHAT_FILE_ATTACHMENT_LIMIT = 10;
 export function prepareChatFileAttachments(input) {
     const paths = normalizeChatFileAttachmentPaths(input.attachmentPaths);
     if (!paths.length)
@@ -34,6 +34,8 @@ export async function saveUploadedChatFiles(request) {
     }
     if (!files.length)
         throw new PiboWebHttpError("No files were uploaded", 400);
+    if (files.length > CHAT_FILE_ATTACHMENT_LIMIT)
+        throw new PiboWebHttpError(`At most ${CHAT_FILE_ATTACHMENT_LIMIT} uploaded files can be attached`, 400);
     ensurePrivateChatUploadDirectory();
     const saved = [];
     for (const file of files) {

package/dist/apps/chat/chat-request-normalizers.js

@@ -749,7 +749,7 @@ export function createAgentUpdate(body) {
     if (body.displayName !== undefined)
         update.displayName = normalizeAgentDisplayName(body.displayName);
     if (body.description !== undefined)
-        update.description = normalizeAgentDescription(body.description);
+        update.description = normalizeAgentDescription(body.description) ?? null;
     if (body.folderId !== undefined)
         update.folderId = normalizeAgentFolderId(body.folderId);
     if (body.runtimeInstanceId !== undefined)

package/dist/apps/chat/chat-user-skill-routes.js

@@ -170,6 +170,13 @@ export async function handleChatUserSkillRoute(options) {
             const existing = userSkillManager.get(route.skillId, scope);
             if (!existing)
                 throw new PiboWebHttpError("Skill not found", 404);
+            const hasEnabledReplacement = userSkillManager.list("all").some((skill) => (skill.id !== existing.id && skill.enabled && skill.name === existing.name));
+            const affectedAgents = existing.enabled && !hasEnabledReplacement
+                ? options.agentsSelectingSkill(existing.name)
+                : [];
+            if (affectedAgents.length > 0) {
+                throw new PiboWebHttpError(`Skill is selected by custom agents: ${affectedAgents.map((agent) => agent.profileName).join(", ")}`, 409);
+            }
             userSkillManager.remove(existing.id, scope);
             syncAndInvalidate(options);
             return responseJson({ removedSkillId: existing.id });

package/dist/apps/chat/data/project-service.js

@@ -333,6 +333,24 @@ export class ChatProjectService {
         const rows = this.db.prepare(`SELECT * FROM project_workflow_wait_tokens ${where} ORDER BY created_at DESC, id DESC LIMIT ?`).all(...values, limit);
         return rows.map(projectWorkflowWaitTokenFromRow);
     }
+    expireProjectWorkflowWaitToken(input) {
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            const token = this.getProjectWorkflowWaitToken(input.waitTokenId);
+            if (!token)
+                throw new Error("Workflow wait token not found");
+            if (token.projectId !== input.projectId || token.piboSessionId !== input.piboSessionId || token.workflowRunId !== input.workflowRunId) {
+                throw new Error("Workflow wait token does not belong to this Project workflow session");
+            }
+            const result = this.expireProjectWorkflowWaitTokenLocked(token, input.resolvedAt ?? new Date().toISOString());
+            this.db.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            this.db.exec("ROLLBACK");
+            throw error;
+        }
+    }
     listProjectWorkflowHumanActions(filter = {}) {
         const clauses = [];
         const values = [];
@@ -370,7 +388,7 @@ export class ChatProjectService {
                 throw new Error(`Workflow wait token is ${token.status} and cannot be resolved again`);
             const actedAt = input.actedAt ?? new Date().toISOString();
             if (token.expiresAt && Date.parse(token.expiresAt) <= Date.parse(actedAt)) {
-                this.db.prepare("UPDATE project_workflow_wait_tokens SET status = 'expired', resolved_at = ? WHERE id = ?").run(actedAt, token.id);
+                this.expireProjectWorkflowWaitTokenLocked(token, actedAt);
                 this.db.exec("COMMIT");
                 throw new Error(`Workflow wait token expired at ${token.expiresAt}`);
             }
@@ -494,6 +512,36 @@ export class ChatProjectService {
         this.db.prepare("UPDATE project_sessions SET archived = ?, updated_at = ? WHERE pibo_session_id = ?").run(archived ? 1 : 0, now, piboSessionId);
         return this.getProjectSession(piboSessionId);
     }
+    expireProjectWorkflowWaitTokenLocked(token, resolvedAt) {
+        if (token.status !== "pending")
+            throw new Error(`Workflow wait token is ${token.status} and cannot be expired again`);
+        const resolvedAtMs = Date.parse(resolvedAt);
+        if (!Number.isFinite(resolvedAtMs))
+            throw new Error("Workflow wait token expiry resolution time is invalid");
+        if (!token.expiresAt || Date.parse(token.expiresAt) > resolvedAtMs)
+            throw new Error("Workflow wait token has not expired");
+        const pendingTokens = this.db.prepare(`SELECT id, expires_at FROM project_workflow_wait_tokens
+			WHERE project_id = ? AND pibo_session_id = ? AND workflow_run_id = ? AND status = 'pending'`)
+            .all(token.projectId, token.piboSessionId, token.workflowRunId);
+        const expire = this.db.prepare("UPDATE project_workflow_wait_tokens SET status = 'expired', resolved_at = ? WHERE id = ? AND status = 'pending'");
+        for (const pendingToken of pendingTokens) {
+            if (pendingToken.expires_at && Date.parse(pendingToken.expires_at) <= resolvedAtMs)
+                expire.run(resolvedAt, pendingToken.id);
+        }
+        const pending = this.db.prepare(`SELECT COUNT(*) AS count FROM project_workflow_wait_tokens
+			WHERE project_id = ? AND pibo_session_id = ? AND workflow_run_id = ? AND status = 'pending'`)
+            .get(token.projectId, token.piboSessionId, token.workflowRunId);
+        const nextStatus = pending.count === 0 ? "failed" : "waiting";
+        this.db.prepare("UPDATE project_workflow_runs SET status = ?, updated_at = ?, failed_at = CASE WHEN ? = 'failed' THEN COALESCE(failed_at, ?) ELSE failed_at END WHERE id = ? AND project_id = ? AND pibo_session_id = ? AND status IN ('running', 'waiting')")
+            .run(nextStatus, resolvedAt, nextStatus, resolvedAt, token.workflowRunId, token.projectId, token.piboSessionId);
+        this.db.prepare("UPDATE project_sessions SET state = ?, updated_at = ? WHERE pibo_session_id = ? AND project_id = ? AND state IN ('running', 'waiting')")
+            .run(nextStatus, resolvedAt, token.piboSessionId, token.projectId);
+        return {
+            waitToken: this.getProjectWorkflowWaitToken(token.id),
+            run: this.getProjectWorkflowRun(token.workflowRunId),
+            projectSession: this.getProjectSession(token.piboSessionId),
+        };
+    }
     insertProjectWorkflowRunForExistingSession(row, input) {
         const now = new Date().toISOString();
         const run = {

package/dist/apps/chat/data/session-query-service.js

@@ -77,12 +77,52 @@ export class ChatSessionQueryService {
         if (!piboSessionIds.length)
             return 0;
         const placeholders = piboSessionIds.map(() => "?").join(", ");
-        this.store.db.prepare(`DELETE FROM observations WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
-        this.store.db.prepare(`DELETE FROM chat_messages WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
-        this.store.db.prepare(`DELETE FROM event_log WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
-        this.store.db.prepare(`DELETE FROM session_navigation WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
-        const result = this.store.db.prepare(`UPDATE sessions SET deleted_at = COALESCE(deleted_at, ?) WHERE id IN (${placeholders})`).run(new Date().toISOString(), ...piboSessionIds);
-        return Number(result.changes ?? 0);
+        const payloadReleaseCounts = this.payloadReleaseCounts(placeholders, piboSessionIds);
+        const releasedPayloads = [];
+        const deleted = this.store.transaction(() => {
+            this.store.db.prepare(`DELETE FROM observations WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
+            this.store.db.prepare(`DELETE FROM chat_messages WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
+            this.store.db.prepare(`DELETE FROM event_log WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
+            this.store.db.prepare(`DELETE FROM session_navigation WHERE session_id IN (${placeholders})`).run(...piboSessionIds);
+            for (const [payloadId, count] of payloadReleaseCounts) {
+                const released = this.store.payloads.releaseReferences(payloadId, count);
+                if (released)
+                    releasedPayloads.push(released);
+            }
+            const result = this.store.db.prepare(`UPDATE sessions SET deleted_at = COALESCE(deleted_at, ?) WHERE id IN (${placeholders})`).run(new Date().toISOString(), ...piboSessionIds);
+            return Number(result.changes ?? 0);
+        });
+        for (const payload of releasedPayloads)
+            this.store.payloads.removeReleasedFile(payload);
+        return deleted;
+    }
+    payloadReleaseCounts(placeholders, piboSessionIds) {
+        const logicalReferences = new Map();
+        const add = (payloadId, key) => {
+            if (!payloadId)
+                return;
+            let references = logicalReferences.get(payloadId);
+            if (!references) {
+                references = new Set();
+                logicalReferences.set(payloadId, references);
+            }
+            references.add(key);
+        };
+        const events = this.store.db.prepare(`SELECT stream_id, payload_ref FROM event_log WHERE session_id IN (${placeholders}) AND payload_ref IS NOT NULL`).all(...piboSessionIds);
+        const eventPayloads = new Map(events.map((row) => [row.stream_id, row.payload_ref]));
+        for (const row of events)
+            add(row.payload_ref, `event:${row.stream_id}`);
+        const messages = this.store.db.prepare(`SELECT id, source_stream_id, content_payload_ref FROM chat_messages WHERE session_id IN (${placeholders}) AND content_payload_ref IS NOT NULL`).all(...piboSessionIds);
+        for (const row of messages) {
+            const linked = row.source_stream_id !== null && eventPayloads.get(row.source_stream_id) === row.content_payload_ref;
+            add(row.content_payload_ref, linked ? `event:${row.source_stream_id}` : `message:${row.id}`);
+        }
+        const observations = this.store.db.prepare(`SELECT id, event_stream_id, payload_ref FROM observations WHERE session_id IN (${placeholders}) AND payload_ref IS NOT NULL`).all(...piboSessionIds);
+        for (const row of observations) {
+            const linked = row.event_stream_id !== null && eventPayloads.get(row.event_stream_id) === row.payload_ref;
+            add(row.payload_ref, linked ? `event:${row.event_stream_id}` : `observation:${row.id}`);
+        }
+        return new Map([...logicalReferences].map(([payloadId, references]) => [payloadId, references.size]));
     }
     close() { }
     sessionIndexMatches(session, status = "idle") {

package/dist/apps/chat/loop-api.js

@@ -1,5 +1,6 @@
 import { PiboWebHttpError, readJsonBody, responseJson } from '../../web/http.js';
 import { getPiboLoopService } from '../../loops/channel.js';
+import { PiboLoopCapacityError } from '../../loops/service.js';
 import { listLoopJobTemplates } from '../../loops/templates.js';
 import { isPiboThinkingLevel } from '../../core/thinking.js';
 import { normalizeLoopStopPolicy, PiboLoopActiveRunModeChangeError } from '../../loops/store.js';
@@ -140,7 +141,15 @@ export async function handleChatLoopApiRequest(options) {
         if (!service)
             throw new PiboWebHttpError('Loop service is not running', 503);
         if (resource.child === 'start') {
-            const run = await service.startJob(resource.id);
+            let run;
+            try {
+                run = await service.startJob(resource.id);
+            }
+            catch (error) {
+                if (error instanceof PiboLoopCapacityError)
+                    throw new PiboWebHttpError(error.message, 409);
+                throw error;
+            }
             if (!run)
                 throw new PiboWebHttpError('Loop job not found, already running, or stopped by a before-run condition', 404);
             return responseJson({ run: serializeRun(run) }, { status: 202 });

package/dist/apps/chat/ralph-api.js

@@ -1,5 +1,6 @@
 import { PiboWebHttpError, readJsonBody, responseJson } from '../../web/http.js';
 import { getPiboRalphService } from '../../ralph/channel.js';
+import { PiboRalphCapacityError } from '../../ralph/service.js';
 import { listRalphJobTemplates } from '../../ralph/templates.js';
 import { isPiboThinkingLevel } from '../../core/thinking.js';
 import { normalizeRalphStopPolicy } from '../../ralph/store.js';
@@ -116,7 +117,15 @@ export async function handleChatRalphApiRequest(options) {
         if (!service)
             throw new PiboWebHttpError('Ralph service is not running', 503);
         if (resource.child === 'start') {
-            const run = await service.startJob(resource.id);
+            let run;
+            try {
+                run = await service.startJob(resource.id);
+            }
+            catch (error) {
+                if (error instanceof PiboRalphCapacityError)
+                    throw new PiboWebHttpError(error.message, 409);
+                throw error;
+            }
             if (!run)
                 throw new PiboWebHttpError('Ralph job not found, already running, or stopped by a before-run condition', 404);
             return responseJson({ run: serializeRun(run) }, { status: 202 });

package/dist/apps/chat/web-app.js

@@ -2379,6 +2379,11 @@ function agentsSelectingPiPackage(state, packageId) {
         .list({ includeArchived: true })
         .filter((agent) => agent.piPackages.some((selected) => aliases.has(selected)));
 }
+function agentsSelectingSkill(state, skillName) {
+    return state.agentStore
+        .list({ includeArchived: true })
+        .filter((agent) => agent.skills.includes(skillName));
+}
 function normalizeAgentDeleteConfirmation(value) {
     if (typeof value !== "string" || value.trim().length === 0) {
         throw new PiboWebHttpError("Type the agent name to permanently delete it.", 400);
@@ -2615,6 +2620,7 @@ async function buildContextBuildSnapshotForRequest(input) {
         if (runtime.adapterId === "pi" && runtimeInfo.available) {
             const snapshot = await inspectPiboContextBuild({
                 cwd,
+                piPackageStoreCwd: input.piPackageStoreCwd,
                 profile,
                 activeModel: selectedSession.activeModel,
                 thinkingLevel: initialThinkingLevel,
@@ -3283,9 +3289,15 @@ function submitProjectWorkflowHumanAction(input) {
         humanActionOptions: WORKFLOW_HUMAN_ACTION_REF_OPTIONS,
     });
     if (validation.diagnostics.length) {
-        if (waitToken && validation.expiredAt) {
-            input.state.projectService.saveProjectWorkflowWaitToken({ ...waitToken, status: "expired", resolvedAt: validation.checkedAt });
-        }
+        const responseWaitToken = waitToken && validation.expiredAt
+            ? input.state.projectService.expireProjectWorkflowWaitToken({
+                projectId: project.id,
+                piboSessionId: session.id,
+                workflowRunId: projectSession.workflowRunId,
+                waitTokenId: waitToken.id,
+                resolvedAt: validation.checkedAt,
+            }).waitToken
+            : waitToken;
         recordWorkflowLifecycleEvent(input.state, input.webSession, {
             type: "workflow.human_action.submitted",
             workflowId: projectSession.workflowId,
@@ -3297,7 +3309,7 @@ function submitProjectWorkflowHumanAction(input) {
             diagnostics: validation.diagnostics,
             payload: projectWorkflowHumanActionLifecyclePayload(request),
         });
-        return projectWorkflowHumanActionDiagnosticResponse("Human action was rejected by wait-token validation", validation.diagnostics, validation.httpStatus, waitToken, WORKFLOW_HUMAN_ACTION_REF_OPTIONS);
+        return projectWorkflowHumanActionDiagnosticResponse("Human action was rejected by wait-token validation", validation.diagnostics, validation.httpStatus, responseWaitToken, WORKFLOW_HUMAN_ACTION_REF_OPTIONS);
     }
     try {
         const result = input.state.projectService.resolveProjectWorkflowHumanAction({
@@ -3347,7 +3359,8 @@ function submitProjectWorkflowHumanAction(input) {
             diagnostics,
             payload: projectWorkflowHumanActionLifecyclePayload(request),
         });
-        return projectWorkflowHumanActionDiagnosticResponse("Human action was rejected by wait-token validation", diagnostics, 409, waitToken, WORKFLOW_HUMAN_ACTION_REF_OPTIONS);
+        const responseWaitToken = input.state.projectService.getProjectWorkflowWaitToken(request.waitTokenId) ?? waitToken;
+        return projectWorkflowHumanActionDiagnosticResponse("Human action was rejected by wait-token validation", diagnostics, 409, responseWaitToken, WORKFLOW_HUMAN_ACTION_REF_OPTIONS);
     }
 }
 function isProjectWorkflowBackedSession(projectSession) {
@@ -3374,6 +3387,7 @@ async function sendProjectMessage(input) {
     const projectSession = input.state.projectService.getProjectSession(selectedSession.id);
     if (!projectSession)
         throw new PiboWebHttpError("Project session not found", 404);
+    requireSharedProject(input.state, input.webSession, projectSession.projectId);
     const actorId = auditActorIdFor(input.webSession);
     const duplicate = clientTxnId ? input.state.eventCommands.findByClientTxn(undefined, actorId, clientTxnId) : undefined;
     if (duplicate)
@@ -3638,6 +3652,7 @@ async function sendChatMessage(input) {
 }
 export function createChatWebApp(options = {}) {
     const integrations = resolveChatWebIntegrations(options);
+    const piPackageStoreCwd = options.piPackageStoreCwd ?? process.cwd();
     ensurePrivateChatUploadDirectory();
     const defaultProfile = options.defaultProfile ?? "base";
     const dataStore = createDataStore(options);
@@ -3934,6 +3949,7 @@ export function createChatWebApp(options = {}) {
                     context,
                     webSession,
                     piboSessionId: url.searchParams.get("piboSessionId") || undefined,
+                    piPackageStoreCwd,
                 });
                 return responseJson({ snapshot });
             }
@@ -4691,6 +4707,7 @@ export function createChatWebApp(options = {}) {
                         state.syncedUserSkillNames = names;
                     },
                     invalidateBootstrapCatalogCache: () => invalidateBootstrapCatalogCache(state),
+                    agentsSelectingSkill: (skillName) => agentsSelectingSkill(state, skillName),
                 });
             }
             if (url.pathname === `${CHAT_WEB_API_PREFIX}/agent-folders` && request.method === "GET") {