@pi-chamber/web 0.2.2 → 0.3.1

package/server/lib/pi/session-daemon/session-daemon.test.js

@@ -6,6 +6,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 
+import { createMessageEntryAliases } from './message-entry-aliases.js';
 import { createSessionDaemon, isLocalSessionDaemonEndpoint } from './session-daemon.js';
 
 const credential = 'a-private-daemon-credential';
@@ -42,6 +43,7 @@ class FakeSession {
       getSessionFile: () => sessionFile,
       getHeader: () => ({ timestamp: '2026-01-01T00:00:00.000Z' }),
       getEntries: () => this.entries,
+      getEntry: (id) => this.entries.find((entry) => entry.id === id),
       getLeafId: () => 'fake-entry',
       getTree: () => [{ entry: { id: 'fake-entry', parentId: undefined, timestamp: '2026-01-01T00:00:00.000Z' }, children: [] }],
       appendSessionInfo: (name) => this.names.push(name),
@@ -315,6 +317,59 @@ describe('Pi session daemon spike', () => {
     await stale.close();
   });
 
+  it('keeps existing and late-joining device streams independent during one turn', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-multi-client-'));
+    const endpoint = testDaemonEndpoint(root);
+    const session = new FakeSession();
+    session.isStreaming = true;
+    session.messages = [{
+      role: 'assistant',
+      content: [{ type: 'text', text: 'half' }],
+      provider: 'test',
+      model: 'model',
+      timestamp: 1_000,
+    }];
+    daemon = createSessionDaemon({ endpoint, credential, cwd: root, createRuntime: async () => ({ session, async dispose() {} }) });
+    await daemon.start();
+
+    const first = connectClient(endpoint);
+    await first.authenticate();
+    await first.request('sessions.create', { cwd: root });
+    const detail = await first.request('sessions.open', { sessionId: 'pi-session-1', cwd: root });
+    expect(detail.result).toMatchObject({
+      isStreaming: true,
+      lifecycle: 'busy',
+      lastSequence: expect.any(Number),
+      messages: [expect.objectContaining({ parts: [expect.objectContaining({ text: 'half' })] })],
+    });
+
+    const late = connectClient(endpoint);
+    await late.authenticate(credential, {
+      sessionId: 'pi-session-1',
+      fromSequence: detail.result.lastSequence,
+    });
+    const firstDelta = first.next((frame) => frame.event === 'assistant.message.delta');
+    const lateDelta = late.next((frame) => frame.event === 'assistant.message.delta');
+    session.emit({
+      type: 'message_update',
+      assistantMessageEvent: { type: 'text_delta', contentIndex: 0, delta: ' plus the rest' },
+    });
+    const [firstDeltaFrame, lateDeltaFrame] = await Promise.all([firstDelta, lateDelta]);
+    expect(firstDeltaFrame.sequence).toBe(lateDeltaFrame.sequence);
+    expect(lateDeltaFrame.payload.delta).toBe(' plus the rest');
+
+    const firstIdle = first.next((frame) => frame.event === 'session.lifecycle' && frame.payload?.state === 'idle');
+    const lateIdle = late.next((frame) => frame.event === 'session.lifecycle' && frame.payload?.state === 'idle');
+    session.isStreaming = false;
+    session.emit({ type: 'agent_settled' });
+    const [firstIdleFrame, lateIdleFrame] = await Promise.all([firstIdle, lateIdle]);
+    expect(firstIdleFrame.sequence).toBe(lateIdleFrame.sequence);
+    expect(firstIdleFrame.sequence).toBeGreaterThan(firstDeltaFrame.sequence);
+
+    await late.close();
+    await first.close();
+  });
+
   it('lists only validated cwd-scoped sessions without exposing Pi JSONL paths', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-'));
     const endpoint = testDaemonEndpoint(root);
@@ -611,6 +666,174 @@ describe('Pi session daemon spike', () => {
     await client.close();
   });
 
+  it('resolves live message ids to Pi entry ids for navigation and forking', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-message-alias-'));
+    const endpoint = testDaemonEndpoint(root);
+    const sessionFile = join(root, 'fixture.jsonl');
+    await writeFile(sessionFile, `${JSON.stringify({ type: 'session', id: 'fixture-session', cwd: root, timestamp: '2026-01-01T00:00:00.000Z' })}\n`);
+    const session = new FakeSession('fixture-session', sessionFile);
+    const hydratedMessage = { role: 'user', timestamp: 1, content: 'm3' };
+    session.entries.push({ type: 'message', id: 'm3-entry', parentId: null, timestamp: '2026-01-01T00:00:01.000Z', message: hydratedMessage });
+    const navigated = [];
+    session.navigateTree = async (entryId) => {
+      if (!session.sessionManager.getEntry(entryId)) throw new Error(`Entry ${entryId} not found`);
+      navigated.push(entryId);
+      return { cancelled: false };
+    };
+    const forked = [];
+    const runtime = new FakeRuntime({ cwd: root, session });
+    runtime.fork = async (entryId) => {
+      if (!session.sessionManager.getEntry(entryId)) throw new Error('Invalid entry ID for forking');
+      forked.push(entryId);
+      return { cancelled: false };
+    };
+    daemon = createSessionDaemon({
+      endpoint,
+      credential,
+      cwd: root,
+      createRuntime: async () => runtime,
+      listSessions: async () => [{ path: sessionFile, id: 'fixture-session', cwd: root }],
+    });
+    await daemon.start();
+
+    const client = connectClient(endpoint);
+    await client.authenticate();
+    await client.request('sessions.open', { sessionId: 'fixture-session', directory: root });
+
+    await expect(client.request('sessions.navigate', { sessionId: 'fixture-session', directory: root, messageId: 'm3-entry' })).resolves.toMatchObject({
+      result: { navigation: { targetEntryId: 'm3-entry' } },
+    });
+
+    const replacementUser = { role: 'user', timestamp: 2, content: 'm4 replacement' };
+    const userStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'user' && frame.payload?.text === 'm4 replacement');
+    session.emit({ type: 'message_start', message: replacementUser });
+    session.emit({ type: 'message_end', message: replacementUser });
+    session.entries.push({ type: 'message', id: 'm4-rev-entry', parentId: 'm3-entry', timestamp: '2026-01-01T00:00:02.000Z', message: replacementUser });
+    const publishedUserId = (await userStartPromise).payload.messageId;
+    await Promise.resolve();
+
+    await expect(client.request('sessions.navigate', { sessionId: 'fixture-session', directory: root, messageId: publishedUserId })).resolves.toMatchObject({
+      result: { navigation: { targetEntryId: 'm4-rev-entry' } },
+    });
+    await expect(client.request('sessions.fork', { sessionId: 'fixture-session', directory: root, messageId: publishedUserId })).resolves.toMatchObject({ result: expect.any(Object) });
+
+    // Pi agent-core shallow-copies the streaming start; message_end carries
+    // the distinct finalized object that SessionManager persists.
+    const assistantStartMessage = { role: 'assistant', timestamp: 3, provider: 'test', model: 'model', content: [] };
+    const replacementAssistant = { role: 'assistant', timestamp: 3, provider: 'test', model: 'model', content: [{ type: 'text', text: 'replacement answer' }] };
+    const assistantStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'assistant');
+    session.emit({ type: 'message_start', message: assistantStartMessage });
+    session.emit({ type: 'message_end', message: replacementAssistant });
+    session.entries.push({ type: 'message', id: 'm4-assistant-entry', parentId: 'm4-rev-entry', timestamp: '2026-01-01T00:00:03.000Z', message: replacementAssistant });
+    const publishedAssistantId = (await assistantStartPromise).payload.messageId;
+    await Promise.resolve();
+
+    await expect(client.request('sessions.navigate', {
+      sessionId: 'fixture-session',
+      directory: root,
+      messageId: `${publishedAssistantId}:text:0`,
+    })).resolves.toMatchObject({ result: { navigation: { targetEntryId: 'm4-assistant-entry' } } });
+    await expect(client.request('sessions.fork', {
+      sessionId: 'fixture-session',
+      directory: root,
+      messageId: `${publishedAssistantId}:text:0`,
+    })).resolves.toMatchObject({ result: expect.any(Object) });
+
+    expect(navigated).toEqual(['m3-entry', 'm4-rev-entry', 'm4-assistant-entry']);
+    expect(forked).toEqual(['m4-rev-entry', 'm4-assistant-entry']);
+    await expect(client.request('sessions.fork', {
+      sessionId: 'fixture-session',
+      directory: root,
+      messageId: 'user-fixture-session-unknown',
+    })).rejects.toThrow('Daemon connection closed');
+
+    const navigationClient = connectClient(endpoint);
+    await navigationClient.authenticate();
+    await expect(navigationClient.request('sessions.navigate', {
+      sessionId: 'fixture-session',
+      directory: root,
+      messageId: 'user-fixture-session-unknown',
+    })).rejects.toThrow('Daemon connection closed');
+  });
+
+  it('keeps live message aliases across idle disposal and runtime reopening', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-message-alias-idle-'));
+    const endpoint = testDaemonEndpoint(root);
+    const sessionFile = join(root, 'fixture.jsonl');
+    await writeFile(sessionFile, `${JSON.stringify({ type: 'session', id: 'fixture-session', cwd: root, timestamp: '2026-01-01T00:00:00.000Z' })}\n`);
+    const liveMessage = { role: 'user', timestamp: 1, content: 'persist me' };
+    const persistedEntry = { type: 'message', id: 'persisted-entry', parentId: null, timestamp: '2026-01-01T00:00:01.000Z', message: liveMessage };
+    const firstSession = new FakeSession('fixture-session', sessionFile);
+    const firstRuntime = new FakeRuntime({ cwd: root, session: firstSession });
+    const reopenedSession = new FakeSession('fixture-session', sessionFile);
+    reopenedSession.entries.push({ ...persistedEntry, message: { ...liveMessage } });
+    reopenedSession.navigateTree = async (entryId) => {
+      if (!reopenedSession.sessionManager.getEntry(entryId)) throw new Error(`Entry ${entryId} not found`);
+      reopenedSession.navigatedTo = entryId;
+      return { cancelled: false };
+    };
+    const reopenedRuntime = new FakeRuntime({ cwd: root, session: reopenedSession });
+    let runtimeCount = 0;
+    daemon = createSessionDaemon({
+      endpoint,
+      credential,
+      cwd: root,
+      idleTimeoutMs: 10,
+      listSessions: async () => [{ path: sessionFile, id: 'fixture-session', cwd: root }],
+      createRuntime: async () => (++runtimeCount === 1 ? firstRuntime : reopenedRuntime),
+    });
+    await daemon.start();
+
+    const client = connectClient(endpoint);
+    await client.authenticate();
+    await client.request('sessions.open', { sessionId: 'fixture-session', directory: root });
+    const userStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'user');
+    firstSession.emit({ type: 'message_start', message: liveMessage });
+    firstSession.emit({ type: 'message_end', message: liveMessage });
+    firstSession.entries.push(persistedEntry);
+    const publishedId = (await userStartPromise).payload.messageId;
+    await Promise.resolve();
+    firstSession.emit({ type: 'agent_settled' });
+    await new Promise((resolve) => setTimeout(resolve, 30));
+    expect(firstRuntime.disposed).toBe(true);
+
+    await expect(client.request('sessions.navigate', {
+      sessionId: 'fixture-session',
+      directory: root,
+      messageId: publishedId,
+    })).resolves.toMatchObject({ result: { navigation: { targetEntryId: 'persisted-entry' } } });
+    expect(reopenedSession.navigatedTo).toBe('persisted-entry');
+    await client.close();
+  });
+
+  it('scopes live message aliases by directory and session id', () => {
+    const aliases = createMessageEntryAliases({ scheduleMicrotask: (callback) => callback() });
+    const messageA = { role: 'user', content: 'same' };
+    const messageB = { role: 'user', content: 'same' };
+    const managerA = {
+      getEntry: () => undefined,
+      getEntries: () => [{ type: 'message', id: 'entry-a', message: messageA }],
+    };
+    const managerB = {
+      getEntry: () => undefined,
+      getEntries: () => [{ type: 'message', id: 'entry-b', message: messageB }],
+    };
+    aliases.retain({ cwd: '/project-a', sessionId: 'same-session', syntheticMessageId: 'user-same-session-1', message: messageA });
+    aliases.retain({ cwd: '/project-b', sessionId: 'same-session', syntheticMessageId: 'user-same-session-1', message: messageB });
+    aliases.observeMessageEnd({ cwd: '/project-a', sessionId: 'same-session', syntheticMessageId: 'user-same-session-1', message: messageA, sessionManager: managerA });
+    aliases.observeMessageEnd({ cwd: '/project-b', sessionId: 'same-session', syntheticMessageId: 'user-same-session-1', message: messageB, sessionManager: managerB });
+
+    expect(aliases.resolve({ cwd: '/project-a', sessionId: 'same-session', requestedId: 'user-same-session-1', sessionManager: managerA })).toBe('entry-a');
+    expect(aliases.resolve({ cwd: '/project-b', sessionId: 'same-session', requestedId: 'user-same-session-1:text:0', sessionManager: managerB })).toBe('entry-b');
+    expect(aliases.resolve({ cwd: '/project-a', sessionId: 'same-session', requestedId: 'user-same-session-unknown', sessionManager: managerA })).toBe('user-same-session-unknown');
+
+    aliases.clearSession({ cwd: '/project-a', sessionId: 'same-session' });
+    expect(aliases.resolve({ cwd: '/project-a', sessionId: 'same-session', requestedId: 'user-same-session-1', sessionManager: managerA })).toBe('user-same-session-1');
+    expect(aliases.resolve({ cwd: '/project-b', sessionId: 'same-session', requestedId: 'user-same-session-1', sessionManager: managerB })).toBe('entry-b');
+    aliases.clear();
+    expect(aliases.resolve({ cwd: '/project-b', sessionId: 'same-session', requestedId: 'user-same-session-1:text:0', sessionManager: managerB })).toBe('user-same-session-1');
+  });
+
   it('disposes an idle runtime without deleting its Pi JSONL and restores it on demand', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-'));
     const endpoint = testDaemonEndpoint(root);
@@ -971,7 +1194,62 @@ describe('Pi session daemon spike', () => {
     await client.close();
   });
 
-  it('preserves assistant messageId for tool executions occurring after message_end', async () => {
+  it('keeps retry attempts attached to the original user turn until Pi settles', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-retry-'));
+    const endpoint = testDaemonEndpoint(root);
+    const session = new FakeSession('pi-session-retry');
+    daemon = createSessionDaemon({ endpoint, credential, cwd: root, createRuntime: async () => ({ session, async dispose() {} }) });
+    await daemon.start();
+    const client = connectClient(endpoint);
+    await client.authenticate();
+    await client.request('sessions.create', { cwd: root });
+
+    const userStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'user');
+    session.emit({ type: 'message_start', message: { role: 'user', content: 'recover this turn', timestamp: 1_000 } });
+    const userStart = await userStartPromise;
+
+    const failedStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'assistant');
+    session.emit({ type: 'message_start', message: { role: 'assistant', content: [], timestamp: 1_100 } });
+    const failedStart = await failedStartPromise;
+    session.emit({ type: 'message_end', message: { role: 'assistant', content: [], stopReason: 'error', errorMessage: 'Rate limit exceeded' } });
+
+    const retryLifecycle = client.next((frame) => frame.event === 'session.lifecycle' && frame.payload.state === 'retry');
+    const prematureError = client.next((frame) => frame.event === 'session.error');
+    session.emit({ type: 'agent_end', willRetry: true, messages: [{ role: 'assistant', stopReason: 'error', errorMessage: 'Rate limit exceeded' }] });
+    session.emit({ type: 'auto_retry_start', attempt: 1, maxAttempts: 3, delayMs: 2_000, errorMessage: 'Rate limit exceeded' });
+
+    await expect(retryLifecycle).resolves.toMatchObject({
+      payload: { state: 'retry', attempt: 1, message: 'Rate limit exceeded' },
+    });
+
+    const retryObserver = connectClient(endpoint);
+    const retrySnapshot = await retryObserver.authenticate();
+    expect(retrySnapshot.payload).toMatchObject({
+      lifecycle: 'retry',
+      retry: { attempt: 1, message: 'Rate limit exceeded' },
+    });
+
+    session.emit({ type: 'agent_start' });
+    const recoveredStartPromise = client.next((frame) => frame.event === 'assistant.message.start'
+      && frame.payload?.role === 'assistant'
+      && frame.payload.messageId !== failedStart.payload.messageId);
+    session.emit({ type: 'message_start', message: { role: 'assistant', content: [], timestamp: 1_200 } });
+    const recoveredStart = await recoveredStartPromise;
+    const recoveredDeltaPromise = client.next((frame) => frame.event === 'assistant.message.delta'
+      && frame.payload?.messageId === recoveredStart.payload.messageId);
+    session.emit({ type: 'message_update', assistantMessageEvent: { type: 'text_delta', contentIndex: 0, delta: 'Recovered' } });
+
+    await expect(recoveredDeltaPromise).resolves.toMatchObject({ payload: { delta: 'Recovered' } });
+    expect(failedStart.payload.parentId).toBe(userStart.payload.messageId);
+    expect(recoveredStart.payload.parentId).toBe(userStart.payload.messageId);
+    await expect(prematureError).rejects.toThrow(/Timed out/);
+
+    session.emit({ type: 'agent_settled' });
+    await retryObserver.close();
+    await client.close();
+  });
+
+  it('keeps ordinary tool errors live and resumes the next assistant in the same user turn', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-'));
     const endpoint = testDaemonEndpoint(root);
     const session = new FakeSession('pi-session-tool-seq');
@@ -981,16 +1259,28 @@ describe('Pi session daemon spike', () => {
     await client.authenticate();
     await client.request('sessions.create', { cwd: root });
 
-    const messageStartPromise = client.next((frame) => frame.event === 'assistant.message.start');
+    const userStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'user');
+    const messageStartPromise = client.next((frame) => frame.event === 'assistant.message.start' && frame.payload?.role === 'assistant');
     const messageEndPromise = client.next((frame) => frame.event === 'assistant.message.end');
     const toolStartPromise = client.next((frame) => frame.event === 'session.tool.start');
     const toolEndPromise = client.next((frame) => frame.event === 'session.tool.end');
 
+    session.emit({ type: 'message_start', message: { role: 'user', content: 'run the command', timestamp: 0 } });
     session.emit({ type: 'message_start', message: { role: 'assistant', timestamp: 1 } });
-    session.emit({ type: 'message_end', message: { role: 'assistant', content: [{ type: 'text', text: 'Calling tool' }] } });
+    session.emit({
+      type: 'message_end',
+      message: {
+        role: 'assistant',
+        content: [
+          { type: 'text', text: 'Calling tool' },
+          { type: 'toolCall', id: 'tool-call-1', name: 'bash', arguments: { command: 'echo hi' } },
+        ],
+      },
+    });
     session.emit({ type: 'tool_execution_start', toolCallId: 'tool-call-1', toolName: 'bash', args: { command: 'echo hi' } });
-    session.emit({ type: 'tool_execution_end', toolCallId: 'tool-call-1', toolName: 'bash', result: { content: [{ type: 'text', text: 'hi' }] }, isError: false });
+    session.emit({ type: 'tool_execution_end', toolCallId: 'tool-call-1', toolName: 'bash', result: { content: [{ type: 'text', text: 'command failed' }] }, isError: true });
 
+    const userStart = await userStartPromise;
     const messageStart = await messageStartPromise;
     const messageEnd = await messageEndPromise;
     const toolStart = await toolStartPromise;
@@ -998,11 +1288,26 @@ describe('Pi session daemon spike', () => {
 
     expect(messageStart.payload.messageId).toMatch(/^assistant-pi-session-tool-seq-\d+$/);
     expect(messageEnd.payload.messageId).toBe(messageStart.payload.messageId);
+    expect(messageEnd.payload.continuing).toBe(true);
     expect(toolStart.payload.messageId).toBe(messageStart.payload.messageId);
     expect(toolStart.payload.partId).toBe(`${messageStart.payload.messageId}:tool:tool-call-1`);
     expect(toolEnd.payload.messageId).toBe(messageStart.payload.messageId);
     expect(toolEnd.payload.partId).toBe(`${messageStart.payload.messageId}:tool:tool-call-1`);
-
+    expect(toolEnd.payload).toMatchObject({ state: 'error', isError: true, error: 'command failed' });
+
+    const recoveredStartPromise = client.next((frame) => frame.event === 'assistant.message.start'
+      && frame.payload?.role === 'assistant'
+      && frame.payload.messageId !== messageStart.payload.messageId);
+    session.emit({ type: 'message_start', message: { role: 'assistant', timestamp: 2 } });
+    const recoveredStart = await recoveredStartPromise;
+    const recoveredDeltaPromise = client.next((frame) => frame.event === 'assistant.message.delta'
+      && frame.payload?.messageId === recoveredStart.payload.messageId);
+    session.emit({ type: 'message_update', assistantMessageEvent: { type: 'text_delta', contentIndex: 0, delta: 'Recovered from tool failure' } });
+
+    await expect(recoveredDeltaPromise).resolves.toMatchObject({ payload: { delta: 'Recovered from tool failure' } });
+    expect(messageStart.payload.parentId).toBe(userStart.payload.messageId);
+    expect(recoveredStart.payload.parentId).toBe(userStart.payload.messageId);
+    session.emit({ type: 'agent_settled' });
     await client.close();
   });
 

package/server/lib/pi/session-daemon/supervisor.js

@@ -24,6 +24,20 @@ class PiSessionDaemonUnavailableError extends Error {
 
 const delay = (milliseconds) => new Promise((resolveDelay) => setTimeout(resolveDelay, milliseconds));
 
+const rejectAfter = (promise, timeoutMs, code) => new Promise((resolvePromise, rejectPromise) => {
+  const timer = setTimeout(() => rejectPromise(new SessionDaemonClientError(code)), timeoutMs);
+  promise.then(
+    (value) => {
+      clearTimeout(timer);
+      resolvePromise(value);
+    },
+    (error) => {
+      clearTimeout(timer);
+      rejectPromise(error);
+    },
+  );
+});
+
 const getWindowsOwnerKey = () => {
   try {
     return createHash('sha256').update(userInfo().username).digest('hex').slice(0, 16);
@@ -253,7 +267,12 @@ export const createPiSessionDaemonSupervisor = ({
       throw new PiSessionDaemonUnavailableError('DAEMON_UNAVAILABLE');
     }
     try {
-      const health = await request({ endpoint: paths.endpoint, credential, command: 'runtime.health' });
+      const health = await rejectAfter(request({
+        endpoint: paths.endpoint,
+        credential,
+        command: 'runtime.health',
+        timeoutMs: startupTimeoutMs,
+      }), startupTimeoutMs, 'DAEMON_UNAVAILABLE');
       if (health?.state !== 'ready' || health.daemonPid !== state.pid) {
         throw new PiSessionDaemonUnavailableError('DAEMON_IDENTITY_MISMATCH');
       }

package/server/lib/pi/session-daemon/supervisor.test.js

@@ -194,6 +194,49 @@ describe('Pi session daemon supervisor', () => {
     expect(windowsSupervisor.paths.endpoint).toMatch(/^\\\\\.\\pipe\\pichamber-pi-session-daemon-[0-9a-f]{16}$/);
   });
 
+  it('bounds an unresponsive Windows daemon probe by the supervisor operation timeout', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-supervisor-hung-win-'));
+    const dataDir = join(root, 'data');
+    const piDataDir = join(dataDir, 'pi');
+    await mkdir(piDataDir, { recursive: true });
+    const daemonPid = 7_331;
+    const processLike = {
+      pid: 4_242,
+      execPath: process.execPath,
+      versions: { electron: '41.2.1' },
+      kill(pid, signal) {
+        if (pid === daemonPid && signal === 0) return;
+        const error = new Error('ESRCH');
+        error.code = 'ESRCH';
+        throw error;
+      },
+    };
+    const probeTimeoutMs = 20;
+    const windowsSupervisor = createPiSessionDaemonSupervisor({
+      env: { PICHAMBER_DATA_DIR: dataDir },
+      cwd: root,
+      dataDir,
+      platform: 'win32',
+      processLike,
+      startupTimeoutMs: probeTimeoutMs,
+      request: () => new Promise(() => {}),
+    });
+    await writeFile(windowsSupervisor.paths.credentialFile, `${'a'.repeat(64)}\n`);
+    await writeFile(windowsSupervisor.paths.stateFile, JSON.stringify({
+      protocolVersion: 1,
+      pid: daemonPid,
+      endpoint: windowsSupervisor.paths.endpoint,
+      startedAt: new Date().toISOString(),
+    }));
+
+    const startedAt = Date.now();
+    await expect(windowsSupervisor.health()).resolves.toMatchObject({
+      state: 'unavailable',
+      error: { code: 'DAEMON_UNAVAILABLE' },
+    });
+    expect(Date.now() - startedAt).toBeLessThan(probeTimeoutMs * 5);
+  });
+
   it('recovers from a leftover empty daemon lock instead of failing as unavailable', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-supervisor-empty-lock-'));
     const cwd = join(root, 'project');

package/server/lib/tunnels/DOCUMENTATION.md

@@ -5,16 +5,15 @@ This module contains the shared tunnel support surface for PiChamber: provider
 capability metadata, tunnel types/normalization helpers, cross-platform
 executable discovery, and dependency install-help metadata.
 
-The actual tunnel start implementations live in
-`packages/web/server/lib/cloudflare-tunnel.js` and
-`packages/web/server/lib/ngrok-tunnel.js`; CLI orchestration lives in
+The tunnel start implementation lives in
+`packages/web/server/lib/cloudflare-tunnel.js`; CLI orchestration lives in
 `packages/web/bin/lib/commands-tunnel.js`.
 
 > Wiring note: the previous service orchestration entrypoint
 > (`tunnels/index.js`, `createTunnelService`) was removed as dead code — no
 > runtime entrypoint registered tunnel routes or started a tunnel service.
 > The remaining files are consumed by the CLI capability surface and by the
-> tunnel provider implementations, not by a tunnel orchestration runtime.
+> Cloudflare tunnel provider implementation, not by a tunnel orchestration runtime.
 
 ## Entrypoints and structure
 - `packages/web/server/lib/tunnels/executable-search.js`: cross-platform executable discovery, including Windows Store app aliases. Consumed by the tunnel providers and `packages/web/server/lib/workspace/host.js`.
@@ -24,10 +23,10 @@ The actual tunnel start implementations live in
 ## Public exports
 - `install-help.js` → `getTunnelDependencyInstallInfo(provider, platform)`
 - `executable-search.js` → `getExecutableSearchDirectories`, `createExecutableSearchEnv`, `findExecutableOnPath`, `resolveExecutableLaunchTarget`
-- `types.js` → `TUNNEL_PROVIDER_CLOUDFLARE`, `TUNNEL_PROVIDER_NGROK`, `TUNNEL_MODE_QUICK`, `TUNNEL_MODE_MANAGED_REMOTE`, `TUNNEL_MODE_MANAGED_LOCAL`, `TUNNEL_INTENT_EPHEMERAL_PUBLIC`, `TUNNEL_INTENT_PERSISTENT_PUBLIC`, `TunnelServiceError`
+- `types.js` → `TUNNEL_PROVIDER_CLOUDFLARE`, `TUNNEL_MODE_QUICK`, `TUNNEL_MODE_MANAGED_REMOTE`, `TUNNEL_MODE_MANAGED_LOCAL`, `TUNNEL_INTENT_EPHEMERAL_PUBLIC`, `TUNNEL_INTENT_PERSISTENT_PUBLIC`, `TunnelServiceError`
 
 ## Consumers
-- `packages/web/bin/lib/cli-tunnel-capabilities.js`: provider capability metadata for CLI tunnel commands.
-- `packages/web/server/lib/cloudflare-tunnel.js` / `packages/web/server/lib/ngrok-tunnel.js`: executable discovery, install-help metadata, and provider constants.
+- `packages/web/bin/lib/cli-tunnel-capabilities.js`: provider capability metadata for CLI tunnel commands (Cloudflare only).
+- `packages/web/server/lib/cloudflare-tunnel.js`: executable discovery, install-help metadata, and provider constants.
 - `packages/web/server/lib/workspace/host.js`: executable discovery.
 

package/server/lib/tunnels/executable-search.test.js

@@ -36,7 +36,7 @@ describe('getExecutableSearchDirectories', () => {
 
 describe('findExecutableOnPath', () => {
   it('finds Windows Store app execution aliases even when PATH omits WindowsApps', () => {
-    const aliasPath = 'C:\\Users\\Ada\\AppData\\Local\\Microsoft\\WindowsApps\\ngrok.exe';
+    const aliasPath = 'C:\\Users\\Ada\\AppData\\Local\\Microsoft\\WindowsApps\\cloudflared.exe';
     const fsLike = {
       statSync: (candidate) => {
         if (candidate === aliasPath) {
@@ -47,7 +47,7 @@ describe('findExecutableOnPath', () => {
       accessSync: () => {},
     };
 
-    const resolved = findExecutableOnPath('ngrok', {
+    const resolved = findExecutableOnPath('cloudflared', {
       platform: 'win32',
       env: {
         PATH: 'C:\\Tools',
@@ -63,7 +63,7 @@ describe('findExecutableOnPath', () => {
 
 describe('resolveExecutableLaunchTarget', () => {
   it('returns a Windows launch target with WindowsApps on PATH when stat lookup fails', () => {
-    const target = resolveExecutableLaunchTarget('ngrok', {
+    const target = resolveExecutableLaunchTarget('cloudflared', {
       platform: 'win32',
       env: {
         PATH: 'C:\\Windows\\System32',
@@ -75,7 +75,7 @@ describe('resolveExecutableLaunchTarget', () => {
       },
     });
 
-    expect(target?.command).toBe('ngrok');
+    expect(target?.command).toBe('cloudflared');
     expect(target?.env.Path).toContain('C:\\Users\\Ada\\AppData\\Local\\Microsoft\\WindowsApps');
   });
 });

package/server/lib/tunnels/install-help.js

@@ -1,6 +1,5 @@
 import {
   TUNNEL_PROVIDER_CLOUDFLARE,
-  TUNNEL_PROVIDER_NGROK,
 } from './types.js';
 
 const PROVIDER_INSTALL_INFO = {
@@ -13,15 +12,6 @@ const PROVIDER_INSTALL_INFO = {
       linux: 'Download cloudflared from https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflared/downloads/',
     },
   },
-  [TUNNEL_PROVIDER_NGROK]: {
-    dependency: 'ngrok',
-    installUrl: 'https://ngrok.com/download',
-    commands: {
-      darwin: 'brew install ngrok',
-      win32: 'winget install ngrok -s msstore',
-      linux: 'Download ngrok from https://ngrok.com/download',
-    },
-  },
 };
 
 const normalizeInstallPlatform = (platform) => {

package/server/lib/tunnels/install-help.test.js

@@ -3,7 +3,6 @@ import { describe, expect, it } from 'bun:test';
 import { getTunnelDependencyInstallInfo } from './install-help.js';
 import {
   TUNNEL_PROVIDER_CLOUDFLARE,
-  TUNNEL_PROVIDER_NGROK,
 } from './types.js';
 
 describe('getTunnelDependencyInstallInfo', () => {
@@ -15,14 +14,6 @@ describe('getTunnelDependencyInstallInfo', () => {
     expect(info.message).toContain('Cloudflare.cloudflared');
   });
 
-  it('returns Windows ngrok winget guidance', () => {
-    const info = getTunnelDependencyInstallInfo(TUNNEL_PROVIDER_NGROK, 'win32');
-
-    expect(info.dependency).toBe('ngrok');
-    expect(info.installCommand).toBe('winget install ngrok -s msstore');
-    expect(info.message).toContain('ngrok -s msstore');
-  });
-
   it('keeps macOS Homebrew guidance', () => {
     const info = getTunnelDependencyInstallInfo(TUNNEL_PROVIDER_CLOUDFLARE, 'darwin');
 

package/server/lib/tunnels/types.js

@@ -1,5 +1,4 @@
 export const TUNNEL_PROVIDER_CLOUDFLARE = 'cloudflare';
-export const TUNNEL_PROVIDER_NGROK = 'ngrok';
 
 export const TUNNEL_MODE_QUICK = 'quick';
 export const TUNNEL_MODE_MANAGED_REMOTE = 'managed-remote';