@pi-chamber/web 0.3.1 → 0.3.3

package/dist/mobile.html

@@ -63,12 +63,12 @@
       })();
     </script>
 
-    <script type="module" crossorigin src="/assets/mobile-B_CyfRAX.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-B4E4JqAf.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DYyjh7Q0.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-CnsBKjP5.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-8TL2HlaR.js">
+    <link rel="modulepreload" crossorigin href="/assets/index-BAqpUCjs.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-katex-CHD9BdDO.js">
     <link rel="stylesheet" crossorigin href="/assets/index-riABQmQ_.css">
     <link rel="stylesheet" crossorigin href="/assets/vendor-katex-Cp579UoJ.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-chamber/web",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "private": false,
   "type": "module",
   "repository": {

package/server/index.js

@@ -10,6 +10,7 @@ import { fileURLToPath } from 'node:url';
 import { createClientPairingRuntime } from './lib/client-auth/pairing.js';
 import { createRemoteClientAuthRuntime } from './lib/client-auth/remote-clients.js';
 import { resolvePiChamberDataDir } from './lib/pichamber-data-dir.js';
+import { createTunnelService } from './lib/server/tunnel-service.js';
 import { registerPiRuntimeRoutes } from './lib/pi/routes.js';
 import { registerWorkspaceIntegrations } from './lib/workspace/host.js';
 import { createPiSessionDaemonSupervisor } from './lib/pi/session-daemon/supervisor.js';
@@ -114,6 +115,15 @@ export async function startWebUiServer(options = {}) {
   const tunnelAuthController = createTunnelAuth();
   const uiAuthController = createUiAuth({ password: uiPassword, readSettingsFromDiskMigrated: async () => ({}) , clientAuthController: remoteClientAuthRuntime });
   const piSessionDaemonRuntime = createPiSessionDaemonSupervisor({ dataDir: PICHAMBER_DATA_DIR });
+  const tunnelService = createTunnelService({
+    dataDir: PICHAMBER_DATA_DIR,
+    getPort: () => {
+      const address = server.address();
+      return typeof address === 'object' && address ? address.port : null;
+    },
+    tunnelAuthController,
+    getServerLabel: () => os.hostname() || 'PiChamber',
+  });
   let stopped = false;
 
   app.set('trust proxy', true);
@@ -157,6 +167,29 @@ export async function startWebUiServer(options = {}) {
     getServerLabel: () => os.hostname() || 'PiChamber',
   });
   registerPiRuntimeRoutes(app, { getPiSessionDaemonRuntime: () => piSessionDaemonRuntime });
+  // Cloudflare Tunnel external access (manual token + quick modes).
+  const requireTunnelAuth = (req, res, next) => uiAuthController.requireAuth(req, res, next);
+  app.get('/api/pichamber/tunnel/status', requireTunnelAuth, async (_req, res) => {
+    try { res.json(await tunnelService.getStatus()); } catch (error) { res.status(500).json({ error: error?.message || 'Failed to get tunnel status' }); }
+  });
+  app.get('/api/pichamber/tunnel/check', requireTunnelAuth, async (req, res) => {
+    try { res.json(await tunnelService.check(req.query?.provider)); } catch (error) { res.status(500).json({ error: error?.message || 'Tunnel check failed' }); }
+  });
+  app.get('/api/pichamber/tunnel/providers', requireTunnelAuth, async (_req, res) => {
+    res.json({ providers: [{ provider: 'cloudflare', modes: [{ key: 'quick' }, { key: 'managed-remote' }, { key: 'managed-local' }] }] });
+  });
+  app.post('/api/pichamber/tunnel/start', express.json({ limit: '64kb' }), requireTunnelAuth, async (req, res) => {
+    try { const result = await tunnelService.start(req.body ?? {}); res.json(result); } catch (error) { const code = error?.code === 'missing_dependency' ? 400 : error?.code === 'validation_error' ? 422 : 500; res.status(code).json({ ok: false, error: error?.message || 'Failed to start tunnel', code: error?.code }); }
+  });
+  app.post('/api/pichamber/tunnel/stop', requireTunnelAuth, async (_req, res) => {
+    try { res.json(await tunnelService.stop()); } catch (error) { res.status(500).json({ error: error?.message || 'Failed to stop tunnel' }); }
+  });
+  app.put('/api/pichamber/tunnel/managed-remote-token', express.json({ limit: '64kb' }), requireTunnelAuth, async (req, res) => {
+    try { res.json(await tunnelService.saveManagedRemoteToken(req.body ?? {})); } catch (error) { const code = error?.code === 'validation_error' ? 400 : 500; res.status(code).json({ ok: false, error: error?.message || 'Failed to save token' }); }
+  });
+  app.get('/api/pichamber/tunnel/doctor', requireTunnelAuth, async (req, res) => {
+    try { const status = await tunnelService.getStatus(); const checkResult = await tunnelService.check(); res.json({ ok: true, status, check: checkResult, query: req.query }); } catch (error) { res.status(500).json({ ok: false, error: error?.message || 'Doctor failed' }); }
+  });
   registerWorkspaceIntegrations({ app, server, express, uiAuthController });
   registerStaticRoutes(app, { apiOnly });
 

package/server/lib/pi/routes.js

@@ -219,6 +219,8 @@ const projectSessionDetail = (value) => {
     isStreaming,
     lifecycle,
     ...(retry ? { retry } : {}),
+    ...(Number.isFinite(value.runStartedAt) ? { runStartedAt: Math.floor(value.runStartedAt) } : {}),
+    ...(Number.isFinite(value.serverNow) ? { serverNow: Math.floor(value.serverNow) } : {}),
   };
 };
 
@@ -380,12 +382,14 @@ const projectEventFrame = (frame) => {
         ...(typeof snapshot.thinking === 'string' ? { thinking: snapshot.thinking } : {}),
         ...(typeof snapshot.lastText === 'string' ? { lastText: snapshot.lastText } : {}),
         ...(typeof snapshot.lastThinking === 'string' ? { lastThinking: snapshot.lastThinking } : {}),
+        ...(Number.isFinite(snapshot.runStartedAt) ? { runStartedAt: Math.floor(snapshot.runStartedAt) } : {}),
+        ...(Number.isFinite(snapshot.serverNow) ? { serverNow: Math.floor(snapshot.serverNow) } : {}),
         lastSequence: Number.isSafeInteger(snapshot.lastSequence) ? snapshot.lastSequence : frame.sequence,
       } } };
     }
     case 'session.lifecycle': {
       const retry = frame.payload.state === 'retry' ? projectRetryInfo(frame.payload) : null;
-      return { ...common, payload: { state: frame.payload.state, ...(retry ?? {}) } };
+      return { ...common, payload: { state: frame.payload.state, ...(retry ?? {}), ...(Number.isFinite(frame.payload.runStartedAt) ? { runStartedAt: Math.floor(frame.payload.runStartedAt) } : {}), ...(Number.isFinite(frame.payload.serverNow) ? { serverNow: Math.floor(frame.payload.serverNow) } : {}) } };
     }
     case 'session.updated': {
       if (typeof frame.payload.title !== 'string') return null;

package/server/lib/pi/session-daemon/DOCUMENTATION.md

@@ -25,7 +25,7 @@ This module is the Pi-owned session-daemon foundation. A detached local daemon p
 - The public health route deliberately whitelists its response fields. It never returns a daemon endpoint, credential, PID, cwd, agent directory, or transcript data. Public transcript and event projections preserve daemon-redacted assistant error messages so the UI can distinguish provider/runtime failures instead of reducing every failure to `ASSISTANT_ERROR`.
 - A client must send an `authenticate` frame carrying the host-private daemon credential before it can issue a request. Credentials are never logged or returned.
 - Frames are LF-delimited JSON. They have a 1 MiB maximum buffered size. A malformed, oversized, unauthenticated, or invalid request closes the connection.
-- The private core commands are `runtime.health`, `projects.list/select`, `providers.list/config.get/models.set/status/login/login.respond/login.status/logout`, `settings.get/set`, `resources.list/update/prompts.create/prompts.delete`, and session list/create/open/rename/delete/tree/navigate/fork/clone/prompt/steer/followUp/abort/model/thinking/compact operations. Resource lists use opaque IDs and never disclose server paths. Only top-level Pi prompt templates and applicable AGENTS.md sources are editable; package/path resources and skills are browse-only. Resource writes are rejected while a session streams, use an atomic replace, then recreate the idle runtime. Project trust changes are persisted in Pi trust.json and likewise recreate an idle runtime; extensions remain disabled regardless of trust. Provider login submits API keys only across authenticated private IPC or brokers Pi's OAuth/device/manual-code interaction; public projections contain only opaque login IDs, prompts, URLs/device codes, model catalog/configuration, and stable states, never credentials or write-only headers. `providers.models.set` is rejected while a session streams, atomically persists Pi's `models.json`, then rehydrates the idle runtime so the catalog is authoritative immediately. `providers.list` projects only catalog and authentication-status metadata, including Pi-supported `thinkingLevels` (`null` map entries hidden, `xhigh`/`max` opt-in). Session thinking overrides are clamped to the live model's supported levels. `sessions.list` checks each cwd JSONL header (not the full transcript) so a project with large session logs cannot spend tens of seconds on startup. SDK `SessionManager.list` is not used for that path; `listPiSessionJsonlDirectory` reads a header, a bounded prefix for the first user prompt, and a tail for the latest rename. Concurrent lists of the same directory share one in-flight result. Concurrent `sessions.open` of the same id share one in-flight runtime create; a duplicate that finishes later disposes itself and returns the registered runtime instead of `SESSION_RUNTIME_CONFLICT`. Full-file JSONL validation stays on open of a chosen session. The browser explicitly selects an existing user-chosen project directory before listing it; the daemon's startup cwd is an internal fallback, not a user-visible default project. Unnamed persisted sessions use their first prompt as a readable list title when available. `sessions.open` and `getSession` project the last assistant `provider`/`model`/`thinkingLevel` onto the session record so reopening a chat keeps that cache identity. Session selection validates a persisted JSONL path before Pi opens it; inactive mutations are never directed by a browser-supplied path. `sessions.open` resolves an id by Pi's `timestamp_<id>.jsonl` filename first so a missing deep link 404s without listing or fully reading every transcript in every cwd; SDK list and header scan remain the fallback for non-standard names. Directory-wide JSONL checks on list/create/startup are header-only; full-file validation stays on open of a chosen transcript. Attachment paths originate in the server-local upload map and cross only private IPC into Pi's tool context. Pi may persist or echo those paths in its authoritative JSONL transcript, so every public projection redacts them recursively: session titles/previews, user and assistant text/thinking, tool arguments, errors, snapshots, and live message events never expose the server-local path. The daemon maps Pi message lifecycle, deltas, tools, queue changes, model/thinking, compaction, interruption state, and session title updates (`session.updated` on create-with-title, first-prompt auto-title, and rename) to canonical events. Tool events carry redacted input arguments, cumulative partial-output snapshots, final output, error text, renderer metadata (edit diffs, truncation notes), and start/end timestamps. Persisted `toolResult` entries merge into their assistant `toolCall` parts as output/error/end time so hydrated sessions render complete tool cards; tool-result entries never surface as standalone messages. Assistant message projections and start events carry the owning user-message id so the restored turn renderer can group and display replies; all assistant entries in a tool loop and every retry/compaction continuation remain attached to the latest user turn until `agent_settled` closes the run. Assistant message projections also pass through Pi's per-turn `Usage` (input, output, cacheRead, cacheWrite, totalTokens, and the same five numeric cost fields). The daemon sanitizes the raw payload through `projectUsage` before publication: every numeric must be finite and non-negative, the whole object is omitted when any field is missing or wrong type, and unknown keys are never copied. The `assistant.message.end` event carries the same sanitized usage so the last turn updates without waiting for a full `getSession` refetch. The public route whitelist re-applies the same sanitizer on each projection so a stale or malformed payload from a different daemon version cannot surface as `NaN` or `Infinity` in the reducer.
+- The private core commands are `runtime.health`, `projects.list/select`, `providers.list/config.get/models.set/status/login/login.respond/login.status/logout`, `settings.get/set`, `resources.list/update/prompts.create/prompts.delete`, and session list/create/open/rename/delete/tree/navigate/fork/clone/prompt/steer/followUp/abort/model/thinking/compact operations. Resource lists use opaque IDs and never disclose server paths. Only top-level Pi prompt templates and applicable AGENTS.md sources are editable; package/path resources and skills are browse-only. Resource writes are rejected while a session streams, use an atomic replace, then recreate the idle runtime. Project trust changes are persisted in Pi trust.json and likewise recreate an idle runtime; extensions remain disabled regardless of trust. Provider login submits API keys only across authenticated private IPC or brokers Pi's OAuth/device/manual-code interaction; public projections contain only opaque login IDs, prompts, URLs/device codes, model catalog/configuration, and stable states, never credentials or write-only headers. `providers.models.set` is rejected while a session streams, atomically persists Pi's `models.json`, then rehydrates the idle runtime so the catalog is authoritative immediately. `providers.list` projects only catalog and authentication-status metadata, including Pi-supported `thinkingLevels` (`null` map entries hidden, `xhigh`/`max` opt-in). Session thinking overrides are clamped to the live model's supported levels. `sessions.list` checks each cwd JSONL header (not the full transcript) so a project with large session logs cannot spend tens of seconds on startup. SDK `SessionManager.list` is not used for that path; `listPiSessionJsonlDirectory` reads a header, a bounded prefix for the first user prompt, and a tail for the latest rename. Concurrent lists of the same directory share one in-flight result. Concurrent `sessions.open` of the same id share one in-flight runtime create; a duplicate that finishes later disposes itself and returns the registered runtime instead of `SESSION_RUNTIME_CONFLICT`. Full-file JSONL validation stays on open of a chosen session. The browser explicitly selects an existing user-chosen project directory before listing it; the daemon's startup cwd is an internal fallback, not a user-visible default project. Unnamed persisted sessions use their first prompt as a readable list title when available. `sessions.open` and `getSession` project the last assistant `provider`/`model`/`thinkingLevel` onto the session record so reopening a chat keeps that cache identity. Session selection validates a persisted JSONL path before Pi opens it; inactive mutations are never directed by a browser-supplied path. `sessions.open` resolves an id by Pi's `timestamp_<id>.jsonl` filename first so a missing deep link 404s without listing or fully reading every transcript in every cwd; SDK list and header scan remain the fallback for non-standard names. Directory-wide JSONL checks on list/create/startup are header-only; full-file validation stays on open of a chosen transcript. Attachment paths originate in the server-local upload map and cross only private IPC into Pi's tool context. Pi may persist or echo those paths in its authoritative JSONL transcript, so every public projection redacts them recursively: session titles/previews, user and assistant text/thinking, tool arguments, errors, snapshots, and live message events never expose the server-local path. Persisted projection first checks for the attachment marker, then redacts matching tokens with a delimiter scan whose work stays linear for large encoded strings and tool payloads. The daemon maps Pi message lifecycle, deltas, tools, queue changes, model/thinking, compaction, interruption state, and session title updates (`session.updated` on create-with-title, first-prompt auto-title, and rename) to canonical events. Tool events carry redacted input arguments, cumulative partial-output snapshots, final output, error text, renderer metadata (edit diffs, truncation notes), and start/end timestamps. Persisted `toolResult` entries merge into their assistant `toolCall` parts as output/error/end time so hydrated sessions render complete tool cards; tool-result entries never surface as standalone messages. Assistant message projections and start events carry the owning user-message id so the restored turn renderer can group and display replies; all assistant entries in a tool loop and every retry/compaction continuation remain attached to the latest user turn until `agent_settled` closes the run. Assistant message projections also pass through Pi's per-turn `Usage` (input, output, cacheRead, cacheWrite, totalTokens, and the same five numeric cost fields). The daemon sanitizes the raw payload through `projectUsage` before publication: every numeric must be finite and non-negative, the whole object is omitted when any field is missing or wrong type, and unknown keys are never copied. The `assistant.message.end` event carries the same sanitized usage so the last turn updates without waiting for a full `getSession` refetch. The public route whitelist re-applies the same sanitizer on each projection so a stale or malformed payload from a different daemon version cannot surface as `NaN` or `Infinity` in the reducer.
 - Live `message_start` events use daemon-generated browser message IDs because Pi has not appended the corresponding session entry yet. Pi agent-core emits streaming assistant starts as shallow copies, not as the finalized object it later persists. At `message_end`, `message-entry-aliases.js` therefore rebinds the synthetic ID to the finalized event object, then maps that object by identity to Pi's appended entry in a microtask. `sessions.navigate` and `sessions.fork` resolve the mapping after stripping any part suffix. Alias keys include cwd and session ID, survive idle runtime disposal, and clear only on explicit session deletion or daemon shutdown. Hydrated message projections continue to use the Pi entry ID directly.
 - Each event and reconnect snapshot has a monotonic sequence. A reconnect receives a bounded contiguous replay after its cursor when available, otherwise an authoritative `session.snapshot`; unavailable runtimes are not represented as empty sessions.
 - Prompt, steer, and follow-up requests acknowledge acceptance immediately after Pi accepts the call; the daemon owns the still-running send promise and publishes any asynchronous rejection as `session.error`. A later prompt on the same session invalidates that rejection so it cannot error the new turn. If the rejected send left Pi streaming, the daemon aborts it. Steer/follow-up against an idle session starts a new prompt instead of `SESSION_NOT_RUNNING`. Agent completion is never held behind the 30-second public/private request budgets. Pi retryable provider failures remain live: an `agent_end` with `willRetry` does not publish terminal `session.error`, and `auto_retry_start` projects Pi's attempt, next-attempt time, and redacted error text through `session.lifecycle: retry`. Retry metadata is retained in reconnect and `getSession` snapshots until the next `agent_start` begins the attempt. `agent_settled` remains the authoritative idle boundary after retry success, exhaustion, or cancellation and clears the run's user/assistant ownership.

package/server/lib/pi/session-daemon/session-daemon.js

@@ -27,6 +27,7 @@ import {
   validatePiSessionJsonlDirectory,
   validatePiSessionJsonlFile,
 } from './session-jsonl.js';
+import { resolvePiChamberDataDir } from '../../pichamber-data-dir.js';
 
 const PROTOCOL_VERSION = 1;
 const MAX_FRAME_BYTES = 16 * 1024 * 1024;
@@ -138,6 +139,7 @@ export function createSessionDaemon({
   const toolStartedAt = new Map();
   const latestUserMessageIds = new Map();
   const retryStateBySession = new Map();
+  const activeRunStartedAt = new Map();
   const sendGenerationBySession = new Map();
   const streamingRedactionBuffers = new Map();
   const loginAttempts = new Map();
@@ -266,6 +268,8 @@ export function createSessionDaemon({
         ...(activeSession?.thinkingLevel ? { thinking: activeSession.thinkingLevel } : {}),
         ...(typeof lastAssistant?.text === 'string' ? { lastText: lastAssistant.text } : {}),
         ...(typeof lastAssistant?.thinking === 'string' ? { lastThinking: lastAssistant.thinking } : {}),
+        ...(session.sessionId && activeRunStartedAt.has(session.sessionId) ? { runStartedAt: activeRunStartedAt.get(session.sessionId) } : {}),
+        serverNow: Date.now(),
         lastSequence: snapshotSequence,
       },
     });
@@ -746,10 +750,16 @@ export function createSessionDaemon({
       isStreaming,
       lifecycle: retry ? 'retry' : isStreaming ? 'busy' : 'idle',
       ...(retry ? { retry } : {}),
+      ...(activeRunStartedAt.has(session.sessionId) ? { runStartedAt: activeRunStartedAt.get(session.sessionId) } : {}),
+      serverNow: Date.now(),
     };
   };
 
   const createSession = async (payload) => {
+    const explicitRetryLimit = payload && typeof payload === 'object' ? (payload.maxRetries ?? payload.retryLimit ?? payload.defaultRetryLimit) : undefined;
+    if (explicitRetryLimit !== undefined && (!Number.isInteger(explicitRetryLimit) || explicitRetryLimit < 0 || explicitRetryLimit > 10)) {
+      throw new SessionDaemonProtocolError('INVALID_ARGUMENT', 'The retry limit must be an integer between 0 and 10.');
+    }
     if (!payload || typeof payload !== 'object'
       || (payload.cwd !== undefined && (typeof payload.cwd !== 'string' || payload.cwd.length === 0))
       || (payload.title !== undefined && (typeof payload.title !== 'string' || payload.title.trim().length === 0 || payload.title.length > 256))
@@ -771,6 +781,32 @@ export function createSessionDaemon({
       ...(parent ? { sessionFile: parent.path } : {}),
     });
     if (!newRuntime.cwd) newRuntime.cwd = targetCwd;
+    // Apply default retry limit for new sessions. Explicit per-run overrides win.
+    try {
+      const settingsManager = newRuntime.services?.settingsManager;
+      if (settingsManager && typeof settingsManager.getRetrySettings === 'function') {
+        let effective = explicitRetryLimit;
+        if (effective === undefined) {
+          try {
+            const raw = await readFile(join(resolvePiChamberDataDir(), 'pi', 'settings.json'), 'utf8');
+            const parsed = JSON.parse(raw);
+            if (Number.isInteger(parsed?.defaultRetryLimit)) effective = parsed.defaultRetryLimit;
+          } catch {}
+          if (effective === undefined) effective = 3;
+        }
+        if (Number.isInteger(effective) && effective >= 0 && effective <= 10) {
+          const current = settingsManager.getRetrySettings().maxRetries;
+          if (current !== effective) {
+            if (typeof settingsManager.applyOverrides === 'function') {
+              settingsManager.applyOverrides({ retry: { maxRetries: effective } });
+              if (explicitRetryLimit === undefined) await settingsManager.flush().catch(() => {});
+            } else if (settingsManager.globalSettings) {
+              settingsManager.globalSettings.retry = { ...(settingsManager.globalSettings.retry ?? {}), maxRetries: effective };
+            }
+          }
+        }
+      }
+    } catch {}
     let result = { cancelled: false };
     if (typeof newRuntime.newSession === 'function') {
       result = await newRuntime.newSession({
@@ -1356,11 +1392,72 @@ export function createSessionDaemon({
     }
   };
 
-  const redactAttachmentPaths = (text) => typeof text === 'string'
-    ? text
-      .replace(/\[Attachment[^\]\r\n]*pi-clipboard-[0-9a-f-]{36}[^\]\r\n]*\]/gi, '[attachment]')
-      .replace(/(?:[A-Za-z]:)?[^\s[\](){}"'`]*pi-clipboard-[0-9a-f-]{36}(?:\.[^\s\])}\]"'`,;]+)?/gi, '[attachment]')
-    : '';
+  const attachmentMarkerPattern = /pi-clipboard-/i;
+  const attachmentMarkerSearchPattern = /pi-clipboard-/gi;
+  const attachmentIdPattern = /^[0-9a-f-]{36}$/i;
+  const attachmentBracketStartPattern = /\[Attachment/gi;
+  const attachmentTokenPattern = /pi-clipboard-[0-9a-f-]{36}/i;
+  const isAttachmentPathDelimiter = (character) => /[\s[\](){}"'`,;]/u.test(character);
+
+  const redactAttachmentBrackets = (text) => {
+    let cursor = 0;
+    let output = '';
+    while (cursor < text.length) {
+      attachmentBracketStartPattern.lastIndex = cursor;
+      const bracketStart = attachmentBracketStartPattern.exec(text);
+      if (!bracketStart) {
+        output += text.slice(cursor);
+        break;
+      }
+
+      output += text.slice(cursor, bracketStart.index);
+      let bracketEnd = bracketStart.index + bracketStart[0].length;
+      while (bracketEnd < text.length && text[bracketEnd] !== ']' && text[bracketEnd] !== '\r' && text[bracketEnd] !== '\n') bracketEnd += 1;
+      if (text[bracketEnd] === ']') {
+        const candidate = text.slice(bracketStart.index, bracketEnd + 1);
+        output += attachmentTokenPattern.test(candidate) ? '[attachment]' : candidate;
+        cursor = bracketEnd + 1;
+      } else {
+        output += text.slice(bracketStart.index, bracketEnd);
+        cursor = bracketEnd;
+      }
+    }
+    return output;
+  };
+
+  const redactAttachmentPaths = (text) => {
+    if (typeof text !== 'string') return '';
+
+    if (!attachmentMarkerPattern.test(text)) return text;
+    const bracketRedacted = redactAttachmentBrackets(text);
+    let cursor = 0;
+    let output = '';
+    while (cursor < bracketRedacted.length) {
+      attachmentMarkerSearchPattern.lastIndex = cursor;
+      const markerMatch = attachmentMarkerSearchPattern.exec(bracketRedacted);
+      if (!markerMatch) {
+        output += bracketRedacted.slice(cursor);
+        break;
+      }
+
+      const markerIndex = markerMatch.index;
+      const idStart = markerIndex + markerMatch[0].length;
+      const idEnd = idStart + 36;
+      if (!attachmentIdPattern.test(bracketRedacted.slice(idStart, idEnd))) {
+        output += bracketRedacted.slice(cursor, idStart);
+        cursor = idStart;
+        continue;
+      }
+
+      let tokenStart = markerIndex;
+      while (tokenStart > cursor && !isAttachmentPathDelimiter(bracketRedacted[tokenStart - 1])) tokenStart -= 1;
+      let tokenEnd = idEnd;
+      while (tokenEnd < bracketRedacted.length && !isAttachmentPathDelimiter(bracketRedacted[tokenEnd])) tokenEnd += 1;
+      output += `${bracketRedacted.slice(cursor, tokenStart)}[attachment]`;
+      cursor = tokenEnd;
+    }
+    return output;
+  };
 
   const redactAttachmentValues = (value) => {
     if (typeof value === 'string') return redactAttachmentPaths(value);
@@ -1611,9 +1708,10 @@ export function createSessionDaemon({
     }
     messageEntryAliases.clearSession({ cwd: active?.cwd || targetDir, sessionId });
     retryStateBySession.delete(sessionId);
+    activeRunStartedAt.delete(sessionId);
     latestUserMessageIds.delete(sessionId);
     latestAssistantMessageIds.delete(sessionId);
-    publish('session.lifecycle', { state: 'idle', deleted: true }, sessionId, targetDir);
+    publish('session.lifecycle', { state: 'idle', deleted: true, serverNow: Date.now() }, sessionId, targetDir);
   };
 
   const publishSessionEvent = (sessionId, event, directory = activeDirectory || cwd) => {
@@ -1756,7 +1854,8 @@ export function createSessionDaemon({
       case 'agent_start':
         clearIdleDisposal(sessionId);
         retryStateBySession.delete(sessionId);
-        publish('session.lifecycle', { state: 'busy' }, sessionId, directory);
+        if (!activeRunStartedAt.has(sessionId)) activeRunStartedAt.set(sessionId, Date.now());
+        publish('session.lifecycle', { state: 'busy', runStartedAt: activeRunStartedAt.get(sessionId), serverNow: Date.now() }, sessionId, directory);
         break;
       case 'agent_end': {
         const finalMessage = event.messages?.at?.(-1);
@@ -1774,7 +1873,8 @@ export function createSessionDaemon({
           message: redactAttachmentPaths(event.errorMessage),
         };
         retryStateBySession.set(sessionId, retry);
-        publish('session.lifecycle', { state: 'retry', ...retry }, sessionId, directory);
+        if (!activeRunStartedAt.has(sessionId)) activeRunStartedAt.set(sessionId, Date.now());
+        publish('session.lifecycle', { state: 'retry', ...retry, runStartedAt: activeRunStartedAt.get(sessionId), serverNow: Date.now() }, sessionId, directory);
         break;
       }
       case 'auto_retry_end':
@@ -1782,9 +1882,10 @@ export function createSessionDaemon({
         break;
       case 'agent_settled':
         retryStateBySession.delete(sessionId);
+        activeRunStartedAt.delete(sessionId);
         latestUserMessageIds.delete(sessionId);
         latestAssistantMessageIds.delete(sessionId);
-        publish('session.lifecycle', { state: 'idle' }, sessionId, directory);
+        publish('session.lifecycle', { state: 'idle', serverNow: Date.now() }, sessionId, directory);
         scheduleIdleDisposal(sessionId);
         break;
       case 'thinking_level_changed':
@@ -2174,6 +2275,7 @@ export function createSessionDaemon({
       }
       loginAttempts.clear();
       retryStateBySession.clear();
+      activeRunStartedAt.clear();
       latestUserMessageIds.clear();
       latestAssistantMessageIds.clear();
       for (const client of clients) client.destroy();

package/server/lib/pi/session-daemon/session-daemon.test.js

@@ -1016,6 +1016,81 @@ describe('Pi session daemon spike', () => {
     await client.close();
   });
 
+  it('projects large tool payloads without blocking attachment redaction', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-large-payload-'));
+    const endpoint = testDaemonEndpoint(root);
+    const persistedSessionFile = join(root, 'persisted.jsonl');
+    await writeFile(persistedSessionFile, `{"type":"session","id":"pi-session-large","cwd":"${root}"}\n`);
+    const session = new FakeSession('pi-session-large', persistedSessionFile);
+    const largeEncodedValue = 'A'.repeat(80_000);
+    session.entries = [{
+      type: 'message',
+      id: 'assistant-large-tool',
+      timestamp: '2026-01-01T00:00:02.000Z',
+      message: {
+        role: 'assistant',
+        provider: 'test',
+        model: 'model',
+        content: [{ type: 'toolCall', id: 'large-tool', name: 'read', arguments: { encoded: largeEncodedValue } }],
+      },
+    }, {
+      type: 'message',
+      id: 'large-tool-result',
+      timestamp: '2026-01-01T00:00:03.000Z',
+      message: {
+        role: 'toolResult',
+        toolCallId: 'large-tool',
+        toolName: 'read',
+        content: [{ type: 'text', text: largeEncodedValue }],
+        details: {
+          encoded: largeEncodedValue,
+          windowsPath: 'C:\\Temp\\pi-clipboard-7f7ec702-256a-4783-855c-df34e3ecedab.png',
+          bracketed: '[Attachment report.png is available at /tmp/pi-clipboard-7f7ec702-256a-4783-855c-df34e3ecedab.png]',
+          punctuated: 'before,/tmp/pi-clipboard-7f7ec702-256a-4783-855c-df34e3ecedab.png;after',
+          unicodePrefix: 'İ /tmp/pi-clipboard-7f7ec702-256a-4783-855c-df34e3ecedab.png',
+        },
+        isError: false,
+      },
+    }];
+    const runtime = new FakeRuntime({ cwd: root, session });
+    daemon = createSessionDaemon({
+      endpoint,
+      credential,
+      cwd: root,
+      createRuntime: async () => runtime,
+      listSessions: async () => [{
+        path: persistedSessionFile,
+        id: 'pi-session-large',
+        cwd: root,
+        created: new Date('2026-01-01T00:00:00.000Z'),
+        modified: new Date('2026-01-01T00:00:01.000Z'),
+        messageCount: 2,
+      }],
+    });
+    await daemon.start();
+    const client = connectClient(endpoint);
+    await client.authenticate();
+
+    const startedAt = performance.now();
+    const opened = await client.request('sessions.open', { sessionId: 'pi-session-large', directory: root });
+    const elapsedMs = performance.now() - startedAt;
+
+    expect(elapsedMs).toBeLessThan(900);
+    expect(opened.result.messages[0].parts[0]).toMatchObject({
+      input: { encoded: largeEncodedValue },
+      output: largeEncodedValue,
+      metadata: {
+        encoded: largeEncodedValue,
+        windowsPath: '[attachment]',
+        bracketed: '[attachment]',
+        punctuated: 'before,[attachment];after',
+        unicodePrefix: 'İ [attachment]',
+      },
+    });
+    expect(JSON.stringify(opened.result)).not.toContain('pi-clipboard-');
+    await client.close();
+  }, 2_000);
+
   it('keeps Pi global/project defaults and trust decisions authoritative', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-settings-'));
     const cwd = join(root, 'project');

package/server/lib/pi/settings-store.js

@@ -63,6 +63,16 @@ const mergeThinkingByModel = (current, incoming) => {
   return next;
 };
 
+const DEFAULT_RETRY_LIMIT = 3;
+const MIN_RETRY_LIMIT = 0;
+const MAX_RETRY_LIMIT = 10;
+
+const normalizeRetryLimit = (value) => {
+  if (value === undefined || value === null) return undefined;
+  if (!Number.isInteger(value) || value < MIN_RETRY_LIMIT || value > MAX_RETRY_LIMIT) throw invalidSettings();
+  return value;
+};
+
 const normalize = (value) => {
   if (!value || typeof value !== 'object' || Array.isArray(value)) throw invalidSettings();
   const model = normalizeModel(value.defaultModel);
@@ -77,6 +87,7 @@ const normalize = (value) => {
     if (!thinkingByModel[key]) thinkingByModel[key] = fallbackThinking;
     fallbackThinking = undefined;
   }
+  const retryLimit = normalizeRetryLimit(value.defaultRetryLimit);
   return {
     version: 1,
     ...(model ? { defaultModel: model } : {}),
@@ -84,6 +95,7 @@ const normalize = (value) => {
     ...(walkthroughModel ? { walkthroughModel } : {}),
     ...(Object.keys(thinkingByModel).length > 0 ? { defaultThinkingByModel: thinkingByModel } : {}),
     ...(fallbackThinking ? { defaultThinking: fallbackThinking } : {}),
+    ...(retryLimit !== undefined ? { defaultRetryLimit: retryLimit } : {}),
   };
 };
 
@@ -92,6 +104,10 @@ const normalize = (value) => {
  * Pi's settings.json: Pi remains authoritative when no PiChamber override is
  * configured, and credentials never enter this sidecar.
  */
+export const PI_DEFAULT_RETRY_LIMIT = DEFAULT_RETRY_LIMIT;
+export const PI_MIN_RETRY_LIMIT = MIN_RETRY_LIMIT;
+export const PI_MAX_RETRY_LIMIT = MAX_RETRY_LIMIT;
+
 export const createPiSettingsStore = ({ file = join(resolvePiChamberDataDir(), 'pi', 'settings.json') } = {}) => {
   let writeChain = Promise.resolve();
 
@@ -115,6 +131,7 @@ export const createPiSettingsStore = ({ file = join(resolvePiChamberDataDir(), '
         ...(Object.hasOwn(patch, 'defaultThinking') ? { defaultThinking: patch.defaultThinking } : {}),
         ...(Object.hasOwn(patch, 'smallModel') ? { smallModel: patch.smallModel } : {}),
         ...(Object.hasOwn(patch, 'walkthroughModel') ? { walkthroughModel: patch.walkthroughModel } : {}),
+        ...(Object.hasOwn(patch, 'defaultRetryLimit') ? { defaultRetryLimit: patch.defaultRetryLimit } : {}),
         defaultThinkingByModel: Object.hasOwn(patch, 'defaultThinkingByModel')
           ? mergeThinkingByModel(current.defaultThinkingByModel ?? {}, patch.defaultThinkingByModel)
           : (current.defaultThinkingByModel ?? {}),

package/server/lib/pi/settings-store.test.js

@@ -110,4 +110,37 @@ describe('Pi settings sidecar', () => {
     await store.update({ defaultThinkingByModel: { 'provider/a': 'low' } });
     await expect(store.update({ defaultThinkingByModel: null })).resolves.toEqual({ version: 1 });
   });
+
+  it('round-trips default retry limit with validation and persistence', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-settings-'));
+    const file = join(root, 'pi', 'settings.json');
+    const store = createPiSettingsStore({ file });
+    await expect(store.update({ defaultRetryLimit: 5 })).resolves.toEqual({ version: 1, defaultRetryLimit: 5 });
+    await expect(store.read()).resolves.toEqual({ version: 1, defaultRetryLimit: 5 });
+    await expect(store.update({ defaultRetryLimit: 0 })).resolves.toEqual({ version: 1, defaultRetryLimit: 0 });
+    await expect(store.read()).resolves.toEqual({ version: 1, defaultRetryLimit: 0 });
+  });
+
+  it('rejects invalid retry limits without erasing existing value', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-settings-'));
+    const file = join(root, 'pi', 'settings.json');
+    const store = createPiSettingsStore({ file });
+    await store.update({ defaultRetryLimit: 3 });
+    await expect(store.update({ defaultRetryLimit: -1 })).rejects.toMatchObject({ code: 'PI_SETTINGS_INVALID' });
+    await expect(store.update({ defaultRetryLimit: 11 })).rejects.toMatchObject({ code: 'PI_SETTINGS_INVALID' });
+    await expect(store.update({ defaultRetryLimit: 2.5 })).rejects.toMatchObject({ code: 'PI_SETTINGS_INVALID' });
+    await expect(store.read()).resolves.toEqual({ version: 1, defaultRetryLimit: 3 });
+  });
+
+  it('preserves explicit per-run retry over stored default', async () => {
+    const resolveEffective = (explicit, stored) => {
+      if (Number.isInteger(explicit)) return explicit;
+      if (Number.isInteger(stored)) return stored;
+      return 3;
+    };
+    expect(resolveEffective(undefined, 5)).toBe(5);
+    expect(resolveEffective(7, 5)).toBe(7);
+    expect(resolveEffective(undefined, undefined)).toBe(3);
+    expect(resolveEffective(0, 5)).toBe(0);
+  });
 });

package/server/lib/server/core-routes.js

@@ -479,6 +479,38 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     }
   };
 
+  const runWithPairingCreateAuth = async (req, res, next, handler) => {
+    try {
+      if (typeof uiAuthController.resolveAuthContext === 'function') {
+        const context = await uiAuthController.resolveAuthContext(req, res, {
+          allowClientAuth: true,
+          allowUrlToken: false,
+        });
+        if (context?.type === 'session') {
+          await handler(context);
+          return;
+        }
+        if (context?.type === 'client') {
+          const client = await clientRecordFromAuthContext(context);
+          // Trusted desktop clients (local or remote) may create short-lived
+          // pairing tickets scoped to this server/user. Mobile or other
+          // client kinds remain prohibited from creating pairing sessions.
+          if (client?.clientKind === 'desktop-local' || client?.clientKind === 'desktop') {
+            await handler({ ...context, client });
+            return;
+          }
+          return res.status(403).json({ error: 'Client tokens cannot create pairing sessions' });
+        }
+      }
+
+      await runWithUiAuth(req, res, next, async () => {
+        await handler({ type: 'session' });
+      }, { sessionOnly: true });
+    } catch (error) {
+      next(error);
+    }
+  };
+
   const clientIdFromAuthContext = (context) => {
     const raw = context?.client?.id || context?.clientId;
     return typeof raw === 'string' && raw.length > 0 ? raw : null;
@@ -811,7 +843,7 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
   });
 
   app.post('/api/client-auth/pairing/sessions', express.json({ limit: '64kb' }), async (req, res, next) => {
-    await runWithClientCreateAuth(req, res, next, async (authContext) => {
+    await runWithPairingCreateAuth(req, res, next, async (authContext) => {
       const candidates = await pairingServerCandidates(req, {
         preferredServerUrl: req.body?.serverUrl,
         includeRelay: typeof req.body?.includeRelay === 'boolean' ? req.body.includeRelay : undefined,
@@ -877,7 +909,7 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
 
   // Direct transports the server can be reached on (for the create-device dialog).
   app.get('/api/client-auth/pairing/transports', async (req, res, next) => {
-    await runWithClientCreateAuth(req, res, next, async () => {
+    await runWithPairingCreateAuth(req, res, next, async () => {
       res.setHeader('Cache-Control', 'no-store');
       res.json(getPairingTransports(req));
     });
@@ -886,7 +918,7 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
   // Pending pairing sessions (link created, device not yet connected) for the
   // "pending devices" list. Secrets are never included.
   app.get('/api/client-auth/pairing/sessions', async (req, res, next) => {
-    await runWithClientCreateAuth(req, res, next, async () => {
+    await runWithPairingCreateAuth(req, res, next, async () => {
       const pending = await clientPairingRuntime.listPendingSessions();
       res.setHeader('Cache-Control', 'no-store');
       res.json({ pending });
@@ -894,7 +926,7 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
   });
 
   app.delete('/api/client-auth/pairing/sessions/:id', async (req, res, next) => {
-    await runWithClientCreateAuth(req, res, next, async () => {
+    await runWithPairingCreateAuth(req, res, next, async () => {
       const result = await clientPairingRuntime.cancelPairingSession(req.params?.id);
       if (!result.cancelled) {
         return res.status(404).json({ cancelled: false, error: 'Pairing session not found' });