@pi-harness/pi-harness 0.1.23 → 0.1.25

package/packages/api-gateway/src/index.ts

@@ -1,7 +1,7 @@
 import { execFile, type ExecFileException } from "node:child_process";
-import { mkdir, mkdtemp, readFile, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, readFile, realpath, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import type { IncomingMessage, ServerResponse } from "node:http";
-import { basename, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { basename, dirname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { tmpdir } from "node:os";
 import type { Context } from "@deepseek-ai/cordis";
 import { SessionManager, type AgentSessionEvent, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
@@ -18,6 +18,7 @@ import {
   paginateMarketplace,
   searchMarketplace,
   needsMarketplacePackageInstall,
+  marketplaceNpmPackageName,
   sortMarketplaceByRecommendation,
   type MarketplacePlugin,
 } from "./marketplace.js";
@@ -41,6 +42,8 @@ const IMPORT_BODY_LIMIT_BYTES = 16 * 1024 * 1024;
 // Retained trajectory events are replayed to every SSE client and returned by /api/session, so the array must stay bounded.
 const MAX_RETAINED_EVENTS = 2000;
 const GIT_TIMEOUT_MS = 15_000;
+// Mutating commands run user hooks (pre-commit, lint-staged, test suites) and may stage large trees; killing them part-way leaves index.lock and a half-finished operation behind, so they get a far more generous bound than read-only queries.
+const GIT_MUTATION_TIMEOUT_MS = 120_000;
 
 class PayloadTooLargeError extends Error {
   constructor() {
@@ -55,17 +58,18 @@ function sendJson(response: ServerResponse, status: number, payload: unknown): v
   response.end(body);
 }
 
+// A multi-byte UTF-8 sequence can straddle a chunk boundary, so the raw bytes are collected and decoded once; decoding each chunk on its own would replace the split sequence with U+FFFD.
 async function bodyText(request: IncomingMessage, maxBytes = DEFAULT_BODY_LIMIT_BYTES): Promise<string> {
-  const chunks: string[] = [];
+  const chunks: Buffer[] = [];
   let length = 0;
   for await (const chunk of request) {
     const input: string | Uint8Array = chunk as string | Uint8Array;
-    const value = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-    length += Buffer.byteLength(value);
+    const buffer = typeof input === "string" ? Buffer.from(input, "utf8") : Buffer.isBuffer(input) ? input : Buffer.from(input);
+    length += buffer.length;
     if (length > maxBytes) throw new PayloadTooLargeError();
-    chunks.push(value);
+    chunks.push(buffer);
   }
-  return chunks.join("");
+  return Buffer.concat(chunks).toString("utf8");
 }
 
 function errorText(error: unknown): string {
@@ -80,9 +84,14 @@ function jsonSafe(value: unknown, seen = new WeakSet<object>()): unknown {
   if (value instanceof Date) return value.toISOString();
   if (typeof value !== "object") return Object.prototype.toString.call(value);
   if (seen.has(value)) return "[Circular]";
+  // Only the ancestors of the current node stay marked: a sibling that repeats the same object (Pi pushes one AgentMessage instance into both the message list and its events) is legitimate data, not a cycle.
   seen.add(value);
-  if (Array.isArray(value)) return value.map((item) => jsonSafe(item, seen));
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+  try {
+    if (Array.isArray(value)) return value.map((item) => jsonSafe(item, seen));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, jsonSafe(item, seen)]));
+  } finally {
+    seen.delete(value);
+  }
 }
 
 function createStatus(services: ApiServices, events: readonly AgentSessionEvent[]) {
@@ -159,7 +168,7 @@ interface MetadataLogger {
   warn(message: string): void;
 }
 
-// A missing file is the normal first-run state. Any other read or parse failure means the file exists but is unusable; it is renamed aside so the wreckage survives for recovery and the next write cannot silently replace the only copy.
+// A missing file is the normal first-run state. A parse or shape failure means the file exists but is unusable; it is renamed aside so the wreckage survives for recovery and the next write cannot silently replace the only copy. Any other read error (EMFILE, EBUSY, EISDIR, permissions) says nothing about the content, so it propagates and the caller's write is skipped instead of replacing a valid map with an empty one.
 async function readSessionMetadata(manager: SessionManager, logger: MetadataLogger): Promise<SessionMetadataMap> {
   const file = sessionMetadataFile(manager);
   let raw: string;
@@ -167,8 +176,7 @@ async function readSessionMetadata(manager: SessionManager, logger: MetadataLogg
     raw = await readFile(file, "utf8");
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code === "ENOENT") return {};
-    await quarantineSessionMetadata(file, logger, error);
-    return {};
+    throw error;
   }
   try {
     const parsed: unknown = JSON.parse(raw);
@@ -195,27 +203,38 @@ async function writeSessionMetadata(manager: SessionManager, metadata: SessionMe
   await atomicWriteFile(sessionMetadataFile(manager), JSON.stringify(metadata, null, 2) + "\n", { encoding: "utf8" });
 }
 
-// Every read-modify-write of the metadata file runs through this chain so concurrent requests cannot interleave and drop each other's updates.
+// Every access to the metadata file runs through this chain so concurrent requests cannot interleave and drop each other's updates. Plain reads take the lock too: a read that finds corrupt bytes quarantines the file, and doing that outside the lock could rename away a valid map that a concurrent mutation had just written.
 let sessionMetadataQueue: Promise<unknown> = Promise.resolve();
 
+function withSessionMetadataLock<T>(operation: () => Promise<T>): Promise<T> {
+  const next = sessionMetadataQueue.catch(() => undefined).then(operation);
+  sessionMetadataQueue = next;
+  return next;
+}
+
+function readSessionMetadataLocked(manager: SessionManager, logger: MetadataLogger): Promise<SessionMetadataMap> {
+  return withSessionMetadataLock(() => readSessionMetadata(manager, logger));
+}
+
 function mutateSessionMetadata<T>(manager: SessionManager, logger: MetadataLogger, mutate: (metadata: SessionMetadataMap) => Promise<T> | T): Promise<T> {
-  const operation = sessionMetadataQueue
-    .catch(() => undefined)
-    .then(async () => {
-      const metadata = await readSessionMetadata(manager, logger);
-      const result = await mutate(metadata);
-      await writeSessionMetadata(manager, metadata);
-      return result;
-    });
-  sessionMetadataQueue = operation;
-  return operation;
+  return withSessionMetadataLock(async () => {
+    const metadata = await readSessionMetadata(manager, logger);
+    const result = await mutate(metadata);
+    await writeSessionMetadata(manager, metadata);
+    return result;
+  });
+}
+
+// True when a path.relative() result points outside the directory it was computed from. All containment checks share this predicate so they agree on every platform separator.
+function escapesRoot(relativePath: string): boolean {
+  return isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + sep);
 }
 
 function sessionPathInDirectory(path: string, manager: SessionManager): boolean {
   const root = resolve(manager.getSessionDir());
   const target = resolve(path);
   const relativePath = relative(root, target);
-  return relativePath !== "" && !isAbsolute(relativePath) && relativePath !== ".." && !relativePath.startsWith(".." + sep) && target.endsWith(".jsonl");
+  return relativePath !== "" && !escapesRoot(relativePath) && target.endsWith(".jsonl");
 }
 
 const webSessionUi = {
@@ -350,6 +369,7 @@ function sanitizeLogValue(value: unknown, state: LogSanitizeState, depth = 0): u
   if (typeof value !== "object") return Object.prototype.toString.call(value);
   if (depth >= loggerPanelDepthLimit) return "[Max Depth]";
   if (state.seen.has(value)) return "[Circular]";
+  // Unmarked once its subtree is done, so an object logged twice as a sibling is rendered twice instead of being mistaken for a cycle.
   state.seen.add(value);
 
   try {
@@ -379,6 +399,8 @@ function sanitizeLogValue(value: unknown, state: LogSanitizeState, depth = 0): u
     return Object.fromEntries(entries);
   } catch {
     return "[Unavailable]";
+  } finally {
+    state.seen.delete(value);
   }
 }
 
@@ -519,39 +541,71 @@ function gitTermination(error: ExecFileException | null): GitTermination | undef
   return undefined;
 }
 
-function gitTerminationMessage(command: string, termination: GitTermination): string {
+function gitTerminationMessage(command: string, termination: GitTermination, timeoutMs = GIT_TIMEOUT_MS): string {
   return termination === "timeout"
-    ? `git ${command} timed out after ${GIT_TIMEOUT_MS / 1000} seconds`
+    ? `git ${command} timed out after ${timeoutMs / 1000} seconds`
     : `git ${command} produced more output than the buffer limit allows`;
 }
 
+interface GitStatusEntry {
+  readonly path: string;
+  readonly status: string;
+}
+
 interface GitStatusResult {
-  readonly output: string;
+  readonly entries: readonly GitStatusEntry[];
   readonly truncated: boolean;
 }
 
-function gitStatus(cwd: string): Promise<GitStatusResult> {
+// `-z` output is NUL-separated and never C-quoted, so non-ASCII names arrive verbatim and a rename carries its original path as the following field instead of an `old -> new` pair. The paths are relative to the repository root regardless of cwd, so they are rebased onto the cwd prefix to keep the contract with /api/files/diff, /api/files/commit and /api/files/revert, which resolve paths against the same cwd.
+function parseGitStatus(output: string, prefix: string): GitStatusEntry[] {
+  const fields = output.split("\0");
+  const entries: GitStatusEntry[] = [];
+  for (let index = 0; index < fields.length; index += 1) {
+    const field = fields[index] ?? "";
+    if (field.length < 4) continue;
+    const code = field.slice(0, 2);
+    const path = field.slice(3);
+    if (code.startsWith("R") || code.startsWith("C")) index += 1;
+    entries.push({ path: prefix === "" ? path : posix.relative("/" + prefix, "/" + path), status: code.trim() || "??" });
+  }
+  return entries;
+}
+
+function gitStatusOutput(cwd: string): Promise<{ output: string; truncated: boolean }> {
   return new Promise((resolveStatus, rejectStatus) => {
-    execFile("git", ["status", "--short", "--untracked-files=all"], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 }, (error, stdout, stderr) => {
-      if (error === null) {
-        resolveStatus({ output: stdout, truncated: false });
-        return;
-      }
-      const termination = gitTermination(error);
-      if (termination === "output-limit") {
-        // Keep the complete lines that arrived before the kill; the final line may have been cut mid-path.
-        resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\n") + 1), truncated: true });
-        return;
-      }
-      if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
-        resolveStatus({ output: "", truncated: false });
-        return;
-      }
-      rejectStatus(new Error(termination ? gitTerminationMessage("status", termination) : stderr.trim() || error.message, { cause: error }));
-    });
+    execFile(
+      "git",
+      ["status", "--porcelain", "-z", "--untracked-files=all"],
+      { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 512 * 1024 },
+      (error, stdout, stderr) => {
+        if (error === null) {
+          resolveStatus({ output: stdout, truncated: false });
+          return;
+        }
+        const termination = gitTermination(error);
+        if (termination === "output-limit") {
+          // Keep the complete entries that arrived before the kill; the final entry may have been cut mid-path.
+          resolveStatus({ output: stdout.slice(0, stdout.lastIndexOf("\0") + 1), truncated: true });
+          return;
+        }
+        if (termination === undefined && error.code === 128 && /not a git repository/i.test(stderr)) {
+          resolveStatus({ output: "", truncated: false });
+          return;
+        }
+        rejectStatus(new Error(termination ? gitTerminationMessage("status", termination) : stderr.trim() || error.message, { cause: error }));
+      },
+    );
   });
 }
 
+async function gitStatus(cwd: string): Promise<GitStatusResult> {
+  const { output, truncated } = await gitStatusOutput(cwd);
+  if (output === "") return { entries: [], truncated };
+  const prefix = await gitCommand(cwd, ["rev-parse", "--show-prefix"]);
+  return { entries: parseGitStatus(output, prefix.code === 0 ? prefix.stdout.trim() : ""), truncated };
+}
+
 function gitDiff(cwd: string, path: string): Promise<string> {
   return new Promise((resolveOutput) => {
     execFile("git", ["diff", "--no-ext-diff", "--", path], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 1024 * 1024 }, (error, stdout) =>
@@ -567,9 +621,9 @@ interface GitCommandResult {
   readonly terminated: GitTermination | undefined;
 }
 
-function gitCommand(cwd: string, args: readonly string[]): Promise<GitCommandResult> {
+function gitCommand(cwd: string, args: readonly string[], timeoutMs = GIT_TIMEOUT_MS): Promise<GitCommandResult> {
   return new Promise((resolveResult) => {
-    execFile("git", [...args], { cwd, timeout: GIT_TIMEOUT_MS, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
+    execFile("git", [...args], { cwd, timeout: timeoutMs, maxBuffer: 2 * 1024 * 1024 }, (error, stdout, stderr) => {
       const code = error && typeof error.code === "number" ? error.code : error ? 1 : 0;
       resolveResult({ stdout, stderr, code, terminated: gitTermination(error) });
     });
@@ -610,6 +664,26 @@ async function isDirectory(path: string): Promise<boolean> {
   }
 }
 
+async function isFile(path: string): Promise<boolean> {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+}
+
+// The loader resolves a bare plugin specifier from the profile file upwards (`createRequire(profilePath).resolve(name)`), never from the shell the harness was started in, so a marketplace package has to land in the package that owns the profile or it installs successfully and then fails to load.
+async function marketplaceInstallDirectory(configPath: string, fallback: string): Promise<string> {
+  let directory = dirname(resolve(configPath));
+  let parent = dirname(directory);
+  while (parent !== directory) {
+    if (await isFile(join(directory, "package.json"))) return directory;
+    directory = parent;
+    parent = dirname(directory);
+  }
+  return fallback;
+}
+
 function pickDirectory(): Promise<string> {
   return new Promise((resolvePath, reject) => {
     execFile(
@@ -637,7 +711,7 @@ function workspacePaths(root: string, paths: unknown): string[] | Error {
     const requested = path as string;
     const absolute = resolve(root, requested);
     const relativePath = relative(root, absolute);
-    if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith("../")) return new Error("path must stay inside the workspace");
+    if (escapesRoot(relativePath)) return new Error("path must stay inside the workspace");
     normalized.push(relativePath);
   }
   return [...new Set(normalized)];
@@ -790,8 +864,8 @@ export default {
             sendJson(response, 400, { error: "settings source must contain a JSON object" });
             return;
           }
-          const path = join(services.launch.agentDir, "settings.json");
-          // Replace the file atomically so an interrupted write never leaves a truncated settings.json behind; keep the existing permission bits.
+          // Replace the file atomically so an interrupted write never leaves a truncated settings.json behind; keep the existing permission bits. The rename must land on the resolved target, otherwise a symlinked settings.json (dotfiles repositories) would be replaced by a detached regular file.
+          const path = await realpath(join(services.launch.agentDir, "settings.json")).catch(() => join(services.launch.agentDir, "settings.json"));
           const mode = await stat(path).then(
             (info) => info.mode & 0o777,
             () => 0o644,
@@ -1073,15 +1147,17 @@ export default {
             sendJson(response, 409, { error: "Plugin is already installed", plugin });
             return;
           }
-          const packageJsonPath = join(services.launch.cwd, "package.json");
-          const packageLockPath = join(services.launch.cwd, "package-lock.json");
+          const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+          const packageJsonPath = join(installDirectory, "package.json");
+          const packageLockPath = join(installDirectory, "package-lock.json");
           const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
           const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
           let profileBefore: string | undefined;
           let entryId: string | undefined;
           try {
             if (needsMarketplacePackageInstall(plugin)) {
-              await runProcess("npm", ["install", "--save-exact", "--package-lock=false", `${plugin.packageName}@${plugin.version}`], services.launch.cwd);
+              const specifier = `${marketplaceNpmPackageName(plugin.packageName)}@${plugin.version}`;
+              await runProcess("npm", ["install", "--save-exact", "--package-lock=false", specifier], installDirectory);
             }
             profileBefore = await appendMarketplaceProfile(configPath, plugin);
             if (!needsMarketplacePackageInstall(plugin)) {
@@ -1101,8 +1177,11 @@ export default {
           } catch (error) {
             if (entryId !== undefined) await loader.remove(entryId).catch(() => {});
             if (profileBefore !== undefined) await writeFile(configPath, profileBefore, "utf8").catch(() => {});
-            if (packageJsonBefore !== undefined) await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => {});
-            if (packageLockBefore !== undefined) await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => {});
+            // A manifest npm created for this install is removed rather than left behind; restoring is only possible when one existed before.
+            if (packageJsonBefore === undefined) await unlink(packageJsonPath).catch(() => {});
+            else await writeFile(packageJsonPath, packageJsonBefore, "utf8").catch(() => {});
+            if (packageLockBefore === undefined) await unlink(packageLockPath).catch(() => {});
+            else await writeFile(packageLockPath, packageLockBefore, "utf8").catch(() => {});
             sendJson(response, 502, { error: errorText(error) });
           }
         } catch (error) {
@@ -1198,15 +1277,17 @@ export default {
           }
           const profileEntryId = entry.options.id;
           const profileBefore = await readFile(configPath, "utf8");
-          const packageJsonPath = join(services.launch.cwd, "package.json");
-          const packageLockPath = join(services.launch.cwd, "package-lock.json");
+          const installDirectory = await marketplaceInstallDirectory(configPath, services.launch.cwd);
+          const packageJsonPath = join(installDirectory, "package.json");
+          const packageLockPath = join(installDirectory, "package-lock.json");
           const packageJsonBefore = await readFile(packageJsonPath, "utf8").catch(() => undefined);
           const packageLockBefore = await readFile(packageLockPath, "utf8").catch(() => undefined);
           await entry.parent.remove(entry.options.id);
           entry.parent.tree.write();
           try {
             await updateMarketplaceProfile(configPath, profileEntryId, { remove: true });
-            if (needsMarketplacePackageInstall(plugin)) await runProcess("npm", ["uninstall", "--package-lock=false", plugin.packageName], services.launch.cwd);
+            if (needsMarketplacePackageInstall(plugin))
+              await runProcess("npm", ["uninstall", "--package-lock=false", marketplaceNpmPackageName(plugin.packageName)], installDirectory);
             sendJson(response, 200, { uninstalled: true, id: payload.id });
           } catch (error) {
             await writeFile(configPath, profileBefore, "utf8").catch(() => {});
@@ -1309,18 +1390,11 @@ export default {
           sendJson(response, 500, { error: errorText(error) });
           return;
         }
-        const items = status.output
-          .split("\n")
-          .map((line) => line.trimEnd())
-          .filter((line) => line.length > 0)
-          .map((line) => {
-            const status = line.slice(0, 2).trim() || "??";
-            return {
-              path: line.slice(3),
-              status,
-              label: status === "??" ? "untracked" : status.includes("D") ? "deleted" : status.includes("A") ? "added" : "modified",
-            };
-          });
+        const items = status.entries.map((entry) => ({
+          path: entry.path,
+          status: entry.status,
+          label: entry.status === "??" ? "untracked" : entry.status.includes("D") ? "deleted" : entry.status.includes("A") ? "added" : "modified",
+        }));
         sendJson(response, 200, { items, ...(status.truncated ? { truncated: true } : {}) });
       },
     });
@@ -1340,7 +1414,7 @@ export default {
         const root = resolve(activeCwd(services));
         const absolute = resolve(root, requested);
         const relativePath = relative(root, absolute);
-        if (isAbsolute(relativePath) || relativePath === ".." || relativePath.startsWith(".." + sep)) {
+        if (escapesRoot(relativePath)) {
           sendJson(response, 400, { error: "path must stay inside the workspace" });
           return;
         }
@@ -1366,18 +1440,18 @@ export default {
             return;
           }
           const root = resolve(activeCwd(services));
-          const add = await gitCommand(root, ["add", "-A", "--", ...paths]);
+          const add = await gitCommand(root, ["add", "-A", "--", ...paths], GIT_MUTATION_TIMEOUT_MS);
           if (add.terminated) {
-            sendJson(response, 500, { error: gitTerminationMessage("add", add.terminated) });
+            sendJson(response, 500, { error: gitTerminationMessage("add", add.terminated, GIT_MUTATION_TIMEOUT_MS) });
             return;
           }
           if (add.code !== 0) {
             sendJson(response, 409, { error: add.stderr.trim() || "Unable to stage workspace files" });
             return;
           }
-          const commit = await gitCommand(root, ["commit", "-m", payload.message.trim(), "--", ...paths]);
+          const commit = await gitCommand(root, ["commit", "-m", payload.message.trim(), "--", ...paths], GIT_MUTATION_TIMEOUT_MS);
           if (commit.terminated) {
-            sendJson(response, 500, { error: gitTerminationMessage("commit", commit.terminated) });
+            sendJson(response, 500, { error: gitTerminationMessage("commit", commit.terminated, GIT_MUTATION_TIMEOUT_MS) });
             return;
           }
           if (commit.code !== 0) {
@@ -1429,9 +1503,9 @@ export default {
             return;
           }
           if (trackedPaths.length > 0) {
-            const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...trackedPaths]);
+            const restore = await gitCommand(root, ["restore", "--worktree", "--staged", "--", ...trackedPaths], GIT_MUTATION_TIMEOUT_MS);
             if (restore.terminated) {
-              sendJson(response, 500, { error: gitTerminationMessage("restore", restore.terminated) });
+              sendJson(response, 500, { error: gitTerminationMessage("restore", restore.terminated, GIT_MUTATION_TIMEOUT_MS) });
               return;
             }
             if (restore.code !== 0) {
@@ -1803,20 +1877,44 @@ export default {
             sendJson(response, 409, { error: "Cannot batch-delete the active session" });
             return;
           }
-          await mutateSessionMetadata(manager, context.logger, async (metadata) => {
+          if (action === "delete") {
+            // The unlinks run outside the metadata mutation: a failure halfway through must not discard the key removals for the files that are already gone from disk.
+            const removed: string[] = [];
+            const failed: { path: string; error: string }[] = [];
             for (const path of paths) {
-              if (action === "delete") {
+              try {
                 await unlink(path);
-                delete metadata[path];
-              } else {
-                const current = metadata[path] ?? {};
-                metadata[path] = {
-                  ...current,
-                  ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
-                  ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
-                };
+                removed.push(path);
+              } catch (error) {
+                // A session another tab already deleted leaves nothing to unlink, but its metadata entry still has to go.
+                if ((error as NodeJS.ErrnoException).code === "ENOENT") removed.push(path);
+                else failed.push({ path, error: errorText(error) });
               }
             }
+            await mutateSessionMetadata(manager, context.logger, (metadata) => {
+              for (const path of removed) delete metadata[path];
+            });
+            if (failed.length > 0) {
+              sendJson(response, 409, {
+                error: `Some sessions could not be deleted: ${failed.map((item) => item.path).join(", ")}`,
+                action,
+                count: removed.length,
+                failed,
+              });
+              return;
+            }
+            sendJson(response, 200, { action, count: removed.length });
+            return;
+          }
+          await mutateSessionMetadata(manager, context.logger, (metadata) => {
+            for (const path of paths) {
+              const current = metadata[path] ?? {};
+              metadata[path] = {
+                ...current,
+                ...(action === "archive" || action === "unarchive" ? { archived: action === "archive" } : {}),
+                ...(action === "pin" || action === "unpin" ? { pinned: action === "pin" } : {}),
+              };
+            }
           });
           sendJson(response, 200, { action, count: paths.length });
         } catch (error) {
@@ -1955,7 +2053,7 @@ export default {
           const page = Math.max(0, Number.parseInt(url.searchParams.get("page") ?? "0", 10) || 0);
           const pageSize = Math.min(100, Math.max(1, Number.parseInt(url.searchParams.get("pageSize") ?? "50", 10) || 50));
           const includeArchived = url.searchParams.get("includeArchived") === "true";
-          const metadata = await readSessionMetadata(manager, context.logger);
+          const metadata = await readSessionMetadataLocked(manager, context.logger);
           const items =
             typeof manager.isPersisted === "function" && manager.isPersisted() ? await SessionManager.list(services.launch.cwd, manager.getSessionDir()) : [];
           const filtered = items.filter((item) => includeArchived || metadata[item.path]?.archived !== true);

package/packages/api-gateway/src/marketplace-entries/official/agent-teams.json

@@ -1,7 +1,7 @@
 {
   "id": "agent-teams",
   "packageName": "@pi-harness/core/plugins/agent-teams",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Agent Team Board",
   "description": "Maintain a bounded, session-local collaboration ledger of named roles, dependency-aware tasks, and mailbox notes without spawning agents or sending external messages.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/anchored-standard.json

@@ -1,7 +1,7 @@
 {
   "id": "anchored-standard",
   "packageName": "@pi-harness/core/plugins/anchored-standard",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Anchored Standard",
   "description": "Audit agent trajectories against an explicit tool-call allowlist and flag activity outside the anchored run.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/annotation.json

@@ -1,7 +1,7 @@
 {
   "id": "annotation",
   "packageName": "@pi-harness/core/plugins/annotation",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Annotations",
   "description": "Capture bounded selections and notes from the conversation for later agent context.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/archify.json

@@ -1,7 +1,7 @@
 {
   "id": "archify",
   "packageName": "@pi-harness/core/plugins/archify",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Architecture Map",
   "description": "Build a bounded, read-only architecture map from workspace components and package dependencies.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/at-file.json

@@ -1,7 +1,7 @@
 {
   "id": "at-file",
   "packageName": "@pi-harness/core/plugins/at-file",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "@file Context",
   "description": "Attach a bounded 256 KiB strict UTF-8 workspace file using canonical workspace path confinement and no-follow regular-file reads, framing it as offline, read-only, untrusted model context with closing-tag neutralization and cancellable sequential execution.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/auto-mode.json

@@ -1,7 +1,7 @@
 {
   "id": "auto-mode",
   "packageName": "@pi-harness/core/plugins/auto-mode",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Auto Mode",
   "description": "Execute argv commands under a safe policy that blocks shell wrappers and requires confirmation for risky operations.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/better-sidebar.json

@@ -1,7 +1,7 @@
 {
   "id": "better-sidebar",
   "packageName": "@pi-harness/core/plugins/better-sidebar",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Better Sidebar",
   "description": "Show a compact workspace, Git, and session overview beside the conversation without modifying files.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/browser-fetch.json

@@ -1,7 +1,7 @@
 {
   "id": "browser-fetch",
   "packageName": "@pi-harness/core/plugins/browser-fetch",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Browser Fetch",
   "description": "Fetch public HTTP and HTTPS pages as bounded text with descriptor-safe inputs, DNS pinning, per-redirect private-network validation, textual MIME enforcement, cancellation, a whole-request timeout, and validated fail-closed panel reporting.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/browser-session.json

@@ -1,7 +1,7 @@
 {
   "id": "browser-session",
   "packageName": "@pi-harness/core/plugins/browser-session",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Browser Session",
   "description": "Control a loopback-only Chrome DevTools session with descriptor-safe commands, bounded discovery, cancellable operations, screenshot metadata protection, and validated fail-closed panel previews.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/canvas-draw.json

@@ -1,7 +1,7 @@
 {
   "id": "canvas-draw",
   "packageName": "@pi-harness/core/plugins/canvas-draw",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Canvas Draw",
   "description": "Generate validated, bounded Mermaid flowchart source from structured nodes and edges in the workspace UI.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/change-verifier.json

@@ -1,7 +1,7 @@
 {
   "id": "change-verifier",
   "packageName": "@pi-harness/core/plugins/change-verifier",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Change Verifier",
   "description": "Combine project tests and Git change review into one explicit verification gate before handoff.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/cleaner.json

@@ -1,7 +1,7 @@
 {
   "id": "cleaner",
   "packageName": "@pi-harness/core/plugins/cleaner",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Cleaner",
   "description": "Strict descriptor-safe configuration and parameters, display-safe bounded Pi Harness Git capsule inventory, removal with explicit confirmation and retention controls, symlink and replacement defenses, cancellable serialization, and a fail-closed normalized panel.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/cli-notifier.json

@@ -1,7 +1,7 @@
 {
   "id": "cli-notifier",
   "packageName": "@pi-harness/core/plugins/cli-notifier",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "CLI Notifier",
   "description": "Send local desktop notifications when an agent turn completes, fails, or is aborted, and when context compaction fails.",
   "author": "Pi Harness",

package/packages/api-gateway/src/marketplace-entries/official/code2skill.json

@@ -1,7 +1,7 @@
 {
   "id": "code2skill",
   "packageName": "@pi-harness/core/plugins/code2skill",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "name": "Code2Skill",
   "description": "Package selected workspace source files into a bounded local Pi skill with a generated SKILL.md manifest and preserved references.",
   "author": "Pi Harness",