@raingor/pi-web-switch 0.4.0 → 0.4.2

package/server/pi-reader.ts

@@ -1,10 +1,24 @@
-import { readFileSync, readdirSync, existsSync, statSync, unlinkSync, writeFileSync, mkdirSync, renameSync } from "fs";
-import { homedir } from "os";
+import { readFileSync, readdirSync, existsSync, statSync, unlinkSync, writeFileSync, mkdirSync, renameSync, realpathSync } from "fs";
+import { homedir, platform } from "os";
 import { join, resolve, dirname, relative, sep } from "path";
 import { spawnSync } from "child_process";
+import { DatabaseSync } from "node:sqlite";
 
 const PI_DIR = join(homedir(), ".pi", "agent");
 
+// ─── Cindy Pi-Agent Sessions ───────────────────────────
+// When Cindy (the AI assistant) delegates to a pi coding agent, sessions
+// are stored under its own data directory instead of ~/.pi/agent/sessions.
+
+function getCindySessionsDir(): string {
+  const home = homedir();
+  if (platform() === "darwin") {
+    return join(home, "Library", "Application Support", "Cindy", "pi-agent-home", "sessions");
+  }
+  // Linux / Windows fallback
+  return join(home, ".config", "cindy", "pi-agent-home", "sessions");
+}
+
 // ─── Config File Paths ───────────────────────────────────
 
 function piPath(filename: string): string {
@@ -111,6 +125,70 @@ function getSessionDirs(): string[] {
     .filter((dir) => statSync(dir).isDirectory());
 }
 
+/**
+ * Recursively walk a project directory to find all session JSONL files.
+ *
+ * Supports both the legacy flat layout and the current nested layout:
+ *   Legacy:  --project--/session.jsonl  (any .jsonl file at the project root)
+ *   Current: --project--/{sessionId}/{hash}/run-0/session.jsonl
+ */
+function walkSessionJsonl(dir: string, out: string[]): void {
+  let entries: string[];
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    const p = join(dir, name);
+    try {
+      const stat = statSync(p);
+      if (stat.isDirectory()) {
+        walkSessionJsonl(p, out);
+      } else if (name.endsWith(".jsonl")) {
+        out.push(p);
+      }
+    } catch {
+      // skip unreadable entries
+    }
+  }
+}
+
+/**
+ * Return every session JSONL file across all project directories, handling
+ * both the legacy flat layout and the current nested run-0 layout.
+ */
+function getAllSessionFiles(): string[] {
+  const files: string[] = [];
+  for (const dir of getSessionDirs()) {
+    walkSessionJsonl(dir, files);
+  }
+  return files;
+}
+
+// Usage stats are bucketed in China time (UTC+8) regardless of the machine's
+// system timezone, so daily totals stay consistent for a Beijing-based user.
+const CN_TZ = "Asia/Shanghai";
+
+function cnDateParts(ts: string | number): { date: string; hour: number } {
+  const d = new Date(ts);
+  if (isNaN(d.getTime())) return { date: "unknown", hour: 0 };
+  const date = new Intl.DateTimeFormat("en-CA", {
+    timeZone: CN_TZ,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+  }).format(d); // "2026-08-06"
+  const hour = Number(
+    new Intl.DateTimeFormat("en-US", {
+      timeZone: CN_TZ,
+      hour: "2-digit",
+      hour12: false,
+    }).format(d)
+  );
+  return { date, hour: hour === 24 ? 0 : hour };
+}
+
 function parseSessionFile(filePath: string): UsageRecord[] {
   const records: UsageRecord[] = [];
   try {
@@ -136,9 +214,7 @@ function parseSessionFile(filePath: string): UsageRecord[] {
           if (!usage || !usage.input) continue;
 
           const timestamp = obj.timestamp || obj.message.timestamp;
-          const d = new Date(timestamp);
-          const date = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
-          const hour = d.getHours();
+          const { date, hour } = cnDateParts(timestamp);
 
           records.push({
             date,
@@ -163,20 +239,142 @@ function parseSessionFile(filePath: string): UsageRecord[] {
   return records;
 }
 
+// Scanned session usage is cached briefly: the same 150MB+ of JSONL gets
+// re-read on every dashboard request otherwise, which stalls the page.
+const USAGE_CACHE_TTL_MS = 30_000;
+let usageCache: { records: UsageRecord[]; at: number } | null = null;
+
+/** Drop cached session usage — called when the UI requests a forced refresh. */
+export function clearUsageCache(): void {
+  usageCache = null;
+}
+
 export function readAllUsage(): UsageRecord[] {
+  if (usageCache && Date.now() - usageCache.at < USAGE_CACHE_TTL_MS) {
+    return usageCache.records;
+  }
   const allRecords: UsageRecord[] = [];
-  const dirs = getSessionDirs();
+  const files = getAllSessionFiles();
 
-  for (const dir of dirs) {
+  for (const filePath of files) {
+    const records = parseSessionFile(filePath);
+    allRecords.push(...records);
+  }
+
+  allRecords.sort((a, b) => a.date.localeCompare(b.date));
+  usageCache = { records: allRecords, at: Date.now() };
+  return allRecords;
+}
+
+// ─── Cindy Pi-Agent Usage ──────────────────────────────
+
+/**
+ * Read usage records from Cindy's pi-agent sessions.
+ * Cindy stores pi-agent sessions in its own data directory
+ * (~/Library/Application Support/Cindy/pi-agent-home/sessions/)
+ * rather than ~/.pi/agent/sessions/. The JSONL format is identical,
+ * so we reuse the same parseSessionFile() function.
+ */
+export function readCindyUsage(): UsageRecord[] {
+  const allRecords: UsageRecord[] = [];
+  const cindyDir = getCindySessionsDir();
+
+  if (!existsSync(cindyDir)) return allRecords;
+
+  try {
+    // Cindy's sessions are flat (no subdirectory per project)
+    const files = readdirSync(cindyDir).filter((f) => f.endsWith(".jsonl"));
+    for (const file of files) {
+      const filePath = join(cindyDir, file);
+      if (!statSync(filePath).isFile()) continue;
+      const records = parseSessionFile(filePath);
+      allRecords.push(...records);
+    }
+  } catch {
+    // skip unreadable directory
+  }
+
+  // Sort by date ascending
+  allRecords.sort((a, b) => a.date.localeCompare(b.date));
+  return allRecords;
+}
+
+// ─── Claude Usage (from Cindy SQLite) ──────────────────
+
+/**
+ * Find all Cindy SQLite database files that may contain usage data.
+ * Cindy stores session/usage data in cindy-cms*.db files under its
+ * application support directory.
+ */
+function getCindyDbPaths(): string[] {
+  const home = homedir();
+  let cindyAppDir: string;
+  if (platform() === "darwin") {
+    cindyAppDir = join(home, "Library", "Application Support", "Cindy");
+  } else if (platform() === "win32") {
+    cindyAppDir = join(process.env.APPDATA ?? join(home, "AppData", "Roaming"), "Cindy");
+  } else {
+    cindyAppDir = join(home, ".config", "Cindy");
+  }
+
+  if (!existsSync(cindyAppDir)) return [];
+
+  try {
+    return readdirSync(cindyAppDir)
+      .filter((f) => f.startsWith("cindy-cms") && f.endsWith(".db"))
+      .map((f) => join(cindyAppDir, f));
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Read Claude usage records from Cindy's daily_model_usage table.
+ * Cindy tracks every agent_kind (claude-code, pi, codex) in the same
+ * table; we filter to agent_kind = 'claude-code' for Claude stats.
+ */
+export function readClaudeUsage(): UsageRecord[] {
+  const allRecords: UsageRecord[] = [];
+  const dbPaths = getCindyDbPaths();
+  if (dbPaths.length === 0) return allRecords;
+
+  for (const dbPath of dbPaths) {
     try {
-      const files = readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
-      for (const file of files) {
-        const filePath = join(dir, file);
-        const records = parseSessionFile(filePath);
-        allRecords.push(...records);
+      const query = "SELECT day, model, cost_usd, input_tokens, output_tokens, cache_read_tokens, cache_create_tokens FROM daily_model_usage WHERE agent_kind = 'claude-code' ORDER BY day";
+      const result = spawnSync("sqlite3", [dbPath, "-json", query], {
+        encoding: "utf8",
+        timeout: 10000,
+      });
+
+      if (result.status !== 0) continue;
+      const output = result.stdout?.trim();
+      if (!output) continue;
+
+      const rows = JSON.parse(output) as Array<{
+        day: string;
+        model: string;
+        cost_usd: number;
+        input_tokens: number;
+        output_tokens: number;
+        cache_read_tokens: number;
+        cache_create_tokens: number;
+      }>;
+
+      for (const row of rows) {
+        allRecords.push({
+          date: row.day,
+          providerId: "claude",
+          modelId: row.model,
+          inputTokens: row.input_tokens ?? 0,
+          outputTokens: row.output_tokens ?? 0,
+          cacheReadTokens: row.cache_read_tokens ?? 0,
+          cacheWriteTokens: row.cache_create_tokens ?? 0,
+          requests: 1,
+          cost: row.cost_usd ?? 0,
+        });
       }
     } catch {
-      // skip unreadable directories
+      // skip this db
     }
   }
 
@@ -185,6 +383,327 @@ export function readAllUsage(): UsageRecord[] {
   return allRecords;
 }
 
+/**
+ * Read Codex usage records from Cindy's daily_model_usage table.
+ * Filters to agent_kind = 'codex'.
+ */
+export function readCodexUsage(): UsageRecord[] {
+  const allRecords: UsageRecord[] = [];
+  const dbPaths = getCindyDbPaths();
+  if (dbPaths.length === 0) return allRecords;
+
+  for (const dbPath of dbPaths) {
+    try {
+      const query = "SELECT day, model, cost_usd, input_tokens, output_tokens, cache_read_tokens, cache_create_tokens FROM daily_model_usage WHERE agent_kind = 'codex' ORDER BY day";
+      const result = spawnSync("sqlite3", [dbPath, "-json", query], {
+        encoding: "utf8",
+        timeout: 10000,
+      });
+
+      if (result.status !== 0) continue;
+      const output = result.stdout?.trim();
+      if (!output) continue;
+
+      const rows = JSON.parse(output) as Array<{
+        day: string;
+        model: string;
+        cost_usd: number;
+        input_tokens: number;
+        output_tokens: number;
+        cache_read_tokens: number;
+        cache_create_tokens: number;
+      }>;
+
+      for (const row of rows) {
+        allRecords.push({
+          date: row.day,
+          providerId: "codex",
+          modelId: row.model,
+          inputTokens: row.input_tokens ?? 0,
+          outputTokens: row.output_tokens ?? 0,
+          cacheReadTokens: row.cache_read_tokens ?? 0,
+          cacheWriteTokens: row.cache_create_tokens ?? 0,
+          requests: 1,
+          cost: row.cost_usd ?? 0,
+        });
+      }
+    } catch {
+      // skip this db
+    }
+  }
+
+  allRecords.sort((a, b) => a.date.localeCompare(b.date));
+  return allRecords;
+}
+
+// ─── Combined All Sources ──────────────────────────────
+
+/**
+ * Combine usage from all sources: local pi, Cindy pi-agent, Claude, Codex.
+ * Used for the "All" tab that shows everything in one view.
+ */
+export function readAllCombinedUsage(): UsageRecord[] {
+  const all: UsageRecord[] = [
+    ...readAllUsage(),
+    ...readCindyUsage(),
+    ...readClaudeUsage(),
+    ...readCodexUsage(),
+    ...readAtomcodeUsage(),
+    ...readCopilotUsage(),
+  ];
+  all.sort((a, b) => a.date.localeCompare(b.date));
+  return all;
+}
+
+// ─── AtomCode Usage ────────────────────────────────────
+
+const ATOMCODE_DIR = join(homedir(), ".atomcode");
+
+/**
+ * Read usage records from AtomCode sessions under ~/.atomcode/sessions.
+ * Each JSONL line carries an optional usage object:
+ *   { prompt, completion, cached } — mapped to input/output/cacheRead.
+ * Model id is sniffed from the snapshot system prompt (e.g.
+ * "running the deepseek-v4-flash model"), defaulting to "atomcode".
+ */
+export function readAtomcodeUsage(): UsageRecord[] {
+  const allRecords: UsageRecord[] = [];
+  const sessionsDir = join(ATOMCODE_DIR, "sessions");
+  if (!existsSync(sessionsDir)) return allRecords;
+
+  let sessionDirs: string[] = [];
+  try {
+    sessionDirs = readdirSync(sessionsDir)
+      .map((name) => join(sessionsDir, name))
+      .filter((dir) => statSync(dir).isDirectory());
+  } catch {
+    return allRecords;
+  }
+
+  for (const dir of sessionDirs) {
+    const files = readdirSync(dir).filter((f) => f.endsWith(".jsonl"));
+    for (const file of files) {
+      const filePath = join(dir, file);
+      try {
+        const raw = readFileSync(filePath, "utf-8");
+        const model = sniffAtomcodeModel(join(dir, file.replace(/\.jsonl$/, ".snapshot")));
+        for (const line of raw.split("\n").filter((l) => l.trim())) {
+          try {
+            const obj = JSON.parse(line);
+            const usage = obj.usage;
+            if (!usage || typeof usage.prompt !== "number") continue;
+            const { date, hour } = cnDateParts(obj.iso ?? obj.ts ?? "");
+            allRecords.push({
+              date,
+              hour,
+              providerId: "atomcode",
+              modelId: model,
+              inputTokens: usage.prompt ?? 0,
+              outputTokens: usage.completion ?? 0,
+              cacheReadTokens: usage.cached ?? 0,
+              cacheWriteTokens: 0,
+              requests: 1,
+              cost: 0,
+            });
+          } catch {
+            // skip malformed lines
+          }
+        }
+      } catch {
+        // skip unreadable files
+      }
+    }
+  }
+
+  allRecords.sort((a, b) => a.date.localeCompare(b.date));
+  return allRecords;
+}
+
+/** Extract the model name from an AtomCode snapshot system prompt. */
+function sniffAtomcodeModel(snapshotPath: string): string {
+  try {
+    if (!existsSync(snapshotPath)) return "atomcode";
+    const txt = readFileSync(snapshotPath, "utf-8");
+    const m = txt.match(/running the ([\w.-]+) model/i);
+    return m?.[1] ?? "atomcode";
+  } catch {
+    return "atomcode";
+  }
+}
+
+// ─── Copilot Usage (Local session-store.db) ────────────
+//
+// The Copilot CLI records every assistant turn's token usage in a local
+// SQLite database (~/.copilot/session-store.db, table
+// assistant_usage_events). We read it directly — no GitHub Billing REST
+// API or PAT required, and it works even when the account isn't on the
+// enhanced billing platform.
+
+const COPILOT_CONFIG_PATH = join(PI_DIR, "copilot.json");
+
+interface CopilotConfig {
+  username?: string;
+  token?: string;
+}
+
+export function readCopilotConfig(): CopilotConfig {
+  try {
+    if (!existsSync(COPILOT_CONFIG_PATH)) return {};
+    const raw = readFileSync(COPILOT_CONFIG_PATH, "utf-8");
+    const parsed = JSON.parse(raw) as CopilotConfig;
+    return {
+      username: typeof parsed.username === "string" ? parsed.username : undefined,
+      token: typeof parsed.token === "string" ? parsed.token : undefined,
+    };
+  } catch {
+    return {};
+  }
+}
+
+export function writeCopilotConfig(cfg: CopilotConfig): boolean {
+  try {
+    const clean: CopilotConfig = {
+      username: cfg.username?.trim() || undefined,
+      token: cfg.token?.trim() || undefined,
+    };
+    writeFileSync(COPILOT_CONFIG_PATH, JSON.stringify(clean, null, 2), "utf-8");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const COPILOT_STORE_PATH = join(homedir(), ".copilot", "session-store.db");
+
+function copilotNum(v: unknown): number {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+
+/**
+ * Read all usage events from the local Copilot session-store.db and map them
+ * to UsageRecords bucketed in China time (UTC+8) like every other source.
+ * Each event = one assistant turn → one request. Local DB has no cost info,
+ * so cost is always 0 (token counts are still fully populated).
+ */
+function readCopilotStore(): UsageRecord[] {
+  const records: UsageRecord[] = [];
+  let db: DatabaseSync | null = null;
+  try {
+    db = new DatabaseSync(COPILOT_STORE_PATH, { readOnly: true });
+    const rows = db
+      .prepare(
+        `SELECT model, input_tokens, output_tokens, cache_read_tokens,
+                cache_write_tokens, created_at
+         FROM assistant_usage_events`
+      )
+      .all() as Array<Record<string, unknown>>;
+
+    for (const row of rows) {
+      const ts = row.created_at;
+      if (typeof ts !== "string" || !ts) continue;
+      const { date, hour } = cnDateParts(ts);
+      records.push({
+        date,
+        hour,
+        providerId: "copilot",
+        modelId: typeof row.model === "string" && row.model ? row.model : "copilot",
+        inputTokens: copilotNum(row.input_tokens),
+        outputTokens: copilotNum(row.output_tokens),
+        cacheReadTokens: copilotNum(row.cache_read_tokens),
+        cacheWriteTokens: copilotNum(row.cache_write_tokens),
+        requests: 1,
+        cost: 0,
+      });
+    }
+  } catch {
+    // DB missing, locked by a running Copilot CLI, or node:sqlite not
+    // available — report zero usage instead of failing the dashboard.
+  } finally {
+    try {
+      db?.close();
+    } catch {
+      /* ignore */
+    }
+  }
+
+  records.sort((a, b) => a.date.localeCompare(b.date));
+  return records;
+}
+
+// Brief cache so the dashboard's auto-refresh doesn't re-open the SQLite DB
+// on every request. Reads are cheap (~700 rows), so a short TTL is fine.
+const COPILOT_USAGE_TTL_MS = 30_000;
+let copilotUsageCache: { records: UsageRecord[]; at: number } | null = null;
+
+/**
+ * Synchronous accessor used by the combined view and the Copilot tab.
+ * Returns the latest local Copilot records, re-reading the DB when stale.
+ */
+export function readCopilotUsage(): UsageRecord[] {
+  if (copilotUsageCache && Date.now() - copilotUsageCache.at < COPILOT_USAGE_TTL_MS) {
+    return copilotUsageCache.records;
+  }
+  const records = readCopilotStore();
+  copilotUsageCache = { records, at: Date.now() };
+  return records;
+}
+
+/** Drop cached Copilot data — called after config changes so usage refetches. */
+export function clearCopilotCaches(): void {
+  copilotUsageCache = null;
+}
+
+// ─── Provider-Based Filtering ──────────────────────────
+
+/**
+ * Provider filter patterns. Each provider has a list of regex patterns
+ * that match against providerId and modelId to classify records.
+ */
+export interface ProviderFilter {
+  id: string;
+  label: string;
+  patterns: RegExp[];
+}
+
+export const PROVIDER_FILTERS: ProviderFilter[] = [
+  {
+    id: "copilot",
+    label: "Copilot",
+    patterns: [/^copilot$/i],
+  },
+  {
+    id: "atomcode",
+    label: "AtomCode",
+    patterns: [/^atomcode$/i],
+  },
+  {
+    id: "opencode",
+    label: "OpenCode",
+    patterns: [/^opencode$/, /^opencode-go$/i],
+  },
+  {
+    id: "gemini",
+    label: "Gemini",
+    patterns: [/^google$/, /gemini/i],
+  },
+  {
+    id: "grok",
+    label: "Grok",
+    patterns: [/^xai$/, /grok/i],
+  },
+];
+
+/**
+ * Filter usage records by provider. Matches against both providerId and modelId.
+ */
+export function filterByProvider(records: UsageRecord[], providerId: string): UsageRecord[] {
+  const filter = PROVIDER_FILTERS.find((f) => f.id === providerId);
+  if (!filter) return records;
+  return records.filter((r) =>
+    filter.patterns.some((p) => p.test(r.providerId) || p.test(r.modelId))
+  );
+}
+
 // ─── Aggregation Helpers ────────────────────────────────
 
 export function getDailyAggregates(records: UsageRecord[]) {
@@ -320,6 +839,8 @@ export function getUsageByRange(records: UsageRecord[], fromDate: string, toDate
     totalRequests += r.requests;
   }
 
+  // totalTokens counts all processed tokens including cached context reads.
+  // Cache hits are billed at a lower rate, but they still count as usage.
   const totalTokens = totalInput + totalOutput + totalCacheRead + totalCacheWrite;
   const cacheHitRate = totalTokens > 0 ? ((totalCacheRead + totalCacheWrite) / totalTokens) * 100 : 0;
 
@@ -573,13 +1094,12 @@ export function listSessions(): ProjectGroup[] {
     }
 
     const group = groups.get(projectPath)!;
-    const files = readdirSync(dir)
-      .filter((f) => f.endsWith(".jsonl"))
-      .sort()
-      .reverse(); // newest first
+    const files: string[] = [];
+    walkSessionJsonl(dir, files);
+    // Sort by path descending (newest session directories first as a rough proxy)
+    files.sort().reverse();
 
-    for (const file of files) {
-      const filePath = join(dir, file);
+    for (const filePath of files) {
       const session = parseSessionFileInfo(filePath);
       if (session) {
         group.sessions.push(session);
@@ -588,11 +1108,10 @@ export function listSessions(): ProjectGroup[] {
 
     group.totalSessions = group.sessions.length;
     if (group.sessions.length > 0) {
-      group.lastActive = group.sessions[0]?.timestamp ?? ""; // already sorted newest-first
+      group.lastActive = group.sessions[0]?.timestamp ?? "";
     }
   }
 
-  // Sort groups by lastActive descending
   return Array.from(groups.values())
     .filter((g) => g.sessions.length > 0)
     .sort((a, b) => b.lastActive.localeCompare(a.lastActive));
@@ -779,6 +1298,74 @@ export function permanentlyDeleteTrash(trashPath: string): boolean {
   }
 }
 
+// ─── Session Auto-Expiry ──────────────────────────────────
+
+const AUTO_EXPIRE_INTERVAL_MS = 24 * 60 * 60 * 1000; // every 24h
+let autoExpireTimer: ReturnType<typeof setInterval> | null = null;
+
+function getSessionExpiryDays(): number {
+  const settings = readSettings();
+  const val = settings?.sessionExpiryDays;
+  const n = typeof val === "number" ? val : Number(val);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 7;
+}
+
+interface ExpireResult {
+  expired: string[];
+  skipped: string[];
+  errors: string[];
+}
+
+export function autoExpireSessions(): ExpireResult {
+  const result: ExpireResult = { expired: [], skipped: [], errors: [] };
+  const expiryDays = getSessionExpiryDays();
+  const cutoffMs = Date.now() - expiryDays * 24 * 60 * 60 * 1000;
+
+  const dirs = getSessionDirs();
+  for (const dir of dirs) {
+    let files: string[];
+    try {
+      files = readdirSync(dir)
+        .filter((f) => f.endsWith(".jsonl"))
+        .map((f) => join(dir, f));
+    } catch {
+      continue;
+    }
+
+    for (const filePath of files) {
+      try {
+        const info = parseSessionFileInfo(filePath);
+        if (!info) { result.skipped.push(filePath); continue; }
+
+        const lastActiveTs = new Date(info.lastActive || info.timestamp).getTime();
+        if (isNaN(lastActiveTs)) { result.skipped.push(filePath); continue; }
+
+        if (lastActiveTs < cutoffMs) {
+          const ok = trashSessionFile(filePath);
+          if (ok) {
+            result.expired.push(filePath);
+          } else {
+            result.errors.push(`trash failed: ${filePath}`);
+          }
+        }
+      } catch {
+        result.errors.push(`scan failed: ${filePath}`);
+      }
+    }
+  }
+
+  return result;
+}
+
+export function startAutoExpiryTimer(): void {
+  if (autoExpireTimer) return;
+  // Run once at startup (fire-and-forget, swallow errors)
+  try { autoExpireSessions(); } catch { /* ignore */ }
+  autoExpireTimer = setInterval(() => {
+    try { autoExpireSessions(); } catch { /* ignore */ }
+  }, AUTO_EXPIRE_INTERVAL_MS);
+}
+
 // ─── Session Preview ────────────────────────────────
 
 export interface SessionPreviewMessage {
@@ -1060,6 +1647,93 @@ export interface ApplyUpdateResult {
   message?: string;
 }
 
+// ─── npm resolution ──────────────────────────────────────
+// GUI-launched apps (Finder / Launchpad) inherit a minimal PATH
+// (/usr/bin:/bin:/usr/sbin:/sbin) that does NOT contain the user's npm or
+// node, so `spawnSync("npm", ...)` fails with ENOENT in the packaged app.
+// Instead of relying on PATH we locate the real npm-cli.js + node binary
+// from common install locations and run npm via that explicit node.
+
+function realpathOr(p: string): string | null {
+  try {
+    return realpathSync(p);
+  } catch {
+    return null;
+  }
+}
+
+/** Candidate npm binaries across common layouts (PATH + known locations). */
+function npmBinCandidates(): string[] {
+  const home = homedir();
+  const fromPath = (process.env.PATH || "")
+    .split(":")
+    .filter(Boolean)
+    .map((d) => join(d, "npm"));
+  return [
+    ...fromPath,
+    `${home}/.npm-global/bin/npm`,
+    `${home}/.npm-packages/bin/npm`,
+    `${home}/.local/share/pnpm/npm`,
+    "/usr/local/bin/npm",
+    "/opt/homebrew/bin/npm",
+    // pi-node bundles its own node/npm under ~/.local/share/pi-node/node-*/
+    ...(() => {
+      const base = join(home, ".local", "share", "pi-node");
+      try {
+        return readdirSync(base)
+          .filter((n) => n.startsWith("node-"))
+          .map((n) => join(base, n, "bin", "npm"));
+      } catch {
+        return [];
+      }
+    })(),
+  ];
+}
+
+/** Resolve the npm CLI entry (npm-cli.js) — npm bins are symlinks to it. */
+function resolveNpmCliJs(): string | null {
+  for (const bin of npmBinCandidates()) {
+    const real = realpathOr(bin);
+    if (real && existsSync(real) && /npm-cli\.js$/.test(real)) return real;
+  }
+  return null;
+}
+
+/** Candidate node binaries (PATH + common locations + pi-node bundle). */
+function resolveNodeBin(): string | null {
+  const home = homedir();
+  const fromPath = (process.env.PATH || "")
+    .split(":")
+    .filter(Boolean)
+    .map((d) => join(d, "node"));
+  const candidates = [
+    ...fromPath,
+    `${home}/.npm-global/bin/node`,
+    `${home}/.npm-packages/bin/node`,
+    "/usr/local/bin/node",
+    "/opt/homebrew/bin/node",
+    ...(() => {
+      const base = join(home, ".local", "share", "pi-node");
+      try {
+        return readdirSync(base)
+          .filter((n) => n.startsWith("node-"))
+          .map((n) => join(base, n, "bin", "node"));
+      } catch {
+        return [];
+      }
+    })(),
+  ];
+  for (const bin of candidates) {
+    try {
+      const out = spawnSync(bin, ["--version"], { encoding: "utf8", timeout: 5000 });
+      if (out.status === 0 && out.stdout) return bin;
+    } catch {
+      // try next candidate
+    }
+  }
+  return null;
+}
+
 /**
  * One-click update: npm install <name>@latest inside ~/.pi/agent/npm.
  * Only packages already installed there are accepted (pi core is excluded —
@@ -1068,6 +1742,8 @@ export interface ApplyUpdateResult {
 export function applyExtensionUpdates(names: string[]): ApplyUpdateResult[] {
   const dir = join(PI_DIR, "npm");
   const installed = new Set(listInstalledExtensions().map((e) => e.name));
+  const npmCliJs = resolveNpmCliJs();
+  const nodeBin = resolveNodeBin();
 
   return names.map((name) => {
     if (!installed.has(name)) {
@@ -1076,15 +1752,19 @@ export function applyExtensionUpdates(names: string[]): ApplyUpdateResult[] {
     try {
       // --legacy-peer-deps: peer deps (e.g. pi core) are provided by the pi host,
       // not installed here — strict resolution would fail with ERESOLVE.
-      const out = spawnSync(
-        "npm",
-        ["install", `${name}@latest`, "--no-audit", "--no-fund", "--legacy-peer-deps"],
-        {
+      const args = ["install", `${name}@latest`, "--no-audit", "--no-fund", "--legacy-peer-deps"];
+      let out;
+      if (nodeBin && npmCliJs) {
+        // Explicit node + npm-cli.js — works even when PATH lacks npm
+        out = spawnSync(nodeBin, [npmCliJs, ...args], {
           cwd: dir,
           encoding: "utf8",
           timeout: 120000,
-        }
-      );
+        });
+      } else {
+        // Fall back to PATH resolution (dev / terminal environments)
+        out = spawnSync("npm", args, { cwd: dir, encoding: "utf8", timeout: 120000 });
+      }
       if (out.status === 0) return { name, success: true };
       const stderr = (out.stderr || "").trim().split("\n").slice(-3).join(" ");
       return { name, success: false, message: stderr || `npm exited with ${out.status}` };