@timqi/pier 0.0.1 → 0.0.2

package/README.md

@@ -17,8 +17,9 @@ versioned from `0.0.1` on — earlier databases are not migrated. Read
 ## Requirements
 
 - Node 24 or newer (`node:sqlite` is used unflagged)
-- A Pi provider key (Anthropic, OpenAI, …) — Pi's own config, in
-  `~/.pi/agent/settings.json`, editable from Console → Configuration
+- A provider account (Anthropic, OpenAI, …) — configure its API key or OAuth
+  login from Console → Settings → Providers after signing in
+- A user-writable global npm prefix if `pier update` should update a service
 - Optional: the `sqlite3` CLI, for backups and password resets
 
 ## Run it
@@ -29,33 +30,87 @@ pier
 ```
 
 It listens on `127.0.0.1:3141` (`PORT`, `HOST`) and keeps everything under
-`~/.pier` (`PIER_HOME`): one SQLite database and the boards it serves.
+`~/.pier` (`PIER_HOME`): one SQLite database, the boards it serves, the
+`master.key` that seals stored credentials, and the Pi runtime with its
+session transcripts (`~/.pier/pi`, unless `PI_CODING_AGENT_DIR` says
+otherwise).
 
 **The first start generates a password and prints it once.** Every HTTP surface
 is behind it — there is no default password and no unclaimed window. Lost it?
-`sqlite3 ~/.pier/pier.db 'DELETE FROM auth'` and restart; a new one is printed.
+`sqlite3 ~/.pier/db/pier.db 'DELETE FROM auth'` and restart; a new one is printed.
 
 Open `http://localhost:3141`, sign in, then:
 
-- **Console → Configuration** — provider keys and model defaults (Pi's files)
-- **Console → Channels** — Slack (Socket Mode) or Telegram bot tokens; chats
-  are discovered when the bot first sees traffic, and stay gated by the
-  mention/bind rules you set
+- **Console → Settings** — everything the instance is configured with, one
+  tab per topic: Providers (API-key/OAuth logins), Models (the menu of
+  favored models agents are advised with), Channels (Slack Socket-Mode or
+  Telegram bot tokens; chats are discovered when the bot first sees traffic,
+  gated by the mention/bind rules you set), Agent files (Pi configuration),
+  plus the public URL, password and master key
 - **New session** — pick a directory; that is where the agent's shell runs
 
+## Configure Pi
+
+Pier gives Pi a dedicated agent directory instead of changing your normal Pi
+installation. By default it is `$PIER_HOME/pi` (`~/.pier/pi`). Set
+`PI_CODING_AGENT_DIR` before starting Pier to use another directory, including
+an existing Pi setup:
+
+```sh
+PI_CODING_AGENT_DIR="$HOME/.pi/agent" pier
+```
+
+Console → Settings is the normal setup path:
+
+- **Providers** configures built-in or custom endpoints and API-key/OAuth login.
+  Stored credentials are sealed in Pier's SQLite database; they are not written
+  back to `models.json`.
+- **Agent files** edits `SYSTEM.md`, `AGENTS.md`, `settings.json`, and advanced
+  `models.json` structure in the Pi agent directory — globally, or per project
+  scope, where it also shows that project's `.pi/skills` and `.pi/extensions`
+  resources. Changes apply when a session next opens; `pier reload` recycles
+  idle, unwatched sessions so their next message uses the current files.
+
+On first credential access, Pier imports an existing `auth.json` into its sealed
+store and renames the source to `auth.json.imported`. Literal provider keys left
+in `models.json` are moved the same way, with the original retained as
+`models.json.imported`. Use Providers for new secrets; the advanced editor will
+not accept plaintext keys or header values.
+
+Provider environment variables supported by Pi are inherited from the Pier
+process. A service installed with `pier service install` does not inherit your
+interactive shell, so put non-secret Pi environment settings in a systemd unit
+override; for API keys, prefer the sealed Providers UI.
+
 ## Run it as a service
 
 ```sh
 pier service install     # --port, --host, --pier-home, --force
 pier service status
 pier service uninstall
+pier restart             # drain running work, then restart
+pier reload              # re-read channel config and recycle idle sessions
+pier backup              # snapshot the database before a manual update
+pier update              # latest release, then hard-stop/restart the service
 ```
 
+`pier restart` refuses new work, waits up to five minutes for active turns and
+Task runs, then restarts; if its deadline aborts an IM turn, the next process
+tells that conversation. `pier reload` stays in-process: adapters re-read their
+configuration and idle, unwatched sessions reopen on their next message.
+Streaming or watched sessions keep running and pick changes up after eviction.
+Both commands target the installed systemd service. `pier update` is still a
+hard stop because its separate updater replaces the installed code; let active
+work finish before starting it.
+
 Linux only, because it is systemd. It writes `~/.config/systemd/user/pier.service`
 with the absolute path of the node you installed with (systemd's PATH would not
 find a version-managed one), a memory drop-in it never rewrites afterwards, and
-turns on linger so scheduled tasks survive your logout. On macOS run `pier` in
-a terminal, or under whatever supervisor you already use.
+turns on linger so scheduled tasks survive your logout. Install also records the
+exact npm executable in a separate updater unit. Re-run `pier service install
+--force` after changing the service settings or its Node/npm installation; this
+rewrites both units and restarts Pier. On macOS run `pier` in a terminal, or
+under whatever supervisor you already use.
 
 `docs/deploy.md` is the same thing written out by hand, plus what the memory
 limits mean, how updates work (and why the updater is a second unit), how to
@@ -84,11 +139,20 @@ npm test          # vitest
 
 ## Releases
 
-`main` is the only development line. `npm version minor` writes the tag, the
+Pier checks `registry.npmjs.org` in the background and shows `v0.0.1 → 0.0.2`
+in the footer when a release is out. It never updates automatically: this
+process holds provider keys and can run a shell, so rewriting its own code on a
+timer would be a supply-chain surface. `pier update` is a command someone
+types; unlike `pier restart`, it hard-stops the service, writes
+`~/.pier/db/pier.db.release.bak`, updates the npm installation recorded when
+the service was installed, and starts Pier again.
+
+`main` is the only development line. `npm version patch` writes the tag, the
 tag builds and publishes a GitHub Release, and the version in the web footer is
 the one from `package.json` — so the number on screen always names a commit.
 Schema upgrades are one-way: a database migrated by a newer Pier is refused by
-an older one, so take the backup `docs/deploy.md` describes before upgrading.
+an older one. The release backup above is the way back; `docs/deploy.md` has the
+restore procedure and the additional snapshots taken before schema migrations.
 
 ## License
 

package/dist/agent/config.js

@@ -1,8 +1,10 @@
 // Pi configuration on disk, behind the ConfigStore seam. Knows Pi's directory
 // conventions (the Pier-managed global dir; <cwd>/AGENTS.md and <cwd>/.pi per
 // project) but not the Pi SDK — pure filesystem, unit-testable in a tmp dir.
+import { randomUUID } from "node:crypto";
 import { promises as fs } from "node:fs";
 import { join, resolve, sep } from "node:path";
+import { isProviderApi, validateEndpoint, validateProviderSetup } from "../core/types.js";
 import { pierPath } from "../paths.js";
 const GLOBAL_FILES = ["SYSTEM.md", "AGENTS.md", "settings.json", "models.json"];
 const PROJECT_FILES = ["AGENTS.md"];
@@ -11,13 +13,56 @@ const RESOURCE_DEPTH = 3; // extensions/skills nest at most a couple of levels
  * repo, not `~/.pi`. main.ts exports this as PI_CODING_AGENT_DIR so the SDK's
  * own path resolution (auth.json, sessions, bin) lands in the same place. */
 export const defaultAgentDir = () => process.env.PI_CODING_AGENT_DIR ?? pierPath("pi");
-/** Stable mask: recomputable at write time, so "unchanged" is detectable. */
-const maskKey = (key) => key.length > 8 ? `${key.slice(0, 4)}…${key.slice(-4)}` : "•••";
+/** Stable mask: mapped back by field, without exposing key fragments. */
+const maskKey = (_key) => "••••••••";
+const missing = (err) => err instanceof Error && "code" in err && err.code === "ENOENT";
+const readOptional = async (path) => {
+    try {
+        return await fs.readFile(path, "utf8");
+    }
+    catch (err) {
+        if (missing(err))
+            return "";
+        throw err;
+    }
+};
+const pathExists = async (path) => {
+    try {
+        await fs.access(path);
+        return true;
+    }
+    catch (err) {
+        if (missing(err))
+            return false;
+        throw err;
+    }
+};
+const atomicWrite = async (path, data, mode = 0o644) => {
+    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try {
+        await fs.writeFile(temp, data, { mode });
+        await fs.rename(temp, path);
+    }
+    catch (err) {
+        try {
+            await fs.unlink(temp);
+        }
+        catch (cleanup) {
+            if (!missing(cleanup))
+                throw new AggregateError([err, cleanup], `failed to write ${path}`);
+        }
+        throw err;
+    }
+};
 export class PiConfigStore {
     agentDir;
+    #writes = Promise.resolve();
     constructor(agentDir = defaultAgentDir()) {
         this.agentDir = agentDir;
     }
+    get globalDir() {
+        return this.agentDir;
+    }
     /** Whitelist is the security boundary — nothing outside it is reachable. */
     fileNames(scope) {
         return scope.kind === "global" ? GLOBAL_FILES : PROJECT_FILES;
@@ -36,20 +81,128 @@ export class PiConfigStore {
     async listFiles(scope) {
         return Promise.all(this.fileNames(scope).map(async (name) => ({
             name,
-            exists: await fs.access(this.filePath(scope, name)).then(() => true, () => false),
+            exists: await pathExists(this.filePath(scope, name)),
         })));
     }
     async readFile(scope, name) {
-        const raw = await fs.readFile(this.filePath(scope, name), "utf8").catch(() => "");
+        const path = this.filePath(scope, name);
+        await this.#writes;
+        const raw = await readOptional(path);
         return name === "models.json" ? maskModels(raw) : raw;
     }
-    async writeFile(scope, name, content) {
+    async writeFile(scope, name, content, expected) {
         const path = this.filePath(scope, name);
-        const data = name === "models.json"
-            ? unmaskModels(content, await fs.readFile(path, "utf8").catch(() => ""))
-            : content;
-        await fs.mkdir(scope.kind === "global" ? this.agentDir : scope.cwd, { recursive: true });
-        await fs.writeFile(path, data);
+        return this.#withWrite(async () => {
+            const current = await readOptional(path);
+            const visible = name === "models.json" ? maskModels(current) : current;
+            if (expected !== undefined && visible !== expected)
+                throw new Error(`${name} changed on disk; reopen it`);
+            const data = name === "models.json" ? unmaskModels(content, current) : content;
+            await fs.mkdir(scope.kind === "global" ? this.agentDir : scope.cwd, { recursive: true });
+            await atomicWrite(path, data, name === "models.json" ? 0o600 : 0o644);
+        });
+    }
+    async providerStructures() {
+        await this.#writes;
+        const raw = await readOptional(join(this.agentDir, "models.json"));
+        const parsed = parseModels(raw);
+        const out = {};
+        for (const [id, provider] of Object.entries(parsed?.providers ?? {})) {
+            const api = isProviderApi(provider.api) ? provider.api : undefined;
+            const endpoint = typeof provider.baseUrl === "string" ? provider.baseUrl : undefined;
+            if (endpoint)
+                validateEndpoint(endpoint);
+            const models = Array.isArray(provider.models)
+                ? provider.models.flatMap((model) => {
+                    if (typeof model !== "object" || model === null || typeof model.id !== "string") {
+                        return [];
+                    }
+                    return [{
+                            id: model.id,
+                            reasoning: model.reasoning === true,
+                        }];
+                })
+                : undefined;
+            out[id] = {
+                ...(typeof provider.name === "string" ? { name: provider.name } : {}),
+                ...(endpoint ? { endpoint } : {}),
+                ...(api ? { api } : {}),
+                ...(models ? { models } : {}),
+            };
+        }
+        return out;
+    }
+    async setupProvider(input, verify) {
+        validateProviderSetup(input);
+        await this.#withWrite(async () => {
+            const path = join(this.agentDir, "models.json");
+            const existed = await pathExists(path);
+            const raw = await readOptional(path);
+            const parsed = raw.trim() ? parseModels(raw) : {};
+            if (!parsed)
+                throw new Error("models.json must be valid JSON before configuring a provider");
+            const providers = { ...parsed.providers };
+            const current = { ...providers[input.id] };
+            if (input.kind === "builtin") {
+                if (input.endpoint)
+                    current.baseUrl = input.endpoint;
+                else
+                    delete current.baseUrl;
+            }
+            else {
+                if (input.name)
+                    current.name = input.name;
+                else
+                    delete current.name;
+                current.baseUrl = input.endpoint;
+                current.api = input.api;
+                const existingModels = Array.isArray(current.models) ? current.models : [];
+                current.models = input.models.map((model) => {
+                    const existing = existingModels.find((candidate) => typeof candidate === "object" && candidate !== null &&
+                        candidate.id === model.id);
+                    const next = {
+                        ...existing, id: model.id,
+                    };
+                    if (model.reasoning)
+                        next.reasoning = true;
+                    else
+                        delete next.reasoning;
+                    return next;
+                });
+            }
+            if (Object.keys(current).length)
+                providers[input.id] = current;
+            else
+                delete providers[input.id];
+            const candidate = `${JSON.stringify({ ...parsed, providers }, null, 2)}\n`;
+            await fs.mkdir(this.agentDir, { recursive: true });
+            await atomicWrite(path, candidate, 0o600);
+            try {
+                await verify?.();
+            }
+            catch (err) {
+                // Decided outside the restore try: a concurrent edit is not a failed
+                // restore, and must not be reported as one.
+                if (await readOptional(path) !== candidate) {
+                    throw new Error(`${path} changed while provider setup was being validated`, { cause: err });
+                }
+                try {
+                    if (existed)
+                        await atomicWrite(path, raw, 0o600);
+                    else
+                        await fs.unlink(path);
+                }
+                catch (rollback) {
+                    throw new AggregateError([err, rollback], `failed to restore ${path}`);
+                }
+                throw err;
+            }
+        });
+    }
+    #withWrite(write) {
+        const result = this.#writes.then(write);
+        this.#writes = result.then(() => undefined, () => undefined);
+        return result;
     }
     async listResources(scope) {
         return {
@@ -91,41 +244,134 @@ async function listDir(root, prefix = "", depth = RESOURCE_DEPTH, linked = false
     }
     return out.sort((a, b) => a.name.localeCompare(b.name));
 }
-/**
- * models.json carries provider API keys — the UI must never see them. A file
- * that fails to parse is passed through untouched: the user needs to see the
- * broken content to repair it, and the keys in it are their own.
- */
+/** models.json may contain legacy keys and literal headers. Only stable
+ * masks cross the HTTP seam; malformed content must be repaired on disk. */
 function maskModels(raw) {
+    if (!raw.trim())
+        return "";
     const parsed = parseModels(raw);
     if (!parsed)
-        return raw;
-    for (const p of Object.values(parsed.providers ?? {})) {
-        if (typeof p.apiKey === "string" && p.apiKey)
-            p.apiKey = maskKey(p.apiKey);
+        throw new Error("models.json must be valid JSON; repair it on disk");
+    for (const provider of Object.values(parsed.providers ?? {})) {
+        validateBaseUrl(provider);
+        if (provider.apiKey !== undefined && typeof provider.apiKey !== "string") {
+            throw new Error("models.json apiKey must be a string");
+        }
+        if (provider.apiKey)
+            provider.apiKey = maskKey(provider.apiKey);
+        maskHeaders(provider);
+        for (const model of modelRecords(provider)) {
+            validateBaseUrl(model);
+            maskHeaders(model);
+        }
+        for (const override of overrideRecords(provider))
+            maskHeaders(override);
     }
     return JSON.stringify(parsed, null, 2);
 }
-/** Restore stored keys wherever the incoming value is still the mask. */
+/** Restore stored secrets wherever the incoming value is still its mask. */
 function unmaskModels(content, currentRaw) {
     const incoming = parseModels(content);
     if (!incoming)
         throw new Error("models.json must be valid JSON");
     const current = parseModels(currentRaw);
-    for (const [name, p] of Object.entries(incoming.providers ?? {})) {
-        const stored = current?.providers?.[name]?.apiKey;
-        if (typeof p.apiKey === "string" &&
-            typeof stored === "string" &&
-            p.apiKey === maskKey(stored)) {
-            p.apiKey = stored;
+    for (const [name, provider] of Object.entries(incoming.providers ?? {})) {
+        validateBaseUrl(provider);
+        const stored = current?.providers?.[name];
+        if (provider.apiKey !== undefined) {
+            if (typeof provider.apiKey !== "string" || typeof stored?.apiKey !== "string" ||
+                provider.apiKey !== maskKey(stored.apiKey)) {
+                throw new Error("API keys must be configured under Providers");
+            }
+            provider.apiKey = stored.apiKey;
+        }
+        restoreHeaders(provider, stored);
+        const storedModels = new Map(modelRecords(stored).flatMap((model) => typeof model.id === "string" ? [[model.id, model]] : []));
+        for (const model of modelRecords(provider)) {
+            validateBaseUrl(model);
+            restoreHeaders(model, typeof model.id === "string" ? storedModels.get(model.id) : undefined);
+        }
+        const storedOverrides = asRecord(stored?.modelOverrides);
+        for (const [id, override] of overrideRecords(provider, true)) {
+            restoreHeaders(override, asRecord(storedOverrides?.[id]));
         }
     }
     return JSON.stringify(incoming, null, 2);
 }
+const asRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value)
+    ? value
+    : undefined;
+function modelRecords(provider) {
+    if (provider?.models === undefined)
+        return [];
+    if (!Array.isArray(provider.models))
+        throw new Error("models.json models must be an array");
+    return provider.models.map((model) => {
+        const record = asRecord(model);
+        if (!record)
+            throw new Error("models.json models must contain objects");
+        return record;
+    });
+}
+function overrideRecords(provider, entries = false) {
+    if (provider.modelOverrides === undefined)
+        return [];
+    const overrides = asRecord(provider.modelOverrides);
+    if (!overrides)
+        throw new Error("models.json modelOverrides must be an object");
+    const records = Object.entries(overrides).map(([id, value]) => {
+        const record = asRecord(value);
+        if (!record)
+            throw new Error("models.json modelOverrides must contain objects");
+        return [id, record];
+    });
+    return entries ? records : records.map(([, record]) => record);
+}
+function validateBaseUrl(owner) {
+    if (owner.baseUrl === undefined)
+        return;
+    if (typeof owner.baseUrl !== "string")
+        throw new Error("models.json baseUrl must be a string");
+    validateEndpoint(owner.baseUrl);
+}
+function maskHeaders(owner) {
+    if (owner.headers === undefined)
+        return;
+    const headers = asRecord(owner.headers);
+    if (!headers || Object.values(headers).some((value) => typeof value !== "string")) {
+        throw new Error("models.json headers must contain string values");
+    }
+    for (const [name, value] of Object.entries(headers))
+        headers[name] = maskKey(value);
+}
+function restoreHeaders(incoming, current) {
+    if (incoming.headers === undefined)
+        return;
+    const headers = asRecord(incoming.headers);
+    const stored = asRecord(current?.headers);
+    if (!headers || !stored)
+        throw new Error("Header values must be configured on disk");
+    for (const [name, value] of Object.entries(headers)) {
+        const original = stored[name];
+        if (typeof value !== "string" || typeof original !== "string" || value !== maskKey(original)) {
+            throw new Error("Header values must be configured on disk");
+        }
+        headers[name] = original;
+    }
+}
 function parseModels(raw) {
     try {
         const parsed = JSON.parse(raw);
-        return typeof parsed === "object" && parsed !== null ? parsed : null;
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            return null;
+        const providers = parsed.providers;
+        if (providers !== undefined) {
+            if (typeof providers !== "object" || providers === null || Array.isArray(providers))
+                return null;
+            if (Object.values(providers).some((provider) => typeof provider !== "object" || provider === null || Array.isArray(provider)))
+                return null;
+        }
+        return parsed;
     }
     catch {
         return null;

package/dist/agent/credentials.js

@@ -8,12 +8,10 @@
 // sweep below leave models.json purely structural — and safely syncable.
 import { existsSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
 import { logger } from "../log.js";
 import { defaultAgentDir } from "./config.js";
 const log = logger("credentials");
-/** Envelope from secrets.ts. A value that matches was sealed by us; anything
- *  else is legacy plaintext, still honored and re-sealed on the next write. */
-const SEALED = /^v1:[0-9a-f]{8}:/;
 export class CredentialStore {
     db;
     secrets;
@@ -55,19 +53,25 @@ export class CredentialStore {
             return next;
         });
     }
+    async replaceIfCurrent(providerId, current, replacement) {
+        return this.#serialized(undefined, async () => {
+            if (!isDeepStrictEqual(this.#get(providerId), current))
+                return false;
+            if (replacement)
+                this.#put(providerId, replacement);
+            else
+                this.db.prepare("DELETE FROM credentials WHERE key = ?").run(providerId);
+            return true;
+        });
+    }
     async delete(providerId, options) {
         return this.#serialized(options, async () => {
             this.db.prepare("DELETE FROM credentials WHERE key = ?").run(providerId);
         });
     }
     #serialized(options, run) {
-        const op = this.#chain.then(() => {
-            options?.signal?.throwIfAborted();
-            this.#ensureImported();
-            return run();
-        }, 
         // The chain only sequences; a predecessor's failure is its caller's news.
-        () => {
+        const op = this.#chain.catch(() => { }).then(() => {
             options?.signal?.throwIfAborted();
             this.#ensureImported();
             return run();
@@ -80,8 +84,8 @@ export class CredentialStore {
         return row ? this.#parse(row.value) : undefined;
     }
     #parse(value) {
-        const plain = SEALED.test(value) ? this.secrets.decrypt(value) : value;
-        return JSON.parse(plain);
+        // Every row was sealed by #put — the table has never held plaintext.
+        return JSON.parse(this.secrets.decrypt(value));
     }
     #put(providerId, credential) {
         this.db
@@ -169,7 +173,9 @@ export class CredentialStore {
         if (moved.length === 0 && shadowed.length === 0)
             return;
         writeFileSync(`${path}.imported`, raw, { mode: 0o600 });
-        writeFileSync(path, `${JSON.stringify(parsed, null, 2)}\n`);
+        // Atomic swap: a crash mid-write must not truncate the file Pi reads.
+        writeFileSync(`${path}.tmp`, `${JSON.stringify(parsed, null, 2)}\n`, { mode: 0o600 });
+        renameSync(`${path}.tmp`, path);
         if (moved.length)
             log.info(`moved ${moved.length} literal API key(s) from models.json into pier.db: ${moved.join(", ")}`);
         if (shadowed.length)

package/dist/agent/events.js

@@ -12,17 +12,6 @@ export function textOf(content) {
         .map((p) => p.text)
         .join("");
 }
-function imageParts(m) {
-    return Array.isArray(m.content) ? m.content.filter((p) => p.type === "image") : [];
-}
-/** Renderable text of a message, with an image marker (IM can't show them). */
-function displayText(m) {
-    const text = textOf(m.content);
-    const images = imageParts(m).length;
-    if (!images)
-        return text;
-    return `${text}${text ? " " : ""}[${images} image${images > 1 ? "s" : ""}]`;
-}
 function systemOrigin(message) {
     if (message.role !== "custom" || message.customType !== "pier.system-input")
         return null;
@@ -44,23 +33,6 @@ function systemOrigin(message) {
         return origin;
     return null;
 }
-/**
- * Bytes of the ordinal-th transcript image. Walks user/assistant messages in
- * the same order toChatTurns numbers them — the two must not drift.
- */
-export function imageAt(messages, ordinal) {
-    let n = 0;
-    for (const m of messages) {
-        if (m.role !== "user" && m.role !== "assistant")
-            continue;
-        for (const p of imageParts(m)) {
-            if (n++ !== ordinal)
-                continue;
-            return p.data ? { data: p.data, mimeType: p.mimeType ?? "image/png" } : undefined;
-        }
-    }
-    return undefined;
-}
 function lastAssistant(messages) {
     if (!messages)
         return undefined;
@@ -113,8 +85,7 @@ export function toChatTurns(messages) {
     const turns = [];
     let steps = []; // activity seen since the last emitted turn
     const pendingTools = new Map();
-    let ordinal = 0; // must advance exactly like imageAt() walks the messages
-    const flush = (role, text, meta, origin, images) => {
+    const flush = (role, text, meta, origin) => {
         const turn = { role, text };
         if (meta)
             turn.meta = meta;
@@ -124,8 +95,6 @@ export function toChatTurns(messages) {
             turn.steps = steps;
             steps = [];
         }
-        if (images?.length)
-            turn.images = images;
         turns.push(turn);
     };
     for (const [i, m] of messages.entries()) {
@@ -140,7 +109,7 @@ export function toChatTurns(messages) {
         }
         const origin = systemOrigin(m);
         if (origin) {
-            const text = displayText(m);
+            const text = textOf(m.content);
             if (text)
                 flush("system", text, undefined, origin);
             continue;
@@ -165,16 +134,11 @@ export function toChatTurns(messages) {
                 }
             }
         }
-        // Refs, not bytes: the web fetches each image from its own route.
-        const images = imageParts(m).map((p) => ({
-            mimeType: p.mimeType ?? "image/png",
-            ordinal: ordinal++,
-        }));
         const text = textOf(m.content);
         // step-only assistant messages keep buffering activity
-        if (!text && !images.length)
+        if (!text)
             continue;
-        flush(m.role, text, m.role === "assistant" ? turnMetaAt(messages, i) : undefined, undefined, images);
+        flush(m.role, text, m.role === "assistant" ? turnMetaAt(messages, i) : undefined);
     }
     // Activity with no answer after it (aborted run) still belongs on the page.
     if (steps.length)
@@ -204,7 +168,7 @@ export function toSessionEvents(e) {
             if (!m)
                 return [];
             const origin = systemOrigin(m);
-            const text = displayText(m);
+            const text = textOf(m.content);
             if (origin)
                 return text ? [{ type: "system-input", text, origin }] : [];
             if (m.role !== "user")

package/dist/agent/models.js

@@ -1,6 +1,18 @@
 // Pure model-list curation, unit-testable without Pi. The raw registry
 // returns every catalog entry per authed provider (legacy generations, dated
 // aliases, -latest aliases); the picker wants the common working set.
+/** Operator-pinned models first, menu order, without inventing entries: a
+ * pin that is not in the list (stale menu, logged-out provider) is skipped
+ * rather than offered as a model that would only fail on selection. */
+export function pinFirst(models, pins) {
+    if (!pins.length)
+        return models;
+    const key = (m) => `${m.provider}/${m.id}`;
+    const listed = new Map(models.map((m) => [key(m), m]));
+    const pinned = pins.map((p) => listed.get(key(p))).filter((m) => !!m);
+    const picked = new Set(pinned.map(key));
+    return [...pinned, ...models.filter((m) => !picked.has(key(m)))];
+}
 export function curateModels(models) {
     const ids = new Set(models.map((m) => `${m.provider}/${m.id}`));
     return models