@timqi/pier 0.0.1 → 0.0.3

package/dist/service.js

@@ -11,16 +11,33 @@
 // installed by fnm/nvm/asdf is not on it) and the absolute path of the
 // installed entry point.
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
 export const UNIT_NAME = "pier.service";
+export const UPDATE_UNIT_NAME = "pier-update.service";
 /** `~/.config/systemd/user/pier.service` — where a user unit belongs. */
 export const unitPath = (home = homedir()) => join(home, ".config", "systemd", "user", UNIT_NAME);
 /** The drop-in Pier writes once and never touches again: what the unit may
  *  consume is the operator's call, not ours. */
 export const limitsPath = (home = homedir()) => join(dirname(unitPath(home)), `${UNIT_NAME}.d`, "limits.conf");
-export function renderUnit({ execPath, entry, host, port, pierHome }) {
+/** The oneshot that installs a new version, beside the unit it restarts. */
+export const updateUnitPath = (home = homedir()) => join(dirname(unitPath(home)), UPDATE_UNIT_NAME);
+/** Runtime-only effective state for the updater, regenerated before each run. */
+export const updateRuntimePath = (home = homedir()) => join(dirname(unitPath(home)), `${UPDATE_UNIT_NAME}.d`, "runtime.conf");
+/** Quote one systemd word. Percent is doubled because specifier expansion runs
+ * after parsing; dollar is doubled only for command lines. */
+function quote(value, command = false) {
+    if (/[\0\r\n]/.test(value))
+        throw new Error("systemd values cannot contain control characters");
+    let escaped = value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%");
+    if (command)
+        escaped = escaped.replaceAll("$", () => "$$");
+    return `"${escaped}"`;
+}
+const environment = (key, value) => `Environment=${quote(`${key}=${value}`)}`;
+export function renderUnit(options) {
+    const { execPath, entry, host, port, pierHome } = options;
     return `[Unit]
 Description=Pier — agent workspace
 Documentation=https://github.com/timqi/pier
@@ -32,13 +49,13 @@ Type=simple
 WorkingDirectory=%h
 # Absolute paths on purpose: systemd starts with a minimal PATH, and the node
 # that installed Pier is usually not on it.
-ExecStart=${execPath} ${entry}
-Environment=NODE_ENV=production
+ExecStart=${quote(execPath, true)} ${quote(entry, true)}
+${environment("NODE_ENV", "production")}
 # Loopback by default. Put a reverse proxy in front before widening this —
 # whoever reaches this port can drive an agent that runs a shell.
-Environment=HOST=${host}
-Environment=PORT=${port}
-${pierHome ? `# Where the database, the boards and the password hash live.\nEnvironment=PIER_HOME=${pierHome}\n` : ""}Restart=always
+${environment("HOST", host)}
+${environment("PORT", String(port))}
+${pierHome ? `# Where the database, the boards and the password hash live.\n${environment("PIER_HOME", pierHome)}\n` : ""}Restart=always
 RestartSec=2
 # The journal is where the first-run password is printed, so keep it readable.
 StandardOutput=journal
@@ -50,6 +67,46 @@ SyslogIdentifier=pier
 WantedBy=default.target
 `;
 }
+/** The 0.0.1 unit did not record npm. This one-time bridge can only use npm
+ * beside its recorded Node; a forced reinstall writes the exact executable. */
+function legacyOptions(home) {
+    const text = readFileSync(unitPath(home), "utf8");
+    const start = text.match(/^ExecStart=(\S+) (\S+)$/m);
+    const host = text.match(/^Environment=HOST=(\S+)$/m)?.[1];
+    const rawPort = text.match(/^Environment=PORT=(\d+)$/m)?.[1];
+    const pierHome = text.match(/^Environment=PIER_HOME=(\S+)$/m)?.[1];
+    if (!start?.[1] || !start[2] || !host || !rawPort)
+        throw new Error("unit is not the 0.0.1 Pier shape");
+    return {
+        execPath: start[1],
+        npmPath: join(dirname(start[1]), "npm"),
+        entry: start[2],
+        host,
+        port: Number(rawPort),
+        ...(pierHome ? { pierHome } : {}),
+    };
+}
+/** A separate cgroup stops Pier, takes a consistent backup, updates the exact
+ * npm installation recorded at install time, and always starts Pier again. */
+export function renderUpdateUnit(options) {
+    const { execPath, npmPath, entry, pierHome } = options;
+    const cli = join(dirname(entry), "cli.js");
+    return `[Unit]
+Description=Update Pier to the latest published version
+Documentation=https://github.com/timqi/pier
+
+[Service]
+Type=oneshot
+${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=systemctl --user stop ${UNIT_NAME}
+ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
+# npm runs under the recorded node: its shebang needs a node on PATH, and
+# systemd's minimal PATH has none for fnm/nvm installs.
+ExecStart=${quote(execPath, true)} ${quote(npmPath, true)} install -g @timqi/pier@latest
+# ExecStopPost runs on success and failure, so a failed backup or npm install
+# does not leave the previously working service stopped.
+ExecStopPost=systemctl --user start ${UNIT_NAME}
+`;
+}
 /**
  * Sized as a share of the machine, not as "how much should Pier need": the
  * limit covers node, every subagent and every command a turn ran, and it
@@ -74,8 +131,8 @@ OOMScoreAdjust=200
 OOMPolicy=continue
 `;
 }
-/** Best-effort: a step that fails says so and the rest still runs, because a
- *  half-installed service the operator knows about beats a stack trace. */
+/** A command failure is printed here and propagated by its caller. Linger is
+ * the only deliberately best-effort step. */
 const runner = (say) => (argv) => {
     try {
         execFileSync(argv[0], argv.slice(1), { stdio: "pipe" });
@@ -91,13 +148,16 @@ export function install(options) {
     const { force, home = homedir(), say, exec, ...unit } = options;
     const run = exec ?? runner(say);
     const path = unitPath(home);
-    if (existsSync(path) && !force) {
+    const replacing = existsSync(path);
+    if (replacing && !force) {
         say(`${path} already exists — nothing written. Re-run with --force to replace it.`);
-        return;
+        return true;
     }
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, renderUnit(unit), { mode: 0o644 });
+    writeFileSync(updateUnitPath(home), renderUpdateUnit(unit), { mode: 0o644 });
     say(`wrote ${path}`);
+    say(`wrote ${updateUnitPath(home)}`);
     const limits = limitsPath(home);
     if (existsSync(limits)) {
         say(`kept ${limits}`); // tuned by hand, by definition
@@ -107,28 +167,142 @@ export function install(options) {
         writeFileSync(limits, renderLimits(), { mode: 0o644 });
         say(`wrote ${limits}`);
     }
-    run(["systemctl", "--user", "daemon-reload"]);
+    if (!run(["systemctl", "--user", "daemon-reload"]))
+        return false;
     // Without lingering, the user manager stops at logout and takes every
     // scheduled task with it. It can need a polkit prompt, hence best-effort.
     if (!run(["loginctl", "enable-linger", userInfo().username])) {
         say(`  run it yourself so Pier survives logout: loginctl enable-linger ${userInfo().username}`);
     }
-    if (run(["systemctl", "--user", "enable", "--now", UNIT_NAME])) {
-        say(`started. The first run prints a password once: journalctl --user -u pier -e`);
+    if (replacing) {
+        if (!run(["systemctl", "--user", "enable", UNIT_NAME]))
+            return false;
+        if (!run(["systemctl", "--user", "restart", UNIT_NAME]))
+            return false;
     }
+    else if (!run(["systemctl", "--user", "enable", "--now", UNIT_NAME]))
+        return false;
+    say(`started. The first run prints a password once: journalctl --user -u pier -e`);
+    return true;
+}
+/**
+ * Why the installed updater could not do its job, or `null` when nothing is
+ * wrong. Checked while Pier is still alive, because the alternative is finding
+ * out at the next restart, from a service that no longer starts.
+ *
+ * The absolute node and npm paths in the unit are deliberate — systemd's PATH
+ * has neither — but they pin the unit to one directory of one version manager.
+ * `fnm install 26 && fnm uninstall 24` leaves ExecStart naming a Node that is
+ * gone; the running process survives (Linux keeps a deleted binary mapped),
+ * so nothing would notice until the update, or the next boot, failed.
+ */
+export function updaterProblem(home = homedir()) {
+    if (!existsSync(unitPath(home)))
+        return null; // not a service install; nothing to check
+    const path = updateUnitPath(home);
+    let unit;
+    if (existsSync(path)) {
+        try {
+            unit = readFileSync(path, "utf8");
+        }
+        catch (err) {
+            return `${path} cannot be read: ${String(err)}`;
+        }
+    }
+    else {
+        // A 0.0.1 install: startUpdate generates the updater from the main unit,
+        // so a missing file is only a problem when that bridge cannot either —
+        // and the generated text gets the same executable check below.
+        try {
+            unit = renderUpdateUnit(legacyOptions(home));
+        }
+        catch {
+            return `${UPDATE_UNIT_NAME} is missing — run: pier service install --force`;
+        }
+    }
+    // The one line that names both executables, quoted and escaped by quote().
+    // Unparseable means hand-edited, which is not this function's business to
+    // judge; the escaping is undone before existsSync sees a path (a `%` or `$`
+    // in it would otherwise read as gone on a working updater).
+    const install = unit.match(/^ExecStart="((?:\\.|[^"\r\n])+)" "((?:\\.|[^"\r\n])+)" install -g/m);
+    if (!install)
+        return null;
+    const unescape = (word) => word.replaceAll("$$", "$").replaceAll("%%", "%").replace(/\\(.)/g, "$1");
+    for (const [what, bin] of [["node", unescape(install[1])], ["npm", unescape(install[2])]]) {
+        if (!existsSync(bin)) {
+            return `the ${what} the updater would use is gone (${bin}) — a version manager removed it; run: pier service install --force`;
+        }
+    }
+    return null;
+}
+function runningPierHome(home) {
+    const pid = Number(execFileSync("systemctl", ["--user", "show", UNIT_NAME, "--property=MainPID", "--value"], { encoding: "utf8" }).trim());
+    if (Number.isInteger(pid) && pid >= 1) {
+        const value = readFileSync(`/proc/${pid}/environ`)
+            .toString()
+            .split("\0")
+            .find((item) => item.startsWith("PIER_HOME="))
+            ?.slice("PIER_HOME=".length);
+        return value || join(home, ".pier");
+    }
+    // Installed but stopped: the unit file records any override (quoted and
+    // escaped since 0.0.2, bare in the 0.0.1 shape) — undo quote()'s escaping
+    // or the drop-in would carry `%%`/`\\"` into a real path.
+    const raw = readFileSync(unitPath(home), "utf8")
+        .match(/^Environment="?PIER_HOME=((?:\\.|[^"\r\n])+)"?$/m)?.[1];
+    const fromUnit = raw?.replaceAll("%%", "%").replace(/\\(.)/g, "$1");
+    return fromUnit || join(home, ".pier");
+}
+/** Start the updater recorded at install time. Its tiny drop-in captures the
+ * running service's effective home, including an operator override. */
+export function startUpdate(options) {
+    const { home = homedir(), say } = options;
+    const run = options.exec ?? runner(say);
+    if (!existsSync(unitPath(home)))
+        return "not-installed";
+    try {
+        if (!existsSync(updateUnitPath(home))) {
+            writeFileSync(updateUnitPath(home), renderUpdateUnit(legacyOptions(home)), { mode: 0o644 });
+            say(`generated a legacy updater; run "pier service install --force" after this update to record the exact npm path.`);
+        }
+        const runtime = updateRuntimePath(home);
+        mkdirSync(dirname(runtime), { recursive: true });
+        writeFileSync(runtime, `[Service]\n${environment("PIER_HOME", (options.effectiveHome ?? (() => runningPierHome(home)))())}\n`, { mode: 0o644 });
+    }
+    catch (err) {
+        say(`! cannot prepare update — ${String(err)}`);
+        return "failed";
+    }
+    if (!run(["systemctl", "--user", "daemon-reload"]))
+        return "failed";
+    if (!run(["systemctl", "--user", "start", "--no-block", UPDATE_UNIT_NAME]))
+        return "failed";
+    say(`updating in the background — follow it with: journalctl --user -u ${UPDATE_UNIT_NAME} -f`);
+    say(`Pier stops, snapshots pier.db.release.bak, installs, then starts again.`);
+    return "started";
 }
 export function uninstall(home = homedir(), say = console.log, exec) {
     const run = exec ?? runner(say);
-    run(["systemctl", "--user", "disable", "--now", UNIT_NAME]);
-    for (const path of [unitPath(home), limitsPath(home)]) {
+    if (!run(["systemctl", "--user", "disable", "--now", UNIT_NAME]))
+        return false;
+    for (const path of [unitPath(home), limitsPath(home), updateUnitPath(home), updateRuntimePath(home)]) {
         if (!existsSync(path))
             continue;
         rmSync(path, { force: true });
         say(`removed ${path}`);
     }
-    rmSync(dirname(limitsPath(home)), { force: true, recursive: true });
-    run(["systemctl", "--user", "daemon-reload"]);
+    for (const dir of [dirname(limitsPath(home)), dirname(updateRuntimePath(home))]) {
+        try {
+            rmdirSync(dir); // non-recursive: drop-ins the operator added are not ours to delete
+        }
+        catch {
+            if (existsSync(dir))
+                say(`kept ${dir} — it has files Pier did not write`);
+        }
+    }
+    const ok = run(["systemctl", "--user", "daemon-reload"]);
     // Left alone on purpose: the database, the boards, and linger — none of them
     // are this command's to decide about.
     say(`$PIER_HOME is untouched; linger is still enabled.`);
+    return ok;
 }

package/dist/settings.js

@@ -1,14 +1,15 @@
 // Instance settings: the facts about *this* Pier that are neither a credential
-// nor per-session. Today there is one — the URL it is reached at from outside,
-// which nothing in the process can discover for itself: a request's Host header
-// is whatever a proxy chose to pass on, and an agent writing a board has no
-// request at all.
+// nor per-session — the public URL (nothing in the process can discover it:
+// a Host header is whatever a proxy passed on) and the operator's model menu.
 //
 // A key-value table, so the next setting is not the next table and not a third
 // kind of storage. It used to be a JSON file, justified by "the agent reads it
 // too" — the agent is told the URL in its system prompt (core/reply.ts), and
 // nothing outside this process ever opened that file.
+import { isThinkingLevel } from "./core/types.js";
 import { pierDb } from "./db.js";
+import { logger } from "./log.js";
+const log = logger("settings");
 /**
  * `""` clears it, `null` rejects it. Rejecting rather than repairing: a
  * mistyped host quietly turned into a URL produces board links that 404 for
@@ -33,22 +34,90 @@ export function normalizePublicUrl(raw) {
         return null;
     return `${url.origin}${url.pathname}`.replace(/\/+$/, "");
 }
+/**
+ * Boundary check for a menu, rejecting rather than repairing (same contract as
+ * `normalizePublicUrl`): a silently "fixed" entry would advertise a model the
+ * operator never picked. Notes are capped — they are one line of intent, and
+ * every session that asks for the menu pays for their tokens.
+ */
+export function normalizeModelMenu(raw) {
+    if (!Array.isArray(raw) || raw.length > 32)
+        return null;
+    const menu = [];
+    for (const item of raw) {
+        if (typeof item !== "object" || item === null)
+            return null;
+        const { provider, id, thinking, note } = item;
+        if (typeof provider !== "string" || !provider.trim())
+            return null;
+        if (typeof id !== "string" || !id.trim())
+            return null;
+        if (thinking !== undefined && !isThinkingLevel(thinking))
+            return null;
+        if (note !== undefined && typeof note !== "string")
+            return null;
+        const cleaned = note?.trim().slice(0, 200);
+        menu.push({
+            provider: provider.trim(),
+            id: id.trim(),
+            ...(thinking !== undefined ? { thinking } : {}),
+            ...(cleaned ? { note: cleaned } : {}),
+        });
+    }
+    return menu;
+}
 export class SettingsStore {
     #db;
     constructor(db = pierDb()) {
         this.#db = db;
     }
     get() {
-        return { publicUrl: this.#value("publicUrl") ?? "" };
+        return {
+            publicUrl: this.#value("publicUrl") ?? "",
+            modelMenu: this.#menu(),
+            autoUpdate: this.#value("autoUpdate") === "1",
+        };
+    }
+    #menu() {
+        const raw = this.#value("modelMenu");
+        if (!raw)
+            return [];
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            // Only a hand-edited row can get here; named, not silently served as [].
+            log.warn("settings.modelMenu is not JSON — ignoring it");
+            return [];
+        }
+        const menu = normalizeModelMenu(parsed);
+        if (!menu) {
+            log.warn("settings.modelMenu is not a valid menu — ignoring it");
+            return [];
+        }
+        return menu;
     }
     /** Store an already-normalized value — validation belongs at the boundary
      *  that received it, so this never has to guess what the caller meant. */
     setPublicUrl(publicUrl) {
+        this.#set("publicUrl", publicUrl);
+        return this.get();
+    }
+    /** Same contract: hand this `normalizeModelMenu`'s output, not raw input. */
+    setModelMenu(menu) {
+        this.#set("modelMenu", JSON.stringify(menu));
+        return this.get();
+    }
+    setAutoUpdate(on) {
+        this.#set("autoUpdate", on ? "1" : "0");
+        return this.get();
+    }
+    #set(key, value) {
         this.#db.prepare(`
-      INSERT INTO settings(key, value) VALUES ('publicUrl', ?)
+      INSERT INTO settings(key, value) VALUES (?, ?)
       ON CONFLICT(key) DO UPDATE SET value = excluded.value
-    `).run(publicUrl);
-        return this.get();
+    `).run(key, value);
     }
     #value(key) {
         const row = this.#db.prepare("SELECT value FROM settings WHERE key = ?").get(key);

package/dist/tasks/agent.js

@@ -1,8 +1,27 @@
+import { quietLabel, splitReply } from "../core/reply.js";
 import { Router } from "../core/router.js";
 import { TaskMessenger } from "./messages.js";
 import { TaskStore } from "./store.js";
 const MAX_ACTIVE_AGENTS = 4;
 const MAX_ACTIVE_PER_ROOT = 4;
+/** What a child cannot know unless told. Every session gets the chat-surface
+ * contract (<pier>/AGENTS.md), task runs included — so the delegation prompt
+ * says which of it does not apply here, and a supervised run how to reach the
+ * agent that is waiting on it. Skipped on resume: the session already saw it. */
+const preamble = (run) => {
+    // A cron/watch task with a session callback is read by an agent too.
+    const audience = run.invokedBySessionId
+        ? "read by the agent that delegated this run"
+        : run.callbackSessionId
+            ? "read by the agent session it is delivered to"
+            : "read by the operator";
+    const contact = run.invokedBySessionId
+        ? ' Mid-run, the task tool\'s contact operation reaches that agent: reason "progress" is fire-and-forget, "decision" waits for a reply — state what you await and end your turn.'
+        : "";
+    return `[Pier task run ${run.id} — "${run.context.definition.name}"] ` +
+        `Your final reply is recorded verbatim as the run result, ${audience}; ` +
+        `next-step buttons and file:// attachments do not render there.${contact}\n\n`;
+};
 export class AgentTaskRunner {
     factory;
     router;
@@ -28,10 +47,12 @@ export class AgentTaskRunner {
                 start();
                 // No input is no block: `<task_input>\nnull\n</task_input>` is four
                 // lines telling the agent nothing, on every run that has no input.
+                // Compact for the same reason tool results are (agent/pi.ts), and
+                // `<\/` is the same JSON — a value cannot close the fence early.
                 const input = run.input === undefined || run.input === null
                     ? ""
-                    : `\n\n<task_input>\n${JSON.stringify(run.input, null, 2)}\n</task_input>`;
-                const prompt = run.context.resumePrompt ?? `${action.prompt}${input}`;
+                    : `\n\n<task_input>\n${JSON.stringify(run.input).replaceAll("</task_input>", "<\\/task_input>")}\n</task_input>`;
+                const prompt = run.context.resumePrompt ?? `${preamble(run)}${action.prompt}${input}`;
                 run.context.sessionId = session.id;
                 run.context.model = session.model;
                 run.context.renderedPrompt = prompt;
@@ -41,7 +62,16 @@ export class AgentTaskRunner {
                     if (event.type === "turn-end")
                         text = event.text;
                 });
-                const abort = () => void session.abort();
+                // The race below also settles this attempt if Pi ignores the abort:
+                // a hung turn must not hold one of the 4 slots (and its waiters)
+                // forever — the same guard execution.ts gives task-type children.
+                let rejectAborted = () => { };
+                const abortedTurn = new Promise((_, reject) => { rejectAborted = reject; });
+                abortedTurn.catch(() => { }); // handled via the race; never unhandled
+                const abort = () => {
+                    void session.abort();
+                    rejectAborted(new Error("cancelled"));
+                };
                 signal.addEventListener("abort", abort, { once: true });
                 // A pre-aborted signal never fires the listener: check before the
                 // prompt starts or a cancelled run would hang until its timeout.
@@ -56,14 +86,20 @@ export class AgentTaskRunner {
                     }, "prompt");
                     await Promise.resolve();
                     this.messages.deliverPendingControls(run);
-                    await turn;
+                    await Promise.race([turn, abortedTurn]);
                     if (signal.aborted)
                         throw new Error("cancelled");
                     if (!text) {
                         const history = await session.history();
                         text = [...history].reverse().find((turn) => turn.role === "assistant")?.text ?? "";
                     }
-                    return { type: "agent", text, sessionId: session.id };
+                    // The chat contract is injected into task sessions too, so a child's
+                    // reply may carry chat-only markup. The result is read by a
+                    // supervisor or the Console, never a chat renderer: buttons are
+                    // dropped, and a turn that said nothing names which kind of nothing
+                    // it was (principle 5b) instead of storing an empty result.
+                    const reply = splitReply(text);
+                    return { type: "agent", text: reply.text || quietLabel(reply.silence), sessionId: session.id };
                 }
                 finally {
                     signal.removeEventListener("abort", abort);

package/dist/tasks/callbacks.js

@@ -1,7 +1,8 @@
+// What a finished run says to the session that delegated it. Delivery itself
+// belongs to outbox.ts; this file owns the run vocabulary and the batching.
 import { Router } from "../core/router.js";
-import { logger } from "../log.js";
+import { Outbox } from "./outbox.js";
 import { TaskStore } from "./store.js";
-const log = logger("tasks");
 export function runResultText(run) {
     let result = run.error ?? "No result";
     if (run.result?.type === "agent")
@@ -13,18 +14,31 @@ export function runResultText(run) {
     if (run.result?.type === "watch")
         result = "Watch condition did not match";
     if (result.length > 8000)
-        result = `${result.slice(0, 8000)}\n[truncated; open run ${run.id}]`;
+        result = `${result.slice(0, 8000)}\n[truncated — task tool get run_id ${run.id} returns the full text]`;
     return result;
 }
 export class TaskCallbacks {
     store;
-    router;
-    changed;
-    delivering = new Set();
-    constructor(store, router, changed) {
+    outbox;
+    constructor(store, router, changed, unreachable) {
         this.store = store;
-        this.router = router;
-        this.changed = changed;
+        this.outbox = new Outbox(router, {
+            id: (run) => run.id,
+            reload: (id) => this.store.getRun(id),
+            save: (run) => { this.store.saveRun(run); },
+            changed,
+            input: (runs) => ({
+                text: this.text(runs),
+                origin: {
+                    kind: "task-callback",
+                    taskId: runs[0].taskId,
+                    runId: runs[0].id,
+                    sourceSessionId: runs[0].targetSessionId,
+                    runIds: runs.map((run) => run.id),
+                },
+            }),
+            describe: (run) => `the result of "${run.context.definition.name}"`,
+        }, unreachable);
     }
     target(callback, origin) {
         if (callback.type === "session")
@@ -37,94 +51,20 @@ export class TaskCallbacks {
         for (const run of this.store.listPendingCallbacks(now))
             void this.deliver(run);
     }
-    /** Delivers the candidate and, in the same system input, every other
-     * deliverable callback aimed at the same session: one model turn drains the
-     * backlog instead of one turn per run. */
+    /** Delivers the candidate together with every other deliverable callback
+     * aimed at the same session. */
     async deliver(candidate) {
-        if (this.delivering.has(candidate.id))
-            return;
         const first = this.store.getRun(candidate.id);
         if (!first?.callbackSessionId || (first.callbackState !== "pending" && first.callbackState !== "failed"))
             return;
         const sessionId = first.callbackSessionId;
-        // Ignore retry due-times when sweeping the batch: once one callback is
+        // Retry due-times are ignored when sweeping the batch: once one callback is
         // deliverable, everything pending for the session rides along.
-        const batch = this.store.listPendingCallbacks(Number.MAX_SAFE_INTEGER).filter((run) => run.callbackSessionId === sessionId && !this.delivering.has(run.id));
+        const batch = this.store.listPendingCallbacks(Number.MAX_SAFE_INTEGER)
+            .filter((run) => run.callbackSessionId === sessionId);
         if (!batch.some((run) => run.id === first.id))
             return;
-        for (const run of batch)
-            this.delivering.add(run.id);
-        try {
-            const session = await this.router.ensure({ channelId: "task", conversationId: sessionId });
-            // Crash-window idempotency: any run id already present in a persisted
-            // callback input (single or batched) must not be sent again.
-            const seen = new Set();
-            for (const turn of await session.history()) {
-                if (turn.role !== "system" || turn.origin?.kind !== "task-callback")
-                    continue;
-                for (const id of turn.origin.runIds ?? [turn.origin.runId])
-                    seen.add(id);
-            }
-            const fresh = batch.filter((run) => !seen.has(run.id));
-            // Waiting for a busy target is not a delivery attempt: counting it would
-            // inflate `callbackAttempts` once per second and skip the real failure
-            // backoff straight to its ceiling.
-            if (fresh.length > 0 && session.state === "streaming") {
-                for (const run of batch) {
-                    run.callbackNextAttemptAt = Date.now() + 1000;
-                    this.store.saveRun(run);
-                }
-                return;
-            }
-            for (const run of batch) {
-                run.callbackAttempts += 1;
-                run.callbackState = "pending";
-                run.callbackError = null;
-                this.store.saveRun(run);
-            }
-            // `systemInput` resolves when the turn it triggers settles, not when Pi
-            // accepts the input — so mark delivered first and let a rejection below
-            // flip it to failed. Otherwise a recipient turn that runs for minutes
-            // leaves the run "pending" and a restart in that window re-delivers.
-            const sent = fresh.length > 0
-                ? session.systemInput(this.text(fresh), {
-                    kind: "task-callback",
-                    taskId: fresh[0].taskId,
-                    runId: fresh[0].id,
-                    sourceSessionId: fresh[0].targetSessionId,
-                    runIds: fresh.map((run) => run.id),
-                }, "followUp")
-                : Promise.resolve();
-            for (const run of batch) {
-                run.callbackState = "delivered";
-                run.callbackNextAttemptAt = null;
-                this.store.saveRun(run);
-                this.changed(run);
-            }
-            if (fresh.length > 0) {
-                log.debug(`callback for ${fresh.map((run) => run.id).join(", ")} → session ${sessionId}`);
-            }
-            await sent;
-        }
-        catch (error) {
-            // The delegating agent is waiting for an answer that is now late: the
-            // retry is silent, so this line is the only sign it is being retried.
-            log.warn(`callback to session ${sessionId} failed, will retry`, error);
-            for (const stale of batch) {
-                const run = this.store.getRun(stale.id);
-                if (!run)
-                    continue;
-                run.callbackState = "failed";
-                run.callbackError = String(error);
-                run.callbackNextAttemptAt = Date.now() + Math.min(60_000, 1000 * 2 ** Math.min(run.callbackAttempts, 6));
-                this.store.saveRun(run);
-                this.changed(run);
-            }
-        }
-        finally {
-            for (const run of batch)
-                this.delivering.delete(run.id);
-        }
+        await this.outbox.deliver(sessionId, batch);
     }
     text(runs) {
         const sections = runs.map((run) => [

package/dist/tasks/definitions.js

@@ -45,6 +45,8 @@ function parseTrigger(raw) {
     }
     throw new Error("unknown trigger type");
 }
+/** Always computed from `from` (boot recomputes from *now*): cron runs missed
+ *  while Pier was down are skipped, never caught up — no double fire. */
 export function nextRunAt(trigger, from) {
     if (trigger.type === "manual")
         return null;
@@ -266,12 +268,6 @@ export class TaskDefinitions {
                 await this.assertDirectory(cwd);
             session = { mode: "fork", ...(cwd ? { cwd } : {}) };
         }
-        else if (typeof raw.sessionId === "string" && raw.sessionId.trim()) {
-            const sessionId = raw.sessionId.trim();
-            if (!(await this.sessionExists(sessionId)))
-                throw new Error(`unknown session: ${sessionId}`);
-            session = { mode: "reuse", sessionId };
-        }
         else {
             // Validation never mutates: a dedicated session is created explicitly
             // (POST /api/sessions) and then referenced with mode:"reuse".