@timqi/pier 0.0.16 → 0.0.19

package/dist/core/reply.js

@@ -216,3 +216,67 @@ export function splitReply(rawMarkdown, meta) {
         return { text: markdown, suggestions: [], meta, silence };
     return { text: markdown.slice(0, m.index).trimEnd(), suggestions, meta, silence };
 }
+/**
+ * The body of a block that is still being written, for a surface rendering it
+ * before the turn ends: everything `splitReply` repairs, minus the next-step
+ * block. That block is only a next-step block at the very *end* of a turn, so
+ * text a later paragraph has already closed behind keeps it as body — which is
+ * what the final render will do with it too.
+ */
+export const streamBody = (markdown) => cjkFriendly(markdown.replace(SILENT, "").trim());
+/** Lines a blank line does not necessarily separate: a list item, a quote and
+ *  an indented continuation all survive one — a loose list is still one list.
+ *  Deliberately over-matching (`*` and `-` also catch emphasis and a rule):
+ *  claiming one boundary too few costs nothing but a repaint. */
+const CONTINUES = /^(?:\s|[-*+>]|\d+[.)])/;
+/**
+ * How much of `markdown` after `from` can no longer change as more text
+ * arrives: the offset just past the last blank line that closes a block, or
+ * `from` if there is none.
+ *
+ * Streaming markdown is the caller. Re-parsing the whole reply on every
+ * repaint costs O(N²) over a turn, so the web chat renders each closed prefix
+ * once and keeps its DOM. A boundary is therefore only claimed where parsing
+ * the two sides separately renders the same as parsing them together: never
+ * inside a backtick or tilde fence, inside a block stripped on completion, or
+ * between two lines a blank line leaves in the same list or quote. Fence runs
+ * keep their length as in `channels/chunk.ts`: a ```` fence is not closed by
+ * the ``` it quotes.
+ */
+export function stableBlockEnd(markdown, from = 0) {
+    // The last line is still growing, so it decides nothing — not the fence
+    // state, and not whether the blank line above it ended a block.
+    const end = markdown.lastIndexOf("\n") + 1;
+    /** Marker run of the fence currently open; empty = closed. */
+    let open = "";
+    let silent = false;
+    let cut = from;
+    /** Start of the block after a blank line, waiting for its first line. */
+    let pending = -1;
+    let prev = "";
+    for (let at = from; at < end;) {
+        const nl = markdown.indexOf("\n", at);
+        const line = markdown.slice(at, nl);
+        at = nl + 1;
+        const fence = /^\s*(`{3,}|~{3,})(.*)$/.exec(line);
+        if (!open && !silent && !line.trim()) {
+            if (pending < 0 && prev)
+                pending = at;
+            continue;
+        }
+        if (!open && !silent && pending >= 0 && !(CONTINUES.test(prev) && CONTINUES.test(line)))
+            cut = pending;
+        const run = fence?.[1] ?? "";
+        if (!open && run && !silent)
+            open = run;
+        else if (open && run[0] === open[0] && run.length >= open.length && !fence?.[2]?.trim())
+            open = "";
+        if (!open && (!run || silent)) {
+            for (const tag of line.matchAll(/<(\/?)silent>/gi))
+                silent = !tag[1];
+        }
+        pending = -1;
+        prev = line;
+    }
+    return cut;
+}

package/dist/db.js

@@ -253,8 +253,102 @@ const MIGRATIONS = [
     token TEXT NOT NULL,
     heartbeat_at INTEGER NOT NULL
   );
+  `,
+    // 13 — a signed-in browser can be signed out on its own (web/auth.ts).
+    `
+  -- One row per signed-in browser. The cookie carries "<id>.<token>" and only
+  -- the token's SHA-256 is stored, so a copy of this database cannot be turned
+  -- into a session — and deleting a row is what revocation is. seen_at is the
+  -- whole lifetime: the session ends one TTL after it, so there is no second
+  -- column that can disagree about when.
+  CREATE TABLE web_sessions (
+    id TEXT PRIMARY KEY,
+    token_hash TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    seen_at INTEGER NOT NULL,
+    ip TEXT NOT NULL,
+    agent TEXT NOT NULL
+  );
+  `,
+    // 14 — signing a browser out also stops notifying it (web/push.ts).
+    `
+  -- A subscription belongs to the web session that made it, and dies with it:
+  -- the cascade is the rule, so no code has to remember to run it — revoking a
+  -- session, changing the password and recovering it all reach here for free.
+  -- Rebuilt rather than altered because a foreign key cannot be added to an
+  -- existing table; nothing is carried over, since migration 13 invalidated
+  -- every cookie and each of these rows belongs to a browser that is now
+  -- signed out. A browser re-subscribes on its next load.
+  DROP TABLE push_subscriptions;
+  CREATE TABLE push_subscriptions (
+    endpoint TEXT PRIMARY KEY,
+    p256dh TEXT NOT NULL,
+    auth TEXT NOT NULL,
+    label TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    session_id TEXT NOT NULL REFERENCES web_sessions(id) ON DELETE CASCADE
+  );
+  `,
+    // 15 — the scheduler's tick stops reading the rows it cannot deliver.
+    `
+  -- Once a second, tasks/ asks for the runs whose callback is still owed and
+  -- the messages whose injection has not landed. Both are a handful of rows
+  -- filtered on one low-cardinality column, and without an index both are a
+  -- full scan of a table that only grows — the sweep got slower with every
+  -- run that finished cleanly and can never match again.
+  CREATE INDEX task_runs_callback_state ON task_runs(callback_state);
+  CREATE INDEX task_messages_state ON task_messages(state);
+  `,
+    // 16 — the same tick stops parsing every task document to find none due.
+    `
+  -- When a task is next due is the one field the scheduler asks about once a
+  -- second, and it lived only inside the JSON: answering meant reading and
+  -- parsing every definition, due or not. A generated column keeps the JSON
+  -- as the only record while giving the query planner a value it can index; a
+  -- disabled or archived task has no next run, so NULLs stay out of the index.
+  ALTER TABLE tasks ADD COLUMN next_run_at INTEGER
+    GENERATED ALWAYS AS (json_extract(json, '$.nextRunAt')) VIRTUAL;
+  CREATE INDEX tasks_due ON tasks(next_run_at) WHERE next_run_at IS NOT NULL;
   `,
 ];
+/**
+ * Several writes as one, or none. `BEGIN IMMEDIATE` because every writer here
+ * competes with another Pier process on the same file: taking the write lock
+ * up front turns a race into a wait, where deferred would turn it into
+ * SQLITE_BUSY halfway through. The rollback is the reason this is shared —
+ * three modules had written the same seven lines, and a `catch` that forgets
+ * to roll back leaves the connection in a transaction forever.
+ */
+export function transact(db, work) {
+    db.exec("BEGIN IMMEDIATE");
+    try {
+        const result = work();
+        db.exec("COMMIT");
+        return result;
+    }
+    catch (err) {
+        db.exec("ROLLBACK");
+        throw err;
+    }
+}
+/**
+ * Prepared statements, memoized by their SQL. `prepare()` compiles, and the
+ * callers here hand it the same handful of strings forever — twice per
+ * authenticated request, once a second per scheduler sweep. A `StatementSync`
+ * is reusable with different bound parameters, so one per SQL string per
+ * connection is the whole cache. Bound to the connection because a statement
+ * belongs to the database that compiled it; SQL built per call does not
+ * belong in here, since the cache would then grow without a bound.
+ */
+export function statements(db) {
+    const cache = new Map();
+    return (sql) => {
+        let stmt = cache.get(sql);
+        if (!stmt)
+            cache.set(sql, (stmt = db.prepare(sql)));
+        return stmt;
+    };
+}
 let shared;
 /**
  * The process's one connection, opened and migrated on first use. Every store
@@ -295,6 +389,17 @@ export function openDb(path, migrations = MIGRATIONS) {
     // file, and SQLite refuses to change it inside one.
     db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
     db.exec("PRAGMA journal_mode = WAL");
+    // WAL's default leaves every commit waiting on an fsync, and DatabaseSync is
+    // synchronous — that wait is the event loop's. NORMAL still survives a
+    // process crash; only a power loss can cost the last transactions, which for
+    // routing state and task bookkeeping is a fair trade for not blocking.
+    db.exec("PRAGMA synchronous = NORMAL");
+    // Off by default in SQLite, and a declared relationship nothing enforces is
+    // a comment. Set before migrate(): it is a per-connection switch and a no-op
+    // inside a transaction. Nothing older declares a key, so this changes the
+    // behaviour of exactly one table — push_subscriptions, whose rows must not
+    // outlive the session that made them.
+    db.exec("PRAGMA foreign_keys = ON");
     migrate(db, path, migrations);
     if (path !== ":memory:")
         restrict(path);

package/dist/main.js

@@ -345,6 +345,7 @@ app.route("/", createServer({
     onUnlocked: () => void startChannels(),
     reload: () => reloadInstance(true),
     backgroundRuns: (id) => tasks.backgroundRuns(id),
+    activeBackgroundRunCounts: () => tasks.activeBackgroundRunCounts(),
     channelOf: (id) => conversations.channelOf(id),
 }));
 const port = Number(process.env.PORT ?? 3141);

package/dist/secrets.js

@@ -119,6 +119,15 @@ export class Secrets {
         this.#file = next;
         log.info(`KEK rotated (${mode} mode, dek ${file.dekId} unchanged)`);
     }
+    /**
+     * What vt says about itself. A refused or impossible unlock is almost never
+     * Pier's fault — missing binary, no agent listening, config pointing
+     * elsewhere — and `lockedReason` only carries the last error. Read-only, so
+     * it is safe to run while locked; vt's own report is the repair instruction.
+     */
+    doctor() {
+        return this.vt.doctor();
+    }
     /** First boot: random KEK and DEK, file mode. */
     #create() {
         const kek = randomBytes(KEY_BYTES);
@@ -172,20 +181,23 @@ export const vtCli = {
             throw new Error("vt create printed no vt:// record");
         return record;
     },
+    // Bounded: doctor probes an agent socket and a worker over the network, and
+    // a hung probe would leave the Console waiting on a diagnosis forever.
+    doctor: () => run("vt", ["doctor"], undefined, 15_000),
 };
-function run(cmd, args, stdin) {
+function run(cmd, args, stdin, timeoutMs) {
     return new Promise((resolvePromise, reject) => {
-        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"], timeout: timeoutMs });
         let out = "";
         let err = "";
         child.stdout.on("data", (d) => (out += d.toString()));
         child.stderr.on("data", (d) => (err += d.toString()));
         child.on("error", reject);
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
             if (code === 0)
-                resolvePromise(out.trim());
-            else
-                reject(new Error(`${cmd} ${args[0]} exited ${code}: ${err.trim() || out.trim()}`));
+                return resolvePromise(out.trim());
+            const how = signal ? `timed out after ${timeoutMs}ms (${signal})` : `exited ${code}`;
+            reject(new Error(`${cmd} ${args[0]} ${how}: ${err.trim() || out.trim()}`));
         });
         child.stdin.on("error", reject); // EPIPE if vt exits before reading
         if (stdin !== undefined)

package/dist/settings.js

@@ -7,7 +7,7 @@
 // too" — the agent is told the URL in its system prompt (core/reply.ts), and
 // nothing outside this process ever opened that file.
 import { isThinkingLevel } from "./core/types.js";
-import { pierDb } from "./db.js";
+import { pierDb, transact } from "./db.js";
 import { logger } from "./log.js";
 // The one place the custom-tool vocabulary lives (names, ubix sources, the
 // names Pier already owns). Imported rather than copied: a second validator
@@ -201,16 +201,7 @@ export class SettingsStore {
      * declared and invisible.
      */
     transact(work) {
-        this.#db.exec("BEGIN IMMEDIATE");
-        try {
-            const result = work();
-            this.#db.exec("COMMIT");
-            return result;
-        }
-        catch (err) {
-            this.#db.exec("ROLLBACK");
-            throw err;
-        }
+        return transact(this.#db, work);
     }
     #set(key, value) {
         this.#db.prepare(`

package/dist/tasks/agent.js

@@ -74,9 +74,17 @@ export class AgentTaskRunner {
                 run.context.renderedPrompt = prompt;
                 this.store.saveRun(run);
                 let text = "";
+                // Not only what the turn said but how it ended: a provider outage ends
+                // it with an empty reply, and a run that settles on that reports "no
+                // reply" — the one wording for a turn that *chose* to say nothing, so
+                // the outage arrives at the caller looking like an answer (§5b). Pi has
+                // already retried by the time this lands; the run only reports.
+                let failure;
                 const unsubscribe = session.subscribe((event) => {
-                    if (event.type === "turn-end")
+                    if (event.type === "turn-end") {
                         text = event.text;
+                        failure = event.error;
+                    }
                 });
                 // The race below also settles this attempt if Pi ignores the abort:
                 // a hung turn must not hold one of the 4 slots (and its waiters)
@@ -106,6 +114,11 @@ export class AgentTaskRunner {
                     await Promise.race([turn, abortedTurn]);
                     if (signal.aborted)
                         throw new Error("cancelled");
+                    // Before the fallback below: on a reused session that reads the
+                    // *previous* turn's answer back out of history and reports it as
+                    // this run's result.
+                    if (failure)
+                        throw new Error(failure);
                     if (!text) {
                         const history = await session.history();
                         text = [...history].reverse().find((turn) => turn.role === "assistant")?.text ?? "";

package/dist/tasks/definitions.js

@@ -228,7 +228,9 @@ export class TaskDefinitions {
     }
     claimDue(now) {
         const due = [];
-        for (const task of this.store.listTasks()) {
+        // The store narrows to the tasks with a next run at or before `now`; the
+        // JSON is still the record, so its own fields decide.
+        for (const task of this.store.listDueTasks(now)) {
             if (!task.enabled || task.archived || task.nextRunAt === null || task.nextRunAt > now)
                 continue;
             task.nextRunAt = nextRunAt(task.trigger, now);

package/dist/tasks/messages.js

@@ -84,8 +84,7 @@ export class TaskMessenger {
      * `inject` dedupes on the recipient transcript, so a retry cannot double
      * deliver. Controls aimed at a finished run are dead and expire here. */
     retryUndelivered(now = Date.now()) {
-        for (const message of this.store.listUndeliveredMessages()) {
-            const run = this.store.getRun(message.runId);
+        for (const { message, run } of this.store.listUndeliveredMessages()) {
             if (!run)
                 continue;
             // Expiring a dead control is not a retry, so it ignores the backoff.

package/dist/tasks/service.js

@@ -198,6 +198,11 @@ export class TaskService {
             .reverse()
             .map((run) => this.backgroundRun(run));
     }
+    /** The same runs `backgroundRuns` reports as in flight, counted per session
+     *  in one query — a list needs the number, not the runs. */
+    activeBackgroundRunCounts() {
+        return this.store.countActiveBackgroundRunsBySession();
+    }
     run(taskId, input = null, source = "manual", parentRunId = null, provenance = {}) {
         this.refusePaused(parentRunId);
         const task = this.get(taskId);

package/dist/tasks/store.js

@@ -2,22 +2,23 @@
 // runs, groups and messages are rows here, read and written through one
 // connection db.ts opened. A store owns its queries, never its own tables or
 // its own handle — the schema is db.ts's migration list.
-import { pierDb } from "../db.js";
+import { pierDb, statements } from "../db.js";
 const clamp = (limit, cap) => Math.min(Math.max(limit, 1), cap);
 export class TaskStore {
-    db;
+    /** Every query below is a fixed string, so each is compiled once. */
+    sql;
     constructor(db = pierDb()) {
-        this.db = db;
+        this.sql = statements(db);
     }
     // Every table is one JSON column plus query columns; these two are the only
     // readers, and the one seam where a future schema change normalizes old rows
     // (pre-v1 databases are refused outright in db.ts).
     #one(sql, ...params) {
-        const row = this.db.prepare(sql).get(...params);
+        const row = this.sql(sql).get(...params);
         return row ? JSON.parse(row.json) : undefined;
     }
     #many(sql, ...params) {
-        return this.db.prepare(sql).all(...params)
+        return this.sql(sql).all(...params)
             .map((row) => JSON.parse(row.json));
     }
     listTasks() {
@@ -27,11 +28,17 @@ export class TaskStore {
         return this.#one("SELECT json FROM tasks WHERE id = ?", id);
     }
     saveTask(task) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO tasks(id, updated_at, json) VALUES (?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET updated_at=excluded.updated_at, json=excluded.json
     `).run(task.id, task.updatedAt, JSON.stringify(task));
     }
+    /** The tick's whole question, asked of the index rather than of every
+     *  document: a task with no next run (disabled, archived, manual) is not in
+     *  it, so an idle second reads no row. */
+    listDueTasks(now) {
+        return this.#many("SELECT json FROM tasks WHERE next_run_at IS NOT NULL AND next_run_at <= ?", now);
+    }
     listRuns(taskId, limit = 50, offset = 0) {
         return this.#many(`
       SELECT json FROM task_runs WHERE task_id = ?
@@ -42,7 +49,7 @@ export class TaskStore {
         return this.#one("SELECT json FROM task_runs WHERE id = ?", id);
     }
     saveRun(run) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_runs(id, task_id, queued_at, state, callback_state, json)
       VALUES (?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
@@ -60,7 +67,7 @@ export class TaskStore {
     `, rootRunId, clamp(limit, 500));
     }
     countActiveRuns() {
-        const row = this.db.prepare("SELECT COUNT(*) AS n FROM task_runs WHERE state IN ('queued', 'running')").get();
+        const row = this.sql("SELECT COUNT(*) AS n FROM task_runs WHERE state IN ('queued', 'running')").get();
         return row.n;
     }
     findActiveRun(taskId) {
@@ -77,6 +84,20 @@ export class TaskStore {
       ORDER BY CASE state WHEN 'running' THEN 0 ELSE 1 END, queued_at DESC LIMIT 1
     `, sessionId);
     }
+    /** How many background runs each session has in flight, for a list that
+     *  draws one dot per row: the state column narrows the scan to the handful
+     *  of live runs, and no row's JSON is parsed. */
+    countActiveBackgroundRunsBySession() {
+        const rows = this.sql(`
+      SELECT json_extract(json, '$.invokedBySessionId') AS session_id, COUNT(*) AS n
+      FROM task_runs
+      WHERE state IN ('queued', 'running')
+        AND json_extract(json, '$.background') = 1
+        AND json_extract(json, '$.invokedBySessionId') IS NOT NULL
+      GROUP BY session_id
+    `).all();
+        return new Map(rows.map((row) => [row.session_id, row.n]));
+    }
     listRunsForSession(sessionId, limit = 50) {
         return this.#many(`
       SELECT json FROM task_runs
@@ -85,7 +106,7 @@ export class TaskStore {
     `, sessionId, clamp(limit, 200));
     }
     saveGroup(group) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_groups(id, created_at, callback_state, finished_at, json)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
@@ -107,7 +128,7 @@ export class TaskStore {
     `, now);
     }
     saveMessage(message) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_messages(id, run_id, state, created_at, json)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET state=excluded.state, json=excluded.json
@@ -122,9 +143,20 @@ export class TaskStore {
     listRecentMessages(since) {
         return this.#many("SELECT json FROM task_messages WHERE created_at >= ? ORDER BY created_at DESC LIMIT 200", since);
     }
-    /** Messages whose injection never landed: the delivery sweep retries these. */
+    /** Messages whose injection never landed, each beside the run it belongs to:
+     *  the delivery sweep needs both, and fetching the run per message made one
+     *  sweep cost a query per undelivered message. A message whose run is gone
+     *  comes back with `run: undefined` — the sweep drops it. */
     listUndeliveredMessages() {
-        return this.#many("SELECT json FROM task_messages WHERE state IN ('pending', 'failed') ORDER BY created_at");
+        const rows = this.sql(`
+      SELECT m.json AS json, r.json AS run_json
+      FROM task_messages m LEFT JOIN task_runs r ON r.id = m.run_id
+      WHERE m.state IN ('pending', 'failed') ORDER BY m.created_at
+    `).all();
+        return rows.map((row) => ({
+            message: JSON.parse(row.json),
+            run: row.run_json === null ? undefined : JSON.parse(row.run_json),
+        }));
     }
     /** Decisions are excluded: they have no timeout and stay answerable across
      * restarts — a reply to a terminal run resumes it. */

package/dist/tools.js

@@ -16,7 +16,7 @@ import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { delimiter, join } from "node:path";
-import { pierDb } from "./db.js";
+import { pierDb, transact } from "./db.js";
 import { logger } from "./log.js";
 import { pierPath, resolveAgentDir } from "./paths.js";
 const log = logger("tools");
@@ -188,6 +188,10 @@ export function prependPath(env = process.env, bin = toolsBin()) {
     mkdirSync(bin, { recursive: true }); // a PATH entry that does not exist is a shell's problem
     env.PATH = current ? `${bin}${delimiter}${current}` : bin;
 }
+/** How long `ubix list --json` stays usable for `status()`: long enough that
+ *  one Console page open spawns it once, short enough that an install done
+ *  outside Pier shows up while the operator is still looking at the page. */
+const LIST_TTL_MS = 3_000;
 /** `stale` is heartbeat age, never how long the work has taken; `wait` is what
  *  a waiter gives a live holder before giving up with a reason. */
 const LOCK_TIMING = { heartbeatMs: 5_000, staleMs: 30_000, waitMs: 20 * 60_000, pollMs: 200 };
@@ -253,21 +257,15 @@ export class SyncLock {
      *  in one immediate transaction, so two waiters cannot both win. */
     #acquire(token) {
         const now = Date.now();
-        this.#db.exec("BEGIN IMMEDIATE");
-        try {
-            const stale = this.#db.prepare("DELETE FROM tools_sync_lock WHERE heartbeat_at <= ?")
-                .run(now - this.#timing.staleMs);
-            const taken = this.#db.prepare("INSERT OR IGNORE INTO tools_sync_lock (id, token, heartbeat_at) VALUES (1, ?, ?)")
-                .run(token, now);
-            this.#db.exec("COMMIT");
-            if (stale.changes && taken.changes)
-                log.warn("took over a tools sync lock whose holder stopped beating");
-            return taken.changes === 1;
-        }
-        catch (err) {
-            this.#db.exec("ROLLBACK");
-            throw err;
-        }
+        const { stale, taken } = transact(this.#db, () => ({
+            stale: this.#db.prepare("DELETE FROM tools_sync_lock WHERE heartbeat_at <= ?")
+                .run(now - this.#timing.staleMs),
+            taken: this.#db.prepare("INSERT OR IGNORE INTO tools_sync_lock (id, token, heartbeat_at) VALUES (1, ?, ?)")
+                .run(token, now),
+        }));
+        if (stale.changes && taken.changes)
+            log.warn("took over a tools sync lock whose holder stopped beating");
+        return taken.changes === 1;
     }
     /** Still ours? The authority is the row, asked now — not the heartbeat's own
      *  bookkeeping, which a stopped process does not get to run either. */
@@ -612,7 +610,15 @@ export class ManagedTools {
         this.#lock ??= new SyncLock(this.#db());
         return this.#lock.run(async (fence) => {
             const { tools, customTools } = read();
-            return this.#converge(tools, customTools, fence);
+            // This run is the only thing here that changes what `list` answers, so
+            // the memo `status()` reads is dropped on both sides of it.
+            this.#listed = undefined;
+            try {
+                return await this.#converge(tools, customTools, fence);
+            }
+            finally {
+                this.#listed = undefined;
+            }
         });
     }
     async #converge(enabled, custom, fence) {
@@ -704,7 +710,7 @@ export class ManagedTools {
             return base;
         let states;
         try {
-            states = await this.#states(this.ubixPath, this.#env(), ["list", "--json"]);
+            states = await this.#listedTools();
         }
         catch (err) {
             // The page says why it cannot answer rather than answering wrongly: a
@@ -739,6 +745,24 @@ export class ManagedTools {
             });
         });
     }
+    /** What `ubix list --json` last said, retained for LIST_TTL_MS. It is a
+     *  subprocess, and the Console asks for the catalog on every settings read —
+     *  one page open is several, each of which spawned its own ubix. A failed
+     *  read is not retained: it is not an answer to hand the next caller for
+     *  three seconds. */
+    #listed;
+    #listedTools() {
+        const now = Date.now();
+        if (this.#listed && now - this.#listed.at < LIST_TTL_MS)
+            return this.#listed.states;
+        const states = this.#states(this.ubixPath, this.#env(), ["list", "--json"]);
+        void states.catch(() => {
+            if (this.#listed?.states === states)
+                this.#listed = undefined;
+        });
+        this.#listed = { at: now, states };
+        return states;
+    }
     /** Pier's ubix config and state, never the operator's. `UBIX_CONFIG_DIR` /
      *  `UBIX_DATA_DIR` name the directories that hold config.toml / state.toml
      *  directly — not XDG parents, which every child ubix spawns (uv, fnm,