@timqi/pier 0.0.17 → 0.0.19

package/dist/core/reply.js

@@ -216,3 +216,67 @@ export function splitReply(rawMarkdown, meta) {
         return { text: markdown, suggestions: [], meta, silence };
     return { text: markdown.slice(0, m.index).trimEnd(), suggestions, meta, silence };
 }
+/**
+ * The body of a block that is still being written, for a surface rendering it
+ * before the turn ends: everything `splitReply` repairs, minus the next-step
+ * block. That block is only a next-step block at the very *end* of a turn, so
+ * text a later paragraph has already closed behind keeps it as body — which is
+ * what the final render will do with it too.
+ */
+export const streamBody = (markdown) => cjkFriendly(markdown.replace(SILENT, "").trim());
+/** Lines a blank line does not necessarily separate: a list item, a quote and
+ *  an indented continuation all survive one — a loose list is still one list.
+ *  Deliberately over-matching (`*` and `-` also catch emphasis and a rule):
+ *  claiming one boundary too few costs nothing but a repaint. */
+const CONTINUES = /^(?:\s|[-*+>]|\d+[.)])/;
+/**
+ * How much of `markdown` after `from` can no longer change as more text
+ * arrives: the offset just past the last blank line that closes a block, or
+ * `from` if there is none.
+ *
+ * Streaming markdown is the caller. Re-parsing the whole reply on every
+ * repaint costs O(N²) over a turn, so the web chat renders each closed prefix
+ * once and keeps its DOM. A boundary is therefore only claimed where parsing
+ * the two sides separately renders the same as parsing them together: never
+ * inside a backtick or tilde fence, inside a block stripped on completion, or
+ * between two lines a blank line leaves in the same list or quote. Fence runs
+ * keep their length as in `channels/chunk.ts`: a ```` fence is not closed by
+ * the ``` it quotes.
+ */
+export function stableBlockEnd(markdown, from = 0) {
+    // The last line is still growing, so it decides nothing — not the fence
+    // state, and not whether the blank line above it ended a block.
+    const end = markdown.lastIndexOf("\n") + 1;
+    /** Marker run of the fence currently open; empty = closed. */
+    let open = "";
+    let silent = false;
+    let cut = from;
+    /** Start of the block after a blank line, waiting for its first line. */
+    let pending = -1;
+    let prev = "";
+    for (let at = from; at < end;) {
+        const nl = markdown.indexOf("\n", at);
+        const line = markdown.slice(at, nl);
+        at = nl + 1;
+        const fence = /^\s*(`{3,}|~{3,})(.*)$/.exec(line);
+        if (!open && !silent && !line.trim()) {
+            if (pending < 0 && prev)
+                pending = at;
+            continue;
+        }
+        if (!open && !silent && pending >= 0 && !(CONTINUES.test(prev) && CONTINUES.test(line)))
+            cut = pending;
+        const run = fence?.[1] ?? "";
+        if (!open && run && !silent)
+            open = run;
+        else if (open && run[0] === open[0] && run.length >= open.length && !fence?.[2]?.trim())
+            open = "";
+        if (!open && (!run || silent)) {
+            for (const tag of line.matchAll(/<(\/?)silent>/gi))
+                silent = !tag[1];
+        }
+        pending = -1;
+        prev = line;
+    }
+    return cut;
+}

package/dist/db.js

@@ -288,6 +288,27 @@ const MIGRATIONS = [
     created_at INTEGER NOT NULL,
     session_id TEXT NOT NULL REFERENCES web_sessions(id) ON DELETE CASCADE
   );
+  `,
+    // 15 — the scheduler's tick stops reading the rows it cannot deliver.
+    `
+  -- Once a second, tasks/ asks for the runs whose callback is still owed and
+  -- the messages whose injection has not landed. Both are a handful of rows
+  -- filtered on one low-cardinality column, and without an index both are a
+  -- full scan of a table that only grows — the sweep got slower with every
+  -- run that finished cleanly and can never match again.
+  CREATE INDEX task_runs_callback_state ON task_runs(callback_state);
+  CREATE INDEX task_messages_state ON task_messages(state);
+  `,
+    // 16 — the same tick stops parsing every task document to find none due.
+    `
+  -- When a task is next due is the one field the scheduler asks about once a
+  -- second, and it lived only inside the JSON: answering meant reading and
+  -- parsing every definition, due or not. A generated column keeps the JSON
+  -- as the only record while giving the query planner a value it can index; a
+  -- disabled or archived task has no next run, so NULLs stay out of the index.
+  ALTER TABLE tasks ADD COLUMN next_run_at INTEGER
+    GENERATED ALWAYS AS (json_extract(json, '$.nextRunAt')) VIRTUAL;
+  CREATE INDEX tasks_due ON tasks(next_run_at) WHERE next_run_at IS NOT NULL;
   `,
 ];
 /**
@@ -310,6 +331,24 @@ export function transact(db, work) {
         throw err;
     }
 }
+/**
+ * Prepared statements, memoized by their SQL. `prepare()` compiles, and the
+ * callers here hand it the same handful of strings forever — twice per
+ * authenticated request, once a second per scheduler sweep. A `StatementSync`
+ * is reusable with different bound parameters, so one per SQL string per
+ * connection is the whole cache. Bound to the connection because a statement
+ * belongs to the database that compiled it; SQL built per call does not
+ * belong in here, since the cache would then grow without a bound.
+ */
+export function statements(db) {
+    const cache = new Map();
+    return (sql) => {
+        let stmt = cache.get(sql);
+        if (!stmt)
+            cache.set(sql, (stmt = db.prepare(sql)));
+        return stmt;
+    };
+}
 let shared;
 /**
  * The process's one connection, opened and migrated on first use. Every store
@@ -350,6 +389,11 @@ export function openDb(path, migrations = MIGRATIONS) {
     // file, and SQLite refuses to change it inside one.
     db.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}`);
     db.exec("PRAGMA journal_mode = WAL");
+    // WAL's default leaves every commit waiting on an fsync, and DatabaseSync is
+    // synchronous — that wait is the event loop's. NORMAL still survives a
+    // process crash; only a power loss can cost the last transactions, which for
+    // routing state and task bookkeeping is a fair trade for not blocking.
+    db.exec("PRAGMA synchronous = NORMAL");
     // Off by default in SQLite, and a declared relationship nothing enforces is
     // a comment. Set before migrate(): it is a per-connection switch and a no-op
     // inside a transaction. Nothing older declares a key, so this changes the

package/dist/main.js

@@ -345,6 +345,7 @@ app.route("/", createServer({
     onUnlocked: () => void startChannels(),
     reload: () => reloadInstance(true),
     backgroundRuns: (id) => tasks.backgroundRuns(id),
+    activeBackgroundRunCounts: () => tasks.activeBackgroundRunCounts(),
     channelOf: (id) => conversations.channelOf(id),
 }));
 const port = Number(process.env.PORT ?? 3141);

package/dist/secrets.js

@@ -119,6 +119,15 @@ export class Secrets {
         this.#file = next;
         log.info(`KEK rotated (${mode} mode, dek ${file.dekId} unchanged)`);
     }
+    /**
+     * What vt says about itself. A refused or impossible unlock is almost never
+     * Pier's fault — missing binary, no agent listening, config pointing
+     * elsewhere — and `lockedReason` only carries the last error. Read-only, so
+     * it is safe to run while locked; vt's own report is the repair instruction.
+     */
+    doctor() {
+        return this.vt.doctor();
+    }
     /** First boot: random KEK and DEK, file mode. */
     #create() {
         const kek = randomBytes(KEY_BYTES);
@@ -172,20 +181,23 @@ export const vtCli = {
             throw new Error("vt create printed no vt:// record");
         return record;
     },
+    // Bounded: doctor probes an agent socket and a worker over the network, and
+    // a hung probe would leave the Console waiting on a diagnosis forever.
+    doctor: () => run("vt", ["doctor"], undefined, 15_000),
 };
-function run(cmd, args, stdin) {
+function run(cmd, args, stdin, timeoutMs) {
     return new Promise((resolvePromise, reject) => {
-        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"] });
+        const child = spawn(cmd, args, { stdio: ["pipe", "pipe", "pipe"], timeout: timeoutMs });
         let out = "";
         let err = "";
         child.stdout.on("data", (d) => (out += d.toString()));
         child.stderr.on("data", (d) => (err += d.toString()));
         child.on("error", reject);
-        child.on("close", (code) => {
+        child.on("close", (code, signal) => {
             if (code === 0)
-                resolvePromise(out.trim());
-            else
-                reject(new Error(`${cmd} ${args[0]} exited ${code}: ${err.trim() || out.trim()}`));
+                return resolvePromise(out.trim());
+            const how = signal ? `timed out after ${timeoutMs}ms (${signal})` : `exited ${code}`;
+            reject(new Error(`${cmd} ${args[0]} ${how}: ${err.trim() || out.trim()}`));
         });
         child.stdin.on("error", reject); // EPIPE if vt exits before reading
         if (stdin !== undefined)

package/dist/tasks/agent.js

@@ -74,9 +74,17 @@ export class AgentTaskRunner {
                 run.context.renderedPrompt = prompt;
                 this.store.saveRun(run);
                 let text = "";
+                // Not only what the turn said but how it ended: a provider outage ends
+                // it with an empty reply, and a run that settles on that reports "no
+                // reply" — the one wording for a turn that *chose* to say nothing, so
+                // the outage arrives at the caller looking like an answer (§5b). Pi has
+                // already retried by the time this lands; the run only reports.
+                let failure;
                 const unsubscribe = session.subscribe((event) => {
-                    if (event.type === "turn-end")
+                    if (event.type === "turn-end") {
                         text = event.text;
+                        failure = event.error;
+                    }
                 });
                 // The race below also settles this attempt if Pi ignores the abort:
                 // a hung turn must not hold one of the 4 slots (and its waiters)
@@ -106,6 +114,11 @@ export class AgentTaskRunner {
                     await Promise.race([turn, abortedTurn]);
                     if (signal.aborted)
                         throw new Error("cancelled");
+                    // Before the fallback below: on a reused session that reads the
+                    // *previous* turn's answer back out of history and reports it as
+                    // this run's result.
+                    if (failure)
+                        throw new Error(failure);
                     if (!text) {
                         const history = await session.history();
                         text = [...history].reverse().find((turn) => turn.role === "assistant")?.text ?? "";

package/dist/tasks/definitions.js

@@ -228,7 +228,9 @@ export class TaskDefinitions {
     }
     claimDue(now) {
         const due = [];
-        for (const task of this.store.listTasks()) {
+        // The store narrows to the tasks with a next run at or before `now`; the
+        // JSON is still the record, so its own fields decide.
+        for (const task of this.store.listDueTasks(now)) {
             if (!task.enabled || task.archived || task.nextRunAt === null || task.nextRunAt > now)
                 continue;
             task.nextRunAt = nextRunAt(task.trigger, now);

package/dist/tasks/messages.js

@@ -84,8 +84,7 @@ export class TaskMessenger {
      * `inject` dedupes on the recipient transcript, so a retry cannot double
      * deliver. Controls aimed at a finished run are dead and expire here. */
     retryUndelivered(now = Date.now()) {
-        for (const message of this.store.listUndeliveredMessages()) {
-            const run = this.store.getRun(message.runId);
+        for (const { message, run } of this.store.listUndeliveredMessages()) {
             if (!run)
                 continue;
             // Expiring a dead control is not a retry, so it ignores the backoff.

package/dist/tasks/service.js

@@ -198,6 +198,11 @@ export class TaskService {
             .reverse()
             .map((run) => this.backgroundRun(run));
     }
+    /** The same runs `backgroundRuns` reports as in flight, counted per session
+     *  in one query — a list needs the number, not the runs. */
+    activeBackgroundRunCounts() {
+        return this.store.countActiveBackgroundRunsBySession();
+    }
     run(taskId, input = null, source = "manual", parentRunId = null, provenance = {}) {
         this.refusePaused(parentRunId);
         const task = this.get(taskId);

package/dist/tasks/store.js

@@ -2,22 +2,23 @@
 // runs, groups and messages are rows here, read and written through one
 // connection db.ts opened. A store owns its queries, never its own tables or
 // its own handle — the schema is db.ts's migration list.
-import { pierDb } from "../db.js";
+import { pierDb, statements } from "../db.js";
 const clamp = (limit, cap) => Math.min(Math.max(limit, 1), cap);
 export class TaskStore {
-    db;
+    /** Every query below is a fixed string, so each is compiled once. */
+    sql;
     constructor(db = pierDb()) {
-        this.db = db;
+        this.sql = statements(db);
     }
     // Every table is one JSON column plus query columns; these two are the only
     // readers, and the one seam where a future schema change normalizes old rows
     // (pre-v1 databases are refused outright in db.ts).
     #one(sql, ...params) {
-        const row = this.db.prepare(sql).get(...params);
+        const row = this.sql(sql).get(...params);
         return row ? JSON.parse(row.json) : undefined;
     }
     #many(sql, ...params) {
-        return this.db.prepare(sql).all(...params)
+        return this.sql(sql).all(...params)
             .map((row) => JSON.parse(row.json));
     }
     listTasks() {
@@ -27,11 +28,17 @@ export class TaskStore {
         return this.#one("SELECT json FROM tasks WHERE id = ?", id);
     }
     saveTask(task) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO tasks(id, updated_at, json) VALUES (?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET updated_at=excluded.updated_at, json=excluded.json
     `).run(task.id, task.updatedAt, JSON.stringify(task));
     }
+    /** The tick's whole question, asked of the index rather than of every
+     *  document: a task with no next run (disabled, archived, manual) is not in
+     *  it, so an idle second reads no row. */
+    listDueTasks(now) {
+        return this.#many("SELECT json FROM tasks WHERE next_run_at IS NOT NULL AND next_run_at <= ?", now);
+    }
     listRuns(taskId, limit = 50, offset = 0) {
         return this.#many(`
       SELECT json FROM task_runs WHERE task_id = ?
@@ -42,7 +49,7 @@ export class TaskStore {
         return this.#one("SELECT json FROM task_runs WHERE id = ?", id);
     }
     saveRun(run) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_runs(id, task_id, queued_at, state, callback_state, json)
       VALUES (?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
@@ -60,7 +67,7 @@ export class TaskStore {
     `, rootRunId, clamp(limit, 500));
     }
     countActiveRuns() {
-        const row = this.db.prepare("SELECT COUNT(*) AS n FROM task_runs WHERE state IN ('queued', 'running')").get();
+        const row = this.sql("SELECT COUNT(*) AS n FROM task_runs WHERE state IN ('queued', 'running')").get();
         return row.n;
     }
     findActiveRun(taskId) {
@@ -77,6 +84,20 @@ export class TaskStore {
       ORDER BY CASE state WHEN 'running' THEN 0 ELSE 1 END, queued_at DESC LIMIT 1
     `, sessionId);
     }
+    /** How many background runs each session has in flight, for a list that
+     *  draws one dot per row: the state column narrows the scan to the handful
+     *  of live runs, and no row's JSON is parsed. */
+    countActiveBackgroundRunsBySession() {
+        const rows = this.sql(`
+      SELECT json_extract(json, '$.invokedBySessionId') AS session_id, COUNT(*) AS n
+      FROM task_runs
+      WHERE state IN ('queued', 'running')
+        AND json_extract(json, '$.background') = 1
+        AND json_extract(json, '$.invokedBySessionId') IS NOT NULL
+      GROUP BY session_id
+    `).all();
+        return new Map(rows.map((row) => [row.session_id, row.n]));
+    }
     listRunsForSession(sessionId, limit = 50) {
         return this.#many(`
       SELECT json FROM task_runs
@@ -85,7 +106,7 @@ export class TaskStore {
     `, sessionId, clamp(limit, 200));
     }
     saveGroup(group) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_groups(id, created_at, callback_state, finished_at, json)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
@@ -107,7 +128,7 @@ export class TaskStore {
     `, now);
     }
     saveMessage(message) {
-        this.db.prepare(`
+        this.sql(`
       INSERT INTO task_messages(id, run_id, state, created_at, json)
       VALUES (?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET state=excluded.state, json=excluded.json
@@ -122,9 +143,20 @@ export class TaskStore {
     listRecentMessages(since) {
         return this.#many("SELECT json FROM task_messages WHERE created_at >= ? ORDER BY created_at DESC LIMIT 200", since);
     }
-    /** Messages whose injection never landed: the delivery sweep retries these. */
+    /** Messages whose injection never landed, each beside the run it belongs to:
+     *  the delivery sweep needs both, and fetching the run per message made one
+     *  sweep cost a query per undelivered message. A message whose run is gone
+     *  comes back with `run: undefined` — the sweep drops it. */
     listUndeliveredMessages() {
-        return this.#many("SELECT json FROM task_messages WHERE state IN ('pending', 'failed') ORDER BY created_at");
+        const rows = this.sql(`
+      SELECT m.json AS json, r.json AS run_json
+      FROM task_messages m LEFT JOIN task_runs r ON r.id = m.run_id
+      WHERE m.state IN ('pending', 'failed') ORDER BY m.created_at
+    `).all();
+        return rows.map((row) => ({
+            message: JSON.parse(row.json),
+            run: row.run_json === null ? undefined : JSON.parse(row.run_json),
+        }));
     }
     /** Decisions are excluded: they have no timeout and stay answerable across
      * restarts — a reply to a terminal run resumes it. */

package/dist/tools.js

@@ -188,6 +188,10 @@ export function prependPath(env = process.env, bin = toolsBin()) {
     mkdirSync(bin, { recursive: true }); // a PATH entry that does not exist is a shell's problem
     env.PATH = current ? `${bin}${delimiter}${current}` : bin;
 }
+/** How long `ubix list --json` stays usable for `status()`: long enough that
+ *  one Console page open spawns it once, short enough that an install done
+ *  outside Pier shows up while the operator is still looking at the page. */
+const LIST_TTL_MS = 3_000;
 /** `stale` is heartbeat age, never how long the work has taken; `wait` is what
  *  a waiter gives a live holder before giving up with a reason. */
 const LOCK_TIMING = { heartbeatMs: 5_000, staleMs: 30_000, waitMs: 20 * 60_000, pollMs: 200 };
@@ -606,7 +610,15 @@ export class ManagedTools {
         this.#lock ??= new SyncLock(this.#db());
         return this.#lock.run(async (fence) => {
             const { tools, customTools } = read();
-            return this.#converge(tools, customTools, fence);
+            // This run is the only thing here that changes what `list` answers, so
+            // the memo `status()` reads is dropped on both sides of it.
+            this.#listed = undefined;
+            try {
+                return await this.#converge(tools, customTools, fence);
+            }
+            finally {
+                this.#listed = undefined;
+            }
         });
     }
     async #converge(enabled, custom, fence) {
@@ -698,7 +710,7 @@ export class ManagedTools {
             return base;
         let states;
         try {
-            states = await this.#states(this.ubixPath, this.#env(), ["list", "--json"]);
+            states = await this.#listedTools();
         }
         catch (err) {
             // The page says why it cannot answer rather than answering wrongly: a
@@ -733,6 +745,24 @@ export class ManagedTools {
             });
         });
     }
+    /** What `ubix list --json` last said, retained for LIST_TTL_MS. It is a
+     *  subprocess, and the Console asks for the catalog on every settings read —
+     *  one page open is several, each of which spawned its own ubix. A failed
+     *  read is not retained: it is not an answer to hand the next caller for
+     *  three seconds. */
+    #listed;
+    #listedTools() {
+        const now = Date.now();
+        if (this.#listed && now - this.#listed.at < LIST_TTL_MS)
+            return this.#listed.states;
+        const states = this.#states(this.ubixPath, this.#env(), ["list", "--json"]);
+        void states.catch(() => {
+            if (this.#listed?.states === states)
+                this.#listed = undefined;
+        });
+        this.#listed = { at: now, states };
+        return states;
+    }
     /** Pier's ubix config and state, never the operator's. `UBIX_CONFIG_DIR` /
      *  `UBIX_DATA_DIR` name the directories that hold config.toml / state.toml
      *  directly — not XDG parents, which every child ubix spawns (uv, fnm,

package/dist/web/auth.js

@@ -20,7 +20,7 @@
 import { createHash, randomBytes, randomInt, scryptSync, timingSafeEqual } from "node:crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
 import { deleteCookie, getCookie, setCookie } from "hono/cookie";
-import { pierDb, transact } from "../db.js";
+import { pierDb, statements, transact } from "../db.js";
 import { logger } from "../log.js";
 const log = logger("auth");
 const COOKIE = "pier_session";
@@ -67,9 +67,13 @@ function generatePassword() {
  */
 export class AuthStore {
     #db;
+    /** Compiled once each: `check()` runs two of these on every request that
+     *  carries a cookie, which is every request the workbench makes. */
+    #sql;
     #revokeListeners = new Set();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
+        this.#sql = statements(db);
         let row = this.#row();
         if (!row) {
             const password = generatePassword();
@@ -81,8 +85,7 @@ export class AuthStore {
             // in one transaction: half of this leaves a new password and live old
             // cookies, which is the state recovery exists to end.
             transact(this.#db, () => {
-                this.#db
-                    .prepare("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
+                this.#sql("INSERT INTO auth(id, salt, hash, created_at) VALUES (1, ?, ?, ?)")
                     .run(salt, hash(password, salt), Date.now());
                 this.#dropSessions();
             });
@@ -96,14 +99,13 @@ export class AuthStore {
         this.sweep();
     }
     #row() {
-        return this.#db
-            .prepare("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
+        return this.#sql("SELECT salt, hash, created_at AS createdAt FROM auth WHERE id = 1")
             .get();
     }
     /** Every signed-in browser at once. Private: the callers that mean it also
      *  have to tell the listeners, and `revoke(ALL)` is that pair in public. */
     #dropSessions() {
-        this.#db.prepare("DELETE FROM web_sessions").run();
+        this.#sql("DELETE FROM web_sessions").run();
     }
     /** Sessions nobody may use any more, deleted rather than merely refused: a
      *  row is what a push subscription hangs off, so "expired" has to become
@@ -111,8 +113,7 @@ export class AuthStore {
      *  boot and whenever somebody signs in — the two moments the process has a
      *  reason to look at this table at all. */
     sweep() {
-        const swept = this.#db
-            .prepare("DELETE FROM web_sessions WHERE seen_at <= ? RETURNING id")
+        const swept = this.#sql("DELETE FROM web_sessions WHERE seen_at <= ? RETURNING id")
             .all(Date.now() - TTL_MS);
         for (const row of swept)
             this.#revoked(row.id);
@@ -135,8 +136,7 @@ export class AuthStore {
         // Credential and sessions change together or not at all — a crash between
         // the two writes is exactly the state "everyone signs in again" denies.
         transact(this.#db, () => {
-            this.#db
-                .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
+            this.#sql("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
                 .run(salt, hash(password, salt), Date.now());
             this.#dropSessions();
         });
@@ -150,10 +150,8 @@ export class AuthStore {
         // name, and the 256-bit token is the only part that has to resist guessing.
         const id = randomBytes(9).toString("base64url");
         const token = randomBytes(32).toString("base64url");
-        this.#db
-            .prepare("INSERT INTO web_sessions(id, token_hash, created_at, seen_at, ip, agent)" +
-            " VALUES (?, ?, ?, ?, ?, ?)")
-            .run(id, digest(token), now, now, ip, agent.slice(0, 200));
+        this.#sql("INSERT INTO web_sessions(id, token_hash, created_at, seen_at, ip, agent)" +
+            " VALUES (?, ?, ?, ?, ?, ?)").run(id, digest(token), now, now, ip, agent.slice(0, 200));
         return `${id}.${token}`;
     }
     /**
@@ -166,9 +164,7 @@ export class AuthStore {
         const [id, token] = (cookie ?? "").split(".");
         if (!id || !token)
             return undefined;
-        const row = this.#db
-            .prepare("SELECT token_hash AS tokenHash, seen_at AS seenAt FROM web_sessions WHERE id = ?")
-            .get(id);
+        const row = this.#sql("SELECT token_hash AS tokenHash, seen_at AS seenAt FROM web_sessions WHERE id = ?").get(id);
         const now = Date.now();
         // One clock: last use is the deadline, so there is no second column that
         // can disagree with it about when this session ends. An expired row is
@@ -184,7 +180,7 @@ export class AuthStore {
             return undefined;
         if (now - row.seenAt < TOUCH_MS)
             return { id, renewed: false };
-        this.#db.prepare("UPDATE web_sessions SET seen_at = ? WHERE id = ?").run(now, id);
+        this.#sql("UPDATE web_sessions SET seen_at = ? WHERE id = ?").run(now, id);
         return { id, renewed: true };
     }
     /** Sign out one browser, or every one of them (`ALL`). Listeners hear the
@@ -193,16 +189,14 @@ export class AuthStore {
         if (id === ALL)
             this.#dropSessions();
         else
-            this.#db.prepare("DELETE FROM web_sessions WHERE id = ?").run(id);
+            this.#sql("DELETE FROM web_sessions WHERE id = ?").run(id);
         this.#revoked(id);
     }
     /** Signed-in browsers, most recently seen first. Never the token — the list
      *  is shown to whoever is signed in, and it is not a set of credentials. */
     list() {
-        return this.#db
-            .prepare("SELECT id, created_at AS createdAt, seen_at AS seenAt, ip, agent" +
-            " FROM web_sessions WHERE seen_at > ? ORDER BY seen_at DESC")
-            .all(Date.now() - TTL_MS);
+        return this.#sql("SELECT id, created_at AS createdAt, seen_at AS seenAt, ip, agent" +
+            " FROM web_sessions WHERE seen_at > ? ORDER BY seen_at DESC").all(Date.now() - TTL_MS);
     }
     /** A long-lived authenticated surface closes itself when a cookie is
      *  revoked. The store and listeners share the process lifetime. */

package/dist/web/config.js

@@ -0,0 +1,61 @@
+// The agent files a scope is configured by — Pi's own config, skills and
+// extensions — read and written through the ConfigStore, never as paths. A
+// scope is "global" or a project cwd Pi already knows, which is why this is
+// the one filesystem-shaped surface that does not go through web/fs.ts: it
+// never takes a path from the browser at all.
+import { guarded } from "./route.js";
+export function registerConfigRoutes(app, { factory, config, onConfigWritten }) {
+    // Scope comes from the client as "global" or a project cwd; only cwds Pi
+    // already knows (the session list) are accepted — never an arbitrary path.
+    const parseScope = async (raw) => {
+        if (!raw || raw === "global")
+            return { kind: "global" };
+        const known = await factory.list();
+        return known.some((s) => s.cwd === raw) ? { kind: "project", cwd: raw } : null;
+    };
+    app.get("/api/config", async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        return c.json({
+            // Where this scope's files live on disk — the UI labels "Global" with it.
+            dir: scope.kind === "global" ? config.globalDir : scope.cwd,
+            files: await config.listFiles(scope),
+            resources: await config.listResources(scope),
+        });
+    });
+    guarded(app, "GET", "/api/config/files/:name", 400, async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        return c.json({ content: await config.readFile(scope, c.req.param("name")) });
+    });
+    guarded(app, "PUT", "/api/config/files/:name", 400, async (c) => {
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        const body = await c.req.json().catch(() => null);
+        if (typeof body?.content !== "string" || typeof body?.expected !== "string") {
+            return c.json({ error: "content and expected content required" }, 400);
+        }
+        const name = c.req.param("name");
+        await config.writeFile(scope, name, body.content, body.expected);
+        onConfigWritten?.();
+        return c.json({ ok: true, content: await config.readFile(scope, name) });
+    });
+    // Resource names may contain slashes — query params, not path params.
+    guarded(app, "GET", "/api/config/resource", 400, async (c) => {
+        c.header("cache-control", "no-store");
+        const scope = await parseScope(c.req.query("scope"));
+        if (!scope)
+            return c.json({ error: "unknown scope" }, 400);
+        const kind = c.req.query("kind");
+        const name = c.req.query("name");
+        if ((kind !== "extensions" && kind !== "skills") || !name) {
+            return c.json({ error: "kind and name required" }, 400);
+        }
+        return c.json({ content: await config.readResource(scope, kind, name) });
+    });
+}