@timqi/pier 0.0.17 → 0.0.20

package/dist/agent/config-sync.js

@@ -0,0 +1,123 @@
+// Credential-blind projection of the portable agent configuration.
+const MODEL_KEYS = ["id", "name", "reasoning", "input", "cost", "contextWindow", "maxTokens", "api"];
+const COST_KEYS = ["input", "output", "cacheRead", "cacheWrite"];
+function record(value, where) {
+    if (!value || typeof value !== "object" || Array.isArray(value) ||
+        ![Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+        throw new Error(`${where} must be an object`);
+    }
+    return value;
+}
+function only(value, keys, where) {
+    if (Object.keys(value).some((key) => !keys.includes(key))) {
+        throw new Error(`${where} contains unsupported fields`);
+    }
+}
+function modelDefinition(value) {
+    const model = record(value, "model");
+    only(model, MODEL_KEYS, "model");
+    if (typeof model.id !== "string" || !model.id.trim() || model.id !== model.id.trim()) {
+        throw new Error("model id must be a non-empty trimmed string");
+    }
+    if (model.name !== undefined && (typeof model.name !== "string" || !model.name.length))
+        throw new Error("model name must be a non-empty string");
+    if (model.reasoning !== undefined && typeof model.reasoning !== "boolean") {
+        throw new Error("model reasoning must be a boolean");
+    }
+    if (model.api !== undefined && (typeof model.api !== "string" || !/^[a-z][a-z0-9-]*$/.test(model.api))) {
+        throw new Error("model api must be a protocol name");
+    }
+    if (model.input !== undefined && (!Array.isArray(model.input) || !model.input.length ||
+        model.input.some((input) => input !== "text" && input !== "image") ||
+        new Set(model.input).size !== model.input.length)) {
+        throw new Error("model input must contain text or image without duplicates");
+    }
+    for (const key of ["contextWindow", "maxTokens"]) {
+        if (model[key] !== undefined && (typeof model[key] !== "number" || !Number.isSafeInteger(model[key]) || model[key] <= 0)) {
+            throw new Error(`model ${key} must be a positive integer`);
+        }
+    }
+    if (model.cost !== undefined) {
+        const cost = record(model.cost, "model cost");
+        only(cost, COST_KEYS, "model cost");
+        for (const key of COST_KEYS) {
+            if (typeof cost[key] !== "number" || !Number.isFinite(cost[key]) || cost[key] < 0) {
+                throw new Error(`model cost ${key} must be a non-negative finite number`);
+            }
+        }
+    }
+    return structuredClone(model);
+}
+/** Strict import boundary: unknown fields are rejected, never treated as masked secrets. */
+export function normalizeAgentSnapshot(raw) {
+    const snapshot = record(raw, "agent snapshot");
+    only(snapshot, ["files", "providers"], "agent snapshot");
+    const files = record(snapshot.files, "snapshot files");
+    only(files, ["SYSTEM.md", "AGENTS.md"], "snapshot files");
+    for (const name of ["SYSTEM.md", "AGENTS.md"]) {
+        if (files[name] !== null && typeof files[name] !== "string") {
+            throw new Error(`${name} must be a string or null`);
+        }
+    }
+    const providers = Object.fromEntries(Object.entries(record(snapshot.providers, "snapshot providers")).map(([id, value]) => {
+        if (id.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || ["constructor", "prototype"].includes(id)) {
+            throw new Error("invalid snapshot provider id");
+        }
+        const provider = record(value, "snapshot provider");
+        only(provider, ["models"], "snapshot provider");
+        if (!Array.isArray(provider.models))
+            throw new Error("snapshot provider models must be an array");
+        const models = provider.models.map(modelDefinition);
+        if (new Set(models.map((model) => model.id)).size !== models.length)
+            throw new Error("duplicate model ids");
+        return [id, { models }];
+    }));
+    return { files: { "SYSTEM.md": files["SYSTEM.md"], "AGENTS.md": files["AGENTS.md"] }, providers };
+}
+/** Project disk metadata before validation, so no nested transport object can escape. */
+export function snapshotProviders(providers = {}) {
+    return Object.fromEntries(Object.entries(providers).flatMap(([id, provider]) => {
+        if (provider.models === undefined)
+            return [];
+        if (!Array.isArray(provider.models))
+            throw new Error("models.json models must be an array");
+        const models = provider.models.map((value) => {
+            const source = record(value, "models.json model");
+            const model = Object.fromEntries(MODEL_KEYS.flatMap((key) => source[key] === undefined ? [] : [[key, source[key]]]));
+            if (source.cost !== undefined) {
+                const cost = record(source.cost, "models.json model cost");
+                model.cost = Object.fromEntries(COST_KEYS.flatMap((key) => cost[key] === undefined ? [] : [[key, cost[key]]]));
+            }
+            return modelDefinition(model);
+        });
+        return [[id, { models }]];
+    }));
+}
+/** Replace only portable fields, retaining excluded fields for matching local model ids. */
+export function mergeSnapshotProviders(local = {}, incoming) {
+    const providers = structuredClone(local);
+    for (const [id, provider] of Object.entries(providers)) {
+        if (!Object.hasOwn(incoming, id)) {
+            delete provider.models;
+        }
+    }
+    for (const [id, { models }] of Object.entries(incoming)) {
+        if (!Object.hasOwn(local, id)) {
+            throw new Error(`provider ${id} must be configured locally before importing models`);
+        }
+        const provider = providers[id];
+        if (provider.models !== undefined && !Array.isArray(provider.models))
+            throw new Error("models.json models must be an array");
+        const existing = new Map((provider.models ?? []).map((value) => {
+            const model = record(value, "models.json model");
+            return [model.id, model];
+        }));
+        provider.models = models.map((model) => {
+            const retained = { ...existing.get(model.id) };
+            for (const key of MODEL_KEYS)
+                delete retained[key];
+            return { ...retained, ...model };
+        });
+    }
+    return providers;
+}

package/dist/agent/config.js

@@ -6,8 +6,10 @@ import { promises as fs } from "node:fs";
 import { join, resolve, sep } from "node:path";
 import { isProviderApi, validateEndpoint, validateProviderSetup } from "../core/types.js";
 import { pierPath } from "../paths.js";
+import { mergeSnapshotProviders, normalizeAgentSnapshot, snapshotProviders } from "./config-sync.js";
 const GLOBAL_FILES = ["SYSTEM.md", "AGENTS.md", "settings.json", "models.json"];
 const PROJECT_FILES = ["AGENTS.md"];
+const SNAPSHOT_FILES = ["SYSTEM.md", "AGENTS.md", "models.json"];
 const RESOURCE_DEPTH = 3; // extensions/skills nest at most a couple of levels
 /** Pier owns the Pi runtime dir: config lives in the syncable `~/.pier/pi`
  * repo, not `~/.pi`. main.ts exports this as PI_CODING_AGENT_DIR so the SDK's
@@ -16,16 +18,17 @@ export const defaultAgentDir = () => process.env.PI_CODING_AGENT_DIR ?? pierPath
 /** Stable mask: mapped back by field, without exposing key fragments. */
 const maskKey = (_key) => "••••••••";
 const missing = (err) => err instanceof Error && "code" in err && err.code === "ENOENT";
-const readOptional = async (path) => {
+const readNullable = async (path) => {
     try {
         return await fs.readFile(path, "utf8");
     }
     catch (err) {
         if (missing(err))
-            return "";
+            return null;
         throw err;
     }
 };
+const readOptional = async (path) => (await readNullable(path)) ?? "";
 const pathExists = async (path) => {
     try {
         await fs.access(path);
@@ -57,9 +60,14 @@ const atomicWrite = async (path, data, mode = 0o644) => {
 export class PiConfigStore {
     agentDir;
     #writes = Promise.resolve();
+    #rollbackFailed = false;
     constructor(agentDir = defaultAgentDir()) {
         this.agentDir = agentDir;
     }
+    #assertSnapshot() {
+        if (this.#rollbackFailed)
+            throw new Error("Configuration rollback failed; repair agent files before restarting");
+    }
     get globalDir() {
         return this.agentDir;
     }
@@ -87,6 +95,8 @@ export class PiConfigStore {
     async readFile(scope, name) {
         const path = this.filePath(scope, name);
         await this.#writes;
+        if (scope.kind === "global")
+            this.#assertSnapshot();
         const raw = await readOptional(path);
         return name === "models.json" ? maskModels(raw) : raw;
     }
@@ -104,6 +114,7 @@ export class PiConfigStore {
     }
     async providerStructures() {
         await this.#writes;
+        this.#assertSnapshot();
         const raw = await readOptional(join(this.agentDir, "models.json"));
         const parsed = parseModels(raw);
         const out = {};
@@ -199,8 +210,89 @@ export class PiConfigStore {
             }
         });
     }
+    exportSnapshot() {
+        return this.#withWrite(async () => {
+            const [system, agents, raw] = await Promise.all(SNAPSHOT_FILES.map((name) => readNullable(join(this.agentDir, name))));
+            const parsed = raw?.trim() ? parseModels(raw) : {};
+            if (!parsed)
+                throw new Error("models.json must be valid JSON before exporting configuration");
+            return normalizeAgentSnapshot({
+                files: { "SYSTEM.md": system, "AGENTS.md": agents },
+                providers: snapshotProviders(parsed.providers),
+            });
+        });
+    }
+    async applySnapshot(snapshot, commit) {
+        const incoming = normalizeAgentSnapshot(snapshot);
+        await this.#withWrite(async () => {
+            const names = SNAPSHOT_FILES;
+            const before = await Promise.all(names.map((name) => readNullable(join(this.agentDir, name))));
+            const raw = before[2];
+            const parsed = raw?.trim() ? parseModels(raw) : {};
+            if (!parsed)
+                throw new Error("models.json must be valid JSON before importing configuration");
+            const providers = mergeSnapshotProviders(parsed.providers, incoming.providers);
+            const models = JSON.stringify(providers) === JSON.stringify(parsed.providers ?? {})
+                ? raw : `${JSON.stringify({ ...parsed, providers }, null, 2)}\n`;
+            const after = [incoming.files["SYSTEM.md"], incoming.files["AGENTS.md"], models];
+            const changes = names.flatMap((name, index) => before[index] === after[index] ? [] : [{
+                    path: join(this.agentDir, name), before: before[index], after: after[index],
+                    temp: join(this.agentDir, `${name}.${process.pid}.${randomUUID()}.tmp`),
+                    mode: name === "models.json" ? 0o600 : 0o644,
+                }]);
+            const applied = [];
+            try {
+                // Prepare every replacement before touching a live file.
+                if (changes.length)
+                    await fs.mkdir(this.agentDir, { recursive: true });
+                for (const change of changes) {
+                    if (change.after !== null)
+                        await fs.writeFile(change.temp, change.after, { mode: change.mode });
+                }
+                for (const change of changes) {
+                    if (change.after === null)
+                        await fs.unlink(change.path);
+                    else
+                        await fs.rename(change.temp, change.path);
+                    applied.push(change);
+                }
+                commit?.(changes.length > 0);
+            }
+            catch (err) {
+                const errors = [err];
+                for (const change of applied.reverse()) {
+                    try {
+                        if (change.before === null)
+                            await fs.unlink(change.path);
+                        else
+                            await atomicWrite(change.path, change.before, change.mode);
+                    }
+                    catch (rollback) {
+                        this.#rollbackFailed = true;
+                        errors.push(rollback);
+                    }
+                }
+                for (const change of changes) {
+                    try {
+                        await fs.unlink(change.temp);
+                    }
+                    catch (cleanup) {
+                        if (!missing(cleanup))
+                            errors.push(cleanup);
+                    }
+                }
+                if (errors.length > 1)
+                    throw new AggregateError(errors, "configuration import rollback failed");
+                throw err;
+            }
+        });
+    }
+    /** Pi loads several files directly; hold the same queue while it opens a session. */
+    withSnapshot(read) {
+        return this.#withWrite(read);
+    }
     #withWrite(write) {
-        const result = this.#writes.then(write);
+        const result = this.#writes.then(() => { this.#assertSnapshot(); return write(); });
         this.#writes = result.then(() => undefined, () => undefined);
         return result;
     }

package/dist/agent/events.js

@@ -184,16 +184,37 @@ export function toSessionEvents(e) {
         case "agent_start":
             return [{ type: "state", state: "streaming" }, { type: "turn-start" }];
         case "agent_end": {
+            // Pi retries a retryable provider error itself and emits one agent_end
+            // per attempt. Only the last one ends the turn: translating the others
+            // posts a reply and an error per attempt for a failure Pi is still
+            // recovering from, and an `idle` the session is not in.
+            if (e.willRetry)
+                return [];
             const final = lastAssistant(e.messages);
+            // A turn can end without the model ever answering. Carried twice on
+            // purpose: on turn-end because it is *how this turn ended*, which is what
+            // a task run settles on (tasks/agent.ts), and as the error event that is
+            // already every chat surface's failure path (core/router.ts).
+            const failure = final?.stopReason === "error"
+                ? final.errorMessage || "unknown agent error"
+                : undefined;
             const out = [
-                { type: "turn-end", text: textOf(final?.content) },
+                { type: "turn-end", text: textOf(final?.content), ...(failure ? { error: failure } : {}) },
             ];
-            if (final?.stopReason === "error") {
-                out.push({ type: "error", message: final.errorMessage ?? "unknown agent error" });
-            }
-            out.push({ type: "state", state: "idle" });
+            if (failure)
+                out.push({ type: "error", message: failure });
             return out;
         }
+        // Pi's own "the run-active flag is now false": `_emitAgentSettled` clears
+        // `isStreaming` one statement before emitting this, and reaches it from the
+        // finally of the prompt — many microtasks after the last `agent_end`. Idle
+        // rides on it rather than on the turn ending, so the seam's `state` getter
+        // and this stream stop being two derivations of one fact (§5): a waiter the
+        // idle wakes now re-reads `state` as idle instead of re-arming for an event
+        // that is already spent. It is also the truthful moment — Pi's
+        // auto-compaction and queued continuations run past `agent_end`.
+        case "agent_settled":
+            return [{ type: "state", state: "idle" }];
         case "message_start": {
             // Pi emits this for every message entering the context; the user ones are
             // what a client can't know about (queued/steered messages, IM traffic).

package/dist/agent/listing.js

@@ -16,7 +16,7 @@
 // incremental.
 import { createReadStream, promises as fs } from "node:fs";
 import { join } from "node:path";
-import { pierDb } from "../db.js";
+import { pierDb, statements, transact } from "../db.js";
 import { SESSION_TITLE_MAX } from "../limits.js";
 import { logger } from "../log.js";
 import { defaultAgentDir } from "./config.js";
@@ -75,6 +75,7 @@ function fold(acc, line) {
 export class IndexedListing {
     dir;
     #db;
+    #statements;
     constructor(dir = join(defaultAgentDir(), "sessions"), db) {
         this.dir = dir;
         this.#db = db;
@@ -85,9 +86,12 @@ export class IndexedListing {
     #store() {
         return (this.#db ??= pierDb());
     }
+    /** The scan's three statements, compiled on the first scan and not again. */
+    #sql() {
+        return (this.#statements ??= statements(this.#store()));
+    }
     async scan() {
-        const db = this.#store();
-        const known = new Map(db.prepare("SELECT * FROM session_index").all().map((row) => [row.path, row]));
+        const known = new Map(this.#sql()("SELECT * FROM session_index").all().map((row) => [row.path, row]));
         const records = [];
         const write = [];
         for (const file of await this.#files()) {
@@ -228,26 +232,21 @@ export class IndexedListing {
         if (!rows.length && !gone.length)
             return;
         const db = this.#store();
-        const upsert = db.prepare(`INSERT INTO session_index(path, id, cwd, created_at, name, first_message, size, mtime, parsed_bytes)
+        const sql = this.#sql();
+        const upsert = sql(`INSERT INTO session_index(path, id, cwd, created_at, name, first_message, size, mtime, parsed_bytes)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
        ON CONFLICT(path) DO UPDATE SET
          id = excluded.id, cwd = excluded.cwd, created_at = excluded.created_at,
          name = excluded.name, first_message = excluded.first_message,
          size = excluded.size, mtime = excluded.mtime,
          parsed_bytes = excluded.parsed_bytes`);
-        const drop = db.prepare("DELETE FROM session_index WHERE path = ?");
-        db.exec("BEGIN");
-        try {
+        const drop = sql("DELETE FROM session_index WHERE path = ?");
+        transact(db, () => {
             for (const r of rows) {
                 upsert.run(r.path, r.id, r.cwd, r.created_at, r.name, r.first_message, r.size, r.mtime, r.parsed_bytes);
             }
             for (const path of gone)
                 drop.run(path);
-            db.exec("COMMIT");
-        }
-        catch (err) {
-            db.exec("ROLLBACK");
-            throw err;
-        }
+        });
     }
 }

package/dist/agent/pi.js

@@ -90,6 +90,17 @@ export const standDownShadowed = (base) => {
         }),
     };
 };
+/**
+ * A bundled skill stands down with the tool it documents. A skill's
+ * description is resident in every prompt, so one pointing at a tool this
+ * session was not given is both a cost and a route the agent cannot take.
+ */
+export const standDownUndocumented = (tools, skills) => {
+    const gone = new Set(tools.filter((tool) => tool.skill && !(tool.available?.() ?? true)).map((tool) => tool.skill));
+    if (!gone.size)
+        return skills;
+    return skills.filter((skill) => !gone.has(skill.name));
+};
 export class PiSession {
     pi;
     pinned;
@@ -101,8 +112,8 @@ export class PiSession {
     /** "What I just wrote is not in your listing yet." The factory retains a
      *  scan for a few seconds, which is exactly the window a rename lands in:
      *  every surface would re-read the old title and keep it until some
-     *  unrelated event moved the list again. Same drop `create` and `fork`
-     *  do — a callback only because the session is what knows it happened. */
+     *  unrelated event moved the list again. Same drop `create` does — a
+     *  callback only because the session is what knows it happened. */
     wrote = () => { }, retention = { value: "long" }) {
         this.pi = pi;
         this.pinned = pinned;
@@ -172,7 +183,24 @@ export class PiSession {
             followUp: [...this.pi.getFollowUpMessages()],
         };
     }
+    /** A system input handed to a streaming session goes into Pi's *agent*
+     *  queue, and the arrays above are the *session's* — they only ever hold
+     *  text a `prompt`/`steer`/`followUp` call queued. So a task message sitting
+     *  in front of a running turn is in neither the queue nor the transcript,
+     *  and this list is the only thing that says it exists. */
+    queuedInputs = [];
+    async pendingSystemInputs() {
+        // Pi drains its follow-up queue before the turn ends, so an idle session
+        // has nothing in flight. Anything still listed was aborted or cleared, and
+        // calling that queued would leave its sender waiting on it forever (§5b).
+        if (!this.pi.isStreaming)
+            this.queuedInputs.length = 0;
+        return [...this.queuedInputs];
+    }
     async clearQueue() {
+        // Not among the texts returned — a system input is nobody's draft — but
+        // dropped all the same, so its sender stops being told it is on its way.
+        this.queuedInputs.length = 0;
         return this.pi.clearQueue();
     }
     async history() {
@@ -279,14 +307,40 @@ export class PiSession {
         // the summary too.
         await this.whenCompacted();
         this.live();
-        return this.pi.sendCustomMessage({ customType: "pier.system-input", content: text, display: true, details: origin }, { triggerTurn: true, deliverAs: mode === "prompt" ? undefined : mode });
+        // Read here, not before the wait, and whatever the mode says: a turn is
+        // running, so the call below queues this input rather than starting one.
+        const queued = this.pi.isStreaming;
+        if (queued)
+            this.queuedInputs.push(origin);
+        try {
+            return await this.pi.sendCustomMessage({ customType: "pier.system-input", content: text, display: true, details: origin }, { triggerTurn: true, deliverAs: mode === "prompt" ? undefined : mode });
+        }
+        catch (error) {
+            // Refused: nothing is in flight, and the caller is about to retry. The
+            // turn may have ended while we waited, so the entry may be gone already.
+            const at = this.queuedInputs.indexOf(origin);
+            if (at >= 0)
+                this.queuedInputs.splice(at, 1);
+            throw error;
+        }
     }
     abort() {
         return this.pi.abort();
     }
     subscribe(fn) {
+        let retryPending = false;
         return this.pi.subscribe((event) => {
-            for (const payload of toSessionEvents(event)) {
+            const piEvent = event;
+            if (piEvent.type === "agent_end")
+                retryPending = piEvent.willRetry === true;
+            if (piEvent.type === "agent_settled" && retryPending) {
+                // Aborting Pi during retry backoff produces no final agent_end, so the
+                // turn has to be ended here. The idle is not: `agent_settled` carries
+                // it through the table below like any other settle.
+                retryPending = false;
+                fn({ type: "turn-end", text: "", meta: this.lastTurnMeta() });
+            }
+            for (const payload of toSessionEvents(piEvent)) {
                 fn(payload.type === "turn-end" ? { ...payload, meta: this.lastTurnMeta() } : payload);
             }
         });
@@ -355,7 +409,7 @@ export class PiAgentFactory {
     located = new Map();
     /** That same scan, retained for LIST_TTL_MS instead of paid once per asking
      *  surface — one workspace event has three (sidebar, Activity, task lookups).
-     *  Dropped on create/fork; ids appear for reasons this factory never sees, so
+     *  Dropped on create; ids appear for reasons this factory never sees, so
      *  a miss that decides something re-lists rather than trusts it (`resume`). */
     listing;
     refreshQueue = Promise.resolve();
@@ -553,6 +607,10 @@ export class PiAgentFactory {
             // Pi's generic default, preserving the user's later instruction layer.
             systemPromptOverride: pierSystemPrompt,
             additionalSkillPaths: this.skillPaths,
+            skillsOverride: (base) => ({
+                ...base,
+                skills: standDownUndocumented(this.extraTools, base.skills),
+            }),
             extensionFactories: [
                 { name: "pier-bash-timeout", factory: bashTimeoutDefault, hidden: true },
                 ...inlineExtensions(this.enabledExtensions()),
@@ -570,7 +628,10 @@ export class PiAgentFactory {
         await loader.reload();
         return loader;
     }
-    async open(cwd, sessionManager, opts = { cwd }) {
+    open(cwd, sessionManager, opts = { cwd }) {
+        return this.providerConfig.withSnapshot(() => this.openSnapshot(cwd, sessionManager, opts));
+    }
+    async openSnapshot(cwd, sessionManager, opts) {
         let live;
         // Asked per open, not captured at wiring: a tool whose channel is not
         // configured yet would otherwise cost context on every turn of every
@@ -630,6 +691,13 @@ export class PiAgentFactory {
             resourceLoader: await this.resourceLoader(cwd),
         });
         live = created.session;
+        // Pi's queue defaults to handing over one follow-up per turn boundary, so N
+        // queued messages cost N model turns and anything behind them waits them
+        // out — 11 progress reports drained over 2.5 minutes and put a guidance
+        // message 11 minutes late (2026-09-07). The agent's own setter only flips
+        // the in-memory queue; `session.setFollowUpMode` would persist it to Pi's
+        // settings.json on every open and make it global forever.
+        live.agent.followUpMode = "all";
         const session = new PiSession(live, this.pinned, () => {
             this.listing = undefined;
         }, retention);
@@ -644,26 +712,6 @@ export class PiAgentFactory {
         this.listing = undefined;
         return this.open(opts.cwd, SessionManager.create(opts.cwd), opts);
     }
-    async fork(sourceSessionId, opts) {
-        const infos = await this.listed();
-        const source = infos.find((session) => session.id === sourceSessionId);
-        if (!source)
-            throw new Error(`unknown session: ${sourceSessionId}`);
-        const targetDir = SessionManager.create(opts.cwd).getSessionDir();
-        const manager = SessionManager.open(source.path, targetDir, opts.cwd);
-        const branch = manager.getBranch();
-        const latest = branch.at(-1);
-        const hasPendingToolCall = latest?.type === "message" &&
-            latest.message.role === "assistant" &&
-            Array.isArray(latest.message.content) &&
-            latest.message.content.some((part) => part.type === "toolCall");
-        const leafId = hasPendingToolCall ? latest.parentId : latest?.id;
-        if (!leafId)
-            throw new Error("cannot fork a session before its first persisted input");
-        manager.createBranchedSession(leafId);
-        this.listing = undefined;
-        return this.open(opts.cwd, manager, opts);
-    }
     async resume(sessionId) {
         const known = this.located.get(sessionId);
         if (known) {
@@ -688,7 +736,7 @@ export class PiAgentFactory {
      *  session this factory opened. The miss is what earns a fresh scan, because
      *  callers read it as permission to start a replacement session
      *  (channels/conversations.ts), which costs a conversation its history, or as
-     *  a session that no longer exists (tasks/, web/files.ts). `reused` is how we
+     *  a session that no longer exists (tasks/, web/server.ts). `reused` is how we
      *  know a scan is owed: same entry back, same disk state. */
     async locate(sessionId) {
         const find = (infos) => infos.find((s) => s.id === sessionId);

package/dist/boards/boards.js

@@ -122,15 +122,16 @@ export async function listBoards(dir) {
     catch {
         return []; // no boards yet
     }
-    const boards = [];
-    for (const slug of entries.sort()) {
+    // One board's manifest says nothing about the next one's, so the scan waits
+    // once for all of them rather than once per board.
+    const boards = await Promise.all(entries.sort().map(async (slug) => {
         const manifest = await readManifest(dir, slug);
         if (!manifest)
-            continue;
+            return null;
         const { title, description, sessions, public: isPublic, token } = manifest;
-        boards.push({ slug, title, description, sessions, public: isPublic, token, updatedAt: await updatedAt(dir, slug) });
-    }
-    return boards;
+        return { slug, title, description, sessions, public: isPublic, token, updatedAt: await updatedAt(dir, slug) };
+    }));
+    return boards.filter((board) => board !== null);
 }
 /** Containment, not normalization: the resolved realpath must sit inside the
  *  board's own site dir or nothing is served. */

package/dist/channels/attach.js

@@ -65,7 +65,14 @@ export async function sendAttachments(paths, upload, log) {
         log(`attachment ${path} not sent: ${reason}`);
         lost.push(lostMarker(nameOf(path), reason));
     };
-    for (const path of paths.slice(0, MAX_ATTACHMENTS)) {
+    const taken = paths.slice(0, MAX_ATTACHMENTS);
+    // Five files that know nothing about each other cost one round trip, not
+    // five. Two phases so the platform still receives them in the order the
+    // turn linked them, and each failure is kept in its own slot — `lost` reads
+    // in link order whichever upload finished first.
+    const reasons = [];
+    const reasonOf = (err) => (err instanceof Error ? err.message : String(err));
+    const files = await Promise.all(taken.map(async (path, i) => {
         try {
             const info = await stat(path);
             if (!info.isFile())
@@ -74,12 +81,19 @@ export async function sendAttachments(paths, upload, log) {
                 throw new Error(`too large (>${MAX_ATTACH_BYTES} bytes)`);
             const name = nameOf(path);
             const ext = extname(name).slice(1).toLowerCase();
-            await upload({ name, bytes: await readFile(path), image: IMAGE_EXT.has(ext) });
+            return { name, bytes: await readFile(path), image: IMAGE_EXT.has(ext) };
         }
         catch (err) {
-            fail(path, err instanceof Error ? err.message : String(err));
+            reasons[i] = reasonOf(err);
+            return undefined;
         }
-    }
+    }));
+    await Promise.all(files.map((file, i) => file ? upload(file).catch((err) => void (reasons[i] = reasonOf(err))) : undefined));
+    taken.forEach((path, i) => {
+        const reason = reasons[i];
+        if (reason !== undefined)
+            fail(path, reason);
+    });
     for (const path of paths.slice(MAX_ATTACHMENTS)) {
         fail(path, `more than ${MAX_ATTACHMENTS} files in one turn`);
     }

package/dist/channels/config.js

@@ -73,13 +73,18 @@ export class ChannelStore {
      * discovery is passive. A new chat copies the platform defaults and owns
      * them from then on — the mention and bind gates are what keep it harmless
      * until an operator configures it.
+     *
+     * Telegram gets a chat's name free with every update, so it discovers on
+     * every message: the "already known, unchanged" answer is read off the
+     * cached document and costs no clone. Only a real change pays for one.
      */
     discoverChat(platform, chat) {
+        const cached = this.cached(platform).chats.find((c) => c.id === chat.id);
+        if (cached && cached.name === chat.name && cached.kind === chat.kind)
+            return;
         const config = this.get(platform);
         const known = config.chats.find((c) => c.id === chat.id);
         if (known) {
-            if (known.name === chat.name && known.kind === chat.kind)
-                return;
             known.name = chat.name || known.name;
             known.kind = chat.kind;
         }