@timqi/pier 0.0.19 → 0.0.21

package/dist/config-sync.js

@@ -0,0 +1,179 @@
+// One serialized configuration subscriber, shared by Settings and the hourly
+// task. Only a successfully applied response advances its persistent ETag.
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { configSourceUrl, CONFIG_SYNC_BYTES, downloadConfig } from "./config-sync-fetch.js";
+import { transact } from "./db.js";
+import { logger } from "./log.js";
+import { normalizeModelMenu } from "./settings.js";
+const log = logger("config-sync");
+const KEY = "configSync";
+// Object order is not a change; array order (model menu priority) is.
+export function configJson(value) {
+    return JSON.stringify(value, (_key, entry) => entry && typeof entry === "object" && !Array.isArray(entry)
+        ? Object.fromEntries(Object.entries(entry).sort(([a], [b]) => a.localeCompare(b, "en"))) : entry);
+}
+const hash = (value) => createHash("sha256").update(configJson(value)).digest("hex");
+export class ConfigSync {
+    deps;
+    #state;
+    #queue = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+        const row = deps.db.prepare("SELECT value FROM settings WHERE key = ?").get(KEY);
+        this.#state = row ? JSON.parse(row.value) : {
+            instanceId: randomUUID(), token: null, url: "", enabled: false, etag: null,
+            appliedHash: null, lastChecked: null, lastApplied: null, error: null, needsReload: false,
+        };
+        if (!row)
+            this.#save();
+    }
+    #save(patch = {}) {
+        const next = { ...this.#state, ...patch };
+        this.deps.db.prepare("INSERT INTO settings(key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+            .run(KEY, JSON.stringify(next));
+        this.#state = next;
+    }
+    #exclusive(work) {
+        const result = this.#queue.then(work);
+        this.#queue = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    status() {
+        const state = this.#state;
+        return {
+            publishedPath: state.token ? `/config-sync/${state.token}` : null,
+            sourceUrl: state.url, enabled: state.enabled,
+            lastChecked: state.lastChecked, lastApplied: state.lastApplied,
+            error: state.error, needsReload: state.needsReload,
+        };
+    }
+    async #local() {
+        return { agent: await this.deps.config.exportSnapshot(), modelMenu: this.deps.settings.get().modelMenu };
+    }
+    publish() {
+        return this.#exclusive(async () => {
+            if (this.#state.enabled)
+                throw new Error("Pause the configuration subscription before publishing a link");
+            await this.#local();
+            this.#save({ token: randomBytes(32).toString("hex") });
+            return this.status();
+        });
+    }
+    revoke() {
+        return this.#exclusive(async () => {
+            this.#save({ token: null });
+            return this.status();
+        });
+    }
+    async published(token) {
+        const expected = this.#state.token;
+        if (!expected || !/^[a-f0-9]{64}$/.test(token) || !timingSafeEqual(Buffer.from(token), Buffer.from(expected)))
+            return null;
+        const local = await this.#local();
+        if (this.#state.token !== expected)
+            return null;
+        const document = { schemaVersion: 1, instanceId: this.#state.instanceId, ...local };
+        const body = configJson(document);
+        if (Buffer.byteLength(body) > CONFIG_SYNC_BYTES)
+            throw new Error("Configuration exceeds 1 MiB");
+        return { body, etag: `"${hash(document)}"` };
+    }
+    #parse(raw) {
+        if (Buffer.byteLength(raw) > CONFIG_SYNC_BYTES)
+            throw new Error("Configuration exceeds 1 MiB");
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            throw new Error("Source returned malformed JSON");
+        }
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Invalid configuration document");
+        const object = value;
+        if (object.schemaVersion !== 1)
+            throw new Error("Unsupported configuration schema version");
+        if (Object.keys(object).some((key) => !["schemaVersion", "instanceId", "agent", "modelMenu"].includes(key))) {
+            throw new Error("Unexpected configuration fields");
+        }
+        if (typeof object.instanceId !== "string" || !object.instanceId || object.instanceId.length > 100)
+            throw new Error("Invalid source instance ID");
+        if (object.instanceId === this.#state.instanceId)
+            throw new Error("An instance cannot subscribe to itself");
+        const modelMenu = normalizeModelMenu(object.modelMenu);
+        if (!modelMenu)
+            throw new Error("Invalid model menu");
+        return { agent: this.deps.normalizeAgent(object.agent), modelMenu };
+    }
+    subscribe(url) {
+        return this.#exclusive(async () => {
+            if (this.#state.token)
+                throw new Error("Revoke the sharing link before enabling a configuration subscription");
+            return this.#sync(url);
+        });
+    }
+    pause() {
+        return this.#exclusive(async () => {
+            this.#save({ enabled: false });
+            return this.status();
+        });
+    }
+    sync(signal) {
+        return this.#exclusive(() => this.#state.enabled
+            ? this.#sync(this.#state.url, signal)
+            : Promise.resolve("Configuration subscription is paused"));
+    }
+    async #sync(rawUrl, signal) {
+        try {
+            const url = configSourceUrl(rawUrl).href;
+            const local = await this.#local();
+            const etag = url === this.#state.url && hash(local) === this.#state.appliedHash ? this.#state.etag : null;
+            const timeout = AbortSignal.timeout(15_000);
+            const response = await (this.deps.download ?? downloadConfig)(url, etag, signal ? AbortSignal.any([signal, timeout]) : timeout);
+            signal?.throwIfAborted();
+            if (response.status === 304 && !etag)
+                throw new Error("Source returned 304 without a matching local configuration");
+            const next = response.status === 304 ? local : this.#parse(response.body);
+            let changed = false;
+            const previous = structuredClone(this.#state);
+            const commit = (filesChanged) => transact(this.deps.db, () => {
+                signal?.throwIfAborted();
+                const menuChanged = configJson(next.modelMenu) !== configJson(this.deps.settings.get().modelMenu);
+                changed = filesChanged || menuChanged;
+                if (menuChanged)
+                    this.deps.settings.setModelMenu(next.modelMenu);
+                this.#save({
+                    url, enabled: true, etag: response.status === 304 ? etag : response.etag,
+                    appliedHash: hash(next), lastChecked: Date.now(),
+                    lastApplied: changed ? Date.now() : previous.lastApplied,
+                    needsReload: changed || previous.needsReload, error: null,
+                });
+            });
+            try {
+                // Reconcile under the file lock even on 304: local edits may have
+                // completed while the conditional download was in flight.
+                await this.deps.config.applySnapshot(next.agent, commit);
+            }
+            catch (err) {
+                this.#state = previous;
+                throw err;
+            }
+            if (this.#state.needsReload) {
+                try {
+                    await this.deps.reload();
+                }
+                catch {
+                    throw new Error("Configuration saved, but reload failed; retry synchronization");
+                }
+                this.#save({ needsReload: false });
+            }
+            return changed ? "Configuration applied; reload completed" : `Configuration unchanged (${response.status})`;
+        }
+        catch (err) {
+            const error = err instanceof Error ? err.message : "Configuration sync failed";
+            log.error(error);
+            this.#save({ lastChecked: Date.now(), error });
+            throw new Error(error);
+        }
+    }
+}

package/dist/core/hub.js

@@ -23,7 +23,7 @@ export class EventHub {
     bus(sessionId) {
         let b = this.buses.get(sessionId);
         if (!b) {
-            b = { seq: 0, buffer: [], subscribers: new Set() };
+            b = { seq: 0, replayFloor: 0, buffer: [], subscribers: new Set() };
             this.buses.set(sessionId, b);
         }
         return b;
@@ -46,7 +46,7 @@ export class EventHub {
         if (payload.type !== "text-delta") {
             b.buffer.push(event);
             if (b.buffer.length > RING_SIZE)
-                b.buffer.shift();
+                b.replayFloor = b.buffer.shift().seq;
         }
         fanOut(b.subscribers, event);
     }
@@ -60,6 +60,11 @@ export class EventHub {
     replay(sessionId, afterSeq) {
         return this.bus(sessionId).buffer.filter((e) => e.seq > afterSeq);
     }
+    /** Whether replay covers this cursor; live-only text gaps are intentional. */
+    covers(sessionId, afterSeq) {
+        const b = this.bus(sessionId);
+        return Number.isSafeInteger(afterSeq) && afterSeq >= b.replayFloor && afterSeq <= b.seq;
+    }
     emitWorkspace(event) {
         fanOut(this.workspace, event);
     }
@@ -88,7 +93,9 @@ export class EventHub {
         if (this.hasSubscribers(sessionId))
             return;
         const b = this.buses.get(sessionId);
-        if (b)
+        if (b) {
+            b.replayFloor = b.buffer.at(-1)?.seq ?? b.replayFloor;
             b.buffer = [];
+        }
     }
 }

package/dist/core/reply.js

@@ -40,14 +40,20 @@ new day — so the last one still applies; a gap alone shows as time only, like
 \`[14:23]\`. Use that \`id\` to mention someone; never ask for their own.
 `;
 /**
- * The contract above plus the two facts about *this* deployment that an agent
+ * The contract above plus the facts about *this* deployment that an agent
  * cannot work out for itself.
  *
- * Told, not discovered. Pier knows both — the home is its own startup argument
+ * Told, not discovered. Pier knows them — the home is its own startup argument
  * and the address is a file it wrote — while an agent can only guess at a
  * path and shell out to look. The guess is wrong on every instance that moves
  * `PIER_HOME`, and it fails as "nothing is configured": indistinguishable from
  * the truth, and reported to the user as such. Which is what happened.
+ *
+ * The editing line is the same shape of fact, learned the same way: GPT models
+ * carry `apply_patch` from their own post-training, and not finding it in the
+ * tool list they go looking in the shell — one failed call, then a filesystem
+ * hunt, and in one session a stale Codex binary that worked, which put every
+ * later edit outside Pi's tooling.
  */
 export function surfacePrompt(instance) {
     const reach = instance.publicUrl
@@ -60,6 +66,10 @@ export function surfacePrompt(instance) {
 ## This Pier instance
 
 Boards: \`${instance.boardsDir}/<slug>/\` — this path, not \`~/.pier\`. ${reach}
+
+Editing: files change through the \`edit\` tool (exact text replacement) or
+\`write\`. There is no \`apply_patch\` here — not as a tool, not as a command —
+so do not call one or go looking for one in the shell.
 `;
 }
 /**

package/dist/core/router.js

@@ -1,5 +1,6 @@
 // Conversation → session routing plus event wiring. In-memory on purpose:
 // the durable chat → session map lives in channels/conversations.ts.
+import { randomUUID } from "node:crypto";
 import { logger } from "../log.js";
 import { EventHub } from "./hub.js";
 import { SenderPrefix, withPrefix } from "./identity.js";
@@ -22,6 +23,13 @@ function keyOf(key) {
  *  `ensure`, and which of the two a session records costs nothing but the
  *  answer to "what is it answering". */
 const isAlias = (key) => key.channelId === "web" || key.channelId === "task";
+export class QueueOperationError extends Error {
+    reason;
+    constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+    }
+}
 export class Router {
     hub;
     resolve;
@@ -112,6 +120,8 @@ export class Router {
         for (const [id, attached] of [...this.bySession]) {
             if (attached.session.state === "streaming")
                 continue;
+            if (this.queueOperations.has(id) || this.recoveries.get(id)?.some((b) => b.status === "submitting"))
+                continue;
             if (!includeWatched && this.hub.hasSubscribers(id))
                 continue;
             if (now - attached.activeAt < ttlMs)
@@ -231,7 +241,7 @@ export class Router {
             // its own queues up to the agent_end handler, so a non-empty queue on an
             // idle session is exactly the message that missed that window.
             if (payload.type === "queue-state" && (payload.steering.length || payload.followUp.length)) {
-                this.promoteQueued(session, key);
+                this.promoteQueued(session);
             }
             // Every turn-end reaches the channel, empty text included: an adapter's
             // per-turn UI (Telegram's 👀 receipts) is retired here, and a turn that
@@ -254,10 +264,124 @@ export class Router {
             unsubscribe,
         });
     }
-    /** Sessions whose queue is being promoted right now. `clearQueue` and the
-     *  prompt that follows it both emit queue-state of their own, so without
-     *  this the handler would re-enter on its own effects. */
-    promoting = new Set();
+    queueOperations = new Set();
+    promotionRequested = new Set();
+    recoveries = new Map();
+    // Keep the latest failed batch ID so a clear cannot erase a newer rejection
+    // that arrived while it awaited the backend. ACK affects only the copy.
+    uncertaintyHeld = new Map();
+    queueUncertain(sessionId) {
+        return this.uncertaintyHeld.has(sessionId);
+    }
+    recoveryOf(sessionId) {
+        return structuredClone(this.recoveries.get(sessionId) ?? []);
+    }
+    recoveryChanged(sessionId) {
+        if (!this.recoveries.get(sessionId)?.length)
+            this.recoveries.delete(sessionId);
+        this.hub.emit(sessionId, {
+            type: "queue-recovery", batches: this.recoveryOf(sessionId), uncertain: this.queueUncertain(sessionId),
+        });
+    }
+    acknowledgeRecovery(sessionId, batchId) {
+        const batches = this.recoveries.get(sessionId);
+        const batch = batches?.find((b) => b.id === batchId);
+        if (!batch)
+            throw new QueueOperationError("missing", "No such recovery batch");
+        if (batch.status === "submitting")
+            throw new QueueOperationError("busy", "Submission has not settled");
+        this.recoveries.set(sessionId, batches.filter((b) => b !== batch));
+        this.promotionRequested.delete(sessionId);
+        this.recoveryChanged(sessionId);
+    }
+    /** Only queue mutation owns this lock. A model turn owns its batch, not the
+     *  next queue: manual controls remain available while that turn runs. */
+    async useQueue(sessionId, action, key = { channelId: "web", conversationId: sessionId }) {
+        if (this.queueOperations.has(sessionId))
+            throw new QueueOperationError("busy", "Queue operation in progress");
+        this.queueOperations.add(sessionId);
+        try {
+            return await action(await this.ensure(key));
+        }
+        finally {
+            this.queueOperations.delete(sessionId);
+            this.resumePromotion(sessionId);
+        }
+    }
+    async recallQueue(sessionId) {
+        return this.useQueue(sessionId, async (session) => {
+            const held = this.uncertaintyHeld.get(sessionId);
+            const queue = await session.clearQueue();
+            if (this.uncertaintyHeld.get(sessionId) === held && this.uncertaintyHeld.delete(sessionId))
+                this.recoveryChanged(sessionId);
+            if (queue.steering.length || queue.followUp.length)
+                this.forgetSender(sessionId);
+            return queue;
+        });
+    }
+    checkQueueDrain() {
+        if (this.draining)
+            throw new QueueOperationError("draining", "Pier is restarting; queued messages were not submitted");
+    }
+    async deliverQueue(sessionId, mode) {
+        let retained = false;
+        try {
+            this.checkQueueDrain();
+            return await this.useQueue(sessionId, async (session) => {
+                this.checkQueueDrain();
+                if (mode === "auto" && (session.state !== "idle" || this.queueUncertain(sessionId) || this.recoveries.get(sessionId)?.length))
+                    return "";
+                const held = this.uncertaintyHeld.get(sessionId);
+                const queue = await session.clearQueue();
+                if (mode !== "auto" && this.uncertaintyHeld.get(sessionId) === held && this.uncertaintyHeld.delete(sessionId))
+                    this.recoveryChanged(sessionId);
+                if (!queue.steering.length && !queue.followUp.length)
+                    throw new QueueOperationError("empty", "Queue is empty");
+                const batch = { id: randomUUID(), ...queue, status: "submitting" };
+                this.recoveries.set(sessionId, [...(this.recoveries.get(sessionId) ?? []), batch]);
+                retained = true;
+                this.recoveryChanged(sessionId);
+                const text = [...batch.steering, ...batch.followUp].join("\n");
+                let invoked = false;
+                const failed = (err) => {
+                    this.forgetSender(sessionId);
+                    this.promotionRequested.delete(sessionId);
+                    batch.status = invoked ? "uncertain" : "not-submitted";
+                    if (invoked)
+                        this.uncertaintyHeld.set(sessionId, batch.id);
+                    batch.error = String(err);
+                    this.recoveryChanged(sessionId);
+                    this.reportTo(sessionId, `Queue promotion failed (${batch.status}); automatic queue paused, originals remain available in queue recovery: ${String(err)}`);
+                };
+                try {
+                    this.checkQueueDrain();
+                    if (mode === "restart")
+                        await this.abort(sessionId);
+                    this.checkQueueDrain();
+                    // Already headed at original dispatch. Calling dispatch again would
+                    // discard rejection and could attribute these words to the operator.
+                    invoked = true;
+                    const submitted = mode === "steer" && session.state === "streaming"
+                        ? session.steer(text) : session.prompt(text);
+                    void submitted.then(() => {
+                        this.recoveries.set(sessionId, (this.recoveries.get(sessionId) ?? []).filter((b) => b !== batch));
+                        this.recoveryChanged(sessionId);
+                    }, failed).finally(() => this.resumePromotion(sessionId));
+                    return text;
+                }
+                catch (err) {
+                    failed(err);
+                    throw err;
+                }
+            }, mode === "auto" ? this.conversationOf(sessionId) : undefined);
+        }
+        catch (err) {
+            if (!retained && !(err instanceof QueueOperationError && (err.reason === "busy" || err.reason === "empty"))) {
+                this.reportTo(sessionId, `Could not promote queued messages: ${String(err)}`);
+            }
+            throw err;
+        }
+    }
     /**
      * Turn a stranded queue into the turn it was waiting for. Not routed through
      * `dispatch`: the text was prefixed when it was first dispatched
@@ -268,40 +392,39 @@ export class Router {
      * start the very turn it was asked to stop. Recovering *those* messages stays
      * the web's recall route, which hands them back to the composer.
      */
-    promoteQueued(session, key) {
-        if (session.state !== "idle" || this.promoting.has(session.id))
+    promoteQueued(session) {
+        if (session.state !== "idle")
             return;
-        this.promoting.add(session.id);
-        void (async () => {
-            try {
-                // Re-read: a turn may have started since the event, and it will drain
-                // the queue itself — clearing it here would take the messages out of it.
-                if (session.state !== "idle")
-                    return;
-                const { steering, followUp } = await session.clearQueue();
-                const text = [...steering, ...followUp].join("\n").trim();
-                if (!text)
-                    return;
-                // A drain is "no new turns", and this would be one. Told to the
-                // conversation rather than dropped, because the message is now out of
-                // the queue and nothing else would ever mention it (§5b).
-                if (this.draining) {
-                    this.report(session.id, key, `queued message not taken — Pier is restarting; send it again: ${truncate(text)}`);
-                    return;
-                }
-                log.info(`promoting ${String(steering.length + followUp.length)} queued message(s) → session ${session.id}`);
-                await session.prompt(text);
-            }
-            catch (err) {
-                this.report(session.id, key, `delivering the queued messages failed: ${String(err)}`);
-            }
-            finally {
-                this.promoting.delete(session.id);
-            }
-        })();
+        this.promotionRequested.add(session.id);
+        this.resumePromotion(session.id);
+    }
+    resumePromotion(sessionId) {
+        // queue_update precedes the backend's enqueue. Never clear it reentrantly.
+        queueMicrotask(() => {
+            if (!this.promotionRequested.has(sessionId) || this.queueOperations.has(sessionId))
+                return;
+            // A queue event followed by rejection might describe the same input.
+            // Retained failures require a human decision, not an automatic resend.
+            if (this.queueUncertain(sessionId) || this.recoveries.get(sessionId)?.length)
+                return;
+            this.promotionRequested.delete(sessionId);
+            const attached = this.bySession.get(sessionId);
+            if (!attached || attached.session.state !== "idle")
+                return;
+            void this.deliverQueue(sessionId, "auto").catch((err) => {
+                // deliverQueue reports failures; empty/busy simply lost the race.
+                log.debug(`automatic promotion of ${sessionId} stopped: ${String(err)}`);
+            });
+        });
     }
     async abort(sessionId) {
-        await this.bySession.get(sessionId)?.session.abort();
+        this.promotionRequested.delete(sessionId);
+        try {
+            await this.bySession.get(sessionId)?.session.abort();
+        }
+        finally {
+            this.promotionRequested.delete(sessionId);
+        }
     }
     /**
      * Drop what this session was told about who is speaking, so the next message
@@ -358,7 +481,9 @@ export class Router {
         return this.byKey.get(keyOf(key));
     }
     async abortConversation(key) {
-        await this.sessionOf(key)?.abort();
+        const session = this.sessionOf(key);
+        if (session)
+            await this.abort(session.id);
     }
     /** Session owning a conversation, resolving and attaching it on first use. */
     async ensure(key) {

package/dist/db.js

@@ -310,6 +310,12 @@ const MIGRATIONS = [
     GENERATED ALWAYS AS (json_extract(json, '$.nextRunAt')) VIRTUAL;
   CREATE INDEX tasks_due ON tasks(next_run_at) WHERE next_run_at IS NOT NULL;
   `,
+    // 17 — stable global pages, including sparse lists with unmatched probes hidden.
+    `
+  CREATE INDEX task_runs_time_id ON task_runs(queued_at DESC, id DESC);
+  CREATE INDEX task_runs_visible_time ON task_runs(queued_at DESC, id DESC)
+    WHERE NOT (state = 'succeeded' AND json_extract(json, '$.matched') IS 0);
+  `,
 ];
 /**
  * Several writes as one, or none. `BEGIN IMMEDIATE` because every writer here

package/dist/main.js

@@ -4,6 +4,9 @@ import { fileURLToPath } from "node:url";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import { PiConfigStore } from "./agent/config.js";
+import { normalizeAgentSnapshot } from "./agent/config-sync.js";
+import { ConfigSync } from "./config-sync.js";
+import { configSyncTask } from "./config-sync-task.js";
 import { CredentialStore } from "./agent/credentials.js";
 import { PiAgentFactory } from "./agent/pi.js";
 import { defaultBoardsDir, registerBoardRoutes } from "./boards/boards.js";
@@ -35,6 +38,7 @@ import { startUpdate, unitPath, updaterProblem } from "./service.js";
 import { SettingsStore } from "./settings.js";
 import { startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
+import { registerConfigShareRoute, registerConfigSyncRoutes } from "./web/config-sync.js";
 import { PushStore, registerPushRoutes } from "./web/push.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
@@ -86,7 +90,12 @@ let channelStore;
 // Shared by the adapter and the tool: a display name is looked up once per
 // process, not once per message and again per transcript.
 const slackDirectory = new SlackDirectory((m) => logger("slack").warn(m));
+let readyForConfigReload = false;
 const piConfig = new PiConfigStore();
+const configSync = new ConfigSync({
+    db, settings, config: piConfig, normalizeAgent: normalizeAgentSnapshot,
+    reload: () => readyForConfigReload ? reloadInstance() : Promise.resolve(),
+});
 const factory = new PiAgentFactory([
     taskToolSpec((params, callerSessionId) => tasks.tool(params, callerSessionId)),
     slackToolSpec((params, callerSessionId) => handleSlackTool({
@@ -143,8 +152,9 @@ const router = new Router(hub, (key) => {
 const stopEviction = router.startIdleEviction();
 tasks = new TaskService(new TaskStore(db), factory, router, hub, {
     modelMenu: () => settings.get().modelMenu,
+    systemActions: { "config-sync": (signal) => configSync.sync(signal) },
 });
-tasks.start();
+const configurationSync = configSyncTask(tasks, configSync);
 // The managed CLI tools (src/tools.ts), and the daily task that keeps them
 // current (src/tools-task.ts) — an ordinary bash task on an ordinary cron,
 // wired here because tools.ts may not import tasks/.
@@ -181,6 +191,19 @@ const reloadInstance = async (includeWatched = false) => {
     await channels.reload();
     return router.evictIdle(0, Date.now(), { includeWatched });
 };
+// Bound the startup check before sessions and scheduled work can start.
+// Remote outages keep the last local configuration available.
+if (configSync.status().enabled) {
+    try {
+        await configSync.sync();
+    }
+    catch {
+        log.error("Startup configuration sync failed; using the last local configuration");
+    }
+}
+await configurationSync.reconcile();
+tasks.start();
+readyForConfigReload = true;
 void secrets.unlock().then(startChannels, (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
 // Replacing Pier is systemd's job, not this process's: the oneshot unit stops
 // the service, snapshots the database, installs and starts it again. Without
@@ -289,8 +312,15 @@ app.onError((err, c) => {
 // so a surface added later is covered without knowing this exists. Built
 // before the listener: a first run generates and prints its password here.
 const auth = new AuthStore(db);
+registerConfigShareRoute(app, configSync);
 app.use("*", requireAuth(auth));
 registerAuthRoutes(app, auth);
+registerConfigSyncRoutes(app, {
+    sync: configSync,
+    status: () => ({ ...configurationSync.status(), publicUrl: settings.get().publicUrl }),
+    reconcile: configurationSync.reconcile,
+    run: configurationSync.run,
+});
 registerTaskRoutes(app, tasks, { factory, router });
 registerChannelRoutes(app, channelStore, channels);
 registerBoardRoutes(app);

package/dist/tasks/agent.js

@@ -1,4 +1,4 @@
-// A run that *is* a Pi session: which session it opens (reuse, fresh, fork),
+// A run that *is* a Pi session: which session it opens (fresh or reused),
 // what the child is told before the prompt, and how many may run at once. The
 // concurrency caps are here rather than in execution.ts because they bound
 // agents specifically — a bash run costs a process, an agent run costs a
@@ -52,7 +52,7 @@ export class AgentTaskRunner {
                 await this.waitUntilIdle(session, signal);
                 // Task requests come seconds apart — the 1h Anthropic cache-write premium
                 // never earns its 2× back, so task runs use the 5m TTL. Set here, not in
-                // resolveSession: this covers create, fork, reuse and resume alike, on
+                // resolveSession: this covers create, reuse and resume alike, on
                 // every attempt — and only after the session is idle, so a reused
                 // interactive session's in-flight turn keeps its 1h writes.
                 session.setCacheRetention("short");
@@ -149,25 +149,16 @@ export class AgentTaskRunner {
         if (run.targetSessionId) {
             return this.router.ensure({ channelId: "task", conversationId: run.targetSessionId });
         }
-        const source = run.sourceSessionId
-            ? await this.factory.find(run.sourceSessionId)
-            : undefined;
         const policy = action.session;
-        let cwd;
-        if (run.sessionMode === "fork") {
-            if (!run.sourceSessionId)
-                throw new Error("fork requires a source session");
-            cwd = policy.mode === "fork" && policy.cwd ? policy.cwd : source?.cwd ?? "";
-        }
-        else if (policy.mode === "fresh") {
-            cwd = policy.cwd;
-        }
-        else if (policy.mode === "reuse") {
-            cwd = (await this.factory.find(policy.sessionId))?.cwd ?? "";
-        }
-        else {
-            cwd = policy.cwd ?? source?.cwd ?? "";
+        // Definitions stored before fork was removed still say `"fork"`. Refused by
+        // name: every directory this could pick instead is a guess at what the
+        // author meant, and a child in the wrong tree edits real files.
+        if (run.sessionMode === "fork" || policy.mode === "fork") {
+            throw new Error(`task "${run.context.definition.name}" uses the removed fork session mode; recreate it with {"mode":"fresh","cwd":"/abs/path"}`);
         }
+        const cwd = policy.mode === "fresh"
+            ? policy.cwd
+            : (await this.factory.find(policy.sessionId))?.cwd ?? "";
         if (!cwd)
             throw new Error("could not resolve child working directory");
         const opts = {
@@ -179,9 +170,7 @@ export class AgentTaskRunner {
                 (run.sourceSessionId ? this.router.modelOf(run.sourceSessionId) : undefined),
             thinking: action.launch?.thinking,
         };
-        const session = run.sessionMode === "fork"
-            ? await this.factory.fork(run.sourceSessionId, opts)
-            : await this.factory.create(opts);
+        const session = await this.factory.create(opts);
         run.targetSessionId = session.id;
         run.context.sessionId = session.id;
         run.context.cwd = cwd;

package/dist/tasks/callbacks.js

@@ -19,7 +19,7 @@ export const runSource = (run) => ({
 });
 export function runResultText(run) {
     let result = run.error ?? "No result";
-    if (run.result?.type === "agent")
+    if (run.result?.type === "agent" || run.result?.type === "system")
         result = run.result.text;
     if (run.result?.type === "bash")
         result = run.result.stdout || run.result.stderr || `exit ${String(run.result.exitCode)}`;