@timqi/pier 0.0.28 → 0.1.0

package/dist/agent/pi.js

@@ -1,20 +1,61 @@
 // The only file outside src/extensions allowed to import @earendil-works/pi-*.
 // Implements the AgentFactory/AgentSession seam from src/core/types.ts on the
 // Pi SDK. No Pi type may appear in an exported signature.
+import { realpathSync } from "node:fs";
+import { basename, dirname, join } from "node:path";
 import { createAgentSession, CredentialSynchronizationError, DefaultResourceLoader, defineTool, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
 import { inlineExtensions } from "../extensions/index.js";
+import { SESSION_TITLE_MAX } from "../limits.js";
 import { logger } from "../log.js";
-import { toChatTurns, toSessionEvents, turnMetaAt, } from "./events.js";
+import { textOf, toChatTurns, toSessionEvents, turnMetaAt, } from "./events.js";
 import { defaultAgentDir, PiConfigStore } from "./config.js";
 import { IndexedListing } from "./listing.js";
 import { curateModels, pinFirst } from "./models.js";
 const log = logger("agent");
+/** A directory is what a session is compared by — the rail groups on it, the
+ *  New-session menu drops a `<repo>.<branch>` worktree when the repository
+ *  itself is in the list — so two names for one directory are two projects. A
+ *  session opened under `/home/qiqi` (a symlink to `/essd/qiqi`) never matched
+ *  the worktrees recorded under the real path, and every branch checkout was
+ *  offered as a project of its own. Resolved once per distinct path: a symlink
+ *  that moves under a running instance is not a case we have.
+ *
+ *  A directory that is gone — a worktree merged and removed — is still a
+ *  session's cwd, and its spelling still decides whether the rail reads it as a
+ *  branch of its repository. So the deepest ancestor that does resolve carries
+ *  the rest of the path, and only a cwd with no resolvable ancestor at all is
+ *  reported as recorded. */
+const realPaths = new Map();
+function realPath(cwd) {
+    const known = realPaths.get(cwd);
+    if (known !== undefined)
+        return known;
+    let real = cwd;
+    const missing = [];
+    for (let head = cwd;;) {
+        try {
+            real = join(realpathSync(head), ...missing);
+            break;
+        }
+        catch (err) {
+            const parent = dirname(head);
+            if (parent === head) {
+                log.debug(`cwd ${cwd} has no resolvable ancestor; using it as recorded`, err);
+                break;
+            }
+            missing.unshift(basename(head));
+            head = parent;
+        }
+    }
+    realPaths.set(cwd, real);
+    return real;
+}
 /** A listed record as the seam reports it. The one mapping, because `list` and
  *  `find` answer with the same shape and drifting would mean two answers about
  *  one session. */
 const summaryOf = (s) => ({
     id: s.id,
-    cwd: s.cwd,
+    cwd: realPath(s.cwd),
     createdAt: s.created,
     modified: s.modified,
     ...(s.title ? { title: s.title } : {}),
@@ -36,6 +77,36 @@ const PROVIDER_CHECK_TIMEOUT_MS = 20_000;
 const PROVIDER_CHECK_MAX_TOKENS = 8192;
 /** Neither half of a probe is worth more than a screen. */
 const clip = (text) => text.length > 4000 ? `${text.slice(0, 4000)}\n[… ${text.length - 4000} more characters]` : text;
+/** Naming a session: one bare request on the operator's title model, after the
+ *  first exchange. Each half of the exchange is cut to a few hundred
+ *  characters — a title is about the subject, and the subject is in the
+ *  opening lines — and the answer is a line, so the cap is a line's worth. */
+const TITLE_INPUT_CHARS = 600;
+const TITLE_MAX_TOKENS = 40;
+const TITLE_TIMEOUT_MS = 20_000;
+const TITLE_PROMPT = "Name this conversation for a session list. Reply with the title only: at most 12 Chinese characters " +
+    "or 6 English words, in the language the user wrote in, no quotes, no trailing period. " +
+    "A leading `[name<id> time]` on the user's message is a speaker header, not content.";
+/** A subject, not the request: the model is asked to title the exchange, and
+ *  the two halves are labelled so a reply that quotes an instruction back is
+ *  not mistaken for one. */
+const titleRequest = (first, reply) => `${TITLE_PROMPT}\n\n<user>\n${first.slice(0, TITLE_INPUT_CHARS)}\n</user>\n\n<assistant>\n${reply.slice(0, TITLE_INPUT_CHARS)}\n</assistant>`;
+/** The text of a bare completion, or the refusal it was: a provider can
+ *  decline as a message rather than a throw, and only the stop reason tells
+ *  that from an answer. */
+function textOfAnswer(answer) {
+    if (answer.stopReason === "error" || answer.stopReason === "aborted") {
+        throw new Error(answer.errorMessage ?? `the provider stopped: ${answer.stopReason}`);
+    }
+    return textOf(answer.content).trim();
+}
+/** What a model hands back as a title, made into one: the first line, quotes
+ *  off, capped where every other title is capped. Empty is a failure, not a
+ *  cleared name — the caller reports it. */
+export function titleFromAnswer(text) {
+    const line = text.trim().split("\n")[0]?.trim() ?? "";
+    return line.replace(/^["'“‘「]+|["'”’」.。]+$/g, "").trim().slice(0, SESSION_TITLE_MAX);
+}
 /** Pier's baseline replaces Pi's generic default; a user's SYSTEM.md follows it. */
 const PIER_SYSTEM_PROMPT = `You are a general-purpose agent with a live workspace: you can read and change files and run shell commands. Act with expert care — do the work and verify the result.
 
@@ -106,6 +177,7 @@ export class PiSession {
     pinned;
     wrote;
     retention;
+    suggestTitle;
     constructor(pi, 
     /** Operator pins, read per call — the menu can change while we run. */
     pinned = () => [], 
@@ -114,11 +186,16 @@ export class PiSession {
      *  every surface would re-read the old title and keep it until some
      *  unrelated event moved the list again. Same drop `create` does — a
      *  callback only because the session is what knows it happened. */
-    wrote = () => { }, retention = { value: "long" }) {
+    wrote = () => { }, retention = { value: "long" }, 
+    /** The operator's title model asked to name a first exchange, or nothing
+     *  when auto-titling is off. Read per turn: switching it on names the next
+     *  session that finishes a first turn, without a restart. */
+    suggestTitle = () => undefined) {
         this.pi = pi;
         this.pinned = pinned;
         this.wrote = wrote;
         this.retention = retention;
+        this.suggestTitle = suggestTitle;
     }
     /** Pi's dispose unhooks the one listener that persists and emits, so a turn
      *  started after it runs for real — model call, tools and all — and lands
@@ -342,9 +419,47 @@ export class PiSession {
             }
             for (const payload of toSessionEvents(piEvent)) {
                 fn(payload.type === "turn-end" ? { ...payload, meta: this.lastTurnMeta() } : payload);
+                if (payload.type === "turn-end" && !payload.error)
+                    this.autoTitle(payload.text, fn);
             }
         });
     }
+    /** Whether naming has been decided for this session — done, started, or
+     *  never: a session that already has a name (a task's, a rename during the
+     *  turn) or more than one exchange behind it keeps what it has. Several
+     *  subscribers see every turn-end; this is what makes the request one. */
+    titleDecided = false;
+    /** Name the session after its first exchange, on the operator's title model.
+     *  Off by default (settings.titleModel), in which case the title stays the
+     *  first prompt that agent/listing.ts derives. The result is a rename like
+     *  any other — an append the next listing reads — announced as `renamed` so
+     *  every surface re-lists; a failure is announced too, because a title that
+     *  silently stayed the prompt looks like the setting did nothing (§5b). */
+    autoTitle(reply, fn) {
+        if (this.titleDecided)
+            return;
+        const suggest = this.suggestTitle();
+        if (!suggest)
+            return; // off — not decided: switched on later, the next turn still counts
+        this.titleDecided = true;
+        if (this.pi.sessionManager.getSessionName())
+            return;
+        const users = this.pi.messages.filter((m) => m.role === "user");
+        const first = users.length === 1 ? textOf(users[0]?.content) : "";
+        if (!first.trim())
+            return;
+        void suggest(first, reply).then((title) => {
+            // Named while we waited — by a person, whose word beats the model's.
+            if (this.disposed || this.pi.sessionManager.getSessionName())
+                return;
+            this.pi.sessionManager.appendSessionInfo(title);
+            this.wrote();
+            fn({ type: "renamed", title });
+        }, (err) => {
+            log.warn(`session ${this.pi.sessionId} could not be titled`, err);
+            fn({ type: "error", message: `session title: ${err instanceof Error ? err.message : String(err)} — the first message stays the title` });
+        });
+    }
     /** Meta of the just-finished turn; live path, so "now" is the completion. */
     lastTurnMeta() {
         const messages = this.pi.messages;
@@ -367,6 +482,7 @@ export class PiAgentFactory {
     providerConfig;
     pinned;
     enabledExtensions;
+    titleModel;
     listings;
     constructor(extraTools = [], 
     /** Appended as a virtual context file, so Pi's own prompt stays intact.
@@ -388,6 +504,10 @@ export class PiAgentFactory {
     /** Which bundled extensions the Console has switched on. A getter for the
      * same reason again: the toggle takes effect on the next session open. */
     enabledExtensions = () => [], 
+    /** The model that names a session after its first exchange (Console →
+     * Settings → Models); unset means the first prompt stays the title. A
+     * getter, read per turn end. */
+    titleModel = () => undefined, 
     /** What exists on disk. Injected so a test can hand this factory a listing
      * instead of a session directory and a database. */
     listings = new IndexedListing()) {
@@ -398,6 +518,7 @@ export class PiAgentFactory {
         this.providerConfig = providerConfig;
         this.pinned = pinned;
         this.enabledExtensions = enabledExtensions;
+        this.titleModel = titleModel;
         this.listings = listings;
     }
     /** One runtime for the whole process; catalogs are global, not per session. */
@@ -516,17 +637,7 @@ export class PiAgentFactory {
             if (!model)
                 throw new Error(`unknown model: ${providerId}/${modelId}`);
             const answer = await runtime.completeSimple(model, { messages: [{ role: "user", content: "hi", timestamp: Date.now() }] }, { maxTokens: PROVIDER_CHECK_MAX_TOKENS, signal, fetch: recorded });
-            // A refusal can arrive as a message rather than a throw; the stop reason
-            // is the only thing separating it from an answer.
-            const refused = answer.stopReason === "error" || answer.stopReason === "aborted";
-            if (refused) {
-                throw new Error(answer.errorMessage ?? `the provider stopped: ${answer.stopReason}`);
-            }
-            const text = answer.content
-                .filter((part) => part.type === "text")
-                .map((part) => part.text)
-                .join("")
-                .trim();
+            const text = textOfAnswer(answer);
             // An empty answer is still an answer; say which kind of nothing it was.
             return answered(clip(text) || `(no text; stop reason: ${answer.stopReason})`, true);
         }
@@ -539,6 +650,24 @@ export class PiAgentFactory {
                 : raw || error, false);
         }
     }
+    /** One bare completion — no session, no tools, no history — on the title
+     *  model. Rejects on anything but a usable line: the session reports it. */
+    async suggestTitle(model, first, reply) {
+        const runtime = await this.refreshedRuntime();
+        const resolved = runtime.getModel(model.provider, model.id);
+        if (!resolved)
+            throw new Error(`title model ${model.provider}/${model.id} is not in the catalog`);
+        // The least reasoning the model does, said explicitly: unset means the
+        // provider's default, which on a reasoning model is not "none" (gpt-5:
+        // medium) and spends the whole output cap thinking about a title. Anthropic
+        // is the exception — its default is thinking off, and any level turns it on.
+        const reasoning = resolved.reasoning && resolved.api !== "anthropic-messages" ? "minimal" : undefined;
+        const answer = await runtime.completeSimple(resolved, { messages: [{ role: "user", content: titleRequest(first, reply), timestamp: Date.now() }] }, { maxTokens: TITLE_MAX_TOKENS, reasoning, signal: AbortSignal.timeout(TITLE_TIMEOUT_MS) });
+        const title = titleFromAnswer(textOfAnswer(answer));
+        if (!title)
+            throw new Error(`${model.provider}/${model.id} answered with no title`);
+        return title;
+    }
     async setup(input) {
         const builtins = await this.builtinIds();
         if (input.kind === "builtin" && !builtins.has(input.id)) {
@@ -700,7 +829,10 @@ export class PiAgentFactory {
         live.agent.followUpMode = "all";
         const session = new PiSession(live, this.pinned, () => {
             this.listing = undefined;
-        }, retention);
+        }, retention, () => {
+            const model = this.titleModel();
+            return model && ((first, reply) => this.suggestTitle(model, first, reply));
+        });
         if (opts.model)
             await session.setModel(opts.model);
         if (opts.thinking)
@@ -710,7 +842,10 @@ export class PiAgentFactory {
     }
     async create(opts) {
         this.listing = undefined;
-        return this.open(opts.cwd, SessionManager.create(opts.cwd), opts);
+        // Resolved before Pi records it, so the transcript, the session directory
+        // and every later listing all name the directory the same way.
+        const cwd = realPath(opts.cwd);
+        return this.open(cwd, SessionManager.create(cwd), { ...opts, cwd });
     }
     async resume(sessionId) {
         const known = this.located.get(sessionId);
@@ -778,4 +913,11 @@ export class PiAgentFactory {
     async list() {
         return (await this.listed()).map(summaryOf);
     }
+    /** After a listing, so a transcript that grew since the last one is indexed
+     *  before it is asked about; the listing owns the index. One that cannot
+     *  search — a test's — has nothing to say. */
+    async search(query) {
+        await this.listed();
+        return this.listings.search?.(query) ?? [];
+    }
 }

package/dist/channels/lark-panel.js

@@ -12,7 +12,7 @@ import { ChatPanel, CWD_PLACEHOLDER, CWD_TAIL, PANEL_PREFIX, } from "./panel.js"
 /** A form-submit button name: `cwdgo:<thread root>`. */
 export const CWD_SUBMIT_PREFIX = "cwdgo:";
 /** The form input's field name, the key `form_value` answers under. */
-export const CWD_FIELD = "cwd";
+const CWD_FIELD = "cwd";
 export class LarkPanel extends ChatPanel {
     deps;
     platform = "lark";

package/dist/core/inbox.js

@@ -12,7 +12,7 @@ import { basename, join } from "node:path";
 import { pierPath } from "../paths.js";
 import { fileMarker, lostMarker, MAX_INBOUND_BYTES, safeName } from "./inbound-file.js";
 /** Where every inbound file lives; the attachment route allowlists this root. */
-export const INBOX_DIR = pierPath("inbox");
+const INBOX_DIR = pierPath("inbox");
 /**
  * Write one inbound file and return its absolute path. The timestamp-random
  * prefix keeps concurrent saves collision-free (`wx` turns the impossible

package/dist/core/router.js

@@ -78,6 +78,7 @@ export class Router {
      *  the process exits when the drain ends — `endDrain` exists for the one
      *  caller that drains *speculatively* and may not get to exit. */
     draining = false;
+    spokenTo;
     constructor(hub, 
     /** Create or resume the session owning a conversation (wired in main.ts). */
     resolve) {
@@ -87,6 +88,14 @@ export class Router {
     registerChannel(channel) {
         this.channels.set(channel.id, channel);
     }
+    /** Told which session a human just spoke to — every message from a chat or
+     *  the workbench passes through `dispatch`, and nothing a task or a subagent
+     *  starts does. Registered rather than a constructor argument: the one
+     *  listener is the rail's working set (web/session-state.ts), built with the
+     *  web surface long after the router. */
+    onSpokenTo(listener) {
+        this.spokenTo = listener;
+    }
     /**
      * Tell the conversation something went wrong, then the event stream.
      *
@@ -242,6 +251,10 @@ export class Router {
                     state: payload.state,
                 });
             }
+            // A title the session gave itself: every list reads the transcript, so
+            // the same re-list a rename route broadcasts.
+            if (payload.type === "renamed")
+                this.hub.emitWorkspace({ type: "sessions-changed" });
             // An error the session itself reported (a tool that threw, a model
             // refusal, a lost connection). Without this it lands only in the web
             // timeline and the IM side goes quiet for no visible reason.
@@ -602,6 +615,7 @@ export class Router {
         // closed must not start the turn the drain just declared finished with.
         if (this.draining)
             this.refuseDraining(msg.key);
+        this.spokenTo?.(session.id);
         const { action, text } = decide(msg, session.state);
         // A group chat is many people talking into one session; without a speaker
         // line the agent cannot tell them apart or mention anyone back. Emitted

package/dist/core/types.js

@@ -11,13 +11,17 @@ export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhig
 export const isThinkingLevel = (v) => typeof v === "string" && THINKING_LEVELS.includes(v);
 // Wire-protocol names, not SDK types — but they are pi-ai's spellings, and a
 // non-Pi backend is bound to them by this seam.
-export const PROVIDER_APIS = [
+const PROVIDER_APIS = [
     "openai-completions",
     "openai-responses",
     "anthropic-messages",
     "google-generative-ai",
 ];
 export const isProviderApi = (value) => typeof value === "string" && PROVIDER_APIS.includes(value);
+/** How far a model's reasoning goes. Every reasoning model offers up to
+ *  "high"; the two levels above it exist only for a model whose catalog entry
+ *  says so, which is the one thing a Console-defined model could not say. */
+export const MODEL_EFFORTS = ["high", "xhigh", "max"];
 /** The rules of the ProviderSetup seam, in one place: agent/ enforces them on
  *  write and web/ pre-checks them at its HTTP boundary, and neither may import
  *  the other. Throws the message the surface shows. */
@@ -46,6 +50,14 @@ export function validateProviderSetup(input) {
     if (ids.some((id) => !id || id.length > 200 || id !== id.trim()) || new Set(ids).size !== ids.length) {
         throw new Error("model ids must be non-empty, trimmed and unique");
     }
+    // An effort ceiling on a model that does not reason would be written into
+    // the catalog and never offered — a setting that lies about itself.
+    if (input.models.some((model) => model.effort !== undefined && !model.reasoning)) {
+        throw new Error("effort requires reasoning");
+    }
+    if (input.models.some((model) => model.effort !== undefined && !MODEL_EFFORTS.includes(model.effort))) {
+        throw new Error("unsupported model effort");
+    }
 }
 export function validateEndpoint(endpoint) {
     let url;

package/dist/db.js

@@ -331,6 +331,54 @@ const MIGRATIONS = [
   -- land in the pinned section. project_sort stays as a column nothing reads
   -- — a SQLite column drop rewrites the table for a NULL nobody pays for.
   UPDATE session_state SET pinned = 0;
+  `,
+    // 20 — the top of the rail is maintained, not arranged: no pin, no drag.
+    `
+  -- sort was the place a hand dragged a pinned row to; it is now the rank in
+  -- the working set the rail keeps on top, which a session enters by being
+  -- spoken to and leaves by being pushed out of the last slot. The pinned rows
+  -- are that set's first members — they are what somebody was working on — in
+  -- the order they were arranged in; never-dragged ones sorted first, so -1 is
+  -- the rank that keeps them there.
+  UPDATE session_state SET sort = -1 WHERE pinned = 1 AND sort IS NULL;
+  UPDATE session_state SET sort = NULL WHERE pinned = 0;
+  -- The set has a size (web/session-state.ts); more pins than that is a list
+  -- the promotion rule would never have built.
+  UPDATE session_state SET sort = NULL WHERE session_id IN (
+    SELECT session_id FROM session_state WHERE sort IS NOT NULL
+    ORDER BY sort, session_id LIMIT -1 OFFSET 8
+  );
+  ALTER TABLE session_state DROP COLUMN pinned;
+  `,
+    // 21 — unread is the workbench's own attention, so it is only its own rows.
+    `
+  -- The flag was written for every session whose turn ended, including the
+  -- ones no browser is the reader of: an IM session answers its chat, a run's
+  -- session answers its supervisor. Both are now skipped at the write
+  -- (web/server.ts), and neither could ever be acked — that needs the session
+  -- on screen — so the rows they left would stay set forever. On the instance
+  -- this was decided on, 195 of 196 marks were those. Cleared wholesale rather
+  -- than by owner: the one real row is a turn from before an upgrade nobody
+  -- was watching for, and a false amber dot costs less than the join.
+  UPDATE session_state SET unread = 0;
+  `,
+    // 22 — the palette finds what was said, not only what a session is called.
+    `
+  -- One row per user message and per assistant reply, keyed by the transcript
+  -- it came from so a file that is rewritten or gone drops its rows in one
+  -- statement (agent/listing.ts). Trigram tokens: a substring match with no
+  -- word segmentation, which CJK text has none of and a path or an identifier
+  -- in a prompt has too much of. Steps stay out — tool calls, their output,
+  -- thinking are the bulk of a transcript and nobody searches for what ran.
+  CREATE VIRTUAL TABLE session_fts USING fts5(
+    text, session_id UNINDEXED, path UNINDEXED, role UNINDEXED, at UNINDEXED,
+    tokenize = 'trigram'
+  );
+  -- Derived and disposable (migration 7): every row goes, so the next scan
+  -- reads every transcript from its first byte and fills the table above.
+  -- Resetting parsed_bytes alone would not — a row whose (size, mtime) still
+  -- match is trusted without opening the file.
+  DELETE FROM session_index;
   `,
 ];
 /**

package/dist/drain.js

@@ -11,7 +11,7 @@ import { logger } from "./log.js";
 const log = logger("drain");
 /** How long running turns may take before they are aborted. Generous: a turn
  *  can be a subagent fan-out, and an abort still persists the partial work. */
-export const DRAIN_DEADLINE_MS = 5 * 60_000;
+const DRAIN_DEADLINE_MS = 5 * 60_000;
 const POLL_MS = 1_000;
 /** Shared cleanup window after the deadline. All sessions use the same clock,
  *  so N hung seams still cost at most this long rather than N times as long. */

package/dist/extensions/web/content.js

@@ -49,7 +49,7 @@ export function sourcesFrom(content) {
     return [...sources.values()].map(({ title, url }) => ({ title, url }));
 }
 /** Only what the search itself returned, in the order it ranked them. */
-export function searchResultsFrom(content) {
+function searchResultsFrom(content) {
     const results = new Map();
     for (const block of content) {
         if (!isObject(block) || block.type !== "web_search_tool_result")
@@ -61,7 +61,7 @@ export function searchResultsFrom(content) {
     }
     return [...results.values()];
 }
-export function searchQueriesFrom(content) {
+function searchQueriesFrom(content) {
     const queries = [];
     for (const block of content) {
         if (!isObject(block) || block.type !== "server_tool_use" || block.name !== "web_search") {

package/dist/main.js

@@ -8,6 +8,7 @@ import { normalizeAgentSnapshot } from "./agent/config-sync.js";
 import { ConfigSync } from "./config-sync.js";
 import { configSyncTask } from "./config-sync-task.js";
 import { CredentialStore } from "./agent/credentials.js";
+import { IndexedListing } from "./agent/listing.js";
 import { PiAgentFactory } from "./agent/pi.js";
 import { defaultBoardsDir, registerBoardRoutes } from "./boards/boards.js";
 import { ChannelStore } from "./channels/config.js";
@@ -20,6 +21,7 @@ import { SlackDirectory } from "./channels/slack-directory.js";
 import { handleSlackTool, slackToolAvailable, slackToolSpec } from "./channels/slack-tool.js";
 import { parseConversation as parseSlackConversation } from "./channels/slack.js";
 import { EventHub } from "./core/hub.js";
+import { splitSpeaker } from "./core/identity.js";
 import { pierDb } from "./db.js";
 import { deliverLedger, drainForRestart, RestartLedger } from "./drain.js";
 import { bundledInfo } from "./extensions/index.js";
@@ -135,7 +137,12 @@ new CredentialStore(db, secrets), piConfig,
 () => settings.get().modelMenu, 
 // Bundled extensions the Console switched on; read per session open, so the
 // toggle reaches the next session the same way an edited agent file does.
-() => settings.get().extensions);
+() => settings.get().extensions, 
+// The title model, if the operator picked one; read when a first turn ends.
+() => settings.get().titleModel, 
+// The search index reads Pi's transcripts, which carry the speaker header
+// core wrote for the model; this is where the two areas meet.
+new IndexedListing(undefined, undefined, (text) => splitSpeaker(text).text));
 const hub = new EventHub();
 const router = new Router(hub, (key) => {
     // Web conversation ids ARE session ids; an IM conversation id is a chat or a

package/dist/secrets.js

@@ -172,7 +172,7 @@ function open(key, sealed, aad) {
 }
 /** The real vt CLI. Absent binary or denied approval both surface as the
  *  spawn/exit error — unlock() records it and the operator reads it. */
-export const vtCli = {
+const vtCli = {
     read: (record) => run("vt", ["read", record]),
     create: async (plaintext) => {
         const out = await run("vt", ["create"], plaintext);

package/dist/service.js

@@ -15,7 +15,7 @@ import { existsSync, mkdirSync, readFileSync, rmdirSync, rmSync, writeFileSync }
 import { homedir, userInfo } from "node:os";
 import { dirname, join } from "node:path";
 export const UNIT_NAME = "pier.service";
-export const UPDATE_UNIT_NAME = "pier-update.service";
+const UPDATE_UNIT_NAME = "pier-update.service";
 /** `~/.config/systemd/user/pier.service` — where a user unit belongs. */
 export const unitPath = (home = homedir()) => join(home, ".config", "systemd", "user", UNIT_NAME);
 /** The drop-in Pier writes once and never touches again: what the unit may
@@ -146,7 +146,7 @@ ExecStopPost=systemctl --user start ${UNIT_NAME}
  * exists to protect the OS and sshd outside it. Written commented so the
  * operator tuning it can see what each line buys.
  */
-export function renderLimits() {
+function renderLimits() {
     return `[Service]
 # Soft ceiling: past this the kernel reclaims hard and lets the unit crawl
 # instead of killing anything. This is the one that should bite first.

package/dist/settings.js

@@ -50,27 +50,40 @@ export function normalizeModelMenu(raw) {
         return null;
     const menu = [];
     for (const item of raw) {
-        if (typeof item !== "object" || item === null)
+        const ref = normalizeModelRef(item);
+        if (!ref)
             return null;
-        const { provider, id, thinking, note } = item;
-        if (typeof provider !== "string" || !provider.trim())
-            return null;
-        if (typeof id !== "string" || !id.trim())
-            return null;
-        if (thinking !== undefined && !isThinkingLevel(thinking))
+        const { thinking, note } = item;
+        // The one thing repaired rather than rejected, because it is not input:
+        // entries stored (or exported by an instance) before the level was
+        // required have none, and dropping the menu over it would lose the pins.
+        const level = thinking === undefined ? "medium" : thinking;
+        if (!isThinkingLevel(level))
             return null;
         if (note !== undefined && typeof note !== "string")
             return null;
         const cleaned = note?.trim().slice(0, 200);
         menu.push({
-            provider: provider.trim(),
-            id: id.trim(),
-            ...(thinking !== undefined ? { thinking } : {}),
+            ...ref,
+            thinking: level,
             ...(cleaned ? { note: cleaned } : {}),
         });
     }
     return menu;
 }
+/** One model reference, rejecting rather than repairing — the menu above is
+ *  built from these. Existence is not checked here: the catalog is the
+ *  agent's, and a model that went away is reported by the call that fails. */
+export function normalizeModelRef(raw) {
+    if (typeof raw !== "object" || raw === null)
+        return null;
+    const { provider, id } = raw;
+    if (typeof provider !== "string" || !provider.trim())
+        return null;
+    if (typeof id !== "string" || !id.trim())
+        return null;
+    return { provider: provider.trim(), id: id.trim() };
+}
 /**
  * Shape only — an unknown name is not an error here. This file must not know
  * what Pier bundles (that catalog is code, and importing it would drag the Pi
@@ -107,9 +120,11 @@ export class SettingsStore {
         this.#db = db;
     }
     get() {
+        const titleModel = this.#json("titleModel", normalizeModelRef, "a {provider, id}");
         return {
             publicUrl: this.#value("publicUrl") ?? "",
             modelMenu: this.#json("modelMenu", normalizeModelMenu, "a valid menu") ?? [],
+            ...(titleModel ? { titleModel } : {}),
             autoUpdate: this.#value("autoUpdate") === "1",
             extensions: this.#json("extensions", normalizeExtensions, "a list of names") ?? [],
             tools: this.#json("tools", normalizeTools, "a list of names") ?? [],
@@ -152,6 +167,12 @@ export class SettingsStore {
         this.#set("modelMenu", JSON.stringify(menu));
         return this.get();
     }
+    /** Same contract: hand this `normalizeModelRef`'s output; null switches
+     *  auto-titling off. */
+    setTitleModel(ref) {
+        this.#set("titleModel", ref ? JSON.stringify(ref) : "");
+        return this.get();
+    }
     setAutoUpdate(on) {
         this.#set("autoUpdate", on ? "1" : "0");
         return this.get();