@timqi/pier 0.0.9 → 0.0.16

package/dist/channels/lark-outbound.js

@@ -6,6 +6,7 @@
 // adapter keeps the 👀 receipts, because those are about the turn ending, not
 // about what was said.
 import { formatTurnMeta, isSilentReply, originLabel, quietLabel } from "../core/reply.js";
+import { sendAttachments, splitAttachments } from "./attach.js";
 import { button, buttonRow, card, chunk, footer, LARK_MAX, markdown, OFFER_PREFIX, withFooter, withoutButtons, } from "./lark-render.js";
 /** How many sent cards the retire cache remembers (avibe keeps 200). */
 const SENT_CACHE = 200;
@@ -37,11 +38,14 @@ export class LarkOutbound {
      * platform — the card is remembered so retire() can rebuild it without them.
      */
     async reply(root, reply) {
-        const text = reply.text.trim();
+        // A file the agent linked lives on Pier's machine, so the link is dead in
+        // Lark: the bytes are uploaded instead and the label stays in the text.
+        const { text: spoken, paths } = splitAttachments(reply.text);
+        const text = spoken.trim();
         const meta = reply.meta ? formatTurnMeta(reply.meta) : "";
         const quiet = isSilentReply(reply) ? quietLabel(reply.silence) : "";
         const note = [quiet, meta].filter(Boolean).join(" · ");
-        if (!(text || reply.suggestions.length || note))
+        if (!(text || reply.suggestions.length || note || paths.length))
             return;
         const row = reply.suggestions.length
             ? buttonRow(reply.suggestions.map((label, index) => button(label, { key: `${OFFER_PREFIX}${index}`, root, label })))
@@ -62,6 +66,11 @@ export class LarkOutbound {
             if (last && row && messageId)
                 this.remember(messageId, card(elements));
         }
+        // Attachments follow the words, so the card introducing them is above
+        // them; anything that could not be sent says so in the thread.
+        const lost = await sendAttachments(paths, (file) => this.api.uploadFile(root, file), this.log);
+        if (lost)
+            await this.api.replyCard(root, card([markdown(lost)]));
     }
     /**
      * Take the buttons off a card one option was just taken from — the rest

package/dist/channels/slack-api.js

@@ -293,4 +293,40 @@ export class SlackApi {
         // Bounded mid-stream: the event's size metadata is the platform's word.
         return { bytes: await readCapped(res.body, maxBytes), mimeType };
     }
+    /**
+     * Three calls, because that is what Slack's current upload is: ask for a
+     * one-shot URL, POST the bytes to it (that host is not the Web API and
+     * answers with plain text, not JSON), then tell Slack where the file goes.
+     * `files.upload` did it in one, and is retired.
+     */
+    async uploadFile(channel, threadTs, file) {
+        // A read method: form-encoded, or Slack ignores the body (see read()).
+        const slot = await this.read("files.getUploadURLExternal", { filename: file.name, length: file.bytes.length }).catch((err) => {
+            // An app installed before Pier could upload has every other scope, so
+            // this reads as a mysterious refusal in the chat. Name the fix instead:
+            // the manifest is only applied when an app is *created*.
+            if (!/missing_scope/.test(String(err)))
+                throw err;
+            throw new Error("the Slack app is missing the files:write scope — add it under " +
+                "OAuth & Permissions and reinstall the app");
+        });
+        if (!slot.upload_url || !slot.file_id) {
+            throw new Error("slack files.getUploadURLExternal: no upload url");
+        }
+        const put = await fetch(slot.upload_url, {
+            method: "POST",
+            headers: { "content-type": "application/octet-stream" },
+            // Copied into a fresh view: a request body must be backed by an
+            // ArrayBuffer, and a Buffer read off disk is the wider ArrayBufferLike.
+            body: new Uint8Array(file.bytes),
+            signal: AbortSignal.timeout(120_000),
+        });
+        if (!put.ok)
+            throw new Error(`slack file upload: ${put.status}`);
+        await this.call("files.completeUploadExternal", {
+            files: [{ id: slot.file_id, title: file.name }],
+            channel_id: channel,
+            thread_ts: threadTs,
+        });
+    }
 }

package/dist/channels/slack-outbound.js

@@ -5,6 +5,7 @@
 // limit, and what an empty turn still has to say. The adapter keeps the 👀
 // receipts, because those are about the turn ending, not about what was said.
 import { formatTurnMeta, isSilentReply, originLabel, quietLabel } from "../core/reply.js";
+import { sendAttachments, splitAttachments } from "./attach.js";
 import { isBlockRejection } from "./slack-api.js";
 import { actions, chunk, context, escapeMrkdwn, markdown, MARKDOWN_MAX, MRKDWN_MAX, sections, toMrkdwn, } from "./slack-render.js";
 /**
@@ -30,7 +31,10 @@ export class SlackOutbound {
      * and that is still something to show.
      */
     async reply(channel, threadTs, reply) {
-        const text = reply.text.trim();
+        // A file the agent linked lives on Pier's machine, so the link is dead in
+        // Slack: the bytes are uploaded instead and the label stays in the text.
+        const { text: spoken, paths } = splitAttachments(reply.text);
+        const text = spoken.trim();
         const footer = reply.meta ? footerText(reply.meta) : "";
         const row = actions(reply.suggestions);
         // A turn that produced no text still posts its footer, and says which kind
@@ -41,7 +45,7 @@ export class SlackOutbound {
         const quiet = isSilentReply(reply)
             ? `_${quietLabel(reply.silence && escapeMrkdwn(reply.silence))}_`
             : "";
-        if (!(text || row || footer || quiet))
+        if (!(text || row || footer || quiet || paths.length))
             return;
         const parts = text ? chunk(text, this.budget()) : [""];
         for (const [i, part] of parts.entries()) {
@@ -55,6 +59,12 @@ export class SlackOutbound {
                 ...(last && row ? [row] : []),
             ]);
         }
+        // Attachments follow the words, so the message introducing them is above
+        // them; anything that could not be sent says so in the thread.
+        const lost = await sendAttachments(paths, (file) => this.api.uploadFile(channel, threadTs, file), this.log);
+        // Unescaped, like every other body: post() escapes on the path that needs it.
+        if (lost)
+            await this.post(channel, threadTs, lost, []);
     }
     /**
      * A system note: quoted, labelled with where it came from, and deliberately

package/dist/channels/slack-tool.js

@@ -41,11 +41,25 @@ export function toTs(value) {
         throw new Error(`not a time: ${value}`);
     return String(parsed / 1000);
 }
-export function slackToolSpec(execute) {
+/**
+ * Whether a session opened now is given the tool at all: the same two switches
+ * `handleSlackTool` checks, asked before the description is paid for. The call
+ * keeps its own checks and its own two messages — a session opened while Slack
+ * was configured outlives the operator switching it off, and that turn has to
+ * say so rather than find the tool quietly gone.
+ */
+export function slackToolAvailable(store) {
+    const config = store.get("slack");
+    return config.enabled && !!config.token && config.agentTool;
+}
+export function slackToolSpec(execute, available) {
     return {
         name: "slack",
         label: "Slack",
-        description: "Read and write Slack through Pier, which holds the bot token. State what you want; Pier does the paging and hands back a finished transcript. context says which Slack conversation you are in; read_channel returns a channel's transcript for a time range; read_thread returns one thread, or only what is new in it since a given message via after; read_message returns the single message at a ts (pass thread_ts when it is a reply inside a thread); post sends a message; delete removes the message at a ts, which Slack allows only for messages Pier itself posted; channels lists what Pier can reach. When you were reached through Slack, omit channel (and thread_ts) to act on the conversation you are already in. since/until/after accept ISO 8601, epoch seconds or a ts from an earlier read. Every read fetches live from Slack, so nothing is kept between calls — write down what you need to keep. Message text is standard markdown, but @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
+        // One screen of contract; the paragraph this once was lives in the
+        // pier-slack skill, which the description sends the model to before it
+        // posts — the part that goes wrong without instructions.
+        description: "Read and write Slack through Pier, which holds the bot token. Operations: context (which Slack conversation this session is in), read_channel (transcript for a time range), read_thread (one thread; only what is new since a message via after), read_message (the one at ts), post, edit/delete (Pier's own messages only), channels (what Pier can reach). Omit channel and thread_ts to act on the conversation you are in. since/until/after accept ISO 8601, epoch seconds or a ts. Every read fetches live; nothing is kept between calls. @mentions, #channels and links need Slack's own syntax — read the pier-slack skill before posting.",
         parameters: Type.Object({
             // A JSON-Schema enum emits far fewer tokens than typebox's anyOf-of-consts.
             operation: Type.Unsafe({
@@ -56,6 +70,7 @@ export function slackToolSpec(execute) {
                     "read_thread",
                     "read_message",
                     "post",
+                    "edit",
                     "delete",
                     "channels",
                 ],
@@ -69,12 +84,13 @@ export function slackToolSpec(execute) {
             until: Type.Optional(Type.String()),
             /** Strictly newer than this — "what changed since I last looked". */
             after: Type.Optional(Type.String()),
-            /** The one message `read_message` or `delete` is about. */
+            /** The one message `read_message`, `edit` or `delete` is about. */
             ts: Type.Optional(Type.String()),
             limit: Type.Optional(Type.Number()),
             thread_ts: Type.Optional(Type.String()),
             text: Type.Optional(Type.String()),
         }),
+        available,
         execute,
     };
 }
@@ -83,6 +99,17 @@ const required = (value, field) => {
         throw new Error(`${field} is required`);
     return value.trim();
 };
+/**
+ * Slack rejects an oversized message outright, so the length is checked here:
+ * a refusal the agent can act on beats a post that silently never happened.
+ */
+const messageText = (raw) => {
+    const text = required(raw, "text");
+    if (text.length > MARKDOWN_MAX) {
+        throw new Error(`text is ${text.length} chars; Slack accepts ${MARKDOWN_MAX} per message`);
+    }
+    return text;
+};
 const record = (raw) => raw && typeof raw === "object" && !Array.isArray(raw) ? raw : undefined;
 export async function handleSlackTool(deps, raw, callerSessionId = "") {
     const input = record(raw);
@@ -157,10 +184,7 @@ export async function handleSlackTool(deps, raw, callerSessionId = "") {
         return readMessage(deps, client, channel, required(input.ts, "ts"), asked || undefined);
     }
     if (input.operation === "post") {
-        const text = required(input.text, "text");
-        if (text.length > MARKDOWN_MAX) {
-            throw new Error(`text is ${text.length} chars; Slack accepts ${MARKDOWN_MAX} per message`);
-        }
+        const text = messageText(input.text);
         // Defaults to the thread we are in; `thread_ts: "none"` is the explicit
         // way to start a new top-level message instead.
         const asked = typeof input.thread_ts === "string" ? input.thread_ts.trim() : "";
@@ -182,6 +206,20 @@ export async function handleSlackTool(deps, raw, callerSessionId = "") {
             threadTs: threadTs ?? sent.ts,
         };
     }
+    if (input.operation === "edit") {
+        // Explicit `ts`, for delete's reason: an edit replaces the text outright,
+        // and Slack keeps no visible record of what it said before.
+        const ts = required(input.ts, "ts");
+        const text = messageText(input.text);
+        try {
+            await client.updateMessage({ channel, ts, text, blocks: [{ type: "markdown", text }] });
+        }
+        catch (err) {
+            throw new Error(explain(err));
+        }
+        deps.log(`slack tool edited ${ts} in ${channel}`);
+        return { channel, ts, edited: true };
+    }
     if (input.operation === "delete") {
         // Never defaulted from `here`: the thread's ts is the parent message, and
         // "delete" with an implied target is the one mistake with no undo.
@@ -305,10 +343,12 @@ function explain(err) {
     return {
         channel_not_found: "no such channel, or Pier's bot cannot see it — check the channels operation",
         not_in_channel: "Pier's bot is not in that channel; someone has to invite it before it can read",
-        missing_scope: "Pier's Slack app lacks the scope for this read; the operator must reinstall it",
-        ratelimited: "Slack rate-limited this read; wait a minute or ask for a narrower range",
+        missing_scope: "Pier's Slack app lacks the scope for this call; the operator must reinstall it",
+        ratelimited: "Slack rate-limited Pier; wait a minute, and narrow the range if this was a read",
         thread_not_found: "no thread with that ts in this channel",
         cant_delete_message: "Slack only lets Pier delete what its own bot posted; a person's message has to be deleted by them",
+        cant_update_message: "Slack only lets Pier edit what its own bot posted; anyone else's message can only be replied to",
+        edit_window_closed: "Slack's edit window for that message has closed; post a correction instead of rewriting it",
         message_not_found: "no message with that ts in this channel — a ts only means anything in the conversation it came from",
     }[code] ?? String(err);
 }

package/dist/channels/telegram-api.js

@@ -13,10 +13,14 @@ export class TelegramApi {
         this.token = token;
     }
     async call(method, payload, timeoutMs = 30_000, retry = true) {
+        // An upload is the one call that is not JSON: FormData carries the bytes,
+        // and fetch sets its own multipart boundary. It is re-sendable, so the
+        // flood retry below still works on it.
+        const multipart = payload instanceof FormData;
         const res = await fetch(`${BASE}/bot${this.token}/${method}`, {
             method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify(payload),
+            headers: multipart ? undefined : { "content-type": "application/json" },
+            body: multipart ? payload : JSON.stringify(payload),
             signal: AbortSignal.timeout(timeoutMs),
         });
         const body = (await res.json());
@@ -41,6 +45,21 @@ export class TelegramApi {
     sendMessage(payload) {
         return this.call("sendMessage", payload);
     }
+    /** Bytes, not a file_id or a URL: the file is local to this machine, which
+     *  is the whole reason the agent could not just link it. */
+    async sendFile({ chat_id, message_thread_id, file }) {
+        const form = new FormData();
+        form.set("chat_id", String(chat_id));
+        if (message_thread_id !== undefined)
+            form.set("message_thread_id", String(message_thread_id));
+        const field = file.image ? "photo" : "document";
+        // Copied into a fresh view: a Blob part must be backed by an ArrayBuffer,
+        // and a Buffer read off disk carries the wider ArrayBufferLike type.
+        form.set(field, new Blob([new Uint8Array(file.bytes)]), file.name);
+        // A long upload on a slow link is not a hung request; 30s is the budget
+        // for a JSON call, not for megabytes.
+        await this.call(file.image ? "sendPhoto" : "sendDocument", form, 120_000);
+    }
     async editMessage(payload) {
         await this.call("editMessageText", payload);
     }

package/dist/channels/telegram.js

@@ -14,6 +14,7 @@
 import { formatTurnMeta, isSilentReply, originLabel, quietLabel } from "../core/reply.js";
 import { saveInboundAll } from "../core/inbox.js";
 import { MAX_INBOUND_BYTES } from "../core/inbound-file.js";
+import { sendAttachments, splitAttachments } from "./attach.js";
 import { bindHint, bindResult, picked, STALE_OPTION, STOPPED } from "./lines.js";
 import { logger } from "../log.js";
 import { Chains } from "./chains.js";
@@ -413,7 +414,10 @@ export class TelegramChannel {
      */
     async send(conversation, reply) {
         const { chatId, topicId } = parseConversation(conversation);
-        const text = reply.text.trim();
+        // A file the agent linked is local to this machine, so the link is dead in
+        // Telegram: the bytes are uploaded instead and the label stays in the text.
+        const { text: spoken, paths } = splitAttachments(reply.text);
+        const text = spoken.trim();
         // A turn that produced no text still posts its footer, and says which kind
         // of nothing it was: total silence is indistinguishable from a crash, and
         // the person waiting cannot tell. See AGENTS.md — an empty turn is still an
@@ -430,17 +434,28 @@ export class TelegramChannel {
         // settleAfter: a 👀 left up because the reply failed would sit there until
         // the stale sweep, looking like the agent is still working.
         await this.receipts.settleAfter(conversation, async () => {
-            if (!body.trim())
-                return;
-            const parts = chunk(body);
-            for (const [i, part] of parts.entries()) {
+            if (body.trim()) {
+                const parts = chunk(body);
+                for (const [i, part] of parts.entries()) {
+                    await this.api.sendMessage({
+                        chat_id: chatId,
+                        message_thread_id: topicId,
+                        text: part,
+                        parse_mode: "HTML",
+                        // Next-step buttons ride the last chunk; a click sends the label.
+                        reply_markup: i === parts.length - 1 ? buttons : undefined,
+                    });
+                }
+            }
+            // Attachments follow the words, so the message that introduces them is
+            // above them; anything that could not be sent says so in the chat.
+            const lost = await sendAttachments(paths, (file) => this.api.sendFile({ chat_id: chatId, message_thread_id: topicId, file }), this.log);
+            if (lost) {
                 await this.api.sendMessage({
                     chat_id: chatId,
                     message_thread_id: topicId,
-                    text: part,
+                    text: escapeHtml(lost),
                     parse_mode: "HTML",
-                    // Next-step buttons ride the last chunk; a click sends the label.
-                    reply_markup: i === parts.length - 1 ? buttons : undefined,
                 });
             }
         });

package/dist/cli.js

@@ -21,6 +21,7 @@ Usage
   pier service status         what systemd thinks of it
   pier update                 install the latest release and restart the service
   pier update --check         only say whether one exists
+  pier tools sync             install/update the managed CLI tools (rtk, …)
   pier restart                finish running turns first, then restart the service
   pier reload                 re-read channel config and recycle idle sessions
   pier backup                 snapshot pier.db before a manual update
@@ -103,6 +104,9 @@ else if (command === "update") {
     allowOnly(["check"], "pier update");
     await update(values.check === true);
 }
+else if (command === "tools") {
+    await tools(subcommand);
+}
 else if (command === "restart" || command === "reload") {
     if (subcommand)
         fail(`unexpected argument "${subcommand}"`);
@@ -150,6 +154,36 @@ async function update(checkOnly) {
     say(`npm install -g @timqi/pier@${latest}`);
     say(`then restart Pier.`);
 }
+/**
+ * What the daily task runs, and what an operator can type. The setting is the
+ * instruction; this converges on it and prints what happened, one line per
+ * tool. Non-zero when anything failed — the task run is then a failed run with
+ * this text in it, which is the whole tools status surface.
+ */
+async function tools(action = "") {
+    if (action !== "sync") {
+        process.stderr.write(`pier tools: unknown action "${action}"\n\n${HELP}`);
+        process.exit(2);
+    }
+    allowOnly([], "pier tools sync");
+    const [{ ManagedTools }, { SettingsStore }] = await Promise.all([
+        import("./tools.js"),
+        import("./settings.js"),
+    ]);
+    try {
+        // Read inside the sync's lock, not here: a sync that queued behind another
+        // one must converge on the set as it is when its turn comes.
+        const settings = new SettingsStore();
+        const report = await new ManagedTools().sync(() => settings.get());
+        say(report.summary);
+        if (report.failed)
+            process.exitCode = 1;
+    }
+    catch (err) {
+        process.stderr.write(`pier: tools sync failed: ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exitCode = 1;
+    }
+}
 /** Both are signals to the running unit: SIGUSR2 drains then exits (systemd
  * starts the next process), SIGHUP reloads config in place (main.ts). */
 async function signalService(command) {

package/dist/core/identity.js

@@ -90,3 +90,21 @@ export function splitSpeaker(text) {
         text: text.slice(m[0].length),
     };
 }
+/**
+ * A session titled by its first prompt inherits that prompt's header, and the
+ * header is for the model: anything a person reads — a list row, a session
+ * header, a notification on a phone — would say "operator: …" on every session
+ * the workbench ever opened. So the speaker comes off and what they said is
+ * the title. Here rather than in a UI module because the push notification
+ * needs the same answer and a second copy of this would drift (AGENTS.md §3).
+ */
+export function readableTitle(title) {
+    if (!title)
+        return title;
+    const { text } = splitSpeaker(title);
+    // No header — the title is what the person typed, and reflowing it would
+    // change what the sidebar's search is matching against for nothing.
+    if (text === title)
+        return title;
+    return text.replace(/\s+/g, " ").trim() || title;
+}

package/dist/core/inbound-file.js

@@ -41,7 +41,9 @@ export const fileMarker = (path) => `[${path.split("/").pop() ?? "file"}](file:/
 /**
  * The conversation-visible line for an attachment that never made it (5b: a
  * failed download must not look like no attachment). Plain text on purpose —
- * not a link — so every surface renders it as the words it is.
+ * not a link — so every surface renders it as the words it is. Both
+ * directions: an inbound file Pier could not fetch and an outbound one it
+ * could not upload (channels/attach.ts) are the same fact to the reader.
  */
 export const lostMarker = (name, reason) => `[attachment lost: ${name} — ${reason}]`;
 // A whole line that is one `[name](file:///…)` link — what fileMarker emits.

package/dist/core/reply.js

@@ -52,7 +52,8 @@ new day — so the last one still applies; a gap alone shows as time only, like
 export function surfacePrompt(instance) {
     const reach = instance.publicUrl
         ? `Address: ${instance.publicUrl} — a board's link is that plus ` +
-            "`/boards/<slug>/`, or `/p/<slug>/` once published."
+            "`/boards/<slug>/`, or `/p/<slug>-<token>/` once published, where `token` " +
+            "is the random field the manifest carries beside `public`."
         : "No public address is configured (the user sets one in Console → Settings), " +
             "so give paths and never guess a host.";
     return `${REPLY_SURFACE_PROMPT}

package/dist/core/router.js

@@ -224,6 +224,15 @@ export class Router {
                     });
                 });
             }
+            // A queued message with no turn left to deliver it. `decide` reads the
+            // state once, so a steer chosen against a turn that ends before the call
+            // lands sits in Pi's queue until some *later* turn reads it — on IM that
+            // is indistinguishable from the message never arriving (§5b). Pi drains
+            // its own queues up to the agent_end handler, so a non-empty queue on an
+            // idle session is exactly the message that missed that window.
+            if (payload.type === "queue-state" && (payload.steering.length || payload.followUp.length)) {
+                this.promoteQueued(session, key);
+            }
             // Every turn-end reaches the channel, empty text included: an adapter's
             // per-turn UI (Telegram's 👀 receipts) is retired here, and a turn that
             // settled with nothing to say still has to settle.
@@ -245,9 +254,69 @@ export class Router {
             unsubscribe,
         });
     }
+    /** Sessions whose queue is being promoted right now. `clearQueue` and the
+     *  prompt that follows it both emit queue-state of their own, so without
+     *  this the handler would re-enter on its own effects. */
+    promoting = new Set();
+    /**
+     * Turn a stranded queue into the turn it was waiting for. Not routed through
+     * `dispatch`: the text was prefixed when it was first dispatched
+     * (identity.ts), and sending it back through would head it a second time.
+     *
+     * Only ever reached from a queue-state event, never from a turn ending: Pi
+     * leaves the queue alone on `abort()`, so promoting on idle would make /stop
+     * start the very turn it was asked to stop. Recovering *those* messages stays
+     * the web's recall route, which hands them back to the composer.
+     */
+    promoteQueued(session, key) {
+        if (session.state !== "idle" || this.promoting.has(session.id))
+            return;
+        this.promoting.add(session.id);
+        void (async () => {
+            try {
+                // Re-read: a turn may have started since the event, and it will drain
+                // the queue itself — clearing it here would take the messages out of it.
+                if (session.state !== "idle")
+                    return;
+                const { steering, followUp } = await session.clearQueue();
+                const text = [...steering, ...followUp].join("\n").trim();
+                if (!text)
+                    return;
+                // A drain is "no new turns", and this would be one. Told to the
+                // conversation rather than dropped, because the message is now out of
+                // the queue and nothing else would ever mention it (§5b).
+                if (this.draining) {
+                    this.report(session.id, key, `queued message not taken — Pier is restarting; send it again: ${truncate(text)}`);
+                    return;
+                }
+                log.info(`promoting ${String(steering.length + followUp.length)} queued message(s) → session ${session.id}`);
+                await session.prompt(text);
+            }
+            catch (err) {
+                this.report(session.id, key, `delivering the queued messages failed: ${String(err)}`);
+            }
+            finally {
+                this.promoting.delete(session.id);
+            }
+        })();
+    }
     async abort(sessionId) {
         await this.bySession.get(sessionId)?.session.abort();
     }
+    /**
+     * Drop what this session was told about who is speaking, so the next message
+     * carries a full header again.
+     *
+     * For the surfaces that take a prefixed message back *out* of the context it
+     * was counted into — a recalled queue, a rewound turn. The tracker's whole
+     * job is "the model has already been told" (identity.ts), and a header that
+     * never reached the model, or reached it and was then rewound away, makes
+     * every later message from that speaker unattributed in a group chat. One
+     * redundant header is the same price eviction already pays.
+     */
+    forgetSender(sessionId) {
+        this.senders.forget(sessionId);
+    }
     /** Refuse new work from every surface; in-flight turns keep running. */
     beginDrain() {
         this.draining = true;
@@ -384,6 +453,9 @@ export class Router {
         // Turn outcomes flow through the event stream; a rejected call surfaces
         // there too, never as a thrown exception across the seam.
         session[action](prompt).catch((err) => {
+            // The header was counted as delivered a line above; this message never
+            // arrived, so the next one from this speaker must carry it again.
+            this.senders.forget(session.id);
             this.report(session.id, msg.key, String(err));
         });
         return { sessionId: session.id };

package/dist/db.js

@@ -175,6 +175,84 @@ const MIGRATIONS = [
   -- every one of its rows because a project is a cwd, not a table.
   ALTER TABLE session_state ADD COLUMN sort INTEGER;
   ALTER TABLE session_state ADD COLUMN project_sort INTEGER;
+  `,
+    // 7 — the session listing, so a transcript is read once (agent/listing.ts).
+    `
+  -- One row per session file. (size, mtime) is what makes the row usable
+  -- without opening the file; parsed_bytes is where reading resumes when it
+  -- grew, and is always a line boundary. Derived from disk and disposable: a
+  -- deleted row costs one re-read, never a fact.
+  CREATE TABLE session_index (
+    path TEXT PRIMARY KEY,
+    id TEXT NOT NULL,
+    cwd TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    name TEXT,
+    first_message TEXT,
+    size INTEGER NOT NULL,
+    mtime INTEGER NOT NULL,
+    parsed_bytes INTEGER NOT NULL
+  );
+  `,
+    // 8 — Projects holds a working set: what is warm, plus what is kept.
+    `
+  -- Membership was permanent, so every throwaway session stayed in the rail
+  -- until someone removed it by hand. last_active is the lease: the end of a
+  -- turn renews it, and web/session-state.ts stops listing a row that ran out.
+  -- kept opts one row out of expiry entirely — what the pin control now means.
+  ALTER TABLE session_state ADD COLUMN kept INTEGER NOT NULL DEFAULT 0;
+  ALTER TABLE session_state ADD COLUMN last_active INTEGER;
+  -- Left NULL on purpose: the honest value is when the transcript was last
+  -- written, which only a listing knows. web/server.ts pays one for a database
+  -- carrying rows without it, the same gate the pin backfill already uses, so
+  -- the first rail after an upgrade is dated by use and not by creation.
+  `,
+    // 9 — the summary a transcript already carries is read, not mirrored.
+    `
+  -- Dropped rather than left unread: a column nobody writes still answers when
+  -- somebody selects it, and the next reader has no way to tell a stale title
+  -- from a current one. The pre-migration backup beside the database is the
+  -- way back, not a row of fossils. cwd stays — it is the key a project's
+  -- manual place is stamped on, and it never changes for a session.
+  ALTER TABLE session_state DROP COLUMN title;
+  ALTER TABLE session_state DROP COLUMN created_at;
+  ALTER TABLE session_state DROP COLUMN last_active;
+  `,
+    // 10 — taking a session into Projects is itself an act, and it is dated.
+    `
+  -- When a hand last put this session in Projects (pin, or a keep toggle).
+  -- Not the mirror migration 9 removed: last_active was a copy of a fact the
+  -- transcript owns, while this one exists nowhere else — pinning a cold
+  -- session back is a statement that it is warm again, and without a record of
+  -- *when* it was made the row is dropped by the same read that drew it.
+  -- NULL for every row that predates this: never pinned within a lease.
+  ALTER TABLE session_state ADD COLUMN pinned_at INTEGER;
+  `,
+    // 11 — Projects holds what a hand put there, for as long as the hand says.
+    `
+  -- The lease is gone, so both of its columns are. It expired nothing: a row
+  -- it dropped kept its transcript, its place and its ownership, and one more
+  -- turn brought it back — so what it actually did was hide rows nobody asked
+  -- it to hide, and kept existed only to opt out of that. On the instance this
+  -- was decided on, the lease had never dropped a row: 20 pinned sessions,
+  -- none past seven days, one kept. Removing a row from Projects is the ✓ on
+  -- the row, and it stays the only way out.
+  ALTER TABLE session_state DROP COLUMN kept;
+  ALTER TABLE session_state DROP COLUMN pinned_at;
+  `,
+    // 12 — one row is how two processes take turns (src/tools.ts).
+    `
+  -- The tools sync, held across processes: the token says who holds it, the
+  -- heartbeat says they are still alive. Both processes already open this
+  -- database, and BEGIN IMMEDIATE is real mutual exclusion — a lock file with
+  -- a pid in it is neither, which is what this replaces. One row, because
+  -- there is one thing to serialize; the second lock can bring its own table
+  -- and its own reason for existing.
+  CREATE TABLE tools_sync_lock (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    token TEXT NOT NULL,
+    heartbeat_at INTEGER NOT NULL
+  );
   `,
 ];
 let shared;

package/dist/extensions/index.js

@@ -22,11 +22,14 @@ export const BUNDLED = [
         factory: web,
     },
 ];
-/** The catalog a surface may show: no Pi types, nothing it cannot render. */
+/** The catalog a surface may show: no Pi types, nothing it cannot render.
+ *  Half of one list; src/tools.ts has the other. */
 export const bundledInfo = (enabled) => BUNDLED.map(({ name, summary, tools }) => ({
+    source: "bundled",
+    kind: "extension",
     name,
     summary,
-    tools,
+    adds: tools,
     enabled: enabled.includes(name),
 }));
 /** The enabled ones as Pi inline extensions; unknown names are not ours. */

package/dist/extensions/web/artifacts.js

@@ -34,11 +34,16 @@ function displayUrl(url) {
     }
     return redacted.toString();
 }
+const digest = (value) => createHash("sha256").update(value).digest("hex").slice(0, 12);
 export async function saveArtifact(url, text, retrievedAt) {
     await mkdir(ARTIFACT_DIR, { recursive: true, mode: 0o700 });
     const host = url.hostname.replace(/[^a-zA-Z0-9.-]+/g, "-").slice(0, 80) || "page";
-    const hash = createHash("sha256").update(url.toString()).digest("hex").slice(0, 16);
-    const path = join(ARTIFACT_DIR, `${host}-${hash}.md`);
+    // The URL alone is not the file's identity: a page fetched again is a
+    // different document, and keying on the URL overwrote the copy an older
+    // transcript's `artifactPath` still points at — the one promise this file
+    // makes. Content decides, so a refetch that changed writes a new file and one
+    // that did not costs nothing.
+    const path = join(ARTIFACT_DIR, `${host}-${digest(url.toString())}-${digest(text)}.md`);
     const temporary = `${path}.${randomUUID()}.tmp`;
     const header = [
         `Source: ${displayUrl(url)}`,