@timqi/pier 0.1.3 → 0.1.5

package/README.md

@@ -2,7 +2,7 @@
 
 A self-hosted workspace for coding agents. Pier puts a web workbench and your
 IM channels in front of [Pi](https://github.com/earendil-works/pi) sessions:
-talk to the same agent from a browser, Slack, Telegram or Lark, steer a running
+talk to the same agent from a browser, Slack or Lark, steer a running
 turn, schedule tasks, watch every session, and publish a static page when
 something is worth showing.
 
@@ -37,8 +37,8 @@ otherwise).
 **The first start generates a password and prints it once.** Lost it?
 `sqlite3 ~/.pier/db/pier.db 'DELETE FROM auth'` and restart. Open
 `http://localhost:3141`, sign in; **Console → Settings** configures Models,
-Agent, Channels, the public URL, password and master key; **New session** picks
-the directory the agent's shell runs in.
+Agent, Channels, Vault, the public URL, password and master key; **New session**
+picks the directory the agent's shell runs in.
 
 ## Configure Pi
 
@@ -62,12 +62,17 @@ Console → Settings:
   `models.json` structure, globally or per project scope (with that project's
   `.pi/skills` and `.pi/extensions` listed). Changes apply when a session next
   opens; saving recycles idle sessions; **Settings → Instance → Reload** does
-  the same for files changed elsewhere. Also here: the bundled extensions
-  (`web`: `web_search` on Anthropic or OpenAI, `web_fetch` on Anthropic; a
-  copy of yours registering the same tool makes Pier's stand down) and the
+  the same for files changed elsewhere. Also here: Pier's own skills
+  (`pier web search|fetch` reaches the web through the provider's hosted
+  tools — Anthropic or OpenAI, no key of your own) and the
   managed CLI tools (`rtk`, `rg`, `fd`, `wt`, `jq`, or your own as a
   [ubix](https://github.com/timqi/ubix) block), installed into
-  `~/.pier/tools/bin`, first on every session's PATH.
+  `~/.pier/tools/bin`, first on every session's PATH beside the `pier` shim
+  Pier writes there at start.
+- **Vault** — named secrets an agent's commands receive through `pier vault
+  run` without the value entering its context (`docs/design/07-vault.md`);
+  `pier slack` and `pier task` reach the running Pier the same way
+  (`docs/design/08-cli-socket.md`).
 
 On first credential access an existing `auth.json` is imported into the sealed
 store and renamed `auth.json.imported`; literal keys in `models.json` likewise

package/dist/agent/config.js

@@ -15,9 +15,15 @@ const PROJECT_FILES = ["AGENTS.md"];
 const READONLY_FILES = ["settings.json"];
 const SNAPSHOT_FILES = ["SYSTEM.md", "AGENTS.md", "models.json", "settings.json"];
 /** What a first boot writes (docs/deploy.md says why each key): the list the
- *  Console installs into, and Pi's attribution headers off — a server is not a
- *  person to survey. Every other key stays Pi's default by omission. */
-const SEED_SETTINGS = { packages: [], enableInstallTelemetry: false };
+ *  Console installs into, Pi's attribution headers off — a server is not a
+ *  person to survey — and a retry budget of minutes, because an unattended
+ *  instance has nobody to re-ask after Pi's 14-second default gives up. Every
+ *  other key stays Pi's default by omission. */
+const SEED_SETTINGS = {
+    packages: [],
+    enableInstallTelemetry: false,
+    retry: { maxRetries: 5, baseDelayMs: 5000 },
+};
 /** Pier owns the Pi runtime dir; main.ts exports it as PI_CODING_AGENT_DIR. */
 export const defaultAgentDir = () => process.env.PI_CODING_AGENT_DIR ?? pierPath("pi");
 /** Stable mask: mapped back by field, without exposing key fragments. */

package/dist/agent/events.js

@@ -33,8 +33,7 @@ function systemOrigin(message) {
     }
     if (origin.kind === "task-message" &&
         typeof origin.messageId === "string" &&
-        (origin.messageKind === "steer" || origin.messageKind === "follow_up" ||
-            origin.messageKind === "progress" || origin.messageKind === "decision" || origin.messageKind === "reply"))
+        (origin.messageKind === "steer" || origin.messageKind === "follow_up"))
         return shape;
     return null;
 }
@@ -201,9 +200,14 @@ export function toSessionEvents(e) {
                 return [];
             // Carried twice: on turn-end because it is how the turn ended (what a
             // task run settles on), and as the error event every chat surface reports.
+            // `toolUse` without a tool call is a provider protocol violation (the
+            // block was billed but never delivered); Pi ends the run on it, so it
+            // reaches the conversation as the failure it is, not as an empty turn.
             const failure = final?.stopReason === "error"
                 ? final.errorMessage || "unknown agent error"
-                : undefined;
+                : final?.stopReason === "toolUse" && !hasToolCalls(final)
+                    ? "the provider stopped on tool_use but sent no tool call"
+                    : undefined;
             const out = [
                 { type: "turn-end", text: hasToolCalls(final) ? "" : textOf(final?.content), ...(failure ? { error: failure } : {}) },
             ];
@@ -229,8 +233,12 @@ export function toSessionEvents(e) {
             // On the message, not its text: an attachment with no caption is still a turn.
             const out = [{ type: "turn-start" }];
             const text = textOf(m.content);
-            if (text)
-                out.push(origin ? { type: "system-input", text, origin } : { type: "user-message", text });
+            if (text) {
+                out.push(origin
+                    // `at` is what `turnMetaAt` will read back as this turn's start.
+                    ? { type: "system-input", text, origin, at: m.timestamp }
+                    : { type: "user-message", text });
+            }
             return out;
         }
         case "message_update": {

package/dist/agent/listing.js

@@ -15,6 +15,13 @@ const log = logger("agent");
 const AUDIT_SAMPLE = 5;
 const titleOf = (name, first) => name || first || undefined;
 const str = (v) => (typeof v === "string" ? v : undefined);
+/** The budget is the words, not the header: a 34-character Lark id would spend
+ *  it all and leave a clip that no longer parses back as a header. */
+function clipTitle(whole, clean) {
+    const body = clean(whole);
+    const header = whole.slice(0, whole.length - body.length);
+    return header + body.slice(0, SESSION_TITLE_MAX);
+}
 /** A reply that calls a tool is a step, not a reply (events.ts), and steps are
  *  not indexed. `clean` takes off the speaker header (core/identity.ts), which
  *  as text would make "operator" hit every session. */
@@ -67,7 +74,7 @@ function fold(acc, line, clean) {
         // through core/identity.ts.
         if (acc.first || said.role !== "user")
             return acc;
-        return { ...acc, first: textOf(message?.content).trim().slice(0, SESSION_TITLE_MAX) };
+        return { ...acc, first: clipTitle(textOf(message?.content).trim(), clean) };
     }
     return acc;
 }
@@ -201,7 +208,8 @@ export class IndexedListing {
             const want = info && {
                 cwd: info.cwd,
                 created: info.created.getTime(),
-                title: info.name ?? info.firstMessage?.slice(0, SESSION_TITLE_MAX),
+                title: info.name ??
+                    (info.firstMessage ? clipTitle(info.firstMessage.trim(), this.clean) : undefined),
             };
             if (want && want.cwd === seen.cwd && want.created === seen.created &&
                 want.title === seen.title)

package/dist/agent/packages.js

@@ -6,16 +6,12 @@ import { existsSync, promises as fs } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { DefaultPackageManager, SettingsManager, } from "@earendil-works/pi-coding-agent";
 import { PackageError, } from "../core/types.js";
-import { BUNDLED } from "../extensions/index.js";
 import { logger } from "../log.js";
 import { defaultAgentDir } from "./config.js";
-import { shadowedBuiltin } from "./pi.js";
 const log = logger("packages");
 /** Set by how long a released fix may sit unnoticed, like update.ts. */
 const CHECK_EVERY_MS = 24 * 60 * 60_000;
 const KINDS = { extensions: "extension", skills: "skill" };
-/** The state line for a skill whose tool this instance is not given (docs/design/03). */
-const FOLLOWS_TOOL = "follows Channels → agent tool";
 /** Written by `rtk init -g --agent pi` (the rtk block's `post_install` hook): a `local` file whose
  *  switch is the rtk tool's, so a settings.json pattern would fight the tool. */
 const RTK_FILE = join("extensions", "rtk.ts");
@@ -154,22 +150,14 @@ export class PiPackageStore {
     }
     async #fillPier(pkg) {
         pkg.version = this.pier.version;
-        const { extensions: on, skillsOff: off } = this.pier.settings.get();
-        // Off is off: a stand-down recorded while it was on is not this switch's state.
-        pkg.resources = BUNDLED.map(({ name }) => ({
-            kind: "extension", name, path: `<inline:${name}>`, enabled: on.includes(name),
-            state: on.includes(name) ? shadowedBuiltin(name) : null,
-        }));
-        const gone = new Set(this.pier.tools.filter((t) => t.skill && !(t.available?.() ?? true)).map((t) => t.skill));
+        const { skillsOff: off } = this.pier.settings.get();
+        pkg.resources = [];
         for (const dir of this.skillDirs) {
             for (const entry of (await fs.readdir(dir, { withFileTypes: true })).filter((e) => e.isDirectory())) {
                 const path = join(dir, entry.name, "SKILL.md");
                 if (!existsSync(path))
                     continue;
-                pkg.resources.push({
-                    kind: "skill", name: entry.name, path, enabled: !off.includes(entry.name),
-                    state: gone.has(entry.name) ? FOLLOWS_TOOL : null,
-                });
+                pkg.resources.push({ kind: "skill", name: entry.name, path, enabled: !off.includes(entry.name), state: null });
             }
         }
     }
@@ -271,11 +259,7 @@ export class PiPackageStore {
         if (resource.locked)
             throw new PackageError("refused", `${resource.name} is ${resource.state} — its switch is under Tools`);
         if (pkg.kind === "pier") {
-            const { extensions, skillsOff } = this.pier.settings.get();
-            if (kind === "skill")
-                this.pier.settings.setSkillsOff(withName(skillsOff, resource.name, !enabled));
-            else
-                this.pier.settings.setExtensions(withName(extensions, resource.name, enabled));
+            this.pier.settings.setSkillsOff(withName(this.pier.settings.get().skillsOff, resource.name, !enabled));
         }
         else {
             const key = kind === "extension" ? "extensions" : "skills";

package/dist/agent/pi.js

@@ -1,10 +1,9 @@
-// The only file outside src/extensions allowed to import @earendil-works/pi-*.
+// One of the two files (with packages.ts) allowed to import @earendil-works/pi-*.
 // Implements the AgentFactory/AgentSession seam from src/core/types.ts on the
 // Pi SDK. No Pi type may appear in an exported signature.
 import { realpathSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
-import { createAgentSession, CredentialSynchronizationError, DefaultResourceLoader, defineTool, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
-import { inlineExtensions } from "../extensions/index.js";
+import { createAgentSession, CredentialSynchronizationError, DefaultResourceLoader, ModelRegistry, ModelRuntime, SessionManager, } from "@earendil-works/pi-coding-agent";
 import { SESSION_TITLE_MAX } from "../core/types.js";
 import { logger } from "../log.js";
 import { textOf, toChatTurns, toSessionEvents, turnMetaAt, } from "./events.js";
@@ -64,7 +63,7 @@ const TITLE_MAX_TOKENS = 40;
 const TITLE_TIMEOUT_MS = 20_000;
 const TITLE_PROMPT = "Name this conversation for a session list. Reply with the title only: at most 12 Chinese characters " +
     "or 6 English words, in the language the user wrote in, no quotes, no trailing period. " +
-    "A leading `[name<id> time]` on the user's message is a speaker header, not content.";
+    "A leading `[name time]` or `[name<id> time]` on the user's message is a speaker header, not content.";
 /** The halves are labelled so a reply quoting an instruction back is not
  *  mistaken for one. */
 const titleRequest = (first, reply) => `${TITLE_PROMPT}\n\n<user>\n${first.slice(0, TITLE_INPUT_CHARS)}\n</user>\n\n<assistant>\n${reply.slice(0, TITLE_INPUT_CHARS)}\n</assistant>`;
@@ -112,42 +111,6 @@ const bashTimeoutDefault = (pi) => {
         }
     });
 };
-/** What the last session open stood down, by bundled extension name: the
- *  registry (agent/packages.ts) shows it as the row's state. Known only at
- *  open, so a built-in no session has loaded since reads nothing. */
-const shadowed = new Map();
-export const shadowedBuiltin = (name) => shadowed.get(name) ?? null;
-/** Pi loads a bundled extension and its on-disk twin both, leaving two tools
- *  of one name; the copy the user put there wins, and the journal says so (§5). */
-export const standDownShadowed = (base) => {
-    const inline = (ext) => ext.path.startsWith("<inline:");
-    const onDisk = new Map(base.extensions.filter((ext) => !inline(ext)).flatMap((ext) => [...ext.tools.keys()].map((tool) => [tool, ext.path])));
-    return {
-        ...base,
-        extensions: base.extensions.filter((ext) => {
-            if (!inline(ext))
-                return true;
-            const name = ext.path.slice("<inline:".length, -1);
-            const clash = [...ext.tools.keys()].filter((tool) => onDisk.has(tool));
-            if (!clash.length) {
-                shadowed.delete(name);
-                return true;
-            }
-            const from = onDisk.get(clash[0]);
-            shadowed.set(name, `stood down — ${clash.join(", ")} from ${from}`);
-            log.info(`bundled ${ext.path} stood down — ${clash.join(", ")} already loaded from ${from}`);
-            return false;
-        }),
-    };
-};
-/** A skill's description is resident in every prompt; one pointing at a tool
- *  this session was not given is a route the agent cannot take. */
-export const standDownUndocumented = (tools, skills) => {
-    const gone = new Set(tools.filter((tool) => tool.skill && !(tool.available?.() ?? true)).map((tool) => tool.skill));
-    if (!gone.size)
-        return skills;
-    return skills.filter((skill) => !gone.has(skill.name));
-};
 export class PiSession {
     pi;
     pinned;
@@ -400,7 +363,6 @@ export class PiSession {
     }
 }
 export class PiAgentFactory {
-    extraTools;
     instructions;
     skillPaths;
     credentials;
@@ -409,9 +371,9 @@ export class PiAgentFactory {
     pier;
     titleModel;
     listings;
-    constructor(extraTools = [], 
-    /** Getters are read per session open, so a Console change reaches the next
-     *  session without a restart. Appended as a context file so the user's own
+    constructor(
+    /** Read per session open, so a Console change reaches the next session
+     *  without a restart; appended as a context file so the user's own
      *  instructions still win. */
     instructions = () => "", 
     /** Loaded per session, never installed into the user's skill directories. */
@@ -419,11 +381,10 @@ export class PiAgentFactory {
     /** Optional only for bare test factories; an OAuth refresh persists here,
      *  never to a plaintext auth.json. */
     credentials, providerConfig = new PiConfigStore(), pinned = () => [], 
-    /** The built-in `pier` package's switches: bundled extensions on, Pier's own skills off. */
-    pier = () => ({ extensions: [], skillsOff: [] }), titleModel = () => undefined, 
+    /** The built-in `pier` package's one switch list: Pier's own skills switched off. */
+    pier = () => ({ skillsOff: [] }), titleModel = () => undefined, 
     /** Injected so a test needs no session directory or database. */
     listings = new IndexedListing()) {
-        this.extraTools = extraTools;
         this.instructions = instructions;
         this.skillPaths = skillPaths;
         this.credentials = credentials;
@@ -616,8 +577,14 @@ export class PiAgentFactory {
     async logout(providerId) {
         await (await this.authRuntime()).logout(providerId, { signal: AbortSignal.timeout(15_000) });
     }
+    /** Pi's registry over the shared runtime, so an OAuth refresh lands in the
+     *  credential store like every other request's. */
+    async webContext(active) {
+        const modelRegistry = new ModelRegistry(await this.refreshedRuntime());
+        return { modelRegistry, model: active && modelRegistry.find(active.provider, active.id) };
+    }
     async resourceLoader(cwd) {
-        const { extensions, skillsOff } = this.pier();
+        const { skillsOff } = this.pier();
         const loader = new DefaultResourceLoader({
             cwd,
             agentDir: defaultAgentDir(),
@@ -628,13 +595,9 @@ export class PiAgentFactory {
             // same name is Pi's to switch (settings.json).
             skillsOverride: (base) => ({
                 ...base,
-                skills: standDownUndocumented(this.extraTools, base.skills.filter((skill) => !skillsOff.includes(skill.name) || !this.skillPaths.some((dir) => skill.filePath.startsWith(dir + sep)))),
+                skills: base.skills.filter((skill) => !skillsOff.includes(skill.name) || !this.skillPaths.some((dir) => skill.filePath.startsWith(dir + sep))),
             }),
-            extensionFactories: [
-                { name: "pier-bash-timeout", factory: bashTimeoutDefault, hidden: true },
-                ...inlineExtensions(extensions),
-            ],
-            extensionsOverride: standDownShadowed,
+            extensionFactories: [{ name: "pier-bash-timeout", factory: bashTimeoutDefault, hidden: true }],
             agentsFilesOverride: (current) => {
                 const content = this.instructions();
                 return {
@@ -651,36 +614,6 @@ export class PiAgentFactory {
         return this.providerConfig.withWrite(() => this.openSnapshot(cwd, sessionManager, opts));
     }
     async openSnapshot(cwd, sessionManager, opts) {
-        let live;
-        // Per open: an unconfigured tool would cost context on every turn and answer nothing.
-        const active = this.extraTools.filter((tool) => tool.available?.() ?? true);
-        const customTools = active.map((tool) => defineTool({
-            name: tool.name,
-            label: tool.label,
-            description: tool.description,
-            parameters: tool.parameters,
-            execute: async (_id, params, signal) => {
-                const caller = live?.sessionId ?? "unknown";
-                log.debug(`tool ${tool.name} called by ${caller}`);
-                try {
-                    return {
-                        content: [
-                            {
-                                type: "text",
-                                // Pretty-printing costs ~20% more tokens and buys the model nothing.
-                                text: JSON.stringify(await tool.execute(params, caller, signal)),
-                            },
-                        ],
-                        details: {},
-                    };
-                }
-                catch (err) {
-                    // Pi turns this into tool-result text: the right recovery, the wrong record.
-                    log.warn(`tool ${tool.name} failed for ${caller}`, err);
-                    throw err;
-                }
-            },
-        }));
         // A locked store is a refusal with a reason here, not "provider not
         // configured" later. Before appendSessionInfo, so nothing is written.
         this.credentials?.assertUnlocked();
@@ -696,11 +629,10 @@ export class PiAgentFactory {
         const created = await createAgentSession({
             cwd,
             sessionManager,
-            customTools,
             modelRuntime: runtime,
             resourceLoader: await this.resourceLoader(cwd),
         });
-        live = created.session;
+        const live = created.session;
         // Pi defaults to one follow-up per turn boundary, so N queued messages cost
         // N turns. The agent's setter flips only the in-memory queue;
         // `session.setFollowUpMode` would persist it to Pi's settings.json.

package/dist/channels/attach.js

@@ -5,8 +5,8 @@
 import { readFile, stat } from "node:fs/promises";
 import { basename, extname } from "node:path";
 import { lostMarker, replaceOutsideCode } from "../core/inbound-file.js";
-/** Telegram refuses a photo past 10 MB, the smallest of the three; one cap so
- *  a turn does not land on one chat and not another. */
+/** Lark refuses an image past 10 MB, the smaller of the two; one cap so a
+ *  turn does not land on one chat and not another. */
 export const MAX_ATTACH_BYTES = 10 * 1024 * 1024;
 const MAX_ATTACHMENTS = 5;
 /** svg excluded deliberately: it is markup, and renders as a file. */

package/dist/channels/commands.js

@@ -1,17 +1,19 @@
-// Slash commands in IM text, parsed once for every platform: Telegram appends
-// `@botname` when several bots share a group, clients add whitespace, users capitalise.
+// Slash commands in IM text, parsed once for every platform: clients add
+// whitespace and capitalise.
+/** The configure-first trigger, one spelling on both platforms: `s <text>`
+ *  (Lark also `/s <text>`), the text being the panel's pending question. A bare
+ *  `s` carries no question and is prose. */
+export function settingsDraft(text) {
+    return /^\/?s[ \t]+(\S[\s\S]*)$/i.exec(text.trim())?.[1];
+}
 export function parseCommand(text) {
     const trimmed = text.trim();
     if (!trimmed.startsWith("/"))
         return null;
     // Args verbatim: a path or a sentence must keep its own spacing.
     const match = /^\/(\S+)[ \t]*([\s\S]*)$/.exec(trimmed);
-    const [name = "", target] = (match?.[1] ?? "").split("@");
+    const name = match?.[1] ?? "";
     if (!name)
         return null; // a bare "/" is not a command
-    return {
-        name: name.toLowerCase(),
-        args: match?.[2] ?? "",
-        ...(target ? { target } : {}),
-    };
+    return { name: name.toLowerCase(), args: match?.[2] ?? "" };
 }

package/dist/channels/config.js

@@ -1,23 +1,30 @@
 // Channel config persistence and the permission gate every adapter shares: one
 // JSON document per platform, so a surface configuring one reads and writes one row.
 import { randomInt } from "node:crypto";
-import { pierDb } from "../db.js";
-import { isSealed } from "../secrets.js";
 import { defaultChannelConfig, } from "./types.js";
 const BIND_CODE_TTL_MS = 10 * 60_000;
 /** Six symbols out of 36 is 2 billion, but a caller who may retry forever only
  *  needs the TTL; five wrong tries void the code instead. */
 const BIND_CODE_TRIES = 5;
 const BIND_CODE_ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+/** Where each platform's credentials live in the vault — fixed names, so a
+ *  skill and the Console agree without a setting. Migration 24 spells the same
+ *  table in SQL. */
+const CREDENTIAL_NAMES = {
+    slack: { token: "SLACK_TOKEN", appToken: "SLACK_APP_TOKEN" },
+    lark: { token: "LARK_APP_ID", appToken: "LARK_APP_SECRET" },
+};
+const credentials = (platform) => Object.entries(CREDENTIAL_NAMES[platform]);
 export class ChannelStore {
-    secrets;
     db;
+    vault;
     cache = new Map();
-    /** Without `secrets` (tests), tokens persist as given. A locked store throws
-     *  rather than serving a token it cannot read. */
-    constructor(db = pierDb(), secrets) {
-        this.secrets = secrets;
+    /** The row never holds a credential: `token`/`appToken` are filled from the
+     *  vault on read and filed there on save. A locked vault throws rather than
+     *  serving a token it cannot read. */
+    constructor(db, vault) {
         this.db = db;
+        this.vault = vault;
     }
     /** Private: handed out, a caller could mutate config without saving. */
     cached(platform) {
@@ -28,11 +35,8 @@ export class ChannelStore {
         const config = row
             ? { ...defaultChannelConfig(), ...JSON.parse(row.json) }
             : defaultChannelConfig();
-        if (this.secrets) {
-            for (const key of ["token", "appToken"]) {
-                if (isSealed(config[key]))
-                    config[key] = this.secrets.decrypt(config[key]);
-            }
+        for (const [key, name] of credentials(platform)) {
+            config[key] = this.vault.get(name) ?? "";
         }
         this.cache.set(platform, config);
         return config;
@@ -41,16 +45,21 @@ export class ChannelStore {
         return structuredClone(this.cached(platform));
     }
     save(platform, config) {
+        // The cache holds plaintext; the row holds neither key. Only a changed
+        // credential touches the vault, so its `updated` is the rotation, not the
+        // last chat discovered; an emptied field removes the row.
+        const before = this.cached(platform);
+        for (const [key, name] of credentials(platform)) {
+            if (config[key] === before[key])
+                continue;
+            if (config[key])
+                this.vault.seal(name, config[key]);
+            else
+                this.vault.remove(name);
+        }
         // Cloned, so the caller's object cannot reach into the cache later.
         this.cache.set(platform, structuredClone(config));
-        // The cache holds plaintext; only the row is sealed.
-        const stored = this.secrets ? structuredClone(config) : config;
-        if (this.secrets) {
-            for (const key of ["token", "appToken"]) {
-                if (stored[key])
-                    stored[key] = this.secrets.encrypt(stored[key]);
-            }
-        }
+        const { token: _token, appToken: _appToken, ...stored } = config;
         this.db.prepare(`
       INSERT INTO channels(platform, json) VALUES (?, ?)
       ON CONFLICT(platform) DO UPDATE SET json = excluded.json
@@ -59,9 +68,9 @@ export class ChannelStore {
     chat(platform, chatId) {
         return this.get(platform).chats.find((c) => c.id === chatId);
     }
-    /** Telegram has no "list my chats" API, so discovery is passive and happens
-     *  on every message: the unchanged case must cost no clone. A new chat copies
-     *  the platform defaults and owns them from then on. */
+    /** No platform reliably lists every chat a bot is in, so discovery is passive
+     *  and happens on every message: the unchanged case must cost no clone. A new
+     *  chat copies the platform defaults and owns them from then on. */
     discoverChat(platform, chat) {
         const cached = this.cached(platform).chats.find((c) => c.id === chat.id);
         if (cached && cached.name === chat.name && cached.kind === chat.kind)
@@ -92,7 +101,6 @@ export class ChannelStore {
             enabled: true,
             requireMention: config.requireMention,
             requireBind: config.requireBind,
-            topicMode: config.topicMode,
             cwd: config.cwd,
             model: config.model,
             thinking: config.thinking,

package/dist/channels/control.js

@@ -1,8 +1,11 @@
 // What an adapter may do to a session beyond handing it a prompt. Not part of
 // the `Channel` seam: the channel layer owns the router and hands adapters this
 // narrow interface instead. Thin wrappers over core; no policy.
+import { projectCwds } from "../core/identity.js";
 import { chatOf, isChannelPlatform } from "./types.js";
-export function createControl({ router, factory, conversations, store }) {
+export const NO_SESSION = "No session in this thread yet — start one first (Start in the panel).";
+export const HAS_SESSION = "This thread already has a session — send your question as a message.";
+export function createControl({ router, factory, conversations, store, modelMenu }) {
     const launchFor = (key) => {
         if (!isChannelPlatform(key.channelId))
             return {};
@@ -13,44 +16,87 @@ export function createControl({ router, factory, conversations, store }) {
             thinking: policy.thinking ?? undefined,
         };
     };
+    /** The thread's session, resumed if evicted; undefined when the thread has
+     *  none. Never creates: a look at the panel must not open a session. */
+    const live = async (key) => {
+        if (!conversations.get(key))
+            return undefined;
+        return router.sessionOf(key) ?? router.ensure(key);
+    };
     return {
         launchFor,
         knows: (key) => conversations.get(key) !== undefined,
         abort: (key) => router.abortConversation(key),
+        working: (key) => router.sessionOf(key)?.state === "streaming",
         async status(key) {
-            const session = router.sessionOf(key);
+            const session = await live(key);
             if (!session)
                 return null;
             const summary = await factory.find(session.id);
             const usage = session.contextUsage;
             return {
                 sessionId: session.id,
-                cwd: summary?.cwd ?? "",
+                // Not on disk until its first reply; the launch record knows where it is.
+                cwd: summary?.cwd ?? conversations.launchOf(key)?.cwd ?? "",
                 state: session.state,
+                empty: (await session.history()).length === 0,
                 model: session.model,
                 thinking: session.thinkingLevel,
-                thinkingLevels: session.availableThinkingLevels(),
                 tokens: usage?.tokens ?? null,
                 contextWindow: usage?.contextWindow ?? null,
             };
         },
-        models: () => factory.availableModels(),
+        pins: modelMenu,
         async setModel(key, model) {
-            await router.sessionOf(key)?.setModel(model);
+            const session = await live(key);
+            if (!session)
+                throw new Error(NO_SESSION);
+            await session.setModel(model);
+            conversations.amendLaunch(key, { model });
         },
         async setThinking(key, level) {
-            router.sessionOf(key)?.setThinkingLevel(level);
+            const session = await live(key);
+            if (!session)
+                throw new Error(NO_SESSION);
+            session.setThinkingLevel(level);
+            conversations.amendLaunch(key, { thinking: level });
         },
-        async newSession(key, cwd) {
-            const launch = launchFor(key);
-            const session = await factory.create({
-                ...launch,
-                cwd: cwd || launch.cwd || process.cwd(),
-            });
+        async newSession(key, over = {}) {
+            const defaults = launchFor(key);
+            const launch = { ...defaults, ...over, cwd: over.cwd || defaults.cwd || process.cwd() };
+            const session = await factory.create(launch);
+            // A message already inside the router's resolve can write the row while Pi
+            // was opening: the first row wins, and the session nobody routes to goes.
+            if (conversations.get(key)) {
+                await session.dispose();
+                throw new Error(HAS_SESSION);
+            }
             // Persist before attaching: a crash between must not leave an unrecorded session.
-            conversations.set(key, session.id);
+            conversations.set(key, session.id, launch);
             router.attach(key, session);
             return session.id;
         },
+        async recentDirs(key, limit = 6) {
+            const own = launchFor(key).cwd;
+            // The web's rule (worktrees folded into their project); task runs' directories count too.
+            const seen = new Set([...(own ? [own] : []), ...projectCwds(await factory.list())]);
+            return [...seen].slice(0, limit);
+        },
+        async recent(key, exchanges) {
+            const session = await live(key);
+            if (!session)
+                return [];
+            const pairs = [];
+            for (const turn of await session.history()) {
+                const last = pairs.at(-1);
+                if (turn.role === "user")
+                    pairs.push({ user: turn.text });
+                // The first reply after a user turn; later assistant turns of the same
+                // exchange are continuations of the same answer.
+                else if (turn.role === "assistant" && last && last.assistant === undefined)
+                    last.assistant = turn.text;
+            }
+            return pairs.slice(-exchanges);
+        },
     };
 }