@timurproko/a1 0.1.8-dev.3b54f21 → 0.1.8-dev.407

package/dist/{src/foundation/pi-engine-adapter → integrations/pi/engine}/adapter.js

@@ -1,31 +1,99 @@
 import { execFile } from "node:child_process";
+import { existsSync, realpathSync } from "node:fs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { promisify } from "node:util";
-import { PRODUCT_IDENTITY } from "../../product-identity.js";
-import { copyToClipboard, DefaultPackageManager, getAgentDir, ProjectTrustStore, SessionManager, } from "@earendil-works/pi-coding-agent";
-import { OWNED_UI_EXTENSION_CONTRACT_VERSION, OWNED_UI_EXTENSION_RENDER_CALLBACKS, OWNED_UI_EXTENSION_UI_CALLBACKS, OWNED_UI_EXTENSION_UI_PROPERTIES, assertOwnedUiCommand, assertOwnedUiExtensionUiPort, assertOwnedUiSnapshot, } from "../owned-ui-contracts/index.js";
+import { PRODUCT_IDENTITY } from "../../../product-identity.js";
+import { configureOwnedHttpDispatcher } from "./http-dispatcher.js";
+import { readPinnedCommandChangelog } from "./changelog.js";
+import { toolRenderingInput } from "./tool-rendering.js";
+import { TranscriptImageAssets } from "./transcript-image-assets.js";
+import { copyToClipboard, CredentialSynchronizationError, DefaultPackageManager, getAgentDir, ProjectTrustStore, SessionManager, VERSION, } from "@earendil-works/pi-coding-agent";
+import { OWNED_UI_EXTENSION_CONTRACT_VERSION, OWNED_UI_EXTENSION_RENDER_CALLBACKS, OWNED_UI_EXTENSION_UI_CALLBACKS, OWNED_UI_EXTENSION_UI_PROPERTIES, CONTEXTUAL_PROMPT_SUGGESTION_INSTRUCTION, acceptsTranscriptUpdate, transcriptToolState, assertOwnedUiCommand, assertOwnedUiExtensionUiPort, assertOwnedUiPromptSuggestionRequest, assertOwnedUiPromptSuggestionResult, assertOwnedUiSnapshot, normalizePromptSuggestionCandidate, } from "../../../contracts/owned-ui/index.js";
 import { PINNED_PI_SETTINGS_CALLBACKS, PINNED_PI_WORKFLOW_COMMAND_NAMES, } from "./workflows.js";
 import { createPiRuntimeIntegration } from "./runtime-integration.js";
 import { PiSessionCommandIntegration } from "./session-integration.js";
 import { PiSettingsIntegration } from "./settings-integration.js";
+import { PendingEngineDelivery } from "./pending-delivery.js";
+/** Explicit flush failure when required delivery was interrupted rather than completed. */
+export class EngineDeliveryError extends Error {
+    constructor() { super("Engine delivery did not complete"); this.name = "EngineDeliveryError"; }
+}
 const execFileAsync = promisify(execFile);
+/**
+ * Engine events delivered before the queue hands the event loop a turn. Small enough
+ * that a streaming burst never holds input, large enough that an ordinary turn is one
+ * batch.
+ */
+// Performance: deliver at most one engine event per event-loop turn. Transcript updates can
+// be expensive in long sessions; a larger synchronous batch starves terminal
+// input and makes an in-progress mouse selection appear frozen.
+const EVENT_DELIVERY_BATCH = 1;
+const AUTH_REFRESH_TIMEOUT_MS = 15_000;
+// Provenance: Pi 0.84.2 core/model-resolver.ts defaultModelPerProvider.
+const PINNED_DEFAULT_MODEL_BY_PROVIDER = Object.freeze({
+    "amazon-bedrock": "us.anthropic.claude-opus-4-6-v1",
+    "ant-ling": "Ring-2.6-1T",
+    anthropic: "claude-opus-4-8",
+    openai: "gpt-5.5",
+    "azure-openai-responses": "gpt-5.4",
+    "openai-codex": "gpt-5.5",
+    radius: "auto",
+    nvidia: "nvidia/nemotron-3-super-120b-a12b",
+    deepseek: "deepseek-v4-pro",
+    google: "gemini-3.1-pro-preview",
+    "google-vertex": "gemini-3.1-pro-preview",
+    "github-copilot": "gpt-5.4",
+    openrouter: "moonshotai/kimi-k2.6",
+    "vercel-ai-gateway": "zai/glm-5.1",
+    xai: "grok-4.5",
+    groq: "openai/gpt-oss-120b",
+    cerebras: "zai-glm-4.7",
+    zai: "glm-5.1",
+    "zai-coding-cn": "glm-5.1",
+    mistral: "devstral-medium-latest",
+    minimax: "MiniMax-M2.7",
+    "minimax-cn": "MiniMax-M2.7",
+    moonshotai: "kimi-k2.6",
+    "moonshotai-cn": "kimi-k2.6",
+    huggingface: "moonshotai/Kimi-K2.6",
+    fireworks: "accounts/fireworks/models/kimi-k2p6",
+    together: "moonshotai/Kimi-K2.6",
+    baseten: "zai-org/GLM-5.2",
+    opencode: "kimi-k2.6",
+    "opencode-go": "kimi-k2.6",
+    "kimi-coding": "kimi-for-coding",
+    "cloudflare-workers-ai": "@cf/moonshotai/kimi-k2.6",
+    "cloudflare-ai-gateway": "workers-ai/@cf/moonshotai/kimi-k2.6",
+    "qwen-token-plan": "qwen3.7-max",
+    "qwen-token-plan-cn": "qwen3.7-max",
+    "qwen-token-plan-individual": "qwen3.8-max",
+    xiaomi: "mimo-v2.5-pro",
+    "xiaomi-token-plan-cn": "mimo-v2.5-pro",
+    "xiaomi-token-plan-ams": "mimo-v2.5-pro",
+    "xiaomi-token-plan-sgp": "mimo-v2.5-pro",
+});
 const DEFAULT_SURFACE = {
     columns: 100,
     rows: 32,
     focusedRegion: "editor",
     hardwareCursor: false,
 };
+/** Owns the pinned Pi session lifecycle and translates its events into the neutral agent-engine contract. */
 export class PiEngineAdapter {
     #runtimeFactory;
     #checkPackageUpdates;
     #cwd;
     #agentDir;
     #sessionId;
+    #sessionPath;
+    #sessionSelection;
+    #sessionForkPrompt;
     #workflowHost;
+    #clipboardWriter;
     #workflowInteraction;
-    #listeners = new Set();
+    #listeners = new Map();
     #runtime;
     #session;
     #unsubscribe;
@@ -41,6 +109,7 @@ export class PiEngineAdapter {
         submitEnabled: false,
     };
     #sessionGeneration = 0;
+    #sessionBindingGeneration = 0;
     #status = {
         title: "Pi",
         workingMessage: null,
@@ -53,26 +122,48 @@ export class PiEngineAdapter {
     #activeCommandIds = [];
     #completedCommands = new Map();
     #transcript = [];
+    #transcriptIndex = new Map();
+    #transcriptSnapshot;
     #messageBlockIds = new WeakMap();
     #messageFallbackIds = new Map();
     #toolBlockIds = new Map();
+    #transcriptImageAssets = new TranscriptImageAssets();
+    #usageCache;
     #nextBlockSequence = 0;
     #diagnostics = [];
-    #eventQueue = [];
+    #eventQueue = new PendingEngineDelivery(event => this.#transcriptImageAssets.retainEvent(event));
     #eventQueueProcessing;
-    #droppedEventCount = 0;
+    #overload;
+    #overloads = 0;
+    #deliveryFailed = false;
+    #admissionStopped = false;
+    #runningCommands = 0;
+    #invalidatedEvents = 0;
+    #pendingCommands = new Map();
+    #reservedOutcomes = new Map();
+    #pendingWorkflows = new Set();
+    #agentRunActive = false;
+    #agentRunSequence = 0;
+    #assistantResponseSequence = 0;
+    #statusKind = null;
     #sessionCommands;
     #gitBranch = null;
     #extensionUi;
     #extensionShutdown;
     #extensionBound = false;
     #disposed = false;
-    /** Lists the themes installed on this machine, when the caller supplies one. */
+    #settingsProductMode;
+    #projectTrustPrompt;
+    #settingsIntegration;
+    #settingsIntegrationManager;
     #availableThemes;
     constructor(options = {}) {
         this.#cwd = options.cwd ?? process.cwd();
         this.#agentDir = options.agentDir ?? getAgentDir();
         this.#sessionId = options.sessionId ?? "owned-session-1";
+        this.#sessionPath = options.sessionPath;
+        this.#sessionSelection = options.sessionSelection;
+        this.#sessionForkPrompt = options.sessionForkPrompt;
         this.#runtimeFactory = options.createRuntime ?? createDefaultPiRuntime;
         this.#checkPackageUpdates = options.checkPackageUpdates
             ?? (options.createRuntime
@@ -80,6 +171,8 @@ export class PiEngineAdapter {
                 : settingsManager => checkDefaultPiPackageUpdates(this.#cwd, this.#agentDir, settingsManager));
         this.#workflowHost = options.workflowHost ?? defaultWorkflowHost();
         this.#availableThemes = options.availableThemes ?? null;
+        this.#settingsProductMode = options.settingsProductMode ?? "bare";
+        this.#projectTrustPrompt = options.projectTrustPrompt;
         this.#workflowInteraction = { prompt: async () => null, notify() { } };
     }
     setWorkflowInteractionHost(interaction) {
@@ -91,12 +184,112 @@ export class PiEngineAdapter {
     get sessionGeneration() {
         return this.#sessionGeneration;
     }
+    /** Actual session replacements, excluding delivery-only invalidation of callbacks. */
+    get sessionBindingGeneration() { return this.#sessionBindingGeneration; }
+    get cwd() {
+        return this.#runtime?.cwd ?? this.#cwd;
+    }
     get agentDir() {
         return this.#agentDir;
     }
+    resolveTranscriptImage(assetId) {
+        return this.#transcriptImageAssets.resolve(assetId);
+    }
+    currentSessionFile() {
+        const value = this.#session?.sessionManager?.getSessionFile?.();
+        return typeof value === "string" && value.length > 0 ? value : null;
+    }
+    currentSessionResumeMetadata() {
+        const manager = this.#session?.sessionManager;
+        if (manager === undefined
+            || typeof manager.isPersisted !== "function"
+            || typeof manager.getSessionId !== "function"
+            || typeof manager.getSessionDir !== "function"
+            || typeof manager.usesDefaultSessionDir !== "function"
+            || manager.isPersisted() !== true
+            || !existsSync(this.currentSessionFile() ?? ""))
+            return null;
+        const sessionId = manager.getSessionId();
+        const sessionDir = manager.getSessionDir();
+        if (!sessionId || !sessionDir)
+            return null;
+        return { sessionId, sessionDir, usesDefaultSessionDir: manager.usesDefaultSessionDir() };
+    }
     get disposed() {
         return this.#disposed;
     }
+    suggestionReasoningPolicy() {
+        const session = this.#session;
+        if (!session?.model)
+            return "unavailable";
+        if (!session.model.reasoning)
+            return "ordinary";
+        const levels = session.getAvailableThinkingLevels?.() ?? [];
+        // Compatibility: capability order, not the user's current setting or a provider-name heuristic.
+        return ["off", "minimal", "low", "medium", "high", "xhigh", "max"]
+            .find(level => levels.includes(level)) ?? "unavailable";
+    }
+    async generate(request) {
+        assertOwnedUiPromptSuggestionRequest(request);
+        const identity = request.identity;
+        const session = this.#session;
+        const runtime = this.#runtime;
+        const activeModel = this.#activeModel;
+        if (this.#disposed || this.#overload !== undefined || this.#admissionStopped || session === undefined || runtime === undefined || request.signal.aborted
+            || identity.sessionId !== this.#sessionId
+            || identity.sessionGeneration !== this.#sessionGeneration
+            || identity.runSequence !== this.#agentRunSequence
+            || identity.responseSequence !== this.#assistantResponseSequence
+            || activeModel === null
+            || identity.model.providerId !== activeModel.providerId
+            || identity.model.modelId !== activeModel.modelId) {
+            return { identity, outcome: request.signal.aborted ? "cancelled" : "unavailable", text: null };
+        }
+        const model = session.model;
+        const agentState = session.agent.state;
+        const policy = this.suggestionReasoningPolicy();
+        if (model === undefined || policy === "unavailable" || typeof runtime.services.modelRuntime.completeSimple !== "function") {
+            return { identity, outcome: "unavailable", text: null };
+        }
+        const messages = agentState.messages.filter(message => message.role === "user" || message.role === "assistant" || message.role === "toolResult");
+        const reasoning = policy === "ordinary" || policy === "off" ? undefined : policy;
+        let response;
+        try {
+            response = await runtime.services.modelRuntime.completeSimple(model, {
+                systemPrompt: agentState.systemPrompt,
+                messages: [
+                    ...messages,
+                    { role: "user", content: CONTEXTUAL_PROMPT_SUGGESTION_INSTRUCTION, timestamp: Date.now() },
+                ],
+                tools: agentState.tools,
+            }, {
+                signal: request.signal,
+                ...(reasoning === undefined ? {} : { reasoning }),
+            });
+        }
+        catch {
+            return { identity, outcome: request.signal.aborted ? "cancelled" : "provider-failure", text: null };
+        }
+        if (request.signal.aborted || (isRecord(response) && response.stopReason === "aborted")) {
+            return { identity, outcome: "cancelled", text: null };
+        }
+        if (!isRecord(response) || stringValue(response.errorMessage) !== undefined || response.stopReason === "error") {
+            return { identity, outcome: "provider-failure", text: null };
+        }
+        const content = Array.isArray(response.content) ? response.content : [];
+        if (response.stopReason === "length" || content.some(block => isRecord(block) && block.type === "toolCall")) {
+            return { identity, outcome: "rejected", text: null };
+        }
+        // Security: validate all text, not just the first block of a multi-part response.
+        const rawText = content.filter(block => isRecord(block) && block.type === "text")
+            .map(block => stringValue(block.text) ?? "").join("\n");
+        const text = normalizePromptSuggestionCandidate(rawText);
+        const result = text === null
+            ? { identity, outcome: rawText.trim() ? "rejected" : "empty", text: null }
+            : { identity, outcome: "candidate", text };
+        assertOwnedUiPromptSuggestionResult(result);
+        return result;
+    }
     async start() {
         if (this.#runtime)
             return this.view();
@@ -104,18 +297,25 @@ export class PiEngineAdapter {
             cwd: this.#cwd,
             agentDir: this.#agentDir,
             sessionId: this.#sessionId,
+            ...(this.#sessionPath === undefined ? {} : { sessionPath: this.#sessionPath }),
+            ...(this.#sessionSelection === undefined ? {} : { sessionSelection: this.#sessionSelection }),
+            ...(this.#sessionForkPrompt === undefined ? {} : { sessionForkPrompt: this.#sessionForkPrompt }),
+            ...(this.#projectTrustPrompt === undefined ? {} : { projectTrustPrompt: this.#projectTrustPrompt }),
         }).catch(error => {
             this.#lifecycle = "failed";
             this.#addDiagnostic("error", "engine-startup", error instanceof Error ? error.message : String(error), false);
             throw error;
         });
         this.#runtime = runtime;
+        this.#cwd = runtime.cwd ?? this.#cwd;
         this.#gitBranch = await readGitBranch(this.#cwd);
         this.#terminal = {
             ...this.#terminal,
             hardwareCursor: runtime.services.settingsManager?.getShowHardwareCursor?.() ?? this.#terminal.hardwareCursor,
         };
         runtime.setRebindSession(async (session) => {
+            if (this.#overload !== undefined || this.#admissionStopped || this.#disposed)
+                return;
             this.#bindSession(session);
             this.#emitView();
         });
@@ -123,6 +323,7 @@ export class PiEngineAdapter {
             this.#addDiagnostic(diagnostic.type === "error" ? "error" : diagnostic.type === "warning" ? "warning" : "info", "engine-startup", diagnostic.message, diagnostic.type !== "error");
         }
         this.#bindSession(runtime.session);
+        await this.#announceChangelog(runtime.services.settingsManager);
         this.#lifecycle = "ready";
         this.#editor = { ...this.#editor, submitEnabled: true };
         this.#emitEvent({ type: "session-lifecycle", lifecycle: "ready", reason: null });
@@ -130,6 +331,27 @@ export class PiEngineAdapter {
         void this.#announcePackageUpdates(runtime.services.settingsManager);
         return this.view();
     }
+    async #announceChangelog(settingsManager) {
+        if (!settingsManager || typeof settingsManager.getLastChangelogVersion !== "function"
+            || typeof settingsManager.setLastChangelogVersion !== "function")
+            return;
+        if ((this.#session?.messages.length ?? 0) > 0)
+            return;
+        const lastVersion = settingsManager.getLastChangelogVersion();
+        if (lastVersion === VERSION)
+            return;
+        if (!lastVersion) {
+            settingsManager.setLastChangelogVersion(VERSION);
+            await settingsManager.flush();
+            return;
+        }
+        const markdown = await this.#workflowHost.readChangelog(lastVersion).catch(() => "");
+        if (markdown.trim().length > 0) {
+            this.#addDiagnostic("info", settingsManager.getCollapseChangelog() ? "changelog-collapsed" : "changelog-expanded", markdown, true);
+            settingsManager.setLastChangelogVersion(VERSION);
+            await settingsManager.flush();
+        }
+    }
     async #announcePackageUpdates(settingsManager) {
         if (process.env.PI_OFFLINE)
             return;
@@ -143,17 +365,28 @@ export class PiEngineAdapter {
         if (this.#disposed || updates.length === 0)
             return;
         const packages = updates.map(name => `- ${name}`).join("\n");
-        this.#addDiagnostic("info", "package-updates", `Package updates are available. Run pi update --extensions\nPackages:\n${packages}`, true);
+        this.#addDiagnostic("info", "package-updates", `Package updates are available. Run ${PRODUCT_IDENTITY.commandName} pi update --extensions\nPackages:\n${packages}`, true);
         this.#emitView();
     }
     onEvent(listener) {
-        this.#listeners.add(listener);
-        listener(this.#event({ type: "session-view", view: this.view() }));
+        const initial = this.#event({ type: "session-view", view: this.view() });
+        this.#listeners.set(listener, initial.sequence);
+        listener(initial);
         return () => this.#listeners.delete(listener);
     }
+    /** Developer-only pressure evidence; never mirrored into visible diagnostic/status arrays. */
+    deliveryDiagnostics() {
+        return { ...this.#eventQueue.diagnostics(), overloads: this.#overloads, recovering: this.#overload !== undefined,
+            pendingCommands: this.#pendingCommands.size + this.#pendingWorkflows.size, reservedOutcomes: this.#reservedOutcomes.size, invalidatedEvents: this.#invalidatedEvents };
+    }
     async flushEvents() {
+        const failed = this.#deliveryFailed;
         while (this.#eventQueueProcessing)
             await this.#eventQueueProcessing;
+        if (failed || this.#deliveryFailed || this.#disposed && this.#lifecycle !== "stopped") {
+            this.#deliveryFailed = false;
+            throw new EngineDeliveryError();
+        }
     }
     nonVisualResources() {
         const loader = this.#runtime?.services.resourceLoader;
@@ -278,6 +511,7 @@ export class PiEngineAdapter {
                     id: `extension-${resources.length}`,
                     sourcePath: extension.path,
                     resolvedPath: extension.resolvedPath,
+                    sourceInfo: extensionSourceSummary(extension.sourceInfo),
                     loaded: true,
                     hidden: extension.hidden === true,
                     diagnostic: null,
@@ -373,9 +607,10 @@ export class PiEngineAdapter {
         }
         const extensionCommands = this.#session?.extensionRunner?.getRegisteredCommands?.();
         if (Array.isArray(extensionCommands)) {
-            for (const command of extensionCommands.filter(isRecord)) {
-                const name = stringProperty(command, "name");
-                if (!name || usedNames.has(name))
+            const registered = extensionCommands.filter(isRecord);
+            for (const command of registered) {
+                const name = stringProperty(command, "invocationName") ?? stringProperty(command, "name");
+                if (!name || usedNames.has(name) || isPiPrefixedCompatibilityAlias(command, registered))
                     continue;
                 commands.push({ name, description: stringProperty(command, "description") ?? "Extension command", source: "extension" });
                 usedNames.add(name);
@@ -388,7 +623,8 @@ export class PiEngineAdapter {
             const session = this.#requireWorkflowSession();
             const result = await requireCapability(session.cycleModel, "cycleModel").call(session, direction);
             if (!isRecord(result) || !isRecord(result.model)) {
-                return workflowResult("model", "cancelled", "No other model is available");
+                const scoped = Array.isArray(session.scopedModels) && session.scopedModels.length > 0;
+                return workflowResult("model", "completed", scoped ? "Only one model in scope" : "Only one model available", undefined, "status");
             }
             const model = readModel(result.model);
             if (model)
@@ -396,7 +632,11 @@ export class PiEngineAdapter {
             if (result.thinkingLevel !== undefined)
                 this.#thinkingLevel = readThinkingLevel(result.thinkingLevel);
             this.#emitView();
-            return workflowResult("model", "completed", model ? `Selected model ${model.providerId}/${model.modelId}` : "Selected model");
+            const modelName = stringProperty(result.model, "name") ?? stringProperty(result.model, "id") ?? "model";
+            const reasoning = result.model.reasoning === true;
+            const thinking = this.#thinkingLevel;
+            const suffix = reasoning && thinking !== "off" ? ` (thinking: ${thinking})` : "";
+            return workflowResult("model", "completed", `Switched to ${modelName}${suffix}`, undefined, "status");
         }
         catch (error) {
             return workflowResult("model", "failed", error instanceof Error ? error.message : String(error));
@@ -412,16 +652,107 @@ export class PiEngineAdapter {
     /** Settings port for the live runtime, or null before the runtime is available. */
     settingsPort() {
         const settings = this.#runtime?.services.settingsManager;
-        if (!settings)
+        if (!settings || typeof settings.getCompactionEnabled !== "function")
             return null;
-        const session = this.#runtime?.session;
-        return new PiSettingsIntegration(settings, {
-            ...(this.#availableThemes === null ? {} : { themes: this.#availableThemes }),
-            thinkingLevels: () => {
-                const levels = session?.getAvailableThinkingLevels?.();
-                return Array.isArray(levels) ? levels.map(level => String(level)) : [];
-            },
-        });
+        if (this.#settingsIntegration === undefined || this.#settingsIntegrationManager !== settings) {
+            this.#settingsIntegrationManager = settings;
+            configureOwnedHttpDispatcher(settings.getHttpIdleTimeoutMs());
+            this.#settingsIntegration = new PiSettingsIntegration(settings, {
+                ...(this.#availableThemes === null ? {} : { themes: this.#availableThemes }),
+                thinkingLevels: () => {
+                    const levels = this.#runtime?.session?.getAvailableThinkingLevels?.();
+                    return Array.isArray(levels) ? levels.map(level => String(level)) : [];
+                },
+                productMode: this.#settingsProductMode,
+            });
+            this.#settingsIntegration.bindOwner("shell", {
+                enableSkillCommands: { apply: value => {
+                        if (typeof value !== "boolean")
+                            throw new TypeError("Skill commands value is invalid");
+                        settings.setEnableSkillCommands(value);
+                    } },
+                doubleEscapeAction: { apply: value => {
+                        if (value !== "tree" && value !== "fork" && value !== "none")
+                            throw new TypeError("Double-Escape action is invalid");
+                        settings.setDoubleEscapeAction(value);
+                    } },
+                treeFilterMode: { apply: value => {
+                        if (value !== "default" && value !== "no-tools" && value !== "user-only" && value !== "labeled-only" && value !== "all")
+                            throw new TypeError("Tree filter mode is invalid");
+                        settings.setTreeFilterMode(value);
+                    } },
+                showCacheMissNotices: { apply: value => {
+                        if (typeof value !== "boolean")
+                            throw new TypeError("Cache-miss notice setting is invalid");
+                        settings.setShowCacheMissNotices(value);
+                    } },
+            });
+            this.#settingsIntegration.bindOwner("startup", {
+                // Invariant: deferred application is the owner operation: the next preflight reads
+                // the persisted default before constructing project-backed services.
+                defaultProjectTrust: { apply() { } },
+                collapseChangelog: { apply() { } },
+            });
+            this.#settingsIntegration.bindOwner("agent", {
+                autoCompact: { apply: value => {
+                        if (typeof value !== "boolean")
+                            throw new TypeError("Auto compact value is invalid");
+                        this.#requireWorkflowSession().setAutoCompactionEnabled(value);
+                    } },
+                autoResizeImages: { apply: value => {
+                        if (typeof value !== "boolean")
+                            throw new TypeError("Auto-resize images value is invalid");
+                        settings.setImageAutoResize(value);
+                    } },
+                blockImages: { apply: value => {
+                        if (typeof value !== "boolean")
+                            throw new TypeError("Block images value is invalid");
+                        settings.setBlockImages(value);
+                    } },
+                steeringMode: { apply: value => {
+                        if (value !== "all" && value !== "one-at-a-time")
+                            throw new TypeError("Steering mode is invalid");
+                        this.#requireWorkflowSession().setSteeringMode(value);
+                    } },
+                followUpMode: { apply: value => {
+                        if (value !== "all" && value !== "one-at-a-time")
+                            throw new TypeError("Follow-up mode is invalid");
+                        this.#requireWorkflowSession().setFollowUpMode(value);
+                    } },
+                transport: { apply: value => {
+                        if (value !== "sse" && value !== "websocket" && value !== "websocket-cached" && value !== "auto")
+                            throw new TypeError("Transport is invalid");
+                        this.#requireWorkflowSession().agent.transport = value;
+                    } },
+                httpIdleTimeoutMs: { apply: value => {
+                        if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+                            throw new TypeError("HTTP idle timeout is invalid");
+                        // Invariant: provider streaming reads the manager per request; global fetch uses
+                        // the matching owned dispatcher and zero maps to disabled semantics.
+                        configureOwnedHttpDispatcher(value);
+                        settings.setHttpIdleTimeoutMs(value);
+                    } },
+                thinkingLevel: { apply: value => {
+                        if (!isThinkingLevel(value))
+                            throw new TypeError("Thinking level is invalid");
+                        this.#requireWorkflowSession().setThinkingLevel(value);
+                        this.#thinkingLevel = readThinkingLevel(this.#requireWorkflowSession().thinkingLevel);
+                        this.#emitView();
+                    } },
+                warnings: { apply: value => {
+                        if (!isRecord(value) || Object.values(value).some(flag => typeof flag !== "boolean"))
+                            throw new TypeError("Warnings setting is invalid");
+                        settings.setWarnings(value);
+                    } },
+            });
+        }
+        return this.#settingsIntegration;
+    }
+    bindSettingsOwner(owner, handlers) {
+        const settings = this.settingsPort();
+        if (settings === null)
+            return () => { };
+        return settings.bindOwner(owner, handlers);
     }
     pinnedModelSelectorContext() {
         const session = this.#requireWorkflowSession();
@@ -454,17 +785,25 @@ export class PiEngineAdapter {
         if (!runtime)
             throw new Error("engine runtime is unavailable");
         const cwd = resolve(this.#cwd);
-        const parent = dirname(cwd);
+        let trustPath = cwd;
+        try {
+            trustPath = realpathSync(cwd);
+        }
+        catch {
+            // Compatibility: pinned Pi retains the resolved path when real-path lookup fails.
+        }
+        // Security: trust the target's parent, not the parent containing a directory alias.
+        const parent = dirname(trustPath);
         const trustStore = new ProjectTrustStore(this.#agentDir);
         const trustOptions = [
-            { label: "Trust", trusted: true, updates: [{ path: cwd, decision: true }], savedPath: cwd },
-            ...(parent === cwd ? [] : [{
+            { label: "Trust", trusted: true, updates: [{ path: trustPath, decision: true }], savedPath: trustPath },
+            ...(parent === trustPath ? [] : [{
                     label: `Trust parent folder (${parent})`,
                     trusted: true,
-                    updates: [{ path: parent, decision: true }, { path: cwd, decision: null }],
+                    updates: [{ path: parent, decision: true }, { path: trustPath, decision: null }],
                     savedPath: parent,
                 }]),
-            { label: "Do not trust", trusted: false, updates: [{ path: cwd, decision: false }], savedPath: cwd },
+            { label: "Do not trust", trusted: false, updates: [{ path: trustPath, decision: false }], savedPath: trustPath },
         ];
         return {
             cwd,
@@ -591,6 +930,17 @@ export class PiEngineAdapter {
         }));
         return { title: `Select authentication method for ${providerName}:`, options };
     }
+    pinnedAmbientAuthentication(selection) {
+        if (!selection.startsWith("api_key:"))
+            return null;
+        const providerId = selection.slice("api_key:".length);
+        const provider = this.#runtime?.services.modelRuntime.getProvider?.(providerId);
+        const method = dynamicObject(dynamicObject(provider, "auth"), "apiKey");
+        if (!method || typeof method.login === "function")
+            return null;
+        const providerName = stringProperty(provider, "name") ?? providerId;
+        return { providerId, providerName, title: `${providerName} setup`, message: `${stringProperty(method, "name") ?? "Authentication"} is configured outside pi.` };
+    }
     pinnedLogoutOptions() {
         return this.#logoutOptions();
     }
@@ -671,9 +1021,27 @@ export class PiEngineAdapter {
     pinnedMessageRenderer(customType) {
         return this.#requireWorkflowSession().extensionRunner?.getMessageRenderer?.(customType);
     }
+    pinnedShortcutDescriptions(bindings) {
+        const shortcuts = this.#requireWorkflowSession().extensionRunner?.getShortcuts?.(bindings);
+        return shortcuts === undefined ? [] : [...shortcuts].map(([key, shortcut]) => ({ key, description: shortcut.description ?? shortcut.extensionPath }));
+    }
     pinnedToolDefinition(toolName) {
         return this.#requireWorkflowSession().extensionRunner?.getToolDefinition?.(toolName);
     }
+    /** Bind the owned UI's clipboard lifecycle without changing the comparison host. True means acknowledged delivery. */
+    bindClipboardWriter(writer) {
+        const previous = this.#clipboardWriter;
+        this.#clipboardWriter = writer;
+        return () => { if (this.#clipboardWriter === writer)
+            this.#clipboardWriter = previous; };
+    }
+    /** Workflow and tree copying share the active owner's write fence and delivery acknowledgment. */
+    async copyWorkflowText(text) {
+        if (this.#clipboardWriter !== undefined)
+            return this.#clipboardWriter(text);
+        await this.#workflowHost.copyText(text);
+        return true;
+    }
     clearQueuedWorkflows() {
         const session = this.#requireWorkflowSession();
         const result = session.clearQueue?.();
@@ -698,23 +1066,55 @@ export class PiEngineAdapter {
             excludeFromContext,
         };
     }
-    applyPinnedSettingValue(callback, value) {
+    async applyPinnedSettingValue(callback, value) {
         try {
-            return this.#applyPinnedSetting(callback, value, true);
+            return await this.#applyPinnedSetting(callback, value, true);
         }
         catch (error) {
             return workflowResult("settings", "failed", error instanceof Error ? error.message : String(error));
         }
     }
+    reloadBlockedResult() {
+        const session = this.#requireWorkflowSession();
+        if (session.isStreaming)
+            return workflowResult("reload", "failed", "Wait for the current response to finish before reloading.", undefined, "warning");
+        if (session.isCompacting)
+            return workflowResult("reload", "failed", "Wait for compaction to finish before reloading.", undefined, "warning");
+        return null;
+    }
     async executeWorkflow(request) {
+        const cancelled = workflowResult(request.command, "cancelled", "", undefined, "silent");
+        if (this.#overload !== undefined || this.#admissionStopped || this.#disposed
+            || this.#pendingCommands.size + this.#pendingWorkflows.size >= 32)
+            return cancelled;
+        let cancel;
+        const cancellation = new Promise(resolve => { cancel = () => resolve(cancelled); });
+        const pending = { command: request.command, cancel };
+        this.#pendingWorkflows.add(pending);
+        this.#runningCommands++;
+        const operation = this.#runWorkflow(request).finally(() => { this.#runningCommands--; });
+        try {
+            return await Promise.race([operation, cancellation]);
+        }
+        finally {
+            this.#pendingWorkflows.delete(pending);
+        }
+    }
+    async #runWorkflow(request) {
         try {
             return await this.#performWorkflow(request);
         }
         catch (error) {
             const message = error instanceof Error ? error.message : String(error);
             const contextualMessage = request.command === "export"
-                ? `Failed to export session: ${message}`
-                : request.command === "reload" ? `Reload failed: ${message}` : message;
+                ? `Failed to export session: ${errorMessage(error, "Unknown error")}`
+                : request.command === "import"
+                    ? `Failed to import session: ${message}`
+                    : request.command === "new"
+                        ? `Failed to create session: ${message}`
+                        : request.command === "resume"
+                            ? `Failed to resume session: ${message}`
+                            : request.command === "reload" ? `Reload failed: ${message}` : message;
             return workflowResult(request.command, "failed", contextualMessage);
         }
     }
@@ -724,13 +1124,13 @@ export class PiEngineAdapter {
             sessionId: this.#sessionId,
             revision: this.#viewRevision,
             lifecycle: this.#lifecycle,
-            transcript: this.#transcript.map(block => ({ ...block })),
+            transcript: this.#transcriptSnapshot ??= Object.freeze([...this.#transcript]),
             editor: { ...this.#editor, queuedSubmissions: [...this.#editor.queuedSubmissions] },
             status: {
                 ...this.#status,
                 diagnostics: [...this.#status.diagnostics],
                 badges: [...this.#status.badges],
-                usage: this.#readUsage(),
+                usage: this.#usageCache ??= this.#readUsage(),
                 footer: {
                     branch: this.#gitBranch,
                     sessionName: this.#session?.sessionManager?.getSessionName() ?? null,
@@ -767,6 +1167,9 @@ export class PiEngineAdapter {
         if (this.#disposed || !this.#runtime || !this.#session) {
             return this.#finishCommand(command, "rejected", "engine adapter is not running");
         }
+        // Invariant: the bounded out-of-band cancellation path has one slot per admitted command.
+        if (this.#overload !== undefined || this.#admissionStopped || this.#pendingCommands.size + this.#pendingWorkflows.size >= 32)
+            return { outcome: "rejected", diagnostic: null };
         const existing = this.#completedCommands.get(command.correlationId);
         if (existing)
             return existing;
@@ -774,28 +1177,65 @@ export class PiEngineAdapter {
             return this.#finishCommand(command, "rejected", "duplicate engine command correlation id");
         }
         this.#activeCommandIds.push(command.correlationId);
-        this.#emitEvent({
-            type: "command-outcome",
-            correlationId: command.correlationId,
-            outcome: "accepted",
-            diagnostic: null,
+        const generation = this.#sessionGeneration;
+        let cancelled = false;
+        const cancellation = new Promise(resolve => {
+            this.#pendingCommands.set(command.correlationId, { type: command.type, cancel: () => {
+                    if (cancelled)
+                        return;
+                    cancelled = true;
+                    resolve(this.#recordCommand(command, "failed", null));
+                } });
         });
+        this.#emitEvent({ type: "command-outcome", correlationId: command.correlationId, outcome: "accepted", diagnostic: null });
+        const operation = async () => {
+            try {
+                if (cancelled)
+                    return { outcome: "failed", diagnostic: null };
+                this.#runningCommands++;
+                try {
+                    await this.#perform(command);
+                }
+                finally {
+                    this.#runningCommands--;
+                }
+                if (cancelled)
+                    return { outcome: "failed", diagnostic: null };
+                if (generation === this.#sessionGeneration)
+                    this.#emitView();
+                if (cancelled)
+                    return { outcome: "failed", diagnostic: null };
+                return this.#recordCommand(command, "completed", null);
+            }
+            catch (error) {
+                if (cancelled)
+                    return { outcome: "failed", diagnostic: null };
+                const diagnostic = error instanceof Error ? error.message : String(error);
+                this.#addDiagnostic("error", "engine-command", diagnostic, true);
+                if (generation === this.#sessionGeneration)
+                    this.#emitView();
+                return this.#recordCommand(command, "failed", diagnostic);
+            }
+        };
         try {
-            await this.#perform(command);
-            this.#emitView();
-            return this.#recordCommand(command, "completed", null);
+            return await Promise.race([operation(), cancellation]);
         }
-        catch (error) {
-            const diagnostic = error instanceof Error ? error.message : String(error);
-            this.#addDiagnostic("error", "engine-command", diagnostic, true);
-            this.#emitView();
-            return this.#recordCommand(command, "failed", diagnostic);
+        finally {
+            this.#pendingCommands.delete(command.correlationId);
         }
     }
     async dispose() {
         if (this.#disposed)
             return;
         this.#disposed = true;
+        for (const pending of this.#pendingCommands.values())
+            if (pending.type !== "shutdown")
+                pending.cancel();
+        // Compatibility: /quit owns normal disposal and must report its actual completion, not cancel itself.
+        for (const pending of this.#pendingWorkflows)
+            if (pending.command !== "quit")
+                pending.cancel();
+        this.#transcriptImageAssets.clear();
         this.#extensionBound = false;
         this.#extensionUi = undefined;
         this.#extensionShutdown = undefined;
@@ -807,7 +1247,13 @@ export class PiEngineAdapter {
         this.#lifecycle = "stopped";
         this.#emitEvent({ type: "session-lifecycle", lifecycle: "stopped", reason: null });
         this.#emitView();
-        await this.flushEvents();
+        try {
+            await this.flushEvents();
+        }
+        catch (error) {
+            if (!(error instanceof EngineDeliveryError))
+                throw error;
+        }
     }
     async #performWorkflow(request) {
         const session = this.#requireWorkflowSession();
@@ -821,22 +1267,88 @@ export class PiEngineAdapter {
             case "settings": {
                 if (!selection)
                     return workflowResult(request.command, "failed", "Settings requires the owned settings controller");
-                return this.#applyPinnedSetting(selection);
+                return await this.#applyPinnedSetting(selection);
             }
             case "model": {
                 const reference = selection ?? argument;
                 if (!reference)
                     return workflowResult(request.command, "failed", "Model requires the owned model controller");
-                const [providerId, modelId] = reference.split("/", 2);
-                if (!providerId || !modelId)
-                    return workflowResult(request.command, "failed", "Model requires provider/model");
-                const model = runtime.services.modelRuntime.getModel(providerId, modelId);
-                if (!model)
-                    return workflowResult(request.command, "failed", `Model is unavailable: ${reference}`);
-                await session.setModel(model);
+                const scopedModels = Array.isArray(session.scopedModels)
+                    ? session.scopedModels.map(item => item.model)
+                    : [];
+                let availableModels = scopedModels.length > 0
+                    ? scopedModels
+                    : [...(runtime.services.modelRuntime.getAvailableSnapshot?.() ?? [])];
+                let model = findExactWorkflowModel(reference, availableModels);
+                const messages = [];
+                const generation = this.#sessionGeneration;
+                const current = () => !this.#disposed && generation === this.#sessionGeneration;
+                const publish = (message) => {
+                    if (!current())
+                        return;
+                    if (this.#workflowInteraction.publish)
+                        this.#workflowInteraction.publish(message);
+                    else
+                        messages.push(message);
+                };
+                if (model === undefined && scopedModels.length === 0) {
+                    publish({ kind: "status", message: "Refreshing model catalogs…" });
+                    const controller = new AbortController();
+                    let timedOut = false;
+                    const timeout = setTimeout(() => {
+                        timedOut = true;
+                        controller.abort();
+                    }, AUTH_REFRESH_TIMEOUT_MS);
+                    try {
+                        const refreshed = await runtime.services.modelRuntime.refresh?.({ signal: controller.signal });
+                        if (isRecord(refreshed) && refreshed.aborted === true && timedOut) {
+                            publish({ kind: "warning", message: "Model refresh timed out; searching cached models." });
+                        }
+                        else if (isRecord(refreshed) && refreshed.errors instanceof Map && refreshed.errors.size > 0) {
+                            publish({ kind: "warning", message: `Could not refresh ${[...refreshed.errors.keys()].join(", ")}; searching cached models.` });
+                        }
+                    }
+                    catch (error) {
+                        publish({
+                            kind: "warning",
+                            message: timedOut
+                                ? "Model refresh timed out; searching cached models."
+                                : `Could not refresh model catalogs: ${error instanceof Error ? error.message : String(error)}`,
+                        });
+                    }
+                    finally {
+                        clearTimeout(timeout);
+                    }
+                    availableModels = [...(runtime.services.modelRuntime.getAvailableSnapshot?.() ?? [])];
+                    model = findExactWorkflowModel(reference, availableModels);
+                }
+                if (!current())
+                    return workflowResult(request.command, "cancelled", "Model selection cancelled", undefined, "silent");
+                if (model === undefined) {
+                    return {
+                        ...workflowResult(request.command, "requires-selection", "Select a model", reference, "silent"),
+                        ...(messages.length === 0 ? {} : { messages: Object.freeze(messages) }),
+                    };
+                }
+                try {
+                    await session.setModel(model);
+                }
+                catch (error) {
+                    if (!current())
+                        return workflowResult(request.command, "cancelled", "Model selection cancelled", undefined, "silent");
+                    const failure = { kind: "error", message: error instanceof Error ? error.message : String(error) };
+                    return workflowResult(request.command, "failed", failure.message, undefined, "error", messages.length === 0 ? undefined : [...messages, failure]);
+                }
+                if (!current())
+                    return workflowResult(request.command, "cancelled", "Model selection cancelled", undefined, "silent");
+                const providerId = stringProperty(model, "provider") ?? "unknown";
+                const modelId = stringProperty(model, "id") ?? reference;
                 this.#activeModel = { providerId, modelId, displayName: stringProperty(model, "name") ?? modelId };
                 this.#emitView();
-                return workflowResult(request.command, "completed", `Model: ${modelId}`);
+                const resultMessage = { kind: "status", message: `Model: ${modelId}` };
+                return messages.length === 0
+                    ? workflowResult(request.command, "completed", resultMessage.message)
+                    : workflowResult(request.command, "completed", resultMessage.message, undefined, "status", [...messages, resultMessage]);
             }
             case "scoped-models": {
                 if (!selection)
@@ -863,27 +1375,64 @@ export class PiEngineAdapter {
                     return workflowConfirmation(request.command, `Replace current session with ${path}?`);
                 }
                 if (!request.confirmed)
-                    return workflowResult(request.command, "cancelled", "Import cancelled");
-                const result = await requireCapability(runtime.importFromJsonl, "importFromJsonl").call(runtime, path);
-                if (isRecord(result) && result.cancelled === true)
-                    return workflowResult(request.command, "cancelled", "Import cancelled");
-                return workflowResult(request.command, "completed", `Session imported from: ${path}`);
+                    return workflowResult(request.command, "cancelled", "Import cancelled", undefined, "status");
+                try {
+                    const result = await requireCapability(runtime.importFromJsonl, "importFromJsonl").call(runtime, path, request.cwdOverride);
+                    if (isRecord(result) && result.cancelled === true)
+                        return workflowResult(request.command, "cancelled", "Import cancelled", undefined, "status");
+                    return workflowResult(request.command, "completed", `Session imported from: ${path}`);
+                }
+                catch (error) {
+                    const issue = isRecord(error) && isRecord(error.issue) ? error.issue : undefined;
+                    const fallbackCwd = issue === undefined ? undefined : stringProperty(issue, "fallbackCwd");
+                    if (fallbackCwd !== undefined && request.cwdOverride === undefined) {
+                        const sessionCwd = stringProperty(issue, "sessionCwd") ?? "the session working directory";
+                        return workflowConfirmation(request.command, `cwd from session file does not exist\n${sessionCwd}\n\ncontinue in current cwd\n${fallbackCwd}`, fallbackCwd);
+                    }
+                    throw error;
+                }
             }
             case "share": {
-                const auth = await this.#workflowHost.runCommand("gh", ["auth", "status"]).catch(error => {
-                    throw new Error(`GitHub CLI is unavailable or not logged in: ${error instanceof Error ? error.message : String(error)}`);
-                });
-                if (auth.stderr && !auth.stdout)
-                    throw new Error(auth.stderr.trim());
+                const signal = request.signal;
+                if (signal?.aborted)
+                    return workflowResult(request.command, "cancelled", "Share cancelled", undefined, "status");
+                try {
+                    await this.#workflowHost.runCommand("gh", ["auth", "status"], signal === undefined ? undefined : { signal });
+                }
+                catch (error) {
+                    if (signal?.aborted || isAbortError(error))
+                        return workflowResult(request.command, "cancelled", "Share cancelled", undefined, "status");
+                    const message = commandMissing(error)
+                        ? "GitHub CLI (gh) is not installed. Install it from https://cli.github.com/"
+                        : "GitHub CLI is not logged in. Run 'gh auth login' first.";
+                    return workflowResult(request.command, "failed", message);
+                }
                 const temporary = join(tmpdir(), `${PRODUCT_IDENTITY.filesystem.temporaryPrefix}pi-session-${process.pid}.html`);
                 try {
-                    await requireCapability(session.exportToHtml, "exportToHtml").call(session, temporary);
-                    const gist = await this.#workflowHost.runCommand("gh", ["gist", "create", "--public=false", temporary]);
+                    try {
+                        await requireCapability(session.exportToHtml, "exportToHtml").call(session, temporary);
+                    }
+                    catch (error) {
+                        return workflowResult(request.command, "failed", `Failed to export session: ${errorMessage(error, "Unknown error")}`);
+                    }
+                    if (signal?.aborted)
+                        return workflowResult(request.command, "cancelled", "Share cancelled", undefined, "status");
+                    let gist;
+                    try {
+                        gist = await this.#workflowHost.runCommand("gh", ["gist", "create", "--public=false", temporary], signal === undefined ? undefined : { signal });
+                    }
+                    catch (error) {
+                        if (signal?.aborted || isAbortError(error))
+                            return workflowResult(request.command, "cancelled", "Share cancelled", undefined, "status");
+                        return workflowResult(request.command, "failed", `Failed to create gist: ${shareCommandFailureDetail(error)}`);
+                    }
+                    if (signal?.aborted)
+                        return workflowResult(request.command, "cancelled", "Share cancelled", undefined, "status");
                     const gistUrl = gist.stdout.trim();
                     const gistId = gistUrl.split("/").at(-1);
                     if (!gistId)
-                        throw new Error("Failed to parse gist ID from gh output");
-                    return workflowResult(request.command, "completed", `Share URL: https://pi.gptscript.ai/gist/${gistId}`, gistUrl);
+                        return workflowResult(request.command, "failed", "Failed to parse gist ID from gh output");
+                    return workflowResult(request.command, "completed", `Share URL: ${shareViewerUrl(gistId)}`, gistUrl);
                 }
                 finally {
                     await rm(temporary, { force: true });
@@ -893,8 +1442,8 @@ export class PiEngineAdapter {
                 const text = requireCapability(session.getLastAssistantText, "getLastAssistantText").call(session);
                 if (typeof text !== "string" || text.length === 0)
                     return workflowResult(request.command, "failed", "No agent messages to copy yet.");
-                await this.#workflowHost.copyText(text);
-                return workflowResult(request.command, "completed", "Copied last agent message to clipboard");
+                const acknowledged = await this.copyWorkflowText(text);
+                return workflowResult(request.command, "completed", acknowledged ? "Copied last agent message to clipboard" : "Submitted last agent message to clipboard");
             }
             case "name": {
                 const manager = session.sessionManager;
@@ -902,7 +1451,7 @@ export class PiEngineAdapter {
                     const current = manager?.getSessionName();
                     return typeof current === "string"
                         ? workflowResult(request.command, "completed", `Session name: ${current}`)
-                        : workflowResult(request.command, "failed", "Usage: /name <name>");
+                        : workflowResult(request.command, "failed", "Usage: /name <name>", undefined, "warning");
                 }
                 requireCapability(session.setSessionName, "setSessionName").call(session, argument);
                 const normalized = manager?.getSessionName();
@@ -929,17 +1478,17 @@ export class PiEngineAdapter {
                     return workflowResult(request.command, "failed", "Fork requires the owned user-message controller");
                 const result = await requireCapability(runtime.fork, "fork").call(runtime, selection, { position: "before" });
                 if (isRecord(result) && result.cancelled === true)
-                    return workflowResult(request.command, "cancelled", "Fork cancelled");
+                    return workflowResult(request.command, "cancelled", "Fork cancelled", undefined, "silent");
                 return workflowResult(request.command, "completed", "Forked to new session");
             }
             case "clone": {
                 const manager = session.sessionManager;
                 const leaf = manager?.getLeafId?.();
                 if (typeof leaf !== "string")
-                    return workflowResult(request.command, "failed", "No session position is available to clone");
+                    return workflowResult(request.command, "completed", "Nothing to clone yet", undefined, "status");
                 const result = await requireCapability(runtime.fork, "fork").call(runtime, leaf, { position: "at" });
                 if (isRecord(result) && result.cancelled === true)
-                    return workflowResult(request.command, "cancelled", "Clone cancelled");
+                    return workflowResult(request.command, "cancelled", "Clone cancelled", undefined, "silent");
                 return workflowResult(request.command, "completed", "Cloned to new session");
             }
             case "tree": {
@@ -953,9 +1502,9 @@ export class PiEngineAdapter {
                         ...(request.treeSummary.customInstructions === undefined ? {} : { customInstructions: request.treeSummary.customInstructions }),
                     });
                 if (isRecord(result) && result.aborted === true)
-                    return workflowResult(request.command, "cancelled", "Branch summarization cancelled");
+                    return workflowResult(request.command, "cancelled", "Branch summarization cancelled", undefined, "status");
                 if (isRecord(result) && result.cancelled === true)
-                    return workflowResult(request.command, "cancelled", "Navigation cancelled");
+                    return workflowResult(request.command, "cancelled", "Navigation cancelled", undefined, "status");
                 return workflowResult(request.command, "completed", "Navigated to selected point");
             }
             case "trust": {
@@ -990,6 +1539,7 @@ export class PiEngineAdapter {
                 const authType = authTypeValue === "api_key" ? "api_key" : "oauth";
                 const provider = modelRuntime.getProvider?.(providerId);
                 const providerName = stringProperty(provider, "name") ?? providerId;
+                const previousModel = session.model;
                 this.#workflowInteraction.startLogin?.({ providerId, providerName, authType });
                 try {
                     await requireCapability(modelRuntime.login, "login").call(modelRuntime, providerId, authType, {
@@ -1027,25 +1577,40 @@ export class PiEngineAdapter {
                     });
                 }
                 catch (error) {
-                    if (error instanceof Error && error.message === "Login cancelled")
-                        return workflowResult(request.command, "cancelled", "Login cancelled");
-                    throw error;
+                    if (error instanceof Error && error.message === "Login cancelled") {
+                        return workflowResult(request.command, "cancelled", "Login cancelled", undefined, "silent");
+                    }
+                    const detail = error instanceof Error ? error.message : String(error);
+                    const actionLabel = authType === "api_key" ? `Saved API key for ${providerName}` : `Logged in to ${providerName}`;
+                    const message = error instanceof CredentialSynchronizationError
+                        ? `${actionLabel}, but local model state could not be synchronized: ${detail}`
+                        : authType === "api_key"
+                            ? `Failed to save API key for ${providerName}: ${detail}`
+                            : `Failed to login to ${providerName}: ${detail}`;
+                    return workflowResult(request.command, "failed", message);
                 }
                 finally {
                     this.#workflowInteraction.finishLogin?.();
                 }
-                this.#reconcileActiveModelAvailability();
-                this.#emitView();
-                return workflowResult(request.command, "completed", `Logged in to ${providerName}. Credentials saved to ${join(this.#agentDir, "auth.json")}`);
+                return await this.#completeProviderAuthentication(providerId, providerName, authType, previousModel);
             }
             case "logout": {
                 if (!selection)
                     return workflowResult(request.command, "failed", "Logout requires the owned authentication controller");
                 const [credentialType = "oauth", providerId = selection] = selection.includes(":") ? selection.split(":", 2) : ["oauth", selection];
                 const modelRuntime = runtime.services.modelRuntime;
-                await requireCapability(modelRuntime.logout, "logout").call(modelRuntime, providerId, { signal: AbortSignal.timeout(15_000) });
                 const provider = modelRuntime.getProvider?.(providerId);
                 const providerName = stringProperty(provider, "name") ?? providerId;
+                try {
+                    await requireCapability(modelRuntime.logout, "logout").call(modelRuntime, providerId, { signal: AbortSignal.timeout(15_000) });
+                }
+                catch (error) {
+                    const detail = error instanceof Error ? error.message : String(error);
+                    const message = error instanceof CredentialSynchronizationError
+                        ? `Credentials removed for ${providerName}, but local model state could not be synchronized: ${detail}`
+                        : `Logout failed: ${detail}`;
+                    return workflowResult(request.command, "failed", message);
+                }
                 this.#reconcileActiveModelAvailability();
                 this.#emitView();
                 return workflowResult(request.command, "completed", credentialType === "api_key"
@@ -1055,12 +1620,17 @@ export class PiEngineAdapter {
             case "new": {
                 const result = await runtime.newSession();
                 if (isRecord(result) && result.cancelled === true)
-                    return workflowResult(request.command, "cancelled", "New session cancelled");
-                return workflowResult(request.command, "completed", "✓ New session started");
+                    return workflowResult(request.command, "cancelled", "New session cancelled", undefined, "silent");
+                return workflowResult(request.command, "completed", "✓ New session started", undefined, "accent");
             }
             case "compact": {
-                await session.compact(argument || undefined);
-                return workflowResult(request.command, "completed", "Compaction requested");
+                try {
+                    await session.compact(argument || undefined);
+                    return workflowResult(request.command, "completed", "Compaction requested", undefined, "silent");
+                }
+                catch (error) {
+                    return workflowResult(request.command, "failed", error instanceof Error ? error.message : String(error), undefined, "silent");
+                }
             }
             case "resume": {
                 if (!selection && !argument)
@@ -1069,7 +1639,7 @@ export class PiEngineAdapter {
                 try {
                     const result = await runtime.switchSession(sessionPath);
                     if (isRecord(result) && result.cancelled === true)
-                        return workflowResult(request.command, "cancelled", "Resume cancelled");
+                        return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "silent");
                     return workflowResult(request.command, "completed", "Resumed session");
                 }
                 catch (error) {
@@ -1082,21 +1652,25 @@ export class PiEngineAdapter {
                         return workflowConfirmation(request.command, `cwd from session file does not exist\n${sessionCwd}\n\ncontinue in current cwd\n${fallbackCwd}`);
                     }
                     if (!request.confirmed)
-                        return workflowResult(request.command, "cancelled", "Resume cancelled");
+                        return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "status");
                     const result = await runtime.switchSession(sessionPath, { cwdOverride: fallbackCwd });
                     if (isRecord(result) && result.cancelled === true)
-                        return workflowResult(request.command, "cancelled", "Resume cancelled");
+                        return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "silent");
                     return workflowResult(request.command, "completed", "Resumed session in current cwd");
                 }
             }
             case "reload": {
-                if (session.isStreaming)
-                    return workflowResult(request.command, "failed", "Wait for the current response to finish before reloading.");
-                if (session.isCompacting)
-                    return workflowResult(request.command, "failed", "Wait for compaction to finish before reloading.");
+                const blocked = this.reloadBlockedResult();
+                if (blocked)
+                    return blocked;
                 await requireCapability(session.reload, "reload").call(session);
                 await this.#bindExtensionUiToSession();
-                return workflowResult(request.command, "completed", "Reloaded keybindings, extensions, skills, prompts, themes, and context files");
+                const message = "Reloaded keybindings, extensions, skills, prompts, themes, and context files";
+                const modelError = runtime.services.modelRuntime.getError?.();
+                return workflowResult(request.command, "completed", message, undefined, "status", modelError ? [
+                    { kind: "error", message: `models.json error: ${modelError}` },
+                    { kind: "status", message },
+                ] : undefined);
             }
             case "quit": {
                 await this.dispose();
@@ -1114,6 +1688,91 @@ export class PiEngineAdapter {
                 return workflowResult(request.command, "completed", "Demented elves announcement");
         }
     }
+    async #completeProviderAuthentication(providerId, providerName, authType, previousModel) {
+        const session = this.#requireWorkflowSession();
+        const modelRuntime = this.#runtime?.services.modelRuntime;
+        if (!modelRuntime)
+            throw new Error("engine runtime is unavailable");
+        const actionLabel = authType === "oauth" ? `Logged in to ${providerName}` : `Saved API key for ${providerName}`;
+        let selectedModelId;
+        let selectionError;
+        if (isUnknownModel(previousModel)) {
+            const available = modelRuntime.getAvailableSnapshot?.() ?? [];
+            const providerModels = available.filter(model => stringProperty(model, "provider") === providerId);
+            const defaultModelId = PINNED_DEFAULT_MODEL_BY_PROVIDER[providerId];
+            if (defaultModelId === undefined) {
+                selectionError = `${actionLabel}, but no default model is configured for provider "${providerId}". Use /model to select a model.`;
+            }
+            else if (providerModels.length === 0) {
+                selectionError = `${actionLabel}, but no models are available for that provider. Use /model to select a model.`;
+            }
+            else {
+                const selectedModel = providerModels.find(model => stringProperty(model, "id") === defaultModelId);
+                if (selectedModel === undefined) {
+                    selectionError = `${actionLabel}, but its default model "${defaultModelId}" is not available. Use /model to select a model.`;
+                }
+                else {
+                    try {
+                        await session.setModel(selectedModel);
+                        selectedModelId = stringProperty(selectedModel, "id") ?? defaultModelId;
+                        this.#activeModel = {
+                            providerId,
+                            modelId: selectedModelId,
+                            displayName: stringProperty(selectedModel, "name") ?? selectedModelId,
+                        };
+                    }
+                    catch (error) {
+                        selectionError = `${actionLabel}, but selecting its default model failed: ${error instanceof Error ? error.message : String(error)}. Use /model to select a model.`;
+                    }
+                }
+            }
+        }
+        this.#reconcileActiveModelAvailability();
+        this.#emitView();
+        const status = `${actionLabel}.${selectedModelId ? ` Selected ${selectedModelId}.` : ""} Credentials saved to ${join(this.#agentDir, "auth.json")}`;
+        const messages = [
+            { kind: "status", message: status },
+            ...(selectionError === undefined ? [] : [{ kind: "error", message: selectionError }]),
+        ];
+        this.#scheduleAuthenticatedProviderRefresh(providerId, actionLabel);
+        return workflowResult("login", "completed", status, undefined, "status", messages);
+    }
+    #scheduleAuthenticatedProviderRefresh(providerId, actionLabel) {
+        const runtime = this.#runtime;
+        const refresh = runtime?.services.modelRuntime.refresh;
+        if (!runtime || typeof refresh !== "function")
+            return;
+        const generation = this.#sessionGeneration;
+        const publish = this.#workflowInteraction.publish;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), AUTH_REFRESH_TIMEOUT_MS);
+        // Compatibility: post-authentication refresh starts on the next turn so its notices follow the saved-credential status.
+        void new Promise(resolve => setTimeout(resolve, 0))
+            .then(() => refresh.call(runtime.services.modelRuntime, { providers: [providerId], signal: controller.signal }))
+            .then(result => {
+            if (this.#disposed || this.#sessionGeneration !== generation)
+                return;
+            if (isRecord(result) && result.aborted === true) {
+                publish?.({ kind: "warning", message: `${actionLabel}, but its model catalog refresh timed out; using cached models.` });
+            }
+            else if (isRecord(result) && result.errors instanceof Map && result.errors.size > 0) {
+                publish?.({ kind: "warning", message: `${actionLabel}, but its model catalog could not be refreshed; using cached models.` });
+            }
+            this.#reconcileActiveModelAvailability();
+            this.#emitView();
+        })
+            .catch(error => {
+            if (this.#disposed || this.#sessionGeneration !== generation)
+                return;
+            publish?.({
+                kind: "warning",
+                message: controller.signal.aborted
+                    ? `${actionLabel}, but its model catalog refresh timed out; using cached models.`
+                    : `${actionLabel}, but its model catalog could not be refreshed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        })
+            .finally(() => clearTimeout(timeout));
+    }
     #requireWorkflowSession() {
         if (this.#disposed || !this.#runtime || !this.#session)
             throw new Error("engine adapter is not running");
@@ -1211,7 +1870,7 @@ export class PiEngineAdapter {
             return [];
         return sessionInfoOptions(await SessionManager.list(cwd, typeof sessionDir === "string" ? sessionDir : undefined));
     }
-    #applyPinnedSetting(selection, selectedValue, hasSelectedValue = false) {
+    async #applyPinnedSetting(selection, selectedValue, hasSelectedValue = false) {
         if (!PINNED_PI_SETTINGS_CALLBACKS.includes(selection)) {
             return workflowResult("settings", "failed", `Unknown setting callback: ${selection}`);
         }
@@ -1258,33 +1917,24 @@ export class PiEngineAdapter {
             selectedValue = currentValues[callback];
             hasSelectedValue = true;
         }
-        const settings = this.#runtime?.services.settingsManager;
-        if (!settings)
+        const port = this.settingsPort();
+        if (port === null)
             return workflowResult("settings", "failed", "Settings are unavailable");
-        const session = this.#requireWorkflowSession();
-        if (callback === "onThinkingLevelChange") {
-            if (!isThinkingLevel(selectedValue))
-                return workflowResult("settings", "failed", "Thinking level is invalid");
-            session.setThinkingLevel(selectedValue);
-        }
-        else {
-            const key = settingKeyForCallback(callback);
-            if (key === null)
-                return workflowResult("settings", "failed", `${settingLabel(callback)} is unavailable in this runtime`);
-            const value = agentJsonValue(selectedValue);
-            if (callback === "onAutoCompactChange") {
-                if (typeof value !== "boolean")
-                    return workflowResult("settings", "failed", "Auto compact value is invalid");
-                session.setAutoCompactionEnabled?.(value);
-            }
-            new PiSettingsIntegration(settings).writeSettingNow(key, value);
+        const key = settingKeyForCallback(callback);
+        if (key === null)
+            return workflowResult("settings", "failed", `${settingLabel(callback)} is unavailable in this runtime`);
+        const result = await port.writeSetting(key, agentJsonValue(selectedValue));
+        if (result.status === "failed" || result.status === "unavailable") {
+            return workflowResult("settings", "failed", result.failure ?? result.limitationReason ?? `${settingLabel(callback)} is unavailable`);
         }
         this.#emitView();
-        return workflowResult("settings", "completed", `${settingLabel(callback)}: ${String(selectedValue)}`);
+        const suffix = result.status === "deferred" ? ` (${result.application})` : "";
+        return workflowResult("settings", "completed", `${settingLabel(callback)}: ${String(selectedValue)}${suffix}`);
     }
     async #perform(command) {
         const runtime = this.#runtime;
         const session = this.#session;
+        const generation = this.#sessionGeneration;
         if (!runtime || !session)
             throw new Error("engine session is unavailable");
         switch (command.type) {
@@ -1295,7 +1945,11 @@ export class PiEngineAdapter {
             case "retry":
             case "compact": {
                 const result = await this.#sessionCommands?.execute(command.type === "prompt" || command.type === "steer" || command.type === "follow-up"
-                    ? { type: command.type, text: command.text }
+                    ? {
+                        type: command.type,
+                        text: command.text,
+                        ...(command.images === undefined ? {} : { images: [...command.images] }),
+                    }
                     : { type: command.type });
                 if (!result || result.outcome === "rejected" || result.outcome === "failed") {
                     throw new Error(command.type === "retry" ? "no previous prompt is available to retry" : `Pi session command failed: ${command.type}`);
@@ -1308,7 +1962,8 @@ export class PiEngineAdapter {
                     throw new Error(`model is unavailable: ${command.model.providerId}/${command.model.modelId}`);
                 }
                 await session.setModel(model);
-                this.#activeModel = { ...command.model };
+                if (generation === this.#sessionGeneration && this.#overload === undefined && !this.#admissionStopped)
+                    this.#activeModel = { ...command.model };
                 return;
             }
             case "set-thinking-level":
@@ -1336,7 +1991,13 @@ export class PiEngineAdapter {
     }
     #bindSession(session) {
         this.#unsubscribe?.();
+        for (const pending of this.#pendingCommands.values()) {
+            if (pending.type !== "new-session" && pending.type !== "resume-session")
+                pending.cancel();
+        }
         this.#sessionGeneration += 1;
+        this.#sessionBindingGeneration += 1;
+        this.#invalidatedEvents += this.#eventQueue.discardObsolete(this.#sessionGeneration);
         this.#session = session;
         this.#activeCommandIds = [];
         this.#completedCommands.clear();
@@ -1350,11 +2011,22 @@ export class PiEngineAdapter {
             submitEnabled: true,
         };
         this.#status = { ...this.#status, workingMessage: null, badges: [] };
+        this.#statusKind = null;
+        this.#agentRunActive = false;
+        this.#agentRunSequence = 0;
+        this.#assistantResponseSequence = 0;
         this.#activeModel = readModel(session.model);
         this.#reconcileActiveModelAvailability();
         this.#thinkingLevel = readThinkingLevel(session.thinkingLevel);
+        this.#transcriptImageAssets.clear();
+        // Invariant: a new binding cannot inherit arguments/results from a reused invocation id.
+        this.#setTranscript([]);
         this.#rebuildTranscript(session.messages, "finalized");
-        this.#unsubscribe = session.subscribe(event => this.#handlePiEvent(event));
+        const generation = this.#sessionGeneration;
+        this.#unsubscribe = session.subscribe(event => {
+            if (generation === this.#sessionGeneration && !this.#disposed)
+                this.#handlePiEvent(event);
+        });
         if (this.#extensionUi !== undefined)
             void this.#bindExtensionUiToSession();
     }
@@ -1402,33 +2074,122 @@ export class PiEngineAdapter {
             this.#emitView();
         }
     }
+    // Performance: replacing the transcript rebuilds its index so block lookup stays constant-time.
+    #setTranscript(blocks) {
+        // Invariant: lazy delivery snapshots must freeze before their authoritative source can be removed.
+        if (!this.#eventQueue.seal()) {
+            this.#beginOverload();
+            return;
+        }
+        for (const block of blocks)
+            this.#transcriptImageAssets.retain(block);
+        for (const block of this.#transcript)
+            this.#transcriptImageAssets.release(block);
+        this.#transcript = blocks;
+        this.#transcriptIndex.clear();
+        for (const [index, block] of blocks.entries())
+            this.#transcriptIndex.set(block.id, index);
+        this.#transcriptImageAssets.discardUnowned();
+        this.#transcriptSnapshot = undefined;
+    }
+    #transcriptBlock(id) {
+        const index = this.#transcriptIndex.get(id);
+        return index === undefined ? undefined : this.#transcript[index];
+    }
+    // Invariant: the named work state is the only state a matching end may clear.
+    #enterWorkState(kind, message) {
+        const wasBusy = this.#lifecycle === "busy";
+        this.#statusKind = kind;
+        this.#lifecycle = "busy";
+        this.#status = { ...this.#status, workingMessage: message };
+        if (!wasBusy)
+            this.#emitEvent({ type: "session-lifecycle", lifecycle: "busy", reason: null });
+        this.#emitEvent({ type: "status", status: this.#status });
+    }
+    // Invariant: ending retry or compaction cannot clear a different active work state.
+    #endWorkState(kind) {
+        if (this.#statusKind !== kind)
+            return;
+        if (this.#agentRunActive) {
+            this.#enterWorkState("working", "Working");
+            return;
+        }
+        this.#leaveWorkStates();
+    }
+    #leaveWorkStates() {
+        this.#statusKind = null;
+        this.#lifecycle = "ready";
+        this.#status = { ...this.#status, workingMessage: null };
+        this.#emitEvent({ type: "session-lifecycle", lifecycle: "ready", reason: null });
+        this.#emitEvent({ type: "status", status: this.#status });
+    }
     #handlePiEvent(event) {
+        try {
+            this.#applyPiEvent(event);
+        }
+        finally {
+            this.#transcriptImageAssets.discardUnowned();
+        }
+    }
+    #applyPiEvent(event) {
         if (!isRecord(event) || typeof event.type !== "string")
             return;
+        // Invariant: usage moves at message and lifecycle boundaries, not with stream chunks, so the
+        // two streaming event kinds keep the memo and everything else drops it.
+        if (event.type !== "message_update" && event.type !== "tool_execution_update")
+            this.#usageCache = undefined;
         switch (event.type) {
             case "agent_start":
-                this.#lifecycle = "busy";
-                this.#status = { ...this.#status, workingMessage: "Working..." };
-                this.#emitEvent({ type: "session-lifecycle", lifecycle: "busy", reason: null });
-                this.#emitEvent({ type: "status", status: this.#status });
+                this.#agentRunActive = true;
+                this.#agentRunSequence += 1;
+                this.#emitEvent({ type: "agent-run-started" });
+                this.#enterWorkState("working", "Working");
                 return;
             case "message_start":
                 this.#upsertMessageBlock(event.message, "live");
                 return;
             case "message_update": {
-                const block = this.#upsertMessageBlock(event.message, "live");
-                if (block && isRecord(event.assistantMessageEvent) && typeof event.assistantMessageEvent.delta === "string") {
-                    this.#upsertTranscriptBlock({
-                        ...block,
-                        text: block.text.endsWith(event.assistantMessageEvent.delta)
-                            ? block.text
-                            : `${block.text}${event.assistantMessageEvent.delta}`,
-                    });
+                const delta = isRecord(event.assistantMessageEvent) && typeof event.assistantMessageEvent.delta === "string"
+                    ? event.assistantMessageEvent.delta
+                    : undefined;
+                // Invariant: the delta is folded in before the block is stored, so a chunk is one update to
+                // one block rather than a store without the delta followed by a store with it.
+                const blocks = this.#messageBlocks(event.message, "live", this.#transcript.length);
+                for (const [index, block] of blocks.entries()) {
+                    this.#upsertTranscriptBlock(index === 0 && delta !== undefined && !block.text.endsWith(delta)
+                        ? { ...block, text: `${block.text}${delta}` }
+                        : block);
                 }
                 return;
             }
             case "message_end":
                 this.#upsertMessageBlock(event.message, "finalized");
+                this.#settleFailedDeclarations(event.message);
+                // Compatibility: preserve the same semantic boundary v2 counted. Transcript block
+                // finalization is intentionally not a substitute: rebuilds, retries,
+                // thinking parts, and tool rows can all finalize independently.
+                if (isRecord(event.message) && event.message.role === "assistant") {
+                    this.#assistantResponseSequence += 1;
+                    const content = Array.isArray(event.message.content) ? event.message.content : [];
+                    const stopReason = stringValue(event.message.stopReason) ?? null;
+                    const toolContinuation = stopReason === "toolUse"
+                        || content.some(item => isRecord(item) && item.type === "toolCall");
+                    const successful = stringValue(event.message.errorMessage) === undefined
+                        && stopReason !== "error"
+                        && stopReason !== "aborted"
+                        && textFromContent(content).trim().length > 0;
+                    this.#emitEvent({
+                        type: "assistant-message-completed",
+                        sessionGeneration: this.#sessionGeneration,
+                        runSequence: this.#agentRunSequence,
+                        responseSequence: this.#assistantResponseSequence,
+                        model: this.#activeModel,
+                        assistantMessageCount: this.#transcript.filter(block => block.kind === "assistant").length,
+                        successful,
+                        stopReason,
+                        toolContinuation,
+                    });
+                }
                 return;
             case "turn_end":
                 this.#upsertMessageBlock(event.message, "finalized");
@@ -1438,26 +2199,58 @@ export class PiEngineAdapter {
                 }
                 return;
             case "tool_execution_start":
+            case "tool_execution_end": {
+                this.#upsertToolExecutionBlock(event);
+                return;
+            }
             case "tool_execution_update":
-            case "tool_execution_end":
                 this.#upsertToolExecutionBlock(event);
                 return;
             case "agent_settled":
             case "agent_end": {
                 if (event.type === "agent_end" && event.willRetry === true)
                     return;
-                const finalMessages = Array.isArray(event.messages) && event.messages.length > 0
-                    ? event.messages
-                    : this.#session?.messages ?? [];
-                if (finalMessages.length > 0)
+                // Protocol: agent_end is run-local; only settlement reads the complete session scope.
+                const finalMessages = event.type === "agent_settled"
+                    ? this.#session?.messages ?? []
+                    : Array.isArray(event.messages) ? event.messages : [];
+                if (event.type === "agent_end")
+                    this.#mergeRunTranscript(finalMessages);
+                else if (finalMessages.length > 0)
                     this.#rebuildTranscript(finalMessages, "finalized");
-                else
-                    this.#transcript = this.#transcript.map(block => block.status === "live" ? { ...block, status: "finalized" } : block);
-                this.#lifecycle = "ready";
-                this.#status = { ...this.#status, workingMessage: null };
-                this.#emitEvent({ type: "session-lifecycle", lifecycle: "ready", reason: null });
-                this.#emitEvent({ type: "status", status: this.#status });
+                // Invariant: missing final messages must not erase accumulated content or invent tool outcomes.
+                if (finalMessages.length === 0)
+                    this.#setTranscript(this.#transcript.map(block => block.status === "live" && transcriptToolState(block) === undefined
+                        ? { ...block, status: "finalized", revision: block.revision + 1 } : block));
+                // Compatibility: ending a turn leaves the working state, as the recorded pinned baseline does, but
+                // it leaves only that state: a compaction or retry being shown outlives the turn
+                // that ended under it. Settlement ends the run, and with it every state — the
+                // engine ends a turn for each continuation it makes and settles once.
+                if (event.type === "agent_settled") {
+                    this.#agentRunActive = false;
+                    this.#leaveWorkStates();
+                }
+                else if (this.#statusKind === null || this.#statusKind === "working") {
+                    this.#leaveWorkStates();
+                }
                 this.#emitView();
+                if (event.type === "agent_settled") {
+                    const assistants = finalMessages.filter(message => isRecord(message) && message.role === "assistant");
+                    const lastAssistant = assistants.at(-1);
+                    const successful = lastAssistant !== undefined
+                        && stringValue(lastAssistant.errorMessage) === undefined
+                        && stringValue(lastAssistant.stopReason) !== "error"
+                        && stringValue(lastAssistant.stopReason) !== "aborted";
+                    this.#emitEvent({
+                        type: "agent-run-settled",
+                        sessionGeneration: this.#sessionGeneration,
+                        runSequence: this.#agentRunSequence,
+                        responseSequence: this.#assistantResponseSequence,
+                        model: this.#activeModel,
+                        assistantMessageCount: assistants.length,
+                        successful,
+                    });
+                }
                 return;
             }
             case "queue_update": {
@@ -1472,20 +2265,16 @@ export class PiEngineAdapter {
                 return;
             }
             case "auto_retry_start":
-                this.#lifecycle = "busy";
-                this.#status = { ...this.#status, workingMessage: "Retrying…" };
-                this.#emitEvent({ type: "status", status: this.#status });
+                this.#enterWorkState("retry", "Retrying");
                 return;
             case "auto_retry_end":
-            case "compaction_end":
-                this.#lifecycle = "ready";
-                this.#status = { ...this.#status, workingMessage: null };
-                this.#emitEvent({ type: "status", status: this.#status });
+                this.#endWorkState("retry");
                 return;
             case "compaction_start":
-                this.#lifecycle = "busy";
-                this.#status = { ...this.#status, workingMessage: "Compacting…" };
-                this.#emitEvent({ type: "status", status: this.#status });
+                this.#enterWorkState("compaction", "Compacting");
+                return;
+            case "compaction_end":
+                this.#endWorkState("compaction");
                 return;
             case "thinking_level_changed":
                 this.#thinkingLevel = readThinkingLevel(event.level);
@@ -1548,6 +2337,29 @@ export class PiEngineAdapter {
             autoCompactEnabled: this.#runtime?.services.settingsManager?.getCompactionEnabled?.() ?? true,
         };
     }
+    // Invariant: run-local completion may restate messages, but never owns transcript membership.
+    #mergeRunTranscript(messages) {
+        const positions = new Map();
+        const sessionOccurrences = new Map();
+        for (const [index, message] of (this.#session?.messages ?? []).entries()) {
+            const key = messageFallbackKey(message, index);
+            const occurrence = sessionOccurrences.get(key) ?? 0;
+            sessionOccurrences.set(key, occurrence + 1);
+            positions.set(message, { index, occurrence });
+        }
+        const runOccurrences = new Map();
+        for (const [index, message] of messages.entries()) {
+            const key = messageFallbackKey(message, index);
+            const occurrence = runOccurrences.get(key) ?? 0;
+            runOccurrences.set(key, occurrence + 1);
+            const position = positions.get(message) ?? { index, occurrence };
+            for (const block of this.#messageBlocks(message, "finalized", position.index, position.occurrence)) {
+                this.#upsertTranscriptBlock(block);
+            }
+            this.#settleFailedDeclarations(message);
+        }
+    }
+    // Invariant: full replacement is reserved for session-authoritative scope (bind/settlement).
     #rebuildTranscript(messages, status) {
         const blocks = [];
         const blockIndexes = new Map();
@@ -1556,7 +2368,7 @@ export class PiEngineAdapter {
             const key = messageFallbackKey(message, index);
             const occurrence = occurrences.get(key) ?? 0;
             occurrences.set(key, occurrence + 1);
-            for (const block of this.#messageBlocks(message, status, index, occurrence)) {
+            for (const block of this.#messageBlocks(message, status, index, occurrence, id => blocks[blockIndexes.get(id) ?? -1] ?? this.#transcriptBlock(id))) {
                 const existingIndex = blockIndexes.get(block.id);
                 if (existingIndex === undefined) {
                     blockIndexes.set(block.id, blocks.length);
@@ -1575,7 +2387,14 @@ export class PiEngineAdapter {
                 }
             }
         }
-        this.#transcript = blocks;
+        // Performance: an authoritative rebuild restates most of what is already there. Reusing the block
+        // that already says it keeps its revision, and with it the rows the shell rendered for
+        // it — otherwise every turn that ends re-renders the whole session.
+        this.#setTranscript(blocks.map(block => {
+            const existing = this.#transcriptBlock(block.id);
+            const next = existing === undefined ? block : retainCompletedArguments(existing, block);
+            return existing !== undefined && sameBlockContent(existing, next) ? existing : next;
+        }));
     }
     #upsertMessageBlock(message, status) {
         const blocks = this.#messageBlocks(message, status, this.#transcript.length);
@@ -1584,7 +2403,7 @@ export class PiEngineAdapter {
             this.#upsertTranscriptBlock(block);
         return first;
     }
-    #messageBlocks(message, status, fallbackIndex, occurrence) {
+    #messageBlocks(message, status, fallbackIndex, occurrence, currentBlock = id => this.#transcriptBlock(id)) {
         if (!isRecord(message) || typeof message.role !== "string")
             return [];
         const baseId = this.#messageBlockId(message, fallbackIndex, status, occurrence);
@@ -1596,7 +2415,12 @@ export class PiEngineAdapter {
                     revision: this.#nextBlockRevision(baseId),
                     title: "User",
                     text: textFromContent(message.content),
-                    payload: { role: "user", imageCount: contentImageCount(message.content) },
+                    imageReferences: this.#imageReferences(message.content, "user"),
+                    payload: {
+                        role: "user",
+                        imageCount: contentImageCount(message.content),
+                        timestamp: typeof message.timestamp === "number" && Number.isFinite(message.timestamp) ? message.timestamp : null,
+                    },
                 }];
         }
         if (message.role === "bashExecution") {
@@ -1660,24 +2484,24 @@ export class PiEngineAdapter {
                 : this.#toolBlockIds.get(toolCallId) ?? `tool-${toolCallId}`;
             if (toolCallId !== undefined)
                 this.#toolBlockIds.set(toolCallId, blockId);
-            const existing = this.#transcript.find(block => block.id === blockId);
+            const existing = currentBlock(blockId);
             const existingPayload = isRecord(existing?.payload) ? existing.payload : undefined;
+            const payload = {
+                role: "toolResult", toolCallId: toolCallId ?? null,
+                toolName: stringValue(message.toolName) ?? stringValue(existingPayload?.toolName) ?? "unknown",
+                argsComplete: true, partialResult: status === "live", isError: message.isError === true,
+            };
+            const rendering = toolRenderingInput({ args: undefined, previousArgs: existing?.toolRendering,
+                result: message, payload, image: part => this.#imageReferences([part], "tool-result")[0] });
             return [{
                     id: blockId,
                     kind: "tool-result",
                     status,
+                    toolState: { argsComplete: true, execution: status === "live" ? "running" : message.isError === true ? "failed" : "succeeded" },
                     revision: this.#nextBlockRevision(blockId),
                     title: stringValue(message.toolName) ?? existing?.title ?? "Tool result",
-                    text: textFromContent(message.content),
-                    payload: {
-                        ...(existingPayload ?? {}),
-                        role: "toolResult",
-                        toolCallId: toolCallId ?? null,
-                        toolName: stringValue(message.toolName) ?? stringValue(existingPayload?.toolName) ?? "unknown",
-                        argsComplete: true,
-                        isError: message.isError === true,
-                        details: jsonSummary(message.details),
-                    },
+                    ...rendering,
+                    payload,
                 }];
         }
         if (message.role !== "assistant" || !Array.isArray(message.content))
@@ -1707,23 +2531,74 @@ export class PiEngineAdapter {
             const toolCallId = stringValue(item.id) ?? `${baseId}:${blocks.length}`;
             const blockId = this.#toolBlockIds.get(toolCallId) ?? `tool-${toolCallId}`;
             this.#toolBlockIds.set(toolCallId, blockId);
+            const failure = status === "finalized" ? this.#declarationFailure(message) : undefined;
+            const payload = { toolCallId, toolName: stringValue(item.name) ?? "unknown",
+                argsComplete: failure === undefined && status === "finalized",
+                ...(failure === undefined ? {} : { isError: true }) };
+            const rendering = toolRenderingInput({ args: item.arguments, payload,
+                ...(failure === undefined ? {} : { result: { content: [{ type: "text", text: failure.text }] } }),
+                image: () => undefined });
             blocks.push({
                 id: blockId,
-                kind: "tool-call",
-                status,
+                kind: failure === undefined ? "tool-call" : "tool-result",
+                status: failure === undefined ? "live" : "finalized",
+                toolState: {
+                    argsComplete: failure === undefined && status === "finalized",
+                    execution: failure?.execution ?? "pending",
+                },
                 revision: this.#nextBlockRevision(blockId),
                 title: stringValue(item.name) ?? "Tool",
-                text: jsonSummary(item.arguments).summary,
-                payload: {
-                    toolCallId,
-                    toolName: stringValue(item.name) ?? "unknown",
-                    arguments: jsonSummary(item.arguments),
-                    argsComplete: status === "finalized",
-                },
+                ...rendering,
+                text: failure?.text ?? jsonSummary(item.arguments).summary,
+                payload,
             });
         }
         return blocks;
     }
+    #declarationFailure(message) {
+        // Provenance: pinned interactive-mode message_end and history reconstruction settle pending tools.
+        if (message.role !== "assistant")
+            return undefined;
+        if (message.stopReason === "aborted") {
+            const attempts = this.#session?.retryAttempt ?? 0;
+            return { execution: "aborted", text: attempts > 0
+                    ? `Aborted after ${attempts} retry attempt${attempts > 1 ? "s" : ""}` : "Operation aborted" };
+        }
+        return message.stopReason === "error"
+            ? { execution: "failed", text: stringValue(message.errorMessage) || "Error" } : undefined;
+    }
+    #settleFailedDeclarations(message) {
+        if (!isRecord(message))
+            return;
+        const failure = this.#declarationFailure(message);
+        if (failure === undefined)
+            return;
+        for (const block of this.#transcript) {
+            const state = transcriptToolState(block);
+            if (state === undefined || state.execution !== "pending" && state.execution !== "running")
+                continue;
+            const payload = { ...(isRecord(block.payload) ? block.payload : {}), partialResult: false, isError: true };
+            this.#upsertTranscriptBlock({
+                ...block, kind: "tool-result", status: "finalized", revision: block.revision + 1,
+                ...toolRenderingInput({ args: undefined, previousArgs: block.toolRendering, payload,
+                    result: { content: [{ type: "text", text: failure.text }] }, image: () => undefined }),
+                toolState: { ...state, execution: failure.execution }, payload,
+            });
+        }
+    }
+    #imageReferences(content, source) {
+        if (!Array.isArray(content))
+            return [];
+        const references = [];
+        for (const item of content) {
+            if (references.length >= 16)
+                break;
+            const reference = this.#transcriptImageAssets.reference(item, source);
+            if (reference !== undefined)
+                references.push(reference);
+        }
+        return references;
+    }
     #upsertToolExecutionBlock(event) {
         const toolCallId = stringValue(event.toolCallId);
         if (!toolCallId)
@@ -1731,31 +2606,52 @@ export class PiEngineAdapter {
         const blockId = this.#toolBlockIds.get(toolCallId) ?? `tool-${toolCallId}`;
         this.#toolBlockIds.set(toolCallId, blockId);
         const ended = event.type === "tool_execution_end";
+        const existing = this.#transcriptBlock(blockId);
+        const state = existing === undefined ? undefined : transcriptToolState(existing);
+        // Invariant: duplicate starts cannot blank accumulated output; late events cannot reopen a settled invocation.
+        if (state !== undefined && (state.execution !== "pending" && state.execution !== "running"
+            || event.type === "tool_execution_start" && state.execution === "running"))
+            return;
         const source = ended ? event.result : event.partialResult;
+        const payload = { toolCallId, toolName: stringValue(event.toolName) ?? "unknown",
+            partialResult: event.type === "tool_execution_update", argsComplete: true, isError: event.isError === true };
+        const rendering = toolRenderingInput({ args: event.args, previousArgs: existing?.toolRendering, result: source,
+            payload, image: part => this.#imageReferences([part], "tool-result")[0] });
         this.#upsertTranscriptBlock({
             id: blockId,
             kind: ended ? "tool-result" : "tool-call",
             status: ended ? "finalized" : "live",
+            toolState: { argsComplete: true, execution: ended ? event.isError === true ? "failed" : "succeeded" : "running" },
             revision: this.#nextBlockRevision(blockId),
             title: stringValue(event.toolName) ?? "Tool",
-            text: textFromContent(isRecord(source) ? source.content : source),
-            payload: {
-                toolCallId,
-                toolName: stringValue(event.toolName) ?? "unknown",
-                arguments: jsonSummary(event.args),
-                result: jsonSummary(source),
-                partialResult: event.type === "tool_execution_update",
-                argsComplete: ended,
-                isError: event.isError === true,
-            },
+            ...rendering,
+            payload,
         });
     }
     #upsertTranscriptBlock(block) {
-        const index = this.#transcript.findIndex(existing => existing.id === block.id);
-        if (index >= 0)
+        const index = this.#transcriptIndex.get(block.id);
+        if (index !== undefined) {
+            const existing = this.#transcript[index];
+            // Invariant: argument completion is not execution finality; stale phases still stay rejected.
+            if (existing !== undefined && !acceptsTranscriptUpdate(existing, block))
+                return;
+            if (existing !== undefined)
+                block = retainCompletedArguments(existing, block);
+            // Performance: nothing is emitted for a block that repeats itself, and keeping the
+            // revision keeps the rows it already rendered.
+            if (existing !== undefined && sameBlockContent(existing, block))
+                return;
+            this.#transcriptImageAssets.retain(block);
+            if (existing !== undefined)
+                this.#transcriptImageAssets.release(existing);
             this.#transcript[index] = block;
-        else
+        }
+        else {
+            this.#transcriptImageAssets.retain(block);
+            this.#transcriptIndex.set(block.id, this.#transcript.length);
             this.#transcript.push(block);
+        }
+        this.#transcriptSnapshot = undefined;
         this.#emitEvent({ type: "transcript-block", block });
     }
     #messageBlockId(message, fallbackIndex, status, occurrence) {
@@ -1773,7 +2669,7 @@ export class PiEngineAdapter {
             }
         }
         else {
-            id = [...cached].reverse().find(candidate => this.#transcript.some(block => block.id === candidate && block.status === "live"));
+            id = [...cached].reverse().find(candidate => this.#transcriptBlock(candidate)?.status === "live");
             if (id === undefined && status === "finalized")
                 id = cached.at(-1);
             if (id === undefined) {
@@ -1786,7 +2682,7 @@ export class PiEngineAdapter {
         return id;
     }
     #nextBlockRevision(id) {
-        const existing = this.#transcript.find(block => block.id === id);
+        const existing = this.#transcriptBlock(id);
         if (existing)
             return existing.revision + 1;
         this.#nextBlockSequence += 1;
@@ -1817,6 +2713,7 @@ export class PiEngineAdapter {
         this.#emitEvent({ type: "diagnostic", diagnostic });
     }
     #emitView() {
+        this.#usageCache = undefined;
         this.#viewRevision += 1;
         this.#emitEvent({ type: "session-view", view: this.view() });
     }
@@ -1827,43 +2724,127 @@ export class PiEngineAdapter {
         this.#enqueueEvent(event);
     }
     #enqueueEvent(event) {
-        const capacity = 1_024;
-        if (this.#eventQueue.length >= capacity) {
-            const coalescible = this.#eventQueue.findIndex(queued => queued.type === "session-view"
-                || queued.type === "status"
-                || queued.type === "editor-state"
-                || queued.type === "transcript-block");
-            if (coalescible >= 0)
-                this.#eventQueue.splice(coalescible, 1);
-            else
-                this.#eventQueue.shift();
-            this.#droppedEventCount += 1;
-            if (this.#droppedEventCount === 1 || this.#droppedEventCount % 128 === 0) {
-                this.#recordDiagnostic("warning", "event-backpressure", `owned UI coalesced ${this.#droppedEventCount} engine events under backpressure`, true);
+        if (this.#overload !== undefined) {
+            if (event.type === "command-outcome" && event.outcome !== "accepted" && this.#pendingCommands.has(event.correlationId)) {
+                this.#reservedOutcomes.set(event.correlationId, { outcome: event.outcome, diagnostic: event.diagnostic });
+            }
+            return;
+        }
+        if (!this.#eventQueue.push(event, this.#sessionGeneration, event.type === "transcript-block"
+            ? this.#blockReconciliation(event.block.id, event.sequence) : undefined)) {
+            this.#beginOverload();
+            if (event.type === "command-outcome" && event.outcome !== "accepted" && this.#pendingCommands.has(event.correlationId)
+                && !this.#reservedOutcomes.has(event.correlationId)) {
+                this.#reservedOutcomes.set(event.correlationId, { outcome: event.outcome, diagnostic: event.diagnostic });
             }
         }
-        this.#eventQueue.push(event);
         this.#eventQueueProcessing ??= Promise.resolve().then(() => this.#processEventQueue());
     }
+    // Performance: capture only identity, not the complete block/event retained by an earlier revision.
+    #blockReconciliation(id, sequence) {
+        return () => ({ type: "transcript-block", sessionId: this.#sessionId, sequence, block: this.#transcriptBlock(id) });
+    }
+    #beginOverload() {
+        if (this.#overload !== undefined)
+            return;
+        this.#overloads = Math.min(Number.MAX_SAFE_INTEGER, this.#overloads + 1);
+        this.#deliveryFailed = true;
+        // Concurrency: reserve before cancellation; outcomes produced reentrantly must not enter the saturated queue.
+        this.#overload = Promise.resolve(false);
+        for (const pending of this.#pendingCommands.values())
+            pending.cancel();
+        for (const pending of this.#pendingWorkflows)
+            pending.cancel();
+        const session = this.#session;
+        this.#overload = new Promise(resolve => {
+            const timer = setTimeout(() => resolve(false), 2000);
+            void Promise.resolve().then(() => session?.abort()).then(() => {
+                clearTimeout(timer);
+                resolve(true);
+            }, () => { clearTimeout(timer); resolve(false); });
+        });
+    }
+    #deliver(event) {
+        for (const [listener, subscribedAt] of this.#listeners) {
+            if (event.sequence <= subscribedAt)
+                continue;
+            try {
+                listener(event);
+            }
+            catch (error) {
+                this.#deliveryFailed = true;
+                this.#recordDiagnostic("warning", "event-listener", error instanceof Error ? error.message : String(error), true);
+            }
+        }
+    }
+    async #reconcileOverload() {
+        const cancelled = await this.#overload;
+        const canResume = cancelled === true && this.#runningCommands === 0;
+        this.#admissionStopped = !canResume;
+        this.#unsubscribe?.();
+        this.#unsubscribe = undefined;
+        ++this.#sessionGeneration;
+        this.#agentRunActive = false;
+        this.#statusKind = null;
+        this.#status = { ...this.#status, workingMessage: null };
+        this.#lifecycle = this.#disposed ? "stopped" : canResume ? "ready" : "failed";
+        this.#editor = { ...this.#editor, submitEnabled: canResume && !this.#disposed };
+        this.#viewRevision += 1;
+        // Invariant: overload publishes one authoritative view; settle tool phases before finalizing other live blocks.
+        this.#settleFailedDeclarations({ role: "assistant", stopReason: cancelled ? "aborted" : "error",
+            errorMessage: "Tool result unavailable after UI delivery overload" });
+        this.#setTranscript(this.#transcript.map(block => block.status === "live" ? { ...block, status: "finalized", revision: block.revision + 1 } : block));
+        for (const [correlationId, result] of this.#reservedOutcomes) {
+            this.#deliver(this.#event({ type: "command-outcome", correlationId, ...result }));
+            await new Promise(resolve => setImmediate(resolve));
+        }
+        this.#reservedOutcomes.clear();
+        // Invariant: one out-of-band authoritative reconciliation, not an emergency transcript/event log.
+        this.#deliver(this.#event({ type: "session-view", view: this.view() }));
+        if (this.#disposed)
+            this.#deliver(this.#event({ type: "session-lifecycle", lifecycle: "stopped", reason: null }));
+        if (canResume && !this.#disposed && this.#session !== undefined) {
+            const generation = this.#sessionGeneration;
+            this.#unsubscribe = this.#session.subscribe(event => {
+                if (generation === this.#sessionGeneration && !this.#disposed)
+                    this.#handlePiEvent(event);
+            });
+        }
+        this.#overload = undefined;
+    }
     async #processEventQueue() {
         try {
-            while (this.#eventQueue.length > 0) {
-                const event = this.#eventQueue.shift();
-                if (!event)
+            let deliveredSinceYield = 0;
+            while (this.#eventQueue.size > 0) {
+                const pending = this.#eventQueue.shift();
+                if (pending === undefined)
                     continue;
-                for (const listener of this.#listeners) {
-                    try {
-                        listener(event);
-                    }
-                    catch (error) {
-                        this.#recordDiagnostic("warning", "event-listener", error instanceof Error ? error.message : String(error), true);
-                    }
+                if (pending.generation !== this.#sessionGeneration && pending.event.type !== "command-outcome") {
+                    this.#invalidatedEvents = Math.min(Number.MAX_SAFE_INTEGER, this.#invalidatedEvents + 1);
+                    pending.release?.();
+                    continue;
+                }
+                try {
+                    this.#deliver(pending.event);
+                }
+                finally {
+                    pending.release?.();
+                }
+                deliveredSinceYield += 1;
+                // Concurrency: a microtask chain runs to exhaustion before the loop turns, so a streaming
+                // burst would hold typed input, pointer reports, and timed indicators until it
+                // drained. Yielding on a macrotask hands those their turn between batches.
+                if (deliveredSinceYield >= EVENT_DELIVERY_BATCH && this.#eventQueue.size > 0) {
+                    deliveredSinceYield = 0;
+                    await new Promise(resolve => { setImmediate(resolve); });
                 }
             }
+            if (this.#overload !== undefined)
+                await this.#reconcileOverload();
         }
         finally {
             this.#eventQueueProcessing = undefined;
-            if (this.#eventQueue.length > 0) {
+            if (this.#eventQueue.size > 0) {
                 this.#eventQueueProcessing = Promise.resolve().then(() => this.#processEventQueue());
             }
         }
@@ -1896,7 +2877,14 @@ export async function createPiEngineAdapter(options = {}) {
     return adapter;
 }
 async function createDefaultPiRuntime(input) {
-    return createPiRuntimeIntegration({ cwd: input.cwd, agentDir: input.agentDir });
+    return createPiRuntimeIntegration({
+        cwd: input.cwd,
+        agentDir: input.agentDir,
+        ...(input.sessionPath === undefined ? {} : { sessionPath: input.sessionPath }),
+        ...(input.sessionSelection === undefined ? {} : { sessionSelection: input.sessionSelection }),
+        ...(input.sessionForkPrompt === undefined ? {} : { sessionForkPrompt: input.sessionForkPrompt }),
+        ...(input.projectTrustPrompt === undefined ? {} : { projectTrustPrompt: input.projectTrustPrompt }),
+    });
 }
 async function checkDefaultPiPackageUpdates(cwd, agentDir, settingsManager) {
     const packageManager = new DefaultPackageManager({ cwd, agentDir, settingsManager });
@@ -2019,11 +3007,11 @@ function pinnedCacheWaste(entries, modelRuntime) {
 function defaultWorkflowHost() {
     return {
         copyText: copyToClipboard,
-        async runCommand(command, arguments_) {
-            const result = await execFileAsync(command, [...arguments_], { encoding: "utf8" });
+        async runCommand(command, arguments_, options) {
+            const result = await execFileAsync(command, [...arguments_], { encoding: "utf8", signal: options?.signal });
             return { stdout: result.stdout, stderr: result.stderr };
         },
-        readChangelog: async () => "No changelog entries found.",
+        readChangelog: readPinnedCommandChangelog,
     };
 }
 function workflowLoginNotification(event) {
@@ -2056,14 +3044,22 @@ function workflowLoginNotification(event) {
     }
     return { type: event.type === "waiting" ? "waiting" : "progress", message };
 }
-function workflowResult(command, outcome, message, detail) {
-    return { command, outcome, message, ...(detail === undefined ? {} : { detail }) };
+function workflowResult(command, outcome, message, detail, messageKind, messages) {
+    return {
+        command,
+        outcome,
+        message,
+        ...(detail === undefined ? {} : { detail }),
+        ...(messageKind === undefined ? {} : { messageKind }),
+        ...(messages === undefined ? {} : { messages: Object.freeze([...messages]) }),
+    };
 }
-function workflowConfirmation(command, message) {
+function workflowConfirmation(command, message, detail) {
     return {
         command,
         outcome: "requires-confirmation",
         message,
+        ...(detail === undefined ? {} : { detail }),
         selectorTitle: "Confirm",
         options: [
             { id: "yes", label: "Yes" },
@@ -2071,6 +3067,26 @@ function workflowConfirmation(command, message) {
         ],
     };
 }
+function errorMessage(error, fallback) {
+    return error instanceof Error ? error.message : fallback;
+}
+function shareCommandFailureDetail(error) {
+    // Compatibility: Pi reports a failed child's stderr, not execFile's command wrapper.
+    if (isRecord(error) && (typeof error.code === "number" || typeof error.signal === "string") && typeof error.stderr === "string") {
+        return error.stderr.trim() || "Unknown error";
+    }
+    return errorMessage(error, "Unknown error");
+}
+function commandMissing(error) {
+    return isRecord(error) && error.code === "ENOENT";
+}
+function isAbortError(error) {
+    return isRecord(error) && (error.name === "AbortError" || error.code === "ABORT_ERR");
+}
+function shareViewerUrl(gistId) {
+    const baseUrl = process.env.PI_SHARE_VIEWER_URL || "https://pi.dev/session/";
+    return `${baseUrl}#${gistId}`;
+}
 function workflowOptions(value, idKey, labelKey) {
     if (!Array.isArray(value))
         return [];
@@ -2122,7 +3138,7 @@ function settingKeyForCallback(callback) {
         onAutoCompactChange: "autoCompact", onShowImagesChange: "showImages", onImageWidthCellsChange: "imageWidthCells",
         onAutoResizeImagesChange: "autoResizeImages", onBlockImagesChange: "blockImages", onEnableSkillCommandsChange: "enableSkillCommands",
         onSteeringModeChange: "steeringMode", onFollowUpModeChange: "followUpMode", onTransportChange: "transport",
-        onHttpIdleTimeoutMsChange: "httpIdleTimeoutMs", onThemeChange: "theme", onThemePreview: "theme",
+        onHttpIdleTimeoutMsChange: "httpIdleTimeoutMs", onThinkingLevelChange: "thinkingLevel", onThemeChange: "theme", onThemePreview: "theme",
         onHideThinkingBlockChange: "hideThinkingBlock", onMermaidRenderingModeChange: "mermaidRenderingMode",
         onShowCacheMissNoticesChange: "showCacheMissNotices", onCollapseChangelogChange: "collapseChangelog",
         onEnableInstallTelemetryChange: "enableInstallTelemetry", onQuietStartupChange: "quietStartup",
@@ -2245,11 +3261,26 @@ function extensionResourceDiagnostic(index, sourcePath, diagnostic) {
         id: `extension-diagnostic-${index}`,
         sourcePath,
         resolvedPath: null,
+        sourceInfo: null,
         loaded: false,
         hidden: false,
         diagnostic,
     };
 }
+function extensionSourceSummary(value) {
+    if (!isRecord(value))
+        return null;
+    const source = stringProperty(value, "source");
+    const scope = value.scope;
+    const origin = value.origin;
+    const baseDir = value.baseDir;
+    if (!source
+        || (scope !== "user" && scope !== "project" && scope !== "temporary")
+        || (origin !== "package" && origin !== "top-level")
+        || (baseDir !== undefined && typeof baseDir !== "string"))
+        return null;
+    return { source, scope, origin, baseDir: baseDir ?? null };
+}
 function collectionResult(value, key) {
     if (!isRecord(value))
         return { values: [], diagnostics: [] };
@@ -2274,10 +3305,91 @@ function stringProperty(value, key) {
     const item = value[key];
     return typeof item === "string" && item.length > 0 ? item : undefined;
 }
+function isUnknownModel(value) {
+    return isRecord(value)
+        && value.provider === "unknown"
+        && value.id === "unknown"
+        && value.api === "unknown";
+}
+function findExactWorkflowModel(reference, models) {
+    const normalized = reference.trim().toLowerCase();
+    const canonical = models.filter(model => {
+        const provider = stringProperty(model, "provider");
+        const id = stringProperty(model, "id");
+        return provider !== undefined && id !== undefined && `${provider}/${id}`.toLowerCase() === normalized;
+    });
+    if (canonical.length === 1)
+        return canonical[0];
+    const bare = models.filter(model => stringProperty(model, "id")?.toLowerCase() === normalized);
+    return bare.length === 1 ? bare[0] : undefined;
+}
+/**
+ * Some ecosystem extensions retain a `pi-<name>` slash-command alias beside
+ * their unprefixed command. A1 presents the product-neutral command once while
+ * leaving Pi's runner free to accept the compatibility alias when typed.
+ */
+function isPiPrefixedCompatibilityAlias(command, commands) {
+    const name = stringProperty(command, "name");
+    if (!name?.startsWith("pi-") || name.length === 3)
+        return false;
+    const canonicalName = name.slice(3);
+    const description = stringProperty(command, "description");
+    const sourcePath = extensionCommandSourcePath(command);
+    return commands.some(candidate => candidate !== command
+        && stringProperty(candidate, "name") === canonicalName
+        && stringProperty(candidate, "description") === description
+        && extensionCommandSourcePath(candidate) === sourcePath);
+}
+function extensionCommandSourcePath(command) {
+    return isRecord(command) ? stringProperty(command.sourceInfo, "path") : undefined;
+}
 function compactResourceLabel(path) {
     const segments = path.replaceAll("\\", "/").split("/").filter(Boolean);
     return segments.at(-1) ?? path;
 }
+/** A later error may restate a declaration, but cannot make completed arguments incomplete. */
+function retainCompletedArguments(current, next) {
+    if (current.toolState?.argsComplete !== true || next.toolState === undefined || next.toolState.argsComplete)
+        return next;
+    return { ...next, toolState: { ...next.toolState, argsComplete: true },
+        ...(next.toolRendering === undefined || current.toolRendering === undefined ? {} : {
+            toolRendering: { ...next.toolRendering, arguments: current.toolRendering.arguments },
+        }),
+        payload: { ...(isRecord(next.payload) ? next.payload : {}), argsComplete: true } };
+}
+/**
+ * Whether two blocks say the same thing. A block that says what it already said is not a
+ * new revision: the shell renders a block once per revision, so bumping one it did not
+ * need re-renders it for nothing.
+ */
+function sameBlockContent(left, right) {
+    return left.kind === right.kind
+        && left.status === right.status
+        && left.title === right.title
+        && left.text === right.text
+        && sameValue(left.toolState, right.toolState)
+        && sameValue(left.toolRendering, right.toolRendering)
+        && sameValue(left.payload, right.payload)
+        && sameValue(left.imageReferences ?? [], right.imageReferences ?? []);
+}
+function sameValue(left, right) {
+    if (left === right)
+        return true;
+    if (typeof left !== typeof right || left === null || right === null)
+        return false;
+    if (Array.isArray(left) || Array.isArray(right)) {
+        if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length)
+            return false;
+        return left.every((value, index) => sameValue(value, right[index]));
+    }
+    if (typeof left !== "object")
+        return false;
+    const leftKeys = Object.keys(left);
+    const rightRecord = right;
+    if (leftKeys.length !== Object.keys(rightRecord).length)
+        return false;
+    return leftKeys.every(key => Object.hasOwn(rightRecord, key) && sameValue(left[key], rightRecord[key]));
+}
 function textFromContent(content) {
     if (typeof content === "string")
         return content;