@timurproko/a1 0.2.7-dev.1276 → 0.2.7-dev.1285

package/dist/integrations/pi/engine/runtime-integration.d.ts

@@ -2,8 +2,11 @@ import { createAgentSessionServices, SettingsManager, type AgentSession, type Ag
 import { resolvePiProjectTrustPreflight, type PiProjectTrustPreflightPrompt } from "./project-trust-preflight.js";
 import { type PiSessionForkPrompt, type PiSessionSelection } from "./session-selection.js";
 import { type StartupPhase } from "../../../foundation/startup/startup-runtime.js";
+import { type PiWorktreeCwdReader } from "./worktree-tools.js";
 export interface PiRuntimeIntegrationOptions {
     readonly cwd: string;
+    /** Only the bare claim-owning product supplies this; comparison tools keep their ordinary cwd. */
+    readonly worktreeCwdReader?: PiWorktreeCwdReader;
     readonly agentDir: string;
     readonly sessionDir?: string;
     readonly sessionPath?: string;
@@ -51,6 +54,11 @@ export declare function createPiRuntimeServicesAfterTrust(options: Pick<PiRuntim
     readonly trust: Awaited<ReturnType<typeof resolvePiProjectTrustPreflight>>;
 }>;
 export declare function createPiRuntimeIntegration(options: PiRuntimeIntegrationOptions): Promise<AgentSessionRuntime>;
+/** Switch to an independent copy; an extension veto or failed switch must not leave a stray fork. */
+export declare function switchToRecoveredFork(runtime: AgentSessionRuntime, sourcePath: string, cwd: string, options?: Parameters<AgentSessionRuntime["switchSession"]>[1]): Promise<{
+    readonly cancelled: boolean;
+    readonly message: string;
+}>;
 export declare function bindPiRuntimeSession(runtime: AgentSessionRuntime, rebind: (session: AgentSession) => Promise<void>): () => void;
 export declare function replacePiRuntimeSession(runtime: AgentSessionRuntime, replacement: PiSessionReplacement): Promise<{
     readonly cancelled: boolean;

package/dist/integrations/pi/engine/runtime-integration.js

@@ -1,10 +1,11 @@
-import { closeSync, mkdirSync, openSync, writeFileSync } from "node:fs";
+import { closeSync, mkdirSync, openSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
 import { createAgentSessionFromServices, createAgentSessionRuntime, createAgentSessionServices, resolveModelScopeWithDiagnostics, SessionManager, SettingsManager, } from "../startup-public.js";
 import { resolvePiProjectTrustPreflight, } from "./project-trust-preflight.js";
 import { openSelectedPiSession, resolveSessionArgumentPath, takeSelectedSessionWriter } from "./session-selection.js";
 import { markStartupPhase } from "../../../foundation/startup/startup-runtime.js";
 import { createWindowsNulCleanupExtension } from "./windows-filesystem-hygiene.js";
+import { createSessionWorktreeTools } from "./worktree-tools.js";
 import { acquireSessionWriter, } from "../../../foundation/session-writer-lock/index.js";
 class SessionWriterCoordinator {
     #current;
@@ -140,13 +141,22 @@ export async function createPiRuntimeIntegration(options) {
             const created = await createAgentSessionFromServices({
                 services,
                 sessionManager: targetSessionManager,
+                ...(options.worktreeCwdReader === undefined ? {} : {
+                    customTools: createSessionWorktreeTools(cwd, signal => options.worktreeCwdReader(targetSessionManager.getSessionId(), targetSessionManager.getSessionFile(), signal ?? options.signal ?? new AbortController().signal)).filter(tool => !services.resourceLoader.getExtensions().extensions.some(extension => extension.tools.has(tool.name))),
+                }),
                 ...(sessionStartEvent ? { sessionStartEvent } : {}),
                 ...(modelScope.model && !hasExistingSession ? { model: modelScope.model } : {}),
                 ...(modelScope.thinkingLevel && !hasExistingSession ? { thinkingLevel: modelScope.thinkingLevel } : {}),
                 ...(modelScope.scopedModels.length > 0 ? { scopedModels: [...modelScope.scopedModels] } : {}),
             });
+            try {
+                await (options.markStartupPhase ?? defaultStartupPhaseMarker)("session-created");
+            }
+            catch (error) {
+                created.session.dispose();
+                throw error;
+            }
             sessionWriters.activate(pendingWriter);
-            await (options.markStartupPhase ?? defaultStartupPhaseMarker)("session-created");
             return {
                 ...created,
                 services,
@@ -161,17 +171,56 @@ export async function createPiRuntimeIntegration(options) {
             throw error;
         }
     };
-    const runtime = await createAgentSessionRuntime(createRuntime, {
-        cwd: sessionManager.getCwd(),
-        agentDir: options.agentDir,
-        sessionManager,
-    });
-    runtimeSessionWriters.set(runtime, sessionWriters);
-    return runtime;
+    try {
+        const runtime = await createAgentSessionRuntime(createRuntime, {
+            cwd: sessionManager.getCwd(),
+            agentDir: options.agentDir,
+            sessionManager,
+        });
+        runtimeSessionWriters.set(runtime, sessionWriters);
+        const dispose = runtime.dispose.bind(runtime);
+        let disposal;
+        // Invariant: every public runtime consumer uses the writer-owning teardown, including the adapter.
+        runtime.dispose = () => disposal ??= (async () => {
+            try {
+                await dispose();
+            }
+            finally {
+                sessionWriters.release();
+                runtimeSessionWriters.delete(runtime);
+            }
+        })();
+        return runtime;
+    }
+    catch (error) {
+        takeSelectedSessionWriter(sessionManager)?.release();
+        sessionWriters.release();
+        throw error;
+    }
 }
 function defaultStartupPhaseMarker(phase) {
     return markStartupPhase(process.env, phase);
 }
+/** Switch to an independent copy; an extension veto or failed switch must not leave a stray fork. */
+export async function switchToRecoveredFork(runtime, sourcePath, cwd, options) {
+    const source = resolveSessionArgumentPath(sourcePath, process.cwd());
+    const fork = SessionManager.forkFrom(source, cwd, runtime.session.sessionManager.getSessionDir());
+    const path = fork.getSessionFile();
+    if (path === undefined)
+        throw new Error("Fork did not create a session file");
+    try {
+        const result = await runtime.switchSession(path, options);
+        if (result.cancelled)
+            unlinkSync(path);
+        return { cancelled: result.cancelled, message: `Forked into new session ${fork.getSessionId()} in ${cwd}` };
+    }
+    catch (error) {
+        // Security: a replacement callback can throw after the fork became active; never delete that active file.
+        if (runtime.session.sessionManager.getSessionFile() !== path)
+            unlinkSync(path);
+        throw error;
+    }
+}
 export function bindPiRuntimeSession(runtime, rebind) {
     runtime.setRebindSession(rebind);
     return () => runtime.setRebindSession(undefined);

package/dist/integrations/pi/engine/session-cwd-recovery.d.ts

@@ -0,0 +1,11 @@
+import type { OwnedUiWorkflowResult } from "../../../contracts/owned-ui/index.js";
+/** Pinned session-cwd prompt policy, adapted without importing Pi's private modules. */
+export declare function missingSessionCwdRecovery(error: unknown): (Pick<OwnedUiWorkflowResult, "message"> & {
+    readonly options: readonly {
+        readonly id: "continue" | "fork" | "cancel";
+        readonly label: string;
+    }[];
+    readonly cwdRecovery: {
+        readonly fallbackCwd: string;
+    };
+}) | undefined;

package/dist/integrations/pi/engine/session-cwd-recovery.js

@@ -0,0 +1,18 @@
+import { isRecord, stringProperty } from "./message-values.js";
+/** Pinned session-cwd prompt policy, adapted without importing Pi's private modules. */
+export function missingSessionCwdRecovery(error) {
+    const issue = isRecord(error) && isRecord(error.issue) ? error.issue : undefined;
+    const fallbackCwd = issue === undefined ? undefined : stringProperty(issue, "fallbackCwd");
+    const sessionCwd = issue === undefined ? undefined : stringProperty(issue, "sessionCwd");
+    if (fallbackCwd === undefined || sessionCwd === undefined)
+        return undefined;
+    return {
+        message: `Session cwd does not exist: ${sessionCwd}`,
+        cwdRecovery: { fallbackCwd },
+        options: [
+            { id: "continue", label: `Continue in ${fallbackCwd} (asks again next time)` },
+            { id: "fork", label: `Fork into ${fallbackCwd} (new session ID, original kept)` },
+            { id: "cancel", label: "Cancel" },
+        ],
+    };
+}

package/dist/integrations/pi/engine/session-runtime.d.ts

@@ -7,8 +7,10 @@ import type { OwnedUiDiagnostics } from "../../../contracts/owned-ui/index.js";
 import type { PiSessionResumeMetadata, PiWorkflowHost } from "./workflows.js";
 import type { PiPullRequestProbe } from "./repository-pr.js";
 import { RepositoryMetadataPoller, type PiRepositoryContextReader } from "./repository-metadata.js";
+import type { PiWorktreeCwdReader } from "./worktree-tools.js";
 export interface PiEngineRuntimeFactoryInput {
     readonly cwd: string;
+    readonly worktreeCwdReader?: PiWorktreeCwdReader;
     readonly agentDir: string;
     readonly sessionId: string;
     readonly sessionPath?: string;
@@ -39,6 +41,7 @@ interface PiEngineRuntimeOptions {
     readonly pullRequestRefreshMs?: number;
     readonly repositoryContextPollMs?: number;
     readonly repositoryContextReader?: PiRepositoryContextReader;
+    readonly worktreeCwdReader?: PiWorktreeCwdReader;
     readonly gitBranchReader?: (cwd: string, signal: AbortSignal) => Promise<string | null>;
     readonly host: PiWorkflowHost;
 }

package/dist/integrations/pi/engine/session-runtime.js

@@ -84,6 +84,7 @@ export class PiEngineRuntime {
             sessionId: this.#options.sessionId,
             signal: this.#options.signal,
             markStartupPhase: this.#options.markStartupPhase,
+            ...(this.#options.worktreeCwdReader === undefined ? {} : { worktreeCwdReader: this.#options.worktreeCwdReader }),
             ...(this.#options.sessionPath === undefined ? {} : { sessionPath: this.#options.sessionPath }),
             ...(this.#options.sessionSelection === undefined ? {} : { sessionSelection: this.#options.sessionSelection }),
             ...(this.#options.sessionForkPrompt === undefined ? {} : { sessionForkPrompt: this.#options.sessionForkPrompt }),
@@ -272,6 +273,7 @@ async function createDefaultPiRuntime(input) {
         agentDir: input.agentDir,
         signal: input.signal,
         markStartupPhase: input.markStartupPhase,
+        ...(input.worktreeCwdReader === undefined ? {} : { worktreeCwdReader: input.worktreeCwdReader }),
         ...(input.sessionPath === undefined ? {} : { sessionPath: input.sessionPath }),
         ...(input.sessionSelection === undefined ? {} : { sessionSelection: input.sessionSelection }),
         ...(input.sessionForkPrompt === undefined ? {} : { sessionForkPrompt: input.sessionForkPrompt }),

package/dist/integrations/pi/engine/session-selection.d.ts

@@ -6,7 +6,8 @@ export interface PiSessionSelection {
 }
 export type PiSessionForkPrompt = (request: {
     readonly sourceCwd: string;
-}) => Promise<boolean>;
+    readonly fallbackCwd?: string;
+}) => Promise<boolean | "continue" | "fork" | "cancel">;
 /** Expected resume outcomes are concise CLI diagnostics, not engine crashes. */
 export declare class PiSessionSelectionError extends Error {
     readonly exitCode: number;
@@ -24,7 +25,7 @@ interface SessionSelectionOptions {
     };
 }
 export declare function takeSelectedSessionWriter(manager: SessionManager): SessionWriterHandle | undefined;
-/** Pinned Pi 0.84.2 main.ts policy, using SDK APIs rather than importing the CLI. */
+/** A1 CLI selection policy over pinned SDK APIs, including missing-folder recovery. */
 export declare function openSelectedPiSession(options: SessionSelectionOptions): Promise<SessionManager>;
 /** Resolve before switching effective cwd, including quoted home-relative paths. */
 export declare function resolveSessionArgumentPath(path: string, cwd: string): string;

package/dist/integrations/pi/engine/session-selection.js

@@ -22,7 +22,7 @@ function holdSelectedWriter(manager, writer) {
     selectedSessionWriters.set(manager, writer);
     return manager;
 }
-/** Pinned Pi 0.84.2 main.ts policy, using SDK APIs rather than importing the CLI. */
+/** A1 CLI selection policy over pinned SDK APIs, including missing-folder recovery. */
 export async function openSelectedPiSession(options) {
     const sessions = options.sessions ?? SessionManager;
     const cwd = resolve(options.cwd);
@@ -48,8 +48,9 @@ export async function openSelectedPiSession(options) {
             path = matched.path;
         }
         assertResumeFile(path);
-        if (global) {
-            if (!options.forkPrompt || !await options.forkPrompt({ sourceCwd: global.cwd })) {
+        if (global && existsSync(global.cwd)) {
+            const choice = await options.forkPrompt?.({ sourceCwd: global.cwd });
+            if (choice !== true && choice !== "fork") {
                 throw new PiSessionSelectionError("Session resume cancelled.", 0);
             }
             assertResumeFile(path);
@@ -66,8 +67,26 @@ export async function openSelectedPiSession(options) {
         // can otherwise produce a new in-memory header instead of an existing session.
         const writer = options.guardWriter ? acquireExisting(path) : undefined;
         try {
-            const manager = sessions.open(path, sessionDir);
+            let manager = sessions.open(path, sessionDir);
             assertResumeFile(path);
+            if (!existsSync(manager.getCwd()) && options.forkPrompt !== undefined) {
+                const choice = await options.forkPrompt({ sourceCwd: manager.getCwd(), fallbackCwd: cwd });
+                if (choice !== "continue" && choice !== "fork" && choice !== true)
+                    throw new PiSessionSelectionError("Session resume cancelled.", 0);
+                assertResumeFile(path);
+                assertCwd(cwd);
+                if (choice === "fork" || choice === true) {
+                    const fork = sessions.forkFrom(path, cwd, sessionDir);
+                    writer?.release();
+                    if (!options.guardWriter)
+                        return fork;
+                    const target = fork.getSessionFile();
+                    if (target === undefined)
+                        throw new PiSessionSelectionError("Fork did not create a session file");
+                    return holdSelectedWriter(fork, acquireSessionWriter(target));
+                }
+                manager = sessions.open(path, sessionDir, cwd);
+            }
             assertCwd(manager.getCwd());
             return writer === undefined ? manager : holdSelectedWriter(manager, writer);
         }
@@ -80,7 +99,8 @@ export async function openSelectedPiSession(options) {
         if (error instanceof PiSessionSelectionError)
             throw error;
         if (error instanceof SessionWriterConflict) {
-            if (options.forkPrompt && await options.forkPrompt({ sourceCwd: cwd })) {
+            const choice = await options.forkPrompt?.({ sourceCwd: cwd });
+            if (choice === true || choice === "fork") {
                 const manager = sessions.forkFrom(error.path, cwd, sessionDir);
                 if (!options.guardWriter)
                     return manager;

package/dist/integrations/pi/engine/transcript-image-assets.d.ts

@@ -1,6 +1,9 @@
 import type { OwnedUiEvent, OwnedUiImageAttachment, OwnedUiTranscriptBlock, OwnedUiTranscriptImageReference } from "../../../contracts/owned-ui/index.js";
 export declare class TranscriptImageAssets {
     #private;
+    /** Encoded assets held only by delivery, plus shared pending lease metadata. */
+    pendingBytesExcluding(event?: OwnedUiEvent): number;
+    get pendingBytes(): number;
     resolve(id: string): OwnedUiImageAttachment | null;
     clear(): void;
     reference(value: unknown, source: OwnedUiTranscriptImageReference["source"]): OwnedUiTranscriptImageReference | undefined;

package/dist/integrations/pi/engine/transcript-image-assets.js

@@ -3,6 +3,22 @@ const MAX_IMAGE_BYTES = 20 * 1024 * 1024;
 // Security: current blocks and admitted delivery snapshots own assets independently; superseded state owns none.
 export class TranscriptImageAssets {
     #assets = new Map();
+    #events = new WeakMap();
+    #captureBytes = 0;
+    /** Encoded assets held only by delivery, plus shared pending lease metadata. */
+    pendingBytesExcluding(event) {
+        const key = event === undefined ? undefined : event.type === "transcript-block" ? event.block : event.type === "session-view" ? event.view.transcript : undefined;
+        const shared = key === undefined ? undefined : this.#events.get(key);
+        return this.pendingBytes - (shared?.owners === 1 ? shared.exclusiveBytes() : 0);
+    }
+    get pendingBytes() {
+        let bytes = this.#captureBytes;
+        for (const entry of this.#assets.values()) {
+            if (entry.pending > 0 && entry.owners === entry.pending)
+                bytes += 64 + entry.asset.data.length * 2;
+        }
+        return bytes;
+    }
     #byData = new Map();
     #unowned = new Set();
     resolve(id) { return this.#assets.get(id)?.asset ?? null; }
@@ -24,7 +40,7 @@ export class TranscriptImageAssets {
             return;
         const assetId = `image-${createHash("sha256").update(value.mimeType).update("\0").update(value.data).digest("hex").slice(0, 24)}`;
         if (!this.#assets.has(assetId)) {
-            this.#assets.set(assetId, { asset: { type: "image", data: value.data, mimeType: value.mimeType }, byteLength, owners: 0 });
+            this.#assets.set(assetId, { asset: { type: "image", data: value.data, mimeType: value.mimeType }, byteLength, owners: 0, pending: 0 });
             let byData = this.#byData.get(value.mimeType);
             if (byData === undefined)
                 this.#byData.set(value.mimeType, byData = new Map());
@@ -50,21 +66,56 @@ export class TranscriptImageAssets {
         }
     }
     retainEvent(event) {
-        const blocks = event.type === "transcript-block" ? [event.block] : event.type === "session-view" ? event.view.transcript : [];
-        // Concurrency: capture entries, not ids; an obsolete generation's release cannot decrement a replacement asset.
-        const entries = blocks.flatMap(block => (block.imageReferences ?? []).map(ref => [ref.assetId, this.#assets.get(ref.assetId)]));
-        for (const [id, entry] of entries) {
-            if (entry === undefined)
-                continue;
-            entry.owners++;
-            this.#unowned.delete(id);
-        }
-        return () => {
+        const key = event.type === "transcript-block" ? event.block : event.type === "session-view" ? event.view.transcript : undefined;
+        if (key === undefined)
+            return () => { };
+        let shared = this.#events.get(key);
+        if (shared === undefined) {
+            const blocks = event.type === "transcript-block" ? [event.block] : event.type === "session-view" ? event.view.transcript : [];
+            // Concurrency: capture entries, not ids: obsolete generations cannot decrement replacement assets.
+            const entries = blocks.flatMap(block => (block.imageReferences ?? []).map(ref => [ref.assetId, this.#assets.get(ref.assetId)]));
+            this.#captureBytes += entries.length * 32;
             for (const [id, entry] of entries) {
-                if (entry !== undefined && this.#assets.get(id) === entry && --entry.owners === 0)
-                    this.#delete(id);
+                if (entry === undefined)
+                    continue;
+                entry.owners++;
+                entry.pending++;
+                this.#unowned.delete(id);
             }
-            entries.length = 0;
+            shared = { owners: 0, exclusiveBytes: () => {
+                    let bytes = entries.length * 32;
+                    const counts = new Map();
+                    for (const [id, entry] of entries)
+                        if (entry !== undefined && this.#assets.get(id) === entry)
+                            counts.set(id, (counts.get(id) ?? 0) + 1);
+                    for (const [id, count] of counts) {
+                        const entry = this.#assets.get(id);
+                        if (entry.owners === count && entry.pending === count)
+                            bytes += 64 + entry.asset.data.length * 2;
+                    }
+                    return bytes;
+                }, release: () => {
+                    this.#captureBytes -= entries.length * 32;
+                    for (const [id, entry] of entries) {
+                        if (entry !== undefined && this.#assets.get(id) === entry) {
+                            entry.pending--;
+                            if (--entry.owners === 0)
+                                this.#delete(id);
+                        }
+                    }
+                    entries.length = 0;
+                    this.#events.delete(key);
+                } };
+            this.#events.set(key, shared);
+        }
+        shared.owners++;
+        let released = false;
+        return () => {
+            if (released)
+                return;
+            released = true;
+            if (--shared.owners === 0)
+                shared.release();
         };
     }
     discardUnowned() {

package/dist/integrations/pi/engine/view-state.d.ts

@@ -14,6 +14,20 @@ declare class EngineDiagnostics {
  * touches more than one field is one named mutator, so the adapter and its collaborators never
  * rebuild these objects inline.
  */
+export declare class OverloadRecovery {
+    #private;
+    readonly ports: {
+        generation(): number;
+        busy(): boolean;
+        canResume(): boolean;
+        resume(): void;
+    };
+    constructor(ports: OverloadRecovery["ports"]);
+    begin(): void;
+    defer(generation: number | undefined): void;
+    settled(): void;
+    resume(): void;
+}
 export declare class EngineViewState {
     #private;
     lifecycle: OwnedUiSessionViewModel["lifecycle"];

package/dist/integrations/pi/engine/view-state.js

@@ -45,6 +45,23 @@ const DEFAULT_SURFACE = {
  * touches more than one field is one named mutator, so the adapter and its collaborators never
  * rebuild these objects inline.
  */
+export class OverloadRecovery {
+    #generation;
+    #settled = false;
+    ports;
+    constructor(ports) { this.ports = ports; }
+    begin() { this.#settled = false; }
+    defer(generation) { this.#generation = generation; }
+    settled() { this.#settled = true; this.resume(); }
+    resume() {
+        if (this.#generation === undefined || !this.#settled || this.ports.busy() || !this.ports.canResume())
+            return;
+        const generation = this.#generation;
+        this.#generation = undefined;
+        if (generation === this.ports.generation())
+            this.ports.resume();
+    }
+}
 export class EngineViewState {
     #revision = 0;
     #editor = {

package/dist/integrations/pi/engine/workflow-runner.d.ts

@@ -48,6 +48,8 @@ export declare class PiWorkflowRunner {
     get pendingCount(): number;
     /** Resolve every admitted workflow as cancelled, except the named command. */
     cancelPending(except?: PiWorkflowRequest["command"]): void;
+    /** Presentation pressure must not cancel an independently applied state mutation. */
+    cancelForDelivery(): void;
     cycleModelWorkflow(direction: "forward" | "backward"): Promise<PiWorkflowResult>;
     /** Bind the owned UI's clipboard lifecycle without changing the comparison host. True means acknowledged delivery. */
     bindClipboardWriter(writer: (text: string) => Promise<boolean>): () => void;

package/dist/integrations/pi/engine/workflow-runner.js

@@ -2,7 +2,8 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { isRecord, readModel, readThinkingLevel, requireCapability, stringProperty } from "./message-values.js";
 import { AUTH_REFRESH_TIMEOUT_MS, errorMessage, findExactWorkflowModel, pathArgument, pinnedHotkeySummary, pinnedSessionInfoPresentation, workflowConfirmation, workflowResult, } from "./workflow-support.js";
-import { PiProviderAuthentication } from "./provider-authentication.js";
+import { missingSessionCwdRecovery } from "./session-cwd-recovery.js";
+import { switchToRecoveredFork } from "./runtime-integration.js";
 /** How many workflows and engine commands may be admitted together before new work is rejected. */
 const MAX_PENDING_WORK = 32;
 /**
@@ -25,7 +26,8 @@ export class PiWorkflowRunner {
         this.#bare = options.productMode === "bare";
         this.#host = options.host;
         this.#ports = ports;
-        this.#authentication = new PiProviderAuthentication({ agentDir: options.agentDir, contexts: options.contexts }, {
+        let authentication;
+        this.#authentication = () => authentication ??= import("./provider-authentication.js").then(({ PiProviderAuthentication }) => new PiProviderAuthentication({ agentDir: options.agentDir, contexts: options.contexts }, {
             runtime: () => ports.runtime(),
             requireSession: () => this.#requireSession(),
             disposed: () => ports.disposed(),
@@ -34,7 +36,7 @@ export class PiWorkflowRunner {
             setActiveModel: model => { ports.setActiveModel(model); },
             reconcileActiveModelAvailability: () => { ports.reconcileActiveModelAvailability(); },
             emitView: () => { ports.emitView(); },
-        });
+        }));
     }
     /** Workflows admitted and not yet settled. */
     get pendingCount() {
@@ -46,6 +48,13 @@ export class PiWorkflowRunner {
             if (pending.command !== except)
                 pending.cancel();
     }
+    /** Presentation pressure must not cancel an independently applied state mutation. */
+    cancelForDelivery() {
+        const mutations = new Set(["model", "models", "thinking", "scoped-models", "name"]);
+        for (const pending of this.#pending)
+            if (!mutations.has(pending.command))
+                pending.cancel();
+    }
     #requireSession() {
         const session = this.#ports.session();
         if (this.#ports.disposed() || !this.#ports.runtime() || !session)
@@ -114,7 +123,7 @@ export class PiWorkflowRunner {
     }
     async executeWorkflow(request) {
         const cancelled = workflowResult(request.command, "cancelled", "", undefined, "silent");
-        if (this.#ports.admissionStopped() || this.#ports.pendingCommandCount() + this.#pending.size >= MAX_PENDING_WORK)
+        if (request.command !== "quit" && (this.#ports.admissionStopped() || this.#ports.pendingCommandCount() + this.#pending.size >= MAX_PENDING_WORK))
             return cancelled;
         let cancel;
         const cancellation = new Promise(resolve => { cancel = () => resolve(cancelled); });
@@ -216,12 +225,14 @@ export class PiWorkflowRunner {
             const failure = { kind: "error", message: error instanceof Error ? error.message : String(error) };
             return workflowResult(request.command, "failed", failure.message, undefined, "error", messages.length === 0 ? undefined : [...messages, failure]);
         }
-        if (!current())
-            return workflowResult(request.command, "cancelled", "Model selection cancelled", undefined, "silent");
         const providerId = stringProperty(model, "provider") ?? "unknown";
         const modelId = stringProperty(model, "id") ?? reference;
-        this.#ports.setActiveModel({ providerId, modelId, displayName: stringProperty(model, "name") ?? modelId });
-        this.#ports.emitView();
+        // Invariant: selection already applied. A delivery-generation change cannot undo it; a replaced
+        // session must not receive its view, but the operation result remains truthful.
+        if (!this.#ports.disposed() && session === this.#ports.session()) {
+            this.#ports.setActiveModel({ providerId, modelId, displayName: stringProperty(model, "name") ?? modelId });
+            this.#ports.emitView();
+        }
         const resultMessage = { kind: "status", message: options.persist ? `Default model: ${providerId}/${modelId}` : `Model: ${modelId}` };
         const result = messages.length === 0
             ? workflowResult(request.command, "completed", resultMessage.message)
@@ -255,8 +266,15 @@ export class PiWorkflowRunner {
             case "clone": return cloneWorkflow(call);
             case "tree": return treeWorkflow(call);
             case "trust": return trustWorkflow(call);
-            case "login": return await this.#authentication.login(request, session, runtime, argument, selection);
-            case "logout": return selection ? await this.#authentication.logout(request, runtime, selection) : workflowResult(command, "failed", "Logout requires the owned authentication controller");
+            case "login":
+            case "logout": {
+                const generation = this.#ports.sessionGeneration();
+                const authentication = await this.#authentication();
+                if (this.#ports.disposed() || generation !== this.#ports.sessionGeneration() || this.#ports.admissionStopped())
+                    return workflowResult(command, "cancelled", "", undefined, "silent");
+                return command === "login" ? authentication.login(request, session, runtime, argument, selection)
+                    : selection ? authentication.logout(request, runtime, selection) : workflowResult(command, "failed", "Logout requires the owned authentication controller");
+            }
             case "new": return newSessionWorkflow(call);
             case "compact": return compactWorkflow(call);
             case "resume": return resumeWorkflow(call);
@@ -350,7 +368,7 @@ async function importWorkflow({ request, runtime, argument }) {
     if (request.confirmed === undefined) {
         return workflowConfirmation(request.command, `Replace current session with ${path}?`);
     }
-    if (!request.confirmed)
+    if (!request.confirmed || request.cwdRecoveryChoice === "cancel")
         return workflowResult(request.command, "cancelled", "Import cancelled", undefined, "status");
     try {
         const result = await requireCapability(runtime.importFromJsonl, "importFromJsonl").call(runtime, path, request.cwdOverride);
@@ -359,13 +377,14 @@ async function importWorkflow({ request, runtime, argument }) {
         return workflowResult(request.command, "completed", `Session imported from: ${path}`);
     }
     catch (error) {
-        const issue = isRecord(error) && isRecord(error.issue) ? error.issue : undefined;
-        const fallbackCwd = issue === undefined ? undefined : stringProperty(issue, "fallbackCwd");
-        if (fallbackCwd !== undefined && request.cwdOverride === undefined) {
-            const sessionCwd = stringProperty(issue, "sessionCwd") ?? "the session working directory";
-            return workflowConfirmation(request.command, `cwd from session file does not exist\n${sessionCwd}\n\ncontinue in current cwd\n${fallbackCwd}`, fallbackCwd);
+        const recovery = missingSessionCwdRecovery(error);
+        if (recovery === undefined || request.cwdOverride !== undefined)
+            throw error;
+        if (request.cwdRecoveryChoice === "fork") {
+            const result = await switchToRecoveredFork(runtime, path, recovery.cwdRecovery.fallbackCwd);
+            return workflowResult(request.command, result.cancelled ? "cancelled" : "completed", result.cancelled ? "Import cancelled" : result.message, undefined, "status");
         }
-        throw error;
+        return { command: request.command, outcome: "requires-selection", ...recovery };
     }
 }
 async function copyWorkflow({ request, session }, copy) {
@@ -459,6 +478,8 @@ async function resumeWorkflow({ request, runtime, argument, selection }) {
     if (!selection && !argument)
         return workflowResult(request.command, "failed", "Resume requires the owned session controller");
     const sessionPath = selection ?? argument;
+    if (request.cwdRecoveryChoice === "cancel")
+        return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "status");
     try {
         const result = await runtime.switchSession(sessionPath);
         if (isRecord(result) && result.cancelled === true)
@@ -466,20 +487,20 @@ async function resumeWorkflow({ request, runtime, argument, selection }) {
         return workflowResult(request.command, "completed", "Resumed session");
     }
     catch (error) {
-        const issue = isRecord(error) && isRecord(error.issue) ? error.issue : undefined;
-        const fallbackCwd = issue === undefined ? undefined : stringProperty(issue, "fallbackCwd");
-        if (fallbackCwd === undefined)
+        const recovery = missingSessionCwdRecovery(error);
+        if (recovery === undefined)
             throw error;
-        if (request.confirmed === undefined) {
-            const sessionCwd = stringProperty(issue, "sessionCwd") ?? "the session working directory";
-            return workflowConfirmation(request.command, `cwd from session file does not exist\n${sessionCwd}\n\ncontinue in current cwd\n${fallbackCwd}`);
+        if (request.cwdRecoveryChoice === undefined)
+            return { command: request.command, outcome: "requires-selection", ...recovery };
+        const fallbackCwd = recovery.cwdRecovery.fallbackCwd;
+        if (request.cwdRecoveryChoice === "fork") {
+            const result = await switchToRecoveredFork(runtime, sessionPath, fallbackCwd);
+            return workflowResult(request.command, result.cancelled ? "cancelled" : "completed", result.cancelled ? "Resume cancelled" : result.message, undefined, "status");
         }
-        if (!request.confirmed)
-            return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "status");
         const result = await runtime.switchSession(sessionPath, { cwdOverride: fallbackCwd });
         if (isRecord(result) && result.cancelled === true)
             return workflowResult(request.command, "cancelled", "Resume cancelled", undefined, "silent");
-        return workflowResult(request.command, "completed", "Resumed session in current cwd");
+        return workflowResult(request.command, "completed", `Resumed session in ${fallbackCwd}`, undefined, "status");
     }
 }
 /**

package/dist/integrations/pi/engine/worktree-tools.d.ts

@@ -0,0 +1,4 @@
+import { type ToolDefinition } from "../startup-public.js";
+export type PiWorktreeCwdReader = (sessionId: string, sessionFile: string, signal: AbortSignal) => Promise<string>;
+/** Built-in tool definitions borrow the current attachment per call, without process-global chdir. */
+export declare function createSessionWorktreeTools(startupCwd: string, resolveCwd: (signal?: AbortSignal) => Promise<string>): ToolDefinition[];

package/dist/integrations/pi/engine/worktree-tools.js

@@ -0,0 +1,26 @@
+import { createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createWriteToolDefinition, defineTool, } from "../startup-public.js";
+/** Built-in tool definitions borrow the current attachment per call, without process-global chdir. */
+export function createSessionWorktreeTools(startupCwd, resolveCwd) {
+    function wrap(factory) {
+        const definition = factory(startupCwd);
+        return defineTool({
+            ...definition,
+            ...(definition.name === "bash" ? { promptGuidelines: [
+                    ...(definition.promptGuidelines ?? []),
+                    "For task worktrees, use a1 worktree enter <branch> or a1 worktree attach <absolute-path>; success confirms attachment and subsequent built-in tools use that root. a1 worktree detach preserves files. Coordination and recovery are internal; no follow-up inventory check is required.",
+                ] } : {}),
+            defaultActive: false,
+            async execute(...args) {
+                const [id, params, signal, onUpdate, context] = args;
+                const cwd = await resolveCwd(signal);
+                signal?.throwIfAborted();
+                return await factory(cwd).execute(id, params, signal, onUpdate, { ...context, cwd });
+            },
+        });
+    }
+    // Compatibility: defineTool preserves schema inference through the SDK's heterogeneous collection.
+    return [
+        wrap(createReadToolDefinition), wrap(createBashToolDefinition), wrap(createEditToolDefinition), wrap(createWriteToolDefinition),
+        wrap(createGrepToolDefinition), wrap(createFindToolDefinition), wrap(createLsToolDefinition),
+    ];
+}