@trim21/personal-pi-extensions 0.0.195 → 0.0.198

package/README.md

@@ -230,23 +230,29 @@ index.ts     —— pi adapter：把 core 接到 pi 的 sendMessage / 生命周
 
 ### 工具（LLM 可见）
 
-| 工具                 | 作用                                                              |
-| -------------------- | ----------------------------------------------------------------- |
-| `talk-list-sessions` | 列出其他 session（presence：idle/working/not responding/offline） |
-| `talk-read-messages` | 主动读收件箱（读即消费）                                          |
-| `talk-ask`           | 向某个 session 提问并阻塞等待回复（默认 120s 超时）               |
-| `talk-wait`          | 阻塞等待新消息到达                                                |
-| `talk-send`          | 发送纯文本消息（`to: "*"` 广播所有，`to: "cwd"` 广播同 cwd）      |
-| `talk-reply`         | 回复一个 ask（`replyTo` 为 ask id，显式关联、不推断）             |
+| 工具                 | 作用                                                                                                                       |
+| -------------------- | -------------------------------------------------------------------------------------------------------------------------- |
+| `talk-list-sessions` | 列出其他 session，返回 JSON 数组（`status` / `work_dir` / `id` / `name`）；默认只列有心跳的，`includeOffline: true` 列全部 |
+| `talk-ask`           | 向某个 session 提问并阻塞等待回复（默认 30 分钟超时）                                                                      |
+| `talk-wait`          | 阻塞等待新消息到达                                                                                                         |
+| `talk-send`          | 发送纯文本消息（`to: "*"` 广播所有，`to: "cwd"` 广播同 cwd）                                                               |
+| `talk-reply`         | 回复一个 ask（`replyTo` 为 ask id，显式关联、不推断）                                                                      |
 
-对端消息在模型工作过程中以 steer 方式注入上下文；模型也可主动 `talk-read-messages` 拉取。
+对端消息自动投递（无需主动拉取）：投递方式由 `talk.deliver` 配置，`steer` 在模型工作过程中打断/唤醒，`queue` 排队到 session 下一轮自然 turn 时注入。
+
+**定位只认 session id**：`talk-send` / `talk-ask` / `talk-watch` 的 `to` 只接受 `talk-list-sessions` 返回的 `id`（pi 的 session uuid）精确匹配，不做 name/路径/前缀匹配。
+
+**标记废弃 session**：`/talk-dead` 把 session 的 `lastSeenAt` 置 0（从默认列表消失，下次 sweep 无 mail 即回收）：无参标记当前 session（同时停止其心跳），`/talk-dead <sessionId>` 标记指定 session，`/talk-dead --all` 标记所有其他可见 session。
 
 ### 关键设计
 
+- **心跳即活跃**：每个 session 每 15s 写一次 `lastSeenAt`；`talk-list-sessions` 默认只显示最近 15 分钟内有心跳的 session，已结束/挂起的 session 自动从默认列表消失（`includeOffline: true` 可见全部）。`status` 用 45s 心跳阈值区分 live / not responding / offline。
+- **定期清理**：心跳停止超过 24h 且无未投递 mail 的记录会被定期 sweep（30 分钟一次）回收；有 mail 的保留 30 天。resume 后 session 会自动重新注册，无 mail 即无损失。
 - **投递成功才消费**：信件只在成功交给 `sendMessage` 后才从 inbox 删除，投递失败留在 inbox 下次重试——不会因 `sendMessage` 吞异常而静默丢信。
 - **双向 ask 仲裁**：`talk-ask` 发起前先检查收件箱（有对方消息就先读/先回）；阻塞等待期间若收到对方的 ask（而非 reply），按两个 ask 的 `ts` 字段仲裁——先 ask 者主导继续等，后 ask 者让位并先回复对方。`ts` 是信件内固定字段，双方读到同一对值，结论天然对称；同毫秒碰撞用 `session dir + session id` 字符串比较兜底。
 - **typebox runtime 验证**：所有从存储读出的值经 TypeBox schema 校验，损坏/伪造数据被拒绝，不做 `as T` 强转。
 - **安全**：纯文本 ≤32KB；10s 去重 / 30s 限速 8 条 / 50 积压上限（防环）；每条投递带「来自其他 session、无权威」声明。
+- **workspace 可见性**：每个 workspace 通过 `<cwd>/.pi/talk.json` 的 `allowed` 控制自己能看到哪些 session，见下方配置。
 
 ### 配置
 
@@ -261,14 +267,39 @@ sqlite 文件路径按优先级取第一个可用值：
 ```jsonc
 // ~/.pi/agent/settings.json
 {
-  "talk": { "db_path": "~/data/talk.db" },
+  "talk": { "db_path": "~/data/talk.db", "deliver": "queue" },
+}
+```
+
+`talk.deliver` 控制对端消息的投递方式：
+
+- `"steer"`：消息到达时打断当前工作（工具调用间隙注入），空闲 session 被唤醒；
+- `"queue"`：消息排队，在 session 下一轮自然 turn（如用户发消息）时注入，不主动唤醒。
+
+默认 `"queue"`。
+
+### workspace 可见性
+
+每个 workspace 通过 `<cwd>/.pi/talk.json` 的 `allowed` 决定自己能看到哪些 session：
+
+```jsonc
+// ~/projects/company1/.pi/talk.json
+{
+  "allowed": ["~/projects/company1/"],
 }
 ```
 
-| 变量              | 默认                              | 含义                          |
-| ----------------- | --------------------------------- | ----------------------------- |
-| `PI_TALK_DB`      | settings 或 `~/.pi/agent/talk.db` | SQLite 邮箱数据库路径         |
-| `PI_TALK_INBOUND` | `accept`                          | `refuse` 时丢弃所有 peer 消息 |
+- `allowed` 是路径前缀列表：能看到前缀本身及其子目录下的 session（`~/projects/company1/*`），看不到 `~/projects/company2/` 下的 session；`company1` 不会误匹配 `company12`
+- 路径支持 `~` 展开，相对路径相对该 workspace 的 cwd 解析
+- 无 `allowed` 字段 → 全部可见；`"allowed": []` → 谁都看不到
+- 可见性单向生效：A 的配置只决定 A 能看到谁，不影响 B
+- 不可见的 session 不仅 list 不到，也无法 `talk-send` / `talk-ask` 寻址（即使知道 id 也会被拒绝）
+
+| 变量              | 默认                              | 含义                            |
+| ----------------- | --------------------------------- | ------------------------------- |
+| `PI_TALK_DB`      | settings 或 `~/.pi/agent/talk.db` | SQLite 邮箱数据库路径           |
+| `PI_TALK_INBOUND` | `accept`                          | `refuse` 时丢弃所有 peer 消息   |
+| `talk.deliver`    | `queue`                           | 消息投递方式：`steer` / `queue` |
 
 ### 使用
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.195",
+  "version": "0.0.198",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/lib/jsonc.ts

@@ -0,0 +1,67 @@
+/**
+ * Minimal JSONC → JSON conversion for small user-edited config files.
+ *
+ * Strips line and block comments and trailing commas outside of string
+ * literals, so a stray comment in a config file does not silently void the
+ * whole file (the way a plain `JSON.parse` would).
+ */
+
+export function jsoncToJson(raw: string): string {
+  let out = "";
+  let inString = false;
+  let i = 0;
+  while (i < raw.length) {
+    const c = raw[i];
+    if (inString) {
+      out += c;
+      if (c === "\\" && i + 1 < raw.length) {
+        out += raw[i + 1];
+        i += 2;
+        continue;
+      }
+      if (c === '"') inString = false;
+      i++;
+      continue;
+    }
+    switch (c) {
+      case '"': {
+        inString = true;
+        out += c;
+        i++;
+        continue;
+      }
+      case "/": {
+        if (raw[i + 1] === "/") {
+          while (i < raw.length && raw[i] !== "\n") i++;
+          continue;
+        }
+        if (raw[i + 1] === "*") {
+          i += 2;
+          while (i < raw.length && !(raw[i] === "*" && raw[i + 1] === "/")) i++;
+          i += 2;
+          continue;
+        }
+        out += c;
+        i++;
+        continue;
+      }
+      case ",": {
+        // Drop a trailing comma before } or ] (outside strings).
+        let j = i + 1;
+        while (j < raw.length && /\s/.test(raw[j])) j++;
+        if (raw[j] === "}" || raw[j] === "]") {
+          i++;
+          continue;
+        }
+        out += c;
+        i++;
+        continue;
+      }
+      default: {
+        out += c;
+        i++;
+      }
+    }
+  }
+  return out;
+}

package/src/talk/core.ts

@@ -9,13 +9,10 @@
  * poll — so a swallowed sendMessage error no longer destroys the letter.
  */
 
-import {
-  formatDelivery,
-  formatListing,
-  refusalAmbiguous,
-  refusalUnknown,
-  shortAddr,
-} from "./format.js";
+import { isAbsolute, resolve } from "node:path";
+
+import { expandHome } from "../lib/path.js";
+import { formatDelivery, formatListing, refusalUnknown, shortAddr } from "./format.js";
 import {
   appendAudit,
   awaitReceipt,
@@ -38,6 +35,7 @@ import {
 } from "./mailbox.js";
 import { inboundAccepts, OutboundPolicy } from "./policy.js";
 import {
+  LIST_ACTIVE_MS,
   listRecords,
   type Presence,
   presenceOf,
@@ -63,8 +61,6 @@ export interface TalkCoreEvents {
 export interface TalkCoreOptions {
   storage: TalkStorage;
   events: TalkCoreEvents;
-  /** Adapter-provided: which session ids pi can still resume (for sweep). */
-  collectResumableSessionIds?: () => Set<string>;
   now?: () => number;
 }
 
@@ -74,11 +70,34 @@ const WATCH_POLL_MS = 5000;
 const DELIVERY_BACKOFF_MS = 5000;
 const INITIAL_DRAIN_DELAY_MS = 1200;
 const WAIT_POLL_MS = 500;
+const SWEEP_INTERVAL_MS = 30 * 60 * 1000;
 
 const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
 
-function recordLabel(record: SessionRecord): string {
-  return `"${record.name}" (${shortAddr(record.addr)})`;
+/** Normalize an allowed path: expand ~, resolve relative against baseCwd, strip trailing slashes. */
+function normalizeAllowedPath(p: string, baseCwd: string): string {
+  const expanded = expandHome(p);
+  const abs = isAbsolute(expanded) ? resolve(expanded) : resolve(baseCwd, expanded);
+  return abs.replace(/[\\/]+$/, "") || "/";
+}
+
+/**
+ * Build the workspace-visibility gate for one session. `allowed` is the
+ * `allowed` array from `<cwd>/.pi/talk.json` (undefined when the file or key
+ * is absent). A peer session is visible when its cwd equals an allowed prefix
+ * or sits below it (`prefix` or `prefix/*`); `company1` never matches
+ * `company12`. An undefined list shows everything; an explicit empty list
+ * shows nothing.
+ */
+export function buildVisibilityFilter(
+  allowed: string[] | undefined,
+  baseCwd: string,
+): (peerCwd: string) => boolean {
+  if (allowed === undefined) return () => true;
+  if (allowed.length === 0) return () => false;
+  const prefixes = allowed.map((p) => normalizeAllowedPath(p, baseCwd));
+  return (peerCwd) =>
+    prefixes.some((prefix) => peerCwd === prefix || peerCwd.startsWith(`${prefix}/`));
 }
 
 /**
@@ -99,7 +118,6 @@ export function peerAskedFirst(
 export class TalkCore {
   private readonly storage: TalkStorage;
   private readonly events: TalkCoreEvents;
-  private readonly collectResumableSessionIds?: () => Set<string>;
   private readonly now: () => number;
 
   private self: SessionRecord | undefined;
@@ -108,16 +126,20 @@ export class TalkCore {
   private readonly watched = new Map<string, Presence>();
   /** Message ids already handed to the adapter but not yet removed from the inbox. */
   private readonly deliveredIds = new Set<string>();
+  /** Visibility gate over peer working directories; defaults to everything visible. */
+  private isPeerVisible: (peerCwd: string) => boolean = () => true;
+  /** Manually marked dead: heartbeat stopped, lastSeenAt pinned to 0. */
+  private dead = false;
 
   private inboxPoll: ReturnType<typeof setInterval> | undefined;
   private heartbeat: ReturnType<typeof setInterval> | undefined;
   private watchPoller: ReturnType<typeof setInterval> | undefined;
+  private sweeper: ReturnType<typeof setInterval> | undefined;
   private lastDeliveryFailureAt = 0;
 
   constructor(options: TalkCoreOptions) {
     this.storage = options.storage;
     this.events = options.events;
-    this.collectResumableSessionIds = options.collectResumableSessionIds;
     this.now = options.now ?? Date.now;
   }
 
@@ -125,6 +147,11 @@ export class TalkCore {
     return this.self?.addr;
   }
 
+  /** Replace the peer-visibility gate (from the session's `.pi/talk.json`). */
+  setPeerVisibility(filter: (peerCwd: string) => boolean): void {
+    this.isPeerVisible = filter;
+  }
+
   private requireSelf(): SessionRecord {
     const self = this.self;
     if (!self) throw new Error("Talk core is not started");
@@ -138,11 +165,7 @@ export class TalkCore {
     this.self = self;
     await writeRecord(this.storage, self);
     try {
-      const collectResumable = this.collectResumableSessionIds;
-      const sessionExists = collectResumable
-        ? (id: string) => collectResumable().has(id)
-        : undefined;
-      await sweep(this.storage, this.now(), sessionExists);
+      await sweep(this.storage, this.now());
     } catch {
       // sweep failure never breaks the session
     }
@@ -151,6 +174,11 @@ export class TalkCore {
       void this.writeSelf({});
     }, HEARTBEAT_MS);
     this.heartbeat.unref();
+    // Reclaim dead records periodically, not just at startup.
+    this.sweeper = setInterval(() => {
+      void sweep(this.storage, this.now());
+    }, SWEEP_INTERVAL_MS);
+    this.sweeper.unref();
     // Drain mail queued while offline — deferred: delivering during
     // session_start races the session's own first turn.
     const initial = setTimeout(() => {
@@ -163,6 +191,7 @@ export class TalkCore {
     if (this.heartbeat) clearInterval(this.heartbeat);
     if (this.watchPoller) clearInterval(this.watchPoller);
     if (this.inboxPoll) clearInterval(this.inboxPoll);
+    if (this.sweeper) clearInterval(this.sweeper);
     if (this.self) {
       try {
         await this.writeSelf({ status: "idle", offline: true });
@@ -186,7 +215,8 @@ export class TalkCore {
 
   private async writeSelf(patch: Partial<SessionRecord>): Promise<void> {
     if (!this.self) return;
-    this.self = { ...this.self, ...patch, lastSeenAt: this.now() };
+    // A dead session pins lastSeenAt to 0 so no later event re-freshens it.
+    this.self = { ...this.self, ...patch, lastSeenAt: this.dead ? 0 : this.now() };
     try {
       await writeRecord(this.storage, this.self);
     } catch {
@@ -314,38 +344,18 @@ export class TalkCore {
 
   // ── Outbound ───────────────────────────────────────────────────────────
 
+  /**
+   * Resolve a target by its exact session id (uuid). A peer must be visible
+   * from this session (`setPeerVisibility`); invisible peers are unreachable
+   * even with a known id.
+   */
   private async resolveTarget(to: string): Promise<TargetResult> {
     const self = this.requireSelf();
     const records = await listRecords(this.storage);
-    const others = records.filter((r) => r.addr !== self.addr);
-    const exact = others.filter((r) => r.name.toLowerCase() === to.toLowerCase() || r.addr === to);
-    const matches = exact.length > 0 ? exact : others.filter((r) => r.addr.startsWith(to));
-    if (matches.length === 0)
-      return {
-        ok: false,
-        error: refusalUnknown(
-          to,
-          others.map((r) => recordLabel(r)),
-        ),
-      };
-    if (matches.length > 1)
-      return {
-        ok: false,
-        error: refusalAmbiguous(
-          to,
-          matches.map((r) => recordLabel(r)),
-        ),
-      };
-    const record = matches[0];
-    if (!record)
-      return {
-        ok: false,
-        error: refusalUnknown(
-          to,
-          others.map((r) => recordLabel(r)),
-        ),
-      };
-    return { ok: true, record };
+    const others = records.filter((r) => r.addr !== self.addr && this.isPeerVisible(r.cwd));
+    const target = others.find((r) => r.sessionId === to);
+    if (!target) return { ok: false, error: refusalUnknown(to) };
+    return { ok: true, record: target };
   }
 
   private async sendLetter(
@@ -459,20 +469,6 @@ export class TalkCore {
 
   // ── Tool actions ───────────────────────────────────────────────────────
 
-  /** Actively read (and consume) inbox letters. Returns delivery-formatted text. */
-  async readMessages(from?: string): Promise<string> {
-    const self = this.requireSelf();
-    let items = await listInbox(this.storage, self.addr);
-    if (from && from !== "*") {
-      const resolved = await this.resolveTarget(from);
-      if (!resolved.ok) return resolved.error;
-      items = items.filter((i) => i.letter.from.addr === resolved.record.addr);
-    }
-    const fresh = await this.consumeFresh(items);
-    if (fresh.length === 0) return "No messages.";
-    return fresh.map((l) => formatDelivery(l)).join("\n\n");
-  }
-
   /** Block until a message arrives (or timeout/abort). */
   async wait(timeoutMs: number, signal?: AbortSignal): Promise<string> {
     const self = this.requireSelf();
@@ -487,17 +483,71 @@ export class TalkCore {
     }
   }
 
-  async list(): Promise<string> {
+  /**
+   * JSON listing of visible peer sessions. Defaults to sessions whose
+   * heartbeat is fresh (within LIST_ACTIVE_MS); pass includeOffline to show
+   * every visible peer regardless of last contact.
+   */
+  async list(includeOffline = false): Promise<string> {
     const self = this.requireSelf();
+    const now = this.now();
+    const all = await listRecords(this.storage);
+    const records = all.filter(
+      (r) => this.isPeerVisible(r.cwd) && (includeOffline || now - r.lastSeenAt < LIST_ACTIVE_MS),
+    );
+    return formatListing(records, self.addr, (r) => presenceOf(r, now));
+  }
+
+  /** Same as list(), filtered to one working directory. */
+  async listCwd(cwd: string, includeOffline = false): Promise<string> {
+    const self = this.requireSelf();
+    const now = this.now();
     const records = await listRecords(this.storage);
-    return formatListing(records, self.addr, (r) => presenceOf(r));
+    const filtered = records.filter(
+      (r) =>
+        r.cwd === cwd &&
+        this.isPeerVisible(r.cwd) &&
+        (includeOffline || now - r.lastSeenAt < LIST_ACTIVE_MS),
+    );
+    return formatListing(filtered, self.addr, (r) => presenceOf(r, now));
   }
 
-  async listCwd(cwd: string): Promise<string> {
+  /** Visible peer records (excluding self), e.g. for command completions. */
+  async listPeers(): Promise<SessionRecord[]> {
     const self = this.requireSelf();
     const records = await listRecords(this.storage);
-    const filtered = records.filter((r) => r.cwd === cwd);
-    return formatListing(filtered, self.addr, (r) => presenceOf(r));
+    return records.filter((r) => r.addr !== self.addr && this.isPeerVisible(r.cwd));
+  }
+
+  /**
+   * Mark a session as dead by pinning lastSeenAt to 0: it vanishes from the
+   * default listing and the next sweep reaps it (empty mailbox). Without a
+   * target, marks this session — its heartbeat is stopped and later
+   * writeSelf calls no longer refresh lastSeenAt.
+   */
+  async markDead(target?: string): Promise<string> {
+    if (!target) {
+      this.dead = true;
+      if (this.heartbeat) {
+        clearInterval(this.heartbeat);
+        this.heartbeat = undefined;
+      }
+      await this.writeSelf({});
+      return "Marked this session as dead.";
+    }
+    const resolved = await this.resolveTarget(target);
+    if (!resolved.ok) return resolved.error;
+    await writeRecord(this.storage, { ...resolved.record, lastSeenAt: 0 });
+    return `Marked "${resolved.record.name}" as dead.`;
+  }
+
+  /** Mark every visible peer (except self) as dead. */
+  async markAllDead(): Promise<string> {
+    const peers = await this.listPeers();
+    for (const peer of peers) {
+      await writeRecord(this.storage, { ...peer, lastSeenAt: 0 });
+    }
+    return `Marked ${peers.length} session(s) as dead.`;
   }
 
   async send(to: string, body: string): Promise<string> {
@@ -510,6 +560,7 @@ export class TalkCore {
       const records = await listRecords(this.storage);
       const peers = records.filter((r) => {
         if (r.addr === self.addr) return false;
+        if (!this.isPeerVisible(r.cwd)) return false;
         return to === "*" ? true : r.cwd === self.cwd;
       });
       if (peers.length === 0) return "No other sessions to broadcast to.";
@@ -547,7 +598,7 @@ export class TalkCore {
     const inbox = await listInbox(this.storage, self.addr);
     const fromTarget = inbox.filter((item) => item.letter.from.addr === record.addr);
     if (fromTarget.length > 0) {
-      return `You have ${fromTarget.length} unread message(s) from "${record.name}". Read them with talk-read-messages and reply before asking.`;
+      return `You have ${fromTarget.length} unread message(s) from "${record.name}" — reply before asking.`;
     }
     const sent = await this.sendLetter(record, "ask", body);
     if (!sent.ok) return sent.error;
@@ -567,7 +618,7 @@ export class TalkCore {
   async reply(replyTo: string, body: string): Promise<string> {
     if (!body) return "reply requires 'message'.";
     if (!replyTo) {
-      return "reply requires 'replyTo' (the ask/message id). Use talk-read-messages to find the id.";
+      return "reply requires 'replyTo' (the ask/message id, shown in the delivered message).";
     }
     const self = this.requireSelf();
     const ask = await resolveAskByRef(this.storage, self.addr, replyTo);

package/src/talk/format.ts

@@ -30,25 +30,31 @@ export function formatDelivery(letter: Letter, now: number = Date.now()): string
   return `${BOUNDARY_PREAMBLE}\n\n${header}:\n\n${letter.body}\n\n${meta}${hint}`;
 }
 
+/** One peer session as the model sees it in a listing. `id` is the stable
+ * pi session uuid; `name` is the display name when one was set. */
+export interface SessionListItem {
+  status: string;
+  work_dir: string;
+  id: string;
+  name?: string;
+}
+
+/** Machine-readable JSON listing of peer sessions (what the model sees). */
 export function formatListing(
   records: SessionRecord[],
   selfAddr: string,
   presence: (r: SessionRecord) => Presence,
 ): string {
   const others = records.filter((r) => r.addr !== selfAddr);
-  if (others.length === 0) return "No other pi sessions registered.";
-  const rows = others.map((r) => {
+  if (others.length === 0) return "[]";
+  const items: SessionListItem[] = others.map((r) => {
     const p = presence(r);
-    const state = p === "live" ? r.status : p === "stalled" ? "not responding" : "offline";
-    return `• ${r.name} (${shortAddr(r.addr)}) — ${r.cwd} [${state}]`;
+    const status = p === "live" ? r.status : p === "stalled" ? "not responding" : "offline";
+    return { status, work_dir: r.cwd, id: r.sessionId, name: r.name };
   });
-  return rows.join("\n");
-}
-
-export function refusalUnknown(to: string, reachable: string[]): string {
-  return `No session matches '${to}'. Reachable: ${reachable.length > 0 ? reachable.join(", ") : "(none)"}.`;
+  return JSON.stringify(items, null, 2);
 }
 
-export function refusalAmbiguous(to: string, candidates: string[]): string {
-  return `'${to}' is ambiguous; matches: ${candidates.join(", ")}. Use a full name or address prefix.`;
+export function refusalUnknown(to: string): string {
+  return `Unknown session id '${to}'. Get session ids with talk-list-sessions.`;
 }

package/src/talk/index.ts

@@ -17,8 +17,9 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { Box, Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { jsoncToJson } from "../lib/jsonc.js";
 import { resolveHomePath } from "../lib/path.js";
-import { TalkCore } from "./core.js";
+import { buildVisibilityFilter, TalkCore } from "./core.js";
 import { formatDelivery } from "./format.js";
 import type { Letter } from "./mailbox.js";
 import { deriveAddr, type SessionRecord } from "./registry.js";
@@ -28,7 +29,7 @@ const DELIVERY_TYPE = "talk:delivery";
 const LIST_TYPE = "talk:list";
 const NOTIFY_TYPE = "talk:notify";
 
-const ASK_TIMEOUT_MS = 120_000;
+const ASK_TIMEOUT_MS = 30 * 60 * 1000;
 
 function toolResult(text: string) {
   return { content: [{ type: "text" as const, text }], details: {} };
@@ -80,48 +81,54 @@ interface DeliveryDetails {
   replyTo?: string;
 }
 
-// ── Resumability (for sweep) ─────────────────────────────────────────────
-// pi session files live at <agentDir>/sessions/<cwd-slug>/<ts>_<sessionId>.jsonl.
-// Collected once per sweep; a session whose file exists can be resumed and
-// must keep its mailbox address.
-
-function collectResumableSessionIds(): Set<string> {
-  const ids = new Set<string>();
-  let dirs: string[];
+/**
+ * Read the default sqlite path and delivery mode from global settings.json:
+ * `{ "talk": { "db_path": "...", "deliver": "steer" | "queue" } }`.
+ */
+function readTalkSettings(): { dbPath?: string; deliver?: "steer" | "queue" } {
   try {
-    dirs = fs.readdirSync(path.join(getAgentDir(), "sessions"));
+    const raw = fs.readFileSync(path.join(getAgentDir(), "settings.json"), "utf8");
+    const parsed = JSON.parse(raw) as { talk?: { db_path?: unknown; deliver?: unknown } };
+    const talk = parsed.talk;
+    if (!talk) return {};
+    const dbPath = typeof talk.db_path === "string" ? talk.db_path : undefined;
+    const deliver = talk.deliver === "steer" || talk.deliver === "queue" ? talk.deliver : undefined;
+    return { dbPath, deliver };
   } catch {
-    return ids;
-  }
-  for (const dir of dirs) {
-    try {
-      for (const file of fs.readdirSync(path.join(getAgentDir(), "sessions", dir))) {
-        const match = /_([0-9a-f-]{36})\.jsonl$/.exec(file);
-        if (match) ids.add(match[1]);
-      }
-    } catch {
-      // skip unreadable dir
-    }
+    return {};
   }
-  return ids;
 }
 
-/** Read the default sqlite path from global settings.json: `{ "talk": { "db_path": "..." } }`. */
-function readDbPathFromSettings(): string | undefined {
+/**
+ * Read the workspace visibility config from `<cwd>/.pi/talk.json`:
+ * `{ "allowed": ["~/projects/company1/"] }`. Missing file/key → undefined
+ * (everything visible); an explicit `"allowed": []` hides every peer.
+ */
+function readWorkspaceTalkConfig(cwd: string): { allowed?: string[] } {
+  const configPath = path.join(cwd, ".pi", "talk.json");
   try {
-    const raw = fs.readFileSync(path.join(getAgentDir(), "settings.json"), "utf8");
-    const parsed = JSON.parse(raw) as { talk?: { db_path?: unknown } };
-    return typeof parsed.talk?.db_path === "string" ? parsed.talk.db_path : undefined;
-  } catch {
-    return undefined;
+    const raw = fs.readFileSync(configPath, "utf8");
+    const parsed = JSON.parse(jsoncToJson(raw)) as { allowed?: unknown };
+    if (Array.isArray(parsed.allowed)) {
+      return { allowed: parsed.allowed.filter((p): p is string => typeof p === "string") };
+    }
+    return {};
+  } catch (error) {
+    // eslint-disable-next-line no-console -- config errors must be visible, not silent
+    console.error(`Warning: could not parse ${configPath}: ${String(error)}`);
+    return {};
   }
 }
 
 export default function talk(pi: ExtensionAPI) {
-  const configured = process.env.PI_TALK_DB ?? readDbPathFromSettings();
+  const settings = readTalkSettings();
+  const configured = process.env.PI_TALK_DB ?? settings.dbPath;
   const dbPath = configured
     ? resolveHomePath(configured, getAgentDir())
     : path.join(getAgentDir(), "talk.db");
+  // "queue": deliver on the session's next natural turn without waking it;
+  // "steer": interrupt mid-run / wake an idle session immediately.
+  const deliverMode: "steer" | "queue" = settings.deliver ?? "queue";
   const storage = new SqliteTalkStorage(dbPath);
 
   let self: SessionRecord | undefined;
@@ -136,12 +143,13 @@ export default function talk(pi: ExtensionAPI) {
       ...(letter.replyTo !== undefined && { replyTo: letter.replyTo }),
     };
     try {
-      // steer lands between tool calls mid-run; triggerTurn wakes an idle
-      // session. The core only removes the letter from the inbox after this
-      // returns true, so a failure keeps it queued for a later poll.
+      // The core only removes the letter from the inbox after this returns
+      // true, so a failure keeps it queued for a later poll.
       pi.sendMessage(
         { customType: DELIVERY_TYPE, content: formatDelivery(letter), display: true, details },
-        { triggerTurn: true, deliverAs: "steer" },
+        deliverMode === "steer"
+          ? { triggerTurn: true, deliverAs: "steer" }
+          : { deliverAs: "nextTurn" },
       );
       return true;
     } catch {
@@ -162,7 +170,6 @@ export default function talk(pi: ExtensionAPI) {
         );
       },
     },
-    collectResumableSessionIds,
   });
 
   function requireInit(): string | undefined {
@@ -186,6 +193,7 @@ export default function talk(pi: ExtensionAPI) {
       lastSeenAt: now,
       status: "idle",
     };
+    core.setPeerVisibility(buildVisibilityFilter(readWorkspaceTalkConfig(cwd).allowed, cwd));
     void core.start(self);
   });
 
@@ -205,33 +213,23 @@ export default function talk(pi: ExtensionAPI) {
     name: "talk-list-sessions",
     label: "List Talk Sessions",
     description:
-      "List other pi sessions on this machine with their presence (idle/working/not responding/offline), address, and working directory.",
+      "List other pi sessions with a recent heartbeat (id, status, work_dir, name). Pass includeOffline to also list stale sessions.",
     promptSnippet: "List other pi sessions on this machine",
     parameters: Type.Object({
       cwd: Type.Optional(Type.String({ description: "Only list sessions in this directory" })),
-    }),
-    async execute(_toolCallId, params) {
-      const initError = requireInit();
-      if (initError) return toolResult(initError);
-      return toolResult(params.cwd ? await core.listCwd(params.cwd) : await core.list());
-    },
-  });
-
-  pi.registerTool({
-    name: "talk-read-messages",
-    label: "Read Talk Messages",
-    description:
-      "Read and consume messages from your talk inbox. Use this to actively check for incoming messages instead of waiting for a steer notification.",
-    promptSnippet: "Read incoming talk messages",
-    parameters: Type.Object({
-      from: Type.Optional(
-        Type.String({ description: "Only read messages from this session (name/address/@alias)" }),
+      includeOffline: Type.Optional(
+        Type.Boolean({ description: "Include sessions without a recent heartbeat" }),
       ),
     }),
     async execute(_toolCallId, params) {
       const initError = requireInit();
       if (initError) return toolResult(initError);
-      return toolResult(await core.readMessages(params.from));
+      const includeOffline = params.includeOffline === true;
+      return toolResult(
+        params.cwd
+          ? await core.listCwd(params.cwd, includeOffline)
+          : await core.list(includeOffline),
+      );
     },
   });
 
@@ -303,7 +301,7 @@ export default function talk(pi: ExtensionAPI) {
     name: "talk-reply",
     label: "Reply Talk",
     description:
-      "Reply to a received ask. `replyTo` is the ask/message id (shown in the delivered message, or from talk-read-messages).",
+      "Reply to a received ask. `replyTo` is the ask/message id (shown in the delivered message).",
     promptSnippet: "Reply to a talk ask",
     parameters: Type.Object({
       replyTo: Type.String({ description: "The ask/message id to reply to" }),
@@ -316,7 +314,7 @@ export default function talk(pi: ExtensionAPI) {
     },
   });
 
-  // ── /talk command ─────────────────────────────────────────────────────
+  // ── /talk commands ────────────────────────────────────────────────────
 
   pi.registerCommand("talk", {
     description: "List registered pi sessions",
@@ -326,6 +324,23 @@ export default function talk(pi: ExtensionAPI) {
     },
   });
 
+  pi.registerCommand("talk-dead", {
+    description:
+      "Mark a talk session as dead (removed from listings, swept soon): no arg = this session, <sessionId> = that session, --all = every other visible session",
+    async handler(args) {
+      const initError = requireInit();
+      const trimmed = args.trim();
+      const text =
+        initError ??
+        (trimmed === "--all"
+          ? await core.markAllDead()
+          : trimmed
+            ? await core.markDead(trimmed)
+            : await core.markDead());
+      pi.sendMessage({ customType: LIST_TYPE, content: text, display: true });
+    },
+  });
+
   // ── Delivery card ──────────────────────────────────────────────────────
 
   pi.registerMessageRenderer<DeliveryDetails>(DELIVERY_TYPE, (message, _options, theme) => {

package/src/talk/registry.ts

@@ -38,6 +38,10 @@ export type SessionRecord = Static<typeof SessionRecordSchema>;
 export type Presence = "live" | "stalled" | "offline";
 
 export const HEARTBEAT_STALE_MS = 45_000;
+/** A session is shown in the default listing while its heartbeat is this fresh. */
+export const LIST_ACTIVE_MS = 15 * 60 * 1000;
+/** Sweep leaves a record alone until its heartbeat has been quiet this long. */
+export const SWEEP_OFFLINE_GRACE_MS = 24 * 60 * 60 * 1000;
 /** A mailbox holding undelivered mail is kept this long after last contact. */
 export const SWEEP_MAIL_KEEP_MS = 30 * 24 * 60 * 60 * 1000;
 
@@ -118,29 +122,21 @@ export function presenceOf(record: SessionRecord, now: number = Date.now()): Pre
 
 /**
  * Reclaim dead sessions' data. Rules (mail outranks tidiness):
- * - a running session is never touched;
+ * - a record whose heartbeat went quiet less than SWEEP_OFFLINE_GRACE_MS ago
+ *   is never touched — it may be merely down or suspended, and a resume will
+ *   re-register it under the same id anyway;
  * - a mailbox holding undelivered mail is kept for SWEEP_MAIL_KEEP_MS;
- * - an offline but resumable session keeps its record (its address — new
- *   mail must remain deliverable while it's down);
- * - only an empty mailbox of a session that can no longer be resumed is
- *   discarded promptly.
- *
- * `sessionExists(sessionId)` reports whether pi can still resume the session
- * (its session file is present). When omitted, every offline session is
- * treated as resumable (the conservative choice).
+ * - once the grace period has passed, an empty mailbox is discarded promptly
+ *   regardless of whether pi could still resume the session (resume re-creates
+ *   the record; with no mail nothing is lost).
  */
-export async function sweep(
-  storage: TalkStorage,
-  now: number = Date.now(),
-  sessionExists?: (sessionId: string) => boolean,
-): Promise<void> {
+export async function sweep(storage: TalkStorage, now: number = Date.now()): Promise<void> {
   for (const record of await listRecords(storage)) {
-    if (presenceOf(record, now) !== "offline") continue;
+    const quietFor = now - record.lastSeenAt;
+    if (quietFor < SWEEP_OFFLINE_GRACE_MS) continue;
     const hasMail =
       (await storage.hasKeys(inboxNs(record.addr))) || (await storage.hasKeys(asksNs(record.addr)));
-    const expired = now - record.lastSeenAt >= SWEEP_MAIL_KEEP_MS;
-    if (hasMail && !expired) continue;
-    if (!expired && (sessionExists?.(record.sessionId) ?? true)) continue;
+    if (hasMail && quietFor < SWEEP_MAIL_KEEP_MS) continue;
     await storage.removeNamespace(inboxNs(record.addr));
     await storage.removeNamespace(asksNs(record.addr));
     await storage.removeKey(RECORDS_NS, recordKey(record.addr));