@vanillagreen/pi-claude-bridge 4.0.0 → 4.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vanillagreen/pi-claude-bridge",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "description": "Pi provider bridge that runs Claude Code through the Claude Agent SDK, with opt-in forwarding for Pi prompt context.",
   "type": "module",
   "keywords": [
@@ -133,7 +133,7 @@
     }
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.3.220",
+    "@anthropic-ai/claude-agent-sdk": "^0.3.261",
     "@anthropic-ai/sdk": "^0.112.4",
     "cc-session-io": "^0.3.2",
     "change-case": "^5.4.4"
@@ -145,15 +145,17 @@
   "devDependencies": {
     "@earendil-works/pi-ai": "^0.84.0",
     "@earendil-works/pi-coding-agent": "^0.84.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/node": "^24.3.0",
     "esbuild": "^0.28.0",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3"
   },
   "scripts": {
-    "build": "esbuild src/index.ts --bundle --platform=node --format=esm --target=node22 --outfile=bundle/index.js --external:@earendil-works/pi-ai --external:@earendil-works/pi-coding-agent && esbuild src/connector-inventory.ts --bundle --platform=node --format=esm --target=node22 --outfile=bundle/connector-inventory.js",
+    "build": "esbuild src/index.ts --bundle --preserve-symlinks --platform=node --format=esm --target=node22 --outfile=bundle/index.js --external:@earendil-works/pi-ai --external:@earendil-works/pi-coding-agent && esbuild src/connector-inventory.ts --bundle --preserve-symlinks --platform=node --format=esm --target=node22 --outfile=bundle/connector-inventory.js",
     "prepack": "npm run build",
     "test:unit": "node --import tsx --test tests/unit-*.mjs",
+    "test:ci": "npm run build && npm run test:unit",
     "test": "set -a && [ -f .env.test ] && . ./.env.test; set +a && npm run test:unit && tests/int-smoke.sh && tests/int-multi-turn.sh && tests/int-cache.sh && node --import tsx --test tests/int-*.mjs",
     "test:usage": "tests/usage-test.sh",
     "typecheck": "tsc --noEmit"

package/src/account-router.ts

@@ -4,8 +4,8 @@
 // versioned symbol below to supply a subscription profile for each fresh
 // Claude request. The bridge passes only an opaque profile id, a display
 // label, and an optional CLAUDE_CONFIG_DIR; credentials remain owned by the
-// official Claude CLI. Incompatible future shapes must use a new
-// symbol/version instead of mutating this contract in place.
+// official Claude CLI. An incompatible shape must use a separate
+// symbol or version instead of mutating this contract in place.
 
 import type { AssistantMessageEvent, AssistantMessageEventStream } from "@earendil-works/pi-ai";
 import { homedir } from "node:os";
@@ -48,7 +48,7 @@ export interface ClaudeAccountRouterV1 {
 	recordFailure(profileId: string, kind: ClaudeAccountFailureKind, modelId: string): void;
 	recordSuccess(profileId: string, sessionId?: string): void;
 	current(modelId: string, sessionId?: string): ClaudeAccountRoute | undefined;
-	/** Resolve a previously issued profile id back to its route. The bridge
+	/** Resolve an issued profile id back to its route. The bridge
 	 *  persists ONLY the opaque profile id into Pi session entries (config-dir
 	 *  paths are account-identifying and travel with shared session archives),
 	 *  so restoring a session re-derives the config dir here. A missing router

package/src/assistant-stream.ts

@@ -5,14 +5,14 @@ import { connectorResultByteSize, recordConnectorCallResult } from "./connector-
 import { isChildExecutedTool } from "./connectors.js";
 import { debug, diagDump } from "./debug.js";
 import { ctx, failStrandedToolCall, type QueryContext } from "./query-state.js";
-import { mapToolArgs, mapToolName } from "./tool-mapping.js";
+import { isForeignMcpTool, isPiDispatchable, mapToolArgs, mapToolName } from "./tool-mapping.js";
 
 // --- Usage helpers ---
 
 function updateUsage(output: AssistantMessage, usage: Record<string, number | undefined>, model: Model<any>, c: QueryContext): void {
 	// Anthropic reports per-message counters and RE-reports them as the message
-	// grows, so the in-flight message's figures are replaced, not added. What is
-	// added is every child message already finished in this Pi turn — see
+	// grows, so the in-flight message's figures replace, never accumulate. What
+	// accumulates is every child message already finished in this Pi turn — see
 	// `turnUsageCarry` in query-state.ts for why a turn can span several.
 	const current = c.currentMessageUsage;
 	const carry = c.turnUsageCarry;
@@ -70,25 +70,24 @@ export function finalizeCurrentStream(stopReason?: string, c: QueryContext = ctx
 //
 // The Claude Code CLI dispatches MCP tool calls (and the SDK yields the
 // completed assistant message) BEFORE the stream's message_delta arrives — and
-// message_delta is what carries the message's REAL output-token count (measured:
-// handler invoked ~45ms before message_delta on every tool-use turn). Ending
-// the pi stream at either of those early signals therefore froze usage at the
-// message_start placeholder values, which is why pi sessions recorded 1–7
-// output tokens per tool-use turn while the final text turn recorded hundreds
-// (2026-07-28 token test, both bridge panes).
+// message_delta is what carries the message's REAL output-token count (the
+// handler fires tens of milliseconds ahead of it on every tool-use turn).
+// Ending the pi stream at either of those early signals freezes usage at the
+// message_start placeholder values: a handful of output tokens per tool-use
+// turn while the final text turn records hundreds.
 //
-// So the turn now ends at message_stop, exactly like the streamed-text case,
-// and the early signals only ARM a grace timer. The timer is the deadlock
-// backstop for the one observed case where the terminal events never arrive
-// (pi 0.80 steer draining): pi cannot execute tools before the stream ends, and
-// the MCP handler cannot resolve before pi executes, so a stream that has gone
-// silent must be ended by force — just 1.5s later instead of immediately.
+// So the turn ends at message_stop, exactly like the streamed-text case, and
+// the early signals only ARM a grace timer. The timer is the deadlock backstop
+// for a stream whose terminal events never arrive (pi's steer draining
+// produces one): pi cannot execute tools before the stream ends, and the MCP
+// handler cannot resolve before pi executes, so a stream that has gone silent
+// must be ended by force — TOOL_USE_END_GRACE_MS later instead of immediately.
 
 const TOOL_USE_END_GRACE_MS = 1500;
 
 /** End the current pi stream as a tool_use turn boundary. Safe to call when the
  *  turn already ended (no-op). Every end path funnels here, so this is where
- *  two invariants are enforced by construction (kendex#1469): a block still
+ *  two invariants are enforced by construction: a block still
  *  carrying partialJson never ships — Pi executes the done message's content,
  *  and truncated arguments must never execute — and every call that DOES ship
  *  is stamped forwarded so no lagging replay can dispatch it again. */
@@ -105,7 +104,7 @@ export function endToolUseTurn(c: QueryContext): void {
 	}
 	// Every tool call Pi is about to execute from this turn is owed a result and
 	// must never be dispatched again: a lagging stream replays the same tool_use
-	// into the NEXT turn, whose per-message dedup cannot see it (kendex#1469).
+	// into the NEXT turn, whose per-message dedup cannot see it.
 	for (const block of c.turnOutput.content as Array<{ type?: string; id?: unknown }>) {
 		if (block?.type === "toolCall" && typeof block.id === "string") c.forwardedToolCallIds.add(block.id);
 	}
@@ -146,12 +145,11 @@ export function scheduleToolUseTurnEnd(c: QueryContext, action: () => void, sour
  * Park queued tool results whose handler has not fired by a child message
  * boundary, and say so everywhere it matters. The boundary is where stale
  * entries would start poisoning mismatch reports — but it does NOT prove the
- * handler gave up: the SDK staggers handler invocations, and in the 2026-08-17
- * deadlock session three of five parallel handlers fired after this point
- * (kendex#1469). Parked results stay consumable through
- * takeQueuedOrParkedResult; one that is never consumed belongs to a call the
- * SDK abandoned client-side (permission denial), which is exactly what the
- * notice describes.
+ * handler gave up: the SDK staggers handler invocations, and handlers in a
+ * parallel batch routinely fire after this point. Parked results stay
+ * consumable through takeQueuedOrParkedResult; one that is never consumed
+ * belongs to a call the SDK abandoned client-side (permission denial), which
+ * is exactly what the notice describes.
  */
 export function reapStaleQueuedResults(c: QueryContext): void {
 	const stale = c.takeStaleQueuedResults();
@@ -161,6 +159,7 @@ export function reapStaleQueuedResults(c: QueryContext): void {
 	diagDump("stale_queued_tool_results_parked", { count: stale.length, stale });
 	appendIntegrityEntry("stale_queued_tool_results_parked", { count: stale.length, stale });
 	safeNotify(
+		`queued-results-parked=${JSON.stringify({ count: stale.length, tools: names })}\n` +
 		`Claude bridge: parked ${stale.length} early tool result(s) whose handler has not arrived (${names.slice(0, 6).join(", ")}${names.length > 6 ? ", …" : ""}). ` +
 		`A late handler can still consume them.`,
 		"warning",
@@ -180,14 +179,14 @@ export const FINALIZE_MAX_REARMS = 3;
  *  stream events never arrived (the grace-timer action armed by an MCP handler
  *  invocation — see scheduleToolUseTurnEnd).
  *
- *  Observed with Claude Code under pi 0.80's steer draining (tool result and
- *  drained steer arrive in one provider call): the NEXT tool turn's tool_use
- *  streams in, the SDK invokes the MCP handler — and neither terminal event
- *  ever arrives. The invocation itself proves the assistant turn is committed,
- *  so end the pi stream like the `message_stop` path — with this handler's
- *  schema-validated arguments, never a partial parse — after settling every
- *  sibling whose handler has fired and giving a merely-lagging stream up to
- *  FINALIZE_MAX_REARMS extra grace periods for the rest (kendex#1469).
+ *  The producer is pi's steer draining (tool result and drained steer arrive
+ *  in one provider call): the NEXT tool turn's tool_use streams in, the SDK
+ *  invokes the MCP handler — and neither terminal event ever arrives. The
+ *  invocation itself proves the assistant turn is committed, so end the pi
+ *  stream like the `message_stop` path — with this handler's schema-validated
+ *  arguments, never a partial parse — after settling every sibling whose
+ *  handler has fired and giving a merely-lagging stream up to
+ *  FINALIZE_MAX_REARMS extra grace periods for the rest.
  *
  *  The dead-stream guard is a backstop: the grace timer's own stream-identity
  *  check means this normally never runs after the turn ended. The primary
@@ -204,8 +203,8 @@ export function finalizeToolUseTurnFromMcpInvocation(
 		// The turn ended without this call. An unforwarded handler here can never
 		// be answered — the yield that could have replayed its call was consumed
 		// against a null stream, and the dead-mark below suppresses any replay
-		// that has not happened yet. Failing it now is what turns the observed
-		// multi-hour session deadlock into one retryable error (kendex#1469).
+		// that has not happened yet. Failing it here turns what would be a
+		// session-long deadlock into one retryable error.
 		if (failStrandedToolCall(queryCtx, toolCallId)) {
 			debug(`mcp handler: ${toolName} [${toolCallId}] stranded — turn ended before its call reached Pi; resolved with error`);
 			diagDump("tool_handler_stranded", { toolCallId, toolName, site: "finalize-no-stream" });
@@ -220,9 +219,9 @@ export function finalizeToolUseTurnFromMcpInvocation(
 			// Stream ended before content_block_stop. The SDK invoked this handler
 			// with the COMPLETE schema-validated input, so the handler's copy is
 			// authoritative — the streamed partial JSON is by definition behind it.
-			// Settling from the partial is what forwarded `{}`-argument calls that
-			// Pi then executed and errored (kendex#1469), exactly the divergence
-			// the synthesize branch below never had.
+			// Settling from the partial forwards `{}`-argument calls that Pi then
+			// executes and errors on, a divergence the synthesize branch below
+			// cannot have.
 			block.arguments = mappedArgs;
 			queryCtx.updateToolCallArgs(block.id, block.arguments);
 			delete block.partialJson;
@@ -230,13 +229,13 @@ export function finalizeToolUseTurnFromMcpInvocation(
 			queryCtx.currentPiStream.push({ type: "toolcall_end", contentIndex: idx, toolCall: block, partial: queryCtx.turnOutput });
 		}
 	} else if (queryCtx.forwardedToolCallIds.has(toolCallId) || queryCtx.deadToolCallIds.has(toolCallId)) {
-		// Pi already executed this call in an earlier turn (its result arrives or
-		// sits parked), or the handler was already failed — either way a second
-		// dispatch is the one outcome worse than waiting. Do NOT return: this
-		// firing consumed the stream's only grace timer, so the current turn's own
-		// blocks must still be settled and the turn still ended below, or a turn
-		// that loses its terminal events afterwards has no backstop left and Pi
-		// sits busy until manual abort.
+		// Pi already executed this call in a turn that has ended (its result
+		// arrives or sits parked), or the handler was already failed — either
+		// way a second dispatch is the one outcome worse than waiting. Do NOT
+		// return: this firing consumed the stream's only grace timer, so the
+		// current turn's own blocks must still be settled and the turn still
+		// ended below, or a turn that loses its terminal events afterwards has
+		// no backstop left and Pi sits busy until manual abort.
 		debug(`mcp handler: ${toolName} [${toolCallId}] already ${queryCtx.forwardedToolCallIds.has(toolCallId) ? "forwarded" : "dead"} — not re-emitting`);
 	} else {
 		// The invocation can arrive before the tool_use is streamed at all
@@ -314,13 +313,14 @@ export function processStreamEvent(
 	}
 
 	if (event?.type === "message_start") {
-		// The child moving to a new message proves every result for the previous
-		// one reached it; anything still queued can never be consumed.
+		// The child moving on to another message is where a still-queued result
+		// would start poisoning mismatch reports: park it, consumable by a late
+		// handler (see reapStaleQueuedResults).
 		reapStaleQueuedResults(c);
 		c.resetToolTracking();
-		// A new child message begins: bank what the previous one billed before its
-		// counters are replaced. No-op on the turn's first, and no-op if this same
-		// message was already declared (see beginChildMessage).
+		// Another child message begins: bank what the previous one billed before
+		// its counters are replaced. No-op on the turn's first, and no-op if this
+		// same message was already declared (see beginChildMessage).
 		c.beginChildMessage(event.message?.id);
 		updateTurnOutputModel(event.message?.model, c);
 		if (event.message?.usage) updateUsage(c.turnOutput, event.message.usage, model, c);
@@ -330,7 +330,7 @@ export function processStreamEvent(
 	if (event?.type === "content_block_start") {
 		c.turnSawStreamEvent = true;
 		ensureTurnStarted(c);
-		// A new block owns this index from here on, so release any child-executed
+		// This block owns its index from here on, so release any child-executed
 		// or suppressed claim on it. Belt-and-braces against a missed
 		// message_start: without this a stale index could silently swallow a later
 		// text block's deltas.
@@ -344,6 +344,12 @@ export function processStreamEvent(
 			debug(`processStreamEvent: child-executed tool ${event.content_block.name} [${event.content_block.id}] — not mirrored as a Pi tool call`);
 			return;
 		}
+		if (event.content_block?.type === "tool_use" && !isPiDispatchable(event.content_block.name, customToolNameToPi)) {
+			c.suppressedStreamIndexes.add(event.index);
+			if (isForeignMcpTool(event.content_block.name)) c.noteForeignMcpToolCall(event.content_block.id, event.content_block.name);
+			debug(`processStreamEvent: non-dispatchable tool ${event.content_block.name} [${event.content_block.id}] — not mirrored as a Pi tool call`);
+			return;
+		}
 		if (event.content_block?.type === "text") {
 			c.turnBlocks.push({ type: "text", text: "", index: event.index });
 			c.currentPiStream!.push({ type: "text_start", contentIndex: c.turnBlocks.length - 1, partial: c.turnOutput });
@@ -355,7 +361,7 @@ export function processStreamEvent(
 			if (typeof streamedId === "string" && (c.forwardedToolCallIds.has(streamedId) || c.deadToolCallIds.has(streamedId))) {
 				// A lagging stream replaying a call Pi already executed — or one whose
 				// handler was already failed as stranded — into a later turn. Mirroring
-				// it would make Pi dispatch it a second time (kendex#1469).
+				// it would make Pi dispatch it a second time.
 				c.suppressedStreamIndexes.add(event.index);
 				debug(`processStreamEvent: tool_use ${streamedId} already ${c.forwardedToolCallIds.has(streamedId) ? "forwarded" : "dead"} — suppressing duplicate stream block`);
 				return;
@@ -364,7 +370,7 @@ export function processStreamEvent(
 				// Same turn, same id: the completed-message yield beat the stream (its
 				// block is already recorded with complete arguments). A second
 				// partialJson copy would ship the id twice in one done message — and
-				// if its stop never arrives, ship it truncated (kendex#1469).
+				// if its stop never arrives, ship it truncated.
 				c.suppressedStreamIndexes.add(event.index);
 				debug(`processStreamEvent: tool_use ${streamedId} already recorded in this turn — suppressing duplicate stream block`);
 				return;
@@ -494,7 +500,7 @@ function appendMissingToolUsesFromAssistant(
 	// array of a turnOutput that endToolUseTurn already handed Pi BY REFERENCE
 	// in its done event, so a push here appends calls into a delivered message
 	// behind Pi's back — whether Pi's dispatch enumerates before or after the
-	// push is a microtask race (kendex#1469).
+	// push is a microtask race.
 	const streamLive = Boolean(c.currentPiStream && c.turnOutput);
 	let sawToolUse = false;
 	for (const block of assistantMsg.content) {
@@ -507,11 +513,16 @@ function appendMissingToolUsesFromAssistant(
 			debug(`assistant message: child-executed tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
 			continue;
 		}
+		if (!isPiDispatchable(block.name, customToolNameToPi)) {
+			if (isForeignMcpTool(block.name)) c.noteForeignMcpToolCall(block.id, block.name);
+			debug(`assistant message: non-dispatchable tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
+			continue;
+		}
 		const existingIdx = c.turnBlocks.findIndex((b: any) => b.type === "toolCall" && b.id === block.id);
 		if (existingIdx < 0 && (c.forwardedToolCallIds.has(block.id) || c.deadToolCallIds.has(block.id))) {
-			// Completed-message replay of a call Pi already executed in an earlier
-			// turn (or one already failed as stranded). Not a live Pi turn boundary:
-			// sawToolUse stays false for it, and no block is emitted (kendex#1469).
+			// Completed-message replay of a call Pi already executed in a turn that
+			// has ended (or one already failed as stranded). Not a live Pi turn
+			// boundary: sawToolUse stays false for it, and no block is emitted.
 			debug(`assistant message: tool_use ${block.id} already ${c.forwardedToolCallIds.has(block.id) ? "forwarded" : "dead"} — skipping duplicate`);
 			continue;
 		}
@@ -545,9 +556,9 @@ function appendMissingToolUsesFromAssistant(
 		c.currentPiStream?.push({ type: "toolcall_end", contentIndex: idx, toolCall: toolBlock as any, partial: c.turnOutput });
 	}
 	// Only while the stream is still live: the SDK's assistant yields carry the
-	// message_start placeholder usage (output ≈ 1–7), and once the done event has
-	// delivered turnOutput to pi, overwriting its usage with those placeholders
-	// would corrupt the very figure message_delta got right.
+	// message_start placeholder usage, and once the done event has delivered
+	// turnOutput to pi, overwriting its usage with those placeholders would
+	// corrupt the very figure message_delta got right.
 	if (assistantMsg.usage && c.turnOutput && c.currentPiStream) updateUsage(c.turnOutput, assistantMsg.usage, model, c);
 	return sawToolUse;
 }
@@ -592,14 +603,14 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	updateTurnOutputModel(assistantMsg.model, c);
 	if (c.turnSawStreamEvent) {
 		// The SDK yields the completed assistant message BEFORE the stream's
-		// message_delta/message_stop on every tool-use turn (measured — this is
-		// the norm, not a fallback). Record any tool_use blocks the stream hasn't
-		// delivered yet, but do NOT end the pi stream here: message_delta, which
-		// arrives tens of ms later, carries the message's real output-token count,
-		// and message_stop is the normal turn end. Ending here froze usage at the
-		// message_start placeholders (1–7 output tokens per tool turn). The grace
-		// timer force-ends the turn if the terminal events never arrive, so pi
-		// still gets to execute the tools and unblock the MCP handlers.
+		// message_delta/message_stop on every tool-use turn (the norm, not a
+		// fallback). Record any tool_use blocks the stream hasn't delivered yet,
+		// but do NOT end the pi stream here: message_delta, which arrives tens of
+		// ms later, carries the message's real output-token count, and
+		// message_stop is the normal turn end. Ending here freezes usage at the
+		// message_start placeholders. The grace timer force-ends the turn if the
+		// terminal events never arrive, so pi still gets to execute the tools and
+		// unblock the MCP handlers.
 		if (appendMissingToolUsesFromAssistant(assistantMsg, model, customToolNameToPi, c)) {
 			c.turnSawToolCall = true;
 			scheduleToolUseTurnEnd(c, () => endToolUseTurn(c), "assistant-boundary");
@@ -609,11 +620,11 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	// The SDK yields the SAME assistant message more than once (per-block
 	// partial copies and the completed message share one id). With stream
 	// events, the streamed path already renders content and the duplicates are
-	// naturally ignored; on this no-stream-events path each yield used to be
-	// re-rendered wholesale — a rate-limited turn printed "You've hit your
-	// weekly limit" twice. Same-message yields keep the turn's tracking (a
-	// reset mid-message would wipe live tool-claim state) and render only
-	// blocks not already rendered.
+	// naturally ignored; on this no-stream-events path, re-rendering each
+	// yield wholesale prints a rate-limited turn's "You've hit your weekly
+	// limit" twice. Same-message yields keep the turn's tracking (a reset
+	// mid-message would wipe live tool-claim state) and render only blocks not
+	// already rendered.
 	const sameMessage = typeof assistantMsg.id === "string" && assistantMsg.id.length > 0 && assistantMsg.id === c.currentMessageId;
 	if (!sameMessage) {
 		reapStaleQueuedResults(c);
@@ -627,9 +638,9 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 	debug(`processAssistantMessage fallback: ${assistantMsg.content.length} blocks, types=${assistantMsg.content.map((b: any) => b.type).join(",")}${sameMessage ? " (same message re-yield)" : ""}`);
 	// Deduped against the WHOLE current turn, not just same-id re-yields: a
 	// rejected turn's synthesized error message ("You've hit your weekly limit")
-	// arrives as multiple assistant yields whose ids DIFFER or are absent
-	// (measured 2026-07-28: one pi message, two byte-identical text blocks), so
-	// an id-keyed guard alone still rendered it twice. A model legitimately
+	// arrives as multiple assistant yields whose ids DIFFER or are absent (one
+	// pi message, two byte-identical text blocks), so an id-keyed guard alone
+	// still renders it twice. A model legitimately
 	// producing two byte-identical full blocks in one turn is vanishingly rare;
 	// rendering such a duplicate once is the better failure mode.
 	const alreadyRendered = (type: string, content: string): boolean =>
@@ -659,14 +670,19 @@ export function processAssistantMessage(message: SDKMessage, model: Model<any>,
 				debug(`processAssistantMessage fallback: child-executed tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
 				continue;
 			}
+			if (!isPiDispatchable(block.name, customToolNameToPi)) {
+				if (isForeignMcpTool(block.name)) c.noteForeignMcpToolCall(block.id, block.name);
+				debug(`processAssistantMessage fallback: non-dispatchable tool ${block.name} [${block.id}] — not mirrored as a Pi tool call`);
+				continue;
+			}
 			if (!c.turnBlocks.some((b: any) => b.type === "toolCall" && b.id === block.id)
 				&& (c.forwardedToolCallIds.has(block.id) || c.deadToolCallIds.has(block.id))) {
 				// A cross-turn replay of a call Pi already executed (or one whose
-				// handler was already failed as stranded). This exact path produced
-				// the observed duplicate dispatches: the completed-message yield lands
-				// in the callback AFTER a grace finalize already ended the call's
-				// turn, and per-message dedup cannot see across turns (kendex#1469).
-				// Not recorded either — a forwarded call must not be claimable again.
+				// handler was already failed as stranded). This is the path a
+				// duplicate dispatch takes: the completed-message yield lands in the
+				// callback AFTER a grace finalize already ended the call's turn, and
+				// per-message dedup cannot see across turns. Not recorded either — a
+				// forwarded call must not be claimable again.
 				debug(`processAssistantMessage fallback: tool_use ${block.id} already ${c.forwardedToolCallIds.has(block.id) ? "forwarded" : "dead"} — skipping duplicate`);
 				continue;
 			}

package/src/auth-presence.ts

@@ -85,7 +85,7 @@ function hasApiKeyHelper(configDir: string): boolean {
  * Keychain, NOT in `.credentials.json`, so file-absence is NOT evidence of
  * logged-out and we cannot cheaply/safely probe the Keychain here. On darwin,
  * when no other signal is present, we default to credentialed=true — preserving
- * the pre-fix "always available" behavior for Mac subscription users. Honesty
+ * an "always available" result for Mac subscription users. Honesty
  * enforcement therefore applies on Linux/Windows, where `.credentials.json`
  * existence is an observable, truthful proxy (empirically, `claude auth logout`
  * unlinks it).
@@ -111,4 +111,3 @@ export function hasClaudeCredentials(
 
 	return false;
 }
-

package/src/billing-identity.ts

@@ -0,0 +1,116 @@
+// The Anthropic login the bridge's child query actually authenticated as,
+// published for other extensions to read.
+//
+// WHY a published surface rather than letting a reader resolve
+// CLAUDE_CONFIG_DIR for itself: that directory names the login only when the
+// child used one. The bridge also accepts an API key and the Bedrock, Vertex,
+// Foundry, Anthropic-AWS and Mantle backends (auth-presence.ts), and it passes
+// those environment values straight to the child (query-options.ts). A
+// companion account router may additionally hand each request its own profile
+// and rotate it while the process environment never changes
+// (account-router.ts). Only the SDK's own accountInfo() names the identity a
+// request ran under, so the rule for reading it lives here once instead of in
+// every consumer.
+//
+// SECURITY: this module holds one email per live request lane in memory and
+// never logs it.
+
+import type { AccountInfo } from "@anthropic-ai/claude-agent-sdk";
+import { currentRequestLaneId } from "./request-lane.js";
+
+export const CLAUDE_BILLING_IDENTITY_SYMBOL = Symbol.for("kendex.pi.claude-bridge.billing-identity.v1");
+
+/** Anthropic's own login backend. Every other `apiProvider` value is an
+ *  external credential whose payer this bridge cannot name. */
+const FIRST_PARTY = "firstParty";
+
+export interface ClaudeBillingIdentityV1 {
+	version: 1;
+	/** The Anthropic login email of the latest child attempt in `sessionId`, or
+	 *  undefined when that attempt authenticated with an API key or a
+	 *  third-party backend, has not reported yet, or its probe failed. A
+	 *  consumer passes the visible Pi session id, displays the result, and
+	 *  derives nothing further. */
+	currentLoginEmail(sessionId: string | undefined): string | undefined;
+}
+
+interface BillingIdentityStore extends ClaudeBillingIdentityV1 {
+	beginAttempt(sessionId: string | undefined): (info: AccountInfo) => void;
+	deleteLane(sessionId: string | undefined): void;
+	clear(): void;
+}
+
+interface BillingIdentityLane {
+	attempt: symbol;
+	loginEmail?: string;
+}
+
+const BILLING_IDENTITY_LANES_SYMBOL = Symbol.for("kendex.pi.claude-bridge.billing-identity-lanes.v1");
+
+function sharedBillingIdentityLanes(): Map<string | undefined, BillingIdentityLane> {
+	const host = globalThis as Record<symbol, unknown>;
+	let lanes = host[BILLING_IDENTITY_LANES_SYMBOL] as Map<string | undefined, BillingIdentityLane> | undefined;
+	if (!lanes) {
+		lanes = new Map();
+		host[BILLING_IDENTITY_LANES_SYMBOL] = lanes;
+	}
+	return lanes;
+}
+
+function nonEmpty(value: string | undefined): string | undefined {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+
+/** The login email an `accountInfo()` result confirms, or undefined when it
+ *  confirms none. An API key is rejected even under the first-party backend:
+ *  the key's owner is not the signed-in login, and `apiKeySource` is how the
+ *  SDK reports that a key was used. */
+export function loginEmailFrom(info: AccountInfo): string | undefined {
+	if (info.apiProvider !== FIRST_PARTY) return undefined;
+	if (nonEmpty(info.apiKeySource)) return undefined;
+	return nonEmpty(info.email);
+}
+
+export function makeBillingIdentityStore(
+	lanes: Map<string | undefined, BillingIdentityLane> = new Map(),
+): BillingIdentityStore {
+	return {
+		version: 1,
+		currentLoginEmail: (sessionId) => lanes.get(sessionId)?.loginEmail,
+		beginAttempt: (sessionId) => {
+			const attempt = Symbol("billing-identity-attempt");
+			lanes.set(sessionId, { attempt });
+			return (info) => {
+				const current = lanes.get(sessionId);
+				if (current?.attempt !== attempt) return;
+				lanes.set(sessionId, { attempt, loginEmail: loginEmailFrom(info) });
+			};
+		},
+		deleteLane: (sessionId) => lanes.delete(sessionId),
+		clear: () => lanes.clear(),
+	};
+}
+
+export const BRIDGE_BILLING_IDENTITY = makeBillingIdentityStore(sharedBillingIdentityLanes());
+
+/** Start the billing probe for the current request lane. Starting clears that
+ *  lane, so a rejected probe cannot leave the previous attempt's identity.
+ *  The returned recorder ignores an older probe that settles after a newer
+ *  attempt in the same lane. */
+export function beginBillingIdentityAttempt(): (info: AccountInfo) => void {
+	return BRIDGE_BILLING_IDENTITY.beginAttempt(currentRequestLaneId());
+}
+
+/** Remove one completed Pi session without changing concurrent sessions. */
+export function deleteBillingIdentityLane(sessionId: string | undefined): void {
+	BRIDGE_BILLING_IDENTITY.deleteLane(sessionId);
+}
+
+/** Read the published store, or undefined when no bridge is loaded. Never
+ *  installs one: a consumer that created its own would answer for a bridge
+ *  that is not running. */
+export function resolveClaudeBillingIdentity(): ClaudeBillingIdentityV1 | undefined {
+	const host = globalThis as unknown as Record<PropertyKey, unknown>;
+	const candidate = host[CLAUDE_BILLING_IDENTITY_SYMBOL] as ClaudeBillingIdentityV1 | undefined;
+	return candidate?.version === 1 && typeof candidate.currentLoginEmail === "function" ? candidate : undefined;
+}

package/src/bridge-commands.ts

@@ -35,7 +35,7 @@ function showBridgeStatus(ctx: { ui: ExtensionUIContext; cwd?: string }): void {
 	].join("\n"), "info");
 }
 
-// Deterministic connector enumeration for the host app (kendex#838). Reports the
+// Deterministic connector enumeration for the host app. Reports the
 // failure reason rather than an empty list, so "no connectors" and "could not
 // check" stay distinguishable.
 async function reportConnectorInventory(ctx: {

package/src/bridge-state.ts

@@ -1,5 +1,5 @@
 import { type ExtensionAPI, type ExtensionUIContext } from "@earendil-works/pi-coding-agent";
-import { debug, diagDump, diagGuidance } from "./debug.js";
+import { DEBUG, debug, diagDump, diagGuidance, diagLogPath } from "./debug.js";
 import { type QueryContext } from "./query-state.js";
 import { currentRequestLaneId } from "./request-lane.js";
 import { summarizeMissingToolNames, type MissingToolResult } from "./tool-pairing-audit.js";
@@ -23,7 +23,7 @@ export interface SessionState {
 	// never rewrite those opening messages — compact/tree-nav mutations set
 	// needsRebuild instead — so a component mismatch marks a FOREIGN
 	// conversation (a subagent-shaped query arriving while the parent is idle,
-	// kendex#1001) that must run as a clean one-shot without touching this
+	//) that must run as a clean one-shot without touching this
 	// record. The user component must always match; the assistant component is
 	// compared only when BOTH sides carry one, so a record stamped on turn 1
 	// (no assistant yet) still matches its own grown conversation and upgrades
@@ -35,14 +35,16 @@ export interface SessionState {
 	// navigation) or after an abort left the JSONL in an indeterminate state.
 	// REBUILD wipes and rewrites the file to match pi's current history.
 	needsRebuild?: boolean;
-	// Set ONLY after an abort. The killed CC subprocess may still be flushing
-	// a late "[Request interrupted by user]" record to the session JSONL.
+	// Set whenever a CC subprocess was killed and may still be flushing to its
+	// session JSONL: after an abort, whose late "[Request interrupted by user]"
+	// record is the classic case, and at a history replacement (compact, tree
+	// navigation) that stops an ACTIVE query to restart it on pi's new context.
 	// Reusing the same sessionId/path would race that orphan write into our
 	// fresh file and break CC's parent-uuid chain on the next resume. When
 	// this flag is set, REBUILD takes a fresh UUID and skips deleteSession
-	// so the orphan writes land on a dead inode. Compact/tree do NOT set
-	// this — there's no concurrent CC writer during those events, so
-	// in-place rebuild (preserve UUID, deleteSession + createSession) is safe.
+	// so the orphan writes land on a dead inode. A compact or tree event with
+	// no active query kills nothing, so it leaves this unset and rebuilds in
+	// place (preserve UUID, deleteSession + createSession).
 	forceRotate?: boolean;
 }
 
@@ -169,10 +171,9 @@ export const INTEGRITY_CUSTOM_TYPE = "claude-bridge-integrity";
 /**
  * Persist a bridge integrity event into the pi session transcript.
  *
- * The diag log and a piUI toast both die with the machine or the render cycle:
- * the 2026-07-28 post-mortem found `Error: Claude bridge: …` messages that were
- * SHOWN but existed nowhere in the pi session file, making analysis from the
- * session alone impossible. A `CustomEntry` closes that gap the same way the
+ * The diag log and a piUI toast both die with the machine or render cycle, so
+ * they cannot support analysis from the session alone. A `CustomEntry` persists
+ * the record in the same way the
  * connector-call audit does — persisted, never part of built context, never
  * dispatchable by pi's agent loop. Payloads must stay compact metadata (ids,
  * counts, tool names), never tool output.
@@ -242,7 +243,7 @@ export function reportToolResultMismatch(
 		queryCtx.reportedToolResultMismatch = true;
 		// The single choke point every mismatch path funnels through (abort,
 		// unmatched result, stream-idle, teardown). A context with no claim on
-		// the shared record (reentrant subagent or foreign one-shot, kendex#1001)
+		// the shared record (reentrant subagent or foreign one-shot,)
 		// still gets the full diagnostics below, but its unresolved tool state is
 		// its own — marking the PARENT's record needsRebuild/forceRotate here
 		// would flush the parent's prompt cache for a query that never touched
@@ -285,6 +286,7 @@ export function reportToolResultMismatch(
 			unmatchedResultIds: progress.unmatchedResultIds,
 		});
 		safeNotify(
+			`tool-result-mismatch=${JSON.stringify({ delivered: progress.deliveredCount, expected: progress.expectedCount, resolved: progress.resolvedCount, diagnostic: DEBUG ? diagLogPath() : "CLAUDE_BRIDGE_DEBUG=1" })}\n` +
 			`Claude bridge: tool result delivery interrupted during ${reason}; ` +
 			`delivered ${progress.deliveredCount}/${progress.expectedCount}, resolved ${progress.resolvedCount}/${progress.expectedCount}, ` +
 			`waiting=${progress.waitingCount}, queued=${progress.queuedCount}, unmatched=${progress.unmatchedResultCount}` +