@vanillagreen/pi-claude-bridge 4.0.1 → 4.0.2

package/src/index.ts

@@ -7,8 +7,8 @@ import { PROVIDER_ID, messageContentToText } from "./convert.js";
 import { buildModels, modelDisplayName } from "./models.js";
 import { MCP_SERVER_NAME, MCP_TOOL_PREFIX } from "./skills.js";
 import { extractAllToolResults as _extractAllToolResults, type McpResult } from "./extract-tool-results.js";
-import { QueryContext, ctx, deleteQueryLane, drainPendingToolCalls, drainStrandedToolCalls, popContext, stackDepth, pushContext, summarizeDroppedUserMessages, takeQueuedOrParkedResult, toolCallDrainCause, type DeferredUserMessage } from "./query-state.js";
-import { teardownQuery } from "./query-teardown.js";
+import { QueryContext, ctx, deleteQueryLane, drainPendingToolCalls, drainStrandedToolCalls, popContext, stackDepth, pushContext, summarizeDroppedUserMessages, takeQueuedOrParkedResult, toolCallDrainCause, type DeferredUserMessage, type QueryRestartRequest } from "./query-state.js";
+import { abortSdkQuery, closeSdkQuery, teardownQuery } from "./query-teardown.js";
 import { loadConfig, recordProjectTrust, registerExternalConfigResolver } from "./config.js";
 import { hasClaudeCredentials } from "./auth-presence.js";
 import { NATIVE_PROVIDER_UNSUPPORTED_MESSAGE, buildNativeProvider, supportsNativeProvider } from "./native-provider.js";
@@ -59,6 +59,7 @@ import {
 	type ClaudeAccountRoute,
 } from "./account-router.js";
 import { BRIDGE_ACCOUNT_HOST } from "./account-host.js";
+import { BRIDGE_BILLING_IDENTITY, CLAUDE_BILLING_IDENTITY_SYMBOL, beginBillingIdentityAttempt, deleteBillingIdentityLane } from "./billing-identity.js";
 import { registerBridgeCommands } from "./bridge-commands.js";
 import { consumeQuery, emitRateLimitEvent, type ClaudeAttemptFailure } from "./consume-query.js";
 import { buildClaudeQueryOptions } from "./query-options.js";
@@ -447,6 +448,10 @@ function releaseProviderTokens(event: string): void {
 	if (g[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] === BRIDGE_ACCOUNT_HOST) {
 		g[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] = undefined;
 	}
+	// Billing identity is request-lane state. The shutdown handler removes its
+	// one lane after this call. The process publisher remains available to
+	// sibling sessions and reads the shared lane registry across reloads until a
+	// new primary replaces it.
 	if (g[ACTIVE_STREAM_SIMPLE_KEY] === streamClaudeAgentSdk) {
 		debug(`${event}: clearing ACTIVE_STREAM_SIMPLE_KEY`);
 		g[ACTIVE_STREAM_SIMPLE_KEY] = undefined;
@@ -528,6 +533,59 @@ function applyProviderRegistration(trigger: string): void {
 	}
 }
 
+/** Prompt for the query that replaces one whose Pi history was replaced. Pi's
+ *  whole context becomes imported history — the summary, the retained messages
+ *  and the results of the tool calls that already ran — so the replacement query
+ *  is only told to carry on from it. */
+export const HISTORY_REPLACED_PROMPT = "The conversation above was rewritten by Pi (compaction or history navigation). It is the complete current history, including the results of every tool call that has already run. Continue the turn from there, and do not repeat a tool call whose result is already above.";
+
+/** Pi's new context plus the continuation prompt, so the rebuild imports every
+ *  message Pi holds — trailing tool results included, which keeps each one
+ *  paired with its tool call and present exactly once. */
+function restartContext(request: QueryRestartRequest): Context {
+	return {
+		...request.context,
+		messages: [...request.context.messages, { role: "user", content: HISTORY_REPLACED_PROMPT, timestamp: Date.now() }],
+	};
+}
+
+/** Pi replaced the conversation's history: pi /compact and session-tree
+ *  navigation (rewind / fork-at-point / branch switch) both mutate pi's messages
+ *  array out from under the bridge. syncSharedSession's REUSE check would
+ *  otherwise see slice(cursor) === [] (or skip entries) and keep --resume'ing a
+ *  CC session that does not match pi's history; /compact in particular triggers
+ *  CC's autocompact-thrashing guard. Force the next call down the REBUILD path,
+ *  and mark an ACTIVE query stale so the next provider callback restarts it
+ *  rather than continuing it on history Pi has thrown away.
+ *
+ *  Exported for the compaction-restart unit test; pi.on wires the two events. */
+export function onPiHistoryReplaced(event: string): void {
+	const activeSession = getSharedSession();
+	const queryCtx = ctx();
+	// Whether THIS call requests a restart. A query with no claim on the shared
+	// record — a reentrant subagent, a foreign one-shot — is running its own
+	// conversation, so pi's replacement is not its history and it is never
+	// restarted on it. Read here rather than off piHistoryReplaced below, which
+	// outlives a query that ended without its restart.
+	const running = queryCtx.activeQuery !== null;
+	const restarts = running && !queryCtx.detachedFromSharedSession;
+	if (running) {
+		if (restarts) queryCtx.piHistoryReplaced = true;
+		// A restart re-imports the interrupted calls' results from pi's own
+		// history, so their interruption is expected teardown rather than the
+		// integrity fault an unhandled one reports.
+		reportToolResultMismatch(queryCtx, event, activeSession?.cwd ?? process.cwd(), { expectedInterruption: restarts });
+	}
+	if (activeSession) {
+		debug(`${event}: marking needsRebuild on session ${activeSession.sessionId.slice(0, 8)}`);
+		// A restart kills the child, which goes on flushing its jsonl: rebuilding
+		// in place would race that writer, so the replacement takes a new session
+		// id and leaves the old transcript alone. A compaction that kills nothing
+		// has no writer to race and rebuilds in place.
+		markSessionForRebuild({ forceRotate: restarts });
+	}
+}
+
 /** Provider entry point. Pi calls this for each prompt and each tool result.
  *  Two cases: tool result delivery (active query) or fresh query. Exported for
  *  the rotation-stream unit tests, which drive it with a fake SDK factory. */
@@ -549,6 +607,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 		if (!ephemeralLane) return;
 		deleteSharedSessionLane(laneId);
 		deleteQueryLane(laneId);
+		deleteBillingIdentityLane(laneId);
 	};
 
 	// DEBUG: trace followUp message triggering
@@ -562,6 +621,44 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	// handlers. Results that arrive before their handler get queued in pendingResults.
 	if (ctx().activeQuery) {
 		const queryCtx = ctx();
+		if (queryCtx.piHistoryReplaced) {
+			// Pi compacted or navigated this conversation while the query ran, so the
+			// query's Claude session holds history Pi has replaced. Restart from THIS
+			// context instead of delivering into it: Pi's messages already carry every
+			// tool call Pi executed, so the rebuilt session imports each result once
+			// and no such tool runs again. The dying query's own chain performs the
+			// restart, once teardown has released the query state.
+			//
+			// Except when the CHILD ran a call pi never sees — a claude.ai connector,
+			// or a foreign MCP tool it loaded from filesystem settings. Those calls are
+			// never mirrored into pi's messages and their results are observed at most,
+			// never recorded, so no rebuild from pi's context can carry them. Handing
+			// the replacement a history missing an account-visible call, under a
+			// prompt saying every result is present, invites the model to run it
+			// again. Keep this query on its stale history instead, and keep the
+			// marker set: pi replaced the history whether or not the bridge acts on
+			// it, so the record this query writes as it ends must still say so or the
+			// NEXT turn resumes the history the compaction threw away. Report the
+			// refusal once, not once per remaining tool result.
+			if (queryCtx.childSideCalls.size > 0) {
+				if (!queryCtx.reportedHistoryRestartDecline) {
+					queryCtx.reportedHistoryRestartDecline = true;
+					const names = [...new Set([...queryCtx.childSideCalls.values()].map((call) => call.name))];
+					debug(`provider: pi replaced this query's history, but ${queryCtx.childSideCalls.size} child-executed call(s) are absent from pi's context; not restarting (${names.join(", ")})`);
+					appendIntegrityEntry("history_restart_declined", { reason: "child-executed calls pi's history cannot carry", count: queryCtx.childSideCalls.size, names });
+				}
+			} else {
+				// Consumed: the pending request carries the replacement from here, and
+				// persistSession reads it there.
+				queryCtx.piHistoryReplaced = false;
+				queryCtx.restartRequest = { model, context, options, stream };
+				// Nothing the dying query still emits belongs to the new history.
+				queryCtx.currentPiStream = null;
+				debug(`provider: pi replaced this query's history; restarting from ${context.messages.length} message(s)`);
+				abortSdkQuery(queryCtx.activeQuery);
+				return stream;
+			}
+		}
 		queryCtx.currentPiStream = stream;
 		queryCtx.resetTurnState(model);
 		// A fresh callback separates handlers registered for settled turns from
@@ -715,6 +812,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	}
 
 	// --- Fresh query ---
+	const recordBillingIdentity = beginBillingIdentityAttempt();
 
 	// Fail-fast credential re-check (only for a fresh query — NEVER for
 	// tool-result delivery of an in-flight query, handled above, where creds were
@@ -756,6 +854,9 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	ctx().pendingToolCalls.clear();
 	ctx().pendingResults.clear();
 	ctx().reapedResults.clear();
+	// Teardown flushed the previous query's calls; carrying them into this one
+	// would make it look like it ran child-side calls it never ran.
+	ctx().childSideCalls.clear();
 	ctx().forwardedToolCallIds.clear();
 	ctx().deadToolCallIds.clear();
 	ctx().callbackGeneration = 0;
@@ -764,6 +865,10 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	ctx().resetToolTracking();
 	ctx().latestCursor = 0;
 	ctx().committedOutput = false;
+	// This query is built from the context Pi holds now; only a replacement that
+	// arrives while it runs makes it stale.
+	ctx().piHistoryReplaced = false;
+	ctx().reportedHistoryRestartDecline = false;
 	// A reentrant query never claims the shared record; a foreign-conversation
 	// one-shot joins it below once syncSharedSession has ruled.
 	ctx().detachedFromSharedSession = isReentrant;
@@ -952,6 +1057,9 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 
 	// 3. Start SDK query and claim it for this context
 	let wasAborted = false;
+	// The stream the post-teardown re-entry feeds: an account retry continues this
+	// call's own stream, a history restart the callback stream that requested it.
+	let reentryStream = stream;
 	let streamIdleTimedOut = false;
 	let retryRequested = false;
 	let retryFailure: ClaudeAttemptFailure | undefined;
@@ -969,7 +1077,21 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	// one-shot has exactly the same non-claim on the record.
 	const persistSession = (next: SessionState | null): void => {
 		if (isReentrant || foreignContext) return;
-		setSharedSession(next && conversationFp ? { conversationFingerprint: conversationFp, ...next } : next);
+		// A history replacement pi made while this query ran describes PI's
+		// messages, not this query, so every record the query writes — this
+		// turn's, a terminal failure's, a continuation's — has to keep it.
+		// Dropping it lets the next sync resume history pi has thrown away, or
+		// read the post-compaction context as a foreign conversation and run it
+		// as a historyless one-shot. forceRotate rides along only while a
+		// restart is pending, which is the case where a child was killed and may
+		// still be flushing to the session jsonl.
+		// Observed and not yet acted on, or already consumed into a pending
+		// restart: both mean pi replaced the history after this query started.
+		const restartPending = abortCtx.restartRequest !== null;
+		const replaced = next && (abortCtx.piHistoryReplaced || restartPending)
+			? { ...next, needsRebuild: true, ...(restartPending ? { forceRotate: true } : {}) }
+			: next;
+		setSharedSession(replaced && conversationFp ? { conversationFingerprint: conversationFp, ...replaced } : replaced);
 	};
 	const markRebuildForThisQuery = (opts: { forceRotate?: boolean } = {}): void => {
 		if (isReentrant || foreignContext) return;
@@ -999,13 +1121,6 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 		accountFailureRecorded = true;
 	};
 
-	const requestAbort = () => {
-		// interrupt() asks the CLI to stop gracefully; close() kills it immediately.
-		// Both are needed — interrupt alone lets the current API call finish.
-		void sdkQuery.interrupt().catch(() => {});
-		try { sdkQuery.close(); } catch {}
-	};
-
 	// Decide whether a classified failure may be replayed on the next profile.
 	// Records the failure with the router either way (a post-output failure is
 	// not replayable but the next prompt's routing should still avoid the
@@ -1061,7 +1176,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 				// specifics (needsRebuild/forceRotate, killing the child) stay here;
 				// eligibility and retry bookkeeping are requestRotation's.
 				if (requestRotation(idleFailure)) {
-					requestAbort();
+					abortSdkQuery(sdkQuery);
 					return;
 				}
 				abortCtx.handledTerminalError = true;
@@ -1089,7 +1204,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 				abortCtx.currentPiStream?.push({ type: "error", reason: "error", error: abortCtx.turnOutput! });
 				abortCtx.currentPiStream?.end();
 				abortCtx.currentPiStream = null;
-				requestAbort();
+				abortSdkQuery(sdkQuery);
 			},
 			timeoutMs: streamIdleTimeoutMs,
 		})
@@ -1112,7 +1227,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 		const drained = drainPendingToolCalls(abortCtx, "abort");
 		if (drained > 0) debug(`provider: abort drained ${drained} waiting MCP handler(s) as errors`);
 		abortCtx.pendingResults.clear();
-		requestAbort();
+		abortSdkQuery(sdkQuery);
 	});
 	if (options?.signal) {
 		if (options.signal.aborted) onAbort();
@@ -1153,9 +1268,16 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 	// query CAN end in that window (abort, child process death throwing out of
 	// the generator). Live-ctx handlers there mutated the subagent's turn state
 	// and stream and skipped the parent's own teardown entirely.
-	consumeQuery(sdkQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, account, router, attemptFailure)
+	consumeQuery(sdkQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, recordBillingIdentity, account, router, attemptFailure)
 		.then(async ({ capturedSessionId, failure }) => {
 			debug(`provider: consumeQuery completed, stopReason=${abortCtx.turnOutput?.stopReason}, failure=${failure?.kind ?? "none"}, aborted=${wasAborted}`);
+			if (abortCtx.restartRequest) {
+				// The replacement query owns this turn's outcome. This one must not
+				// surface its interruption, end a stream, or write the record: its
+				// session id and cursor describe history Pi has replaced.
+				debug("provider: query ended for a history restart; leaving the outcome to the replacement query");
+				return;
+			}
 			if (streamIdleTimedOut) {
 				dropDeferredUserMessages("stream-idle-timeout-completion");
 				debug(`provider: stream idle timeout ${retryRequested ? "queued account rotation" : "already surfaced"}; skipping normal completion`);
@@ -1205,6 +1327,7 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 				debug(`provider: query done, session=${sessionId.slice(0, 8)}, cursor=${cursor}, account=${account?.label ?? "legacy"}`);
 				// Fresh record on purpose: a transient mid-turn needsRebuild/forceRotate
 				// must not survive a completed query and force a rebuild next turn.
+				// persistSession re-adds what a pi history replacement requires.
 				persistSession({ sessionId, cursor, cwd, ...accountScope });
 			}
 			// The failure branch above returned, so reaching here means success.
@@ -1241,7 +1364,11 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 					debug(`provider: continuation query, model=${queryModel.id}, resume=${resumeId.slice(0, 8)}, account=${account?.label ?? "legacy"}, prompt=${steerPreview}`);
 
 					try {
-						const continuation = await consumeQuery(contQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, account, router);
+						const continuation = await consumeQuery(contQuery, abortCtx, customToolNameToPi, queryModel, bridgeConfig, () => wasAborted, recordBillingIdentity, account, router);
+						// Superseded: the restart killed this attempt, so its end is not
+						// an outcome to record. The replacement carries the remaining
+						// steers, which pi's history holds and the rebuild imports.
+						if (abortCtx.restartRequest) break;
 						if (continuation.failure) {
 							// Continuations never rotate: the original prompt already
 							// committed on this account.
@@ -1261,6 +1388,10 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 							persistSession({ sessionId: sid, cursor: activeSession?.cursor ?? 0, cwd, ...accountScope });
 						}
 					} catch (contError) {
+						// Killing the child can throw out of its iterator; that is this
+						// restart's own doing, not an attempt failure to charge to the
+						// account or a reason to drop input the rebuild carries.
+						if (abortCtx.restartRequest) break;
 						debug(`provider: continuation query error:`, contError);
 						const continuationFailure: ClaudeAttemptFailure = {
 							kind: classifyClaudeFailure(contError),
@@ -1286,6 +1417,11 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 		})
 		.catch((error) => {
 			debug(`provider: query error, model=${queryModel.id}, aborted=${Boolean(options?.signal?.aborted)}, error=`, error);
+			if (abortCtx.restartRequest) {
+				// Killed for the restart: the replacement query surfaces the outcome.
+				debug("provider: query error while a history restart was pending; suppressed");
+				return;
+			}
 			const suppressDuplicateError = abortCtx.handledTerminalError || (streamIdleTimedOut && !retryRequested);
 			if (wasAborted || options?.signal?.aborted) {
 				markRebuildForThisQuery({ forceRotate: true });
@@ -1321,9 +1457,38 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 			if (options?.signal) options.signal.removeEventListener("abort", onAbort);
 			const cause = toolCallDrainCause({ wasAborted, signalAborted: options?.signal?.aborted, streamIdleTimedOut });
 			teardownQuery(abortCtx, sdkQuery, cause, cwd, isReentrant);
-			sdkQuery.close();
+			closeSdkQuery(sdkQuery);
 		})
 		.then(async () => {
+			// --- History restart re-entry ---
+			// Runs AFTER teardown, like the account retry below: the replacement is
+			// a fresh outermost query over Pi's new context, and its events belong to
+			// the callback that observed the replacement, not to this one.
+			const restart = abortCtx.restartRequest;
+			if (restart) {
+				abortCtx.restartRequest = null;
+				reentryStream = restart.stream;
+				if (wasAborted || options?.signal?.aborted || restart.options?.signal?.aborted) {
+					// The request died between the restart and this teardown: rebuilding
+					// the session and spawning a child the fresh-query path kills on the
+					// same signal buys nothing. Terminate the callback's stream instead.
+					debug("provider: abort before the history restart — terminating the stream without restarting");
+					// A fresh output for THIS message: the restart branch returned before
+					// resetTurnState, so turnOutput is still the message pi already holds
+					// for the pre-compaction turn. Stamping "aborted" onto it would
+					// rewrite a delivered turn whose tools really ran.
+					abortCtx.resetTurnState(restart.model);
+					abortCtx.turnOutput!.stopReason = "aborted";
+					abortCtx.turnOutput!.errorMessage = "Operation aborted";
+					reentryStream.push({ type: "error", reason: "aborted", error: abortCtx.turnOutput! });
+					reentryStream.end();
+					return;
+				}
+				debug(`provider: restarting query on replaced history, ${restart.context.messages.length} pi message(s)`);
+				for await (const event of streamClaudeAgentSdk(restart.model, restartContext(restart), restart.options)) reentryStream.push(event);
+				reentryStream.end();
+				return;
+			}
 			// --- Account retry re-entry ---
 			// Runs AFTER teardown so the failed attempt's query state is fully
 			// released. The recursive call re-enters the fresh-query path with the
@@ -1341,8 +1506,8 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 					abortCtx.turnOutput.stopReason = "aborted";
 					abortCtx.turnOutput.errorMessage = "Operation aborted";
 				}
-				stream.push({ type: "error", reason: "aborted", error: abortCtx.turnOutput! });
-				stream.end();
+				reentryStream.push({ type: "error", reason: "aborted", error: abortCtx.turnOutput! });
+				reentryStream.end();
 				return;
 			}
 			debug(`provider: starting account retry after ${retryFailure?.kind ?? "failure"}; excluded=${[...rotationState.excludedProfileIds].join(",")}`);
@@ -1355,17 +1520,30 @@ function streamClaudeAgentSdkInLane(model: Model<any>, context: Context, options
 			// event — and EventStream.push is a silent no-op after end, so a failed
 			// rotation ended the turn with no error event at all. Success ends
 			// here; every throw ends in the .catch, after the error is pushed.
-			for await (const event of retryStream) stream.push(event);
-			stream.end();
+			for await (const event of retryStream) reentryStream.push(event);
+			reentryStream.end();
 		})
 		.catch((error) => {
-			debug("provider: account retry pipeline failed:", error);
+			debug("provider: re-entry pipeline failed:", error);
+			// A throw BEFORE the re-entry ran — teardown, or closing the stale query
+			// — skips it, leaving reentryStream on this call's own stream, which has
+			// already ended, while pi still waits on the callback stream the restart
+			// was meant to feed. Take that request over so the failure reaches the
+			// stream pi is holding, and clear it so nothing stale outlives this chain.
+			const restart = abortCtx.restartRequest;
+			if (restart) {
+				abortCtx.restartRequest = null;
+				reentryStream = restart.stream;
+				// Same reason as the abort branch above: without a restart this
+				// message would be the delivered pre-compaction turn.
+				abortCtx.resetTurnState(restart.model);
+			}
 			if (abortCtx.turnOutput) {
 				abortCtx.turnOutput.stopReason = "error";
 				abortCtx.turnOutput.errorMessage = error instanceof Error ? error.message : String(error);
 			}
-			stream.push({ type: "error", reason: "error", error: abortCtx.turnOutput! });
-			stream.end();
+			reentryStream.push({ type: "error", reason: "error", error: abortCtx.turnOutput! });
+			reentryStream.end();
 		})
 		// After teardown and any retry pipeline: nothing else reads this lane.
 		.finally(releaseEphemeralLane);
@@ -1397,6 +1575,10 @@ export default function (pi: ExtensionAPI) {
 	if (claimPrimaryInstance()) {
 		const host = globalThis as Record<symbol, any>;
 		host[CLAUDE_BRIDGE_ACCOUNT_HOST_SYMBOL] = BRIDGE_ACCOUNT_HOST;
+		// Published beside it so a reader finds a store that answers "no login
+		// confirmed yet" rather than nothing at all, and so both are owned by
+		// the same instance.
+		host[CLAUDE_BILLING_IDENTITY_SYMBOL] = BRIDGE_BILLING_IDENTITY;
 	}
 
 	// Reset shared (Claude) conversation state on pi session lifecycle events.
@@ -1434,31 +1616,17 @@ export default function (pi: ExtensionAPI) {
 		});
 		deleteSharedSessionLane(sessionId);
 		deleteQueryLane(sessionId);
+		deleteBillingIdentityLane(sessionId);
 	});
 	pi.on("message_end", (event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => {
 		const message = (event as { message?: AssistantMessage }).message;
 		if (message?.role === "assistant" && message.provider === PROVIDER_ID) schedulePersistSharedSession(ctx);
 	}));
 
-	// pi /compact and session-tree navigation (rewind / fork-at-point /
-	// branch switch) both mutate pi's messages array out from under the
-	// bridge. syncSharedSession's REUSE check would otherwise see
-	// slice(cursor) === [] (or skip entries) and keep --resume'ing a CC
-	// session that does not match pi's history. /compact in particular
-		// triggers CC's autocompact-thrashing guard. Force the next
-	// call down the REBUILD path so CC sees the current history.
-	const markRebuild = (event: string) => {
-		const activeSession = getSharedSession();
-		if (ctx().activeQuery) {
-			reportToolResultMismatch(ctx(), event, activeSession?.cwd ?? process.cwd());
-		}
-		if (activeSession) {
-			debug(`${event}: marking needsRebuild on session ${activeSession.sessionId.slice(0, 8)}`);
-			markSessionForRebuild();
-		}
-	};
-	pi.on("session_compact", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => markRebuild("session_compact")));
-	pi.on("session_tree", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => markRebuild("session_tree")));
+	// Both events replace pi's messages array out from under the bridge; see
+	// onPiHistoryReplaced for what that forces.
+	pi.on("session_compact", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => onPiHistoryReplaced("session_compact")));
+	pi.on("session_tree", (_event, ctx) => runInRequestLane(ctx.sessionManager.getSessionId(), () => onPiHistoryReplaced("session_tree")));
 
 	// --- Provider ---
 	//

package/src/native-provider.ts

@@ -60,7 +60,9 @@ export function buildNativeProvider(
 	// passes a probe that also accepts a companion account-router pool.
 	hasCredentials: () => boolean = () => hasClaudeCredentials(env),
 ): unknown {
-	if (!supportsNativeProvider(piAi)) throw new Error(NATIVE_PROVIDER_UNSUPPORTED_MESSAGE);
+	if (!supportsNativeProvider(piAi)) {
+		throw Object.assign(new Error(NATIVE_PROVIDER_UNSUPPORTED_MESSAGE), { code: "CLAUDE_BRIDGE_NATIVE_PROVIDER_UNSUPPORTED" });
+	}
 	// The legacy config path stamped provider/api/baseUrl onto each model during
 	// composition; createProvider passes models through verbatim, so stamp here.
 	// Stamps win over any provider field the source model carries — the models

package/src/query-state.ts

@@ -6,7 +6,7 @@
 // Separate from index.ts so tests can import it without activating the extension.
 
 import type { ContentBlockParam } from "@anthropic-ai/sdk/resources";
-import type { AssistantMessage, AssistantMessageEventStream, Model } from "@earendil-works/pi-ai";
+import type { AssistantMessage, AssistantMessageEventStream, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
 import { isConnectorTool } from "./connectors.js";
 import type { McpResult } from "./extract-tool-results.js";
 import { currentRequestLaneId } from "./request-lane.js";
@@ -33,6 +33,16 @@ export function summarizeDroppedUserMessages(site: string, dropped: DeferredUser
 	};
 }
 
+/** A provider call held to replace a query whose Pi history was replaced while
+ *  it ran: the callback's own model, context, options and stream, so the
+ *  replacement runs under the current request instead of the dead query's. */
+export interface QueryRestartRequest {
+	model: Model<any>;
+	context: Context;
+	options: SimpleStreamOptions | undefined;
+	stream: AssistantMessageEventStream;
+}
+
 export interface PendingToolCall {
 	toolName: string;
 	/** The MCP invocation's schema-validated arguments. The SDK hands the handler
@@ -64,7 +74,7 @@ const DRAIN_CAUSE_TEXT: Record<ToolCallDrainCause, string> = {
 
 export function interruptedToolCallResult(cause: ToolCallDrainCause): McpResult {
 	return {
-		content: [{ type: "text", text: `Claude bridge: ${DRAIN_CAUSE_TEXT[cause]} before this tool call's result was delivered. The call did not complete and produced no output.` }],
+		content: [{ type: "text", text: `tool-call-drain=${cause}\nClaude bridge: ${DRAIN_CAUSE_TEXT[cause]} before this tool call's result was delivered. The call did not complete and produced no output.` }],
 		isError: true,
 	};
 }
@@ -95,7 +105,7 @@ export function drainPendingToolCalls(queryCtx: QueryContext, cause: ToolCallDra
  *  call is guaranteed not to have executed on the Pi side. */
 export function strandedToolCallResult(): McpResult {
 	return {
-		content: [{ type: "text", text: "Claude bridge: this tool call was never forwarded to Pi before its turn ended, so it did not execute and no result can arrive. Re-run the tool." }],
+		content: [{ type: "text", text: "tool-call-stranded=unforwarded\nClaude bridge: this tool call was never forwarded to Pi before its turn ended, so it did not execute and no result can arrive. Re-run the tool." }],
 		isError: true,
 	};
 }
@@ -161,8 +171,14 @@ export function takeQueuedOrParkedResult(queryCtx: QueryContext, id: string): Mc
 /** One connector call's audit state for the life of a query. `recorded` means an
  *  entry for it has already been appended (or attempted), so neither a re-yielded
  *  result nor the teardown flush can record it twice. */
-export interface ConnectorCallAuditState {
+/** Why pi's messages can never carry this call: a claude.ai connector the child
+ *  ran itself, or a foreign MCP tool it loaded from filesystem settings. Only a
+ *  connector backs the connector audit trail. */
+export type ChildSideCallKind = "connector" | "foreign-mcp";
+
+export interface ChildSideCallState {
 	name: string;
+	kind: ChildSideCallKind;
 	/** The child session that issued it, captured when the call was seen — a
 	 *  continuation query gets its own, and a call is audited against the session
 	 *  that actually made it. */
@@ -247,6 +263,22 @@ export class QueryContext {
 	// Query-scoped (fully isolated per query)
 	activeQuery: unknown | null = null;
 	currentPiStream: AssistantMessageEventStream | null = null;
+	/** Pi replaced the history this query's Claude session was built from
+	 *  (compaction, history navigation) while the query was still running.
+	 *  Delivering further tool results into it would keep Claude Code on history
+	 *  Pi no longer holds, so the next provider callback restarts the query from
+	 *  Pi's new context. A query that ENDS while this is set persists its record
+	 *  with needsRebuild, so the next turn rebuilds either way. */
+	piHistoryReplaced = false;
+	/** The handover this replacement asked for was refused, and the refusal is
+	 *  already reported. Every later callback of the query re-reads
+	 *  `piHistoryReplaced`, which stays set, so without this the same refusal
+	 *  would be recorded once per remaining tool result. */
+	reportedHistoryRestartDecline = false;
+	/** The provider callback that observed `piHistoryReplaced`. The dying query's
+	 *  own promise chain runs it, after teardown released the query state, and
+	 *  feeds the replacement query's events into that callback's stream. */
+	restartRequest: QueryRestartRequest | null = null;
 	latestCursor = 0;
 	pendingToolCalls = new Map<string, PendingToolCall>();
 	pendingResults = new Map<string, McpResult>();
@@ -332,14 +364,20 @@ export class QueryContext {
 	/** tool_use id → raw SDK tool name. */
 	childExecutedToolCalls = new Map<string, string>();
 	/**
-	 * The same calls, for the connector-call audit trail (see connector-audit.ts).
+	 * Every call the CHILD executed that pi's messages cannot carry — a claude.ai
+	 * connector, or a foreign MCP tool the child loaded itself — keyed by tool_use
+	 * id. Nothing can rebuild these from pi's context, so a history handover is
+	 * refused while the map is non-empty. Connector entries also back the
+	 * connector-call audit trail (see connector-audit.ts).
 	 *
 	 * Query-scoped and deliberately NOT cleared by resetToolTracking: that runs at
 	 * every child message boundary, and a call issued in one child message is only
 	 * reconciled after that message ends. Clearing it there would make an abandoned
 	 * call unrecordable at teardown — which is the one case the trail exists for.
+	 * Fresh-query setup clears it instead, once teardown has flushed it: a reused
+	 * top-level context would otherwise answer for calls an earlier query made.
 	 */
-	connectorCallAudit = new Map<string, ConnectorCallAuditState>();
+	childSideCalls = new Map<string, ChildSideCallState>();
 	/** Claude Code session id for this query, from the SDK's `system` init message.
 	 *  Undefined until it arrives; the audit trail omits the field rather than
 	 *  guessing. */
@@ -400,7 +438,7 @@ export class QueryContext {
 	turnSawToolCall = false;
 
 	get turnBlocks(): Array<any> {
-		if (!this.turnOutput) throw new Error("turnBlocks accessed before resetTurnState");
+		if (!this.turnOutput) throw new Error("turn-state-uninitialized=turnBlocks\nturnBlocks accessed before resetTurnState");
 		return this.turnOutput.content;
 	}
 
@@ -466,9 +504,10 @@ export class QueryContext {
 			// Both emission paths can see the same call (streamed block, then the
 			// SDK's completed copy), so never overwrite an existing audit state —
 			// that would resurrect one already recorded.
-			if (!this.connectorCallAudit.has(id)) {
-				this.connectorCallAudit.set(id, {
+			if (!this.childSideCalls.has(id)) {
+				this.childSideCalls.set(id, {
 					name: rawName,
+					kind: "connector",
 					...(this.childSessionId ? { childSessionId: this.childSessionId } : {}),
 					recorded: false,
 				});
@@ -477,6 +516,21 @@ export class QueryContext {
 		if (typeof streamIndex === "number") this.childExecutedStreamIndexes.add(streamIndex);
 	}
 
+	/** A foreign MCP tool the child loaded from filesystem settings and ran
+	 *  itself. Pi never sees the call or its result, so it commits the turn the
+	 *  same way a connector does and joins the same map: a rebuild from pi's
+	 *  context would erase an account-visible operation the model could repeat. */
+	noteForeignMcpToolCall(id: string | undefined, rawName: string): void {
+		this.markOutputCommitted();
+		if (!id || this.childSideCalls.has(id)) return;
+		this.childSideCalls.set(id, {
+			name: rawName,
+			kind: "foreign-mcp",
+			...(this.childSessionId ? { childSessionId: this.childSessionId } : {}),
+			recorded: false,
+		});
+	}
+
 	recordToolCall(id: string | undefined, toolName: string, args: Record<string, unknown> = {}): void {
 		if (!id) return;
 		this.queryToolNames.set(id, toolName);
@@ -702,14 +756,14 @@ export function stackDepth(): number { return lane().stack.length; }
 
 export function pushContext(): void {
 	const state = lane();
-	if (!state.current.activeQuery) throw new Error("pushContext() called with no active query");
+	if (!state.current.activeQuery) throw new Error("query-stack-push=inactive\npushContext() called with no active query");
 	state.stack.push(state.current);
 	state.current = new QueryContext();
 }
 
 export function popContext(): void {
 	const state = lane();
-	if (state.stack.length === 0) throw new Error("popContext() called with empty stack");
+	if (state.stack.length === 0) throw new Error("query-stack-pop=empty\npopContext() called with empty stack");
 	const parent = state.stack[state.stack.length - 1];
 	parent.deferredUserMessages.push(...state.current.deferredUserMessages);
 	state.current = state.stack.pop()!;

package/src/query-teardown.ts

@@ -10,6 +10,22 @@ import { flushConnectorCallAudit } from "./connector-audit.js";
 import { debug } from "./debug.js";
 import { drainPendingToolCalls, popContextFor, type QueryContext, type ToolCallDrainCause } from "./query-state.js";
 
+/** Close a settled or dying SDK query. Its transport can throw on the way down
+ *  — a child already gone, a socket already closed — and that throw belongs to
+ *  the query being closed, never to whatever its caller does next. */
+export function closeSdkQuery(sdkQuery: unknown): void {
+	try { (sdkQuery as { close(): void }).close(); }
+	catch (error) { debug("provider: closing the sdk query threw; continuing teardown:", error); }
+}
+
+/** Stop an in-flight SDK query. `interrupt()` asks the CLI to stop gracefully,
+ *  `close()` kills it; both are needed, because interrupt alone lets the current
+ *  API call finish. */
+export function abortSdkQuery(sdkQuery: unknown): void {
+	void (sdkQuery as { interrupt(): Promise<void> }).interrupt().catch(() => {});
+	closeSdkQuery(sdkQuery);
+}
+
 /** Tear down `queryCtx` after its SDK query settled. No-ops when the query is
  *  is not the context's active one (a continuation replaced it, or teardown
  *  already ran). Returns true when teardown actually ran. */