@yefengr/pi-reach 0.0.0-stage → 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jacob Moura
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,107 @@
-# Temporary Holding Version
+<h1 align="center">Pi Reach</h1>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+> A Pi Extension for controlling the current Pi process from the browser through a Relay.
+
+`/pi-reach` connects the current Pi process to a Relay, supports Owner pairing, and exposes the live timeline plus typed session actions to the Pi Reach PWA.
+
+## Endpoint model
+
+```text
+device -> endpoint -> runtime -> session / history generation
+```
+
+- **Device**: the computer's Ed25519 identity.
+- **Endpoint and runtime**: generated randomly when a Pi process loads the Extension. They remain stable across Extension reloads in that process and are regenerated for the next Pi process.
+- **Session / generation**: the active Pi conversation and its current history branch. Pi Reach does not list or resume historical sessions.
+
+The endpoint never derives from the working directory. Pairing QR codes target the current endpoint and runtime, while the resulting Owner authorization is stored at device scope. Later Pi processes on that computer are discovered without pairing again.
+
+## Quick start
+
+Install the Extension once:
+
+```bash
+pi install npm:@yefengr/pi-reach
+```
+
+Open Pi in the project you want to control. When the session starts, the Extension automatically connects to the configured Relay. Pair the browser device from Pi:
+
+```text
+/pi-reach pair
+```
+
+Scan the code in your deployed [Pi Reach PWA](../pwa/README.md) at `/app`, select the endpoint card, and send a prompt. Pairings are local to the computer that creates them:
+
+```text
+/pi-reach devices
+/pi-reach revoke <shortid>
+```
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `/pi-reach` | Connect the current Pi endpoint after it was stopped |
+| `/pi-reach start` / `/pi-reach stop` | Connect or disconnect this endpoint |
+| `/pi-reach status` | Show Relay, endpoint, runtime, and Owner state |
+| `/pi-reach pair` | Show an endpoint-aware pairing QR |
+| `/pi-reach devices` | List locally paired Owners |
+| `/pi-reach revoke <shortid>` | Revoke one locally stored Owner |
+| `/pi-reach set-relay <url>` | Persist the Relay URL |
+| `/pi-reach config` | Show the resolved Relay URL |
+
+The Extension handles remote `session_new` requests in-process through Pi's session API. There is no standalone `pi-reach` CLI, background process, scheduler, or service installation command.
+
+## Relay configuration
+
+The effective Relay URL resolves in this order:
+
+1. `PI_REACH_RELAY`
+2. `~/.pi/pi-reach/config.json`
+3. `https://pi-reach-relay.yefengr.cn`
+
+Set and inspect it from Pi:
+
+```text
+/pi-reach set-relay https://relay.example.com
+/pi-reach config
+```
+
+Only `http://` and `https://` are accepted at the command boundary; WebSocket conversion happens inside the Extension. The Relay forwards opaque payloads and retains endpoint routing state in memory.
+
+## Pairing and security
+
+- `device_id` is the Host Ed25519 public key in canonical Base64 form.
+- Owner messages are trusted only through the Relay-injected `source_owner_id`.
+- Pairing and revocation update the Relay endpoint ACL with `authorized_owner_ids`.
+- Relay loss enters reconnecting state; the Extension does not restart Pi to recover.
+- Device private keys, pairing tokens, encrypted payloads, and message bodies are not logged.
+- Concurrent Pi processes coordinate device identity initialization through a local lock. If initialization is interrupted, follow the [identity storage and lock recovery rules](../docs/reference/protocol/pairing.md#host); do not delete identity or pairing data to retry.
+
+## Local state
+
+Pi Reach stores global configuration, identity files, and pairings under `~/.pi/pi-reach`, and project display configuration under `.pi/pi-reach`. Its platform keyring service is `dev.pireach.pi`.
+
+## Development
+
+Install dependencies from the repository root with `pnpm install --frozen-lockfile`.
+The root workspace owns dependency catalogs, build approvals, and the lockfile. The private workspace package [`@pi-reach/protocol`](../packages/protocol/) provides the shared protocol build artifacts; the Extension uses it as a development dependency, while installed users receive vendored artifacts and need neither the workspace nor a separately published shared package. Its module and distribution boundary is defined in [ARCHITECTURE](../docs/ARCHITECTURE.md#工程与构建边界).
+
+The root `prepare` script and an Extension `pnpm build` build the shared package first. After changing shared sources, run `pnpm --filter @pi-reach/protocol build` from the repository root before an Extension-only `typecheck` or `test`, or use the corresponding root command.
+
+Run these commands from `pi-extension/`, or use the `@yefengr/pi-reach` package filter:
+
+```bash
+pnpm typecheck
+pnpm test
+pnpm build
+```
+
+The development toolchain is pinned by the root configuration. The published
+extension retains its Node 20+ runtime requirement. TypeScript ESM imports must
+use `.js` extensions. `prepack` builds before packaging; `pnpm pack` resolves
+catalog and workspace references, and `publish-npm.sh` uploads the inspected tarball.
+
+## License
+
+MIT

package/dist/actions/handlers.d.ts

@@ -0,0 +1,143 @@
+/**
+ * Plan/28 Wave B — typed action handlers.
+ *
+ * Each handler maps one `ClientMessage` action to a public Pi SDK call,
+ * and replies with `action_ok` or `action_error`. Handlers take their
+ * dependencies as parameters so the index.ts wiring is one-liner and
+ * unit tests can pass fakes without touching global state.
+ *
+ * `models_list` lives next door because it shares the `ModelRegistry`
+ * helper and the same wire vocabulary.
+ *
+ * SDK API surface used (see plan/28 Wave 0 for the full table):
+ *
+ *   - `ctx.compact()`            — non-blocking, fires `session_compact`
+ *                                  event when done
+ *   - `ctx.newSession()`         — only on `ExtensionCommandContext`;
+ *                                  resolves with `{cancelled}` flag
+ *   - `pi.setModel(model)`       — returns `false` if no auth configured
+ *   - `pi.setThinkingLevel(lvl)` — synchronous
+ *   - `ctx.getModel()`           — optional, undefined before first turn
+ *   - `ModelRegistry.{refresh,getAvailable,find}` — see `registry.ts`
+ */
+import type { ClientMessage, ServerMessage, WireModel } from "../protocol/types.js";
+/**
+ * Structural subset of the SDK's `Model<Api>` interface (defined in
+ * `@earendil-works/pi-ai`, which is a transitive dep — not re-exported by
+ * `@earendil-works/pi-coding-agent`'s main entry). Capturing just the
+ * fields we touch keeps the handler decoupled from the SDK's full Model
+ * surface and avoids a direct dep on `pi-ai`.
+ */
+export interface SdkModelLike {
+    id: string;
+    name: string;
+    provider: string;
+    reasoning: boolean;
+    contextWindow: number;
+    /** Plan/30: accepted input modalities. The SDK's `Model.input` is
+     *  `("text" | "image")[]`; we read `includes("image")` for the `vision`
+     *  flag. Optional here so tests can omit it (treated as text-only). */
+    input?: ("text" | "image")[];
+}
+type Model<_TApi = unknown> = SdkModelLike;
+/** Identity used when a full SDK model object is unavailable. */
+export interface CurrentModelRef {
+    provider: string;
+    id: string;
+}
+/** Legacy labels remain accepted for callers that predate structured identity. */
+export type CurrentModelHint = Model<any> | CurrentModelRef | string;
+/**
+ * Minimal channel surface needed to reply. Mirrors `PlainPeerChannel`'s
+ * `.send` signature; tests pass an array-backed fake.
+ */
+export interface ActionReplySender {
+    send(msg: ServerMessage): void;
+}
+/**
+ * Narrow shape of the `ExtensionAPI` surface action handlers actually
+ * call. Lets the test layer stub just these without rebuilding the full
+ * SDK type (which has 30+ methods we don't use here).
+ */
+export interface ActionPi {
+    setModel(model: Model<any>): Promise<boolean>;
+    setThinkingLevel(level: import("../protocol/types.js").ThinkingLevel): void;
+}
+/**
+ * Narrow shape of the per-call context. Drawn from the union of
+ * `ExtensionContextActions` (compact, getModel) and
+ * `ExtensionCommandContextActions` (newSession), since index.ts caches
+ * the most-recent ctx and that's typically the command one.
+ *
+ * All fields are optional so a missing method (e.g. when only a plain
+ * `ExtensionContext` was seen) becomes a typed `action_error` instead of
+ * a runtime TypeError.
+ */
+export interface ActionCtx {
+    compact?: (options?: object) => void;
+    /**
+     * Starts a new session. `withSession` is the SDK's blessed hook for
+     * post-replacement work: it receives a FRESH, command-capable ctx bound to
+     * the new session. The SDK marks any ctx captured BEFORE this call stale, so
+     * callers must re-capture via `withSession` rather than reuse the old ctx.
+     */
+    newSession?: (options?: {
+        withSession?: (ctx: ActionCtx) => Promise<void>;
+    }) => Promise<{
+        cancelled: boolean;
+    }>;
+    /** Pi 0.84.4 exposes the active model directly on ExtensionContext. */
+    model?: Model<any>;
+    /** Compatibility path for SDK contexts that expose the getter only. */
+    getModel?: () => Model<any> | undefined;
+    /**
+     * Models enabled for session cycling by `--models` or `enabledModels`.
+     * Empty means no explicit scope, so all available models remain usable.
+     */
+    scopedModels?: readonly {
+        model: Model<any>;
+    }[];
+    /**
+     * Live session registry from Pi's extension ctx. Includes providers/models
+     * registered dynamically via `pi.registerProvider(...)`, unlike the fallback
+     * disk-backed registry Pi Reach can build on its own.
+     */
+    modelRegistry?: ActionModelRegistry;
+}
+/**
+ * Minimal shape of the registry surface. Maps 1:1 onto `ModelRegistry`
+ * but lets tests fake catalogs without instantiating the real one.
+ */
+export interface ActionModelRegistry {
+    refresh(): void;
+    getAvailable(): Model<any>[];
+    find(provider: string, modelId: string): Model<any> | undefined;
+}
+/** Project a SDK `Model<Api>` onto the wire schema. Shared by list_models
+ *  and the `current` echo, so both stay in lockstep. */
+export declare function wireFromModel(model: Model<any>): WireModel;
+type SessionCompactMsg = Extract<ClientMessage, {
+    type: "session_compact";
+}>;
+type SessionNewMsg = Extract<ClientMessage, {
+    type: "session_new";
+}>;
+type ModelSetMsg = Extract<ClientMessage, {
+    type: "model_set";
+}>;
+type ThinkingSetMsg = Extract<ClientMessage, {
+    type: "thinking_set";
+}>;
+type ListModelsMsg = Extract<ClientMessage, {
+    type: "list_models";
+}>;
+export declare function handleSessionCompact(ctx: ActionCtx | null, sender: ActionReplySender, msg: SessionCompactMsg, onSettled?: () => void): void;
+export declare function handleSessionNew(ctx: ActionCtx | null, sender: ActionReplySender, msg: SessionNewMsg, onReplaced?: (freshCtx: ActionCtx) => void): Promise<boolean>;
+export declare function handleThinkingSet(pi: ActionPi, sender: ActionReplySender, msg: ThinkingSetMsg): void;
+export declare function handleModelSet(pi: ActionPi, ctx: ActionCtx | null, reg: ActionModelRegistry, sender: ActionReplySender, msg: ModelSetMsg, onPersist?: (provider: string, modelId: string) => void, onModelSet?: (model: Model<any>) => void): Promise<void>;
+export declare function getModelsList(ctx: ActionCtx | null, reg: ActionModelRegistry, currentModelHint?: CurrentModelHint): {
+    models: WireModel[];
+    current?: WireModel;
+};
+export declare function handleListModels(ctx: ActionCtx | null, reg: ActionModelRegistry, sender: ActionReplySender, msg: ListModelsMsg): void;
+export {};

package/dist/actions/handlers.js

@@ -0,0 +1,200 @@
+/**
+ * Plan/28 Wave B — typed action handlers.
+ *
+ * Each handler maps one `ClientMessage` action to a public Pi SDK call,
+ * and replies with `action_ok` or `action_error`. Handlers take their
+ * dependencies as parameters so the index.ts wiring is one-liner and
+ * unit tests can pass fakes without touching global state.
+ *
+ * `models_list` lives next door because it shares the `ModelRegistry`
+ * helper and the same wire vocabulary.
+ *
+ * SDK API surface used (see plan/28 Wave 0 for the full table):
+ *
+ *   - `ctx.compact()`            — non-blocking, fires `session_compact`
+ *                                  event when done
+ *   - `ctx.newSession()`         — only on `ExtensionCommandContext`;
+ *                                  resolves with `{cancelled}` flag
+ *   - `pi.setModel(model)`       — returns `false` if no auth configured
+ *   - `pi.setThinkingLevel(lvl)` — synchronous
+ *   - `ctx.getModel()`           — optional, undefined before first turn
+ *   - `ModelRegistry.{refresh,getAvailable,find}` — see `registry.ts`
+ */
+/** Project a SDK `Model<Api>` onto the wire schema. Shared by list_models
+ *  and the `current` echo, so both stay in lockstep. */
+export function wireFromModel(model) {
+    return {
+        id: model.id,
+        name: model.name,
+        provider: model.provider,
+        reasoning: model.reasoning,
+        context_window: model.contextWindow,
+        // Plan/30: vision = model accepts image input. `Model.input` is
+        // `("text" | "image")[]` at runtime (confirmed against pi-ai). `?.` guards
+        // a fake/partial model in tests → treated as text-only.
+        vision: model.input?.includes("image") ?? false,
+    };
+}
+// ── ack helpers ────────────────────────────────────────────────────────────
+function ok(sender, msg, action) {
+    sender.send({ type: "action_ok", in_reply_to: msg.id, action });
+}
+function fail(sender, msg, action, err) {
+    const error = err instanceof Error ? err.message : String(err);
+    sender.send({ type: "action_error", in_reply_to: msg.id, action, error });
+}
+/** Run a synchronous action with uniform success/failure replies. */
+function runSync(sender, msg, action, body) {
+    try {
+        body();
+        ok(sender, msg, action);
+    }
+    catch (e) {
+        fail(sender, msg, action, e);
+    }
+}
+/** Run an async action with uniform success/failure replies. */
+async function runAsync(sender, msg, action, body) {
+    try {
+        await body();
+        ok(sender, msg, action);
+        return true;
+    }
+    catch (e) {
+        fail(sender, msg, action, e);
+        return false;
+    }
+}
+export function handleSessionCompact(ctx, sender, msg, onSettled) {
+    runSync(sender, msg, "session_compact", () => {
+        if (!ctx?.compact)
+            throw new Error("compact unavailable (no active session ctx)");
+        // Force the summary to English regardless of the conversation language —
+        // the summary is surfaced to the app via the `compaction` message, which
+        // is an English-only surface. `customInstructions` is appended to the SDK's
+        // compaction prompt (best-effort: the model writes the summary).
+        ctx.compact({
+            customInstructions: "Always write the compaction summary in English, even if the conversation is in another language.",
+            ...(onSettled ? { onComplete: onSettled, onError: onSettled } : {}),
+        });
+    });
+}
+export async function handleSessionNew(ctx, sender, msg, onReplaced) {
+    // Returns true only when a fresh session was actually created. index.ts
+    // keys the Pi-side reset (clear _messageBuffer, restamp _sessionStartedAt,
+    // fan out an empty session_history) off this signal — a `cancelled`/errored
+    // new-session must NOT reset, so we return runAsync's success boolean.
+    return runAsync(sender, msg, "session_new", async () => {
+        if (!ctx?.newSession)
+            throw new Error("newSession unavailable (no command ctx yet)");
+        // newSession marks the caller's captured ctx (index.ts's `_lastCtx`) STALE
+        // — reusing it later throws "stale after session replacement" (the
+        // compact-after-New-session crash). `withSession` hands back a fresh,
+        // command-capable ctx bound to the new session; forward it via onReplaced
+        // so the caller re-captures and keeps later actions off the stale ctx.
+        const result = await ctx.newSession({
+            withSession: async (freshCtx) => { onReplaced?.(freshCtx); },
+        });
+        // `cancelled: true` happens when the SDK's hook chain vetoes the new
+        // session (e.g. an extension's `session_before_switch` returned a
+        // refusal). Surface as a typed error rather than silent success.
+        if (result.cancelled)
+            throw new Error("cancelled by extension hook");
+    });
+}
+export function handleThinkingSet(pi, sender, msg) {
+    runSync(sender, msg, "thinking_set", () => {
+        pi.setThinkingLevel(msg.level);
+    });
+}
+export async function handleModelSet(pi, ctx, reg, sender, msg, onPersist, onModelSet) {
+    await runAsync(sender, msg, "model_set", async () => {
+        // Prefer Pi's LIVE session registry when available so the app sees models
+        // registered dynamically by extensions via `pi.registerProvider(...)`.
+        // Fall back to Pi Reach's own disk-backed registry when no ctx exists.
+        const liveReg = ctx?.modelRegistry ?? reg;
+        // Refresh first so a model just-added via `/login` is visible.
+        liveReg.refresh();
+        const model = liveReg.find(msg.provider, msg.model_id);
+        if (!model) {
+            throw new Error(`model "${msg.provider}/${msg.model_id}" not in registry`);
+        }
+        const success = await pi.setModel(model);
+        if (!success)
+            throw new Error("no auth configured for this model");
+        // `pi.setModel` only sets the LIVE model — it does NOT persist. Without
+        // this, a model picked from the app reverts to the saved default on the
+        // next Pi restart (the TUI persists because AgentSession.setModel
+        // writes the default; this path doesn't). `onPersist` writes the new
+        // default so the app's choice survives. Best-effort — the caller's writer
+        // must not throw, so a failed settings write never fails the model change.
+        try {
+            onModelSet?.(model);
+        }
+        catch {
+            // State synchronization must not turn a successful model change into an error.
+        }
+        onPersist?.(model.provider, model.id);
+    });
+}
+function uniqueModelMatch(available, predicate) {
+    const matches = available.filter(predicate);
+    return matches.length === 1 ? matches[0] : undefined;
+}
+function isFullModel(value) {
+    if (typeof value === "string" || !value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return typeof candidate.id === "string"
+        && typeof candidate.name === "string"
+        && typeof candidate.provider === "string"
+        && typeof candidate.reasoning === "boolean"
+        && typeof candidate.contextWindow === "number";
+}
+function resolveCurrentModel(ctx, available, hint) {
+    // A structured hint is updated by model_select/model_set and must win over
+    // the session-start context, whose model property can be an older snapshot.
+    if (hint) {
+        if (typeof hint !== "string") {
+            if (isFullModel(hint))
+                return hint;
+            return uniqueModelMatch(available, (model) => model.provider === hint.provider && model.id === hint.id);
+        }
+        // String matching is retained only as a conservative legacy fallback.
+        return uniqueModelMatch(available, (model) => model.id === hint || model.name === hint);
+    }
+    // The property is the canonical Pi 0.84.4 source. Keep getModel() for older
+    // contexts and test fakes that expose only the legacy accessor.
+    return ctx?.model ?? ctx?.getModel?.();
+}
+export function getModelsList(ctx, reg, currentModelHint) {
+    // Prefer Pi's LIVE session registry when available so the app sees models
+    // registered dynamically by extensions via `pi.registerProvider(...)`.
+    // Fall back to Pi Reach's own disk-backed registry when no ctx exists.
+    const liveReg = ctx?.modelRegistry ?? reg;
+    liveReg.refresh();
+    const available = liveReg.getAvailable();
+    const scopedModels = ctx?.scopedModels;
+    const listedModels = scopedModels && scopedModels.length > 0
+        ? scopedModels.map(({ model }) => model)
+        : available;
+    const models = listedModels.map(wireFromModel);
+    const current = resolveCurrentModel(ctx, available, currentModelHint);
+    return { models, ...(current ? { current: wireFromModel(current) } : {}) };
+}
+export function handleListModels(ctx, reg, sender, msg) {
+    // refresh() can throw if `models.json` is malformed — wrap in try so the
+    // app gets an explicit error reply instead of a silent drop.
+    try {
+        sender.send({ type: "models_list", in_reply_to: msg.id, ...getModelsList(ctx, reg) });
+    }
+    catch (e) {
+        sender.send({
+            type: "error",
+            in_reply_to: msg.id,
+            code: "internal_error",
+            message: e instanceof Error ? e.message : String(e),
+        });
+    }
+}
+//# sourceMappingURL=handlers.js.map

package/dist/actions/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/actions/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA4GH;wDACwD;AACxD,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,gEAAgE;QAChE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;KAChD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,EAAE,CAAC,MAAyB,EAAE,GAAmB,EAAE,MAAkB;IAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,GAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CACd,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC;QACP,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,QAAQ,CACrB,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,IAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,oBAAoB,CAClC,GAAqB,EACrB,MAAyB,EACzB,GAAsB,EACtB,SAAsB;IAEtB,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE;QAC3C,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClF,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,GAAG,CAAC,OAAO,CAAC;YACV,kBAAkB,EAChB,kGAAkG;YACpG,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,MAAyB,EACzB,GAAkB,EAClB,UAA0C;IAE1C,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,CAAC,GAAG,EAAE,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrF,2EAA2E;QAC3E,mEAAmE;QACnE,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC;YAClC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SAC7D,CAAC,CAAC;QACH,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAY,EACZ,MAAyB,EACzB,GAAmB;IAEnB,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAY,EACZ,GAAqB,EACrB,GAAwB,EACxB,MAAyB,EACzB,GAAgB,EAChB,SAAuD,EACvD,UAAwC;IAExC,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,GAAG,CAAC;QAC1C,+DAA+D;QAC/D,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,IAAI,CAAC;YACH,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;QACD,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAgC,EAChC,SAAyC;IAEzC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACnF,MAAM,SAAS,GAAG,KAA8B,CAAC;IACjD,OAAO,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;WAClC,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ;WAClC,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ;WACtC,OAAO,SAAS,CAAC,SAAS,KAAK,SAAS;WACxC,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAqB,EACrB,SAAgC,EAChC,IAAuB;IAEvB,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,IAAI,WAAW,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,gBAAgB,CACrB,SAAS,EACT,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CACpE,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,OAAO,gBAAgB,CACrB,SAAS,EACT,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CACpD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,OAAO,GAAG,EAAE,KAAK,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,GAAqB,EACrB,GAAwB,EACxB,gBAAmC;IAEnC,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,GAAG,CAAC;IAC1C,OAAO,CAAC,OAAO,EAAE,CAAC;IAClB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,CAAC;IACvC,MAAM,YAAY,GAAG,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAqB,EACrB,GAAwB,EACxB,MAAyB,EACzB,GAAkB;IAElB,yEAAyE;IACzE,6DAA6D;IAC7D,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/actions/registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Plan/28 — ModelRegistry access for the action handlers.
+ *
+ * The host hands every extension a ready `ModelRegistry` on
+ * `ExtensionContext.modelRegistry` — the same instance `AgentSession` uses
+ * internally. That is the ONLY source we read.
+ *
+ * History (issue #112): this module used to build its own registry via
+ * `ModelRegistry.create(AuthStorage.create())`. Both factories were removed
+ * from `@earendil-works/pi-coding-agent` in pi 0.83, so the import crashed the
+ * whole pi process on the first `model_set`/`list_models` from the app
+ * (`undefined is not an object (evaluating 'AuthStorage.create')`, thrown from
+ * the WebSocket line handler). Reading the registry off the live ctx drops the
+ * dependency on that package's factory surface entirely, so a future breaking
+ * change there cannot crash the extension the same way again.
+ *
+ * Two hazards this handles:
+ *
+ * 1. A ctx captured before a session replacement/reload is **stale**, and even
+ *    *reading* `.modelRegistry` on it throws (`assertActive`). Every read is
+ *    wrapped.
+ * 2. There may be no live ctx at all while an Extension callback runs. Rather
+ *    than throw from a WS callback — an uncaught exception that exits pi — we
+ *    fall back to the last registry that worked, then to a stub whose methods
+ *    never throw and report an empty catalog.
+ */
+import type { ActionModelRegistry } from "./handlers.js";
+/** Anything carrying the host registry — `ExtensionContext` and friends. */
+interface RegistryBearingCtx {
+    modelRegistry?: ActionModelRegistry;
+}
+/**
+ * Resolve the live host `ModelRegistry` from the most recent extension ctx.
+ * Falls back to the last one that worked, then to an inert stub.
+ */
+export declare function ensureModelRegistry(ctx?: RegistryBearingCtx | null): ActionModelRegistry;
+/** Test seam — drop the cached registry so tests can rebuild with fakes. */
+export declare function _resetModelRegistryForTests(): void;
+export {};

package/dist/actions/registry.js

@@ -0,0 +1,58 @@
+/**
+ * Plan/28 — ModelRegistry access for the action handlers.
+ *
+ * The host hands every extension a ready `ModelRegistry` on
+ * `ExtensionContext.modelRegistry` — the same instance `AgentSession` uses
+ * internally. That is the ONLY source we read.
+ *
+ * History (issue #112): this module used to build its own registry via
+ * `ModelRegistry.create(AuthStorage.create())`. Both factories were removed
+ * from `@earendil-works/pi-coding-agent` in pi 0.83, so the import crashed the
+ * whole pi process on the first `model_set`/`list_models` from the app
+ * (`undefined is not an object (evaluating 'AuthStorage.create')`, thrown from
+ * the WebSocket line handler). Reading the registry off the live ctx drops the
+ * dependency on that package's factory surface entirely, so a future breaking
+ * change there cannot crash the extension the same way again.
+ *
+ * Two hazards this handles:
+ *
+ * 1. A ctx captured before a session replacement/reload is **stale**, and even
+ *    *reading* `.modelRegistry` on it throws (`assertActive`). Every read is
+ *    wrapped.
+ * 2. There may be no live ctx at all while an Extension callback runs. Rather
+ *    than throw from a WS callback — an uncaught exception that exits pi — we
+ *    fall back to the last registry that worked, then to a stub whose methods
+ *    never throw and report an empty catalog.
+ */
+let _lastGoodRegistry = null;
+/**
+ * Never-throwing empty catalog. Used only when no ctx has ever been seen —
+ * callers get an empty model list instead of a crashed agent.
+ */
+const _stubRegistry = {
+    refresh() { },
+    getAvailable() { return []; },
+    find() { return undefined; },
+};
+/**
+ * Resolve the live host `ModelRegistry` from the most recent extension ctx.
+ * Falls back to the last one that worked, then to an inert stub.
+ */
+export function ensureModelRegistry(ctx) {
+    try {
+        const live = ctx?.modelRegistry;
+        if (live) {
+            _lastGoodRegistry = live;
+            return live;
+        }
+    }
+    catch {
+        // stale ctx after session replacement — reading the property throws.
+    }
+    return _lastGoodRegistry ?? _stubRegistry;
+}
+/** Test seam — drop the cached registry so tests can rebuild with fakes. */
+export function _resetModelRegistryForTests() {
+    _lastGoodRegistry = null;
+}
+//# sourceMappingURL=registry.js.map

package/dist/actions/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/actions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,IAAI,iBAAiB,GAA+B,IAAI,CAAC;AAEzD;;;GAGG;AACH,MAAM,aAAa,GAAwB;IACzC,OAAO,KAAI,CAAC;IACZ,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA+B;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,iBAAiB,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}

package/dist/actions/session_new_bridge.d.ts

@@ -0,0 +1,35 @@
+import type { ExtensionAPI, ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
+import type { V2ActionFrame } from "../timeline/v2_service.js";
+import { type ActionCtx, type ActionReplySender } from "./handlers.js";
+type SessionNewFrame = Extract<V2ActionFrame, {
+    type: "session_new";
+}>;
+export interface SessionNewBridgeOptions {
+    getPi(): ExtensionAPI | null;
+    onCommandContext(ctx: ExtensionCommandContext): void;
+    onReplaced(ctx: ActionCtx): void;
+    onFinished(): void;
+}
+/** Bridges a remote action to Pi's command-only, process-local newSession API. */
+export declare class SessionNewBridge {
+    private readonly options;
+    private readonly pending;
+    private timeoutMs;
+    private running;
+    private switchPermit;
+    constructor(options: SessionNewBridgeOptions);
+    dispatch(sender: ActionReplySender, frame: SessionNewFrame): void;
+    run(token: string, ctx: ExtensionCommandContext): Promise<void>;
+    beforeSwitch(reason: "new" | "resume"): {
+        cancel: true;
+    } | undefined;
+    beforeFork(): {
+        cancel: true;
+    } | undefined;
+    isRunning(): boolean;
+    clear(error?: string): void;
+    setTimeoutForTest(timeoutMs: number): void;
+    private fail;
+    private complete;
+}
+export {};