@zerwiz/ymir 0.1.33 → 0.1.35

package/apps/sessrumnir/src/main/pi-event-router.test.ts

@@ -0,0 +1,388 @@
+import assert from 'node:assert/strict'
+import { test } from 'node:test'
+import { PiRpcManager } from './pi-rpc-manager'
+import { createPiEventRouter, type PiEventRouter } from './pi-event-router'
+import type { PendingPromptCounts, PiExtensionUiRequest, PiRpcEvent } from '../shared/ipc-contracts'
+
+const WS_A = 'ws-a'
+const WS_B = 'ws-b'
+const PROMPT_TIMEOUT_MS = 5_000
+
+/**
+ * Pi holds the tool call for every one of these methods, so each must queue
+ * rather than drop when its workspace is inactive; narrowing the router's set
+ * to a subset would deadlock the other methods' turns.
+ */
+const BLOCKING_METHODS: readonly PiExtensionUiRequest['method'][] = ['select', 'confirm', 'input', 'editor']
+
+function dialogRequest(id: string, overrides: Partial<PiExtensionUiRequest> = {}): PiExtensionUiRequest {
+  return {
+    type: 'extension_ui_request',
+    id,
+    method: 'confirm',
+    title: `Approve ${id}?`,
+    ...overrides,
+  }
+}
+
+function notifyRequest(id: string): PiExtensionUiRequest {
+  return { type: 'extension_ui_request', id, method: 'notify', message: 'done' }
+}
+
+interface RecordedResponse {
+  workspaceId: string
+  id: string
+  response: Record<string, unknown>
+}
+
+interface Harness {
+  router: PiEventRouter
+  managers: Map<string, PiRpcManager>
+  broadcasts: PiRpcEvent[]
+  countsLog: PendingPromptCounts[]
+  responses: RecordedResponse[]
+  clock: { now: number }
+  setActive(workspaceId: string | null): void
+  addManager(workspaceId: string): PiRpcManager
+}
+
+/**
+ * Drives the router with real PiRpcManager instances used as bare emitters (no
+ * child process is ever spawned). Responses are recorded per workspace by
+ * overriding sendExtensionUiResponse, which would otherwise no-op silently
+ * because the managers are not running.
+ */
+function createHarness(workspaceIds: string[], activeId: string | null = workspaceIds[0] ?? null): Harness {
+  const managers = new Map<string, PiRpcManager>()
+  const broadcasts: PiRpcEvent[] = []
+  const countsLog: PendingPromptCounts[] = []
+  const responses: RecordedResponse[] = []
+  const clock = { now: 0 }
+  let active = activeId
+
+  const router = createPiEventRouter({
+    getActiveManager: () => (active !== null ? (managers.get(active) ?? null) : null),
+    workspaceIdFor: (manager) => {
+      for (const [workspaceId, candidate] of managers) {
+        if (candidate === manager) return workspaceId
+      }
+      return null
+    },
+    broadcastEvent: (event) => broadcasts.push(event),
+    broadcastPendingCounts: (counts) => countsLog.push(counts),
+    now: () => clock.now,
+  })
+
+  const addManager = (workspaceId: string): PiRpcManager => {
+    const manager = new PiRpcManager()
+    manager.sendExtensionUiResponse = (id, response): void => {
+      responses.push({ workspaceId, id, response })
+    }
+    managers.set(workspaceId, manager)
+    router.attachManager(manager)
+    return manager
+  }
+  for (const workspaceId of workspaceIds) addManager(workspaceId)
+
+  return {
+    router,
+    managers,
+    broadcasts,
+    countsLog,
+    responses,
+    clock,
+    setActive: (workspaceId) => {
+      active = workspaceId
+    },
+    addManager,
+  }
+}
+
+// ─── Passthrough filter ──────────────────────────────────────────────────────
+
+test('non-dialog events pass through from the active manager only', () => {
+  const h = createHarness([WS_A, WS_B])
+  const activeTurn: PiRpcEvent = { type: 'turn_start' }
+  h.managers.get(WS_A)!.emit('event', activeTurn)
+  h.managers.get(WS_B)!.emit('event', { type: 'turn_start' })
+  h.managers.get(WS_B)!.emit('event', notifyRequest('n1'))
+  h.managers.get(WS_B)!.emit('status-change', 'running')
+  assert.deepEqual(h.broadcasts, [activeTurn], 'inactive traffic must stay filtered out')
+  assert.deepEqual(h.countsLog, [], 'non-dialog traffic must not touch pending counts')
+})
+
+test('notify from the active manager passes through without queueing', () => {
+  const h = createHarness([WS_A])
+  const notify = notifyRequest('n1')
+  h.managers.get(WS_A)!.emit('event', notify)
+  assert.deepEqual(h.broadcasts, [notify])
+  assert.deepEqual(h.router.getPendingCounts(), {})
+})
+
+test('active manager status changes broadcast as status_change events', () => {
+  const h = createHarness([WS_A])
+  h.managers.get(WS_A)!.emit('status-change', 'running')
+  // The payload comes from getStatus(); a never-started manager reports 'stopped'.
+  assert.deepEqual(h.broadcasts, [
+    { type: 'status_change', status: 'stopped', pid: null, error: null, engine: 'pi', startupPhase: undefined },
+  ])
+})
+
+// ─── Queueing and delivery ───────────────────────────────────────────────────
+
+for (const method of BLOCKING_METHODS) {
+  test(`a ${method} dialog from an inactive workspace is queued, not dropped`, () => {
+    const h = createHarness([WS_A, WS_B])
+    h.managers.get(WS_B)!.emit('event', dialogRequest('b1', { method }))
+    assert.deepEqual(h.broadcasts, [], 'an inactive dialog must not reach the renderer yet')
+    assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+    h.router.respond('b1', { value: 'answer' })
+    assert.deepEqual(
+      h.responses,
+      [{ workspaceId: WS_B, id: 'b1', response: { value: 'answer' } }],
+      'the answer must reach the Pi that asked, not the active one'
+    )
+    assert.deepEqual(h.countsLog, [{ [WS_B]: 1 }, {}])
+    assert.deepEqual(h.router.getPendingCounts(), {})
+  })
+
+  test(`${method} dialogs from the active workspace deliver immediately and serialize`, () => {
+    const h = createHarness([WS_A, WS_B])
+    const first = dialogRequest('a1', { method })
+    const second = dialogRequest('a2', { method })
+    h.managers.get(WS_A)!.emit('event', first)
+    h.managers.get(WS_A)!.emit('event', second)
+    assert.deepEqual(h.broadcasts, [first], 'the second dialog must wait for the first answer')
+    assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 2 })
+    h.router.respond('a1', { value: 'answer' })
+    assert.deepEqual(h.responses, [{ workspaceId: WS_A, id: 'a1', response: { value: 'answer' } }])
+    assert.deepEqual(h.broadcasts, [first, second], 'answering the delivered dialog chains the queued one')
+    assert.deepEqual(h.countsLog, [{ [WS_A]: 1 }, { [WS_A]: 2 }, { [WS_A]: 1 }])
+    assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 1 })
+  })
+}
+
+// ─── Responding ──────────────────────────────────────────────────────────────
+
+test('answering a dialog whose workspace is no longer active does not chain the next one', () => {
+  const h = createHarness([WS_A, WS_B])
+  const first = dialogRequest('a1')
+  const second = dialogRequest('a2')
+  h.managers.get(WS_A)!.emit('event', first)
+  h.managers.get(WS_A)!.emit('event', second)
+  h.setActive(WS_B)
+  h.router.handleActiveWorkspaceChanged()
+  h.router.respond('a1', { confirmed: true })
+  assert.deepEqual(h.broadcasts, [first], 'the queued dialog must wait for the switch back')
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 1 }, 'the held dialog stays counted')
+  assert.deepEqual(h.countsLog.at(-1), { [WS_A]: 1 })
+  h.setActive(WS_A)
+  h.router.flush(WS_A)
+  assert.deepEqual(h.broadcasts, [first, second], 'switching back delivers the held dialog')
+})
+
+test('respond with an unknown id falls back to the active manager', () => {
+  const h = createHarness([WS_A])
+  h.router.respond('ghost', { value: '' })
+  assert.deepEqual(h.responses, [{ workspaceId: WS_A, id: 'ghost', response: { value: '' } }])
+})
+
+test('respond with no origin and no active manager drops silently', () => {
+  const h = createHarness([WS_A], null)
+  h.router.respond('ghost', { value: '' })
+  assert.deepEqual(h.responses, [])
+})
+
+test('respond purges a queued, undelivered copy of the same id', () => {
+  const h = createHarness([WS_A])
+  const first = dialogRequest('a1')
+  const second = dialogRequest('a2')
+  h.managers.get(WS_A)!.emit('event', first)
+  h.managers.get(WS_A)!.emit('event', second)
+  h.router.respond('a2', { confirmed: true })
+  assert.deepEqual(h.responses.map((r) => r.id), ['a2'])
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 1 }, 'only the still-delivered first dialog remains')
+  h.router.respond('a1', { confirmed: true })
+  assert.deepEqual(h.broadcasts, [first], 'the answered-while-queued dialog must never be delivered')
+  assert.deepEqual(h.router.getPendingCounts(), {})
+})
+
+// ─── Flush (self-healing re-broadcast) ───────────────────────────────────────
+
+test('flush re-broadcasts the retained delivered dialog for the active workspace', () => {
+  const h = createHarness([WS_A])
+  const request = dialogRequest('a1')
+  h.managers.get(WS_A)!.emit('event', request)
+  h.router.flush(WS_A)
+  assert.deepEqual(h.broadcasts, [request, request])
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 1 }, 'a re-broadcast must not duplicate state')
+  assert.deepEqual(h.countsLog, [{ [WS_A]: 1 }], 'replaying the same dialog changes no count')
+})
+
+test('flush for a non-active workspace is a no-op', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.router.flush(WS_B)
+  assert.deepEqual(h.broadcasts, [])
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+})
+
+test('flush after switching to a workspace delivers its queued dialog', () => {
+  const h = createHarness([WS_A, WS_B])
+  const request = dialogRequest('b1')
+  h.managers.get(WS_B)!.emit('event', request)
+  h.setActive(WS_B)
+  h.router.handleActiveWorkspaceChanged()
+  const countsBeforeFlush = h.countsLog.length
+  h.router.flush(WS_B)
+  assert.deepEqual(h.broadcasts, [request])
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+  assert.equal(h.countsLog.length, countsBeforeFlush + 1, 'promoting a queued dialog must re-broadcast counts')
+  assert.deepEqual(h.countsLog.at(-1), { [WS_B]: 1 })
+})
+
+// ─── Eviction ────────────────────────────────────────────────────────────────
+
+test('a manager leaving the running state evicts its held prompts', () => {
+  const h = createHarness([WS_A, WS_B])
+  const firstA = dialogRequest('a1')
+  h.managers.get(WS_A)!.emit('event', firstA)
+  h.managers.get(WS_A)!.emit('event', dialogRequest('a2'))
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.managers.get(WS_A)!.emit('status-change', 'stopped')
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+  assert.deepEqual(h.countsLog.at(-1), { [WS_B]: 1 })
+  h.router.flush(WS_A)
+  assert.deepEqual(
+    h.broadcasts.filter((e) => e.type === 'extension_ui_request'),
+    [firstA],
+    'evicted prompts must not resurface'
+  )
+})
+
+test('an error status evicts held prompts', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.managers.get(WS_B)!.emit('status-change', 'error')
+  assert.deepEqual(h.router.getPendingCounts(), {})
+  assert.deepEqual(h.countsLog.at(-1), {})
+})
+
+test('process exit evicts held prompts', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.managers.get(WS_B)!.emit('exit', { code: 1, signal: null })
+  assert.deepEqual(h.router.getPendingCounts(), {})
+  assert.deepEqual(h.countsLog.at(-1), {})
+})
+
+test('eviction forgets prompt origins, so a late answer falls back to the active manager', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.managers.get(WS_B)!.emit('status-change', 'stopped')
+  h.router.respond('b1', { confirmed: true })
+  assert.deepEqual(
+    h.responses,
+    [{ workspaceId: WS_A, id: 'b1', response: { confirmed: true } }],
+    'the dead Pi must not be addressed again'
+  )
+})
+
+test('re-evicting a manager with nothing held emits no further counts', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  h.managers.get(WS_B)!.emit('status-change', 'stopped')
+  const countsAfterEviction = h.countsLog.length
+  h.managers.get(WS_B)!.emit('exit', { code: 0, signal: null })
+  assert.equal(h.countsLog.length, countsAfterEviction, 'an idle eviction must not churn the renderer')
+})
+
+test('a dialog arriving after eviction is held again and answers to its own manager', () => {
+  // Pi's buffered stdout can surface a request after the exit event; the late
+  // dialog is treated as any other, and the next eviction clears it again.
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('exit', { code: 0, signal: null })
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+  h.router.respond('b1', { confirmed: true })
+  assert.deepEqual(h.responses, [{ workspaceId: WS_B, id: 'b1', response: { confirmed: true } }])
+})
+
+// ─── Ghost guard ─────────────────────────────────────────────────────────────
+
+test('deliverNext drops queued prompts whose extension timeout has expired', () => {
+  const h = createHarness([WS_A, WS_B])
+  const expired = dialogRequest('b1', { timeout: PROMPT_TIMEOUT_MS })
+  const fresh = dialogRequest('b2')
+  h.managers.get(WS_B)!.emit('event', expired)
+  h.managers.get(WS_B)!.emit('event', fresh)
+  h.clock.now = PROMPT_TIMEOUT_MS
+  h.setActive(WS_B)
+  h.router.flush(WS_B)
+  assert.deepEqual(h.broadcasts, [fresh], 'Pi already auto-resolved the expired prompt')
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+})
+
+test('flush drops an expired delivered dialog and delivers the next queued one', () => {
+  const h = createHarness([WS_A])
+  const expired = dialogRequest('a1', { timeout: PROMPT_TIMEOUT_MS })
+  const fresh = dialogRequest('a2')
+  h.managers.get(WS_A)!.emit('event', expired)
+  h.managers.get(WS_A)!.emit('event', fresh)
+  h.clock.now = PROMPT_TIMEOUT_MS
+  h.router.flush(WS_A)
+  assert.deepEqual(
+    h.broadcasts,
+    [expired, fresh],
+    'the expired dialog must not be replayed; the fresh one takes the slot'
+  )
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_A]: 1 })
+  assert.deepEqual(h.countsLog.at(-1), { [WS_A]: 1 })
+})
+
+test('expired queued prompts stop being counted without a workspace visit', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1', { timeout: PROMPT_TIMEOUT_MS }))
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b2', { timeout: PROMPT_TIMEOUT_MS * 2 }))
+  h.clock.now = PROMPT_TIMEOUT_MS
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 }, 'the elapsed prompt no longer exists in Pi')
+  h.clock.now = PROMPT_TIMEOUT_MS * 2
+  h.router.handleActiveWorkspaceChanged()
+  assert.deepEqual(h.countsLog.at(-1), {}, 'an emptied queue must not linger')
+  h.router.respond('b1', { confirmed: true })
+  assert.deepEqual(
+    h.responses,
+    [{ workspaceId: WS_A, id: 'b1', response: { confirmed: true } }],
+    'a reaped prompt forgets its origin'
+  )
+})
+
+// ─── Activation ──────────────────────────────────────────────────────────────
+
+test('activation change re-broadcasts counts without mutating state', () => {
+  const h = createHarness([WS_A, WS_B])
+  h.managers.get(WS_B)!.emit('event', dialogRequest('b1'))
+  const before = h.router.getPendingCounts()
+  h.setActive(WS_B)
+  h.router.handleActiveWorkspaceChanged()
+  assert.deepEqual(h.countsLog.at(-1), before)
+  assert.deepEqual(h.router.getPendingCounts(), before)
+  assert.deepEqual(h.broadcasts, [], 'activation alone must not deliver anything')
+})
+
+// ─── Attachment ──────────────────────────────────────────────────────────────
+
+test('a manager attached after construction is routed like any other', () => {
+  const h = createHarness([WS_A])
+  const late = h.addManager(WS_B)
+  late.emit('event', dialogRequest('b1'))
+  assert.deepEqual(h.router.getPendingCounts(), { [WS_B]: 1 })
+})
+
+test('attaching the same manager twice does not double-route its events', () => {
+  const h = createHarness([WS_A])
+  h.router.attachManager(h.managers.get(WS_A)!)
+  const event: PiRpcEvent = { type: 'turn_start' }
+  h.managers.get(WS_A)!.emit('event', event)
+  assert.deepEqual(h.broadcasts, [event])
+})

package/apps/sessrumnir/src/main/pi-event-router.ts

@@ -0,0 +1,290 @@
+import type { PiRpcManager } from './pi-rpc-manager'
+import type {
+  PendingPromptCounts,
+  PiExtensionUiRequest,
+  PiProcessStatus,
+  PiRpcEvent,
+} from '../shared/ipc-contracts'
+
+/**
+ * Routes Pi events from every workspace's PiRpcManager to the renderer.
+ *
+ * Non-dialog events keep the deliberate active-workspace-only filter: the
+ * renderer's piStatus/stream state is a single global view and must track the
+ * active workspace. Blocking extension-UI dialogs (select/confirm/input/editor)
+ * are different — Pi holds the tool call until an answer arrives, with no
+ * timeout on permission confirms — so dropping one from an inactive workspace
+ * deadlocks that workspace's turn. The router instead:
+ *
+ *  - retains the one delivered dialog per workspace (renderer slot is
+ *    reconstructible from main state at any moment via flush),
+ *  - queues further dialogs per workspace and serializes delivery,
+ *  - remembers each request's origin manager so the answer always reaches the
+ *    Pi that asked, regardless of which workspace is active at answer time,
+ *  - evicts a manager's held prompts when its process stops (a dead Pi can
+ *    never consume an answer).
+ *
+ * Electron-free factory: all I/O goes through injected deps, so tests drive it
+ * with bare emitters and an injected clock.
+ */
+
+const BLOCKING_UI_METHODS: ReadonlySet<PiExtensionUiRequest['method']> = new Set([
+  'select',
+  'confirm',
+  'input',
+  'editor',
+])
+
+interface QueuedPrompt {
+  event: PiExtensionUiRequest
+  receivedAt: number
+}
+
+export interface PiEventRouterDeps {
+  getActiveManager(): PiRpcManager | null
+  workspaceIdFor(manager: PiRpcManager): string | null
+  /** Forward one Pi event to the renderer (EVENT_PI). */
+  broadcastEvent(event: PiRpcEvent): void
+  /** Push a fresh pending-prompt snapshot to the renderer (EVENT_PENDING_PROMPTS). */
+  broadcastPendingCounts(counts: PendingPromptCounts): void
+  now(): number
+}
+
+export interface PiEventRouter {
+  /** Wire a manager's event/status-change/exit emissions into the router. Idempotent. */
+  attachManager(manager: PiRpcManager): void
+  /** Answer an extension-UI request, routing to its origin manager. */
+  respond(id: string, response: Record<string, unknown>): void
+  /** (Re-)deliver the workspace's held dialog; no-op unless it is active now. */
+  flush(workspaceId: string): void
+  /** Snapshot of held prompts; reaps timed-out ones so the figures stay honest. */
+  getPendingCounts(): PendingPromptCounts
+  /** Re-broadcast counts after an active-workspace change; delivers nothing. */
+  handleActiveWorkspaceChanged(): void
+}
+
+export function createPiEventRouter(deps: PiEventRouterDeps): PiEventRouter {
+  // Blocking dialogs are owned by a Pi process, not a project. Multiple live
+  // session runtimes may share one workspace cwd, so workspace-keyed queues
+  // would deliver one session's prompt to another.
+  const queues = new Map<PiRpcManager, QueuedPrompt[]>()
+  // The one dialog currently owned by the renderer slot per Pi process. The
+  // full payload is retained until answered or evicted so flush can replay it.
+  const delivered = new Map<PiRpcManager, QueuedPrompt>()
+  // Every blocking dialog's asking manager, until answered or evicted.
+  const origins = new Map<string, PiRpcManager>()
+  const attached = new WeakSet<PiRpcManager>()
+
+  const isBlockingDialog = (event: PiRpcEvent): event is PiExtensionUiRequest =>
+    event.type === 'extension_ui_request' && BLOCKING_UI_METHODS.has(event.method)
+
+  const activeWorkspaceId = (): string | null => {
+    const manager = deps.getActiveManager()
+    return manager ? deps.workspaceIdFor(manager) : null
+  }
+
+  const track = (event: PiExtensionUiRequest): QueuedPrompt => ({ event, receivedAt: deps.now() })
+
+  /**
+   * Once the extension-supplied timeout elapses, Pi has auto-resolved the
+   * request and deleted its pending entry, so a dialog shown from here on could
+   * never be answered. Sole expiry rule for held prompts, queued or delivered.
+   */
+  const isExpired = (entry: QueuedPrompt): boolean =>
+    entry.event.timeout !== undefined && deps.now() - entry.receivedAt >= entry.event.timeout
+
+  /** Drop expired entries, forgetting their origins; returns the live ones. */
+  const reapExpired = (entries: readonly QueuedPrompt[]): QueuedPrompt[] => {
+    const live: QueuedPrompt[] = []
+    for (const entry of entries) {
+      if (isExpired(entry)) origins.delete(entry.event.id)
+      else live.push(entry)
+    }
+    return live
+  }
+
+  /** An empty queue is deleted rather than stored, so counts omit zero entries. */
+  const storeQueue = (manager: PiRpcManager, entries: QueuedPrompt[]): void => {
+    if (entries.length === 0) queues.delete(manager)
+    else queues.set(manager, entries)
+  }
+
+  const getPendingCounts = (): PendingPromptCounts => {
+    const counts: PendingPromptCounts = {}
+    for (const [manager, entries] of queues) {
+      const live = reapExpired(entries)
+      if (live.length !== entries.length) storeQueue(manager, live)
+      const workspaceId = deps.workspaceIdFor(manager)
+      if (workspaceId && live.length > 0) counts[workspaceId] = (counts[workspaceId] ?? 0) + live.length
+    }
+    for (const manager of delivered.keys()) {
+      const workspaceId = deps.workspaceIdFor(manager)
+      if (workspaceId) counts[workspaceId] = (counts[workspaceId] ?? 0) + 1
+    }
+    return counts
+  }
+
+  const emitCounts = (): void => {
+    deps.broadcastPendingCounts(getPendingCounts())
+  }
+
+  /**
+   * Pop the workspace's queue into its empty delivered slot and broadcast,
+   * reaping expired entries on the way. Returns whether state changed.
+   */
+  const deliverNext = (manager: PiRpcManager): boolean => {
+    if (delivered.has(manager)) return false
+    const entries = queues.get(manager)
+    if (entries === undefined) return false
+    const live = reapExpired(entries)
+    const next = live.shift()
+    if (next !== undefined) {
+      delivered.set(manager, next)
+      deps.broadcastEvent(next.event)
+    }
+    storeQueue(manager, live)
+    return live.length !== entries.length
+  }
+
+  const enqueue = (manager: PiRpcManager, event: PiExtensionUiRequest): void => {
+    const entry = track(event)
+    const queue = queues.get(manager)
+    if (queue) queue.push(entry)
+    else queues.set(manager, [entry])
+  }
+
+  const handleBlockingDialog = (manager: PiRpcManager, event: PiExtensionUiRequest): void => {
+    origins.set(event.id, manager)
+    const workspaceId = deps.workspaceIdFor(manager)
+    if (workspaceId === null) {
+      // Manager unknown to the workspace registry: there is no queue slot to
+      // hold it under, so deliver directly when active (origin routing above
+      // still answers it) and let the inactive case fall through as a drop.
+      if (manager === deps.getActiveManager()) deps.broadcastEvent(event)
+      return
+    }
+    if (manager === deps.getActiveManager() && !delivered.has(manager)) {
+      delivered.set(manager, track(event))
+      deps.broadcastEvent(event)
+    } else {
+      // Inactive session runtime, or a dialog already on screen: hold for later.
+      enqueue(manager, event)
+    }
+    emitCounts()
+  }
+
+  const handleManagerEvent = (manager: PiRpcManager, event: PiRpcEvent): void => {
+    if (isBlockingDialog(event)) {
+      handleBlockingDialog(manager, event)
+      return
+    }
+    if (manager === deps.getActiveManager()) {
+      deps.broadcastEvent(event)
+    }
+  }
+
+  /**
+   * A manager that stopped, crashed, or is restarting has abandoned its
+   * pending requests: purge every prompt it originated so none can ghost-
+   * deliver against a process that will never consume the answer.
+   */
+  const evictManager = (manager: PiRpcManager): void => {
+    const ownedIds = new Set<string>()
+    for (const [id, origin] of origins) {
+      if (origin === manager) ownedIds.add(id)
+    }
+    if (ownedIds.size === 0) return
+    for (const id of ownedIds) origins.delete(id)
+    for (const [manager, entries] of queues) {
+      const kept = entries.filter((entry) => !ownedIds.has(entry.event.id))
+      if (kept.length !== entries.length) storeQueue(manager, kept)
+    }
+    for (const [manager, entry] of delivered) {
+      if (ownedIds.has(entry.event.id)) delivered.delete(manager)
+    }
+    emitCounts()
+  }
+
+  const attachManager = (manager: PiRpcManager): void => {
+    // WorkspaceManager's wiredPairs already dedups its listener attachment;
+    // this guard makes the router safe against any second wiring path.
+    if (attached.has(manager)) return
+    attached.add(manager)
+    manager.on('event', (event: PiRpcEvent) => handleManagerEvent(manager, event))
+    manager.on('status-change', (status: PiProcessStatus) => {
+      if (manager === deps.getActiveManager()) {
+        deps.broadcastEvent({ type: 'status_change', ...manager.getStatus() })
+      }
+      if (status !== 'running') evictManager(manager)
+    })
+    // A startup-phase flip keeps status 'starting', so it is a separate signal:
+    // routing it through 'status-change' would re-run evictManager and purge
+    // extension UI prompts the still-starting engine already sent.
+    manager.on('startup-phase', () => {
+      if (manager === deps.getActiveManager()) {
+        deps.broadcastEvent({ type: 'status_change', ...manager.getStatus() })
+      }
+    })
+    manager.on('exit', () => evictManager(manager))
+  }
+
+  const respond = (id: string, response: Record<string, unknown>): void => {
+    const origin = origins.get(id) ?? null
+    origins.delete(id)
+    // Purge the id everywhere FIRST — regardless of a routing hit — so an
+    // answered request can never linger as a queued or delivered ghost.
+    let purgedManager: PiRpcManager | null = null
+    for (const [manager, entries] of queues) {
+      const kept = entries.filter((entry) => entry.event.id !== id)
+      if (kept.length === entries.length) continue
+      purgedManager = manager
+      storeQueue(manager, kept)
+    }
+    for (const [manager, entry] of delivered) {
+      if (entry.event.id !== id) continue
+      delivered.delete(manager)
+      purgedManager = manager
+    }
+    // Origin miss (notify dismissal, evicted prompt): fall back to the active
+    // manager — Pi ignores unknown ids — or drop when no workspace is active.
+    const target = origin ?? deps.getActiveManager()
+    target?.sendExtensionUiResponse(id, response)
+    if (purgedManager !== null && purgedManager === deps.getActiveManager()) {
+      deliverNext(purgedManager)
+    }
+    emitCounts()
+  }
+
+  const flush = (workspaceId: string): void => {
+    // Only the active workspace and its active session runtime may be flushed:
+    // a stale flush must not resurface another session's dialog.
+    if (workspaceId !== activeWorkspaceId()) return
+    const manager = deps.getActiveManager()
+    if (!manager) return
+    const held = delivered.get(manager)
+    if (held !== undefined && !isExpired(held)) {
+      // Self-healing re-broadcast: rebuilds the renderer slot after a reload,
+      // a switch-back, or a same-workspace re-activation. The renderer's
+      // id-guard tolerates the duplicate when the dialog is already up.
+      deps.broadcastEvent(held.event)
+      return
+    }
+    if (held !== undefined) {
+      // The slot's dialog timed out while the workspace was away: releasing it
+      // lets the next queued dialog take the slot instead of waiting on an
+      // answer Pi would discard.
+      delivered.delete(manager)
+      origins.delete(held.event.id)
+    }
+    const promoted = deliverNext(manager)
+    if (held !== undefined || promoted) emitCounts()
+  }
+
+  return {
+    attachManager,
+    respond,
+    flush,
+    getPendingCounts,
+    handleActiveWorkspaceChanged: emitCounts,
+  }
+}