bloby-bot 0.70.12 → 0.71.0

package/supervisor/harnesses/pi/providers/humanize-error.ts

@@ -48,6 +48,18 @@ const AUTH_RE =
 const BILLING_RE =
   /insufficient_quota|credit balance is too low|payment required|purchase more credits/i;
 
+// A text-only model rejecting an attached image. Vendors phrase it many ways:
+// OpenAI "Invalid content type. image_url is only supported by certain models",
+// OpenRouter "No endpoints found that support image input", others mention
+// "image input" / "does not support images" / "unsupported content type".
+// Only EXPLICIT image-naming phrases — the bare tokens "vision"/"multimodal"/
+// "modality" were removed because the provider body routinely echoes the model id
+// (e.g. "gpt-4-vision-preview", "llama-3.2-90b-vision-instruct"), which would
+// mis-classify an unrelated 400 from a vision-capable model and wrongly disable
+// vision for the rest of the session. Paired with a 400/415/422 status below.
+const IMAGE_UNSUPPORTED_RE =
+  /image[_ ]?url|image input|images?(?: are| is)? not supported|does not support images?|no endpoints? .*support image|unsupported content type/i;
+
 export function classifyPiError(
   providerLabel: string,
   status: number | undefined,
@@ -85,6 +97,19 @@ export function classifyPiError(
       message: `${providerLabel} rejected your API key. Update it from the dashboard (Bloby provider settings).${suffix}`,
     };
   }
+  // A text-only model that the catalog couldn't flag up front (dynamic/unknown
+  // sub-providers) 400/415/422s on the attached image. The session reacts by
+  // disabling vision for the rest of the session and re-running the round with
+  // images downgraded — self-healing so a single screenshot can't permanently
+  // 400-poison the conversation (it rides every stateless resend otherwise).
+  if ((status === 400 || status === 415 || status === 422) && IMAGE_UNSUPPORTED_RE.test(body)) {
+    return {
+      kind: 'image-unsupported',
+      retryable: false,
+      status,
+      message: `${providerLabel} rejected the attached image — this model appears to be text-only. Retrying without the image; switch to a vision-capable model to send images.${suffix}`,
+    };
+  }
   if (status === 429) {
     return {
       kind: 'rate-limit',
@@ -113,8 +138,8 @@ export function classifyPiError(
 export function classifyPiNetworkError(providerLabel: string, err: any): ClassifiedPiError {
   const raw = err?.message || String(err);
   // undici's body/headers timeouts surface as the famously cryptic 'terminated'
-  // and 'Headers Timeout Error' — translate them.
-  const stalled = /terminated|timeout/i.test(raw);
+  // and 'Headers Timeout Error'; our own SSE idle guard says 'stalled'.
+  const stalled = /terminated|timeout|stalled/i.test(raw);
   return {
     kind: 'transient',
     retryable: true,

package/supervisor/harnesses/pi/providers/retry.ts

@@ -51,6 +51,37 @@ export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   });
 }
 
+/** Per-chunk SSE idle guard (audit D6-7). Without it, a stalled-but-open
+ *  stream waits ~300s for Node's undici body timeout and then surfaces a
+ *  cryptic 'terminated'. 120s is generous: Anthropic pings every ~20s and
+ *  Gemini/OpenAI chunk every few seconds while healthy. */
+export const SSE_IDLE_TIMEOUT_MS = 120_000;
+
+export async function readWithIdleTimeout<T>(
+  reader: { read(): Promise<T>; cancel?: (reason?: any) => Promise<void> | void },
+  providerLabel: string,
+): Promise<T> {
+  let timer: NodeJS.Timeout | undefined;
+  const timeoutP = new Promise<never>((_, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`${providerLabel} stream stalled — no data received for ${SSE_IDLE_TIMEOUT_MS / 1000}s.`)),
+      SSE_IDLE_TIMEOUT_MS,
+    );
+  });
+  const readP = reader.read();
+  // Mark the losing read promise handled so a post-timeout rejection (after
+  // reader.cancel) never surfaces as an unhandledRejection.
+  readP.catch?.(() => {});
+  try {
+    return await Promise.race([readP, timeoutP]);
+  } catch (err) {
+    try { void reader.cancel?.(); } catch {}
+    throw err;
+  } finally {
+    clearTimeout(timer!);
+  }
+}
+
 export async function fetchWithRetry(
   url: string,
   init: RequestInit & { signal?: AbortSignal },

package/supervisor/harnesses/pi/providers/stream-anthropic.ts

@@ -20,7 +20,7 @@ import type {
   PiStopReason,
   PiUsage,
 } from './types.js';
-import { fetchWithRetry } from './retry.js';
+import { fetchWithRetry, readWithIdleTimeout } from './retry.js';
 import { classifyPiError, classifyPiNetworkError } from './humanize-error.js';
 
 /* ── SSE parser (shares the LF/CRLF-tolerant pattern from the other providers) ── */
@@ -32,7 +32,7 @@ async function* parseSse(res: Response): AsyncIterable<any> {
   let buffer = '';
   try {
     while (true) {
-      const { value, done } = await reader.read();
+      const { value, done } = await readWithIdleTimeout(reader, 'Anthropic');
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       let idx;
@@ -79,12 +79,24 @@ function toAnthropicContent(blocks: PiContentBlock[]): any[] {
   const out: any[] = [];
   for (const b of blocks) {
     if (b.type === 'text') {
+      // The Messages API rejects empty/whitespace-only text blocks ("text
+      // content blocks must be non-empty") — drop them; an all-empty message
+      // is then filtered by the content-length guards in toAnthropicMessages.
+      if (!b.text || !b.text.trim()) continue;
       out.push({ type: 'text', text: b.text });
     } else if (b.type === 'image') {
       out.push({
         type: 'image',
         source: { type: 'base64', media_type: b.mediaType, data: b.data },
       });
+    } else if (b.type === 'document') {
+      // Native PDF document block — the Messages API renders the pages and the
+      // model reads them as vision. The base64 document source accepts ONLY
+      // application/pdf (buildUserMessage gates it on canNativeDocument).
+      out.push({
+        type: 'document',
+        source: { type: 'base64', media_type: b.mediaType, data: b.data },
+      });
     } else if (b.type === 'tool_use') {
       out.push({
         type: 'tool_use',
@@ -105,13 +117,19 @@ function toAnthropicContent(blocks: PiContentBlock[]): any[] {
 }
 
 function toAnthropicMessages(pi: PiMessage[]): any[] {
-  return pi
+  const msgs = pi
     .filter((m) => m.content.length > 0)
     .map((m) => ({
       role: m.role === 'assistant' ? 'assistant' : 'user',
       content: toAnthropicContent(m.content),
     }))
     .filter((m) => m.content.length > 0);
+  // The Messages API requires the first message to be user-role. Rolling
+  // history windows (customer buffers) are trimmed user-first at the source
+  // (channels/manager.ts trimCustomerBuffer), but defend here too — a leading
+  // assistant message 400s the whole request (audit C-7).
+  while (msgs.length > 0 && msgs[0].role !== 'user') msgs.shift();
+  return msgs;
 }
 
 function toAnthropicTools(tools: { name: string; description: string; inputSchema: Record<string, any> }[]) {
@@ -166,6 +184,9 @@ export async function* streamAnthropic(req: PiStreamRequest): AsyncIterable<PiSt
   if (req.tools && req.tools.length > 0) {
     body.tools = toAnthropicTools(req.tools);
     body.tools[body.tools.length - 1].cache_control = { type: 'ephemeral' };
+    // Round-cap wrap-up: forbid further tool calls; tools stay declared so
+    // tool_use/tool_result blocks in history remain valid.
+    if (req.toolChoice === 'none') body.tool_choice = { type: 'none' };
   }
   if (Array.isArray(body.messages) && body.messages.length > 0) {
     const lastContent = body.messages[body.messages.length - 1].content;
@@ -213,6 +234,7 @@ export async function* streamAnthropic(req: PiStreamRequest): AsyncIterable<PiSt
   let usage: PiUsage | undefined;
   let chunkCount = 0;
   let firstChunkSummary = '';
+  let thinkingEmitted = false;
 
   try {
     for await (const evt of parseSse(res)) {
@@ -250,6 +272,12 @@ export async function* streamAnthropic(req: PiStreamRequest): AsyncIterable<PiSt
               toolArgsBuf: '',
             });
           } else {
+            // Extended-thinking blocks (not requested today, future-proofed):
+            // one liveness pulse, text never forwarded.
+            if (block.type === 'thinking' && !thinkingEmitted) {
+              thinkingEmitted = true;
+              yield { type: 'thinking' };
+            }
             blocks.set(idx, { kind: 'other' });
           }
           break;

package/supervisor/harnesses/pi/providers/stream-google.ts

@@ -18,7 +18,7 @@ import type {
   PiStopReason,
   PiUsage,
 } from './types.js';
-import { fetchWithRetry } from './retry.js';
+import { fetchWithRetry, readWithIdleTimeout } from './retry.js';
 import { classifyPiError, classifyPiNetworkError } from './humanize-error.js';
 
 /** Walk an SSE byte stream and yield each parsed JSON event. */
@@ -30,7 +30,7 @@ async function* parseSse(res: Response, dbg: { firstBytes: string }): AsyncItera
   let totalBytes = 0;
   try {
     while (true) {
-      const { value, done } = await reader.read();
+      const { value, done } = await readWithIdleTimeout(reader, 'Google Gemini');
       if (done) break;
       if (value) totalBytes += value.byteLength;
       buffer += decoder.decode(value, { stream: true });
@@ -102,6 +102,11 @@ function toGeminiParts(content: PiContentBlock[]): any[] {
       parts.push({ text: b.text });
     } else if (b.type === 'image') {
       parts.push({ inlineData: { mimeType: b.mediaType, data: b.data } });
+    } else if (b.type === 'document') {
+      // Gemini ingests application/pdf inline via the same inlineData shape as
+      // images (it OCRs/renders the document). buildUserMessage only routes a
+      // document block here when the flavor supports it.
+      parts.push({ inlineData: { mimeType: b.mediaType, data: b.data } });
     } else if (b.type === 'tool_use') {
       // Assistant turn: the model asked to invoke a tool. Thinking-capable
       // Gemini 3.x rejects (HTTP 400) any echoed functionCall whose
@@ -203,11 +208,25 @@ export async function* streamGoogle(req: PiStreamRequest): AsyncIterable<PiStrea
       maxOutputTokens: req.maxOutputTokens ?? 32768,
     },
   };
+  // Thinking-capable families (2.5+/3.x): ask for thought summaries so the
+  // harness can emit a liveness pulse — without this, Gemini 3 burns its
+  // output budget on invisible reasoning and the chat looks hung. Gated by
+  // model id; unknown/dynamic ids skip it (older models reject the field).
+  // The rolling aliases (gemini-flash-latest / gemini-flash-lite-latest)
+  // resolve to 2.5+/3.x thinking models too (review PI-D-2).
+  if (/gemini-(2\.5|[3-9]|flash(-lite)?-latest)/i.test(req.modelId)) {
+    body.generationConfig.thinkingConfig = { includeThoughts: true };
+  }
   if (req.systemPrompt?.trim()) {
     body.systemInstruction = { parts: [{ text: req.systemPrompt }] };
   }
   if (req.tools && req.tools.length > 0) {
     body.tools = toGeminiTools(req.tools);
+    // Round-cap wrap-up: forbid further function calls; tools stay declared so
+    // functionCall/functionResponse parts in history remain valid.
+    if (req.toolChoice === 'none') {
+      body.toolConfig = { functionCallingConfig: { mode: 'NONE' } };
+    }
   }
 
   let res: Response;
@@ -263,7 +282,11 @@ export async function* streamGoogle(req: PiStreamRequest): AsyncIterable<PiStrea
       for (const part of parts) {
         // Thinking models emit reasoning parts with `thought: true`. They
         // shouldn't be shown to the user as part of the visible answer.
-        if (part?.thought) { thoughtPartCount++; continue; }
+        if (part?.thought) {
+          thoughtPartCount++;
+          if (thoughtPartCount === 1) yield { type: 'thinking' };
+          continue;
+        }
         if (part?.functionCall && typeof part.functionCall.name === 'string') {
           // Gemini doesn't surface a tool-call id of its own; bake the tool
           // name into the id so the session can echo it back as a

package/supervisor/harnesses/pi/providers/stream-openai-completions.ts

@@ -18,7 +18,7 @@ import type {
   PiStopReason,
   PiUsage,
 } from './types.js';
-import { fetchWithRetry } from './retry.js';
+import { fetchWithRetry, readWithIdleTimeout } from './retry.js';
 import { classifyPiError, classifyPiNetworkError } from './humanize-error.js';
 
 /* ── SSE parser (LF or CRLF tolerant, flushes the trailing event) ── */
@@ -30,7 +30,7 @@ async function* parseSse(res: Response): AsyncIterable<any> {
   let buffer = '';
   try {
     while (true) {
-      const { value, done } = await reader.read();
+      const { value, done } = await readWithIdleTimeout(reader, 'OpenAI-compat');
       if (done) break;
       buffer += decoder.decode(value, { stream: true });
       let idx;
@@ -119,24 +119,33 @@ function toOpenAIMessages(pi: PiMessage[]): any[] {
       out.push(msg);
       continue;
     }
-    // role === 'user' with non-tool-result content (text + optional images)
+    // role === 'user' with non-tool-result content (text + optional images).
+    // Media parts go first; text is appended last (parity with the other
+    // providers and pi/index's media-first block ordering).
     const contentBlocks: any[] = [];
     let plainText = '';
-    let hasImage = false;
+    let hasMedia = false;
     for (const b of m.content) {
       if (b.type === 'text') {
         plainText += (plainText ? '\n' : '') + b.text;
       } else if (b.type === 'image') {
-        hasImage = true;
+        hasMedia = true;
         contentBlocks.push({
           type: 'image_url',
           image_url: { url: `data:${b.mediaType};base64,${b.data}` },
         });
+      } else if (b.type === 'document') {
+        // The Chat Completions schema has no document part — degrade to a text
+        // note rather than crashing. The file is also on disk (saved-files
+        // note), so the agent can open it with its tools. This shouldn't
+        // normally happen: buildUserMessage gates documents on canNativeDocument
+        // (false for this flavor), so a PDF here rides as the disk pointer.
+        plainText += (plainText ? '\n' : '') +
+          `[Attached document${b.name ? ` "${b.name}"` : ''} (${b.mediaType}) could not be inlined for this model — it is saved to disk; open it with your file tools.]`;
       }
     }
-    if (hasImage) {
-      // Mixed image+text: prepend text part to the content array.
-      if (plainText) contentBlocks.unshift({ type: 'text', text: plainText });
+    if (hasMedia) {
+      if (plainText) contentBlocks.push({ type: 'text', text: plainText });
       out.push({ role: 'user', content: contentBlocks });
     } else {
       out.push({ role: 'user', content: plainText });
@@ -203,7 +212,10 @@ export async function* streamOpenAICompletions(req: PiStreamRequest): AsyncItera
   }
   if (req.tools && req.tools.length > 0) {
     body.tools = toOpenAITools(req.tools);
-    body.tool_choice = 'auto';
+    // 'none' = the round-cap wrap-up round: the model must summarize, not
+    // start more work. Tools stay declared so histories containing tool calls
+    // remain valid.
+    body.tool_choice = req.toolChoice === 'none' ? 'none' : 'auto';
   }
 
   let res: Response;
@@ -243,6 +255,7 @@ export async function* streamOpenAICompletions(req: PiStreamRequest): AsyncItera
   const toolCallsByIndex = new Map<number, PartialToolCall>();
   let chunkCount = 0;
   let firstChunkSummary = '';
+  let thinkingEmitted = false;
 
   // Vendors disagree on where streamed usage lives: spec says a final
   // choice-less chunk's `usage`, Groq defaults to nesting under `x_groq.usage`,
@@ -267,6 +280,16 @@ export async function* streamOpenAICompletions(req: PiStreamRequest): AsyncItera
       readUsage(choice?.usage);
       const delta = choice.delta || {};
 
+      // Reasoning models stream hidden thinking under vendor-specific fields
+      // (DeepSeek/OpenRouter: reasoning_content; others: reasoning /
+      // reasoning_text — upstream pi's field priority). Emit ONE liveness
+      // pulse so the chat doesn't look hung; never forward the text itself.
+      const reasoningDelta = delta.reasoning_content ?? delta.reasoning ?? delta.reasoning_text;
+      if (!thinkingEmitted && typeof reasoningDelta === 'string' && reasoningDelta.length > 0) {
+        thinkingEmitted = true;
+        yield { type: 'thinking' };
+      }
+
       if (typeof delta.content === 'string' && delta.content.length > 0) {
         accumulated += delta.content;
         yield { type: 'text_delta', delta: delta.content };

package/supervisor/harnesses/pi/providers/types.ts

@@ -17,6 +17,11 @@ export type PiRole = 'user' | 'assistant' | 'tool';
 export type PiContentBlock =
   | { type: 'text'; text: string }
   | { type: 'image'; mediaType: string; data: string }   // base64
+  // Native document block (PDF). Only the flavors with native document support
+  // (anthropic-messages, google-gemini) ever receive one — buildUserMessage
+  // gates it on canNativeDocument; openai-completions degrades it to a text
+  // note rather than crashing if one ever reaches it.
+  | { type: 'document'; mediaType: string; data: string; name?: string }  // base64
   // `thoughtSignature` is a Gemini 3.x thinking-model field. Pi-flavored
   // providers that emit reasoning attach it to function-call parts; the API
   // rejects the next turn with HTTP 400 if we don't echo it back verbatim.
@@ -56,6 +61,13 @@ export interface PiStreamRequest {
    * that 422 on the `stream_options.include_usage` opt-in. Default true.
    */
   includeStreamUsage?: boolean;
+  /**
+   * 'none' forbids tool calls for this request (mapped per flavor: OpenAI
+   * tool_choice:'none', Anthropic {type:'none'}, Gemini functionCallingConfig
+   * mode NONE). Used by the session's round-cap wrap-up round, where the model
+   * must summarize instead of starting more work.
+   */
+  toolChoice?: 'auto' | 'none';
   /** Optional abort signal so the session can interrupt in-flight requests. */
   signal?: AbortSignal;
 }
@@ -67,11 +79,27 @@ export type PiStopReason = 'end_turn' | 'tool_use' | 'max_tokens' | 'error' | 'a
  * string-matching: retry transient rounds, tear down on auth/overflow, and
  * show actionable messages instead of raw provider JSON.
  */
-export type PiErrorKind = 'auth' | 'context-overflow' | 'rate-limit' | 'billing' | 'transient' | 'other';
+export type PiErrorKind =
+  | 'auth'
+  | 'context-overflow'
+  | 'rate-limit'
+  | 'billing'
+  | 'transient'
+  /** The model rejected an image/vision/modality block (a text-only model 400/
+   *  415/422s on the attached image). The session reacts by disabling vision
+   *  for the rest of the session and re-running the round with images
+   *  downgraded to placeholders — self-healing for dynamic/unknown models whose
+   *  catalog can't tell us up front whether they see images. */
+  | 'image-unsupported'
+  | 'other';
 
 export type PiStreamEvent =
   | { type: 'text_delta'; delta: string }
   | { type: 'text_end'; text: string }
+  /** Emitted when the model starts (visibly) reasoning — a liveness pulse for
+   *  thinking models so the chat doesn't look hung. Reasoning TEXT is never
+   *  forwarded (it would corrupt the streamed-text == response contract). */
+  | { type: 'thinking' }
   | { type: 'tool_use'; id: string; name: string; input: any; thoughtSignature?: string }
   | { type: 'done'; stopReason: PiStopReason; usage?: PiUsage }
   | { type: 'error'; error: string; status?: number; kind?: PiErrorKind; retryable?: boolean };

package/supervisor/harnesses/pi/session.ts

@@ -44,6 +44,8 @@ export type PiSessionEvent =
   | { type: 'turn_started' }
   | { type: 'text_delta'; delta: string }
   | { type: 'text_end'; text: string }
+  /** Liveness pulse: the model is reasoning (thinking models) — no text attached. */
+  | { type: 'thinking' }
   | { type: 'tool_use'; id: string; name: string; input: any }
   | { type: 'tool_result'; toolUseId: string; name: string; isError?: boolean }
   | {
@@ -78,6 +80,10 @@ export interface PiSessionAuth {
   includeStreamUsage?: boolean;
   /** Model context window from the catalog — reported on turn_complete for the recycler. */
   contextWindow?: number;
+  /** False when the catalog says the model is text-only — image blocks are
+   *  downgraded to placeholders on send so one screenshot can't 400-poison
+   *  the session (audit C-8). Undefined (dynamic models) ⇒ assume vision. */
+  supportsImages?: boolean;
 }
 
 export interface PiSessionInit {
@@ -117,6 +123,51 @@ export interface PiSession {
   getMessages(): PiMessage[];
 }
 
+/** Transform-on-send for text-only models (audit C-8): image blocks become
+ *  placeholders in the REQUEST only — the stored history keeps the images, so
+ *  switching to a vision model later restores them. */
+function downgradeImages(messages: PiMessage[]): PiMessage[] {
+  let any = false;
+  const out = messages.map((m) => {
+    if (!m.content.some((b) => b.type === 'image')) return m;
+    any = true;
+    return {
+      ...m,
+      content: m.content.map((b): PiContentBlock =>
+        b.type === 'image'
+          ? { type: 'text', text: '[An image was attached here, but the current model cannot view images. Tell the user to switch to a vision-capable model if the image matters.]' }
+          : b,
+      ),
+    };
+  });
+  return any ? out : messages;
+}
+
+/** Emergency in-turn context relief (audit D2-6): when occupancy crosses the
+ *  threshold MID-turn (recycling only acts between idle turns), stub out the
+ *  oldest large tool_result payloads — never user/assistant text, never the
+ *  protected tail (the current round's results). Cruder than real compaction,
+ *  but the turn finishes instead of 400ing on the context wall. */
+function trimOldToolResults(messages: PiMessage[], charsToFree: number, protectTail: number): number {
+  let freed = 0;
+  const limit = Math.max(0, messages.length - protectTail);
+  for (let i = 0; i < limit && freed < charsToFree; i++) {
+    const m = messages[i];
+    if (m.role !== 'user') continue;
+    for (const b of m.content) {
+      if (b.type === 'tool_result' && typeof b.content === 'string' && b.content.length > 2048) {
+        freed += b.content.length;
+        b.content = `[tool output trimmed to fit the context window — ~${Math.round(b.content.length / 1024)} KB removed]`;
+        if (freed >= charsToFree) break;
+      }
+    }
+  }
+  return freed;
+}
+
+const ROUND_CAP_NOTICE =
+  '[System: the tool budget for this turn is exhausted. Stop working now. In 2-3 sentences, summarize what you completed, what remains, and the exact next step.]';
+
 const FILE_TOOL_NAMES = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit', 'write', 'edit', 'multiEdit', 'notebookEdit']);
 const MAX_TOOL_ROUNDS = 25;
 /** Transparent re-runs of a failed round that produced nothing (audit D6-1). */
@@ -130,6 +181,14 @@ export function createPiSession(init: PiSessionInit): PiSession {
   let lastUsage: PiUsage | undefined;
   let lastContextWindow: number | undefined;
 
+  // Self-healing vision (audit D rank 12): when a model the catalog couldn't
+  // classify (dynamic/unknown sub-providers ⇒ supportsImages undefined) rejects
+  // an image with an 'image-unsupported' error, latch this for the rest of the
+  // session and downgrade images on every subsequent send. The IMAGE stays in
+  // history (downgradeImages is transform-on-send only), so switching to a
+  // vision-capable model later restores it.
+  let visionDisabled = false;
+
   /** One stream round — collect the assistant blocks the model emits this pass. */
   interface RoundResult {
     text: string;
@@ -142,7 +201,7 @@ export function createPiSession(init: PiSessionInit): PiSession {
     retryable?: boolean;
   }
 
-  async function runOneRound(emitSeparatorFirst: boolean): Promise<RoundResult> {
+  async function runOneRound(emitSeparatorFirst: boolean, opts?: { wrapUp?: boolean }): Promise<RoundResult> {
     const result: RoundResult = { text: '', toolUses: [], errored: false };
     let firstDelta = true;
     try {
@@ -153,8 +212,13 @@ export function createPiSession(init: PiSessionInit): PiSession {
         baseUrl: auth.baseUrl,
         apiKey: auth.apiKey,
         systemPrompt: init.systemPrompt,
-        messages,
+        // Downgrade images when the catalog says text-only (supportsImages
+        // false) OR a prior round in THIS session learned it the hard way via
+        // an 'image-unsupported' error (visionDisabled). The stored history
+        // keeps the image so a later vision-capable model still restores it.
+        messages: auth.supportsImages === false || visionDisabled ? downgradeImages(messages) : messages,
         tools: init.tools,
+        toolChoice: opts?.wrapUp ? 'none' : undefined,
         maxOutputTokens: auth.maxOutputTokens,
         maxTokensField: auth.maxTokensField,
         includeStreamUsage: auth.includeStreamUsage,
@@ -182,6 +246,9 @@ export function createPiSession(init: PiSessionInit): PiSession {
             // at the end of the whole turn so the UI doesn't show half-answers.
             result.text = evt.text;
             break;
+          case 'thinking':
+            init.onEvent({ type: 'thinking' });
+            break;
           case 'tool_use':
             result.toolUses.push({
               id: evt.id,
@@ -189,7 +256,12 @@ export function createPiSession(init: PiSessionInit): PiSession {
               input: evt.input,
               thoughtSignature: evt.thoughtSignature,
             });
-            init.onEvent({ type: 'tool_use', id: evt.id, name: evt.name, input: evt.input });
+            // Wrap-up rounds forbid tools (toolChoice 'none'); if a vendor
+            // ignores that, swallow the phantom call silently — it is never
+            // executed or persisted.
+            if (!opts?.wrapUp) {
+              init.onEvent({ type: 'tool_use', id: evt.id, name: evt.name, input: evt.input });
+            }
             break;
           case 'error':
             result.errored = true;
@@ -270,6 +342,21 @@ export function createPiSession(init: PiSessionInit): PiSession {
         res = await runOneRound(needsSeparator);
       }
 
+      // Self-healing vision (audit D rank 12): a model the catalog couldn't
+      // classify just 400/415/422'd on an attached image. Latch visionDisabled
+      // and re-run the round ONCE — runOneRound now downgrades images on send,
+      // so the resend succeeds. Guarded by !visionDisabled so it fires at most
+      // once per session; an image rides every stateless resend, so without
+      // this the whole conversation would keep re-400ing.
+      if (
+        res.errored && res.errorKind === 'image-unsupported' && !visionDisabled &&
+        !init.abortController.signal.aborted
+      ) {
+        log.info('[pi/session] model rejected image — disabling vision for this session and retrying without it');
+        visionDisabled = true;
+        res = await runOneRound(needsSeparator);
+      }
+
       const { text, toolUses, errored } = res;
 
       // Append whatever the model produced this round to history so subsequent
@@ -331,10 +418,63 @@ export function createPiSession(init: PiSessionInit): PiSession {
         messages.push({ role: 'user', content: toolResultBlocks });
       }
 
+      // Emergency in-turn context relief (audit D2-6): recycling only acts
+      // between idle turns, so a single heavy tool loop could cross the wall
+      // mid-turn. Above 85% occupancy, stub the oldest large tool outputs to
+      // bring the next request back toward 70%.
+      if (lastContextWindow && lastUsage) {
+        const occupancy =
+          (lastUsage.inputTokens || 0) + (lastUsage.cacheReadTokens || 0) + (lastUsage.cacheCreationTokens || 0);
+        if (occupancy > 0.85 * lastContextWindow) {
+          const charsToFree = (occupancy - Math.floor(0.7 * lastContextWindow)) * 4; // ~4 chars/token
+          const freed = trimOldToolResults(messages, charsToFree, 4);
+          if (freed > 0) {
+            log.info(`[pi/session] context at ${occupancy}/${lastContextWindow} tok mid-turn — trimmed ~${Math.round(freed / 1024)} KB of old tool output`);
+          }
+        }
+      }
+
       // No tool calls ⇒ the model is done with this turn.
       if (toolUses.length === 0) { roundCapHit = false; break; }
     }
 
+    // Round-cap wrap-up (audit D5-8): the budget ran out with the model still
+    // mid-task. Run ONE final no-tools round so the turn ends with an honest
+    // status summary instead of silent truncation. roundCapHit stays true on
+    // turn_complete — consumers still know the work is incomplete.
+    if (roundCapHit && !turnErrored && !init.abortController.signal.aborted) {
+      log.info(`[pi/session] tool-round budget (${maxRounds}) exhausted — running a no-tools wrap-up round`);
+      messages.push({ role: 'user', content: [{ type: 'text', text: ROUND_CAP_NOTICE }] });
+      const needsSeparator = accumulatedText.length > 0 && !accumulatedText.endsWith('\n');
+      const res = await runOneRound(needsSeparator, { wrapUp: true });
+      if (res.text) {
+        if (needsSeparator) accumulatedText += '\n\n';
+        accumulatedText += res.text;
+        messages.push({ role: 'assistant', content: [{ type: 'text', text: res.text }] });
+      } else {
+        // The notice was never answered — pop it so the NEXT turn doesn't
+        // open under a stale "stop working now" instruction (review PI-D-1).
+        const last = messages[messages.length - 1];
+        if (last?.role === 'user' && last.content.length === 1 &&
+            last.content[0].type === 'text' && last.content[0].text === ROUND_CAP_NOTICE) {
+          messages.pop();
+        }
+      }
+      // Fatal wrap-up failures (dead key / context wall) must still tear the
+      // session down, and a cap-hit turn with NO text at all must not end in
+      // total silence — claude surfaces error_max_turns and pi's one-shot
+      // paths guard this state too (PI-C-2). Set the turn-error fields so the
+      // standard emission below handles both (review PI-D-1).
+      if (res.errored && (res.errorKind === 'auth' || res.errorKind === 'context-overflow')) {
+        turnErrored = true;
+        turnErrorMsg = res.errorMsg;
+        turnErrorKind = res.errorKind;
+      } else if (!accumulatedText) {
+        turnErrored = true;
+        turnErrorMsg = `I hit my tool budget for this turn (${maxRounds} rounds) before finishing — say "continue" and I'll pick up where I left off.`;
+      }
+    }
+
     // Turn-end emission order (audit D6-2, mirrors claude.ts:394-401):
     //   1. text_end whenever ANY text streamed — even on errored turns, so the
     //      partial the user watched is committed, persisted, and consumes its