litura-app 0.4.2 → 0.5.0

package/SPEC.md

@@ -18,33 +18,33 @@ The product does not claim to determine whether text was written by AI. Its revi
 ## 2. Interface
 
 ```text
-+---------------------------------------------------------------+
-| [logo]                        Style 3  settings |
-+---------------------------------------------------------------+
-|                                                               |
-|          WORKING DOCUMENT             | finding card        |
-|                                       |                     |
-|          CodeMirror editor            | finding card        |
-|          (never moves for a card)     |                     |
-|      highlighted review findings      | [< 2 of 3 >] card   |
-|                                                               |
-|          chat messages and replies                            |
-|          [Review draft] reviewing...                          |
-|          +-----------------------------------------+           |
-|          | attached-passage chip                  |           |
-|          | Ask anything...                        |           |
-|          +-----------------------------------------+           |
-+---------------------------------------------------------------+
++--------+------------------------------------------------------+
+| Files  | [sidebar]                Style 3  settings |
+| list   +------------------------------------------------------+
+| New    |                                                      |
+| Open…  |          WORKING DOCUMENT             | finding card |
+| Save…  |                                       |              |
+| History|          CodeMirror editor            | finding card |
+|        |          (never moves for a card)     |              |
+|        |      highlighted review findings      | [< 2 of 3 >] card |
+|        |                                                      |
+|        |          chat messages and replies                   |
+|        |          [Review draft] reviewing...                 |
+|        |          +-----------------------------------------+  |
+|        |          | attached-passage chip                  |  |
+|        |          | Ask anything...                        |  |
+|        |          +-----------------------------------------+  |
++--------+------------------------------------------------------+
 ```
 
-The current product has one working-document pane. There is no separate context pane, file browser, or document list.
+The current product has one working-document pane and a file sidebar. There is no separate context pane.
 
 ### Header
 
-One row, and nothing in it spends a model call. Everything about the file is behind the logo, and the local score sits at the far end. The header is the frame the draft is read in — it carries no file name and no status line of its own.
+One row, and nothing in it spends a model call. Everything about the file lives in the sidebar behind the sidebar toggle, and the local score sits at the far end. The header is the frame the draft is read in — it carries no file name and no status line of its own.
 
-- Logo button opening the document menu: `Open a file…`, `Export a copy`, `History`.
-- Save trouble — a save error, or a paused autosave after a conflict — is reported in the chat stream, where the writer is already reading. Routine saves are silent.
+- Sidebar toggle opening the file sidebar: the list of Markdown and text files next to the draft, a filter, and `New`, `Open a file…`, `Save as new…`, `History`. Opening a listed file replaces the workspace draft at once — the click is the intent, and the previous text is kept in History.
+- Save trouble — a save error, or disk writes waiting on an unresolved divergence — is named where the writer is already reading. Routine saves are silent.
 - Local style signals, labelled `Style` with a count of marked passages, when the draft is predominantly Latin script. Hidden otherwise.
 - Settings button.
 
@@ -163,6 +163,8 @@ Editing inside the attached passage ends the attachment and cancels an in-flight
 
 Clicking any finding shows its card and offers a bubble with `Add to context` and `Suggest rewrites`. It makes no model request: the card carries a single `Options` control, and reading the remark and fixing the sentence by hand is a complete outcome. Clicking the same mark again returns to its card rather than repeating the remark.
 
+The bubble is placed inside the writing pane and below the header, never over the sidebar or the fixed header band: a toolbar a chrome layer covers is a toolbar that looks present and swallows the click meant for it. It is anchored to the words it was raised on: a scroll, the panel opening under it or a window resize carries it along with them, and it hides while they are scrolled out of the pane. Only an edit, which may remove those words, takes it away.
+
 There is one replacement scope, and it is the quoted passage. The tint in the draft and the range a rewrite would replace are the same span, so a finding never silently rewrites more than it marked, and the card asks for nothing before it can be used. A structural finding names a problem with the paragraph around its quote; its rewrite still replaces the quote, and the whole document goes to the model as context. A change that has to move material between paragraphs is a conversation: typing in the composer with a finding attached opens one.
 
 For an ordinary selection, the next composer message becomes the rewrite instruction.
@@ -189,7 +191,7 @@ The conversation survives a reload. A message sent with a finding attached carri
 
 ### 3.6 Continuation suggestions
 
-After 900 milliseconds without typing, a suggestion may be requested when:
+After 200 milliseconds without typing, a suggestion may be requested when:
 
 - the document contains at least 15 non-whitespace characters;
 - the selection is collapsed;
@@ -199,7 +201,7 @@ After 900 milliseconds without typing, a suggestion may be requested when:
 
 Only typing (including composition) starts this timer. Paste, deletion, Undo, Redo, loading a document and accepting an AI edit cancel pending suggestions without requesting another one.
 
-A failed continuation says so in the status line; the next successful request clears its error. The model may return an empty continuation when the thought is finished or continuing would invent facts or the author's intent. Non-empty output is a single line of at most 15 words; one word or punctuation alone is allowed. The provider returns `NONE`, `TEXT: …` for new words or punctuation, or `WORD: …` for missing letters, so prose quotation marks do not need JSON escaping. The HTTP response still uses `{ suggestion: string }`. Invalid output is reported as an error and never inserted. Spacing is applied at the insertion boundary; repeated tails are removed only at word boundaries. A valid continuation appears in a block below the current line, is announced to assistive technology, and does not enter the document until accepted.
+A failed continuation says so in the notice; the next successful request clears its error. The model may return an empty continuation when the thought is finished or continuing would invent facts or the author's intent. Non-empty output is a single line of at most 15 words; one word or punctuation alone is allowed. The provider returns `NONE`, `TEXT: …` for new words or punctuation, or `WORD: …` for missing letters, so prose quotation marks do not need JSON escaping. The HTTP response still uses `{ suggestion: string }`. Invalid output is reported as an error and never inserted. Spacing is applied at the insertion boundary; repeated tails are removed only at word boundaries. A valid continuation appears in a block below the current line, is announced to assistive technology, and does not enter the document until accepted.
 
 - `Tab`: insert the suggestion at its original cursor position.
 - `Escape`: dismiss it and cancel pending work, even before an answer arrives.
@@ -229,7 +231,7 @@ The settings dialog:
 
 All settings take effect immediately; there is no Save button.
 
-When no model is selected, the review, rewrite, chat, and manual-continuation actions re-check Pi status once, then report the missing setup in the composer and open this dialog instead of failing silently. Automatic review and continuation suggestions stay silent and make no request.
+When no model is selected, the review, rewrite, chat, and manual-continuation actions re-check Pi status once, then report the missing setup in the notice and open this dialog instead of failing silently. Automatic review and continuation suggestions stay silent and make no request.
 
 ## 4. State and privacy
 
@@ -256,13 +258,15 @@ Each edit updates the browser working copy and schedules a disk save after 800 m
 
 At startup, the editor waits for the server to identify and read the draft. It restores this tab's working copy when available, otherwise the document's shared browser copy, otherwise the disk text. An empty browser copy is distinct from a missing one. Legacy unscoped browser text is offered for export, not silently imported into another workspace.
 
-If browser and disk differ at startup, or the disk revision changes when the window regains focus or visibility, Litura pauses autosave. The conflict dialog shows both copies and offers `Use disk copy`, `Keep browser copy`, or `Export browser copy`. Closing the dialog does not resume saving. Choosing a copy resumes revision-checked saving; another external change can cause a new conflict. Nothing is merged automatically.
+If browser and disk differ at startup, or the disk revision changes when the window regains focus or visibility, Litura never opens a modal. When the browser copy is untouched since the last confirmed save it takes the disk copy silently; when only one side moved there is nothing to decide. Only two genuinely diverged copies raise a slim banner above the draft — `Load disk`, `Keep mine`, and a `What changed` word diff — while the draft stays editable and only disk writes wait. Choosing a copy resumes revision-checked saving; another external change can raise the banner again. Nothing is merged automatically.
 
 Save errors remain visible and pause autosave until the writer retries. A failed request does not advance the recorded disk revision. The browser warns before leaving while a save is in flight or the working text differs from the last confirmed disk copy.
 
 Findings are restored only when their stored document text exactly matches the loaded draft, then their quotes are re-anchored. Chat restores messages, not finding cards or rewrite previews. Replacing the document clears findings, dismissed findings and chat, and keeps a browser checkpoint of the previous text. Keeping an AI replacement also creates a checkpoint. Rewrite previews alone change neither stored copy.
 
-`Cmd/Ctrl+S` requests an immediate disk save, respecting any paused conflict or error. `Export a copy` downloads the current text using the workspace draft's filename. `Open a file…` and drag-and-drop accept `.md`, `.markdown` and `.txt` files up to 1 MiB and ask before importing. Import replaces the current workspace draft's contents; it does not switch the server to the imported file's path. History can restore a previous version after confirmation while keeping a checkpoint of the current text.
+`Cmd/Ctrl+S` requests an immediate disk save, respecting any paused conflict or error. `Export a copy` downloads the current text using the workspace draft's filename. `Open a file…` and drag-and-drop accept `.md`, `.markdown` and `.txt` files up to 1 MiB and import without asking. Import replaces the current workspace draft's contents; it does not switch the server to the imported file's path. History restores a previous version at once while keeping a checkpoint of the current text. `New`, import and restore never ask first: the replaced text goes to History, and the notice offers `Undo` for a few seconds.
+
+Everything the app reports outside the conversation — save and load trouble, model errors, confirmations with `Undo` — appears in one notice at the bottom-left, one at a time. Passing notices fade after six seconds; problems stay until their action or `×`. A chat answer never shows the raw edit list: a response that drops the `<litura-edits>` tags still yields edit cards.
 
 Every model-backed action sends the current full document to the selected provider. Rewrite and review requests additionally send the relevant selection or target passages.
 
@@ -343,6 +347,8 @@ All bodies and non-streaming responses are JSON unless noted.
 | `GET` | `/draft` | `{ text, path, id, exists, revision }`; a missing file has empty text and revision `missing` |
 | `PUT` | `/draft` | Save `{ text, revision }`; returns `{ saved: true, text, path, id, exists, revision }`, or `409` with `{ error, current }` when the revision differs |
 | `GET` | `/draft/history` | `{ snapshots }`, latest 20 disk backups with `text`, `at` and `revision` |
+| `GET` | `/files` | `{ files }`: Markdown and text files next to the draft, each with `name`, `size`, `mtime` and a markup-stripped `excerpt` (first meaningful prose, ~160 chars) for the card preview, sorted by name |
+| `GET` | `/file?name=` | `{ name, text }` for one workspace file by basename; `400` for anything that is not a plain Markdown or text name, `404` when it is gone, `413` past 1 MB |
 | `GET` | `/api/version` | `{ name, current }`; with `?check=1` also `latest` from the npm registry, or `error` if it is unreachable |
 | `GET` | `/api/agent/status` | Providers, models, auth status, and default selection |
 | `POST` | `/api/agent/credentials` | Save a provider API key through Pi |

package/document-store.js

@@ -24,8 +24,16 @@ export function documentStore(filename) {
     let files;
     try { files = fs.readdirSync(historyDir); }
     catch (error) { if (error.code === 'ENOENT') return []; throw error; }
-    return files.filter(name => /^\d+-[a-f0-9-]+\.json$/.test(name)).sort().reverse().slice(0, 20)
-      .map(name => JSON.parse(fs.readFileSync(path.join(historyDir, name), 'utf8')));
+    const items = [];
+    for (const name of files.filter(name => /^\d+-[a-f0-9-]+\.json$/.test(name)).sort().reverse().slice(0, 20)) {
+      try {
+        const item = JSON.parse(fs.readFileSync(path.join(historyDir, name), 'utf8'));
+        if (item && typeof item.text === 'string' && typeof item.at === 'string' && typeof item.revision === 'string') items.push(item);
+      } catch {
+        // One corrupt snapshot must not hide the rest of the history.
+      }
+    }
+    return items;
   }
   function write(text, revision) {
     if (typeof text !== 'string' || typeof revision !== 'string') throw Object.assign(new Error('text and revision are required strings'), { status: 400 });

package/editing.js

@@ -62,3 +62,30 @@ function coarseDiff(a, b) {
     { type: 'keep', text: end ? a.slice(-end).join('') : '' },
   ].filter(op => op.text);
 }
+
+// Whose turn it is when the disk copy moved under the editor. lastDisk is
+// the text we last confirmed on disk (durable across restarts); local is
+// the editor now, disk is freshly read. No merge exists, only a verdict:
+// - 'in-sync': nothing to do, adopt the fresh revision quietly.
+// - 'fast-forward': the writer changed nothing since the last save — take
+//   the disk copy silently, no question asked.
+// - 'diverged': both sides moved since the baseline — ask, but never modal.
+// An unknown baseline (legacy installs) can only answer 'diverged': without
+// proof the writer stood still, silence would discard their work.
+export function resolveDrift(local, disk, lastDisk) {
+  if (local === disk) return 'in-sync';
+  if (lastDisk !== undefined && local === lastDisk) return 'fast-forward';
+  return 'diverged';
+}
+
+// Mark bubble box inside `area` (the writing pane below the header). Above
+// the line, clear of its words; below with a gap when the header leaves no
+// room above; pinned inside when the pane is narrower than the bubble.
+export function clampBubble(x, y, size, area) {
+  const width = Math.min(size.w, area.right - area.left);
+  const left = Math.max(area.left, Math.min(x - width / 2, area.right - width));
+  let top = y - size.h - 4;
+  if (top < area.top) top = y + 20;
+  if (top + size.h > area.bottom) top = Math.max(area.top, area.bottom - size.h);
+  return { left, top };
+}

package/index.js

@@ -108,6 +108,60 @@ const STYLE_FILE = process.env.STYLE_FILE
   || [path.join(CWD, 'style.md'), path.join(ROOT, 'style.md')].find(p => fs.existsSync(p))
   || path.join(CWD, 'style.md');
 
+// ─── Workspace files ───────────────────────────────────────────────────────
+// The sidebar lists the Markdown and text files sitting next to the draft,
+// so the writer can pull one into the workspace without leaving the page.
+// The anchor is the draft's own folder, not the process working directory:
+// DRAFT_FILE may point elsewhere, and the listing must follow the draft.
+// Listing and reading only: writing stays with the draft CAS. Names are
+// basenames with an approved extension, resolved inside that folder —
+// anything else is a 400, never a filesystem walk.
+const WORKSPACE_EXTENSIONS = new Set(['.md', '.markdown', '.txt']);
+const FILES_DIR = path.dirname(path.resolve(DRAFT_FILE));
+function workspaceFile(name) {
+  if (typeof name !== 'string' || !name || name.includes('\0')) return null;
+  if (path.basename(name) !== name) return null;
+  if (!WORKSPACE_EXTENSIONS.has(path.extname(name).toLowerCase())) return null;
+  const resolved = path.join(FILES_DIR, name);
+  if (path.resolve(FILES_DIR, name) !== resolved) return null;
+  return resolved;
+}
+
+// Two-line card preview: the first ~160 chars of actual prose. Markup is
+// stripped line by line — headings, links, images, tags, comments and
+// frontmatter — so the card never shows `<img …>` or `#` artefacts.
+// Cut on a word boundary; a sliced half-word reads as a typo.
+function cardExcerpt(text) {
+  const lines = text.replace(/<!--[\s\S]*?-->/g, ' ').split('\n');
+  let inFrontmatter = false;
+  const kept = [];
+  let length = 0;
+  for (let i = 0; i < lines.length && length < 200; i++) {
+    const raw = lines[i].trim();
+    if (i === 0 && /^---$/.test(raw)) { inFrontmatter = true; continue; }
+    if (inFrontmatter) { if (/^(---|\.\.\.)$/.test(raw)) inFrontmatter = false; continue; }
+    const line = raw
+      .replace(/<[^>]*>/g, ' ')
+      .replace(/!\[([^\]]*)\]\([^)]*\)/g, '$1')
+      .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+      .replace(/(\*\*|__)(.*?)\1/g, '$2')
+      .replace(/(`{1,3})(.*?)\1/g, '$2')
+      .replace(/~~(.*?)~~/g, '$1')
+      .replace(/^#{1,6}\s+/, '')
+      .replace(/^>\s?/, '')
+      .replace(/^([-*+]\s+|\d+[.)]\s+)/, '')
+      .replace(/[*_~`|]+/g, '')
+      .replace(/\s+/g, ' ')
+      .trim();
+    if (!line || /^[-*_]{3,}$/.test(line)) continue;
+    kept.push(line);
+    length += line.length + 1;
+  }
+  const joined = kept.join(' ');
+  if (joined.length <= 160) return joined;
+  return joined.slice(0, 160).replace(/\s+\S*$/, '').trim();
+}
+
 // ─── Style guide ───────────────────────────────────────────────────────────
 let styleWarnedOnce = false;
 
@@ -237,11 +291,21 @@ function readBody(req) {
   });
 }
 
+// macOS gates Documents, Desktop and Downloads behind a per-app consent
+// prompt; a past "Don't Allow" surfaces as EPERM on every open, with no
+// re-prompt. Name the fix, not the errno.
+function fsErrorMessage(error) {
+  if (error?.code === 'EPERM' || error?.code === 'EACCES') {
+    return 'Litura may not open this folder. On macOS allow it under System Settings → Privacy & Security → Files and Folders, or pick a folder outside Documents, Desktop and Downloads.';
+  }
+  return error?.message || String(error);
+}
+
 // ─── Server ────────────────────────────────────────────────────────────────
 const server = http.createServer((req, res) => {
   handleRequest(req, res).catch(error => {
     console.error('[request]', error.message);
-    if (!res.headersSent) sendJson(res, error.status || 500, { error: error.message });
+    if (!res.headersSent) sendJson(res, error.status || 500, { error: fsErrorMessage(error) });
     else res.end();
   });
 });
@@ -313,13 +377,58 @@ async function handleRequest(req, res) {
         sendJson(res, 200, { saved: true, ...draftStore.write(body.text, body.revision) });
       } catch (error) {
         console.error('[/draft]', error.message);
-        sendJson(res, error.status || 500, { error: error.message, current: error.current });
+        sendJson(res, error.status || 500, { error: fsErrorMessage(error), current: error.current });
       }
       return;
     }
   }
   if (req.method === 'GET' && url.pathname === '/draft/history') return sendJson(res, 200, { snapshots: draftStore.history() });
 
+  if (req.method === 'GET' && url.pathname === '/files') {
+    let entries;
+    try { entries = fs.readdirSync(FILES_DIR, { withFileTypes: true }); }
+    catch (error) { sendJson(res, 500, { error: fsErrorMessage(error) }); return; }
+    const files = [];
+    for (const entry of entries) {
+      if (!entry.isFile() || entry.name.startsWith('.')) continue;
+      if (!WORKSPACE_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) continue;
+      try {
+        const full = path.join(FILES_DIR, entry.name);
+        const stats = fs.statSync(full);
+        // Card excerpt: first meaningful text, not raw markup. Comments,
+        // tags, images and markdown markers never reach the two-line preview.
+        // Read capped — a 1 MB draft must not be fully read for a preview.
+        let excerpt = '';
+        try {
+          const fd = fs.openSync(full, 'r');
+          try {
+            const buf = Buffer.alloc(2048);
+            const n = fs.readSync(fd, buf, 0, 2048, 0);
+            excerpt = cardExcerpt(buf.subarray(0, n).toString('utf8').replace(/\uFFFD+$/g, ''));
+          } finally { fs.closeSync(fd); }
+        } catch { excerpt = ''; }
+        files.push({ name: entry.name, size: stats.size, mtime: stats.mtime.toISOString(), excerpt });
+      } catch { /* raced deletion — skip */ }
+    }
+    files.sort((a, b) => a.name.localeCompare(b.name));
+    sendJson(res, 200, { files });
+    return;
+  }
+  if (req.method === 'GET' && url.pathname === '/file') {
+    const file = workspaceFile(url.searchParams.get('name'));
+    if (!file) { sendJson(res, 400, { error: 'Open a Markdown or text file by name.' }); return; }
+    let text;
+    try { text = fs.readFileSync(file, 'utf8'); }
+    catch (error) {
+      const missing = error.code === 'ENOENT';
+      sendJson(res, missing ? 404 : 500, { error: missing ? 'File no longer exists.' : fsErrorMessage(error) });
+      return;
+    }
+    if (Buffer.byteLength(text) > MAX_DOCUMENT_BYTES) { sendJson(res, 413, { error: 'File exceeds the 1 MB editing limit.' }); return; }
+    sendJson(res, 200, { name: path.basename(file), text });
+    return;
+  }
+
   // ── Static
   if (req.method === 'GET') {
     if      (url.pathname === '/')          serveStatic(res, path.join(PUBLIC, 'index.html'));

package/markdown.js

@@ -12,10 +12,9 @@ const ESCAPES = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&
 const escapeHtml = text => text.replace(/[&<>"']/g, char => ESCAPES[char]);
 
 // NUL cannot appear in model output and survives escaping, so a stashed code
-// block never collides with ordinary prose like "I have 3 apples".
-const MARK = '\u0000';
-const PLACEHOLDER = new RegExp(`${MARK}(\\d+)${MARK}`, 'g');
-const IS_PLACEHOLDER = new RegExp(`^${MARK}\\d+${MARK}$`);
+// block never collides with ordinary prose like "I have 3 apples". If a model
+// ever does emit one, fall back to a private-use character that is absent.
+const MARKS = ['\u0000', '\uE000', '\uE001', '\uE002'];
 
 function inline(text) {
   return text
@@ -29,9 +28,9 @@ function inline(text) {
     .replace(/(^|[^_\w])_([^_\n]+)_(?![\w_])/g, '$1<em>$2</em>');
 }
 
-function block(text) {
+function block(text, isPlaceholder) {
   if (!text) return '';
-  if (IS_PLACEHOLDER.test(text)) return text;  // a fenced block stands alone
+  if (isPlaceholder.test(text)) return text;  // a fenced block stands alone
 
   const lines = text.split('\n');
   if (lines.every(line => /^\s*[-*+]\s+/.test(line))) {
@@ -47,17 +46,21 @@ function block(text) {
 }
 
 export function renderMarkdown(source) {
+  const raw = String(source ?? '');
+  const mark = MARKS.find(candidate => !raw.includes(candidate)) ?? MARKS[0];
   const stash = [];
-  const keep = html => `${MARK}${stash.push(html) - 1}${MARK}`;
+  const keep = html => `${mark}${stash.push(html) - 1}${mark}`;
+  const isPlaceholder = new RegExp(`^${mark}\\d+${mark}$`);
+  const placeholder = new RegExp(`${mark}(\\d+)${mark}`, 'g');
 
   // Lift code out before anything else, so emphasis rules never run inside it.
-  const text = escapeHtml(String(source ?? ''))
+  const text = escapeHtml(raw)
     .replace(/```[^\n]*\n?([\s\S]*?)```/g, (_, body) => keep(`<pre><code>${body.replace(/\n$/, '')}</code></pre>`))
     .replace(/`([^`\n]+)`/g, (_, body) => keep(`<code>${body}</code>`));
 
   return text
     .split(/\n{2,}/)
-    .map(part => block(part.trim()))
+    .map(part => block(part.trim(), isPlaceholder))
     .join('')
-    .replace(PLACEHOLDER, (_, index) => stash[Number(index)]);
+    .replace(placeholder, (_, index) => stash[Number(index)]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "litura-app",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "A local AI-assisted editor for sharper, more human writing",
   "keywords": [
     "writing",
@@ -45,6 +45,7 @@
     "start": "node index.js",
     "build": "esbuild src/app.js --bundle --outfile=public/app.js --format=iife",
     "build:server": "node scripts/build-server.mjs",
+    "build:artifact": "node scripts/build-artifact.mjs",
     "desktop:prepare": "npm run build && npm run build:server && node scripts/fetch-node.mjs",
     "desktop": "tauri dev",
     "desktop:build": "tauri build",
@@ -58,14 +59,14 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@earendil-works/pi-ai": "0.84.2",
-    "@earendil-works/pi-coding-agent": "0.84.2"
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1"
   },
   "devDependencies": {
-    "@tauri-apps/cli": "^2.9.1",
+    "@tauri-apps/cli": "^2.11.5",
     "codemirror": "^6.0.1",
     "dictionary-en": "^4.0.0",
-    "esbuild": "^0.25.0",
+    "esbuild": "^0.28.2",
     "nspell": "^2.1.5"
   }
 }

package/pi.js

@@ -25,7 +25,16 @@ const runtime = () => runtimePromise ??= ModelRuntime.create({ allowModelNetwork
   .catch(error => {
     // No network, or a provider that will not answer: the snapshot still works.
     console.warn('[pi] model catalog refresh failed, using the bundled list —', error.message);
+    // The in-flight assignment already happened; clear it so a later call
+    // retries instead of reusing this rejection.
+    runtimePromise = undefined;
     return ModelRuntime.create({ allowModelNetwork: false });
+  })
+  .catch(error => {
+    // Even the offline snapshot can fail. Never park a rejected promise in the
+    // cache — the next call must try again.
+    runtimePromise = undefined;
+    throw error;
   });
 
 const requestedThinking = () => THINKING_LEVELS.includes(process.env.PI_THINKING_LEVEL)