pi-pier 0.3.1 → 0.4.2

package/src/herdr-client.ts

@@ -1,9 +1,11 @@
 /**
  * Minimal herdr socket API client used inside the pi extension.
  *
- * Validated against herdr 0.9.1 (protocol 22; see WIRE.md). The request shapes pier builds are pinned
- * to herdr's own `api schema` by test/herdr-client.test.ts — regenerate test/fixtures/herdr-contract.json
- * and bump HERDR_PROTOCOL_EXPECTED when the server moves on:
+ * Validated against herdr 0.9.5 (protocol 22; see WIRE.md — unchanged since 0.9.1; 0.9.2 removed only the
+ * pane.graphics.* API, which pier never used). The request shapes pier builds are pinned to the
+ * 0.9.5 methods snapshot in test/fixtures/herdr-contract.json (recent `api schema` releases no longer
+ * emit a methods map) — after a herdr upgrade, re-verify the protocol number and the method set, then
+ * regenerate the fixture and bump HERDR_PROTOCOL_EXPECTED when the server moves on:
  *  - Transport is NDJSON: request {id, method, params} → response {id, result} | {id, error:{code,message}};
  *  - **Control requests use one connection per request**; the server closes it after replying;
  *  - Windows targets are named pipes whose name is the complete socket_path with a \\.\pipe\ prefix;
@@ -18,6 +20,7 @@
  */
 import { REPORT_AGENT_SOURCE, type TodoItem } from './vocab.ts';
 import { BLOCKED_LABEL_KEY, SIDEBAR_ASK_TOKEN, formatBlockedLabel, formatPaneTitle, sidebarTodoTokens, staleTokenClearance } from './pane-title.ts';
+import { applyWorkerTag, delegationSidebarTokens, type DelegationContext } from './delegation-core.ts';
 import { LOCK_BATCH_LIMIT, LOCK_TTL_MS } from './lock-core.ts';
 import * as net from 'node:net';
 
@@ -57,6 +60,18 @@ export interface PaneListItem {
   terminalTitleStripped?: string | null;
 }
 
+/** pane.process_info: the processes currently holding the pane's PTY foreground. */
+export interface PaneProcessInfo {
+  paneId: string;
+  shellPid: number | null;
+  foreground: ReadonlyArray<{
+    name: string | null;
+    argv0: string | null;
+    pid: number | null;
+    cwd: string | null;
+  }>;
+}
+
 export interface PaneLayoutCell {
   paneId: string;
   x: number;
@@ -88,6 +103,8 @@ export interface OpenPluginPaneOptions {
 
 export type OpenPluginPaneResult =
   | { mode: 'popup'; ok: true }
+  /** Another popup/modal owns the session; the caller may switch that panel instead of opening a tab. */
+  | { mode: 'busy' }
   | { mode: 'pane'; paneId: string }
   | { mode: 'fallback_tab'; tabId?: string; paneId?: string };
 
@@ -127,12 +144,23 @@ export function herdrUnavailableHint(err: unknown): string | null {
   return `herdr unreachable (${msg}) — check that the herdr server is running and HERDR_SOCKET_PATH matches its socket`;
 }
 
-/** Wire protocol this client is written against (herdr 0.9.1). See test/fixtures/herdr-contract.json. */
+/** Wire protocol this client is written against (herdr 0.9.5, contract fixture regenerated 2026-10-20). */
 export const HERDR_PROTOCOL_EXPECTED = 22;
 
+export type WaitFailureReason = 'timeout' | 'unavailable';
+
 export type WaitForOutputResult =
   | { matched: true }
-  | { matched: false; reason: 'timeout' | 'unavailable' };
+  | { matched: false; reason: WaitFailureReason };
+
+/** Classify a failed `pane.wait_for_output`: null means the error is not a wait outcome and should
+ *  surface. herdr may report its own server-side timeout under an `unavailable` code or as
+ *  "timed out"; a wait that consumed its budget is a timeout regardless of the label it chose. */
+export function classifyWaitFailure(message: string, elapsedMs: number, timeoutMs: number): WaitFailureReason | null {
+  if (/timeout|timed out|deadline exceeded/i.test(message) || elapsedMs >= timeoutMs * 0.95) return 'timeout';
+  if (/not supported|not implemented|unknown method|unavailable|method not found/i.test(message)) return 'unavailable';
+  return null;
+}
 
 /** pane.read / agent.read selection: `recent` keeps ANSI so T6 fullscreen detection still sees it. */
 export interface ReadOptions {
@@ -151,8 +179,7 @@ export interface ReadBuffer {
 export interface HerdrClientLike {
   readonly available: boolean;
   reportAgent(state: PaneAgentState, message: string | null): Promise<void>;
-  reportMetadata(meta: { session: string; items: readonly TodoItem[]; progressSuffix?: string | null; lastWriteAt?: number | null }): Promise<void>;
-  /** M18: report write-lock tokens (lock-<hash> → paneId|path); null releases, and batches stay within 16 keys. */
+  reportMetadata(meta: { session: string; items: readonly TodoItem[]; progressSuffix?: string | null; lastWriteAt?: number | null; workerTag?: string | null }): Promise<void>;
   reportLockTokens(tokens: Record<string, string | null>): Promise<void>;
   /** D93: sidebar agent display name (display_agent is the role name); null clears it. Persists, no TTL. */
   reportDisplayAgent(name: string | null): Promise<void>;
@@ -161,6 +188,14 @@ export interface HerdrClientLike {
    * grade blocked + pi-ask as the ask level, distinct from plain block.
    */
   reportAskFlag(text: string | null): Promise<void>;
+  /** Delegation identity tokens (pi-parent/pi-task): who delegated this pane and for what task. */
+  reportDelegationTokens(d: DelegationContext | null): Promise<void>;
+  /**
+   * herdr 0.9.2+ self-reported restore: register the command that reopens this exact session after
+   * a server restart. Worker panes only; masters stay with herdr's native pi integration.
+   * Silently no-ops on older servers and on any error — resume is always best-effort.
+   */
+  reportAgentSessionResume(sessionId: string, resumeArgv: readonly string[]): Promise<void>;
   listAgents(): Promise<AgentInfo[]>;
   /** Inject text into a pane terminal (pi editor input + Enter); the PTY channel is used only to start launchLine. */
   sendPaneText(paneId: string, text: string): Promise<void>;
@@ -173,6 +208,8 @@ export interface HerdrClientLike {
   closePane(paneId: string): Promise<void>;
   createTab(opts: { workspaceId: string; label?: string; cwd?: string; env?: Record<string, string> }): Promise<{ tabId: string; paneId: string }>;
   listPanes(): Promise<PaneListItem[]>;
+  /** Foreground process snapshot; null when the server predates the method or the pane is gone. */
+  processInfo(paneId: string): Promise<PaneProcessInfo | null>;
   /** D91: layout tree by paneId or tabId; null on failure. */
   exportLayout(opts?: { paneId?: string; tabId?: string }): Promise<{ tabId: string | null; zoomed: boolean; root: unknown; focusedPaneId: string | null } | null>;
   /** 0.9.1: live pane rects for the tab containing paneId. Best effort returns null. */
@@ -183,7 +220,6 @@ export interface HerdrClientLike {
   /** 0.9.1: Launch a manifest pane entrypoint with placement (popup/tab/split/overlay/zoomed). */
   openPluginPane(opts: OpenPluginPaneOptions): Promise<OpenPluginPaneResult>;
   agentExplain(target: string): Promise<Record<string, unknown> | null>;
-  getServerVersion(): Promise<string | null>;
   /** pane.send_keys; herdr key combos include ctrl+c, enter, and esc. */
   sendPaneKeys(paneId: string, keys: string[]): Promise<void>;
   readPane(paneId: string, opts?: ReadOptions): Promise<ReadBuffer>;
@@ -212,8 +248,10 @@ function findIdIn(obj: unknown, key: string, depth = 0): string | null {
 export class NoopHerdrClient implements HerdrClientLike {
   readonly available = false;
   async reportAgent(): Promise<void> {}
+  async reportAgentSessionResume(): Promise<void> {}
   async reportMetadata(): Promise<void> {}
   async reportLockTokens(): Promise<void> {}
+  async reportDelegationTokens(): Promise<void> {}
   async reportDisplayAgent(): Promise<void> {}
   async reportAskFlag(): Promise<void> {}
   async sendPaneText(): Promise<void> {}
@@ -223,13 +261,13 @@ export class NoopHerdrClient implements HerdrClientLike {
   close(): void {}
   async listAgents(): Promise<AgentInfo[]> { return []; }
   async listPanes(): Promise<PaneListItem[]> { return []; }
+  async processInfo(): Promise<PaneProcessInfo | null> { return null; }
   async tabList(): Promise<TabInfo[]> { return []; }
   async waitAgent(): Promise<null> { return null; }
   async getAgentSessionPath(): Promise<null> { return null; }
   async exportLayout(): Promise<null> { return null; }
   async paneLayout(): Promise<null> { return null; }
   async agentExplain(): Promise<null> { return null; }
-  async getServerVersion(): Promise<null> { return null; }
   async readPane(): Promise<ReadBuffer> { return { text: '', revision: 0, truncated: false }; }
   async readAgent(): Promise<ReadBuffer> { return { text: '', revision: 0, truncated: false }; }
   async waitForOutput(): Promise<WaitForOutputResult> { return { matched: false, reason: 'unavailable' }; }
@@ -312,6 +350,13 @@ export class HerdrClient implements HerdrClientLike {
 
   /* ── Reporting (silent best effort: the workbench mirror must never affect pi's main flow) ── */
 
+  /**
+   * D-2 (verified 2026-10-20): herdr's native `herdr:pi` integration owns `agent_status`
+   * (`screen_detection_skip_reason: full_lifecycle_hook_authority`), but it never reports the
+   * activity text. `pane.report_agent` is still the only carrier for the tool badge, so pier keeps
+   * sending state with the message; removing it requires migrating the badge to
+   * `report_metadata.state_labels` first.
+   */
   async reportAgent(state: PaneAgentState, message: string | null): Promise<void> {
     try {
       await this.request('pane.report_agent', {
@@ -325,16 +370,47 @@ export class HerdrClient implements HerdrClientLike {
     }
   }
 
-  // Single writer: herdr's native pi integration owns the session path, so pier never sends
-  // pane.report_agent_session; the activity badge stays on report_agent.
+  /**
+   * Master panes stay with herdr's native pi integration (it owns the session path); workers
+   * self-report so a restart replays pier's own launch line — extension loaded, role model, approve,
+   * fullscreen frame — instead of a bare `pi --resume` without `-e`. herdr requires the source to
+   * hold the pane before accepting a resume command (resume_not_accepted), so an idle state report
+   * goes first, with one retry to tolerate a lost race with the session_start gate report.
+   */
+  async reportAgentSessionResume(sessionId: string, resumeArgv: readonly string[]): Promise<void> {
+    if (!this.env) return;
+    try {
+      await this.reportAgent('idle', null);
+      const params = {
+        pane_id: this.env.paneId,
+        source: REPORT_AGENT_SOURCE,
+        agent: 'pi',
+        agent_session_id: sessionId,
+        resume_argv: [...resumeArgv],
+      };
+      try {
+        await this.request('pane.report_agent_session', params);
+      } catch {
+        const { promise: retryDelay, resolve: retryNow } = Promise.withResolvers<void>();
+        setTimeout(retryNow, 250);
+        await retryDelay;
+        await this.request('pane.report_agent_session', params);
+      }
+    } catch {
+      /* best effort: live sessions never depend on restore metadata */
+    }
+  }
 
-  async reportMetadata(meta: { session: string; items: readonly TodoItem[]; progressSuffix?: string | null; lastWriteAt?: number | null }): Promise<void> {
+  async reportMetadata(meta: { session: string; items: readonly TodoItem[]; progressSuffix?: string | null; lastWriteAt?: number | null; workerTag?: string | null }): Promise<void> {
     try {
       void meta.session;
-      const title = formatPaneTitle(meta.items, null, {
-        progressSuffix: meta.progressSuffix,
-        lastWriteAt: meta.lastWriteAt,
-      });
+      const title = applyWorkerTag(
+        formatPaneTitle(meta.items, null, {
+          progressSuffix: meta.progressSuffix,
+          lastWriteAt: meta.lastWriteAt,
+        }),
+        meta.workerTag ?? null,
+      );
       const blocked = formatBlockedLabel(meta.items);
       // D96: stale cleanup needs its own batch — stale(16) + pi-todo(1) exceeds herdr's 16-token
       // limit, and the rejected request would drop both the title and the tokens.
@@ -362,6 +438,22 @@ export class HerdrClient implements HerdrClientLike {
     }
   }
 
+  /** RFC rfc-delegation-identity §2.3: separate batch — tokens patches never merge with the stale
+   * cleanup or the todo title (D96 discipline); an unknown parent pane skips the report. */
+  async reportDelegationTokens(d: DelegationContext | null): Promise<void> {
+    const tokens = d ? delegationSidebarTokens(d) : {};
+    if (Object.keys(tokens).length === 0) return;
+    try {
+      await this.request('pane.report_metadata', {
+        pane_id: this.env.paneId,
+        source: REPORT_AGENT_SOURCE,
+        tokens,
+        ttl_ms: 86400000,
+      });
+    } catch {
+    }
+  }
+
   async reportLockTokens(tokens: Record<string, string | null>): Promise<void> {
     const keys = Object.keys(tokens);
     if (keys.length === 0) return;
@@ -513,6 +605,29 @@ export class HerdrClient implements HerdrClientLike {
     }));
   }
 
+  async processInfo(paneId: string): Promise<PaneProcessInfo | null> {
+    try {
+      const result = (await this.request('pane.process_info', { pane_id: paneId })) as Record<string, unknown> | null;
+      const info = (result?.process_info ?? result) as Record<string, unknown> | null | undefined;
+      if (!info || typeof info !== 'object') return null;
+      const raw = Array.isArray(info.foreground_processes) ? info.foreground_processes : [];
+      return {
+        paneId: typeof info.pane_id === 'string' ? info.pane_id : paneId,
+        shellPid: typeof info.shell_pid === 'number' ? info.shell_pid : null,
+        foreground: raw
+          .filter((p): p is Record<string, unknown> => p !== null && typeof p === 'object')
+          .map((p) => ({
+            name: typeof p.name === 'string' ? p.name : null,
+            argv0: typeof p.argv0 === 'string' ? p.argv0 : null,
+            pid: typeof p.pid === 'number' ? p.pid : null,
+            cwd: typeof p.cwd === 'string' ? p.cwd : null,
+          })),
+      };
+    } catch {
+      return null;
+    }
+  }
+
   async exportLayout(opts: { paneId?: string; tabId?: string } = {}): Promise<{ tabId: string | null; zoomed: boolean; root: unknown; focusedPaneId: string | null } | null> {
     try {
       const result = (await this.request('layout.export', {
@@ -608,8 +723,14 @@ export class HerdrClient implements HerdrClientLike {
       }
       return { mode: 'pane', paneId: findIdIn(result, 'pane_id') ?? '' };
     } catch (err) {
+      // A live popup/modal is a transient state, not an old server: opening a tab would orphan a
+      // second dashboard and silently change the surface. Callers decide whether to switch panels.
+      const message = err instanceof Error ? err.message : String(err);
+      if (opts.placement === 'popup' && /ui_busy|popup pane is already open/i.test(message)) {
+        return { mode: 'busy' };
+      }
       // 0.9.0 serde rejects unknown `popup` as "unknown variant" / invalid_params — not a dedicated
-      // invalid_placement code. Any popup failure retries as tab; tab failure surfaces to Level 3.
+      // invalid_placement code. Any other popup failure retries as tab; tab failure surfaces to Level 3.
       if (opts.placement !== 'popup') throw err;
       const { width: _width, height: _height, target_pane_id: _target, ...base } = params;
       const fallbackRes = (await this.request('plugin.pane.open', { ...base, placement: 'tab' })) as Record<string, unknown> | null;
@@ -635,21 +756,6 @@ export class HerdrClient implements HerdrClientLike {
     }
   }
 
-  private cachedVersion: string | null = null;
-
-  async getServerVersion(): Promise<string | null> {
-    if (this.cachedVersion) return this.cachedVersion;
-    try {
-      const result = (await this.request('ping', {})) as { version?: unknown } | null;
-      if (typeof result?.version === 'string') {
-        this.cachedVersion = result.version;
-        return result.version;
-      }
-    } catch {
-    }
-    return null;
-  }
-
   async sendPaneKeys(paneId: string, keys: string[]): Promise<void> {
     await this.request('pane.send_keys', { pane_id: paneId, keys });
   }
@@ -688,6 +794,7 @@ export class HerdrClient implements HerdrClientLike {
   }
 
   async waitForOutput(paneId: string, match: { type: 'substring' | 'regex'; value: string }, timeoutMs: number): Promise<WaitForOutputResult> {
+    const started = Date.now();
     try {
       await this.request('pane.wait_for_output', {
         pane_id: paneId,
@@ -698,10 +805,8 @@ export class HerdrClient implements HerdrClientLike {
       return { matched: true };
     } catch (err) {
       const msg = String((err as Error)?.message ?? err);
-      if (/timeout/i.test(msg)) return { matched: false, reason: 'timeout' };
-      if (/not supported|not implemented|unknown method|unavailable|method not found/i.test(msg)) {
-        return { matched: false, reason: 'unavailable' };
-      }
+      const reason = classifyWaitFailure(msg, Date.now() - started, timeoutMs);
+      if (reason != null) return { matched: false, reason };
       throw err;
     }
   }

package/src/history-store.ts

@@ -29,6 +29,8 @@ export interface HistoryEntry {
   kind: string;
   paneId: string;
   tabId: string;
+  /** Phase 2 task slug — carried so resume-from-history keeps the tool-facing reference stable. */
+  slug?: string;
   tabName?: string;
   workspaceId: string;
   cwd: string;

package/src/index-gates.ts

@@ -8,10 +8,7 @@
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import type { HerdrClientLike } from './herdr-client.ts';
 
-/** pi surface pieces the gate runtime touches (ui_prompt events postdate the pinned devDependency). */
-type GatePi = ExtensionAPI & {
-  on?: (name: 'ui_prompt_start' | 'ui_prompt_end', handler: (event: unknown) => void) => void;
-};
+/** ui_prompt events are typed by pi ≥ 1.1 (they postdated the 0.86 pin this gate was written against). */
 
 /** Only inherently human-blocking kinds open the gate; `custom` covers resident overlays too (D97). */
 const GATING_PROMPT_KINDS = new Set(['select', 'confirm', 'input', 'editor']);
@@ -95,18 +92,15 @@ export function createGateRuntime(d: GateRuntimeDeps): GateRuntime {
     }
   });
 
-  const gatePi = d.pi as GatePi;
-  gatePi.on?.('ui_prompt_start', (event) => {
-    const rec = (event ?? {}) as { kind?: unknown; title?: unknown };
-    const title = typeof rec.title === 'string' && rec.title.trim() ? rec.title.trim() : null;
-    const kind = typeof rec.kind === 'string' ? rec.kind : 'prompt';
-    if (!GATING_PROMPT_KINDS.has(kind)) return;
-    const label = title ?? kind;
+  d.pi.on('ui_prompt_start', (event) => {
+    const title = typeof event.title === 'string' && event.title.trim() ? event.title.trim() : null;
+    if (!GATING_PROMPT_KINDS.has(event.kind)) return;
+    const label = title ?? event.kind;
     // The ask tool opens its own gate first, so this is usually a nested no-op;
     // prompts from other extensions or pi core open the gate here.
     if (enter(label)) emitHerdrBlocked(true, label);
   });
-  gatePi.on?.('ui_prompt_end', () => {
+  d.pi.on('ui_prompt_end', () => {
     if (exit()) emitHerdrBlocked(false, null);
   });
 

package/src/index-master.ts

@@ -5,6 +5,7 @@ import type { Context } from '@deepseek-ai/cordis';
 import type { Server } from 'node:net';
 import { PiSurface } from './pi-surface.ts';
 import { createCordisApp } from './bootstrap.ts';
+import { baseTodoDeps, cordisProvide } from './cordis-services.ts';
 import { disposeSessionRoot } from './subagent-poller.ts';
 import terminalPlugin from './plugins/terminal.ts';
 import todoPlugin from './plugins/todo.ts';
@@ -15,7 +16,7 @@ import type { RoutingTelemetryRecord } from './routing-telemetry.ts';
 import type { TodosService } from './todos-service.ts';
 import type { TodoUiSlot } from './plugins/todo.ts';
 import type { SubagentPortBox } from './subagent-core.ts';
-import type { SubagentDeps } from './plugins/subagent.ts';
+import type { WorkerWidgetRow } from './tree-view.ts';
 
 export interface MasterPluginMount {
   pi: ExtensionAPI;
@@ -40,6 +41,8 @@ export interface MasterPluginMount {
   jev?: { ask: JevRuntime['ask']; getMinConfidence: () => number };
   /** Phase 0 routing telemetry append (RFC rfc-jev-role-routing §8); absent in tests. */
   appendRoutingLog?: (row: RoutingTelemetryRecord) => void;
+  /** D113: running subagent rows joined with their cached todos — feeds the unified widget. */
+  getWorkers?: () => readonly WorkerWidgetRow[];
 }
 
 async function loadEntry(
@@ -74,25 +77,19 @@ export async function mountMasterPlugins(m: MasterPluginMount): Promise<void> {
   }, 'pipe-server');
 
   const surface = new PiSurface(m.pi as unknown as object, cordisApp.ledger);
-  sessionRoot.provide('pi-herdr.surface', surface);
+  cordisProvide(sessionRoot, 'pi-herdr.surface', surface);
   const terminalDeps = {
     client: m.client,
     env: m.env,
     state: { activePaneIds: (): Set<string> => new Set() },
   };
-  sessionRoot.provide('pi-herdr.terminal-deps', terminalDeps);
+  cordisProvide(sessionRoot, 'pi-herdr.terminal-deps', terminalDeps);
 
   await loadEntry(sessionRoot, useLoader, './plugins/terminal.ts', terminalPlugin);
 
-  sessionRoot.provide('pi-herdr.todo-deps', {
-    todos: m.todos,
-    allowParallelInProgress: m.todos.config.allowParallelInProgress,
-    maxItems: 15,
-    mirrorTodos: m.mirrorTodos,
-    appendEntry: (customType: string, data: unknown) => {
-      (m.pi as { appendEntry?: (t: string, d: unknown) => void }).appendEntry?.(customType, data);
-    },
-    state: m.todoUi,
+  cordisProvide(sessionRoot, 'pi-herdr.todo-deps', {
+    ...baseTodoDeps(m),
+    ...(m.getWorkers ? { getWorkers: m.getWorkers } : {}),
     getBlockedDepth: m.getBlockedDepth,
     stopReminder: {
       getBlockedDepth: m.getBlockedDepth,
@@ -103,9 +100,8 @@ export async function mountMasterPlugins(m: MasterPluginMount): Promise<void> {
   });
   await loadEntry(sessionRoot, useLoader, './plugins/todo.ts', todoPlugin);
 
-  // D98 regression guard: `satisfies` makes tsc reject a missing/mistyped key here — the bag is
-  // consumed untyped by plugins/subagent.ts, and the fe99252 crash was exactly a dropped key.
-  sessionRoot.provide('pi-herdr.subagent-deps', {
+  // Dropped keys fail here: cordisProvide checks the bag against PierCordisServices (fe99252).
+  cordisProvide(sessionRoot, 'pi-herdr.subagent-deps', {
     client: m.client,
     env: m.env,
     extPath: m.extPath,
@@ -120,7 +116,7 @@ export async function mountMasterPlugins(m: MasterPluginMount): Promise<void> {
     terminalState: terminalDeps.state,
     ...(m.jev ? { jev: m.jev } : {}),
     ...(m.appendRoutingLog ? { logRouting: m.appendRoutingLog } : {}),
-  } satisfies SubagentDeps);
+  });
   await loadEntry(sessionRoot, useLoader, './plugins/subagent.ts', subagentPlugin);
 
   m.pi.on('session_shutdown', () => {

package/src/index-pipe.ts

@@ -21,6 +21,8 @@ export interface PipeHandlerSession {
   setPendingMachineRequest: (req: MachineRequest | null) => void;
   /** P0 (RFC §4.4): apply a role switch requested over the pipe (master → worker). */
   applyRoleSwitch: (role: string, switchedBy: string) => Promise<{ ok: boolean; message: string }>;
+  /** D113 (RFC rfc-unified-widget): worker → master full todo push; updates the widget cache. */
+  applyWorkerTodos: (workerPaneId: string, items: Array<{ content: string; status: string; blocker?: string }>, summary: string) => void;
 }
 
 export async function handlePipeRequest(
@@ -54,6 +56,10 @@ export async function handlePipeRequest(
         ? { type: 'ok', id: req.id, detail: res.message }
         : { type: 'error', id: req.id, message: res.message };
     }
+    case 'todo_sync': {
+      s.applyWorkerTodos(req.paneId, req.items, req.summary);
+      return { type: 'ok', id: req.id };
+    }
     case 'reply': {
       s.port.current?.applyReplySession(req.paneId, req.sessionFile);
       // Consume before the finish notice: otherwise listRunningSubs still reports the pane and the

package/src/index-runtime.ts

@@ -21,3 +21,17 @@ export function planIndexMode(env: NodeJS.ProcessEnv = process.env): IndexMode {
     composeMaster: hasHerdr && !isSubagent,
   };
 }
+
+/**
+ * herdr 0.9.2 restore path: a reopened worker pane runs pier's resume_argv, which cannot carry the
+ * spawn env. A worker marker next to the session file is the durable identity, so the restored boot
+ * plans worker mode (todo-only mount, no master services) instead of master composition.
+ */
+export function applyRestoredWorkerMode(
+  mode: IndexMode,
+  sessionFile: string | null | undefined,
+  markerExists: (sessionFile: string) => boolean,
+): IndexMode {
+  if (mode.isSubagent || !mode.hasHerdr || !sessionFile) return mode;
+  return markerExists(sessionFile) ? { isSubagent: true, hasHerdr: true, composeMaster: false } : mode;
+}

package/src/index-worker.ts

@@ -3,6 +3,7 @@
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
 import { Context } from '@deepseek-ai/cordis';
 import { PiSurface } from './pi-surface.ts';
+import { baseTodoDeps, cordisProvide } from './cordis-services.ts';
 import todoPlugin from './plugins/todo.ts';
 import type { TodosService } from './todos-service.ts';
 import type { TodoUiSlot } from './plugins/todo.ts';
@@ -26,16 +27,9 @@ export interface TodoOnlyMount {
 export async function mountTodoOnly(m: TodoOnlyMount): Promise<void> {
   const workerRoot = new Context();
   const workerSurface = new PiSurface(m.pi as unknown as object);
-  workerRoot.provide('pi-herdr.surface', workerSurface);
-  workerRoot.provide('pi-herdr.todo-deps', {
-    todos: m.todos,
-    allowParallelInProgress: m.todos.config.allowParallelInProgress,
-    maxItems: 15,
-    mirrorTodos: m.mirrorTodos,
-    appendEntry: (customType: string, data: unknown) => {
-      (m.pi as { appendEntry?: (t: string, d: unknown) => void }).appendEntry?.(customType, data);
-    },
-    state: m.todoUi,
+  cordisProvide(workerRoot, 'pi-herdr.surface', workerSurface);
+  cordisProvide(workerRoot, 'pi-herdr.todo-deps', {
+    ...baseTodoDeps(m),
     ...(m.getBlockedDepth ? { getBlockedDepth: m.getBlockedDepth } : {}),
     ...(m.stopReminder ? { stopReminder: m.stopReminder } : {}),
   });