pi-project-switcher 0.7.0 → 0.8.0

package/README.md

@@ -15,6 +15,7 @@ A [pi coding agent](https://github.com/earendil-works/pi) extension to switch be
   - sets the session display name
   - injects the project path into every agent turn's system prompt, so file operations default to the active project
   - **via the Telegram bridge**: the switch is confirmed in the chat — a short reply with the project, working directory, and session identity, plus buttons (project list, and switch back to the previous project). The confirmation is sent from the new session runtime, so it also works when the switch restores a stored session. No-switch outcomes (already active, cancelled, unknown) are answered in the chat too.
+  - **Telegram transport re-arm**: a session-replacing switch from the Telegram bridge suspends the bridge's polling (pi-telegram stands down on session shutdown and its auto-reconnect declines the handoff because the restored session's cwd differs from the lock's cwd). The switcher therefore re-runs `/telegram-connect` from the new session ~9 s after the switch — but **only** when the session being left provably owned the connected transport: pi-telegram's lock (`~/.pi/agent/tmp/telegram/owners.json`) must name this process with a fresh heartbeat and a cwd matching the old session. Native switches and switches from sessions that didn't own the bot never re-arm. The lock file is only read, never modified.
   - **if the project doesn't exist yet**, offers to create the folder and switch to it (confirmation dialog on dialog-capable surfaces; use `/project <name>!` to skip the dialog — e.g. on headless/RPC surfaces). Unsafe names (path segments, `..`, hidden, absolute) are never created.
 - **Session restore** — a machine-local map (`~/.pi/agent/project-switcher-sessions.json`) remembers the most recent session per project. Switching projects returns you to that project's last session; if none exists (or the file is gone), the switch happens in the current session.
 - **Auto-detection** — if pi starts inside `~/dev/<project>`, that project is active automatically

package/index.ts

@@ -335,6 +335,103 @@ function buildTelegramNoChangePrompt(text: string): string {
   );
 }
 
+// ── Telegram transport ownership probe & re-arm ──────────────────────────────
+
+/**
+ * Path of pi-telegram's transport ownership lock. The switcher only ever
+ * READS this file (pi-telegram's own connect handler performs the actual
+ * acquisition); mutating it by hand is explicitly forbidden by the
+ * bridge's diagnosis guidance.
+ */
+function telegramOwnersPath(): string {
+  return join(HOME, ".pi", "agent", "tmp", "telegram", "owners.json");
+}
+
+/**
+ * Freshness bound for the ownership probe. Deliberately LOOSER than
+ * pi-telegram's 8s staleness window: a passing probe means the owner
+ * runtime was definitely alive at switch time (a false positive here only
+ * leads to a connect attempt that pi-telegram itself re-validates).
+ */
+const TELEGRAM_OWNERSHIP_FRESH_MS = 10_000;
+
+/**
+ * Delay before re-dispatching /telegram-connect after a session-replacing
+ * switch. Must exceed pi-telegram's lock staleness window (8s): the
+ * suspended old runtime stops refreshing the heartbeat at session
+ * shutdown, and a *stale* lock is the only one the connect handler's
+ * non-forced acquire can replace across a cwd mismatch.
+ */
+const TELEGRAM_REARM_DELAY_MS = 9_000;
+
+/**
+ * Read-only probe: is the session we are about to leave the live owner of
+ * the connected Telegram transport? True iff pi-telegram's lock file has
+ * an entry for the current process whose heartbeat is fresh and whose cwd
+ * matches the old session's cwd (or is absent). This is the guard that
+ * prevents stealing the bot from a different pi instance or re-arming in
+ * a session that never used Telegram.
+ */
+function probeTelegramTransportOwnership(oldCwd: string): boolean {
+  try {
+    const raw = JSON.parse(readFileSync(telegramOwnersPath(), "utf8"));
+    if (!raw || typeof raw !== "object") return false;
+    // Any profile entry counts (the default profile uses the key "default").
+    for (const entry of Object.values(raw) as any[]) {
+      if (
+        entry &&
+        typeof entry === "object" &&
+        entry.pid === process.pid &&
+        typeof entry.heartbeatMs === "number" &&
+        Date.now() - entry.heartbeatMs <= TELEGRAM_OWNERSHIP_FRESH_MS &&
+        (entry.cwd === undefined || entry.cwd === oldCwd)
+      ) {
+        return true;
+      }
+    }
+    return false;
+  } catch {
+    // Missing or malformed lock file: transport not owned here.
+    return false;
+  }
+}
+
+/**
+ * Pending re-arm timer (single slot): scheduling a new re-arm supersedes
+ * a not-yet-fired previous one. The callback only touches the withSession
+ * context it was scheduled with, so it can never act on a stale runtime.
+ */
+let pendingRearmTimer: ReturnType<typeof setTimeout> | null = null;
+
+function scheduleTelegramRearm(newCtx: any, source: string): void {
+  if (pendingRearmTimer) {
+    clearTimeout(pendingRearmTimer);
+    pendingRearmTimer = null;
+  }
+  const timer = setTimeout(async () => {
+    pendingRearmTimer = null;
+    try {
+      // Command re-dispatch from the FRESH runtime: executes pi-telegram's
+      // connect handler (no agent turn) and re-acquires the now-stale lock,
+      // restarting polling in the new session.
+      await newCtx.sendUserMessage("/telegram-connect", {
+        expandPromptTemplates: true,
+      });
+    } catch (err: any) {
+      try {
+        newCtx.ui.notify(
+          `Telegram re-arm after ${source} switch failed: ${err?.message ?? err}`,
+          "warning"
+        );
+      } catch {
+        // Even the fresh context can be gone (e.g. another switch followed):
+        // never let an error escape into an uncaught timer callback.
+      }
+    }
+  }, TELEGRAM_REARM_DELAY_MS);
+  timer.unref?.();
+  pendingRearmTimer = timer;
+}
 
 function getConfig(): Config {
   if (!config) {
@@ -587,6 +684,15 @@ export default function (pi: ExtensionAPI) {
       // with "stale ctx" errors and killed the whole flow).
       const branch = getGitBranch(projectPath(name));
       const branchStr = branch ? ` on branch \`${branch}\`` : "";
+      // Ownership probe BEFORE the switch (the old session's cwd is only
+      // available here): when the session we are leaving is the live owner
+      // of the connected Telegram transport, the new runtime must re-arm
+      // it after the switch (pi-telegram suspends polling on session
+      // shutdown and its auto-start declines the handoff across a cwd
+      // mismatch). The probe failing means we are NOT the owner (another
+      // pi instance, or Telegram was never connected here): re-arm nothing.
+      const ownedTelegramTransport =
+        isTelegramOrigin && probeTelegramTransportOwnership(ctx.cwd);
       const result = await ctx.switchSession(targetSession, {
         withSession: async (newCtx: any) => {
           // Safety net in case the restored session has no project entry:
@@ -617,6 +723,13 @@ export default function (pi: ExtensionAPI) {
               { deliverAs: "followUp" }
             );
           }
+          if (ownedTelegramTransport) {
+            // Re-arm the Telegram transport from the fresh runtime. Only the
+            // withSession context is touched; the delay lets the old lock
+            // go stale (see TELEGRAM_REARM_DELAY_MS) so the connect
+            // handler's acquire can replace it across the cwd mismatch.
+            scheduleTelegramRearm(newCtx, name);
+          }
         },
       });
       if (result.cancelled) {

package/package.json

@@ -1 +1 @@
-{"name": "pi-project-switcher", "version": "0.7.0", "description": "pi coding agent extension: switch between projects under a configurable base directory via /project", "main": "index.ts", "type": "module", "scripts": {"test": "vitest run", "test:watch": "vitest", "typecheck": "tsc --noEmit"}, "keywords": ["pi", "pi-package", "pi-extension", "project", "switcher", "project-switching"], "author": "stefclawd", "license": "MIT", "repository": {"type": "git", "url": "git+https://github.com/stefclawd/pi-project-switcher.git"}, "bugs": {"url": "https://github.com/stefclawd/pi-project-switcher/issues"}, "homepage": "https://github.com/stefclawd/pi-project-switcher#readme", "files": ["index.ts", "README.md", "LICENSE"], "engines": {"node": ">=22.19.0"}, "pi": {"extensions": ["./index.ts"]}, "devDependencies": {"@earendil-works/pi-coding-agent": "^0.85.1", "@types/node": "^24.0.0", "typescript": "^5.7.0", "vitest": "^3.0.0"}}
+{"name": "pi-project-switcher", "version": "0.8.0", "description": "pi coding agent extension: switch between projects under a configurable base directory via /project", "main": "index.ts", "type": "module", "scripts": {"test": "vitest run", "test:watch": "vitest", "typecheck": "tsc --noEmit"}, "keywords": ["pi", "pi-package", "pi-extension", "project", "switcher", "project-switching"], "author": "stefclawd", "license": "MIT", "repository": {"type": "git", "url": "git+https://github.com/stefclawd/pi-project-switcher.git"}, "bugs": {"url": "https://github.com/stefclawd/pi-project-switcher/issues"}, "homepage": "https://github.com/stefclawd/pi-project-switcher#readme", "files": ["index.ts", "README.md", "LICENSE"], "engines": {"node": ">=22.19.0"}, "pi": {"extensions": ["./index.ts"]}, "devDependencies": {"@earendil-works/pi-coding-agent": "^0.85.1", "@types/node": "^24.0.0", "typescript": "^5.7.0", "vitest": "^3.0.0"}}