pi-quiver 6.2.0 → 6.3.1

package/CHANGELOG.md

@@ -8,6 +8,14 @@ Published to npm as `pi-quiver` (`pi install npm:pi-quiver`). Pushing a
 via OIDC trusted publishing. The release helper at
 `.agents/skills/release/scripts/release.sh` cuts the tag; CI publishes.
 
+## v6.3.1 - 2026-09-25
+
+- `provider-stall-watchdog` recovers again on pi >= 0.86 ([#23](https://github.com/jjuraszek/pi-quiver/issues/23)): pi's session abort now fences the run so its retry loop never runs after a watchdog abort; the watchdog omits the aborted attempt from the model's context at `turn_end` and re-drives the request itself via a hidden custom message after pi's backoff, honoring pi's `retry.enabled` / `retry.baseDelayMs` / `retry.maxAgentDelayMs` live and the existing `maxStallRetries` cap. Print/json await the backoff; TUI/RPC show `Retrying (n/m) in Ns... (Esc to cancel)` in the status bar on the timer path. In TUI, Esc, a new prompt, a tree switch, or compaction cancels the pending retry; RPC cancels on a new prompt, not Esc. Behavior guide: `doc/provider-stall-watchdog.md`. Dev dependencies on `@earendil-works/*` move to `^0.87.1`.
+
+## v6.3.0 - 2026-09-16
+
+- `session-name` Herdr sink claims any numeric tab label (optionally behind one `* `) at any position instead of only the label equal to the tab's live position, so tabs reordered before the first auto-name - or after a `/new` restore - get named; the claim resets at every `session_start` (`/new`, resume, fork behave like a fresh process) and a tab that reverts to a bare number is re-claimed on the next turn. The extension never writes a digits-only label (`1234` -> `#1234`) and the naming prompt asks for `PR 1234` / `issue 123` / `ticket ABC-123` over a bare ID.
+
 ## v6.2.0 - 2026-09-15
 
 - `slack_thread` flattens Block Kit blocks in its default rendering (blocks joined by ` / `, `[<type>]` for unknown types) and gains an opt-in `raw: true` mode returning thread messages as a pure JSON array for `slack_update` round-trips; both modes go through the existing size gate. (#21)

package/README.md

@@ -69,7 +69,7 @@ A 300 KB changelog page never touches your context window - you get a preview an
 | `extensions/session-name.ts` | `/session-name` | Manual + opt-in automatic session naming, naming rules and deny list, long-session revisits, and Ghostty/Herdr tab rename. OFF by default. |
 | `extensions/sword-header.ts` | `/builtin-header` | Themed ASCII startup header replacing pi's default logo. OFF by default. |
 | `extensions/fast-mode.ts` | `/fast` | Inject Anthropic fast-mode (`speed: "fast"` + `anthropic-beta: fast-mode-2026-02-01`) into every Claude Opus 4.8 / Opus 5 request, any thinking level. `--fast` flag + `/fast [on\|off\|status]`. OFF by default. |
-| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Policy D offers each stall to Pi's retry loop until the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) is exhausted. OFF by default. |
+| `extensions/provider-stall-watchdog.ts` | - | Opt-in provider-stall recovery, in two tiers: a pre-first-event deadline (`firstEventMs`, 20s) on every provider request in every mode, and the mid-stream pair (warn at 2 min, recover at 4 min) in TUI runs only. Each stall is aborted; while pi's `retry.enabled` is true and the stall retry budget (`maxStallRetries`, default = `retry.maxRetries`) remains, its aborted attempt is hidden from the model and re-driven by the watchdog after pi's backoff; behavior guide: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md). OFF by default. |
 | `extensions/slack.ts` | `slack_search`, `slack_thread`, `slack_post`, `slack_update`, `slack_delete`, `slack_pin`, `slack_upload`, `slack_cache_refresh` | Context-safe Slack search/threads/posting with dual `user`/`bot` token identities, Block Kit flattening and optional raw JSON output for threads, a workspace-keyed channel/user name->ID cache, DM targets by `@name` / user ID, fetch-style output size gating, and a transactional headline+detail-thread announce protocol with a documented recovery path. OFF by default. Behavior lives in `lib/slack-core.ts` and `lib/slack-cache.ts`. |
 
 Full routing rules, size-gate mechanics, and config: [doc/fetch.md](doc/fetch.md), [doc/doc-to-md.md](doc/doc-to-md.md), [doc/slack.md](doc/slack.md).
@@ -200,7 +200,7 @@ survive untouched.
 
 `sessionAutoName.enabled` makes one extra short LLM call per session (once, after the first turn) to title it; `false` (default) makes no model calls. `rules` appends house conventions to the naming prompt (later rules win when they conflict with the built-ins). Literal, case-insensitive `deny` phrases are stripped from every name; whitespace inside a phrase is loose, so `"acme corp"` also catches `AcmeCorp`. `revisitFirstTurn` re-evaluates the name once that many model round trips have completed, while `revisitEveryTurns` does so at every multiple; both default to `0` (off) because each revisit costs another short LLM call. For example, `10` and `100` mark round trips 10, 100, 200, 300. Revisits only run when the agent has fully settled (idle, nothing queued) - an automated multi-turn run such as a subagent chain is never renamed or delayed mid-flight; cadence points it crossed fire once, at the settle. A machine-generated name is replaced when stale. A name set by a human is never overwritten: the extension strongly prefers it, and announces a suggestion only when the work has clearly moved on. Counts come from the persisted transcript, so they survive resume.
 
-`herdrTab` (default `true`) mirrors the same curated label to the Herdr tab bar over Herdr's unix socket, independent of `ghosttyTab` - either sink can be toggled off without affecting the other. It's claim-once: the extension adopts a tab only while it still shows its default numeric label (its live 1-based position among the workspace's tabs); a manually renamed tab, or one renamed mid-session by hand, is never touched again for that session - the human's label always wins. One exception: exactly one leading `* ` (herdr-ntfy-notify's armed marker) is not a human rename - it is preserved across renames and the shutdown restore, and removing it keeps the claim. On every shutdown (quit, reload, `/new`, resume, fork) a claimed tab's label is restored to its then-current default position, so a successor session in the same pane can claim cleanly. It only ever runs in TUI mode, on an attached TTY, under Herdr (`HERDR_ENV`/`HERDR_TAB_ID`/`HERDR_SOCKET_PATH` all set) - `pi -p`/json/rpc runs and background subagents never touch the tab. Caveats: a hard crash (`kill -9`) skips the restore and leaves the stale label - rename the tab by hand to recover; and the restored label is internally a custom name (Herdr has no clear-to-auto API), so that tab keeps a number-looking label but stops renumbering on later tab closes/reorders.
+`herdrTab` (default `true`) mirrors the same curated label to the Herdr tab bar over Herdr's unix socket, independent of `ghosttyTab` - either sink can be toggled off without affecting the other. A tab is claimable while its label is a bare number (`1`, `4`, ...) at any position - Herdr's vocabulary for "unnamed" - so reordering tabs before or after naming never matters; a tab you deliberately name `3` is taken over too. A non-numeric label is treated as a human's and is never overwritten; the check repeats every turn, so renumbering the tab by hand hands it back. Exactly one leading `* ` (herdr-ntfy-notify's armed marker) is not a human rename - it is preserved across renames and the shutdown restore, and removing it keeps the claim. Every session claims afresh: on each shutdown (quit, reload, `/new`, resume, fork) a claimed tab is restored to its then-current position number, and the successor session in the pane claims it again on its first name. The label the extension writes is never digits-only - a bare `1234` becomes `#1234`, and the naming prompt asks the model for `PR 1234` / `issue 123` / `ticket ABC-123` instead of a bare ID. It only ever runs in TUI mode, on an attached TTY, under Herdr (`HERDR_ENV`/`HERDR_TAB_ID`/`HERDR_SOCKET_PATH` all set) - `pi -p`/json/rpc runs and background subagents never touch the tab. Caveat: the restored number is internally a custom name (Herdr has no clear-to-auto API), so that tab keeps a number-looking label but stops renumbering on later tab closes/reorders.
 
 `fastMode` only affects `claude-opus-4-8` and `claude-opus-5` requests on Anthropic's `anthropic-messages` API; enabling it opts into premium fast-mode pricing. `--fast` forces it on for one launch; `/fast on|off` toggles live. Proxy providers (opencode, cloudflare-ai-gateway) are excluded. `fastMode`'s header injection needs the `before_provider_headers` hook (pi bundling `@earendil-works/pi-coding-agent` >= 0.80.5); on older pi the beta header is silently not sent. The `anthropic-beta` header is discovered at request time by probing pi's own request assembly (no network), so conditional betas pi adds - e.g. `server-side-fallback-2026-07-01` for models with server-side fallback - are preserved alongside `fast-mode-2026-02-01`. If the probe fails, the header falls back to the static OAuth-identity + fast-mode list. See [doc/fetch.md](doc/fetch.md) and [doc/doc-to-md.md](doc/doc-to-md.md) for the ingestion tools' full reference; session-name/sword-header behavior above is complete.
 
@@ -239,18 +239,18 @@ not a pi-quiver setting and is never nested):
 
 `providerStallWatchdog` is OFF by default. Once enabled it arms in two tiers per provider request:
 
-- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error, so an unresponsive request recovers in ~22s (20s detection + Pi's 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
+- **Pre-first-event (`firstEventMs`).** Armed at every provider request, in every mode and from every origin - including extension-triggered turns that never emit `before_agent_start` - and cleared by the first assistant `message_start`. On expiry the request is aborted and, budget permitting, converted to a retryable error and re-driven after pi's backoff when `retry.enabled` is true, so an unresponsive request recovers in ~22s (20s detection + 2s backoff) instead of the ~240s it took when only the mid-stream tier existed.
 - **Mid-stream (`warningMs` / `recoveryMs`).** Armed from the first assistant `message_start` onward, and only when `ctx.mode === "tui"`. Aborting mid-generation discards billed output tokens and an unattended run has nobody to read the warning, so headless mid-stream silence deliberately falls through to the transport timeout instead.
 
 **Raise `firstEventMs` if your provider is legitimately slow to first event.** Queueing gateways, throttled endpoints, and busy single-slot local model servers can hold the connection for well over 20s before their first stream event; every false abort re-uploads the whole context and spends one stall retry.
 
 **Leave pi's own `httpIdleTimeoutMs` (default `300000`) at its default.** It is the transport backstop, and a single value drives undici's `headersTimeout` *and* `bodyTimeout` - lowering it to get fast pre-stream failure also truncates legitimate mid-stream gaps. `firstEventMs` is the knob for pre-stream silence.
 
-Verified with Pi 0.80.10: each stall is aborted and offered to Pi retry until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". Consecutive stall conversions consume Pi retry attempts without a success reset in between, so keep `maxStallRetries <= retry.maxRetries`. A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). Automatic continuation needs enabled Pi retry with remaining capacity. Disabled, exhausted, or incompatible retry degrades to manual resubmission. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed.
+Verified with Pi 0.87.1: each eligible stall is aborted, its message omitted from the model's context, and the request re-driven by the watchdog after pi's backoff (`retry.baseDelayMs`, capped at `retry.maxAgentDelayMs`) until `maxStallRetries` conversions are used; further stalls stop for manual resubmission. Both tiers draw on that one budget. `maxStallRetries` defaults to the layered `retry.maxRetries` (Pi default 3, an explicit `0` honoured); `0` is valid and means "detect and stop, never auto-retry". A successful assistant turn resets the stall counter (mirroring Pi's own retry counter). pi's `retry.enabled: false` disables the re-drive and degrades to manual resubmission without omitting the aborted message. Pending steering or follow-ups return to the editor and are excluded from automatic continuation. Invalid merged watchdog config fails closed. Print/json await pi's backoff before re-driving; TUI/RPC show a timer-path countdown that a new prompt cancels. Why the watchdog re-drives instead of pi, the hidden re-drive message, and the wait behavior: [doc/provider-stall-watchdog.md](doc/provider-stall-watchdog.md).
 
 Operational notes:
 
-- **Settings are read once per session,** on the first provider request. Editing `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension.
+- **Settings are read once per session,** on the first provider request. Editing watchdog settings in `settings.json` mid-session changes nothing until you restart the session - that includes repairing an invalid block that already disabled the extension. The exception is pi's `retry.enabled`, `retry.baseDelayMs`, and `retry.maxAgentDelayMs`, which the re-drive reads live at each stall.
 - **A watchdog abort that the provider ignores escalates after a fixed 10s.** Any post-abort stream event re-arms that deadline (bytes prove only that the connection was alive at that instant), so a stream that emits a straggler and then wedges still escalates 10s after its last event. This reduces the hang; it cannot force the provider to stop, and undici's timeouts remain the final backstop.
 - **Headless runs report on stderr.** In `print`/`json` mode pi binds a no-op UI, so watchdog notices go out via `console.warn`. Nothing is ever written to stdout, which `json` mode uses for its protocol. In TUI and RPC the notices render as main-window notifications, not the bottom status line.
 

package/extensions/fast-mode.ts

@@ -28,7 +28,7 @@
  */
 
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import type { Context, Model, StreamOptions, Usage } from "@earendil-works/pi-ai";
+import type { Context, Model, StreamOptions, TranscriptContext, Usage } from "@earendil-works/pi-ai";
 import { resolveConfig } from "../lib/extension-config.ts";
 
 export const FAST_MODE_BETA = "fast-mode-2026-02-01";
@@ -163,7 +163,7 @@ export async function probePiBetaHeader(
 	};
 	try {
 		const { anthropicMessagesApi } = await import("@earendil-works/pi-ai/compat");
-		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT, options);
+		const stream = anthropicMessagesApi().stream(model, PROBE_CONTEXT as TranscriptContext, options);
 		await stream.result().catch(() => {});
 	} catch {
 		return captured;

package/extensions/provider-stall-watchdog.ts

@@ -91,6 +91,27 @@ export function resolveRetryMaxRetries(cwd: string): number {
 	return maxRetries;
 }
 
+export type RetrySettings = { enabled: boolean; baseDelayMs: number; maxAgentDelayMs: number };
+
+export function resolveRetrySettings(cwd: string): RetrySettings {
+	const settings: RetrySettings = { enabled: true, baseDelayMs: 2_000, maxAgentDelayMs: 60_000 };
+	for (const path of settingsPaths(cwd)) {
+		const retry = readSettings(path)?.retry;
+		if (retry === null || typeof retry !== "object" || Array.isArray(retry)) continue;
+		const source = retry as Record<string, unknown>;
+		if (typeof source.enabled === "boolean") settings.enabled = source.enabled;
+		if (isNonNegativeInteger(source.baseDelayMs)) settings.baseDelayMs = source.baseDelayMs;
+		if (isNonNegativeInteger(source.maxAgentDelayMs)) settings.maxAgentDelayMs = source.maxAgentDelayMs;
+	}
+	return settings;
+}
+
+export function redriveDelayMs(settings: Pick<RetrySettings, "baseDelayMs" | "maxAgentDelayMs">, attempt: number): number {
+	const delay = settings.baseDelayMs * 2 ** Math.max(0, attempt - 1);
+	const safeDelay = Number.isSafeInteger(delay) ? delay : Number.MAX_SAFE_INTEGER;
+	return Math.min(safeDelay, settings.maxAgentDelayMs, MAX_TIMER_MS);
+}
+
 export function resolveWatchdogConfig(cwd: string, warn?: (msg: string) => void): ConfigValidation {
 	const candidate = resolveConfig(cwd, "providerStallWatchdog", DEFAULT_CANDIDATE, coerce, warn);
 	if (candidate.blockIsObject === true && candidate.maxStallRetries === undefined) {
@@ -105,6 +126,9 @@ const defaultRuntime: WatchdogRuntime = {
 	clearTimeout: (handle) => clearTimeout(handle as ReturnType<typeof setTimeout>),
 };
 
+const REDRIVE_TEXT = "The previous provider request stalled before completing and was retried automatically. Continue.";
+const RETRY_CANCELLED_NOTICE = "Automatic retry cancelled; submit the message again to retry manually.";
+const STATUS_KEY = "providerStallWatchdog";
 const DEGRADATION_NOTICE = "The stalled request was stopped, but Pi did not start an automatic retry. Retry may be disabled, exhausted, or incompatible; submit the message again to retry manually.";
 // Reduces, but cannot eliminate, the hang when an aborted provider operation never terminates;
 // undici's headersTimeout/bodyTimeout stay the backstop past this point.
@@ -157,6 +181,16 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		let stallRetriesUsed = 0;
 		let continuationStarted = false;
 		let convertedTimeout = false;
+		let redrivePending = false;
+		let redriveResolve: ((fired: boolean) => void) | undefined;
+		let exhaustedAbortGeneration: number | undefined;
+		let redriveEligible = false;
+		let redriveDelay = 0;
+		let redriveTimer: unknown;
+		let statusTimer: unknown;
+		let redriveInFlight = false;
+		let removeTerminalInput: (() => void) | undefined;
+		let statusUI: { setStatus(key: string, text: string | undefined): void } | undefined;
 
 		const clearTimers = () => {
 			for (const key of ["firstEvent", "warning", "recovery", "abortGuard"] as const) {
@@ -175,7 +209,24 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeGeneration = undefined;
 		};
 		const disarm = () => { clear(); warned = false; };
+		const cancelRedrive = () => {
+			if (redriveTimer !== undefined) runtime.clearTimeout(redriveTimer);
+			redriveTimer = undefined;
+			redriveResolve?.(false);
+			redriveResolve = undefined;
+			if (statusTimer !== undefined) runtime.clearTimeout(statusTimer);
+			statusTimer = undefined;
+			statusUI?.setStatus(STATUS_KEY, undefined);
+			statusUI = undefined;
+			removeTerminalInput?.();
+			removeTerminalInput = undefined;
+		};
 		const resetRunState = () => {
+			cancelRedrive();
+			redrivePending = false;
+			exhaustedAbortGeneration = undefined;
+			redriveEligible = false;
+			redriveInFlight = false;
 			disarm();
 			activeRun = false;
 			stallRetriesUsed = 0;
@@ -217,6 +268,7 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			// the generation check makes the callback a no-op if that teardown disarmed the watchdog.
 			armAbortGuard(capturedGeneration);
 			if (stallRetriesUsed >= config.maxStallRetries) {
+				exhaustedAbortGeneration = capturedGeneration;
 				announce(notices.exhausted());
 				ctx.abort();
 				return;
@@ -274,6 +326,11 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 		};
 
 		pi.on("before_provider_request", (_event, ctx) => {
+			if (redriveTimer !== undefined) resetRunState();
+			if (redriveInFlight) {
+				redriveInFlight = false;
+				continuationStarted = true;
+			} else if (convertedTimeout) continuationStarted = true;
 			if (disabled) return;
 			ui = ctx.ui;
 			hasUI = ctx.hasUI;
@@ -289,7 +346,6 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 			activeRun = config.enabled;
 			if (!activeRun) return;
 			disarm();
-			if (convertedTimeout) continuationStarted = true;
 			activeGeneration = ++generation;
 			lastSemanticAt = runtime.now();
 			const target = ctx.signal;
@@ -338,17 +394,67 @@ export function createProviderStallWatchdog(runtime: WatchdogRuntime = defaultRu
 				&& activeGeneration === watchdogAbortedGeneration;
 			disarm();
 			// Mirror Pi's retry loop, which resets its attempt counter on any successful assistant turn.
-			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") stallRetriesUsed = 0;
+			if (event.message.stopReason !== "aborted" && event.message.stopReason !== "error") { stallRetriesUsed = 0; convertedTimeout = false; redrivePending = false; redriveEligible = false; }
 			if (!matchesWatchdogAbort) return;
 			convertedTimeout = true;
+			redrivePending = true;
+			redriveEligible = false;
 			continuationStarted = false;
 			return { message: { ...event.message, stopReason: "error", errorMessage } };
 		});
+		pi.on("turn_end", (event, ctx) => {
+			// The converted generation is watchdogAbortedGeneration until this turn ends.
+			if (!redrivePending) return;
+			redrivePending = false;
+			const settings = resolveRetrySettings(ctx.cwd);
+			redriveEligible = settings.enabled;
+			if (!redriveEligible) return;
+			redriveDelay = redriveDelayMs(settings, stallRetriesUsed);
+			return { entries: [...event.entries, { type: "context_edit" as const, targetId: event.messageEntryId, replacement: null }] };
+		});
+		// Re-drive exists because pi >= 0.86 fences the whole run on session abort; delete it once pi offers a request-scoped abort.
+		const sendRedrive = () => {
+			cancelRedrive();
+			redriveInFlight = true;
+			redriveEligible = false;
+			try { pi.sendMessage({ customType: "provider-stall-watchdog", content: REDRIVE_TEXT, display: false }, { triggerTurn: true }); }
+			catch (error) { resetRunState(); announce(`providerStallWatchdog: automatic retry failed to start: ${error instanceof Error ? error.message : String(error)}`, "error"); }
+		};
+		const awaitRedriveDelay = () => new Promise<boolean>((resolve) => {
+			redriveResolve = resolve;
+			redriveTimer = runtime.setTimeout(() => { redriveTimer = undefined; redriveResolve = undefined; resolve(true); }, redriveDelay);
+		});
+		const armRedrive = (ctx: { ui: { setStatus(key: string, text: string | undefined): void; onTerminalInput(handler: (data: string) => any): () => void } }) => {
+			statusUI = ctx.ui;
+			const deadline = runtime.now() + redriveDelay;
+			const tick = () => {
+				if (redriveTimer === undefined || !config) return;
+				ctx.ui.setStatus(STATUS_KEY, `Retrying (${stallRetriesUsed}/${config.maxStallRetries}) in ${Math.ceil(Math.max(0, deadline - runtime.now()) / 1000)}s... (Esc to cancel)`);
+				if (deadline - runtime.now() > 1000) statusTimer = runtime.setTimeout(tick, 1000);
+			};
+			redriveTimer = runtime.setTimeout(sendRedrive, redriveDelay);
+			removeTerminalInput = ctx.ui.onTerminalInput((data) => {
+				if (data !== "\x1b") return;
+				resetRunState(); announce(RETRY_CANCELLED_NOTICE);
+				return { consume: true };
+			});
+			tick();
+		};
 		pi.on("agent_end", () => disarm());
-		pi.on("agent_settled", () => {
-			if (convertedTimeout && !continuationStarted) announce(DEGRADATION_NOTICE);
+		pi.on("agent_settled", async (_event, ctx) => {
+			if (exhaustedAbortGeneration !== undefined && exhaustedAbortGeneration === watchdogAbortedGeneration) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (convertedTimeout && continuationStarted) { resetRunState(); return; }
+			if (convertedTimeout && !redriveEligible) { announce(DEGRADATION_NOTICE); resetRunState(); return; }
+			if (redriveEligible) {
+				if (ctx.mode === "tui" || ctx.mode === "rpc") armRedrive(ctx);
+				else { if (await awaitRedriveDelay()) sendRedrive(); }
+				return;
+			}
 			resetRunState();
 		});
+		pi.on("input", () => { if (redriveTimer !== undefined || redriveInFlight) resetRunState(); });
+		pi.on("session_before_tree", () => { if (redriveTimer !== undefined) resetRunState(); });
+		pi.on("session_before_compact", () => { if (redriveTimer !== undefined) resetRunState(); });
 		pi.on("session_shutdown", () => {
 			resetRunState();
 			config = undefined;

package/extensions/session-name.ts

@@ -173,12 +173,15 @@ export function isGhosttyActive(
 }
 
 export function toTabLabel(name: string, maxWords = 4): string {
-	return name
+	const label = name
 		.replace(/[\u0000-\u001f\u007f]/g, " ")
 		.split(/\s+/)
 		.filter(Boolean)
 		.slice(0, maxWords)
 		.join(" ");
+	// A bare number is Herdr's "unnamed tab" vocabulary; our own label must
+	// never look like one or a successor session would treat it as claimable.
+	return /^\d+$/.test(label) ? `#${label}` : label;
 }
 
 /**
@@ -338,6 +341,7 @@ export function buildNamingPrompt(conversation: string, opts: PromptOptions = {}
 		"- Describe the actual task, NOT the tool/skill/command used to start it.",
 		"- Lead with an action verb (e.g. refine, fix, add, rework).",
 		"- Preserve ticket/issue IDs (e.g. ABC-123, PROJ-42, #99) verbatim.",
+		"- If the whole TAB would be just an ID, say what it is: PR 1234, issue 123, ticket ABC-123. Never reply with digits only.",
 		"- No quotes, no trailing punctuation, plain ASCII.",
 		...rules.map((r) => `- ${r}`),
 		"Example -> SESSION: Refine Linear Ticket ABC-123 / TAB: Refine ABC-123",
@@ -496,12 +500,15 @@ export function installSessionName(pi: ExtensionAPI, generate: NameGenerator = g
 		if (currentTabLabel) renameGhosttyTab(currentTabLabel, cfg.ghosttyTab);
 	};
 
-	// Herdr sink. Claim-once: adopt the tab only while it shows its default
-	// (position) label; a human rename - before or during the session - wins
-	// permanently. The one exception is exactly one leading "* ": that is
-	// herdr-ntfy-notify's armed marker, ignored for ownership and carried
-	// through on every write. All syncs serialize on one chain so overlapping
-	// hooks never interleave a read with a rename.
+	// Herdr sink. A tab is claimable while its label is a bare number - Herdr's
+	// vocabulary for "unnamed", and the only label this extension or
+	// herdr-ntfy-notify ever write back - regardless of position: Herdr stores a
+	// renamed number as a permanent custom label that reorders never update. A
+	// non-numeric label is a human's and is never overwritten; it is re-checked
+	// each turn so a tab renumbered by hand becomes claimable again. Exactly one
+	// leading "* " is herdr-ntfy-notify's armed marker, ignored for ownership and
+	// carried through on every write. All syncs serialize on one chain so
+	// overlapping hooks never interleave a read with a rename.
 	// Used both for turn_start syncs (bounds a wedged-but-accepting Herdr so it
 	// can't stall the turn) and for the session_end restore.
 	const HERDR_TIMEOUT_MS = 500;
@@ -514,44 +521,42 @@ export function installSessionName(pi: ExtensionAPI, generate: NameGenerator = g
 	};
 
 	const ARMED_PREFIX = "* ";
+	const NUMERIC = /^\d+$/;
 	const matchOwned = (live: string, expected: string): { owned: boolean; armed: boolean } => {
 		if (live === expected) return { owned: true, armed: false };
 		if (live === ARMED_PREFIX + expected) return { owned: true, armed: true };
 		return { owned: false, armed: false };
 	};
+	const matchClaimable = (live: string): { claimable: boolean; armed: boolean } => {
+		if (NUMERIC.test(live)) return { claimable: true, armed: false };
+		if (live.startsWith(ARMED_PREFIX) && NUMERIC.test(live.slice(ARMED_PREFIX.length))) return { claimable: true, armed: true };
+		return { claimable: false, armed: false };
+	};
 
 	const syncHerdrTab = (cfg: Config, label: string | null, mode: Mode | undefined): Promise<void> => {
 		const run = async (): Promise<void> => {
 			if (!cfg.herdrTab || mode !== "tui" || !label) return;
-			if (herdrClaim === "backed-off") return;
 			if (!isHerdrActive()) return;
 			const sock = process.env.HERDR_SOCKET_PATH as string;
 			const tabId = process.env.HERDR_TAB_ID as string;
-			if (herdrClaim === null) {
-				const tabs = await listTabs(sock, HERDR_TIMEOUT_MS);
-				if (!tabs) return; // transient; retry next sync
-				const position = positionOf(tabs, tabId);
-				if (position === -1) return; // stale tab id (pane moved); retry harmlessly
-				const own = tabs.find((t) => t.tab_id === tabId)!;
-				const owned = matchOwned(own.label, String(position));
-				if (!owned.owned) {
-					herdrClaim = "backed-off"; // human (or crashed predecessor) owns it
+			const live = await getTab(sock, tabId, HERDR_TIMEOUT_MS);
+			if (!live) return; // transient or stale tab id; a failed read is never a human rename
+			if (typeof herdrClaim === "object" && herdrClaim !== null) {
+				const owned = matchOwned(live.label, herdrClaim.lastWritten);
+				if (owned.owned) {
+					if (label === herdrClaim.lastWritten) return;
+					if (await renameTab(sock, tabId, (owned.armed ? ARMED_PREFIX : "") + label, HERDR_TIMEOUT_MS)) herdrClaim.lastWritten = label;
 					return;
 				}
-				if (await renameTab(sock, tabId, (owned.armed ? ARMED_PREFIX : "") + label, HERDR_TIMEOUT_MS)) {
-					herdrClaim = { lastWritten: label };
-				}
-				return;
 			}
-			const live = await getTab(sock, tabId, HERDR_TIMEOUT_MS);
-			if (!live) return; // failed read is not a human rename; stay claimed
-			const owned = matchOwned(live.label, herdrClaim.lastWritten);
-			if (!owned.owned) {
-				herdrClaim = "backed-off";
+			const claim = matchClaimable(live.label);
+			if (!claim.claimable) {
+				herdrClaim = "backed-off"; // human owns it until the label is numeric again
 				return;
 			}
-			if (label === herdrClaim.lastWritten) return;
-			if (await renameTab(sock, tabId, (owned.armed ? ARMED_PREFIX : "") + label, HERDR_TIMEOUT_MS)) herdrClaim.lastWritten = label;
+			if (await renameTab(sock, tabId, (claim.armed ? ARMED_PREFIX : "") + label, HERDR_TIMEOUT_MS)) {
+				herdrClaim = { lastWritten: label };
+			}
 		};
 		herdrChain = herdrChain.then(run, run);
 		return herdrChain;
@@ -595,6 +600,10 @@ export function installSessionName(pi: ExtensionAPI, generate: NameGenerator = g
 	});
 
 	pi.on("session_start", async (_event, ctx) => {
+		// Every session claims afresh, exactly like a fresh process: /new, resume,
+		// and fork each tear the previous session down (restore included) first.
+		// Before loadConfig so `enabled: false, herdrTab: true` resets too.
+		herdrClaim = null;
 		const cfg = loadConfig(ctx);
 		if (!cfg.enabled) return; // off by default; opt in via settings.json
 		const current = pi.getSessionName();
@@ -646,9 +655,9 @@ export function installSessionName(pi: ExtensionAPI, generate: NameGenerator = g
 	});
 
 	// Restore the numeric label on every teardown reason (quit/reload/new/
-	// resume/fork): a successor session in this pane must find the default so
-	// claim-once stays sound. The restored label is internally a custom name -
-	// Herdr has no clear-to-auto API - so it looks right but won't renumber.
+	// resume/fork) so the pane reads as unnamed again. The restored label is
+	// internally a custom name - Herdr has no clear-to-auto API - so it won't
+	// renumber on reorders; the successor claims any numeric label regardless.
 	pi.on("session_shutdown", async () => {
 		await restoreHerdrTab();
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-quiver",
-  "version": "6.2.0",
+  "version": "6.3.1",
   "description": "Personal pack of Pi coding-agent extensions: context-safe fetch, doc_to_md PDF/DOCX/PPTX-to-Markdown conversion, session naming, a themed ASCII startup header, Opus 4.8 fast mode, and a provider-stall watchdog.",
   "author": "Jacek Juraszek",
   "license": "MIT",
@@ -87,9 +87,9 @@
     "unpdf": "^1.8.1"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.2",
-    "@earendil-works/pi-coding-agent": "^0.84.2",
-    "@earendil-works/pi-tui": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.87.1",
+    "@earendil-works/pi-coding-agent": "^0.87.1",
+    "@earendil-works/pi-tui": "^0.87.1",
     "@sinclair/typebox": "^0.34.49",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^26.1.0",