pig-claude-bridge 0.4.0 → 0.6.0

package/README.md

@@ -30,9 +30,9 @@ Use `/model` to select any Claude model in the catalog, e.g. `claude-bridge/clau
 
 Behind the scenes, PiG's tools are bridged to Claude Code but everything works like normal in PiG. Bash commands get Claude Code's 120-second default timeout since PiG's bash has none. Skills are forwarded to Claude Code's system prompt, and steering mid-turn reaches Claude at the next tool boundary.
 
-The model list is a static table generated from the Anthropic catalog of `@earendil-works/pi-ai` 1.2.0 (`scripts/dev/gen-catalog.mjs`) and registered when the extension loads; it does not follow later catalog updates. Dated snapshot ids are not shown. See [docs/compatibility.md](docs/compatibility.md) (D5).
+The model list is a static table generated from the Anthropic catalog of `@earendil-works/pi-ai` 1.5.0 (`scripts/dev/gen-catalog.mjs`) and registered when the extension loads; it does not follow later catalog updates. Models Claude Code ships before pi-ai does (currently Fable 5.2) are listed by hand in `internal/models/pending.go` until a regenerated catalog carries them. Dated snapshot ids are not shown. See [docs/compatibility.md](docs/compatibility.md) (D5).
 
-**1M context:** Fable 5/5.1, Opus 5.5/5/4.8/4.7, and Sonnet 5.5/5 get 1M context. Opus 4.6 gets 1M on Max, Ultra, Team (Standard and Premium seats) and Enterprise plans or with Extra Usage, and Sonnet 4.6 only with Extra Usage ([Claude Code docs](https://code.claude.com/docs/en/model-config#extended-context)): the extension detects the plan by itself (see `provider.plan` in [Configuration](#configuration)); set `provider.longContextExtraUsage` for Extra Usage.
+**1M context:** Fable 5/5.1/5.2, Opus 5.5/5/4.8/4.7, and Sonnet 5.5/5 get 1M context. Opus 4.6 gets 1M on Max, Ultra, Team (Standard and Premium seats) and Enterprise plans or with Extra Usage, and Sonnet 4.6 only with Extra Usage ([Claude Code docs](https://code.claude.com/docs/en/model-config#extended-context)): the extension detects the plan by itself (see `provider.plan` in [Configuration](#configuration)); set `provider.longContextExtraUsage` for Extra Usage.
 
 **Fast mode:** `/claude-fast` turns Claude Code's fast mode on or off for the rest of the session (`/claude-fast on`, `/claude-fast off`, or no argument to toggle); set `provider.fastMode` to `true` to start every session with it on. It takes effect from the next turn, on models that have fast mode (Opus 5.5, for example); other models ignore it. On subscription plans fast mode is billed to usage credits, not to the plan's limits, and on Team and Enterprise an Owner has to enable it for the organization first ([Claude Code docs](https://code.claude.com/docs/en/fast-mode)). While it is on, the footer shows `fast` (see [Footer status](#footer-status)).
 
@@ -52,12 +52,9 @@ The plan shows from session start, fast mode as soon as `/claude-fast` changes i
 
 ## Configuration
 
-Config file `claude-bridge.json`, in two places (the project file is merged over the global one, key by key):
+Config file `claude-bridge.json` in PiG's agent directory, `~/.pig/agent` by default (`$PIG_HOME/agent`, or `PIG_CODING_AGENT_DIR`). With `PIG_USE_PI_DIRS=1` PiG shares Pi's tree and this is `~/.pi/agent` (or `PI_CODING_AGENT_DIR`). There is no project config (pi-claude-bridge #198): a cloned repo could otherwise point the bridge at its own Claude Code executable or turn on metered billing. For the same reason Claude Code loads only `~/.claude/settings.json` on the provider path, never a repo's `.claude/settings.json` or `settings.local.json`.
 
-- global: PiG's agent directory, `~/.pig/agent` by default (`$PIG_HOME/agent`, or `PIG_CODING_AGENT_DIR`). With `PIG_USE_PI_DIRS=1` PiG shares Pi's tree and this is `~/.pi/agent` (or `PI_CODING_AGENT_DIR`).
-- project: `<project>/.pig/claude-bridge.json`; under `PIG_USE_PI_DIRS=1`, `<project>/.pi/claude-bridge.json`.
-
-The extension asks PiG for both directories; nothing is hard-coded. A missing or unparseable file counts as empty; with `CLAUDE_BRIDGE_DEBUG` set, a parse failure is written to the debug log. A key with a value of the wrong type is ignored, except `askClaude.allowFullMode` and `askClaude.defaultMode`, which fail closed (full mode denied, mode `none`).
+The extension asks PiG for the directory; nothing is hard-coded. A missing or unparseable file counts as empty; with `CLAUDE_BRIDGE_DEBUG` set, a parse failure is written to the debug log. A key with a value of the wrong type is ignored, except `askClaude.allowFullMode` and `askClaude.defaultMode`, which fail closed (full mode denied, mode `none`).
 
 ```json
 {
@@ -184,9 +181,9 @@ Claude Code sends a `rate_limit_event` when a usage window changes. The TypeScri
 
 ## Known issues
 
-**A session rebuild re-sends the whole conversation.** The bridge rewrites Claude Code's session from PiG's history whenever the two diverge (after an abort, `/compact`, tree navigation, an API error, or on returning to a session), and the next request usually misses the prompt cache for everything past the system prompt. Abort-heavy sessions cost noticeably more.
+**Session sync.** The bridge compares PiG's history with what Claude Code's session file covers, message by message. An unchanged history resumes the session; a rewind, edit, abort, failed turn or restart forks or trims it at the last point both agree and imports only what follows; a full import happens only when the model, the system prompt or the working directory changed. The pointer from a PiG session to its Claude Code session lives under `<agent dir>/claude-bridge/sessions/` (user-only files), so a restart or `/reload` forks the earlier session instead of re-sending the conversation, and a `/fork` or clone continues from its parent's. Each import or trim still costs that turn a prompt-cache miss for what it rewrote.
 
-**Files Claude Code edits are not carried across a rebuild.** The edit itself survives in the history as a tool call and result; what is lost is the post-edit file snapshot. `@file` expansions *are* carried.
+**Files Claude Code edits are not carried across an import.** The edit itself survives in the history as a tool call and result; what is lost is the post-edit file snapshot. `@file` expansions and tool results Claude Code saved to a file *are* carried.
 
 **System prompt changes mid-session may not reach the model.** Project context (AGENTS.md/CLAUDE.md), skills, and extension-written instructions are captured on the first request and reused on resume. This keeps the cached prefix stable, but later changes may not take effect until a rebuild or compaction. Start a new session if updated instructions must take effect immediately.
 

package/UPSTREAM.md

@@ -6,13 +6,13 @@ This extension is a Go port of [pi-claude-bridge](https://github.com/elidickinso
 
 | what | pin |
 |---|---|
-| pi-claude-bridge | `6aa276a1498e5376363f5c1f8cf04bfcaee38c93`, plus these later commits ported on their own: f502f5d (silent-turn reminder, MCP description limit), 2edde93 (interrupted-turn resume), 5c4a268 (default output style), e93d51d (parent-session env markers), 0b096a8 (thinking off). The 0.10.0 session-sync rework (#222) and the AskClaude split (0.11.0) are not ported |
-| cc-session-io | 0.4.0 (MIT), the subset the bridge imports |
+| pi-claude-bridge | `acbe45b` (0.11.0). The AskClaude package split and `src/cache-trace.ts` are not ported (docs/compatibility.md D8, D9); `src/index.ts` line ranges below are those of 6aa276a, where the code moved they name the 0.11.0 function instead |
+| cc-session-io | 0.4.1 (MIT), the subset the bridge imports |
 | `@anthropic-ai/claude-agent-sdk` | 0.3.310 (Claude Code 2.1.310). The protocol client was written from the SDK's public type definitions and live probes ([protocol reference](docs/reference/agent-sdk-protocol-0.3.310.md)); the SDK itself is not vendored or depended on |
 | Claude Code | 2.1.310 (`ccproto.MinVersion`) |
 | PiG SDK | `github.com/MichaelKinsy/PiG/extensions/sdk` v0.7.0 (PiG 0.7.0); the [signatures](docs/reference/pig-sdk-signatures-v0.5.3.md) recorded at v0.5.3 still match every symbol the bridge uses |
 | `@modelcontextprotocol/sdk` | 1.29.0, only as the reference for the JSON-RPC responses the in-process MCP server must produce |
-| `@earendil-works/pi-ai` | 1.2.0, source of the generated model catalog |
+| `@earendil-works/pi-ai` | 1.5.0, source of the generated model catalog |
 | `golang.org/x/text` | v0.43.0, for NFC normalisation of project paths |
 
 ## File map
@@ -26,7 +26,10 @@ Paths are relative to `extensions/pig-claude-bridge/`. TypeScript paths are `src
 | `internal/askclaude/tool.go` | `index.ts` 2662-2780 and the AskClaude call handler near 1750 | tool definition, remembered/isolated sessions, notices |
 | `internal/askclaude/ui.go` | `askclaude-ui.ts` | action summary and tool-name mapping, rendered as lines (D6) |
 | `internal/bridge/askclaude.go` | `index.ts` `promptAndWait` (2263) | AskClaude query path |
-| `internal/bridge/consume.go` | `index.ts` 1028-1100, 1486-1790 (`consumeQuery`, steering, tool-result delivery, abort, discard) | goroutines and channels instead of the event loop (D3) |
+| `internal/bridge/consume.go` | `index.ts` 1028-1100, 1486-1790 (`consumeQuery`, steering, tool-result delivery, abort, discard; 0.11.0 `discardRewrittenQuery`, `dropParkedQuery`, `deliverToolResults`) | goroutines and channels instead of the event loop (D3) |
+| `internal/bridge/recording.go` | `session-sync.ts` (`Recording`, `compareHistory`, `importHistory`, `LiveRecording`), `session-transcript.ts` (`resolveRecordingCut`, `recordedToolResults`) | mutex-guarded |
+| `internal/bridge/recordtap.go` | 0.11.0 `index.ts` `tapRecording`, `incorporate`, `recordAssistantEmission`, `completeAssistantRecording` | |
+| `internal/bridge/sessionstore.go` | `session-store.ts` | `""` stands for a null uuid in memory; the file keeps JSON null |
 | `internal/bridge/debug.go` | `index.ts` 36-150 (`debug`, `makeCliDebugOptions`, `diagDump`) | |
 | `internal/bridge/hooks.go` | `index.ts` 2463-2660 (event handlers) | `session_start`, `before_agent_start`, `agent_start`, `turn_start`, compaction/tree, shutdown |
 | `internal/bridge/host.go` | new (Go-only) | `Host` interface and `Deps`, so the PiG SDK stays confined to `extension.go` and the bridge is testable with a fake host |
@@ -37,12 +40,14 @@ Paths are relative to `extensions/pig-claude-bridge/`. TypeScript paths are `src
 | `internal/bridge/query.go` | `query-state.ts`, `prompt-stream.ts`, `index.ts` 480-494 (`newAssistantOutput`) | |
 | `internal/bridge/ratelimit.go` | `rate-limit.ts`, `index.ts` 510-550 | headers go to the debug log only (D1) |
 | `internal/bridge/sessioncwd.go` | `session-cwd.ts` | most-recent-pending summary slot (D7) |
-| `internal/bridge/state.go` | `index.ts` 187-340 (`SessionState`, `sessionKey`, `markRebuildForSession`, `armStaleContexts`) | `sponsorMarkRebuildForSession` not ported (D4) |
+| `internal/bridge/state.go` | 0.11.0 `index.ts` "Session persistence" (`sessionStateFor`, `inheritSessionState`, `setSessionStateFor`, `markRebuildForSession`, `armStaleContexts`, `waitForSessionWriter`) | `sponsorMarkRebuildForSession` not ported (D4) |
 | `internal/bridge/stream.go` | `index.ts` 1101-1216, 1215-1485 (`processStreamEvent`, `processAssistantMessage`, finalisation) | |
-| `internal/bridge/sync.go` | `index.ts` 341-420, 600-720 (`syncSharedSession`, `turnStart`, `convertAndImportMessages`, `verifyWrittenSession`, `safeRealpath`), 219-237 (`readCarriedAttachments`) | |
+| `internal/bridge/sync.go` | 0.11.0 `index.ts` `syncSharedSession`, `turnStart`, `verifyWrittenSession`, `safeRealpath`, `debugSessionPaths` | `importForAskClaude` is the port's (D8) |
 | `internal/bridge/toolargs.go` | `index.ts` 914-1018 (`piToolNameFor`, `mapToolArgs`) | |
 | `internal/bridge/usage.go` | `usage.ts`, `index.ts` `recordUsage` | |
-| `internal/ccproto/args.go` | `index.ts` 53-57 (`CC_CHILD_ENV`), 2030-2096 (query options); the SDK's argv builder (`sdk.mjs`) | argv pinned by `testdata/sdk-argv-snapshot.json` |
+| `internal/ccproto/args.go` | `cc-child.ts` (`CC_CHILD_ENV`, `PARENT_SESSION_VARS`, `SESSION_STORAGE_VARS`, `ccChildEnv`), `index.ts` query options; the SDK's argv builder (`sdk.mjs`) | argv pinned by `testdata/sdk-argv-snapshot.json`; `CLAUDE_CODE_DISABLE_FEATURE_FLAGS` is the port's |
+| `internal/ccsession/transcript.go` | `session-transcript.ts` (`readTranscript`, `findBoundary`, `resolveCut`, `savePrefixSession`, the tool-result index of `recordedToolResults`) | |
+| `internal/digest/digest.go` | `message-digests.ts` | pinned by `tests/fixtures/message-digests.json` (`scripts/dev/gen-digests.mjs`) |
 | `internal/ccproto/control.go` | the SDK's control protocol (`sdk.mjs`), reference sections 2 to 4 | requests, responses, inbound `mcp_message`, interrupt |
 | `internal/ccproto/exec.go` | `index.ts` executable options; the SDK's executable handling | `claude` from `PATH` and version check (D2) |
 | `internal/ccproto/messages.go` | the SDK's `SDKUserMessage` type, reference section 4 | |
@@ -63,8 +68,9 @@ Paths are relative to `extensions/pig-claude-bridge/`. TypeScript paths are `src
 | `internal/convert/transcript.go` | `transcript.ts` | |
 | `internal/mcptools/schema.go` | `mcp-server.ts` (root-schema flattening) | |
 | `internal/mcptools/server.go` | `mcp-server.ts`; `@modelcontextprotocol/sdk` 1.29.0 for response shapes | |
-| `internal/models/catalog_gen.go` | new (Go-only), generated by `scripts/dev/gen-catalog.mjs` from `@earendil-works/pi-ai` 1.2.0 | static catalog (D5); do not edit |
+| `internal/models/catalog_gen.go` | new (Go-only), generated by `scripts/dev/gen-catalog.mjs` from `@earendil-works/pi-ai` 1.5.0 | static catalog (D5); do not edit |
 | `internal/models/models.go` | `models.ts` | |
+| `internal/models/pending.go` | new (Go-only) | models Claude Code ships before pi-ai's catalog does (Fable 5.2); an entry leaves when a regenerated catalog carries it |
 | `internal/promptcapture/capture.go` | `prompt-capture.ts` | |
 
 ## Bump procedure

package/docs/compatibility.md

@@ -10,11 +10,11 @@ What this port is pinned to, and every place where it differs from the TypeScrip
 | PiG Go SDK | `github.com/MichaelKinsy/PiG/extensions/sdk` v0.7.0, Go 1.26 floor |
 | Claude Code | 2.1.310 minimum (the port warns when the binary is older); verified against 2.1.319 |
 | Agent SDK protocol | `@anthropic-ai/claude-agent-sdk` 0.3.310 (Claude Code 2.1.310); [reference](reference/agent-sdk-protocol-0.3.310.md). 0.3.308 to 0.3.310 changes nothing on the wire that the bridge uses; the one new control subtype, survey feedback, is never sent |
-| pi-claude-bridge | `6aa276a`, https://github.com/elidickinson/pi-claude-bridge, plus the later commits listed in [../UPSTREAM.md](../UPSTREAM.md) (see "Ported after 6aa276a" below) |
-| cc-session-io | 0.4.0 (MIT) |
+| pi-claude-bridge | `acbe45b` (0.11.0), https://github.com/elidickinson/pi-claude-bridge; see "Caught up to 0.11.0" below for what is not ported |
+| cc-session-io | 0.4.1 (MIT), the subset the bridge imports (`addToolResultBlocks` as `AddToolResultBlocks`; the 0.4.1 timestamp stamping is approximated by the port's monotonic clock) |
 | Pi compatibility surface | pi 1.4.0 (the Pi that PiG 0.5.3 tracks) |
 | `@modelcontextprotocol/sdk` | 1.31.0 (the TypeScript declares `^1.29.0`), only as the reference for the JSON-RPC responses the in-process MCP server produces |
-| Model catalog | `@earendil-works/pi-ai` 1.2.0, generated into `internal/models/catalog_gen.go` |
+| Model catalog | `@earendil-works/pi-ai` 1.5.0, generated into `internal/models/catalog_gen.go` |
 
 ## Principal differences (D1 to D7)
 
@@ -26,12 +26,18 @@ What this port is pinned to, and every place where it differs from the TypeScrip
 
 **D4. Subagent mark sponsorship is not ported.** TypeScript: `sponsorMarkRebuildForSession` lets a subagent hand a rebuild mark to the module instance that serves the session, because several module instances share one process. Port: PiG subagents are separate processes, so there is nothing to sponsor; the function has no counterpart. The matching test, `unit-session-cwd` "shares the store across module instances", has no Go counterpart either.
 
-**D5. The model list is a static catalog registered in the factory.** TypeScript: the list comes from pi-ai's Anthropic catalog at run time and follows package updates. Port: `scripts/dev/gen-catalog.mjs` generates `internal/models/catalog_gen.go` from `@earendil-works/pi-ai` 1.2.0 and the provider is registered when the extension loads, with nothing registered at `session_start`. Reason: spike S1 showed that registration from `session_start` is too late for `defaultProvider`/`defaultModel` resolution at startup, so the catalog must be known in the factory. A new Claude model needs a regenerated catalog (see [../UPSTREAM.md](../UPSTREAM.md)).
+**D5. The model list is a static catalog registered in the factory.** TypeScript: the list comes from pi-ai's Anthropic catalog at run time and follows package updates. Port: `scripts/dev/gen-catalog.mjs` generates `internal/models/catalog_gen.go` from `@earendil-works/pi-ai` 1.5.0 and the provider is registered when the extension loads, with nothing registered at `session_start`. Reason: spike S1 showed that registration from `session_start` is too late for `defaultProvider`/`defaultModel` resolution at startup, so the catalog must be known in the factory. A new Claude model needs a regenerated catalog (see [../UPSTREAM.md](../UPSTREAM.md)).
 
 **D6. AskClaude renders as lines.** TypeScript: `askclaude-ui.ts` builds pi-tui components (colour, "(to expand)" affordance). Port: PiG's `ToolDefinition.RenderCall`/`RenderResult` return lines, so the action summary is plain lines without colour, with "… (to expand)" as text, and truncation counts runes.
 
 **D7. Summary attribution by the most recent pending compaction.** TypeScript: `session-cwd.ts` keys the pending summary session by the identity of the request's `AbortSignal`. Port: Go has no such identity, so a single most-recent-pending slot is set at `session_before_compact` / `session_before_tree` and the isolated summary query reads it; it is not cleared by the read (Pi makes several summary calls per operation, compaction makes two) and `forgetSummarySession` clears it only if no other session has been remembered since. With two sessions summarising at once in one process, the later one wins. A compaction that fails or is aborted never reaches `session_compact`, so the port also forgets the pending session at PiG's `session_compact_failed` (fired after a failed or aborted compaction, PiG `compaction.md`); without it the stale slot would hand that session's cwd to a later summary from another session. The TypeScript needs no such hook because a cancelled compaction's signal is never looked up again. A cancelled tree navigation has no failure event, so its slot stays until the next `session_before_compact` or `session_before_tree` replaces it.
 
+**D8. AskClaude stays in this package.** TypeScript 0.11.0 moved the tool to `pi-claude-bridge-askclaude`, its own npm package with its own copy of the conversion and child env. Port: the tool stays in `internal/askclaude`, off unless `askClaude.enabled` is set, and its shared mode imports pi's history into a session of its own (`importForAskClaude`) without touching the provider's mirror. Reason: a second Go package means a second binary, release flow and repo for a tool that is already opt-in.
+
+**D9. No cache trace.** TypeScript: `CLAUDE_BRIDGE_TRACE_DIR` writes a per-query trace (`src/cache-trace.ts`) that `diag/audit-cache.mjs` analyses. Port: not ported; `CLAUDE_BRIDGE_DEBUG` and the `syncResult:` decision lines remain. Reason: debug tooling with no user-facing behaviour.
+
+**D10. Shutdown kills every live child.** TypeScript: `session_shutdown` closes only the shutting-down session's parked queries, since subagents share the process. Port: the session's own parked queries are closed first with their progress committed, then every Claude Code child this process started is killed (as before). Reason: PiG subagents are separate processes (D4), so another session's live query in the same process does not occur.
+
 ## Rulings that changed the plan
 
 - Work in place on branch `feat/native-port`, no worktree: the repo is new and single-purpose.
@@ -71,8 +77,10 @@ What this port is pinned to, and every place where it differs from the TypeScrip
 
 ### Session files and logs
 
-- `syncSharedSession` takes `host` and `modelID`.
-- The `APPEND` log line prints the advanced cursor (TypeScript prints the pre-advance cursor).
+- `syncSharedSession` takes `host`, `modelID` and `promptDigest`; its `syncResult:` line carries the row and reason in one line where the TypeScript logs them across its trace.
+- The persisted state file is the TypeScript's (`s-<sha256 of the UTF-16LE pi session id>.json`, version 1), under PiG's agent dir rather than Pi's, so the two bridges never read each other's pointers.
+- A prefix write re-emits the retained records through a key-order-preserving field rewrite (`sessionId`, and `parentUuid` on the suffix's first record), where the TypeScript spreads the object.
+- The fake Claude Code the unit tests drive echoes completed blocks before closing them and writes session records, as the real one does; the TypeScript tests stub the SDK instead.
 - The `[moduleInstanceId]` bracket is dropped from log lines (the TypeScript `diag/*.mjs` parsers expect it); the deadlock-check regex was adapted. The `imported roles:` debug line and the sanitized-id list are dropped.
 - Stderr tail counts runes where the SDK counts UTF-16 units.
 - An empty `CLAUDE_CONFIG_DIR` counts as unset (`??` in JavaScript would use it), and with `HOME` unset the Claude config dir falls back to the account's home directory instead of a relative `.claude`.
@@ -84,7 +92,7 @@ What this port is pinned to, and every place where it differs from the TypeScrip
 ### Provider stream and notices
 
 - `Details.executionTime` is an `int64`.
-- The "Claude Code returned an error result" replacement is unreachable, as in the TypeScript (the loop stops at the error result). An error result drops the mirror, while a process exit or panic marks rebuild (the TypeScript drops the mirror on exit too).
+- The "Claude Code returned an error result" replacement is unreachable, as in the TypeScript (the loop stops at the error result). A failed query (error result, process exit, panic) commits its recording dirty, as the TypeScript does; nothing drops the mirror any more.
 - Abort lifetime is proven by the live smoke's tool round trip. Abort follows `ctx.Signal()`, PiG's run-scoped signal, where the plan said `ctx.Done()`: the per-request `Done()` is cancelled when each provider call ends, which would kill a query parked at a tool call between calls; `Done()` is used only when a context carries no signal.
 - Abort is honoured while Claude Code starts: the call's cancellation reaches the spawn until the `initialize` answer arrives (spike S2 saw about 4 s, inferred to be user `SessionStart` hooks), so an abort then ends the turn as aborted instead of waiting; after that, the stream's own abort wiring takes over, so a parked query still survives between calls. The isolated and AskClaude paths spawn under the call's context. `claude --version` is bounded by 10 s and runs once at a time; a probe that times out is logged and does not fail the query, and an abort during the probe ends the turn as aborted without caching a result. Only the leading `x.y.z` of the version output is read.
 - The cost of a turn leaves out pi-ai's `cost.tiers` and `cacheWrite1h`. The registered models carry zero rates and no tiers, so the cost is zero either way.
@@ -127,18 +135,13 @@ What this port is pinned to, and every place where it differs from the TypeScrip
 - The alternative provider for the AskClaude, image and session-resume tests must come from `CLAUDE_BRIDGE_TESTING_ALT_PROVIDER`, `CLAUDE_BRIDGE_TESTING_ALT_MODEL` and that provider's API-key variable, because every live run uses a fresh `PIG_HOME`/`PIG_CODING_AGENT_DIR` (the TypeScript suite used the real agent dir). Without them those checks skip.
 - The deadlock-check log pattern, the shutdown test (a third case for the stdin close) and the subagent test (our own agent definition, run through `@tintinweb/pi-subagents`) are adapted as listed in [verification.md](verification.md).
 
-## Ported after 6aa276a
-
-Upstream pi-claude-bridge moved on to 0.11.0 (acbe45b, 100 commits) after the pin. These were ported on their own, each with the TypeScript commit; the rest is listed below.
+## Caught up to 0.11.0
 
-- **Child environment (f502f5d, 2edde93).** `CLAUDE_CODE_SILENT_TURN_REMINDER=0`, `CLAUDE_CODE_MAX_MCP_DESCRIPTION_LENGTH=16384` and `CLAUDE_CODE_RESUME_INTERRUPTED_TURN_MAX_AGE_MS=1` join `CCChildEnv`. The argv snapshot predates them, so `TestArgvMatchesNodeSdkSnapshot` sets them aside and `TestBuildEnv` pins their values.
-- **Parent-session markers (e93d51d, #198).** When `CLAUDECODE` is set in PiG's environment, the parent Claude Code session's markers are dropped from the child env. The TypeScript also moved `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` off its own `process.env`; the port never set it there.
-- **Default output style (5c4a268, #220).** The provider's `--settings` carries `outputStyle: "default"`. Pinned live by `TestOutputStyleDefaultOverridesAUserLevelOutputStyle`.
-- **Thinking off (0b096a8, #152).** No reasoning level means `--thinking=disabled` on the provider and isolated paths, for reasoning models whose `thinkingLevelMap` does not mark `off` as `null`.
+The port followed pi-claude-bridge from 6aa276a to acbe45b (0.10.0 and 0.11.0, 100 commits). Ported: the content-based session sync (#222) with its live recording, cuts, prefix writes, forks and persisted state; the conversion changes (#227, #207, #242); the child environment (f502f5d, 2edde93, e93d51d), `settingSources: ["user"]` and the end of the project config (#198); the default output style (#220); thinking off (#152); provider env; the Extra Usage notice (#201, #213); same-session routing (#111); parked-query closing at shutdown (#210, as D10); the bash default timeout in the `tool_call` hook (#203); the fallback fix (87f67d1). The argv snapshot predates some of these, so `TestArgvMatchesNodeSdkSnapshot` sets `EnvAddedAfterSnapshot`, `--setting-sources=user`, `--session-id` and `outputStyle` aside, and the unit tests pin them instead.
 
 Port-only, with no TypeScript counterpart: **`CLAUDE_CODE_DISABLE_FEATURE_FLAGS=1`** in `CCChildEnv`. In Claude Code 2.1.319 feature-flag evaluation (`Ph()`) requires both no disable variable and telemetry on, and `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` counts as telemetry off, so the TypeScript already runs with flags off; the explicit variable also keeps the disk cache closed should `CLAUDE_CODE_GB_DISK_CACHE_WHEN_TELEMETRY_OFF` be exported, and `TestDisableFeatureFlagsTurnsFlagEvaluationOff` pins the behaviour.
 
-Not ported from 0.10.0 and 0.11.0: the content-digest session sync (#222: forks and trims instead of rebuilds, atomic session state, `/fork` and clone continuing the parent's Claude Code session), `CLAUDE_BRIDGE_TRACE_DIR`, provider `env` from `auth.json`, the Extra Usage billing notice, the empty-tool-result placeholder (#227), Claude Code's normalised tool args (#242), the `settingSources` change that stops loading a repo's `.claude/settings*.json` (#198), the AskClaude split into its own package, and the removal of the `provider.plan` notice (the port detects the plan instead). D1 to D7 above still hold.
+Not ported: the AskClaude split (D8), `CLAUDE_BRIDGE_TRACE_DIR` and the `diag/` tooling (D9), the per-session scope of shutdown (D10), the removal of the `provider.plan` startup notice (the port detects the plan instead and never asked), and the `BRIDGE_VERSION`/SDK version log line at load. D1 to D7 above still hold.
 
 ## Pi-only tests that are not ported
 

package/extensions/pig-claude-bridge/extension.go

@@ -129,8 +129,7 @@ func Extension() *sdk.Extension {
 	// unread and the logs beside the cwd, and the extension still loads.
 	agentDir, _ := sdk.AgentDir()
 	configDirName, _ := sdk.ConfigDirName()
-	cwd, _ := os.Getwd()
-	cfg := config.Load(agentDir, cwd, configDirName)
+	cfg := config.Load(agentDir)
 	// Detected before the provider registers, since the plan decides which models get 1M.
 	// Skipped outside a host, so validate-only installs and tests never spawn claude.
 	if agentDir != "" && cfg.Provider.Plan == nil {
@@ -196,7 +195,8 @@ func Extension() *sdk.Extension {
 	ext.OnSessionStart(func(ctx sdk.Context, data map[string]any) (any, error) {
 		defer func() { _ = recover() }()
 		reason, _ := data["reason"].(string)
-		b.OnSessionStart(sdkHost{ctx}, reason)
+		previous, _ := data["previousSessionFile"].(string)
+		b.OnSessionStart(sdkHost{ctx}, reason, previous)
 		return nil, nil
 	})
 	forward := func(event string, fn func(h bridge.Host, data map[string]any)) {
@@ -218,6 +218,19 @@ func Extension() *sdk.Extension {
 	forward("session_compact_failed", func(h bridge.Host, _ map[string]any) { b.OnSessionCompactFailed(h) })
 	forward("session_tree", func(h bridge.Host, _ map[string]any) { b.OnSessionTree(h) })
 	forward("session_shutdown", func(h bridge.Host, _ map[string]any) { b.OnSessionShutdown(h) })
+	// Claude Code models expect bash to time out (CC's default is 120s); PiG's bash has none.
+	// Set on the execution copy PiG hands tool_call handlers, not in the stored call, so PiG's
+	// history keeps the arguments CC sent and a rebuild matches CC's records (pi-claude-bridge
+	// #203). A `background: true` call (added by an extension) doesn't block the turn, so it
+	// gets no default.
+	ext.OnEvent("tool_call", func(ctx sdk.Context, data map[string]any) (any, error) {
+		defer func() { _ = recover() }()
+		input, _ := data["input"].(map[string]any)
+		if sdk.IsToolCallEventType("bash", data) && input != nil && input["timeout"] == nil && input["background"] != true && ctx.ModelProvider() == "claude-bridge" {
+			input["timeout"] = 120
+		}
+		return nil, nil
+	})
 	return ext
 }
 

package/extensions/pig-claude-bridge/internal/bridge/askclaude.go

@@ -65,19 +65,19 @@ func (b *Bridge) PromptAndWait(ctx context.Context, host Host, r AskRequest) (te
 	}
 
 	// A non-isolated call continues the session the provider already keeps for this pi
-	// session, or creates one from pi's context. It does not move the mirror's cursor,
-	// so the next provider call sees the missed messages and rebuilds.
+	// session, or imports pi's context into one of its own. The provider's mirror is
+	// not touched (D8): its recording does not cover what AskClaude adds, so the next
+	// provider turn forks or rewrites from the content comparison as usual.
 	resume := ""
 	if !r.Isolated && len(r.Context) > 0 {
 		if state := b.sessionStateFor(r.PiSessionID); state != nil {
-			resume = state.SessionID
+			resume = state.CCSessionID
 		} else {
 			withPrompt := append(slices.Clone(r.Context), map[string]any{"role": "user", "content": r.Prompt, "timestamp": b.deps.Now().UnixMilli()})
-			synced, err := b.syncSharedSession(host, r.PiSessionID, withPrompt, nil, cwd, cliModel)
-			if err != nil {
+			var err error
+			if resume, err = b.importForAskClaude(host, withPrompt, cwd, cliModel); err != nil {
 				return "", err
 			}
-			resume = synced.SessionID
 		}
 	}
 

package/extensions/pig-claude-bridge/internal/bridge/consume.go

@@ -67,13 +67,18 @@ func (b *Bridge) unregisterContext(q *QueryContext) {
 	delete(b.contexts, q)
 }
 
-// contextForToolResults finds the live query a turn's results belong to, by the
-// tool call ids it parked, queued or emitted. nil when none matches.
-func (b *Bridge) contextForToolResults(results []convert.McpResult) *QueryContext {
+// contextForToolResults finds the parked query of this pi session that a turn's
+// results answer, by the tool call ids it parked, queued or emitted. nil when none
+// matches. Tool-call ids repeat across sessions whenever one copies another's
+// history (a fork, a worker seeded from its host), so an id alone could deliver one
+// session's turn into another's Claude Code query (pi-claude-bridge #111).
+func (b *Bridge) contextForToolResults(results []convert.McpResult, piSessionID string) *QueryContext {
 	b.mu.Lock()
 	live := make([]*QueryContext, 0, len(b.contexts))
 	for c := range b.contexts {
-		live = append(live, c)
+		if c.piSessionID == piSessionID {
+			live = append(live, c)
+		}
 	}
 	b.mu.Unlock()
 	for _, r := range results {
@@ -195,6 +200,7 @@ func parseRateLimitInfo(m map[string]any) RateLimitInfo {
 		OverageStatus: str(m["overageStatus"]), OverageResetsAt: num(m["overageResetsAt"]),
 		Utilization: num(m["utilization"]), SurpassedThreshold: num(m["surpassedThreshold"]),
 	}
+	info.IsUsingOverage, _ = m["isUsingOverage"].(bool)
 	if windows := obj(m["unifiedWindows"]); windows != nil {
 		info.UnifiedWindows = map[string]*UsageWindow{}
 		for name, raw := range windows {
@@ -253,7 +259,14 @@ loop:
 			b.debugf("consumeQuery: skipping malformed frame: %v", err)
 			continue
 		}
+		if q.isAbandoned() {
+			break
+		}
+		b.tapRecording(q, frame)
 		b.reportHeldRateLimit(q)
+		if ctx.Err() != nil || q.isAbandoned() {
+			break
+		}
 		if b.consumeFrame(host, q, frame, &res) {
 			break
 		}
@@ -300,17 +313,10 @@ func (b *Bridge) consumeFrame(host Host, q *QueryContext, frame map[string]any,
 	typ := str(frame["type"])
 
 	// Lifecycle frames come before the currentPiStream gate: everything below it is
-	// content, which has nowhere to go once a turn ended on a tool call.
-	//
-	// A replay acknowledgement clears a queued steer even after its turn's stream
-	// ended. For a fresh steer uuid, replay marks incorporation, not completion:
-	// its MCP calls still need stdin until the following result.
-	if parent, present := frame["parent_tool_use_id"]; typ == "user" && present && parent == nil && frame["isReplay"] == true {
-		q.mu.Lock()
-		delete(q.pendingSteerUUIDs, str(frame["uuid"]))
-		q.mu.Unlock()
-	}
-
+	// content, which has nowhere to go once a turn ended on a tool call. A replay
+	// acknowledgement (tapRecording) clears a queued steer even after its turn's
+	// stream ended; it marks incorporation, not completion: the steer's MCP calls
+	// still need stdin until the following result.
 	switch typ {
 	case "result":
 		// The failure a result carries is the only record the turn failed at all; it
@@ -373,7 +379,15 @@ func (b *Bridge) consumeFrame(host Host, q *QueryContext, frame map[string]any,
 	case "stream_event":
 		b.processStreamEvent(q, frame)
 	case "assistant":
-		b.processAssistantMessage(q, frame)
+		// A completed echo can trail tool-result delivery. tapRecording recorded it for
+		// its original step; it is never rendered again into the new pi stream.
+		q.mu.Lock()
+		step := q.assistantSteps[str(obj(frame["message"])["id"])]
+		emitted := step != nil && step.emitted != nil
+		q.mu.Unlock()
+		if !emitted {
+			b.processAssistantMessage(q, frame)
+		}
 	case "result":
 		// The success path: push the result text when no stream event delivered it.
 		func() {
@@ -478,12 +492,10 @@ func (b *Bridge) turnField(q *QueryContext, key string) any {
 	return q.turnOutput[key]
 }
 
-// finishAborted ends an aborted query. The killed subprocess may flush a late
-// record into the session JSONL, so its mirror rebuilds on a fresh id. A turn whose
-// stream already ended was returned to pi and is left alone.
+// finishAborted ends an aborted query; its final snapshot was committed by the abort
+// itself. A turn whose stream already ended was returned to pi and is left alone.
 func (b *Bridge) finishAborted(q *QueryContext) {
-	b.markSessionNeedsRebuild(q.piSessionID, true)
-	b.debugf("provider: abort detected, marked session needsRebuild + forceRotate")
+	b.debugf("provider: abort detected")
 	q.mu.Lock()
 	defer q.mu.Unlock()
 	q.heldRateLimit = nil
@@ -495,17 +507,16 @@ func (b *Bridge) finishAborted(q *QueryContext) {
 	q.endStreamLocked(map[string]any{"type": "error", "reason": "aborted", "error": deepCopy(q.turnOutput)})
 }
 
-// failQuery ends a failed query with exactly one error event on the open stream.
-// A turn whose stream already ended is left unchanged (issue #181).
+// failQuery ends a failed query with exactly one error event on the open stream,
+// after committing its progress dirty: the next turn compares content and keeps what
+// still matches. A turn whose stream already ended is left unchanged (issue #181).
 func (b *Bridge) failQuery(q *QueryContext, client ccproto.Client, failure error) {
 	b.debugf("provider: query error, error=%v", failure)
-	var reported *resultFailure
-	if errors.As(failure, &reported) {
-		// The conversation is in an unknown state: drop the mirror, like the SDK's
-		// throw after an error result did.
-		b.setSessionStateFor(q.piSessionID, nil)
-	} else {
-		b.markSessionNeedsRebuild(q.piSessionID, false)
+	q.mu.Lock()
+	commit := q.commitRecording
+	q.mu.Unlock()
+	if commit != nil {
+		commit(true)
 	}
 	q.mu.Lock()
 	ps := q.promptStream
@@ -638,16 +649,23 @@ func (b *Bridge) drainForAbort(q *QueryContext) {
 }
 
 // discardRewrittenQuery drops a Claude Code query parked at a tool boundary whose
-// conversation pi has since rewritten (/compact, tree navigation; issue #101).
-// Delivering the tool result into it would hand Claude Code the context pi just
-// shrank. The caller takes the fresh-query path, where REBUILD imports pi's
-// rewritten history, this tool result included. reason is what the parked handlers
-// are answered with.
+// conversation pi has since rewritten or replaced (/compact, tree navigation, a
+// history edit, a fresh prompt from the same session; issue #101). Its progress is
+// committed first, dirty, so the next sync keeps whatever still matches. Delivering
+// the tool result into it would hand Claude Code the context pi just shrank; the
+// caller takes the fresh-query path instead, where the sync imports pi's current
+// history, this tool result included. reason is what the parked handlers are answered with.
 func (b *Bridge) discardRewrittenQuery(q *QueryContext, reason string) {
+	q.mu.Lock()
+	commit := q.commitRecording
+	q.mu.Unlock()
+	if commit != nil {
+		commit(true)
+	}
 	q.mu.Lock()
 	discarded := q.activeQuery
 	q.activeQuery = nil
-	q.abandoned = q.abandoned || discarded != nil
+	q.abandoned = true
 	q.turnToolCallIDs = []string{}
 	ps := q.promptStream
 	q.promptStream = nil
@@ -668,21 +686,14 @@ func (b *Bridge) discardRewrittenQuery(q *QueryContext, reason string) {
 	// subprocess never settles.
 	q.releasePendingToolCalls(reason)
 	b.killClient(discarded)
-	// The CLI may still flush a record into the session JSONL and the rebuild is
-	// next, so rotate rather than race it. Only this session's mirror.
-	b.markSessionNeedsRebuild(q.piSessionID, true)
-	b.debugf("provider: history rewritten under a parked query — discarded it, rebuilding from current history")
-}
-
-// steerMissedSession records a steer that never made it into Claude Code's
-// session. The cursor has already counted it, so count-based sync would skip it
-// forever: rebuild instead, which re-imports the message from pi's context.
-func (b *Bridge) steerMissedSession(q *QueryContext, text string) {
 	q.mu.Lock()
-	q.missedSteer = true
+	if q.currentPiStream != nil && q.turnOutput != nil {
+		q.turnOutput["stopReason"] = "error"
+		q.turnOutput["errorMessage"] = "Conversation replaced"
+		q.endStreamLocked(map[string]any{"type": "error", "reason": "error", "error": deepCopy(q.turnOutput)})
+	}
 	q.mu.Unlock()
-	b.markSessionNeedsRebuild(q.piSessionID, false)
-	b.debugf("provider: steer never reached CC, marked query for rebuild: %s", truncateRunes(text, 60))
+	b.debugf("provider: discarded parked query; its recorded prefix remains available for a fork")
 }
 
 func newUUID() string {
@@ -705,9 +716,15 @@ func newUUID() string {
 // the FIFO ordering are Claude Code internals.
 //
 // Results pair with handlers by tool use id. host may be nil (no stuck-handler notice).
-func (b *Bridge) deliverToolResults(ctx context.Context, host Host, q *QueryContext, results []convert.McpResult, steer []any, contextLength int) {
+// history is pi's conversation without system messages; it registers the results
+// and any steer with the recording.
+func (b *Bridge) deliverToolResults(ctx context.Context, host Host, q *QueryContext, results []convert.McpResult, steer []any, history []map[string]any) {
+	contextLength := len(history)
+	if err := q.recording.Results(history); err != nil {
+		b.debugf("recording: tool results could not be digested: %v", err)
+	}
 	if len(steer) > 0 {
-		b.pushSteer(ctx, q, steer)
+		b.pushSteer(ctx, q, steer, history)
 	}
 
 	type release struct {
@@ -757,8 +774,9 @@ func (b *Bridge) deliverToolResults(ctx context.Context, host Host, q *QueryCont
 }
 
 // pushSteer writes a steer to Claude Code's stdin and waits for the write. A steer
-// that cannot be written is recorded as missed; the tool results are delivered anyway.
-func (b *Bridge) pushSteer(ctx context.Context, q *QueryContext, steer []any) {
+// that cannot be written leaves a coverage gap (no replay acknowledgement ever
+// comes, so the next sync imports it from pi); the tool results are delivered anyway.
+func (b *Bridge) pushSteer(ctx context.Context, q *QueryContext, steer []any, history []map[string]any) {
 	parts := make([]string, len(steer))
 	for i, raw := range steer {
 		if blk := obj(raw); blk["type"] == "text" {
@@ -775,24 +793,25 @@ func (b *Bridge) pushSteer(ctx context.Context, q *QueryContext, steer []any) {
 	if ps != nil {
 		uuid = newUUID()
 		// Registered before the write: a result can arrive during it.
-		q.pendingSteerUUIDs[uuid] = struct{}{}
+		q.addPendingSteer(uuid)
 	}
 	q.mu.Unlock()
 	if ps == nil {
 		b.debugf("WARNING: steer with no prompt stream, dropping: %s", truncateRunes(text, 60))
-		b.steerMissedSession(q, text)
 		return
 	}
+	if err := q.recording.Users(history, turnStart(history), uuid, false, true); err != nil {
+		b.debugf("recording: steer could not be digested: %v", err)
+	}
 	msg := userMessage(steer, "next")
 	msg.UUID = uuid
 	if err := ps.Push(ctx, msg); err != nil {
-		// The query is ending: further input would wedge tool-result delivery. The
-		// steer is still in pi's context but the cursor is past it, so force a rebuild.
+		// The query is ending: further input would wedge tool-result delivery. No replay
+		// acknowledgement means no coverage slot; the next sync imports the steer from pi.
 		q.mu.Lock()
-		delete(q.pendingSteerUUIDs, uuid)
+		q.removePendingSteer(uuid)
 		q.mu.Unlock()
 		b.debugf("provider: steer push rejected, delivering tool result anyway: %v", err)
-		b.steerMissedSession(q, text)
 		return
 	}
 	b.debugf("provider: steer written to CC stdin before tool result: %s", truncateRunes(text, 60))

package/extensions/pig-claude-bridge/internal/bridge/hooks.go

@@ -1,7 +1,6 @@
 package bridge
 
 import (
-	"fmt"
 	"runtime/debug"
 	"slices"
 	"sort"
@@ -117,15 +116,22 @@ func (b *Bridge) hostSessionID(host Host, event string) string {
 	return id
 }
 
-// OnSessionStart remembers the session's cwd, and drops every mirror when the
-// session is a fresh conversation.
-func (b *Bridge) OnSessionStart(host Host, reason string) {
+// OnSessionStart remembers the session's cwd. Mirrors stay: each is keyed by its own
+// pi session id, so switching sessions erases none of them. A fork or clone starts
+// from its parent's mirror, so its first turn forks the parent's Claude Code session.
+func (b *Bridge) OnSessionStart(host Host, reason, previousSessionFile string) {
 	defer b.recoverHandler("session_start")
 	b.showStatus(host)
-	b.rememberSessionCwd(b.hostSessionID(host, "session_start"), host.Cwd())
-	switch reason {
-	case "new", "resume", "fork":
-		b.clearSessions("session_start:" + reason)
+	id := b.hostSessionID(host, "session_start")
+	b.rememberSessionCwd(id, host.Cwd())
+	b.mu.Lock()
+	n := len(b.sessions)
+	b.mu.Unlock()
+	b.debugf("session_start:%s: retaining %d shared session(s)", reason, n)
+	if reason == "fork" && previousSessionFile != "" && id != "" {
+		if err := b.inheritSessionState(previousSessionFile, id); err != nil {
+			b.debugf("session_start:fork: %v", err)
+		}
 	}
 }
 
@@ -207,18 +213,39 @@ func (b *Bridge) historyRewrittenBy(host Host, event string) {
 	b.forgetSummarySession(id)
 }
 
-// OnSessionShutdown ends a pi session: its cwd, its sync lock and every mirror go,
-// and every Claude Code child this process started is killed, even when the host fails.
+// OnSessionShutdown ends a pi session: its cwd and sync lock go, its parked queries
+// are closed with their progress kept for a later resume (a tool that returns
+// terminate: true ends pi's run with Claude Code still parked on its result, issue
+// #210), and then every Claude Code child this process started is killed (D10),
+// even when the host fails. Mirrors stay; they are keyed per pi session and persisted.
 func (b *Bridge) OnSessionShutdown(host Host) {
 	defer b.recoverHandler("session_shutdown")
 	defer b.killLiveQueries()
 	id := b.hostSessionID(host, "session_shutdown")
 	b.forgetSessionCwd(id)
 	b.mu.Lock()
-	delete(b.syncLocks, sessionKey(id))
+	delete(b.syncLocks, id)
 	b.mu.Unlock()
+	b.closeSessionQueries(id)
 	b.reportLeaks("session_shutdown")
-	b.clearSessions("session_shutdown")
+}
+
+// closeSessionQueries closes every query the shutting-down pi session still holds.
+func (b *Bridge) closeSessionQueries(piSessionID string) {
+	for _, q := range b.liveContexts() {
+		if q.piSessionID != piSessionID {
+			continue
+		}
+		q.mu.Lock()
+		active, pending, ps := q.activeQuery != nil, len(q.pendingToolCalls), q.promptStream != nil
+		q.mu.Unlock()
+		if active {
+			b.debugf("session_shutdown: closing parked query — pendingToolCalls=%d promptStream=%t", pending, ps)
+		} else {
+			b.debugf("WARNING: session_shutdown left a context with no query — pendingToolCalls=%d promptStream=%t", pending, ps)
+		}
+		b.discardRewrittenQuery(q, "Session shut down; this query was closed.")
+	}
 }
 
 // killLiveQueries aborts every live query, then kills every Claude Code child still
@@ -235,19 +262,3 @@ func (b *Bridge) killLiveQueries() {
 	}
 	ccproto.Shutdown()
 }
-
-// clearSessions drops every mirror: children never emit session_shutdown (only
-// runtime teardown does), so there is no per-entry removal, and a top-level
-// transition takes every mirror with it.
-func (b *Bridge) clearSessions(event string) {
-	b.mu.Lock()
-	n := len(b.sessions)
-	b.sessions = map[string]SessionState{}
-	b.historyRewritten = map[string]struct{}{}
-	b.mu.Unlock()
-	plural := "s"
-	if n == 1 {
-		plural = ""
-	}
-	b.debugf("%s", fmt.Sprintf("%s: clearing %d shared session%s", event, n, plural))
-}