remote-pi-app 0.7.1

package/dist/actions/handlers.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Plan/28 Wave B — typed action handlers.
+ *
+ * Each handler maps one `ClientMessage` action to a public Pi SDK call,
+ * and replies with `action_ok` or `action_error`. Handlers take their
+ * dependencies as parameters so the index.ts wiring is one-liner and
+ * unit tests can pass fakes without touching global state.
+ *
+ * `models_list` lives next door because it shares the `ModelRegistry`
+ * helper and the same wire vocabulary.
+ *
+ * SDK API surface used (see plan/28 Wave 0 for the full table):
+ *
+ *   - `ctx.compact()`            — non-blocking, fires `session_compact`
+ *                                  event when done
+ *   - `ctx.newSession()`         — only on `ExtensionCommandContext`;
+ *                                  resolves with `{cancelled}` flag
+ *   - `pi.setModel(model)`       — returns `false` if no auth configured
+ *   - `pi.setThinkingLevel(lvl)` — synchronous
+ *   - `ctx.getModel()`           — optional, undefined before first turn
+ *   - `ModelRegistry.{refresh,getAvailable,find}` — see `registry.ts`
+ */
+import type { ClientMessage, ServerMessage, WireModel } from "../protocol/types.js";
+/**
+ * Structural subset of the SDK's `Model<Api>` interface (defined in
+ * `@earendil-works/pi-ai`, which is a transitive dep — not re-exported by
+ * `@earendil-works/pi-coding-agent`'s main entry). Capturing just the
+ * fields we touch keeps the handler decoupled from the SDK's full Model
+ * surface and avoids a direct dep on `pi-ai`.
+ */
+export interface SdkModelLike {
+    id: string;
+    name: string;
+    provider: string;
+    reasoning: boolean;
+    contextWindow: number;
+    /** Plan/30: accepted input modalities. The SDK's `Model.input` is
+     *  `("text" | "image")[]`; we read `includes("image")` for the `vision`
+     *  flag. Optional here so tests can omit it (treated as text-only). */
+    input?: ("text" | "image")[];
+}
+type Model<_TApi = unknown> = SdkModelLike;
+/**
+ * Minimal channel surface needed to reply. Mirrors `PlainPeerChannel`'s
+ * `.send` signature; tests pass an array-backed fake.
+ */
+export interface ActionReplySender {
+    send(msg: ServerMessage): void;
+}
+/**
+ * Narrow shape of the `ExtensionAPI` surface action handlers actually
+ * call. Lets the test layer stub just these without rebuilding the full
+ * SDK type (which has 30+ methods we don't use here).
+ */
+export interface ActionPi {
+    setModel(model: Model<any>): Promise<boolean>;
+    setThinkingLevel(level: import("../protocol/types.js").ThinkingLevel): void;
+}
+/**
+ * Narrow shape of the per-call context. Drawn from the union of
+ * `ExtensionContextActions` (compact, getModel) and
+ * `ExtensionCommandContextActions` (newSession), since index.ts caches
+ * the most-recent ctx and that's typically the command one.
+ *
+ * All fields are optional so a missing method (e.g. when only a plain
+ * `ExtensionContext` was seen) becomes a typed `action_error` instead of
+ * a runtime TypeError.
+ */
+export interface ActionCtx {
+    compact?: (options?: object) => void;
+    /**
+     * Starts a new session. `withSession` is the SDK's blessed hook for
+     * post-replacement work: it receives a FRESH, command-capable ctx bound to
+     * the new session. The SDK marks any ctx captured BEFORE this call stale, so
+     * callers must re-capture via `withSession` rather than reuse the old ctx.
+     */
+    newSession?: (options?: {
+        withSession?: (ctx: ActionCtx) => Promise<void>;
+    }) => Promise<{
+        cancelled: boolean;
+    }>;
+    getModel?: () => Model<any> | undefined;
+    /**
+     * Live session registry from Pi's extension ctx. Includes providers/models
+     * registered dynamically via `pi.registerProvider(...)`, unlike the fallback
+     * disk-backed registry remote-pi can build on its own.
+     */
+    modelRegistry?: ActionModelRegistry;
+}
+/**
+ * Minimal shape of the registry surface. Maps 1:1 onto `ModelRegistry`
+ * but lets tests fake catalogs without instantiating the real one.
+ */
+export interface ActionModelRegistry {
+    refresh(): void;
+    getAvailable(): Model<any>[];
+    find(provider: string, modelId: string): Model<any> | undefined;
+}
+/** Project a SDK `Model<Api>` onto the wire schema. Shared by list_models
+ *  and the `current` echo, so both stay in lockstep. */
+export declare function wireFromModel(model: Model<any>): WireModel;
+type SessionCompactMsg = Extract<ClientMessage, {
+    type: "session_compact";
+}>;
+type SessionNewMsg = Extract<ClientMessage, {
+    type: "session_new";
+}>;
+type ModelSetMsg = Extract<ClientMessage, {
+    type: "model_set";
+}>;
+type ThinkingSetMsg = Extract<ClientMessage, {
+    type: "thinking_set";
+}>;
+type ListModelsMsg = Extract<ClientMessage, {
+    type: "list_models";
+}>;
+type ListCommandsMsg = Extract<ClientMessage, {
+    type: "list_commands";
+}>;
+export declare function handleSessionCompact(ctx: ActionCtx | null, sender: ActionReplySender, msg: SessionCompactMsg): void;
+export declare function handleSessionNew(ctx: ActionCtx | null, sender: ActionReplySender, msg: SessionNewMsg, onReplaced?: (freshCtx: ActionCtx) => void): Promise<boolean>;
+export declare function handleThinkingSet(pi: ActionPi, sender: ActionReplySender, msg: ThinkingSetMsg): void;
+export declare function handleModelSet(pi: ActionPi, ctx: ActionCtx | null, reg: ActionModelRegistry, sender: ActionReplySender, msg: ModelSetMsg, onPersist?: (provider: string, modelId: string) => void): Promise<void>;
+export declare function handleListModels(ctx: ActionCtx | null, reg: ActionModelRegistry, sender: ActionReplySender, msg: ListModelsMsg): void;
+/**
+ * Plan/58 (primitive A): enumerate the slash commands pi currently exposes
+ * (remote-pi's own, plus any registered by third-party plugins) so remote
+ * clients can offer a picker. Read-only — execution goes through the daemon's
+ * RPC `prompt` path (see the relay `user_message` handler in index.ts).
+ */
+export declare function handleListCommands(pi: {
+    getCommands?: () => Array<{
+        name: string;
+        description?: string;
+        source?: string;
+    }>;
+} | null, sender: ActionReplySender, msg: ListCommandsMsg): void;
+export {};

package/dist/actions/handlers.js

@@ -0,0 +1,189 @@
+/**
+ * Plan/28 Wave B — typed action handlers.
+ *
+ * Each handler maps one `ClientMessage` action to a public Pi SDK call,
+ * and replies with `action_ok` or `action_error`. Handlers take their
+ * dependencies as parameters so the index.ts wiring is one-liner and
+ * unit tests can pass fakes without touching global state.
+ *
+ * `models_list` lives next door because it shares the `ModelRegistry`
+ * helper and the same wire vocabulary.
+ *
+ * SDK API surface used (see plan/28 Wave 0 for the full table):
+ *
+ *   - `ctx.compact()`            — non-blocking, fires `session_compact`
+ *                                  event when done
+ *   - `ctx.newSession()`         — only on `ExtensionCommandContext`;
+ *                                  resolves with `{cancelled}` flag
+ *   - `pi.setModel(model)`       — returns `false` if no auth configured
+ *   - `pi.setThinkingLevel(lvl)` — synchronous
+ *   - `ctx.getModel()`           — optional, undefined before first turn
+ *   - `ModelRegistry.{refresh,getAvailable,find}` — see `registry.ts`
+ */
+/** Project a SDK `Model<Api>` onto the wire schema. Shared by list_models
+ *  and the `current` echo, so both stay in lockstep. */
+export function wireFromModel(model) {
+    return {
+        id: model.id,
+        name: model.name,
+        provider: model.provider,
+        reasoning: model.reasoning,
+        context_window: model.contextWindow,
+        // Plan/30: vision = model accepts image input. `Model.input` is
+        // `("text" | "image")[]` at runtime (confirmed against pi-ai). `?.` guards
+        // a fake/partial model in tests → treated as text-only.
+        vision: model.input?.includes("image") ?? false,
+    };
+}
+// ── ack helpers ────────────────────────────────────────────────────────────
+function ok(sender, msg, action) {
+    sender.send({ type: "action_ok", in_reply_to: msg.id, action });
+}
+function fail(sender, msg, action, err) {
+    const error = err instanceof Error ? err.message : String(err);
+    sender.send({ type: "action_error", in_reply_to: msg.id, action, error });
+}
+/** Run a synchronous action with uniform success/failure replies. */
+function runSync(sender, msg, action, body) {
+    try {
+        body();
+        ok(sender, msg, action);
+    }
+    catch (e) {
+        fail(sender, msg, action, e);
+    }
+}
+/** Run an async action with uniform success/failure replies. */
+async function runAsync(sender, msg, action, body) {
+    try {
+        await body();
+        ok(sender, msg, action);
+        return true;
+    }
+    catch (e) {
+        fail(sender, msg, action, e);
+        return false;
+    }
+}
+export function handleSessionCompact(ctx, sender, msg) {
+    runSync(sender, msg, "session_compact", () => {
+        if (!ctx?.compact)
+            throw new Error("compact unavailable (no active session ctx)");
+        // Force the summary to English regardless of the conversation language —
+        // the summary is surfaced to the app via the `compaction` message, which
+        // is an English-only surface. `customInstructions` is appended to the SDK's
+        // compaction prompt (best-effort: the model writes the summary).
+        ctx.compact({
+            customInstructions: "Always write the compaction summary in English, even if the conversation is in another language.",
+        });
+    });
+}
+export async function handleSessionNew(ctx, sender, msg, onReplaced) {
+    // Returns true only when a fresh session was actually created. index.ts
+    // keys the Pi-side reset (clear _messageBuffer, restamp _sessionStartedAt,
+    // fan out an empty session_history) off this signal — a `cancelled`/errored
+    // new-session must NOT reset, so we return runAsync's success boolean.
+    return runAsync(sender, msg, "session_new", async () => {
+        if (!ctx?.newSession)
+            throw new Error("newSession unavailable (no command ctx yet)");
+        // newSession marks the caller's captured ctx (index.ts's `_lastCtx`) STALE
+        // — reusing it later throws "stale after session replacement" (the
+        // compact-after-New-session crash). `withSession` hands back a fresh,
+        // command-capable ctx bound to the new session; forward it via onReplaced
+        // so the caller re-captures and keeps later actions off the stale ctx.
+        const result = await ctx.newSession({
+            withSession: async (freshCtx) => { onReplaced?.(freshCtx); },
+        });
+        // `cancelled: true` happens when the SDK's hook chain vetoes the new
+        // session (e.g. an extension's `session_before_switch` returned a
+        // refusal). Surface as a typed error rather than silent success.
+        if (result.cancelled)
+            throw new Error("cancelled by extension hook");
+    });
+}
+export function handleThinkingSet(pi, sender, msg) {
+    runSync(sender, msg, "thinking_set", () => {
+        pi.setThinkingLevel(msg.level);
+    });
+}
+export async function handleModelSet(pi, ctx, reg, sender, msg, onPersist) {
+    await runAsync(sender, msg, "model_set", async () => {
+        // Prefer Pi's LIVE session registry when available so the app sees models
+        // registered dynamically by extensions via `pi.registerProvider(...)`.
+        // Fall back to remote-pi's own disk-backed registry when no ctx exists.
+        const liveReg = ctx?.modelRegistry ?? reg;
+        // Refresh first so a model just-added via `/login` is visible.
+        liveReg.refresh();
+        const model = liveReg.find(msg.provider, msg.model_id);
+        if (!model) {
+            throw new Error(`model "${msg.provider}/${msg.model_id}" not in registry`);
+        }
+        const success = await pi.setModel(model);
+        if (!success)
+            throw new Error("no auth configured for this model");
+        // `pi.setModel` only sets the LIVE model — it does NOT persist. Without
+        // this, a model picked from the app reverts to the saved default on the
+        // next Pi/daemon restart (the TUI persists because AgentSession.setModel
+        // writes the default; this path doesn't). `onPersist` writes the new
+        // default so the app's choice survives. Best-effort — the caller's writer
+        // must not throw, so a failed settings write never fails the model change.
+        onPersist?.(model.provider, model.id);
+    });
+}
+export function handleListModels(ctx, reg, sender, msg) {
+    // refresh() can throw if `models.json` is malformed — wrap in try so the
+    // app gets an explicit error reply instead of a silent drop.
+    try {
+        // Prefer Pi's LIVE session registry when available so the app sees models
+        // registered dynamically by extensions via `pi.registerProvider(...)`.
+        // Fall back to remote-pi's own disk-backed registry when no ctx exists.
+        const liveReg = ctx?.modelRegistry ?? reg;
+        liveReg.refresh();
+        const models = liveReg.getAvailable().map(wireFromModel);
+        const current = ctx?.getModel?.();
+        sender.send({
+            type: "models_list",
+            in_reply_to: msg.id,
+            models,
+            current: current ? wireFromModel(current) : undefined,
+        });
+    }
+    catch (e) {
+        sender.send({
+            type: "error",
+            in_reply_to: msg.id,
+            code: "internal_error",
+            message: e instanceof Error ? e.message : String(e),
+        });
+    }
+}
+/**
+ * Plan/58 (primitive A): enumerate the slash commands pi currently exposes
+ * (remote-pi's own, plus any registered by third-party plugins) so remote
+ * clients can offer a picker. Read-only — execution goes through the daemon's
+ * RPC `prompt` path (see the relay `user_message` handler in index.ts).
+ */
+export function handleListCommands(pi, sender, msg) {
+    try {
+        const commands = (pi?.getCommands?.() ?? []).map((command) => {
+            const source = command.source === "extension" || command.source === "prompt" || command.source === "skill"
+                ? command.source
+                : "extension";
+            return {
+                name: command.name,
+                ...(command.description ? { description: command.description } : {}),
+                source,
+            };
+        });
+        sender.send({ type: "commands_list", in_reply_to: msg.id, commands });
+    }
+    catch (e) {
+        sender.send({
+            type: "error",
+            in_reply_to: msg.id,
+            code: "internal_error",
+            message: e instanceof Error ? e.message : String(e),
+        });
+    }
+}
+//# sourceMappingURL=handlers.js.map

package/dist/actions/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../src/actions/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AA4FH;wDACwD;AACxD,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,aAAa;QACnC,gEAAgE;QAChE,2EAA2E;QAC3E,wDAAwD;QACxD,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK;KAChD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E,SAAS,EAAE,CAAC,MAAyB,EAAE,GAAmB,EAAE,MAAkB;IAC5E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,IAAI,CACX,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,GAAY;IAEZ,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CACd,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,IAAgB;IAEhB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC;QACP,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,QAAQ,CACrB,MAAyB,EACzB,GAAmB,EACnB,MAAkB,EAClB,IAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAWD,MAAM,UAAU,oBAAoB,CAClC,GAAqB,EACrB,MAAyB,EACzB,GAAsB;IAEtB,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE;QAC3C,IAAI,CAAC,GAAG,EAAE,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClF,yEAAyE;QACzE,yEAAyE;QACzE,4EAA4E;QAC5E,iEAAiE;QACjE,GAAG,CAAC,OAAO,CAAC;YACV,kBAAkB,EAChB,kGAAkG;SACrG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAqB,EACrB,MAAyB,EACzB,GAAkB,EAClB,UAA0C;IAE1C,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,OAAO,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE;QACrD,IAAI,CAAC,GAAG,EAAE,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACrF,2EAA2E;QAC3E,mEAAmE;QACnE,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC;YAClC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,UAAU,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SAC7D,CAAC,CAAC;QACH,qEAAqE;QACrE,kEAAkE;QAClE,iEAAiE;QACjE,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,EAAY,EACZ,MAAyB,EACzB,GAAmB;IAEnB,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE;QACxC,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAY,EACZ,GAAqB,EACrB,GAAwB,EACxB,MAAyB,EACzB,GAAgB,EAChB,SAAuD;IAEvD,MAAM,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAClD,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,GAAG,CAAC;QAC1C,+DAA+D;QAC/D,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,mBAAmB,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnE,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,SAAS,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,GAAqB,EACrB,GAAwB,EACxB,MAAyB,EACzB,GAAkB;IAElB,yEAAyE;IACzE,6DAA6D;IAC7D,IAAI,CAAC;QACH,0EAA0E;QAC1E,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,GAAG,EAAE,aAAa,IAAI,GAAG,CAAC;QAC1C,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,MAAM;YACN,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,EAAiG,EACjG,MAAyB,EACzB,GAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YAC1E,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO;gBACzF,CAAC,CAAC,OAAO,CAAC,MAAM;gBAChB,CAAC,CAAC,WAAW,CAAC;YAClB,OAAO;gBACL,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,MAAM;aACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,GAAG,CAAC,EAAE;YACnB,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/actions/registry.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Plan/28 — ModelRegistry access for the action handlers.
+ *
+ * The host hands every extension a ready `ModelRegistry` on
+ * `ExtensionContext.modelRegistry` — the same instance `AgentSession` uses
+ * internally. That is the ONLY source we read.
+ *
+ * History (issue #112): this module used to build its own registry via
+ * `ModelRegistry.create(AuthStorage.create())`. Both factories were removed
+ * from `@earendil-works/pi-coding-agent` in pi 0.83, so the import crashed the
+ * whole pi process on the first `model_set`/`list_models` from the app
+ * (`undefined is not an object (evaluating 'AuthStorage.create')`, thrown from
+ * the WebSocket line handler). Reading the registry off the live ctx drops the
+ * dependency on that package's factory surface entirely, so a future breaking
+ * change there cannot crash the extension the same way again.
+ *
+ * Two hazards this handles:
+ *
+ * 1. A ctx captured before a session replacement/reload is **stale**, and even
+ *    *reading* `.modelRegistry` on it throws (`assertActive`). Every read is
+ *    wrapped.
+ * 2. There may be no live ctx at all (daemon boot, control channel). Rather
+ *    than throw from a WS callback — an uncaught exception that exits pi — we
+ *    fall back to the last registry that worked, then to a stub whose methods
+ *    never throw and report an empty catalog.
+ */
+import type { ActionModelRegistry } from "./handlers.js";
+/** Anything carrying the host registry — `ExtensionContext` and friends. */
+interface RegistryBearingCtx {
+    modelRegistry?: ActionModelRegistry;
+}
+/**
+ * Resolve the live host `ModelRegistry` from the most recent extension ctx.
+ * Falls back to the last one that worked, then to an inert stub.
+ */
+export declare function ensureModelRegistry(ctx?: RegistryBearingCtx | null): ActionModelRegistry;
+/** Test seam — drop the cached registry so tests can rebuild with fakes. */
+export declare function _resetModelRegistryForTests(): void;
+export {};

package/dist/actions/registry.js

@@ -0,0 +1,58 @@
+/**
+ * Plan/28 — ModelRegistry access for the action handlers.
+ *
+ * The host hands every extension a ready `ModelRegistry` on
+ * `ExtensionContext.modelRegistry` — the same instance `AgentSession` uses
+ * internally. That is the ONLY source we read.
+ *
+ * History (issue #112): this module used to build its own registry via
+ * `ModelRegistry.create(AuthStorage.create())`. Both factories were removed
+ * from `@earendil-works/pi-coding-agent` in pi 0.83, so the import crashed the
+ * whole pi process on the first `model_set`/`list_models` from the app
+ * (`undefined is not an object (evaluating 'AuthStorage.create')`, thrown from
+ * the WebSocket line handler). Reading the registry off the live ctx drops the
+ * dependency on that package's factory surface entirely, so a future breaking
+ * change there cannot crash the extension the same way again.
+ *
+ * Two hazards this handles:
+ *
+ * 1. A ctx captured before a session replacement/reload is **stale**, and even
+ *    *reading* `.modelRegistry` on it throws (`assertActive`). Every read is
+ *    wrapped.
+ * 2. There may be no live ctx at all (daemon boot, control channel). Rather
+ *    than throw from a WS callback — an uncaught exception that exits pi — we
+ *    fall back to the last registry that worked, then to a stub whose methods
+ *    never throw and report an empty catalog.
+ */
+let _lastGoodRegistry = null;
+/**
+ * Never-throwing empty catalog. Used only when no ctx has ever been seen —
+ * callers get an empty model list instead of a crashed agent.
+ */
+const _stubRegistry = {
+    refresh() { },
+    getAvailable() { return []; },
+    find() { return undefined; },
+};
+/**
+ * Resolve the live host `ModelRegistry` from the most recent extension ctx.
+ * Falls back to the last one that worked, then to an inert stub.
+ */
+export function ensureModelRegistry(ctx) {
+    try {
+        const live = ctx?.modelRegistry;
+        if (live) {
+            _lastGoodRegistry = live;
+            return live;
+        }
+    }
+    catch {
+        // stale ctx after session replacement — reading the property throws.
+    }
+    return _lastGoodRegistry ?? _stubRegistry;
+}
+/** Test seam — drop the cached registry so tests can rebuild with fakes. */
+export function _resetModelRegistryForTests() {
+    _lastGoodRegistry = null;
+}
+//# sourceMappingURL=registry.js.map

package/dist/actions/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/actions/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AASH,IAAI,iBAAiB,GAA+B,IAAI,CAAC;AAEzD;;;GAGG;AACH,MAAM,aAAa,GAAwB;IACzC,OAAO,KAAI,CAAC;IACZ,YAAY,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA+B;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,EAAE,aAAa,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,iBAAiB,GAAG,IAAI,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;IACvE,CAAC;IACD,OAAO,iBAAiB,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,2BAA2B;IACzC,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC"}

package/dist/bin/supervisord.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin/supervisord.js

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+/**
+ * `pi-supervisord` — long-running daemon supervisor.
+ *
+ * Entry point of the `pi-supervisord` binary (plan/26 W2). Run by
+ * systemd/launchd in production, or directly during dev:
+ *
+ *   pnpm build
+ *   node dist/bin/supervisord.js
+ *
+ * Once running, it:
+ *   - Reads `~/.pi/remote/daemons.json`
+ *   - Spawns `pi --mode rpc -e <remote-pi/dist/index.js>` per entry
+ *   - Listens on `~/.pi/remote/supervisor.sock` for CLI control requests
+ *   - Restarts crashed children with exponential backoff
+ *
+ * Exits cleanly on SIGTERM/SIGINT (used by `remote-pi uninstall`).
+ */
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { Supervisor, SupervisorAlreadyRunningError } from "../daemon/supervisor.js";
+const HELP_TEXT = `pi-supervisord — Remote Pi daemon supervisor
+
+Usage: pi-supervisord
+
+Runs the long-lived supervisor: reads ~/.pi/remote/daemons.json, spawns one
+\`pi --mode rpc\` child per entry, and listens on ~/.pi/remote/supervisor.sock
+for control requests from the \`remote-pi\` CLI.
+
+This binary takes NO arguments — it is normally launched by systemd/launchd
+(via \`remote-pi install\`), not by hand. Manage the fleet with:
+  remote-pi daemon start | stop | restart | status
+  remote-pi daemons
+
+Options:
+  -h, --help      Show this help and exit
+  -v, --version   Print version and exit
+`;
+async function main() {
+    // Guard: any stray argument used to fall through and start a FULL
+    // supervisor (a `pi-supervisord --help` once ran for days). Handle the
+    // conventional flags explicitly and reject unknown args instead of
+    // silently spawning the daemon fleet.
+    const args = process.argv.slice(2);
+    if (args.includes("-h") || args.includes("--help")) {
+        process.stdout.write(HELP_TEXT);
+        return;
+    }
+    if (args.includes("-v") || args.includes("--version")) {
+        process.stdout.write("pi-supervisord (remote-pi)\n");
+        return;
+    }
+    if (args.length > 0) {
+        process.stderr.write(`pi-supervisord: unexpected argument(s): ${args.join(" ")}\n` +
+            "This binary takes no arguments. Run `pi-supervisord --help`.\n");
+        process.exit(2);
+    }
+    // The supervisor needs to point each spawned Pi at the extension
+    // entry it's bundled with. We're at `dist/bin/supervisord.js` after
+    // build; the extension is the sibling `dist/index.js`.
+    const here = fileURLToPath(import.meta.url);
+    const distRoot = dirname(dirname(here)); // dist/bin → dist
+    const extensionPath = join(distRoot, "index.js");
+    const supervisor = new Supervisor({ extensionPath });
+    await supervisor.start();
+    process.stderr.write(`[pi-supervisord] up — UDS: ~/.pi/remote/supervisor.sock, extension: ${extensionPath}\n`);
+    const shutdown = async (signal) => {
+        process.stderr.write(`[pi-supervisord] received ${signal}, shutting down\n`);
+        await supervisor.stop();
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => void shutdown("SIGTERM"));
+    process.on("SIGINT", () => void shutdown("SIGINT"));
+}
+main().catch((err) => {
+    // "Already running" is a normal, expected condition (systemd/launchd may
+    // race a manual start, or the user double-launches) — not a crash. Report
+    // it calmly and exit 0 so service managers don't flag a failure loop.
+    if (err instanceof SupervisorAlreadyRunningError) {
+        process.stderr.write(`[pi-supervisord] ${err.message}\n`);
+        process.exit(0);
+    }
+    process.stderr.write(`[pi-supervisord] fatal: ${String(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=supervisord.js.map

package/dist/bin/supervisord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supervisord.js","sourceRoot":"","sources":["../../src/bin/supervisord.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAC;AAEpF,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;CAgBjB,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;YAC7D,gEAAgE,CACjE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iEAAiE;IACjE,oEAAoE;IACpE,uDAAuD;IACvD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,kBAAkB;IAC5D,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAEjD,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACrD,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE,aAAa,IAAI,CACzF,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,mBAAmB,CAAC,CAAC;QAC7E,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,yEAAyE;IACzE,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Default community relay. Stored in canonical http(s):// form — conversion
+ * to ws(s):// happens at the transport layer (see `toWebSocketUrl`). The
+ * community relay's reverse proxy maps `:443 → :3000` (the WS port), so the
+ * URL has no explicit port and the WebSocket upgrade rides on the same TLS
+ * connection as the HTTPS endpoints used by the mesh client.
+ */
+export declare const kDefaultRelayUrl = "https://relay-rp1.jacobmoura.work";
+export type RemotePiConfig = {
+    relay?: string;
+};
+export declare function loadConfig(): RemotePiConfig;
+export declare function saveConfig(patch: Partial<RemotePiConfig>): void;
+export type RelayResolution = {
+    url: string;
+    source: "env" | "config" | "default";
+};
+/**
+ * Resolves the effective relay URL in **canonical http(s):// form**.
+ *
+ * Precedence:
+ *   1. `REMOTE_PI_RELAY` env var (ops/CI escape hatch)
+ *   2. `~/.pi/remote/config.json` `relay` field (set via /remote-pi set-relay)
+ *   3. `kDefaultRelayUrl` (community default)
+ *
+ * Any ws(s):// values found (legacy configs or env overrides) are coerced
+ * to http(s):// defensively — the canonical form across the codebase is
+ * http(s)://, and the transport layer converts to ws(s):// at WS-open time.
+ */
+export declare function resolveRelayUrl(): RelayResolution;
+/**
+ * Strict validator for **user-provided** relay URLs (via `/remote-pi
+ * set-relay` or `/remote-pi relay url`).
+ *
+ * Only accepts `http://` and `https://`. `ws://`/`wss://` are deliberately
+ * **rejected** — the canonical form stored in config is http(s):// and the
+ * extension converts to ws(s):// internally when opening the WebSocket.
+ * Forcing a single scheme at the user boundary avoids two-form drift.
+ */
+export declare function isValidRelayUrl(url: string): boolean;
+/**
+ * Returns true if the URL uses ws:// or wss:// scheme — for emitting a
+ * targeted error message when the user pastes a WebSocket URL by mistake.
+ */
+export declare function isWebSocketScheme(url: string): boolean;
+/**
+ * Converts an http(s):// URL to the corresponding ws(s):// form. Used by
+ * the transport layer right before opening the WebSocket — config storage
+ * and the mesh HTTP client both stay on http(s)://.
+ *
+ *   https://host  → wss://host
+ *   http://host   → ws://host
+ *   ws(s)://host  → pass-through (defensive — env overrides or legacy
+ *                   configs may still carry ws(s)://)
+ */
+export declare function toWebSocketUrl(url: string): string;
+/**
+ * Inverse of `toWebSocketUrl`. Used by `resolveRelayUrl` to coerce any
+ * ws(s):// values back to canonical http(s):// before returning them to
+ * the rest of the codebase.
+ */
+export declare function toHttpUrl(url: string): string;