* feat(pi): complete RPC interaction parity
* feat(pi): integrate native conversation history
* fix(pi): harden RPC lifecycle boundaries
* fix(pi): address review lifecycle and upload boundaries
* fix(pi): release history transaction on rollback deadline
* fix(pi): isolate preflight and timed-out mutations
* fix(pi): preserve retry and editor boundaries
* fix(pi): disable unavailable history synchronization
* fix(pi): gate fallback readiness on history baseline
* fix(pi): bind uploads and retire extension requests
* fix(pi): preserve canceled and legacy stream boundaries
* fix(pi): preserve native fork runtime state
* fix(pi): persist dialogs and preserve select values
* fix(pi): keep upload authorization path-stable
* feat(pi): preserve native steer semantics
Route ordinary sends during an active Pi main turn through native steer while keeping explicit queue delivery on the existing composer gestures. Persist the delivery contract across Hub replay and Web retries, and guard stale steer dispatch with streaming generations and ordered prompt fallback.
* fix(pi): queue deferred steer deliveries
Keep native steer only for the initial live emit. Reconnect replay, CLI backfill, clear-gate release, and mature delivery now downgrade turn-scoped steer intent to the durable HAPI queue without mutating stored provenance.
* fix(pi): retain abort guard through preflight miss
Treat an immediate no-active abort rejection as a possible async-preflight race. Keep the existing abort boundary alive so a late agent_start receives the compensating abort before queued work is released.
* fix(pi): queue stale steer retries
A failed send no longer reuses turn-scoped steer intent after its original Pi generation is lost. Text restoration, attachment retry, and legacy retry provenance all enter the durable HAPI queue while fresh ordinary sends retain native steer behavior.
* fix(pi): invalidate rejected abort generation
After a no-active preflight abort waits through late-start compensation, mark the target stream idle while the runtime mutation lease is still held. Waiting native steers therefore fall back instead of entering the aborted generation.
* fix(pi): queue idempotent steer retries
Track whether a localId insert created a new row. Initial inserts may retain live Pi steer, while duplicate-localId retries deliver a queue-safe view of the stored row without overwriting its original provenance.
* fix(pi): sync command-only history before fallback
Read the Pi append log before retiring a successful prompt that produced no agent lifecycle. Preserve FIFO history associations across missing entry events, and fail the wrapper closed if that mandatory synchronization cannot be completed.
Use provider-qualified model lookup (provider + modelId) to resolve the
correct context window for the Pi status bar, falling back to legacy
modelId when selected-model metadata is absent. This prevents showing
the wrong context window when two providers share the same modelId.
* feat(pi): add 'max' thinking level
Pi's --thinking flag accepts 7 levels: off, minimal, low, medium, high,
xhigh, max. The shared constant and UI only exposed 6 levels (missing max).
Add 'max' to PI_THINKING_LEVELS and PI_THINKING_LEVEL_LABELS. Like xhigh,
max requires explicit opt-in via the model's thinkingLevelMap — models that
support it will include max in their map and the UI will show it
accordingly.
* fix(pi): close max thinking-level branch
* fix: verify PID belongs to hapi before treating runner as alive
After OS upgrade, stale runner.state.json PID can be reused by unrelated
processes. The old kill(pid, 0) check passes for any process, causing
start-sync to loop with 'Runner already running' indefinitely.
Now uses ps/wmic to confirm the process command line contains 'hapi'
before considering the runner alive. Falls back to alive-only check if
ps/wmic fails.
* fix: precise runner process detection and wmic fallback
* fix: add fallback for ps failure in non-Windows branch
