* fix(web): filter Pi effort options by model thinkingLevelMap in new session form The create-session EffortField called getPiThinkingLevelOptions without the selected model's thinkingLevelMap, so the Pi effort select always showed the static off..high list: levels the model marks unsupported stayed visible and xhigh/max never appeared even for models that opt in. Pass the map through piSelectedModel (mirrors HappyComposer), and extend the stale-effort reset effect so a level unsupported by the newly selected model falls back to auto. * feat(cli): probe machine Pi models over RPC to carry thinkingLevelMap The machine-level Pi model probe parsed the `pi --list-models` text table, which only exposes provider/model/thinking-yes-no — thinkingLevelMap (and name/contextWindow) never reached the create-session form, so model-accurate thinking levels could not render there (xhigh/max are map-opt-in and were permanently hidden; see the companion web commit). Replace the table probe with a short-lived `pi --mode rpc` child (--no-session --no-extensions --no-skills --no-prompt-templates --no-tools) that issues get_available_models and reuses the session path's parsePiModels schema, so machine and session catalogs share one wire contract. The lightweight probe also measures faster than the table probe (~0.8s vs ~1.6-2.4s) and drops the whitespace-table parsing entirely. Cache/inflight dedupe/timeout structure is unchanged. * fix: address review findings on the Pi model probe and effort reset Three review findings on the RPC probe / effort-map change: - (high) Probe teardown killed only the direct child PID: with shell:true on Windows that is the shell, orphaning the interactive pi RPC process on every successful probe and on timeout; finish() also resolved before the process was confirmed gone. Use killProcessByChildProcess (taskkill /T on Windows, Unix tree kill, SIGKILL escalation) and settle only after the tree teardown completes. - (medium) An explicit get_available_models success:false response was discarded, so Pi's own error text was lost and the interactive child hung until the generic 15s timeout. parsePiModelsProbeLine now returns a three-way result (unrelated/models/error), also validating the response id, and the probe rejects immediately with Pi's error. - (medium) Switching an xhigh/max-capable model back to Default left the now-hidden effort in state and submitted it while the select visually fell back to auto. The reset effect now also covers model === 'auto' (undefined map) while still not resetting mid-resolve for a concrete model. Tests: probe-line failure/foreign-id cases; NewSession restore-to-Default reset and map-opt-in retention (the latter guards the former against a false green from the restore path). * fix(web): type the Pi model test mock as PiModelSummary The inline mock element type omitted thinkingLevelMap, so the new capability-driven tests failed typecheck (TS2353) and the required test job stopped before the unit tests ran. Use the shared PiModelSummary type so the mock cannot drift from the wire contract again. * fix(web): reconcile hidden Pi effort when model discovery fails A restored explicit Pi model never resolves when the machine catalog request fails, so piSelectedModel stays null for good. The reset effect required a resolved model, so it skipped reconciliation, while EffortField rendered with an undefined map and hid xhigh/max. Creation is only gated on the loading state, not on the error, so handleCreate could still forward the stale hidden level for Pi to reject or clamp. Treat a failed catalog as a settled selection (alongside Default and a resolved model) and reconcile against the undefined map; keep skipping the reset while a concrete model is still resolving without an error, so a restored xhigh/max survives until the map can prove it valid. Test asserts the spawn payload carries no effort after a failed catalog with a restored xhigh; verified it fails when the error branch is reverted. * fix(cli): honor a failed probe process-tree teardown killProcessByChildProcess reports survivors by resolving false, but the probe discarded that result and settled anyway. The Windows graceful path is taskkill /T without /F and escalates nothing on its own, so a probe child that refuses the signal would be reported as cleaned up and the catalog cached, letting interactive Pi processes accumulate across refreshes. Escalate to the forced teardown when the graceful one reports survivors, and reject (caching nothing, so the next call re-probes) when even that fails. Skip the check when the child has no pid: nothing can leak, and replacing a spawn ENOENT with a teardown error would only obscure the real failure. Adds probe lifecycle tests (spawn + teardown helper mocked) for the escalation path, the reject-and-do-not-cache path, the no-pid spawn-failure path, and the timeout path; verified they fail when the escalation is reverted. * fix(cli): keep extensions enabled for the Pi model probe --no-extensions silently dropped providers contributed through pi.registerProvider, which the old `pi --list-models` probe did list. Users with such an extension would have lost those models in the create-session form only. Verified with a project-local .pi/extensions provider in the same cwd: the probe with --no-extensions returned 29 models, while both the default run and the old table probe returned 30 including the extension's model (and its thinkingLevelMap). Dropping the flag restores parity; the extension provider now comes back with its map intact. Discovery that cannot contribute models stays disabled (--no-session, --no-skills, --no-prompt-templates, --no-tools). Cost: the probe now measures ~1.4-2.0s instead of ~0.65s, still at or below the old table probe (~1.6-2.4s) and fronted by the existing 60s cache. * fix(cli): probe Pi models from the home directory, not the runner cwd Under launchd/systemd the runner cwd is `/`, and starting Pi there is pathological: project discovery plus extensions that scan from the working directory walk the whole filesystem root. With extensions enabled (required so pi.registerProvider models still surface) the RPC probe took 16.8s at cwd=/, past the 15s timeout, so machine-level model discovery failed 100% of the time and the create-session form showed only 'Pi model discovery timed out'. Measured on macOS with 9 global extensions: cwd=/ extensions on 16.8s -> timeout cwd=/ extensions off 0.6s -> would lose extension providers cwd=$HOME extensions on 1.4s -> 29 models, complete The catalog is machine-scoped and does not depend on cwd, so probing from the home directory is both safe and representative. Verified from cwd=/ under the runner's exact launchd environment: 1.3-1.7s, 29 models. The old `pi --list-models` probe was immune because it never initialized a session; this regression arrived with the RPC probe and was missed because every earlier verification ran from a project directory. Tests assert the spawn cwd is homedir() and that --no-extensions stays absent; verified the cwd test fails when the option is removed. * fix(cli): keep the probe in the runner cwd, fall back to home only at a root Forcing every probe to the home directory fixed the launchd timeout but broke project-local discovery: a runner started inside a project stopped seeing that project's .pi/extensions providers, which the replaced --list-models probe did surface. Verified with a project-local provider: present from the project dir (30 models), absent from home (29). Use the runner cwd normally and fall back to home only when cwd is a filesystem root -- the launchd/systemd case where Pi startup walks the whole tree (16.8s, past PROBE_TIMEOUT_MS) and where there is no project to lose anyway. process.cwd() can also throw for a deleted directory, so that falls back to home too. Verified under the runner's launchd environment: from / -> home, 1.6s, 29 models; from a project dir -> that dir, 1.4s, 30 models including the project-local provider. Tests cover all three branches and were checked in both directions: pinning to home fails the project-cwd test, pinning to cwd fails the root test.
hapi CLI
Run Claude Code, Codex, Cursor Agent, Grok Build, or OpenCode sessions from your terminal and control them remotely through the hapi hub.
What it does
- Starts Claude Code sessions and registers them with hapi-hub.
- Starts Codex mode for OpenAI-based sessions.
- Starts Cursor Agent mode for Cursor CLI sessions.
- Starts Grok Build locally or via ACP for remote sessions.
- Starts OpenCode mode via ACP and its plugin hook system.
- Provides an MCP stdio bridge for external tools.
- Manages a background runner for long-running sessions.
- Includes diagnostics and auth helpers.
Typical flow
- Start the hub and set env vars (see ../hub/README.md).
- Set the same CLI_API_TOKEN on this machine or run
hapi auth login. - Run
hapito start a session. - Use the web app or Telegram Mini App to monitor and control.
Commands
Session commands
hapi- Start a Claude Code session (passes through Claude CLI flags). Seesrc/index.ts.hapi codex- Start Codex mode. Seesrc/codex/runCodex.ts.hapi codex resume <sessionId>- Resume existing Codex session.hapi cursor- Start Cursor Agent mode. Seesrc/cursor/runCursor.ts. Supportshapi cursor resume <chatId>,hapi cursor --continue,--mode plan|ask,--yolo,--model. Local and remote modes supported; remote usesagent -pwith stream-json.hapi grok- Start Grok Build mode. Seesrc/grok/runGrok.ts.hapi opencode- Start OpenCode mode via ACP. Seesrc/opencode/runOpencode.ts. Note: OpenCode supports local and remote modes; local mode streams via OpenCode plugins.hapi resume [sessionId]- List resumable sessions for this machine or resume one locally.hapi ping-peer <session-id-prefix> <message>- Resume (if needed) and message another session. Prefer this or MCPping_peer/list_peersover reinventing JWT+curl. Also--message-file/--list.hapi inspect-peer <session-id-or-prefix>- Read-only peer metadata + recent message text (no resume). Prefer this or MCPinspect_peerwhen a user cites[title](/sessions/<id>)or Copy-referenceSee session "…" (/sessions/<id>) for context./sessions/<id>is a hub path, not a local file. Optional--limit.
Resume a remote session locally
hapi resume
hapi resume <session-id>
hapi resume lists resumable sessions for the current machine. hapi resume <session-id> hands off an active remote session and opens the same HAPI session in the local terminal.
Authentication
hapi auth status- Show authentication configuration and token source.hapi auth login- Interactively enter and save CLI_API_TOKEN.hapi auth logout- Clear saved credentials.
See src/commands/auth.ts.
Runner management
hapi runner start- Start runner as detached process.hapi runner stop- Stop runner gracefully.hapi runner status- Show runner diagnostics.hapi runner list- List active sessions managed by runner.hapi runner stop-session <sessionId>- Terminate specific session.hapi runner logs- Print path to latest runner log file.
Both start and start-sync accept repeatable --workspace-root <path> (or --workspace-root=<path>). When set:
- The web
/browsepage surfaces scoped file trees rooted at those paths. - The runner refuses
list-directoryandspawn-sessionrequests for paths outside the configured roots. ~and~/fooare expanded.
Omitting the flag keeps the legacy behavior: no scoping, no /browse feature.
See src/runner/run.ts.
Diagnostics
hapi doctor- Show full diagnostics (version, runner status, logs, processes).hapi doctor clean- Kill runaway HAPI processes.
See src/ui/doctor.ts.
Other
hapi mcp- Start MCP stdio bridge. Seesrc/codex/happyMcpStdioBridge.ts.hapi hub- Start the bundled hub (single binary workflow).hapi server- Alias forhapi hub.
Configuration
See src/configuration.ts for all options.
Required
CLI_API_TOKEN- Shared secret; must match the hub. Can be set via env or~/.hapi/settings.json(env wins).HAPI_API_URL- Hub base URL (default: http://localhost:3006).
Optional
HAPI_HOME- Config/data directory (default: ~/.hapi).HAPI_EXPERIMENTAL- Enable experimental features (true/1/yes).HAPI_EXTRA_HEADERS_JSON- JSON object of extra headers to send on CLI → hub requests, e.g.{"Cookie":"CF_Authorization=..."}. Can also be set as theextraHeadersobject in~/.hapi/settings.json(environment variable wins).HAPI_CLAUDE_PATH- Path to a specificclaudeexecutable.HAPI_HTTP_MCP_URL- Default MCP target forhapi mcp.
Runner
HAPI_RUNNER_HEARTBEAT_INTERVAL- Heartbeat interval in ms (default: 60000).HAPI_RUNNER_HTTP_TIMEOUT- HTTP timeout for runner control in ms (default: 10000).
Worktree (set by runner)
HAPI_WORKTREE_BASE_PATH- Base repository path.HAPI_WORKTREE_BRANCH- Current branch name.HAPI_WORKTREE_NAME- Worktree name.HAPI_WORKTREE_PATH- Full worktree path.HAPI_WORKTREE_CREATED_AT- Creation timestamp (ms).
Set for the wrapped agent
-
HAPI_SESSION_ID- The hub session id for the current run, exported into the wrapped agent/CLI child environment at spawn for every flavor (claude / codex / copilot / cursor / gemini / opencode / kimi / grok / pi), both runner-spawned and locally started sessions. Agents can read it to self-target "this chat" over the hub REST API or shell helpers without listing/api/sessions. Prefer the MCPdisplay_imagetool for inline media when it is available; useHAPI_SESSION_IDfor hub REST / shell tooling where MCP is not. To list peers on the same hub/namespace, prefer MCPlist_peers(works from runner-spawned sessions without sitting on the hub host; excludes the calling session). To read another session, prefer MCPinspect_peerorhapi inspect-peer. To message another session, prefer MCPping_peerorhapi ping-peer— do not reinvent JWT+curl. User citations look like[title](/sessions/<id>)or Copy-referenceSee session "…" (/sessions/<id>) for context; pass that<id>assessionIdPrefix. Do not Grep/Glob/sessions/<id>as a local filesystem path. On a remote runner, configure matchingHAPI_API_URL+CLI_API_TOKEN(orhapi auth login/~/.hapi/settings.json) on the runner host so shellhapi ping-peer --listworks; session CLI may export an explicit non-default hub URL into child env, but never mirrorsCLI_API_TOKENinto wrapped agents.Lazy Codex (terminal) sessions export the id only after the hub row is materialized, which happens when the MCP bridge starts — before the agent process is spawned — so path-only self-targeting does not race a missing hub row.
Example (shell fallback when MCP is unavailable) — path-only, self-targets the current session:
bun scripts/tooling/hapi-display-image.mjs /absolute/path/to/image.png "optional title"Explicit other session (prefix or full uuid) still works; that path may list sessions.
Storage
Data is stored in ~/.hapi/ (or $HAPI_HOME):
settings.json- User settings (machineId, token, onboarding flag). Seesrc/persistence.ts.runner.state.json- Runner state (pid, port, version, heartbeat).logs/- Log files.
Requirements
- Claude CLI installed and logged in (
claudeon PATH). - Cursor Agent CLI installed (
agenton PATH) forhapi cursor. Install:curl https://cursor.com/install -fsS | bash(macOS/Linux),irm 'https://cursor.com/install?win32=true' | iex(Windows). - Grok Build CLI installed (
grokon PATH) forhapi grok. Authenticate withgrok login --device-authon headless runner machines, or setXAI_API_KEY. - OpenCode CLI installed (
opencodeon PATH). - Bun for building from source.
Build from source
From the repo root:
bun install
bun run build:cli
bun run build:cli:exe
For an all-in-one binary that also embeds the web app:
bun run build:single-exe
Source structure
src/api/- Bot communication (Socket.IO + REST).src/claude/- Claude Code integration.src/codex/- Codex mode integration.src/cursor/- Cursor Agent integration.src/grok/- Grok Build native TUI + ACP integration.src/agent/- Shared support for ACP-compatible agents.src/opencode/- OpenCode ACP + hook integration.src/runner/- Background service.src/commands/- CLI command handlers.src/ui/- User interface and diagnostics.src/modules/- Tool implementations (ripgrep, difftastic, git).
Related docs
../hub/README.md../web/README.md