@evandu/super-pi 0.1.103 → 0.1.105

package/dist/client/index.html

@@ -8,8 +8,8 @@
     <link rel="alternate icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
     <title>Super Pi</title>
-    <script type="module" crossorigin src="/assets/index-mAu39Bra.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DDkbPYLz.css">
+    <script type="module" crossorigin src="/assets/index-tBfBUY_8.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-UiqTcZca.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/application/catalog-service.d.ts

@@ -37,6 +37,15 @@ export declare class CatalogService {
      * Broadcasts the model catalog to connected clients.
      */
     broadcastCatalog(selection?: ModelSelection, conversationId?: string): Promise<void>;
+    /**
+     * Broadcasts the UNFILTERED catalog, for the settings window's model panel.
+     *
+     * A SEPARATE EVENT FROM `model.catalog`, and the reason is the same one that made
+     * `model.catalog.all` a separate event in the first place: a `model.catalog` without a
+     * conversation is the unfiltered list, and a client that received it as its conversation's list
+     * would be offered the models that workspace's rules forbid. The panel gets its own event.
+     */
+    broadcastAllCatalog(): Promise<void>;
     setModelRules(rules: import("../types.js").ModelFilterRule[]): Promise<void>;
     /**
      * Reads one catalog filtered by mode at source.

package/dist/server/application/catalog-service.js

@@ -90,6 +90,17 @@ export class CatalogService {
         const catalog = await this.getCatalog(selection, conversationId);
         this.broadcaster.broadcast({ type: "model.catalog", catalog, conversationId });
     }
+    /**
+     * Broadcasts the UNFILTERED catalog, for the settings window's model panel.
+     *
+     * A SEPARATE EVENT FROM `model.catalog`, and the reason is the same one that made
+     * `model.catalog.all` a separate event in the first place: a `model.catalog` without a
+     * conversation is the unfiltered list, and a client that received it as its conversation's list
+     * would be offered the models that workspace's rules forbid. The panel gets its own event.
+     */
+    async broadcastAllCatalog() {
+        this.broadcaster.broadcast({ type: "model.catalog.all", catalog: await this.getAllCatalog() });
+    }
     async setModelRules(rules) {
         if (!this.store)
             throw new Error("Store unavailable");

package/dist/server/application/conversation-service.d.ts

@@ -1,6 +1,7 @@
 import { type Store } from "../store.js";
 import type { AgentRuntime } from "../runtime.js";
 import type { SubagentRunRecorder } from "../subagent-runs.js";
+import type { ModelSelection } from "../types.js";
 import type { EventBroadcaster } from "../server-context.js";
 import type { CatalogService } from "./catalog-service.js";
 import type { RunService } from "./run-service.js";
@@ -45,6 +46,14 @@ export declare class ConversationService {
      * a log and in a retry.
      */
     autoRenameConversation(conversationId: string): Promise<string>;
+    /**
+     * The model a conversation has selected, or undefined when it follows Pi's default.
+     *
+     * THIS IS WHAT THE CATALOG'S THINKING LEVELS DEPEND ON. Pi computes the levels from the model
+     * itself, so the levels of the model in force are the levels that conversation gets. A catalog read
+     * without this is a catalog of whatever Pi would default to.
+     */
+    modelSelectionFor(conversationId: string | undefined): ModelSelection | undefined;
     /**
      * Selects a conversation and broadcasts the catalog for that conversation's model.
      */

package/dist/server/application/conversation-service.js

@@ -107,6 +107,19 @@ export class ConversationService {
             throw new Error("当前没有可用的 Pi 进程，无法生成标题");
         return this.runtime.summarizeConversation(conversation, workspace.path);
     }
+    /**
+     * The model a conversation has selected, or undefined when it follows Pi's default.
+     *
+     * THIS IS WHAT THE CATALOG'S THINKING LEVELS DEPEND ON. Pi computes the levels from the model
+     * itself, so the levels of the model in force are the levels that conversation gets. A catalog read
+     * without this is a catalog of whatever Pi would default to.
+     */
+    modelSelectionFor(conversationId) {
+        if (!conversationId)
+            return undefined;
+        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        return conversation?.model;
+    }
     /**
      * Selects a conversation and broadcasts the catalog for that conversation's model.
      */

package/dist/server/application/provider-service.d.ts

@@ -0,0 +1,63 @@
+import { ProviderRegistry } from "../providers.js";
+import type { AgentRuntime } from "../runtime.js";
+import type { Store } from "../store.js";
+import type { PublicProvider } from "../types.js";
+import type { EventBroadcaster } from "../server-context.js";
+import type { CatalogService } from "./catalog-service.js";
+/**
+ * THE PROVIDERS A PERSON ADDED, as a service.
+ *
+ * The service owns the sequence, and the sequence is the whole point: a provider is not "saved"
+ * when it is in Super Pi's registry, it is saved when Pi can use it. So every change goes through
+ * the same four steps, in this order:
+ *
+ *   1. WRITE PI'S FILES. The definitions go into Pi's `models.json` and the key into Pi's
+ *      `auth.json`, merged into whatever is already there.
+ *   2. WRITE SUPER PI'S REGISTRY. It is the truth source, and it is written AFTER Pi's files so
+ *      that a failure to write them leaves Super Pi claiming nothing it has not done.
+ *   3. INVALIDATE THE CATALOG. Pi's model list is cached - the SDK's is remembered for the life of
+ *      the process and the runtime's has a ten-minute TTL - so a provider added now would not
+ *      appear in the picker until the cache expired. Ten minutes of a picker that cannot see the
+ *      model the person just added is exactly the "decorative control" this project refuses to ship.
+ *   4. INVALIDATE THE LIVE SESSIONS. A session holds its own `ModelRuntime`, created when the
+ *      session was built, and that runtime does not know a provider added a minute ago. Pi's
+ *      refusal to switch to an unknown model is swallowed by the session pool into a warning - the
+ *      turn then runs on the OLD model while the picker says the new one. So the sessions are made
+ *      stale instead, and each one is rebuilt at its next turn, which is a moment when throwing the
+ *      session away costs nothing.
+ */
+export declare class ProviderService {
+    private readonly registry;
+    private readonly runtime;
+    private readonly broadcaster;
+    private readonly catalogService;
+    private readonly store;
+    constructor(registry: ProviderRegistry, runtime: AgentRuntime, broadcaster: EventBroadcaster, catalogService: CatalogService, store: Store);
+    /** The providers Super Pi manages, as the browser may see them: no keys, only the fact of one. */
+    list(): Promise<PublicProvider[]>;
+    /**
+     * Adds a provider, or adds a model to one, or updates one.
+     *
+     * ONE CALL, THREE THINGS, because the form collects a provider and a model together and a person
+     * saving a second model under the same provider should not have to retype the API address. The
+     * merge is by id: the provider's fields are replaced by what the form said, and the model with
+     * the same id is replaced while the provider's other models stay.
+     *
+     * THE KEY IS LEFT ALONE UNLESS THE FORM SAYS OTHERWISE. An empty key field means "I did not type
+     * one", not "remove the key": the key is never shown again once it is stored, so an empty field
+     * is the normal state of a form for a provider that already has one. `clearKey` is how a person
+     * asks for it to go.
+     */
+    set(input: unknown): Promise<PublicProvider[]>;
+    /** Removes a provider Super Pi manages, and only one it manages. */
+    remove(providerId: string): Promise<PublicProvider[]>;
+    /**
+     * What has to happen after the files are written, for the change to be REAL rather than pending.
+     *
+     * The catalog is re-read for every live conversation - the same loop the model rules use - rather
+     * than broadcast once without a conversation, because a catalog without a conversation is the
+     * UNFILTERED one, and handing that to a conversation that has model rules would offer it models
+     * those rules forbid.
+     */
+    private afterChange;
+}

package/dist/server/application/provider-service.js

@@ -0,0 +1,136 @@
+import { KNOWN_APIS, publicProviders, validateProvider } from "../providers.js";
+/**
+ * THE PROVIDERS A PERSON ADDED, as a service.
+ *
+ * The service owns the sequence, and the sequence is the whole point: a provider is not "saved"
+ * when it is in Super Pi's registry, it is saved when Pi can use it. So every change goes through
+ * the same four steps, in this order:
+ *
+ *   1. WRITE PI'S FILES. The definitions go into Pi's `models.json` and the key into Pi's
+ *      `auth.json`, merged into whatever is already there.
+ *   2. WRITE SUPER PI'S REGISTRY. It is the truth source, and it is written AFTER Pi's files so
+ *      that a failure to write them leaves Super Pi claiming nothing it has not done.
+ *   3. INVALIDATE THE CATALOG. Pi's model list is cached - the SDK's is remembered for the life of
+ *      the process and the runtime's has a ten-minute TTL - so a provider added now would not
+ *      appear in the picker until the cache expired. Ten minutes of a picker that cannot see the
+ *      model the person just added is exactly the "decorative control" this project refuses to ship.
+ *   4. INVALIDATE THE LIVE SESSIONS. A session holds its own `ModelRuntime`, created when the
+ *      session was built, and that runtime does not know a provider added a minute ago. Pi's
+ *      refusal to switch to an unknown model is swallowed by the session pool into a warning - the
+ *      turn then runs on the OLD model while the picker says the new one. So the sessions are made
+ *      stale instead, and each one is rebuilt at its next turn, which is a moment when throwing the
+ *      session away costs nothing.
+ */
+export class ProviderService {
+    registry;
+    runtime;
+    broadcaster;
+    catalogService;
+    store;
+    constructor(registry, runtime, broadcaster, catalogService, store) {
+        this.registry = registry;
+        this.runtime = runtime;
+        this.broadcaster = broadcaster;
+        this.catalogService = catalogService;
+        this.store = store;
+    }
+    /** The providers Super Pi manages, as the browser may see them: no keys, only the fact of one. */
+    async list() {
+        return publicProviders(await this.registry.load());
+    }
+    /**
+     * Adds a provider, or adds a model to one, or updates one.
+     *
+     * ONE CALL, THREE THINGS, because the form collects a provider and a model together and a person
+     * saving a second model under the same provider should not have to retype the API address. The
+     * merge is by id: the provider's fields are replaced by what the form said, and the model with
+     * the same id is replaced while the provider's other models stay.
+     *
+     * THE KEY IS LEFT ALONE UNLESS THE FORM SAYS OTHERWISE. An empty key field means "I did not type
+     * one", not "remove the key": the key is never shown again once it is stored, so an empty field
+     * is the normal state of a form for a provider that already has one. `clearKey` is how a person
+     * asks for it to go.
+     */
+    async set(input) {
+        const requested = validateProvider(input);
+        const raw = (input ?? {});
+        const previous = await this.registry.load();
+        const existing = previous.find((provider) => provider.id === requested.id);
+        const apiKey = requested.apiKey
+            ? requested.apiKey
+            : (raw.clearKey === true ? undefined : existing?.apiKey);
+        // A MODEL WITH THE SAME ID IS REPLACED WHERE IT STANDS, not moved to the end: the list a person
+        // sees in the panel is the list they added, and re-ordering it because they edited its first
+        // entry would be a change nobody asked for. A model with a NEW id is appended.
+        const incoming = requested.models[0];
+        const models = !existing
+            ? requested.models
+            : (existing.models.some((model) => model.id === incoming.id)
+                ? existing.models.map((model) => (model.id === incoming.id ? incoming : model))
+                : [...existing.models, incoming]);
+        const merged = {
+            id: requested.id,
+            ...(requested.name ? { name: requested.name } : {}),
+            baseUrl: requested.baseUrl,
+            api: requested.api,
+            ...(apiKey ? { apiKey } : {}),
+            models,
+        };
+        const next = existing
+            ? [...previous.filter((provider) => provider.id !== requested.id), merged]
+            : [...previous, merged];
+        await this.registry.applyToPi(previous, next);
+        try {
+            await this.registry.save(next);
+        }
+        catch (error) {
+            // The registry is the truth source, so a failure to write it means Super Pi no longer knows
+            // what it put into Pi's files. Pi's files are put back the way they were, and the failure is
+            // reported rather than swallowed: a registry that disagrees with Pi's files is a state the
+            // next write would trip over.
+            await this.registry.applyToPi(next, previous).catch(() => undefined);
+            throw error;
+        }
+        await this.afterChange();
+        return publicProviders(next);
+    }
+    /** Removes a provider Super Pi manages, and only one it manages. */
+    async remove(providerId) {
+        const previous = await this.registry.load();
+        const existing = previous.find((provider) => provider.id === providerId);
+        if (!existing)
+            throw new Error(`Super Pi 没有管理供应商「${providerId}」`);
+        const next = previous.filter((provider) => provider.id !== providerId);
+        await this.registry.applyToPi(previous, next);
+        await this.registry.save(next);
+        await this.afterChange();
+        return publicProviders(next);
+    }
+    /**
+     * What has to happen after the files are written, for the change to be REAL rather than pending.
+     *
+     * The catalog is re-read for every live conversation - the same loop the model rules use - rather
+     * than broadcast once without a conversation, because a catalog without a conversation is the
+     * UNFILTERED one, and handing that to a conversation that has model rules would offer it models
+     * those rules forbid.
+     */
+    async afterChange() {
+        this.runtime.invalidateCatalog?.();
+        this.runtime.bumpModelEpoch?.();
+        for (const conversation of this.store.snapshot().conversations) {
+            if (conversation.archivedAt)
+                continue;
+            try {
+                await this.catalogService.broadcastCatalog(conversation.model, conversation.id);
+            }
+            catch (error) {
+                console.warn(`供应商已保存，刷新会话 ${conversation.id} 的模型目录失败：${String(error)}`);
+            }
+        }
+        // The settings panel's OWN list, which is unfiltered and therefore has to be asked for
+        // separately. Without this the person who just added a provider would not see their own model
+        // in the default-model dropdown until they closed the window and opened it again.
+        await this.catalogService.broadcastAllCatalog?.();
+        this.broadcaster.broadcast({ type: "providers.list", providers: await this.list(), apis: [...KNOWN_APIS] });
+    }
+}

package/dist/server/command-handler.d.ts

@@ -4,6 +4,7 @@ import type { ConversationService } from "./application/conversation-service.js"
 import type { RunService } from "./application/run-service.js";
 import type { ExtensionUiService } from "./application/extension-ui-service.js";
 import type { CatalogService } from "./application/catalog-service.js";
+import type { ProviderService } from "./application/provider-service.js";
 import type { TerminalService } from "./terminal.js";
 export type SocketSender = (event: ServerEvent) => void;
 /**
@@ -17,6 +18,13 @@ export declare class CommandHandler {
     private readonly catalogService;
     /** Path to the Super Pi repository root, used to spawn the restart script. */
     private readonly rootDir?;
+    /**
+     * The providers a person added through the settings window.
+     *
+     * Optional because the command handler is constructed by tests that do not care about providers,
+     * and a missing service has to say so rather than take the whole handler down.
+     */
+    private readonly providerService?;
     /**
      * The built-in terminal service.
      *
@@ -25,7 +33,14 @@ export declare class CommandHandler {
     private readonly terminalService?;
     constructor(workspaceService: WorkspaceService, conversationService: ConversationService, runService: RunService, extensionUiService: ExtensionUiService, catalogService: CatalogService, terminalService?: TerminalService, 
     /** Path to the Super Pi repository root, used to spawn the restart script. */
-    rootDir?: string | undefined);
+    rootDir?: string | undefined, 
+    /**
+     * The providers a person added through the settings window.
+     *
+     * Optional because the command handler is constructed by tests that do not care about providers,
+     * and a missing service has to say so rather than take the whole handler down.
+     */
+    providerService?: ProviderService | undefined);
     /**
      * Processes a client command.
      *

package/dist/server/command-handler.js

@@ -1,5 +1,6 @@
 import { spawn } from "node:child_process";
 import { join } from "node:path";
+import { KNOWN_APIS } from "./providers.js";
 import { packageUpdateArgs } from "./update.js";
 /**
  * Routes client commands to appropriate application services and converts results or errors.
@@ -11,6 +12,7 @@ export class CommandHandler {
     extensionUiService;
     catalogService;
     rootDir;
+    providerService;
     /**
      * The built-in terminal service.
      *
@@ -19,13 +21,21 @@ export class CommandHandler {
     terminalService;
     constructor(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, 
     /** Path to the Super Pi repository root, used to spawn the restart script. */
-    rootDir) {
+    rootDir, 
+    /**
+     * The providers a person added through the settings window.
+     *
+     * Optional because the command handler is constructed by tests that do not care about providers,
+     * and a missing service has to say so rather than take the whole handler down.
+     */
+    providerService) {
         this.workspaceService = workspaceService;
         this.conversationService = conversationService;
         this.runService = runService;
         this.extensionUiService = extensionUiService;
         this.catalogService = catalogService;
         this.rootDir = rootDir;
+        this.providerService = providerService;
         this.terminalService = terminalService;
     }
     /**
@@ -69,6 +79,29 @@ export class CommandHandler {
             await this.catalogService.setDefaultModel(command.model);
             return;
         }
+        // THE PROVIDERS A PERSON ADDED. The list is answered to the ASKING socket only - it is a panel's
+        // private list, and broadcasting it would put a provider's API address in every other tab's state
+        // for no gain. The set and the remove broadcast the new list themselves, because everybody who
+        // has the settings window open has to see the change.
+        if (command.type === "providers.set") {
+            if (!this.providerService)
+                throw new Error("供应商功能不可用");
+            await this.providerService.set(command.provider);
+            return;
+        }
+        if (command.type === "providers.remove") {
+            if (!this.providerService)
+                throw new Error("供应商功能不可用");
+            await this.providerService.remove(command.providerId);
+            return;
+        }
+        if (command.type === "providers.fetch") {
+            if (!this.providerService)
+                throw new Error("供应商功能不可用");
+            if (sendToSocket)
+                sendToSocket({ type: "providers.list", providers: await this.providerService.list(), apis: [...KNOWN_APIS] });
+            return;
+        }
         if (command.type === "workspace.create") {
             return await this.workspaceService.createWorkspace(command.name, command.path);
         }
@@ -237,10 +270,21 @@ export class CommandHandler {
             return;
         }
         if (command.type === "catalog.fetch") {
+            // THE CATALOG OF THE CONVERSATION BEING SHOWN, not of whatever Pi would default to.
+            //
+            // The THINKING LEVELS belong to the model in force: Pi computes them from the model itself, and a
+            // model that cannot reason offers only "off". This command used to ask for the catalog with NO
+            // selection, so the levels were always the DEFAULT model's - which means the picker offered the
+            // levels of a model the person was not using, and hid the ones they were. The model list is the
+            // same either way, so only the levels were wrong; the levels are the part a person reads.
+            //
+            // `conversation.select` already asked for it this way; this is the same answer, for the other
+            // way a client asks for it.
+            const selection = this.conversationService.modelSelectionFor(command.conversationId);
             if (sendToSocket)
-                sendToSocket({ type: "model.catalog", conversationId: command.conversationId, catalog: await this.catalogService.getCatalog(undefined, command.conversationId) });
+                sendToSocket({ type: "model.catalog", conversationId: command.conversationId, catalog: await this.catalogService.getCatalog(selection, command.conversationId) });
             else
-                await this.catalogService.broadcastCatalog(undefined, command.conversationId);
+                await this.catalogService.broadcastCatalog(selection, command.conversationId);
             return;
         }
         // The unfiltered catalog, for the settings window's model panel. Sent to the ASKING socket only:

package/dist/server/index.js

@@ -16,6 +16,8 @@ import { SubagentRunRecorder } from "./subagent-runs.js";
 import { WorkflowEngine } from "./workflow-engine.js";
 import { ExtensionUiService } from "./application/extension-ui-service.js";
 import { CatalogService } from "./application/catalog-service.js";
+import { ProviderService } from "./application/provider-service.js";
+import { ProviderRegistry } from "./providers.js";
 import { RunService } from "./application/run-service.js";
 import { ConversationService } from "./application/conversation-service.js";
 import { WorkspaceService } from "./application/workspace-service.js";
@@ -178,6 +180,15 @@ const onDirsChanged = (dirs) => {
     workspaceService.setAgentsDir(dirs);
 };
 const catalogService = new CatalogService(runtime, broadcaster, initialAgentDirs, store, rootDir, onDirsChanged);
+/**
+ * The providers a person added through the settings window.
+ *
+ * The registry lives in Super Pi's own data directory and holds the API keys; Pi's `models.json` and
+ * `auth.json` are written from it, so a provider added here is a provider Pi can use - in a session,
+ * in a spawned Pi, and in the terminal.
+ */
+const providerRegistry = new ProviderRegistry(dataDir);
+const providerService = new ProviderService(providerRegistry, runtime, broadcaster, catalogService, store);
 const runService = new RunService(store, runtime, subagents, broadcaster, extensionUiService, initialAgentDirs, workflows);
 runService.setMemory(memory);
 const conversationService = new ConversationService(store, runtime, subagents, broadcaster, catalogService, runService, extensionUiService, initialAgentDirs);
@@ -216,6 +227,7 @@ const serverContext = {
     runService,
     extensionUiService,
     catalogService,
+    providerService,
     execService,
     toolRegistry,
     toolRunner,
@@ -223,7 +235,7 @@ const serverContext = {
     terminalEnabled: () => terminalService.enabled,
     terminalDisabledReason: () => terminalDisabledReason(),
 };
-const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir);
+const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir, providerService);
 // ------------------------------------------------------------- Lifecycle & shutdown
 let shutdownPromise;
 async function closeHttpServer() {

package/dist/server/pi-session-events.d.ts

@@ -73,6 +73,37 @@ export interface TurnEventHandlers {
         followUp: string[];
     }): void;
 }
+/**
+ * The failure Pi reported in the message that ended the turn, if it reported one.
+ *
+ * WHY IT IS HELD AND NOT THROWN ON THE SPOT. Pi retries on its own: an assistant message that ends
+ * with `stopReason: "error"` may be followed by another assistant message, and only the LAST one
+ * decides whether the turn failed. So the failure is remembered when it arrives and raised when Pi
+ * SETTLES - which is the moment Pi has stopped working on its own and the answer is final. A failure
+ * raised at the moment it arrives would abort a turn Pi was about to retry, and the retry would then
+ * look like the user's problem.
+ *
+ * THE SAME RULES AS THE ONE-SHOT PATH, which already got this right (`runtime.ts`: the RPC drain loop
+ * reads the terminal outcome off `agent_end` and throws at `agent_settled`). A provider failure is a
+ * failure; a response that hit the length limit is an INCOMPLETE answer and is one too. An `"aborted"`
+ * is NOT a failure here: the person stopped the turn, and a stopped turn is a turn that ended - the
+ * one-shot path can tell the difference because it knows whether the signal was aborted, and the
+ * session path does not need to: an abort is the user's own action and the run service already
+ * records it as stopped.
+ */
+export interface TurnFailure {
+    /** The message Pi reported, in its own words. */
+    message: string;
+    /** The raw reason, kept so a caller can tell a provider failure from anything else. */
+    stopReason: string;
+}
+/**
+ * Reads the failure out of a `message_end` record, or undefined when it is not a failed one.
+ *
+ * ONLY THE ASSISTANT'S MESSAGE COUNTS. `message_end` also fires for user messages, tool results and
+ * custom messages, and none of those is a turn failing.
+ */
+export declare function describeMessageFailure(record: unknown): TurnFailure | undefined;
 /**
  * A queue of turn items, with the waiters that are blocked on it.
  *
@@ -108,4 +139,6 @@ export declare class TurnQueue {
  * then counted - the same policy the RPC loop applied, and for the same reason: an event type nobody
  * understands is worth saying out loud exactly once.
  */
-export declare function handleSessionEvent(event: unknown, queue: TurnQueue, handlers: TurnEventHandlers, report: (key: string) => void): boolean;
+export declare function handleSessionEvent(event: unknown, queue: TurnQueue, handlers: TurnEventHandlers, report: (key: string) => void, failure?: {
+    current: TurnFailure | undefined;
+}): boolean;

package/dist/server/pi-session-events.js

@@ -62,6 +62,31 @@ export function describeDeliveredUserMessage(record) {
         .filter((part) => part !== undefined);
     return parts.length ? parts.join("\n") : undefined;
 }
+/**
+ * Reads the failure out of a `message_end` record, or undefined when it is not a failed one.
+ *
+ * ONLY THE ASSISTANT'S MESSAGE COUNTS. `message_end` also fires for user messages, tool results and
+ * custom messages, and none of those is a turn failing.
+ */
+export function describeMessageFailure(record) {
+    const event = record;
+    if (event?.type !== "message_end")
+        return undefined;
+    const message = event.message;
+    if (!message || typeof message !== "object" || message.role !== "assistant")
+        return undefined;
+    const text = typeof message.errorMessage === "string" ? message.errorMessage.trim() : "";
+    if (message.stopReason === "error") {
+        return { message: text || "Pi 报告模型或服务提供方错误。", stopReason: "error" };
+    }
+    if (message.stopReason === "length") {
+        // A response that hit the length limit is an INCOMPLETE answer. Pi compacts and continues after a
+        // recoverable one, so a turn that SETTLES with this reason is one whose answer is missing its
+        // end - and saying so is better than a turn that looks finished.
+        return { message: text || "模型输出达到本轮长度上限，回答未完成。", stopReason: "length" };
+    }
+    return undefined;
+}
 /**
  * A queue of turn items, with the waiters that are blocked on it.
  *
@@ -149,11 +174,53 @@ export class TurnQueue {
  * then counted - the same policy the RPC loop applied, and for the same reason: an event type nobody
  * understands is worth saying out loud exactly once.
  */
-export function handleSessionEvent(event, queue, handlers, report) {
+export function handleSessionEvent(event, queue, handlers, report, failure) {
     const record = event;
     if (!record || typeof record.type !== "string")
         return false;
     switch (record.type) {
+        case "message_end": {
+            // THE AUTHORITATIVE END OF AN ASSISTANT MESSAGE. `message_end` is the completed message, and its
+            // `stopReason` is the only place Pi says whether the model actually answered. The bridge used to
+            // ignore this event, which meant a provider that failed was indistinguishable from one that
+            // finished: the turn settled, the status became "completed", and the reader saw a turn that
+            // looked fine and had no answer in it.
+            //
+            // A failure is HELD, not thrown, because Pi retries on its own - the message that failed may be
+            // followed by another one. The retry starts a new assistant message, and THAT clears the held
+            // failure, so only the last message of the turn decides.
+            const reported = describeMessageFailure(record);
+            if (reported && failure)
+                failure.current = reported;
+            return true;
+        }
+        case "message_start": {
+            // A NEW ASSISTANT MESSAGE MEANS A NEW ATTEMPT. Pi's retry starts one, and the failure of the
+            // attempt before it is no longer the failure of this turn.
+            if (record.message?.role === "assistant" && failure)
+                failure.current = undefined;
+            // A STEER THIS TURN DELIVERED. Pi announces the moment a queued message stops waiting and starts
+            // being answered by emitting `message_start` with the user message it picked up, immediately after
+            // the `queue_update` above that shows the entry gone. The host uses it to split the turn so the
+            // answer lands under the message it answers.
+            //
+            // A NON-user `message_start` is not a delivery: it gets the same once-per-type report every other
+            // unrouted event gets, which is the same policy the RPC drain loop applies.
+            const delivered = describeDeliveredUserMessage(record);
+            if (delivered === undefined) {
+                if (record.message?.role === "assistant")
+                    return true;
+                report(`type ${JSON.stringify(record.type)}`);
+                return true;
+            }
+            try {
+                handlers.onSteerDelivered?.(delivered);
+            }
+            catch (error) {
+                console.warn(`PiRpcRuntime: the steer delivery handler threw: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+            return true;
+        }
         case "message_update": {
             const assistant = record.assistantMessageEvent;
             if (!assistant)
@@ -240,28 +307,19 @@ export function handleSessionEvent(event, queue, handlers, report) {
             }
             return true;
         }
-        case "message_start": {
-            // A STEER THIS TURN DELIVERED. Pi announces the moment a queued message stops waiting and starts
-            // being answered by emitting `message_start` with the user message it picked up, immediately after
-            // the `queue_update` above that shows the entry gone. The host uses it to split the turn so the
-            // answer lands under the message it answers.
+        case "agent_settled": {
+            // THE TURN IS OVER, AND IT MAY HAVE FAILED. Pi settling is the end of the turn, and a turn that
+            // ended because the provider failed has to say so: a failure that is not raised is a failed turn
+            // that the reader sees as a completed one, with no answer in it and no banner above it.
             //
-            // A NON-user `message_start` is not a delivery: it gets the same once-per-type report every other
-            // unrouted event gets, which is the same policy the RPC drain loop applies.
-            const delivered = describeDeliveredUserMessage(record);
-            if (delivered === undefined) {
-                report(`type ${JSON.stringify(record.type)}`);
+            // The failure is raised HERE and not when it arrived, because Pi retries on its own - a message
+            // that failed may be followed by another one, and only the last one decides.
+            const held = failure?.current;
+            if (held) {
+                failure.current = undefined;
+                queue.push({ kind: "error", error: new Error(held.message) });
                 return true;
             }
-            try {
-                handlers.onSteerDelivered?.(delivered);
-            }
-            catch (error) {
-                console.warn(`PiRpcRuntime: the steer delivery handler threw: ${error instanceof Error ? error.message : "unknown error"}`);
-            }
-            return true;
-        }
-        case "agent_settled": {
             queue.push({ kind: "end" });
             return true;
         }