@evandu/super-pi 0.1.129 → 0.1.131

package/dist/server/file-changes.js

@@ -106,8 +106,8 @@ const MAX_BASELINE_BYTES = 1024 * 1024;
  * `stat` reports by default rounds two edits inside the same millisecond into one value, and a check
  * that misses a change is worse than no check.
  */
-function etagOf(size, mtimeNs, ino) {
-    return createHash("sha1").update(`${size}:${mtimeNs}:${ino}`).digest("hex").slice(0, 20);
+function etagOf(content) {
+    return createHash("sha1").update(content, "utf8").digest("hex").slice(0, 20);
 }
 export class FileChangeTracker {
     /** Workspace id -> path -> the change recorded for it. A path is recorded once: the LAST change to a
@@ -165,7 +165,7 @@ export class FileChangeTracker {
             }
             else {
                 before = readFileSync(absolute, "utf8");
-                etag = etagOf(info.size, info.mtimeNs, info.ino);
+                etag = etagOf(before);
             }
         }
         catch (error) {
@@ -223,7 +223,9 @@ export class FileChangeTracker {
             return;
         try {
             const info = statSync(resolve(root, change.path), { bigint: true });
-            const current = etagOf(info.size, info.mtimeNs, info.ino);
+            if (info.size > MAX_BASELINE_BYTES)
+                return;
+            const current = etagOf(readFileSync(resolve(root, change.path), "utf8"));
             if (current === change.etag) {
                 // The file is byte-for-byte what the baseline says it was, so the baseline was taken AFTER the
                 // write - or nothing changed at all. Either way it cannot be shown as "before".

package/dist/server/files.d.ts

@@ -97,9 +97,30 @@ export declare function looksBinary(sample: Uint8Array): boolean;
  * the extension path with a fixture whose CONTENT is text.
  */
 export declare function hasBinaryExtension(name: string): boolean;
+/**
+ * The extensions of the documents the parsing layer can read.
+ *
+ * WHY THE LIST LIVES HERE AND NOT IN `documents.ts`. This module has no relative imports, and that is
+ * load-bearing: `scripts/files-api.test.mjs` copies this file ALONE into a temp directory and
+ * compiles it there, to prove that a broken containment check really does leak. An import of a
+ * sibling module would not resolve in that scratch directory, so the mutation would fail to compile
+ * - which the test would read as "the guard still refuses the escape", the exact opposite of what it
+ * is checking.
+ *
+ * The parsing layer holds the same list, and the two are checked against each other by
+ * `scripts/documents.test.mjs`, so the tree cannot offer a file the parser cannot read.
+ */
+export declare const DOCUMENT_EXTENSIONS: Set<string>;
 /** Whether a file is worth putting in an editor tab at all, decided from its NAME alone, for the tree's
  *  own labelling. The authoritative answer comes from `readWorkspaceFile`, which reads bytes. */
 export declare function isTextName(name: string): boolean;
+/**
+ * Whether a file is a DOCUMENT the parsing layer can read, decided from its name.
+ *
+ * The same list the knowledge base and the document tools use, so a picker that offers a file and a
+ * server that accepts it cannot disagree about which files those are.
+ */
+export declare function isDocumentName(name: string): boolean;
 /** What a caller is told about one entry in a directory. */
 export type DirEntry = {
     /** The path RELATIVE to the workspace root, always `/`-separated, never with a leading slash. This is
@@ -110,6 +131,17 @@ export type DirEntry = {
     kind: "directory" | "file" | "symlink";
     /** Whether a file is worth opening, decided from its name. `null` for a directory. */
     text: boolean | null;
+    /**
+     * Whether this file is a DOCUMENT the parsing layer can read - a PDF, a Word document, a
+     * spreadsheet. `null` for a directory.
+     *
+     * WHY IT IS A SEPARATE FLAG AND NOT PART OF `text`. A document is not text - it cannot be opened in
+     * the editor, and opening it as text would show a zip file's bytes - but it IS worth offering to
+     * the person, because the knowledge base can import it and the agent can read it. One flag for
+     * "worth showing" would force the two cases into one, and a picker that offers a file the server
+     * then refuses is worse than one that offers nothing.
+     */
+    document?: boolean;
     /** Set when this entry is a link, and `kind` becomes `symlink` when it points OUT of the workspace. The
      *  tree can then say "cannot be opened" before the request comes back 403 rather than after. */
     symlink?: boolean;

package/dist/server/files.js

@@ -352,6 +352,20 @@ export function hasBinaryExtension(name) {
     }
     return false;
 }
+/**
+ * The extensions of the documents the parsing layer can read.
+ *
+ * WHY THE LIST LIVES HERE AND NOT IN `documents.ts`. This module has no relative imports, and that is
+ * load-bearing: `scripts/files-api.test.mjs` copies this file ALONE into a temp directory and
+ * compiles it there, to prove that a broken containment check really does leak. An import of a
+ * sibling module would not resolve in that scratch directory, so the mutation would fail to compile
+ * - which the test would read as "the guard still refuses the escape", the exact opposite of what it
+ * is checking.
+ *
+ * The parsing layer holds the same list, and the two are checked against each other by
+ * `scripts/documents.test.mjs`, so the tree cannot offer a file the parser cannot read.
+ */
+export const DOCUMENT_EXTENSIONS = new Set([".pdf", ".docx", ".xlsx", ".pptx", ".ppt"]);
 /** Whether a file is worth putting in an editor tab at all, decided from its NAME alone, for the tree's
  *  own labelling. The authoritative answer comes from `readWorkspaceFile`, which reads bytes. */
 export function isTextName(name) {
@@ -365,6 +379,19 @@ export function isTextName(name) {
         return true; // extensionless files are usually source or config; the sniff decides
     return TEXT_EXTENSIONS.has(lower.slice(dot));
 }
+/**
+ * Whether a file is a DOCUMENT the parsing layer can read, decided from its name.
+ *
+ * The same list the knowledge base and the document tools use, so a picker that offers a file and a
+ * server that accepts it cannot disagree about which files those are.
+ */
+export function isDocumentName(name) {
+    const lower = basename(name).toLowerCase();
+    const dot = lower.lastIndexOf(".");
+    if (dot <= 0)
+        return false;
+    return DOCUMENT_EXTENSIONS.has(lower.slice(dot));
+}
 /** The `/`-separated relative form used on the wire and in every comparison. */
 export function toRelative(root, absolute) {
     return relative(root, absolute).split(sep).join("/");
@@ -409,6 +436,7 @@ export async function listDirectory(root, requested) {
             name: dirent.name,
             kind: outside ? "symlink" : isDir ? "directory" : "file",
             text: isDir ? null : !outside && isTextName(dirent.name),
+            ...(isDir ? {} : { document: !outside && isDocumentName(dirent.name) }),
             ...(isLink ? { symlink: true } : {}),
             ...(outside ? { outside: true } : {}),
         });

package/dist/server/http-server.js

@@ -9,7 +9,10 @@ import { findUploadFile, MAX_UPLOAD_BODY_BYTES, saveUpload } from "./upload.js";
 import { checkDiskVersion } from "./version.js";
 import { gitBlame, gitDiff, gitLog, gitMutate, gitStatus } from "./git.js";
 import { computeFileDiff } from "./file-diff.js";
+import { verifyCapability } from "./capability.js";
 import { MAX_KNOWLEDGE_REQUEST_BYTES } from "./knowledge.js";
+import { MAX_DOCUMENT_REQUEST_BYTES } from "./application/document-service.js";
+import { MAX_WEB_REQUEST_BYTES } from "./web.js";
 import { MAX_TOOL_BODY_BYTES } from "./tool-registry.js";
 import { packageUpdateArgs } from "./update.js";
 import { FileIndex } from "./file-index.js";
@@ -240,7 +243,13 @@ export function createHttpServer(options) {
         // the same reason: it is reached only by the Pi process of one turn, carrying that turn's
         // capability in a header. The MANAGEMENT half (`/api/knowledge`) is deliberately NOT exempted - it
         // imports and deletes documents, so it stays behind the ordinary token.
-        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/todos" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
+        //
+        // `/api/documents/tool` is the same shape again, and the exemption is safe for the same reason:
+        // the endpoint verifies the SESSION's capability on its own, and refuses a request whose turn is
+        // not running. The global token is a server-wide secret; the capability is a per-conversation
+        // one that only the Pi process of that conversation holds, so the exemption does not widen who
+        // can reach the server - it only spares the one caller that already proves who it is.
+        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/documents/tool" && requestPath !== "/api/web/tool" && requestPath !== "/api/todos" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
             response.writeHead(401, { "www-authenticate": "Bearer" }).end("Authentication required");
             return;
         }
@@ -705,6 +714,97 @@ export function createHttpServer(options) {
             }
             return;
         }
+        if (url.pathname === "/api/documents/tool") {
+            if (!context.documentService) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "";
+                let totalBytes = 0;
+                // A DOCUMENT'S TEXT RIDES IN THE REQUEST BODY, so the cap is the document cap: a request
+                // past it is refused outright rather than truncated into a document that silently lost its
+                // tail.
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_DOCUMENT_REQUEST_BYTES) {
+                        response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "文档请求过大" }));
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                // The capability says WHICH CONVERSATION is asking, and the workspace is derived from it
+                // rather than taken from the request: a request that named its own workspace would be a
+                // request that could read another workspace.
+                const conversationId = String(request.headers["x-documents-conversation"] ?? "");
+                const verdict = verifyCapability(conversationId, request.headers["x-documents-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const result = body.action === "write"
+                    ? await context.documentService.write(conversationId, String(body.path ?? ""), String(body.content ?? ""), typeof body.title === "string" ? body.title : undefined, typeof body.baseEtag === "string" ? body.baseEtag : undefined)
+                    : await context.documentService.read(conversationId, String(body.path ?? ""));
+                response.writeHead(200, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(result));
+            }
+            catch (error) {
+                response.writeHead(400, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+            }
+            return;
+        }
+        if (url.pathname === "/api/web/tool") {
+            if (!context.web) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "", totalBytes = 0;
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_WEB_REQUEST_BYTES) {
+                        response.writeHead(413).end();
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const conversationId = String(request.headers["x-web-conversation"] ?? "");
+                const verdict = verifyCapability(conversationId, request.headers["x-web-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                const result = body.action === "search"
+                    ? await context.web.search(String(body.query ?? ""), Number(body.limit ?? 5), abortedAs(request))
+                    : body.action === "fetch"
+                        ? await context.web.fetch(String(body.url ?? ""), abortedAs(request))
+                        : await Promise.reject(new Error("未知网页工具操作"));
+                json(200, result);
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
         if (url.pathname === "/api/shutdown") {
             if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
                 response.writeHead(403, { "content-type": "text/plain; charset=utf-8" }).end("Shutdown requires a loopback or private network POST");
@@ -1059,9 +1159,20 @@ export function createHttpServer(options) {
                 response.writeHead(403).end();
                 return;
             }
+            // READ WITH A CEILING. This endpoint is exempt from the global token (the caller proves itself
+            // with a per-conversation capability instead), which means anyone on the LAN can REACH it - and
+            // this loop used to read the whole body into one string before checking anything, so an oversized
+            // body cost its full size in memory before the 403 said no. A question is a few hundred bytes;
+            // 64KB is orders of magnitude above any honest one and far below what a hostile body could use,
+            // and the shape is the same ceiling the `/api/tools` endpoints already enforce.
             let raw = "";
-            for await (const chunk of request)
+            for await (const chunk of request) {
                 raw += chunk;
+                if (raw.length > 64_000) {
+                    response.writeHead(413, { "content-type": "application/json" }).end(JSON.stringify({ error: "question request too large" }));
+                    return;
+                }
+            }
             try {
                 const body = JSON.parse(raw);
                 if (!body.conversationId || !body.question || !Array.isArray(body.options))

package/dist/server/index.js

@@ -15,6 +15,7 @@ import { SubagentSupervisor } from "./subagents.js";
 import { SubagentRunRecorder } from "./subagent-runs.js";
 import { WorkflowEngine } from "./workflow-engine.js";
 import { ExtensionUiService } from "./application/extension-ui-service.js";
+import { DocumentService } from "./application/document-service.js";
 import { CatalogService } from "./application/catalog-service.js";
 import { ProviderService } from "./application/provider-service.js";
 import { ProviderRegistry } from "./providers.js";
@@ -32,6 +33,7 @@ import { installServerLogging } from "./logging.js";
 import { ToolRegistry } from "./tool-registry.js";
 import { ToolRunner } from "./tool-runner.js";
 import { ToolLlmService } from "./tool-llm.js";
+import { WebService } from "./web.js";
 // ------------------------------------------------------------- Environment & paths
 const rootDir = resolve(import.meta.dirname, "../..");
 initRunningVersion(rootDir);
@@ -108,6 +110,7 @@ const todoEndpoint = `http://${internalHost}:${port}/api/todos`;
 const workflowEndpoint = `http://${internalHost}:${port}/api/workflow/run`;
 const questionEndpoint = `http://${internalHost}:${port}/api/question`;
 const toolsEndpoint = `http://${internalHost}:${port}/api/tools`;
+const documentsEndpoint = `http://${internalHost}:${port}/api/documents/tool`;
 // ------------------------------------------------------------- Core singletons
 const store = await openStateStore(dataDir, process.env.SUPER_PI_PERSISTENCE ?? "sqlite");
 const toolRegistry = new ToolRegistry(dataDir);
@@ -130,7 +133,7 @@ const paths = {
 };
 const runtime = process.env.SUPER_PI_RUNTIME === "welcome"
     ? new WelcomeRuntime()
-    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, uploadsDir });
+    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, uploadsDir });
 const broadcaster = new WsBroadcaster(() => store.snapshot());
 const memory = new ActiveMemory(join(dataDir, "memories"), store, runtime);
 process.env.SUPER_PI_MEMORY_ENDPOINT = `http://${internalHost}:${port}/api/memory/tool`;
@@ -143,6 +146,13 @@ const knowledge = new KnowledgeBase(join(dataDir, "knowledge"), store, runtime,
 process.env.SUPER_PI_KNOWLEDGE_ENDPOINT = `http://${internalHost}:${port}/api/knowledge/tool`;
 if (runtime instanceof PiRpcRuntime)
     runtime.setKnowledge(knowledge);
+// The document tools. The endpoint is published here, the same way the knowledge one is: the Pi
+// process of a turn reads it out of its environment, and the endpoint verifies the session's
+// capability on its own.
+const documentService = new DocumentService(store);
+process.env.SUPER_PI_DOCUMENTS_ENDPOINT = documentsEndpoint;
+const web = new WebService();
+process.env.SUPER_PI_WEB_ENDPOINT = `http://${internalHost}:${port}/api/web/tool`;
 const extensionUiService = new ExtensionUiService(broadcaster);
 const supervisor = new SubagentSupervisor(join(dataDir, "pi-sessions"), undefined, {
     dir: initialAgentDirs,
@@ -249,6 +259,8 @@ runService.setExecService(execService);
 const serverContext = {
     memory,
     knowledge,
+    web,
+    documentService,
     paths,
     store,
     runtime,

package/dist/server/inline-thinking.d.ts

@@ -0,0 +1,90 @@
+/**
+ * THE REASONING A MODEL PUTS INSIDE ITS OWN ANSWER.
+ *
+ * Some models do not have a reasoning channel. They answer in one stream of text and put their
+ * thinking in it, marked up with `<think>…</think>` tags - MiniMax's M2 series is the one this
+ * file exists for, and every gateway that proxies it behaves the same way. The tags arrive as
+ * ordinary text, so nothing downstream can tell them from an answer.
+ *
+ * WHY THIS IS SUPER PI'S PROBLEM AND NOT THE USER'S. Pi's OpenAI-compatible adapter only treats
+ * `reasoning_content`, `reasoning`, `reasoning_text` and `reasoning_details` as reasoning; it
+ * never parses tags out of `content`. A provider that inlines its thinking therefore hands Pi one
+ * long text block, Pi hands Super Pi one long text block, and Super Pi would draw the reasoning as
+ * part of the answer - in the reader's face, unlabelled, with the tags still in it. The obvious
+ * "fix" is to tell the user to go and set a provider-specific switch in Pi's `models.json`, which
+ * is a private API of a program Super Pi ships, for a quirk of one vendor. A user who never
+ * hears of it sees a broken transcript and has no way to know why.
+ *
+ * SO THE SPLIT HAPPENS HERE, ON SUPER PI'S OWN SIDE, FOR EVERY PROVIDER. Whatever the endpoint
+ * does with its reasoning, the transcript reads the same way: the reasoning goes into a thinking
+ * block, the answer goes into the answer, and the tags are never shown to anyone.
+ *
+ * THE ORDER IS THE WHOLE TRICK. A tag can straddle two deltas - the model writes `</thi` and then
+ * `nk>` in the next one - so the splitter holds back the tail that might be the start of a tag
+ * until the next delta settles it. And a delta can hold an answer, a thought and another answer,
+ * so the splitter returns SEGMENTS IN ORDER rather than "the text" and "the thinking": the caller
+ * has to be able to put the answer that came before a thought after it, and has to be able to say
+ * where that thought began.
+ *
+ * THE RULES, because each of them has a case that would otherwise be a bug:
+ *
+ *   - A PROPERLY CLOSED region is reasoning. It leaves the answer and enters the thinking block.
+ *   - AN UNCLOSED region is reasoning too. The model said it was thinking and then the turn
+ *     ended - an abort, a truncation, a provider that stopped mid-thought. The reasoning goes
+ *     into the block, and the answer keeps whatever came before the tag. Nothing is thrown away
+ *     either way: the fold is expandable, so the words are still there to be read.
+ *   - A CLOSING TAG WITH NOTHING OPEN is dropped. The model wrote it by mistake, and showing it
+ *     would be showing a fragment of markup as if it were content.
+ *   - TEXT IS NEVER LOST. A `<` that turns out not to begin a tag is held for one delta and then
+ *     released as text, so a comparison like `a < b` survives intact.
+ */
+/**
+ * One piece of a turn's text, in the order the model wrote it.
+ *
+ * `thinking-end` is a segment of its own because the end of a reasoning region is a FACT the
+ * browser needs and not text: it is what closes the "正在思考" indicator and what tells the
+ * transcript that the next fold is a new one.
+ */
+export type InlineThinkingSegment = {
+    kind: "text";
+    text: string;
+} | {
+    kind: "thinking";
+    text: string;
+} | {
+    kind: "thinking-end";
+};
+/**
+ * Splits a model's text into the answer and the reasoning the model wrote inside it.
+ *
+ * ONE SPLITTER PER TURN. The state it keeps - the held-back tail and whether the stream is
+ * inside a reasoning region - belongs to a turn and to nothing else, so a splitter is created
+ * when a turn starts and dropped when it ends.
+ */
+export declare class InlineThinkingSplitter {
+    /** The tail that might be the start of a tag, held until the next delta settles it. */
+    private held;
+    /** True while the stream is inside a reasoning region. */
+    private inside;
+    /**
+     * Feeds one delta in and gets back the segments it produced, in order.
+     *
+     * A delta that carries nothing but text produces one text segment. A delta that opens a
+     * reasoning region produces the text before it, then the reasoning, then the end of the
+     * reasoning when the closing tag arrives - and the text after it, if there is any.
+     */
+    push(delta: string): InlineThinkingSegment[];
+    /**
+     * Closes the turn: whatever is still held is released, and a reasoning region that never
+     * closed is finished as one.
+     */
+    flush(): InlineThinkingSegment[];
+}
+/**
+ * The answer inside a model's text, with the reasoning taken out of it.
+ *
+ * For the paths that want a STRING rather than a stream of segments: the title generator, the
+ * tool LLM, a sub-agent's result. A title with a `<think>` prefix in it is not a title, and a
+ * sub-agent's card whose summary starts with markup reads as broken.
+ */
+export declare function stripInlineThinking(text: string): string;

package/dist/server/inline-thinking.js

@@ -0,0 +1,181 @@
+/**
+ * THE REASONING A MODEL PUTS INSIDE ITS OWN ANSWER.
+ *
+ * Some models do not have a reasoning channel. They answer in one stream of text and put their
+ * thinking in it, marked up with `<think>…</think>` tags - MiniMax's M2 series is the one this
+ * file exists for, and every gateway that proxies it behaves the same way. The tags arrive as
+ * ordinary text, so nothing downstream can tell them from an answer.
+ *
+ * WHY THIS IS SUPER PI'S PROBLEM AND NOT THE USER'S. Pi's OpenAI-compatible adapter only treats
+ * `reasoning_content`, `reasoning`, `reasoning_text` and `reasoning_details` as reasoning; it
+ * never parses tags out of `content`. A provider that inlines its thinking therefore hands Pi one
+ * long text block, Pi hands Super Pi one long text block, and Super Pi would draw the reasoning as
+ * part of the answer - in the reader's face, unlabelled, with the tags still in it. The obvious
+ * "fix" is to tell the user to go and set a provider-specific switch in Pi's `models.json`, which
+ * is a private API of a program Super Pi ships, for a quirk of one vendor. A user who never
+ * hears of it sees a broken transcript and has no way to know why.
+ *
+ * SO THE SPLIT HAPPENS HERE, ON SUPER PI'S OWN SIDE, FOR EVERY PROVIDER. Whatever the endpoint
+ * does with its reasoning, the transcript reads the same way: the reasoning goes into a thinking
+ * block, the answer goes into the answer, and the tags are never shown to anyone.
+ *
+ * THE ORDER IS THE WHOLE TRICK. A tag can straddle two deltas - the model writes `</thi` and then
+ * `nk>` in the next one - so the splitter holds back the tail that might be the start of a tag
+ * until the next delta settles it. And a delta can hold an answer, a thought and another answer,
+ * so the splitter returns SEGMENTS IN ORDER rather than "the text" and "the thinking": the caller
+ * has to be able to put the answer that came before a thought after it, and has to be able to say
+ * where that thought began.
+ *
+ * THE RULES, because each of them has a case that would otherwise be a bug:
+ *
+ *   - A PROPERLY CLOSED region is reasoning. It leaves the answer and enters the thinking block.
+ *   - AN UNCLOSED region is reasoning too. The model said it was thinking and then the turn
+ *     ended - an abort, a truncation, a provider that stopped mid-thought. The reasoning goes
+ *     into the block, and the answer keeps whatever came before the tag. Nothing is thrown away
+ *     either way: the fold is expandable, so the words are still there to be read.
+ *   - A CLOSING TAG WITH NOTHING OPEN is dropped. The model wrote it by mistake, and showing it
+ *     would be showing a fragment of markup as if it were content.
+ *   - TEXT IS NEVER LOST. A `<` that turns out not to begin a tag is held for one delta and then
+ *     released as text, so a comparison like `a < b` survives intact.
+ */
+/** The tag that opens a reasoning region. */
+const OPEN_TAG = "<think>";
+/** The tag that closes one. */
+const CLOSE_TAG = "</think>";
+/** Appends a piece of text, skipping the empty ones: an empty segment is not an event. */
+function append(segments, kind, text) {
+    if (text)
+        segments.push({ kind, text });
+}
+/**
+ * How much of the tail of `text` could be the beginning of `tag`.
+ *
+ * The whole tag is not a candidate - a complete tag would have been found by `indexOf` - so this
+ * returns the length of the longest PROPER prefix of the tag that the tail ends with. It is what
+ * makes `<thi` wait for the next delta instead of being published as text and then having to be
+ * taken back.
+ */
+function partialTagLength(text, tag) {
+    const max = Math.min(tag.length - 1, text.length);
+    for (let length = max; length > 0; length -= 1) {
+        if (text.endsWith(tag.slice(0, length)))
+            return length;
+    }
+    return 0;
+}
+/**
+ * Splits a model's text into the answer and the reasoning the model wrote inside it.
+ *
+ * ONE SPLITTER PER TURN. The state it keeps - the held-back tail and whether the stream is
+ * inside a reasoning region - belongs to a turn and to nothing else, so a splitter is created
+ * when a turn starts and dropped when it ends.
+ */
+export class InlineThinkingSplitter {
+    /** The tail that might be the start of a tag, held until the next delta settles it. */
+    held = "";
+    /** True while the stream is inside a reasoning region. */
+    inside = false;
+    /**
+     * Feeds one delta in and gets back the segments it produced, in order.
+     *
+     * A delta that carries nothing but text produces one text segment. A delta that opens a
+     * reasoning region produces the text before it, then the reasoning, then the end of the
+     * reasoning when the closing tag arrives - and the text after it, if there is any.
+     */
+    push(delta) {
+        const segments = [];
+        if (!delta)
+            return segments;
+        const buffer = this.held + delta;
+        this.held = "";
+        let index = 0;
+        while (index < buffer.length) {
+            if (this.inside) {
+                const close = buffer.indexOf(CLOSE_TAG, index);
+                if (close === -1) {
+                    // No closing tag yet. Everything that cannot be the start of one is reasoning, and the
+                    // rest waits for the next delta.
+                    const keep = partialTagLength(buffer.slice(index), CLOSE_TAG);
+                    append(segments, "thinking", buffer.slice(index, buffer.length - keep));
+                    this.held = buffer.slice(buffer.length - keep);
+                    break;
+                }
+                append(segments, "thinking", buffer.slice(index, close));
+                index = close + CLOSE_TAG.length;
+                this.inside = false;
+                segments.push({ kind: "thinking-end" });
+                continue;
+            }
+            const open = buffer.indexOf(OPEN_TAG, index);
+            const close = buffer.indexOf(CLOSE_TAG, index);
+            if (open === -1 && close === -1) {
+                // BOTH TAGS CAN START HERE, SO BOTH TAILS ARE HELD. The tail is held so that a tag the
+                // tokenizer cut in half is still recognized as a tag; which tag it might be is exactly the
+                // question, and outside a reasoning region it can be EITHER one: a stray `</think>` is markup
+                // the model wrote by mistake and must be dropped, exactly like a `<think>` that opens a
+                // region. Holding only the OPEN prefix published the CLOSE prefix as text at once, so the
+                // same stray tag was dropped when it arrived whole and survived in the answer when the
+                // tokenizer cut it - `["答案</thi", "nk>还是答案"]` read as `答案</think>还是答案`
+                // (measured by scripts/inline-thinking-close-tag.test.mjs, ledger TEST-021). The longer of
+                // the two prefixes is held; a tail that turns out to be neither is released as text on the
+                // next delta, which is the "text is never lost" rule.
+                const rest = buffer.slice(index);
+                const keep = Math.max(partialTagLength(rest, OPEN_TAG), partialTagLength(rest, CLOSE_TAG));
+                append(segments, "text", rest.slice(0, rest.length - keep));
+                this.held = rest.slice(rest.length - keep);
+                break;
+            }
+            if (open !== -1 && (close === -1 || open < close)) {
+                append(segments, "text", buffer.slice(index, open));
+                index = open + OPEN_TAG.length;
+                this.inside = true;
+                continue;
+            }
+            // A CLOSING TAG WITH NOTHING OPEN. Dropped: it is markup the model wrote by mistake, and a
+            // reader would take it for content. The text BEFORE it is ordinary text and is kept - the tag
+            // is dropped, not everything up to it.
+            append(segments, "text", buffer.slice(index, close));
+            index = close + CLOSE_TAG.length;
+        }
+        return segments;
+    }
+    /**
+     * Closes the turn: whatever is still held is released, and a reasoning region that never
+     * closed is finished as one.
+     */
+    flush() {
+        const segments = [];
+        if (this.inside) {
+            if (this.held)
+                segments.push({ kind: "thinking", text: this.held });
+            this.held = "";
+            this.inside = false;
+            segments.push({ kind: "thinking-end" });
+            return segments;
+        }
+        if (this.held) {
+            segments.push({ kind: "text", text: this.held });
+            this.held = "";
+        }
+        return segments;
+    }
+}
+/**
+ * The answer inside a model's text, with the reasoning taken out of it.
+ *
+ * For the paths that want a STRING rather than a stream of segments: the title generator, the
+ * tool LLM, a sub-agent's result. A title with a `<think>` prefix in it is not a title, and a
+ * sub-agent's card whose summary starts with markup reads as broken.
+ */
+export function stripInlineThinking(text) {
+    if (!text)
+        return "";
+    const splitter = new InlineThinkingSplitter();
+    const segments = [...splitter.push(text), ...splitter.flush()];
+    let answer = "";
+    for (const segment of segments) {
+        if (segment.kind === "text")
+            answer += segment.text;
+    }
+    return answer;
+}