@evandu/super-pi 0.1.129 → 0.1.131

package/dist/server/web.js

@@ -0,0 +1,180 @@
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+export const WEB_SEARCH_TOOL_NAME = "web_search";
+export const WEB_FETCH_TOOL_NAME = "web_fetch";
+export const MAX_WEB_REQUEST_BYTES = 64 * 1024;
+const SEARCH_LIMIT = 10;
+const RESPONSE_LIMIT = 2 * 1024 * 1024;
+const TEXT_LIMIT = 30_000;
+const REDIRECT_LIMIT = 5;
+const TIMEOUT_MS = 15_000;
+const USER_AGENT = "Mozilla/5.0 (compatible; SuperPi/1.0; +https://www.npmjs.com/package/@evandu/super-pi)";
+function decodeEntities(value) {
+    const named = { amp: "&", quot: '"', apos: "'", lt: "<", gt: ">", nbsp: " " };
+    return value.replace(/&(#x[\da-f]+|#\d+|[a-z]+);/gi, (_all, entity) => {
+        if (entity[0] === "#") {
+            const code = entity[1]?.toLowerCase() === "x" ? Number.parseInt(entity.slice(2), 16) : Number.parseInt(entity.slice(1), 10);
+            return Number.isFinite(code) ? String.fromCodePoint(code) : "";
+        }
+        return named[entity.toLowerCase()] ?? `&${entity};`;
+    });
+}
+function plainText(html) {
+    return decodeEntities(html.replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, " ").replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, " ").replace(/<[^>]+>/g, " "))
+        .replace(/\s+/g, " ").trim();
+}
+/** Parse Bing's ordinary result page. Kept separate so captured fixtures can guard markup changes. */
+export function parseBingResults(html, limit = 5) {
+    const results = [];
+    const blocks = html.match(/<li\b[^>]*class=["'][^"']*\bb_algo\b[^"']*["'][^>]*>[\s\S]*?<\/li>/gi) ?? [];
+    for (const block of blocks) {
+        const anchor = /<h2\b[^>]*>[\s\S]*?<a\b[^>]*href=["']([^"']+)["'][^>]*>([\s\S]*?)<\/a>/i.exec(block);
+        if (!anchor)
+            continue;
+        let url;
+        try {
+            url = new URL(decodeEntities(anchor[1]));
+        }
+        catch {
+            continue;
+        }
+        if (!/^https?:$/.test(url.protocol))
+            continue;
+        const caption = /<p\b[^>]*>([\s\S]*?)<\/p>/i.exec(block)?.[1] ?? "";
+        results.push({ title: plainText(anchor[2]), url: url.href, snippet: plainText(caption) });
+        if (results.length >= Math.min(SEARCH_LIMIT, Math.max(1, limit)))
+            break;
+    }
+    return results;
+}
+function blockedAddress(address) {
+    if (address === "::" || address === "::1")
+        return true;
+    const v4 = address.startsWith("::ffff:") ? address.slice(7) : address;
+    if (isIP(v4) === 4) {
+        const [a, b] = v4.split(".").map(Number);
+        return a === 0 || a === 10 || a === 127 || (a === 169 && b === 254) || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || a >= 224;
+    }
+    const normalized = address.toLowerCase();
+    return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb") || normalized.startsWith("ff");
+}
+async function publicAddress(hostname) {
+    if (hostname.toLowerCase() === "localhost" || hostname.endsWith(".localhost"))
+        throw new Error("不允许访问本机或私网地址");
+    const records = isIP(hostname) ? [{ address: hostname, family: isIP(hostname) }] : await lookup(hostname, { all: true, verbatim: true });
+    const record = records.find(item => !blockedAddress(item.address));
+    if (!record || records.some(item => blockedAddress(item.address)))
+        throw new Error("不允许访问本机或私网地址");
+    return record;
+}
+async function download(input, signal, redirects = 0) {
+    const url = new URL(input);
+    if (!/^https?:$/.test(url.protocol) || url.username || url.password)
+        throw new Error("只允许无凭据的 HTTP/HTTPS URL");
+    if (redirects > REDIRECT_LIMIT)
+        throw new Error("网页重定向次数过多");
+    const resolved = await publicAddress(url.hostname);
+    const requester = url.protocol === "https:" ? httpsRequest : httpRequest;
+    // Node may ask a custom lookup for one address or an array (`all: true`). Honor both overloads;
+    // returning the wrong shape makes net.connect report the misleading "Invalid IP address: undefined".
+    const pinnedLookup = ((_hostname, options, callback) => {
+        if (options?.all)
+            callback(null, [resolved]);
+        else
+            callback(null, resolved.address, resolved.family);
+    });
+    return new Promise((resolve, reject) => {
+        const req = requester(url, {
+            headers: { "user-agent": USER_AGENT, accept: "text/html,text/plain,application/xhtml+xml", "accept-encoding": "gzip, deflate, br" },
+            lookup: pinnedLookup,
+            servername: url.hostname,
+            timeout: TIMEOUT_MS,
+            signal,
+        }, response => {
+            const status = response.statusCode ?? 0;
+            const location = response.headers.location;
+            if (status >= 300 && status < 400 && location) {
+                response.resume();
+                download(new URL(location, url).href, signal, redirects + 1).then(resolve, reject);
+                return;
+            }
+            if (status < 200 || status >= 300) {
+                response.resume();
+                reject(new Error(`网页请求失败（HTTP ${status}）`));
+                return;
+            }
+            const chunks = [];
+            let bytes = 0;
+            response.on("data", chunk => {
+                bytes += chunk.length;
+                if (bytes > RESPONSE_LIMIT) {
+                    req.destroy(new Error("网页响应超过 2 MB 限制"));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            response.on("end", () => {
+                try {
+                    let body = Buffer.concat(chunks);
+                    const encoding = String(response.headers["content-encoding"] ?? "").toLowerCase();
+                    if (encoding === "gzip")
+                        body = gunzipSync(body);
+                    else if (encoding === "deflate")
+                        body = inflateSync(body);
+                    else if (encoding === "br")
+                        body = brotliDecompressSync(body);
+                    resolve({ url: url.href, body, contentType: String(response.headers["content-type"] ?? "application/octet-stream") });
+                }
+                catch (error) {
+                    reject(error);
+                }
+            });
+        });
+        req.on("timeout", () => req.destroy(new Error("网页请求超时")));
+        req.on("error", reject);
+        req.end();
+    });
+}
+function extractHtml(html) {
+    const title = plainText(/<title\b[^>]*>([\s\S]*?)<\/title>/i.exec(html)?.[1] ?? "");
+    let body = /<article\b[^>]*>([\s\S]*?)<\/article>/i.exec(html)?.[1]
+        ?? /<main\b[^>]*>([\s\S]*?)<\/main>/i.exec(html)?.[1]
+        ?? /<body\b[^>]*>([\s\S]*?)<\/body>/i.exec(html)?.[1]
+        ?? html;
+    body = body.replace(/<(nav|aside|footer|form|noscript|svg)\b[^>]*>[\s\S]*?<\/\1>/gi, " ")
+        .replace(/<(br|p|div|li|h[1-6]|tr)\b[^>]*>/gi, "\n")
+        .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, " ").replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, " ")
+        .replace(/<[^>]+>/g, " ");
+    const text = decodeEntities(body).replace(/[ \t]+/g, " ").replace(/\n\s*/g, "\n").replace(/\n{3,}/g, "\n\n").trim();
+    return { title, text };
+}
+export class WebService {
+    async search(query, limit = 5, signal) {
+        const clean = query.trim();
+        if (!clean)
+            throw new Error("搜索词不能为空");
+        if (clean.length > 500)
+            throw new Error("搜索词不能超过 500 个字符");
+        const url = new URL("https://www.bing.com/search");
+        url.searchParams.set("q", clean);
+        url.searchParams.set("count", String(Math.min(SEARCH_LIMIT, Math.max(1, Math.floor(limit)))));
+        url.searchParams.set("setlang", "zh-Hans");
+        const response = await download(url.href, signal);
+        const results = parseBingResults(response.body.toString("utf8"), limit);
+        if (!results.length)
+            throw new Error("搜索引擎没有返回可解析的结果，可能暂时限流或页面格式已变化");
+        return { query: clean, results };
+    }
+    async fetch(url, signal) {
+        const response = await download(url, signal);
+        if (!/^(text\/html|application\/xhtml\+xml|text\/plain)\b/i.test(response.contentType))
+            throw new Error(`不支持的网页类型：${response.contentType}`);
+        const decoded = response.body.toString("utf8");
+        const extracted = /^text\/plain\b/i.test(response.contentType) ? { title: "", text: decoded.trim() } : extractHtml(decoded);
+        const truncated = extracted.text.length > TEXT_LIMIT;
+        return { title: extracted.title, url: response.url, text: extracted.text.slice(0, TEXT_LIMIT), truncated, contentType: response.contentType };
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@evandu/super-pi",
-  "version": "0.1.129",
+  "version": "0.1.131",
   "description": "Web control plane and companion for Pi",
   "license": "MIT",
   "type": "module",
@@ -16,12 +16,14 @@
   "files": [
     "dist",
     "agents",
+    "skills",
     "bin",
     "scripts/restart-server.mjs",
     "README.md",
     "assets/knowledge-model",
     "scripts/patch-brace-expansion.mjs",
-    "scripts/diagnose.mjs"
+    "scripts/diagnose.mjs",
+    "assets/fonts"
   ],
   "engines": {
     "node": ">=22.19.0"
@@ -42,7 +44,11 @@
   "check:logic": [
     "scripts/stream-checkpoint.test.mjs",
     "scripts/stream-transport.test.mjs",
+    "scripts/inline-thinking.test.mjs",
+    "scripts/inline-thinking-close-tag.test.mjs",
     "scripts/pi-session.test.mjs",
+    "scripts/pi-session-isolation.test.mjs",
+    "scripts/installed-layout.test.mjs",
     "scripts/pi-model-switch.test.mjs",
     "scripts/pi-thinking-levels.test.mjs",
     "scripts/diagnose-cli.test.mjs",
@@ -79,6 +85,10 @@
     "scripts/queue-store.test.mjs",
     "scripts/followup.test.mjs",
     "scripts/pi-followup-queue.test.mjs",
+    "scripts/background-result-delivery.test.mjs",
+    "scripts/question-stop.test.mjs",
+    "scripts/background-result-body.test.mjs",
+    "scripts/question-request-size.test.mjs",
     "scripts/md-render.test.mjs",
     "scripts/revert-session-format.test.mjs",
     "scripts/revert-session-file.test.mjs",
@@ -122,10 +132,17 @@
     "scripts/cli.test.mjs",
     "scripts/check-runner.test.mjs",
     "scripts/skills-discovery.test.mjs",
+    "scripts/built-in-skills.test.mjs",
+    "scripts/presentation-schema.test.mjs",
     "scripts/session-state-icon.test.mjs",
     "scripts/provider-fetch-models.test.mjs",
     "scripts/shared-chrome.test.mjs",
-    "scripts/prompt-templates.test.mjs"
+    "scripts/prompt-templates.test.mjs",
+    "scripts/documents.test.mjs",
+    "scripts/web-tools.test.mjs",
+    "scripts/document-service.test.mjs",
+    "scripts/document-block-parse.test.mjs",
+    "scripts/document-write-overwrite.test.mjs"
   ],
   "check:browser": [
     "scripts/interrupt-browser.test.mjs",
@@ -175,7 +192,8 @@
     "scripts/knowledge-base-browser.test.mjs",
     "scripts/terminal-browser.test.mjs",
     "scripts/ux-polish-browser.test.mjs",
-    "scripts/prompt-templates-browser.test.mjs"
+    "scripts/prompt-templates-browser.test.mjs",
+    "scripts/documents-browser.test.mjs"
   ],
   "dependencies": {
     "@codemirror/commands": "^6.11.1",
@@ -210,12 +228,14 @@
   },
   "devDependencies": {
     "@types/node": "latest",
+    "@types/pdfkit": "^0.17.7",
     "@types/react": "latest",
     "@types/react-dom": "latest",
     "@types/ws": "latest",
     "@vitejs/plugin-react": "latest",
     "concurrently": "latest",
     "cross-env": "latest",
+    "pdf-lib": "^1.17.1",
     "react": "latest",
     "react-dom": "latest",
     "tsx": "latest",
@@ -223,6 +243,14 @@
     "vite": "latest"
   },
   "optionalDependencies": {
-    "@huggingface/transformers": "^4.3.1"
+    "@huggingface/transformers": "^4.3.1",
+    "cfb": "^1.2.2",
+    "docx": "^9.14.0",
+    "exceljs": "^4.4.0",
+    "fflate": "^0.8.3",
+    "mammoth": "^1.13.0",
+    "pdfjs-dist": "^6.4.299",
+    "pdfkit": "^0.20.2",
+    "pptxgenjs": "^4.0.1"
   }
 }

package/skills/presentation/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: presentation
+description: Create, revise, or review PowerPoint presentations when the user needs a coherent story, deliberate visual design, charts or imagery, template fidelity, and a validated PPTX deliverable.
+---
+
+# Presentation production
+
+Treat a deck as a communication artifact, not a document split across slides. Preserve the user's audience, purpose, evidence, brand constraints, language, and requested file path.
+
+## Workflow
+
+1. Inspect supplied source material and any existing deck or template before proposing a structure.
+2. Establish the audience, decision or learning outcome, presentation setting, and approximate duration. Infer ordinary defaults when they do not materially change the result; ask only for consequential missing choices.
+3. Write a slide-level story before building. Each slide needs one job and a conclusion-oriented title.
+4. Choose a small visual system and a layout appropriate to each slide's job. Do not make every slide a title plus bullets.
+5. Build with the presentation tools available in the session. Never claim that an image, chart, template, or visual validation was applied if the available tools cannot perform it.
+6. Render or inspect the finished deck when the tools support it. Fix overflow, collisions, illegible text, weak hierarchy, misleading charts, and visual repetition before delivery.
+7. Report the output path, what was validated, and any limitation that remains observable to the user.
+
+## Progressive references
+
+- Read [references/story.md](references/story.md) when developing or restructuring the narrative.
+- Read [references/visual-system.md](references/visual-system.md) when choosing layouts, typography, colour, imagery, or information hierarchy.
+- Read [references/data.md](references/data.md) for tables, quantitative claims, and chart selection.
+- Read [references/templates-and-editing.md](references/templates-and-editing.md) when a template or existing deck must be preserved or edited.
+- Read [references/quality.md](references/quality.md) before final validation and delivery.
+
+## Current tool boundary
+
+The legacy `document_write` PPT path accepts Markdown and produces a clean text-first deck. It cannot faithfully implement positioned elements, images, native charts, templates, object-level edits, or visual rendering. When those capabilities are absent, produce the strongest honest text-first deck possible and state the limitation; do not simulate visual completion in prose.

package/skills/presentation/references/data.md

@@ -0,0 +1,10 @@
+# Data, tables, and charts
+
+Use quantitative visuals to answer a question, not to decorate a slide.
+
+- Bar: compare categories. Line: change over ordered time. Scatter: relationship or distribution. Waterfall: contributions to a change. Pie or donut: only a few parts of one whole when precise comparison is unimportant.
+- Start axes honestly, disclose truncation, preserve units, and name the time period and source.
+- Highlight the series or value that supports the slide's takeaway; mute supporting context.
+- Direct-label when practical. Remove chart furniture that does not help interpretation.
+- Use a table when exact lookup matters; use a chart when pattern or comparison matters.
+- Reconcile values against the source before building and again after rendering.

package/skills/presentation/references/quality.md

@@ -0,0 +1,12 @@
+# Presentation quality gate
+
+Validate the artifact, not just the source instructions.
+
+1. File integrity: opens without repair, has the requested aspect ratio and slide count, and contains no missing relationships.
+2. Content: claims match sources; titles communicate takeaways; spelling, units, dates, and names are correct.
+3. Geometry: no object is outside the canvas; no accidental overlap, clipping, or text overflow; margins and alignment are consistent.
+4. Readability: type remains legible at presentation scale, contrast is adequate, and charts have readable labels.
+5. Visual rhythm: layouts vary with the story while retaining one system; no page is needlessly dense or empty.
+6. Delivery: render every slide when possible, inspect a contact sheet and full-size pages, repair defects, then rerender the affected pages.
+
+Report exactly which checks ran. A PPTX that merely reopens and yields its text has passed structural round-trip testing, not visual QA.

package/skills/presentation/references/story.md

@@ -0,0 +1,12 @@
+# Story and slide architecture
+
+Start from the outcome: what should the audience understand, believe, decide, or do afterward? Arrange evidence so the answer becomes inevitable rather than merely chronological.
+
+- Give every slide one communicative job and a title that states its takeaway.
+- Prefer a visible arc: context or tension, evidence, implication, recommendation, next action.
+- Separate sections when the audience must reset its mental model.
+- Remove slides that neither change understanding nor support a decision.
+- Put detail needed only for questions in an appendix.
+- For a timed talk, budget roughly one substantive slide per one to two minutes, then adjust for demos and discussion.
+
+Before building, record for each slide: purpose, takeaway title, evidence, intended visual form, and source.

package/skills/presentation/references/templates-and-editing.md

@@ -0,0 +1,11 @@
+# Templates and existing decks
+
+Inspect before editing. Preserve the existing slide size, theme, masters, layouts, placeholders, brand assets, and object relationships unless the user asks for a redesign.
+
+- Prefer filling real placeholders over painting look-alike text boxes on top.
+- Duplicate an appropriate existing layout when adding a slide.
+- Make object-level changes for local requests; do not rebuild the whole deck and lose unsupported content.
+- Preserve charts, notes, links, media, accessibility metadata, and animations that are outside the requested change.
+- Require a fresh version token before overwriting an existing file.
+
+If the available tools expose only extracted text, state that template-faithful editing is unavailable instead of pretending the regenerated file preserves it.

package/skills/presentation/references/visual-system.md

@@ -0,0 +1,10 @@
+# Visual system and layout
+
+Choose a restrained system and apply it consistently: aspect ratio, typefaces, title/body scale, margins, grid, background, primary text, muted text, accent, and semantic status colours.
+
+- Use hierarchy, whitespace, alignment, and scale before decoration.
+- Select layouts by content relationship: comparison, sequence, hierarchy, spatial relationship, evidence plus interpretation, or a single focal statement.
+- Prefer diagrams, images, charts, and short labels over dense prose when they communicate the same idea more directly.
+- Avoid repeated card grids, decorative gradients, arbitrary icons, excessive rounded rectangles, and tiny captions that create an automatic “AI deck” look.
+- Keep body copy comfortably readable in the actual presentation setting. Split content instead of shrinking it to fit.
+- Treat accessibility as a design constraint: sufficient contrast, colour-independent meaning, readable labels, and sensible reading order.