@evandu/super-pi 0.1.130 → 0.1.132

package/dist/server/files.d.ts

@@ -97,9 +97,30 @@ export declare function looksBinary(sample: Uint8Array): boolean;
  * the extension path with a fixture whose CONTENT is text.
  */
 export declare function hasBinaryExtension(name: string): boolean;
+/**
+ * The extensions of the documents the parsing layer can read.
+ *
+ * WHY THE LIST LIVES HERE AND NOT IN `documents.ts`. This module has no relative imports, and that is
+ * load-bearing: `scripts/files-api.test.mjs` copies this file ALONE into a temp directory and
+ * compiles it there, to prove that a broken containment check really does leak. An import of a
+ * sibling module would not resolve in that scratch directory, so the mutation would fail to compile
+ * - which the test would read as "the guard still refuses the escape", the exact opposite of what it
+ * is checking.
+ *
+ * The parsing layer holds the same list, and the two are checked against each other by
+ * `scripts/documents.test.mjs`, so the tree cannot offer a file the parser cannot read.
+ */
+export declare const DOCUMENT_EXTENSIONS: Set<string>;
 /** Whether a file is worth putting in an editor tab at all, decided from its NAME alone, for the tree's
  *  own labelling. The authoritative answer comes from `readWorkspaceFile`, which reads bytes. */
 export declare function isTextName(name: string): boolean;
+/**
+ * Whether a file is a DOCUMENT the parsing layer can read, decided from its name.
+ *
+ * The same list the knowledge base and the document tools use, so a picker that offers a file and a
+ * server that accepts it cannot disagree about which files those are.
+ */
+export declare function isDocumentName(name: string): boolean;
 /** What a caller is told about one entry in a directory. */
 export type DirEntry = {
     /** The path RELATIVE to the workspace root, always `/`-separated, never with a leading slash. This is
@@ -110,6 +131,17 @@ export type DirEntry = {
     kind: "directory" | "file" | "symlink";
     /** Whether a file is worth opening, decided from its name. `null` for a directory. */
     text: boolean | null;
+    /**
+     * Whether this file is a DOCUMENT the parsing layer can read - a PDF, a Word document, a
+     * spreadsheet. `null` for a directory.
+     *
+     * WHY IT IS A SEPARATE FLAG AND NOT PART OF `text`. A document is not text - it cannot be opened in
+     * the editor, and opening it as text would show a zip file's bytes - but it IS worth offering to
+     * the person, because the knowledge base can import it and the agent can read it. One flag for
+     * "worth showing" would force the two cases into one, and a picker that offers a file the server
+     * then refuses is worse than one that offers nothing.
+     */
+    document?: boolean;
     /** Set when this entry is a link, and `kind` becomes `symlink` when it points OUT of the workspace. The
      *  tree can then say "cannot be opened" before the request comes back 403 rather than after. */
     symlink?: boolean;

package/dist/server/files.js

@@ -150,17 +150,17 @@ function rejectUnsafeShape(requested) {
     // UNC: `\\server\share\...` and its POSIX-spelled twin `//server/share`. Named explicitly because
     // `isAbsolute` is true for the first on Windows and false for the second on Linux.
     if (/^[\\/]{2}/.test(requested))
-        throw new FilesError(403, "拒绝 UNC 路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝 UNC 路径：请给出相对于工作区根目录的路径", "outside_workspace");
     // A drive letter in EITHER position: `C:\x` is absolute, `C:x` is drive-relative and resolves against
     // that drive's current directory, which is not a location the caller gets to choose. The colon is also
     // how NTFS alternate data streams are addressed (`notes.md:hidden`), which is a second file hiding
     // behind one path - handled by the segment check below.
     if (/^[A-Za-z]:/.test(requested))
-        throw new FilesError(403, "拒绝 Windows 盘符路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝 Windows 盘符路径：请给出相对于工作区根目录的路径", "outside_workspace");
     // Rooted, POSIX or Windows: `/etc/passwd` and `\Windows`. Both are absolute, and the leading-slash
     // forms are spelled out so the refusal does not depend on the host's own path parser agreeing.
     if (requested.startsWith("/") || requested.startsWith("\\"))
-        throw new FilesError(403, "拒绝绝对路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝绝对路径：请给出相对于工作区根目录的路径", "outside_workspace");
     return requested.replace(/\\/g, "/");
 }
 /**
@@ -352,6 +352,20 @@ export function hasBinaryExtension(name) {
     }
     return false;
 }
+/**
+ * The extensions of the documents the parsing layer can read.
+ *
+ * WHY THE LIST LIVES HERE AND NOT IN `documents.ts`. This module has no relative imports, and that is
+ * load-bearing: `scripts/files-api.test.mjs` copies this file ALONE into a temp directory and
+ * compiles it there, to prove that a broken containment check really does leak. An import of a
+ * sibling module would not resolve in that scratch directory, so the mutation would fail to compile
+ * - which the test would read as "the guard still refuses the escape", the exact opposite of what it
+ * is checking.
+ *
+ * The parsing layer holds the same list, and the two are checked against each other by
+ * `scripts/documents.test.mjs`, so the tree cannot offer a file the parser cannot read.
+ */
+export const DOCUMENT_EXTENSIONS = new Set([".pdf", ".docx", ".xlsx", ".pptx", ".ppt"]);
 /** Whether a file is worth putting in an editor tab at all, decided from its NAME alone, for the tree's
  *  own labelling. The authoritative answer comes from `readWorkspaceFile`, which reads bytes. */
 export function isTextName(name) {
@@ -365,6 +379,19 @@ export function isTextName(name) {
         return true; // extensionless files are usually source or config; the sniff decides
     return TEXT_EXTENSIONS.has(lower.slice(dot));
 }
+/**
+ * Whether a file is a DOCUMENT the parsing layer can read, decided from its name.
+ *
+ * The same list the knowledge base and the document tools use, so a picker that offers a file and a
+ * server that accepts it cannot disagree about which files those are.
+ */
+export function isDocumentName(name) {
+    const lower = basename(name).toLowerCase();
+    const dot = lower.lastIndexOf(".");
+    if (dot <= 0)
+        return false;
+    return DOCUMENT_EXTENSIONS.has(lower.slice(dot));
+}
 /** The `/`-separated relative form used on the wire and in every comparison. */
 export function toRelative(root, absolute) {
     return relative(root, absolute).split(sep).join("/");
@@ -409,6 +436,7 @@ export async function listDirectory(root, requested) {
             name: dirent.name,
             kind: outside ? "symlink" : isDir ? "directory" : "file",
             text: isDir ? null : !outside && isTextName(dirent.name),
+            ...(isDir ? {} : { document: !outside && isDocumentName(dirent.name) }),
             ...(isLink ? { symlink: true } : {}),
             ...(outside ? { outside: true } : {}),
         });

package/dist/server/http-server.js

@@ -9,7 +9,13 @@ import { findUploadFile, MAX_UPLOAD_BODY_BYTES, saveUpload } from "./upload.js";
 import { checkDiskVersion } from "./version.js";
 import { gitBlame, gitDiff, gitLog, gitMutate, gitStatus } from "./git.js";
 import { computeFileDiff } from "./file-diff.js";
+import { verifyCapability } from "./capability.js";
+import { conversationWorkspace } from "./model-filter.js";
+import { describeSchedule } from "./scheduled-tasks.js";
 import { MAX_KNOWLEDGE_REQUEST_BYTES } from "./knowledge.js";
+import { MAX_DOCUMENT_REQUEST_BYTES } from "./application/document-service.js";
+import { MAX_FEISHU_REQUEST_BYTES } from "./application/feishu-service.js";
+import { MAX_WEB_REQUEST_BYTES } from "./web.js";
 import { MAX_TOOL_BODY_BYTES } from "./tool-registry.js";
 import { packageUpdateArgs } from "./update.js";
 import { FileIndex } from "./file-index.js";
@@ -240,7 +246,18 @@ export function createHttpServer(options) {
         // the same reason: it is reached only by the Pi process of one turn, carrying that turn's
         // capability in a header. The MANAGEMENT half (`/api/knowledge`) is deliberately NOT exempted - it
         // imports and deletes documents, so it stays behind the ordinary token.
-        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/todos" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
+        //
+        // `/api/documents/tool` is the same shape again, and the exemption is safe for the same reason:
+        // the endpoint verifies the SESSION's capability on its own, and refuses a request whose turn is
+        // not running. The global token is a server-wide secret; the capability is a per-conversation
+        // one that only the Pi process of that conversation holds, so the exemption does not widen who
+        // can reach the server - it only spares the one caller that already proves who it is.
+        //
+        // `/api/feishu/tool` is that shape once more. The Feishu credential is a company secret, so
+        // the endpoint that can spend it is exactly the one an agent's own turn can reach, and the
+        // management half (`/api/feishu/config`) stays behind the ordinary token AND the local-address
+        // predicate.
+        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/documents/tool" && requestPath !== "/api/web/tool" && requestPath !== "/api/feishu/tool" && requestPath !== "/api/todos" && requestPath !== "/api/scheduled-tasks" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
             response.writeHead(401, { "www-authenticate": "Bearer" }).end("Authentication required");
             return;
         }
@@ -705,6 +722,197 @@ export function createHttpServer(options) {
             }
             return;
         }
+        if (url.pathname === "/api/documents/tool") {
+            if (!context.documentService) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "";
+                let totalBytes = 0;
+                // A DOCUMENT'S TEXT RIDES IN THE REQUEST BODY, so the cap is the document cap: a request
+                // past it is refused outright rather than truncated into a document that silently lost its
+                // tail.
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_DOCUMENT_REQUEST_BYTES) {
+                        response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "文档请求过大" }));
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                // The capability says WHICH CONVERSATION is asking, and the workspace is derived from it
+                // rather than taken from the request: a request that named its own workspace would be a
+                // request that could read another workspace.
+                const conversationId = String(request.headers["x-documents-conversation"] ?? "");
+                const verdict = verifyCapability(conversationId, request.headers["x-documents-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const result = body.action === "write"
+                    ? await context.documentService.write(conversationId, String(body.path ?? ""), String(body.content ?? ""), typeof body.title === "string" ? body.title : undefined, typeof body.baseEtag === "string" ? body.baseEtag : undefined)
+                    : await context.documentService.read(conversationId, String(body.path ?? ""));
+                response.writeHead(200, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(result));
+            }
+            catch (error) {
+                response.writeHead(400, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+            }
+            return;
+        }
+        if (url.pathname === "/api/web/tool") {
+            if (!context.web) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "", totalBytes = 0;
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_WEB_REQUEST_BYTES) {
+                        response.writeHead(413).end();
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const conversationId = String(request.headers["x-web-conversation"] ?? "");
+                const verdict = verifyCapability(conversationId, request.headers["x-web-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                const result = body.action === "search"
+                    ? await context.web.search(String(body.query ?? ""), Number(body.limit ?? 5), abortedAs(request))
+                    : body.action === "fetch"
+                        ? await context.web.fetch(String(body.url ?? ""), abortedAs(request))
+                        : await Promise.reject(new Error("未知网页工具操作"));
+                json(200, result);
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        if (url.pathname === "/api/feishu/tool") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "", totalBytes = 0;
+                // The Markdown of a document rides in the request body, so the cap is the document cap.
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_FEISHU_REQUEST_BYTES) {
+                        response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "飞书请求过大" }));
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const conversationId = String(request.headers["x-feishu-conversation"] ?? "");
+                // THE SAME PROOF THE DOCUMENT TOOLS USE: the request must carry the session's own
+                // capability, and the session must actually be running a turn. The Feishu credential is a
+                // company secret, so this endpoint is the only way to spend it.
+                const verdict = verifyCapability(conversationId, request.headers["x-feishu-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                json(200, await context.feishu.tool(body));
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        /**
+         * THE FEISHU CONNECTION, as the settings panel sees it.
+         *
+         * A GET answers with what the official CLI can do right now: whether it is installed, whether
+         * it has an application, and whether a person has authorized it. It never answers with a
+         * credential - the CLI keeps those in the OS keychain, and this server never sees them.
+         *
+         * The address predicate is on the POSTs and not on the GET: connecting is a change to the
+         * machine, and the project's rule is that changes like this come from the local network.
+         * Reading whether the CLI is connected leaks nothing beyond what the panel already shows.
+         */
+        if (url.pathname === "/api/feishu/status") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "GET") {
+                json(405, { error: "这个接口只接受 GET 请求。" });
+                return;
+            }
+            json(200, await context.feishu.status());
+            return;
+        }
+        /**
+         * STARTS THE CONNECT FLOW, and finishes it.
+         *
+         * The first POST asks the CLI for a device code (or for it to register an application), and
+         * answers with the URL the person has to open. The second one hands the device code back to
+         * the CLI once they have authorized it, which is where the token is written - into the keychain,
+         * not into this server.
+         *
+         * The CLI's own documentation describes exactly this two-step shape for agents, and the two
+         * calls are separate endpoints because the person has to go and do something in between.
+         */
+        if (url.pathname === "/api/feishu/connect" || url.pathname === "/api/feishu/connect/complete") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                json(405, { error: "这个接口只接受 POST 请求。" });
+                return;
+            }
+            if (!isLocalOrPrivateAddress(remote)) {
+                json(403, { error: "连接飞书账号只允许来自本机或局域网的请求。" });
+                return;
+            }
+            try {
+                const result = url.pathname.endsWith("/complete")
+                    ? await context.feishu.completeConnect()
+                    : await context.feishu.connect();
+                json(result.ok ? 200 : 400, result);
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
         if (url.pathname === "/api/shutdown") {
             if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
                 response.writeHead(403, { "content-type": "text/plain; charset=utf-8" }).end("Shutdown requires a loopback or private network POST");
@@ -1054,14 +1262,128 @@ export function createHttpServer(options) {
             }
             return;
         }
+        if (url.pathname === "/api/scheduled-tasks") {
+            // THE AGENT'S DOOR TO THE SCHEDULED TASKS, and the same shape as `/api/todos`: exempt from the
+            // global token because the caller proves itself with a per-conversation capability instead, and
+            // restricted to loopback or a private network for the same reason `/api/todos` is.
+            if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
+                response.writeHead(403, { "content-type": "text/plain; charset=utf-8" }).end("Scheduled task writes require a loopback or private network POST");
+                return;
+            }
+            let raw = "";
+            let totalBytes = 0;
+            for await (const chunk of request) {
+                totalBytes += chunk.length;
+                if (totalBytes > MAX_FILE_BYTES * 2) {
+                    response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "请求体过大", code: "too_large" }));
+                    request.destroy();
+                    return;
+                }
+                raw += chunk;
+            }
+            const json = (status, body) => {
+                response.writeHead(status, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(body));
+            };
+            try {
+                const body = JSON.parse(raw);
+                const conversationId = body.conversationId?.trim();
+                if (!conversationId)
+                    throw new Error("scheduled_task requires conversationId");
+                const verdict = runService.verifyPrimaryCapability(conversationId, body.capability);
+                if (!verdict.ok) {
+                    json(403, { error: verdict.message });
+                    return;
+                }
+                const service = context.scheduledTaskService;
+                if (!service) {
+                    json(503, { error: "定时任务功能在这个实例上没有启用。" });
+                    return;
+                }
+                // THE WORKSPACE IS THE CALLER'S, not the agent's choice. The conversation the turn belongs to
+                // decides where the task runs and what its defaults are; a task could otherwise be filed under
+                // a workspace its own author cannot see.
+                const workspaceId = conversationWorkspace(store.snapshot(), conversationId).id;
+                const action = (body.action ?? "create").trim();
+                if (action === "list") {
+                    json(200, { tasks: service.listForWorkspace(workspaceId) });
+                    return;
+                }
+                if (action === "create") {
+                    const task = await service.create({
+                        name: body.name,
+                        prompt: body.prompt,
+                        schedule: body.schedule,
+                        workspaceId,
+                        model: body.model ? { provider: body.model.provider, modelId: body.model.modelId, label: body.model.label ?? body.model.modelId } : null,
+                        agentId: body.agentId,
+                    }, "agent");
+                    json(200, { task, describe: describeSchedule(task.schedule) });
+                    return;
+                }
+                if (action === "update") {
+                    const id = body.id?.trim();
+                    if (!id)
+                        throw new Error("scheduled_task update requires an id");
+                    // THE TASK MUST BE THE CALLER'S TO CHANGE. A task runs in a workspace: it opens its
+                    // conversation there, uses that workspace's defaults and its tools. The caller cannot even
+                    // LIST another workspace's tasks (`list` is scoped), so it must not be able to change or
+                    // delete them either - and the refusal must not say "it exists, over there".
+                    service.requireForWorkspace(id, workspaceId);
+                    const task = await service.update(id, {
+                        name: body.name,
+                        prompt: body.prompt,
+                        schedule: body.schedule,
+                        // "NOT MENTIONED" AND "CLEARED" ARE DIFFERENT REQUESTS. The extension only sends the
+                        // fields the model actually wrote, so a model that changes the prompt and says nothing
+                        // about the model leaves the key ABSENT - and the service reads an absent model as
+                        // "keep what is there". Mapping absence to null made "not mentioned" mean "delete", so a
+                        // model the user had picked for this task was silently dropped and the task fell back to
+                        // the default model (measured by scripts/scheduled-task-scope.test.mjs, ledger
+                        // TEST-025). Every other field here already has this asymmetry right: name, prompt,
+                        // schedule and agentId are all "absent means unchanged".
+                        model: body.model === undefined
+                            ? undefined
+                            : (body.model ? { provider: body.model.provider, modelId: body.model.modelId, label: body.model.label ?? body.model.modelId } : null),
+                        agentId: body.agentId,
+                    });
+                    json(200, { task, describe: describeSchedule(task.schedule) });
+                    return;
+                }
+                if (action === "delete") {
+                    const id = body.id?.trim();
+                    if (!id)
+                        throw new Error("scheduled_task delete requires an id");
+                    service.requireForWorkspace(id, workspaceId);
+                    await service.remove(id);
+                    json(200, { deleted: id });
+                    return;
+                }
+                json(400, { error: "action 只能是 create、list、update 或 delete。" });
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : "scheduled task request failed" });
+            }
+            return;
+        }
         if (url.pathname === "/api/question") {
             if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
                 response.writeHead(403).end();
                 return;
             }
+            // READ WITH A CEILING. This endpoint is exempt from the global token (the caller proves itself
+            // with a per-conversation capability instead), which means anyone on the LAN can REACH it - and
+            // this loop used to read the whole body into one string before checking anything, so an oversized
+            // body cost its full size in memory before the 403 said no. A question is a few hundred bytes;
+            // 64KB is orders of magnitude above any honest one and far below what a hostile body could use,
+            // and the shape is the same ceiling the `/api/tools` endpoints already enforce.
             let raw = "";
-            for await (const chunk of request)
+            for await (const chunk of request) {
                 raw += chunk;
+                if (raw.length > 64_000) {
+                    response.writeHead(413, { "content-type": "application/json" }).end(JSON.stringify({ error: "question request too large" }));
+                    return;
+                }
+            }
             try {
                 const body = JSON.parse(raw);
                 if (!body.conversationId || !body.question || !Array.isArray(body.options))

package/dist/server/index.js

@@ -15,12 +15,15 @@ import { SubagentSupervisor } from "./subagents.js";
 import { SubagentRunRecorder } from "./subagent-runs.js";
 import { WorkflowEngine } from "./workflow-engine.js";
 import { ExtensionUiService } from "./application/extension-ui-service.js";
+import { DocumentService } from "./application/document-service.js";
+import { FeishuService } from "./application/feishu-service.js";
 import { CatalogService } from "./application/catalog-service.js";
 import { ProviderService } from "./application/provider-service.js";
 import { ProviderRegistry } from "./providers.js";
 import { RunService } from "./application/run-service.js";
 import { FileChangeTracker } from "./file-changes.js";
 import { ConversationService } from "./application/conversation-service.js";
+import { ScheduledTaskService } from "./application/scheduled-task-service.js";
 import { WorkspaceService } from "./application/workspace-service.js";
 import { CommandHandler } from "./command-handler.js";
 import { TerminalService, terminalDisabledReason } from "./terminal.js";
@@ -32,6 +35,7 @@ import { installServerLogging } from "./logging.js";
 import { ToolRegistry } from "./tool-registry.js";
 import { ToolRunner } from "./tool-runner.js";
 import { ToolLlmService } from "./tool-llm.js";
+import { WebService } from "./web.js";
 // ------------------------------------------------------------- Environment & paths
 const rootDir = resolve(import.meta.dirname, "../..");
 initRunningVersion(rootDir);
@@ -105,9 +109,11 @@ await mkdir(uploadsDir, { recursive: true }).catch(() => { });
 const taskEndpoint = `http://${internalHost}:${port}/api/subagent/dispatch`;
 const execEndpoint = `http://${internalHost}:${port}/api/exec`;
 const todoEndpoint = `http://${internalHost}:${port}/api/todos`;
+const scheduledTaskEndpoint = `http://${internalHost}:${port}/api/scheduled-tasks`;
 const workflowEndpoint = `http://${internalHost}:${port}/api/workflow/run`;
 const questionEndpoint = `http://${internalHost}:${port}/api/question`;
 const toolsEndpoint = `http://${internalHost}:${port}/api/tools`;
+const documentsEndpoint = `http://${internalHost}:${port}/api/documents/tool`;
 // ------------------------------------------------------------- Core singletons
 const store = await openStateStore(dataDir, process.env.SUPER_PI_PERSISTENCE ?? "sqlite");
 const toolRegistry = new ToolRegistry(dataDir);
@@ -130,7 +136,7 @@ const paths = {
 };
 const runtime = process.env.SUPER_PI_RUNTIME === "welcome"
     ? new WelcomeRuntime()
-    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, uploadsDir });
+    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, scheduledTaskEndpoint, uploadsDir });
 const broadcaster = new WsBroadcaster(() => store.snapshot());
 const memory = new ActiveMemory(join(dataDir, "memories"), store, runtime);
 process.env.SUPER_PI_MEMORY_ENDPOINT = `http://${internalHost}:${port}/api/memory/tool`;
@@ -143,6 +149,19 @@ const knowledge = new KnowledgeBase(join(dataDir, "knowledge"), store, runtime,
 process.env.SUPER_PI_KNOWLEDGE_ENDPOINT = `http://${internalHost}:${port}/api/knowledge/tool`;
 if (runtime instanceof PiRpcRuntime)
     runtime.setKnowledge(knowledge);
+// The document tools. The endpoint is published here, the same way the knowledge one is: the Pi
+// process of a turn reads it out of its environment, and the endpoint verifies the session's
+// capability on its own.
+const documentService = new DocumentService(store);
+process.env.SUPER_PI_DOCUMENTS_ENDPOINT = documentsEndpoint;
+// The Feishu tools. The credential belongs to the OFFICIAL CLI, which keeps it in the OS keychain,
+// so this service holds nothing but the CLI's address. The endpoint is published here the same way
+// the document one is: the Pi process of a turn reads it out of its environment, and the endpoint
+// verifies the session's capability on its own.
+const feishu = new FeishuService();
+process.env.SUPER_PI_FEISHU_ENDPOINT = `http://${internalHost}:${port}/api/feishu/tool`;
+const web = new WebService();
+process.env.SUPER_PI_WEB_ENDPOINT = `http://${internalHost}:${port}/api/web/tool`;
 const extensionUiService = new ExtensionUiService(broadcaster);
 const supervisor = new SubagentSupervisor(join(dataDir, "pi-sessions"), undefined, {
     dir: initialAgentDirs,
@@ -246,9 +265,20 @@ const terminalService = new TerminalService({
  */
 const execService = new ExecService((event) => broadcaster.broadcast(event), (sessionId, exitCode, stdout, stderr) => runService.enqueueExecResult(sessionId, exitCode, stdout, stderr));
 runService.setExecService(execService);
+/**
+ * THE SCHEDULED TASKS, and the clock that fires them.
+ *
+ * Constructed after the run service and the conversation service, because it drives both: a task that
+ * fires opens a conversation and sends a message into it, through exactly the path a person's own
+ * message takes.
+ */
+const scheduledTaskService = new ScheduledTaskService(store, runService, conversationService, broadcaster);
 const serverContext = {
     memory,
     knowledge,
+    web,
+    documentService,
+    feishu,
     paths,
     store,
     runtime,
@@ -261,6 +291,7 @@ const serverContext = {
     extensionUiService,
     catalogService,
     providerService,
+    scheduledTaskService,
     execService,
     toolRegistry,
     toolRunner,
@@ -271,7 +302,7 @@ const serverContext = {
     terminalEnabled: () => terminalService.enabled,
     terminalDisabledReason: () => terminalDisabledReason(),
 };
-const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir, providerService);
+const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir, providerService, scheduledTaskService);
 // ------------------------------------------------------------- Lifecycle & shutdown
 let shutdownPromise;
 async function closeHttpServer() {
@@ -290,6 +321,10 @@ async function shutdown(reason) {
         execService.closeAll();
         runService.abortAll();
         workflows.abortAll();
+        // The scheduler stops BEFORE the runs are waited for, so no new task starts while the server is
+        // closing. The runs already in flight are not aborted: a half-answered scheduled task is a real
+        // answer in a real conversation, and throwing it away to shut down faster would be the wrong trade.
+        await scheduledTaskService.stop();
         for (const c of store.snapshot().conversations) {
             extensionUiService.cancelPendingUi(c.id, "aborted");
         }
@@ -338,6 +373,10 @@ httpServer.listen(port, host, () => {
     const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
     console.log(`Super Pi is running at http://${displayHost}:${port}`);
     logging.write("info", `listening on ${host}:${port} (pid ${process.pid})`);
+    // THE CLOCK STARTS WITH THE SERVER. A task whose moment passed while the server was down is fired
+    // once by the first sweep - the daily report the user asked for is still wanted when they come back,
+    // but seven of them are not.
+    scheduledTaskService.start();
     if (host === "0.0.0.0" || host === "::") {
         const lanIps = getLanIps();
         for (const ip of lanIps) {