@evandu/super-pi 0.1.131 → 0.1.133

package/dist/server/files.js

@@ -150,17 +150,17 @@ function rejectUnsafeShape(requested) {
     // UNC: `\\server\share\...` and its POSIX-spelled twin `//server/share`. Named explicitly because
     // `isAbsolute` is true for the first on Windows and false for the second on Linux.
     if (/^[\\/]{2}/.test(requested))
-        throw new FilesError(403, "拒绝 UNC 路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝 UNC 路径：请给出相对于工作区根目录的路径", "outside_workspace");
     // A drive letter in EITHER position: `C:\x` is absolute, `C:x` is drive-relative and resolves against
     // that drive's current directory, which is not a location the caller gets to choose. The colon is also
     // how NTFS alternate data streams are addressed (`notes.md:hidden`), which is a second file hiding
     // behind one path - handled by the segment check below.
     if (/^[A-Za-z]:/.test(requested))
-        throw new FilesError(403, "拒绝 Windows 盘符路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝 Windows 盘符路径：请给出相对于工作区根目录的路径", "outside_workspace");
     // Rooted, POSIX or Windows: `/etc/passwd` and `\Windows`. Both are absolute, and the leading-slash
     // forms are spelled out so the refusal does not depend on the host's own path parser agreeing.
     if (requested.startsWith("/") || requested.startsWith("\\"))
-        throw new FilesError(403, "拒绝绝对路径：路径必须在 workspace 内", "outside_workspace");
+        throw new FilesError(403, "拒绝绝对路径：请给出相对于工作区根目录的路径", "outside_workspace");
     return requested.replace(/\\/g, "/");
 }
 /**

package/dist/server/http-server.js

@@ -10,8 +10,11 @@ import { checkDiskVersion } from "./version.js";
 import { gitBlame, gitDiff, gitLog, gitMutate, gitStatus } from "./git.js";
 import { computeFileDiff } from "./file-diff.js";
 import { verifyCapability } from "./capability.js";
+import { conversationWorkspace } from "./model-filter.js";
+import { describeSchedule } from "./scheduled-tasks.js";
 import { MAX_KNOWLEDGE_REQUEST_BYTES } from "./knowledge.js";
 import { MAX_DOCUMENT_REQUEST_BYTES } from "./application/document-service.js";
+import { MAX_FEISHU_REQUEST_BYTES } from "./application/feishu-service.js";
 import { MAX_WEB_REQUEST_BYTES } from "./web.js";
 import { MAX_TOOL_BODY_BYTES } from "./tool-registry.js";
 import { packageUpdateArgs } from "./update.js";
@@ -249,7 +252,12 @@ export function createHttpServer(options) {
         // not running. The global token is a server-wide secret; the capability is a per-conversation
         // one that only the Pi process of that conversation holds, so the exemption does not widen who
         // can reach the server - it only spares the one caller that already proves who it is.
-        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/documents/tool" && requestPath !== "/api/web/tool" && requestPath !== "/api/todos" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
+        //
+        // `/api/feishu/tool` is that shape once more. The Feishu credential is a company secret, so
+        // the endpoint that can spend it is exactly the one an agent's own turn can reach, and the
+        // management half (`/api/feishu/config`) stays behind the ordinary token AND the local-address
+        // predicate.
+        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/knowledge/tool" && requestPath !== "/api/documents/tool" && requestPath !== "/api/web/tool" && requestPath !== "/api/feishu/tool" && requestPath !== "/api/todos" && requestPath !== "/api/scheduled-tasks" && requestPath !== "/api/question" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
             response.writeHead(401, { "www-authenticate": "Bearer" }).end("Authentication required");
             return;
         }
@@ -805,6 +813,126 @@ export function createHttpServer(options) {
             }
             return;
         }
+        if (url.pathname === "/api/feishu/tool") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                response.writeHead(405).end();
+                return;
+            }
+            const origin = request.headers.origin;
+            if (origin && origin !== url.origin) {
+                response.writeHead(403).end("Origin not allowed");
+                return;
+            }
+            try {
+                let raw = "", totalBytes = 0;
+                // The Markdown of a document rides in the request body, so the cap is the document cap.
+                for await (const chunk of request) {
+                    totalBytes += chunk.length;
+                    if (totalBytes > MAX_FEISHU_REQUEST_BYTES) {
+                        response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "飞书请求过大" }));
+                        return;
+                    }
+                    raw += chunk;
+                }
+                const conversationId = String(request.headers["x-feishu-conversation"] ?? "");
+                // THE SAME PROOF THE DOCUMENT TOOLS USE: the request must carry the session's own
+                // capability, and the session must actually be running a turn. The Feishu credential is a
+                // company secret, so this endpoint is the only way to spend it.
+                const verdict = verifyCapability(conversationId, request.headers["x-feishu-capability"], { running: context.runService.isRunning(conversationId) });
+                if (!verdict.ok) {
+                    response.writeHead(403, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: verdict.message }));
+                    return;
+                }
+                const body = raw ? JSON.parse(raw) : {};
+                json(200, await context.feishu.tool(body));
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        /**
+         * THE FEISHU CONNECTION, as the settings panel sees it.
+         *
+         * A GET answers with what the official CLI can do right now: whether it is installed, whether
+         * it has an application, and whether a person has authorized it. It never answers with a
+         * credential - the CLI keeps those in the OS keychain, and this server never sees them.
+         *
+         * The address predicate is on the POSTs and not on the GET: connecting is a change to the
+         * machine, and the project's rule is that changes like this come from the local network.
+         * Reading whether the CLI is connected leaks nothing beyond what the panel already shows.
+         */
+        if (url.pathname === "/api/feishu/status") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "GET") {
+                json(405, { error: "这个接口只接受 GET 请求。" });
+                return;
+            }
+            json(200, await context.feishu.status());
+            return;
+        }
+        /**
+         * STARTS THE CONNECT FLOW, and finishes it.
+         *
+         * The first POST asks the CLI for a device code (or for it to register an application), and
+         * answers with the URL the person has to open. The second one hands the device code back to
+         * the CLI once they have authorized it, which is where the token is written - into the keychain,
+         * not into this server.
+         *
+         * The CLI's own documentation describes exactly this two-step shape for agents, and the two
+         * calls are separate endpoints because the person has to go and do something in between.
+         */
+        if (url.pathname === "/api/feishu/connect" || url.pathname === "/api/feishu/connect/complete") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (request.method !== "POST") {
+                json(405, { error: "这个接口只接受 POST 请求。" });
+                return;
+            }
+            if (!isLocalOrPrivateAddress(remote)) {
+                json(403, { error: "连接飞书账号只允许来自本机或局域网的请求。" });
+                return;
+            }
+            try {
+                const result = url.pathname.endsWith("/complete")
+                    ? await context.feishu.completeConnect()
+                    : await context.feishu.connect();
+                json(result.ok ? 200 : 400, result);
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : String(error) });
+            }
+            return;
+        }
+        /**
+         * CHECKS THE CONNECTION, and says why it does not work when it does not.
+         *
+         * The status already verifies the credential against Feishu, so this is the same answer shaped
+         * for a button - the difference is that a failure comes back as a MESSAGE AND A HINT rather
+         * than as a state the panel has to interpret.
+         */
+        if (url.pathname === "/api/feishu/verify" && request.method === "POST") {
+            if (!context.feishu) {
+                response.writeHead(503).end();
+                return;
+            }
+            if (!isLocalOrPrivateAddress(remote)) {
+                json(403, { error: "测试飞书连接只允许来自本机或局域网的请求。" });
+                return;
+            }
+            const result = await context.feishu.verify();
+            json(result.ok ? 200 : 400, result);
+            return;
+        }
         if (url.pathname === "/api/shutdown") {
             if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
                 response.writeHead(403, { "content-type": "text/plain; charset=utf-8" }).end("Shutdown requires a loopback or private network POST");
@@ -1154,6 +1282,109 @@ export function createHttpServer(options) {
             }
             return;
         }
+        if (url.pathname === "/api/scheduled-tasks") {
+            // THE AGENT'S DOOR TO THE SCHEDULED TASKS, and the same shape as `/api/todos`: exempt from the
+            // global token because the caller proves itself with a per-conversation capability instead, and
+            // restricted to loopback or a private network for the same reason `/api/todos` is.
+            if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
+                response.writeHead(403, { "content-type": "text/plain; charset=utf-8" }).end("Scheduled task writes require a loopback or private network POST");
+                return;
+            }
+            let raw = "";
+            let totalBytes = 0;
+            for await (const chunk of request) {
+                totalBytes += chunk.length;
+                if (totalBytes > MAX_FILE_BYTES * 2) {
+                    response.writeHead(413, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify({ error: "请求体过大", code: "too_large" }));
+                    request.destroy();
+                    return;
+                }
+                raw += chunk;
+            }
+            const json = (status, body) => {
+                response.writeHead(status, { "content-type": "application/json; charset=utf-8" }).end(JSON.stringify(body));
+            };
+            try {
+                const body = JSON.parse(raw);
+                const conversationId = body.conversationId?.trim();
+                if (!conversationId)
+                    throw new Error("scheduled_task requires conversationId");
+                const verdict = runService.verifyPrimaryCapability(conversationId, body.capability);
+                if (!verdict.ok) {
+                    json(403, { error: verdict.message });
+                    return;
+                }
+                const service = context.scheduledTaskService;
+                if (!service) {
+                    json(503, { error: "定时任务功能在这个实例上没有启用。" });
+                    return;
+                }
+                // THE WORKSPACE IS THE CALLER'S, not the agent's choice. The conversation the turn belongs to
+                // decides where the task runs and what its defaults are; a task could otherwise be filed under
+                // a workspace its own author cannot see.
+                const workspaceId = conversationWorkspace(store.snapshot(), conversationId).id;
+                const action = (body.action ?? "create").trim();
+                if (action === "list") {
+                    json(200, { tasks: service.listForWorkspace(workspaceId) });
+                    return;
+                }
+                if (action === "create") {
+                    const task = await service.create({
+                        name: body.name,
+                        prompt: body.prompt,
+                        schedule: body.schedule,
+                        workspaceId,
+                        model: body.model ? { provider: body.model.provider, modelId: body.model.modelId, label: body.model.label ?? body.model.modelId } : null,
+                        agentId: body.agentId,
+                    }, "agent");
+                    json(200, { task, describe: describeSchedule(task.schedule) });
+                    return;
+                }
+                if (action === "update") {
+                    const id = body.id?.trim();
+                    if (!id)
+                        throw new Error("scheduled_task update requires an id");
+                    // THE TASK MUST BE THE CALLER'S TO CHANGE. A task runs in a workspace: it opens its
+                    // conversation there, uses that workspace's defaults and its tools. The caller cannot even
+                    // LIST another workspace's tasks (`list` is scoped), so it must not be able to change or
+                    // delete them either - and the refusal must not say "it exists, over there".
+                    service.requireForWorkspace(id, workspaceId);
+                    const task = await service.update(id, {
+                        name: body.name,
+                        prompt: body.prompt,
+                        schedule: body.schedule,
+                        // "NOT MENTIONED" AND "CLEARED" ARE DIFFERENT REQUESTS. The extension only sends the
+                        // fields the model actually wrote, so a model that changes the prompt and says nothing
+                        // about the model leaves the key ABSENT - and the service reads an absent model as
+                        // "keep what is there". Mapping absence to null made "not mentioned" mean "delete", so a
+                        // model the user had picked for this task was silently dropped and the task fell back to
+                        // the default model (measured by scripts/scheduled-task-scope.test.mjs, ledger
+                        // TEST-025). Every other field here already has this asymmetry right: name, prompt,
+                        // schedule and agentId are all "absent means unchanged".
+                        model: body.model === undefined
+                            ? undefined
+                            : (body.model ? { provider: body.model.provider, modelId: body.model.modelId, label: body.model.label ?? body.model.modelId } : null),
+                        agentId: body.agentId,
+                    });
+                    json(200, { task, describe: describeSchedule(task.schedule) });
+                    return;
+                }
+                if (action === "delete") {
+                    const id = body.id?.trim();
+                    if (!id)
+                        throw new Error("scheduled_task delete requires an id");
+                    service.requireForWorkspace(id, workspaceId);
+                    await service.remove(id);
+                    json(200, { deleted: id });
+                    return;
+                }
+                json(400, { error: "action 只能是 create、list、update 或 delete。" });
+            }
+            catch (error) {
+                json(400, { error: error instanceof Error ? error.message : "scheduled task request failed" });
+            }
+            return;
+        }
         if (url.pathname === "/api/question") {
             if (request.method !== "POST" || !isLocalOrPrivateAddress(remote)) {
                 response.writeHead(403).end();

package/dist/server/index.js

@@ -16,12 +16,14 @@ import { SubagentRunRecorder } from "./subagent-runs.js";
 import { WorkflowEngine } from "./workflow-engine.js";
 import { ExtensionUiService } from "./application/extension-ui-service.js";
 import { DocumentService } from "./application/document-service.js";
+import { FeishuService } from "./application/feishu-service.js";
 import { CatalogService } from "./application/catalog-service.js";
 import { ProviderService } from "./application/provider-service.js";
 import { ProviderRegistry } from "./providers.js";
 import { RunService } from "./application/run-service.js";
 import { FileChangeTracker } from "./file-changes.js";
 import { ConversationService } from "./application/conversation-service.js";
+import { ScheduledTaskService } from "./application/scheduled-task-service.js";
 import { WorkspaceService } from "./application/workspace-service.js";
 import { CommandHandler } from "./command-handler.js";
 import { TerminalService, terminalDisabledReason } from "./terminal.js";
@@ -107,6 +109,7 @@ await mkdir(uploadsDir, { recursive: true }).catch(() => { });
 const taskEndpoint = `http://${internalHost}:${port}/api/subagent/dispatch`;
 const execEndpoint = `http://${internalHost}:${port}/api/exec`;
 const todoEndpoint = `http://${internalHost}:${port}/api/todos`;
+const scheduledTaskEndpoint = `http://${internalHost}:${port}/api/scheduled-tasks`;
 const workflowEndpoint = `http://${internalHost}:${port}/api/workflow/run`;
 const questionEndpoint = `http://${internalHost}:${port}/api/question`;
 const toolsEndpoint = `http://${internalHost}:${port}/api/tools`;
@@ -133,7 +136,7 @@ const paths = {
 };
 const runtime = process.env.SUPER_PI_RUNTIME === "welcome"
     ? new WelcomeRuntime()
-    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, uploadsDir });
+    : new PiRpcRuntime(join(dataDir, "pi-sessions"), undefined, { dir: initialAgentDirs, promptDir: agentPromptDir }, { endpoint: taskEndpoint, execEndpoint, todoEndpoint, workflowEndpoint, questionEndpoint, toolsEndpoint, documentsEndpoint, scheduledTaskEndpoint, uploadsDir });
 const broadcaster = new WsBroadcaster(() => store.snapshot());
 const memory = new ActiveMemory(join(dataDir, "memories"), store, runtime);
 process.env.SUPER_PI_MEMORY_ENDPOINT = `http://${internalHost}:${port}/api/memory/tool`;
@@ -151,6 +154,12 @@ if (runtime instanceof PiRpcRuntime)
 // capability on its own.
 const documentService = new DocumentService(store);
 process.env.SUPER_PI_DOCUMENTS_ENDPOINT = documentsEndpoint;
+// The Feishu tools. The credential belongs to the OFFICIAL CLI, which keeps it in the OS keychain,
+// so this service holds nothing but the CLI's address. The endpoint is published here the same way
+// the document one is: the Pi process of a turn reads it out of its environment, and the endpoint
+// verifies the session's capability on its own.
+const feishu = new FeishuService();
+process.env.SUPER_PI_FEISHU_ENDPOINT = `http://${internalHost}:${port}/api/feishu/tool`;
 const web = new WebService();
 process.env.SUPER_PI_WEB_ENDPOINT = `http://${internalHost}:${port}/api/web/tool`;
 const extensionUiService = new ExtensionUiService(broadcaster);
@@ -256,11 +265,20 @@ const terminalService = new TerminalService({
  */
 const execService = new ExecService((event) => broadcaster.broadcast(event), (sessionId, exitCode, stdout, stderr) => runService.enqueueExecResult(sessionId, exitCode, stdout, stderr));
 runService.setExecService(execService);
+/**
+ * THE SCHEDULED TASKS, and the clock that fires them.
+ *
+ * Constructed after the run service and the conversation service, because it drives both: a task that
+ * fires opens a conversation and sends a message into it, through exactly the path a person's own
+ * message takes.
+ */
+const scheduledTaskService = new ScheduledTaskService(store, runService, conversationService, broadcaster);
 const serverContext = {
     memory,
     knowledge,
     web,
     documentService,
+    feishu,
     paths,
     store,
     runtime,
@@ -273,6 +291,7 @@ const serverContext = {
     extensionUiService,
     catalogService,
     providerService,
+    scheduledTaskService,
     execService,
     toolRegistry,
     toolRunner,
@@ -283,7 +302,7 @@ const serverContext = {
     terminalEnabled: () => terminalService.enabled,
     terminalDisabledReason: () => terminalDisabledReason(),
 };
-const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir, providerService);
+const commandHandler = new CommandHandler(workspaceService, conversationService, runService, extensionUiService, catalogService, terminalService, rootDir, providerService, scheduledTaskService);
 // ------------------------------------------------------------- Lifecycle & shutdown
 let shutdownPromise;
 async function closeHttpServer() {
@@ -302,6 +321,10 @@ async function shutdown(reason) {
         execService.closeAll();
         runService.abortAll();
         workflows.abortAll();
+        // The scheduler stops BEFORE the runs are waited for, so no new task starts while the server is
+        // closing. The runs already in flight are not aborted: a half-answered scheduled task is a real
+        // answer in a real conversation, and throwing it away to shut down faster would be the wrong trade.
+        await scheduledTaskService.stop();
         for (const c of store.snapshot().conversations) {
             extensionUiService.cancelPendingUi(c.id, "aborted");
         }
@@ -350,6 +373,10 @@ httpServer.listen(port, host, () => {
     const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
     console.log(`Super Pi is running at http://${displayHost}:${port}`);
     logging.write("info", `listening on ${host}:${port} (pid ${process.pid})`);
+    // THE CLOCK STARTS WITH THE SERVER. A task whose moment passed while the server was down is fired
+    // once by the first sweep - the daily report the user asked for is still wanted when they come back,
+    // but seven of them are not.
+    scheduledTaskService.start();
     if (host === "0.0.0.0" || host === "::") {
         const lanIps = getLanIps();
         for (const ip of lanIps) {

package/dist/server/knowledge.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { mkdir, readFile, readdir, rename, stat, unlink, writeFile } from "node:fs/promises";
-import { basename, extname, join } from "node:path";
+import { basename, extname, join, relative, sep } from "node:path";
 import { looksBinary, resolveInsideRoot } from "./files.js";
 import { documentFormatOf, DocumentError, extractText } from "./documents.js";
 /** 1 MB. Big enough for a design doc or a spec, small enough that chunking stays instant. */
@@ -406,7 +406,15 @@ export class KnowledgeBase {
             }
             if (info.size > MAX_DOCUMENT_BYTES)
                 throw new Error(`文件过大：${info.size} 字节超过 ${MAX_DOCUMENT_BYTES} 的上限`);
-            source = body.path.trim();
+            // THE DOCUMENT'S IDENTITY IS THE FILE, NOT THE SPELLING OF ITS PATH. `resolveInsideRoot` has
+            // already resolved the caller's path to a canonical one, so the identity is derived from THAT -
+            // the workspace-relative path - instead of from whatever string the caller typed. Taking the raw
+            // string made `./notes.md` and `notes.md` two different documents: re-importing the same file
+            // under another spelling added a second document, and the REPLACED version stayed in the index
+            // where the agent could still cite it (measured by
+            // scripts/knowledge-import-identity.test.mjs, ledger TEST-027). The contract says a file whose
+            // content changed is an update, keeping its id, and only one document per file may exist.
+            source = relative(workspace.path, absolute).split(sep).join("/");
             if (!title)
                 title = basename(absolute);
             if (documentFormat) {

package/dist/server/persistence/app-state-repository.d.ts

@@ -10,7 +10,19 @@ export type StateTransaction = {
     run: SubagentRun;
 } | {
     kind: "collections.replace";
-    values: Partial<Pick<AppState, "workflows" | "backgroundTasks">>;
+    values: Partial<Pick<AppState, "workflows" | "backgroundTasks" | "scheduledTasks">>;
+}
+/**
+ * Removes one collection row entirely.
+ *
+ * It exists because "this collection is empty" is stored as the ABSENCE of the key, not as an empty
+ * array: a fresh install must not claim the user considered a schedule and found none. A repository
+ * whose `collections.replace` can only write rows therefore cannot express "there are none" - it can
+ * only write `[]`, which is a different claim.
+ */
+ | {
+    kind: "collections.remove";
+    name: "workflows" | "backgroundTasks" | "scheduledTasks";
 } | {
     kind: "conversation.metadata";
     conversationId: string;

package/dist/server/persistence/sqlite-state-repository.js

@@ -118,6 +118,27 @@ export class SqliteStateRepository {
                 for (const [name, value] of Object.entries(transaction.values))
                     write.run(name, JSON.stringify(value));
             }
+            else if (transaction.kind === "collections.remove") {
+                this.db.prepare("DELETE FROM collections WHERE name=?").run(transaction.name);
+                // AND THE BASE SNAPSHOT MUST STOP CARRYING IT TOO. Deleting only the overlay row was not
+                // enough: this loader treats an overlay as a PURE INCREMENT - "no row for this name" means
+                // "read it from the base snapshot" - so the base's stale array came back on the next load,
+                // and a scheduled task the user had deleted was resurrected and ran again on its old
+                // schedule (ledger TEST-038). "This collection is empty" is stored as the ABSENCE of the key
+                // (app-state-repository.ts), so the base has to lose the key as well - the row's deletion
+                // alone cannot express it, because the base is where the value would come from.
+                //
+                // The json backend has no incremental path and falls back to a whole-state save, which is
+                // why it was always right; that asymmetry is what makes this a defect and not a choice.
+                const base = this.db.prepare("SELECT json FROM state WHERE id=1").get();
+                if (base) {
+                    const parsed = JSON.parse(String(base.json));
+                    if (transaction.name in parsed) {
+                        delete parsed[transaction.name];
+                        this.db.prepare("UPDATE state SET json=? WHERE id=1").run(JSON.stringify(parsed));
+                    }
+                }
+            }
             else if (transaction.kind === "conversation.messages") {
                 // A DIFF, NOT A REWRITE. This used to DELETE the conversation's rows and re-INSERT every
                 // message - stringified twice, once per table - on every single send, under

package/dist/server/pi-session-events.js

@@ -16,7 +16,7 @@
  * be announced as unhandled is still announced as unhandled - this bridge changes WHERE the events come
  * from, not what they mean.
  */
-import { describeToolCall, describeToolCallArgs, extractPartialResultText } from "./tool-calls.js";
+import { describeToolCall, describeToolCallArgs, extractPartialResultText, readQuestionCall } from "./tool-calls.js";
 import { toolTargetPath } from "./file-changes.js";
 /** Keeps only real strings, so a malformed queue snapshot cannot put objects into a broadcast. */
 const textList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === "string") : undefined;
@@ -254,7 +254,15 @@ export function handleSessionEvent(event, queue, handlers, report, failure) {
                 return true;
             const name = record.toolName ?? "unknown";
             try {
-                handlers.onToolCall?.({ id, name, detail: describeToolCall(name, record.args), args: describeToolCallArgs(record.args) });
+                // A `question` CALL IS READ HERE, AT `tool_execution_start` - the same place the one-shot path
+                // reads it, and for the same reason: the card on screen must be the tool call the model is
+                // actually blocked in, with the same identity and the same lifecycle. This path left the
+                // question out, so the host never saw a pending question and the model was told the session
+                // had no question waiting for an answer - the `question` tool was simply dead on the SDK
+                // session path, which is the PRODUCTION default (ledger TEST-037). Two paths must give the
+                // same answer to "what is a question call".
+                const question = readQuestionCall(name, record.args);
+                handlers.onToolCall?.({ id, name, detail: describeToolCall(name, record.args), args: describeToolCallArgs(record.args), ...(question ? { question } : {}) });
             }
             catch (error) {
                 console.warn(`PiRpcRuntime: the tool call handler threw: ${error instanceof Error ? error.message : "unknown error"}`);

package/dist/server/pi-session-pool.d.ts

@@ -87,6 +87,22 @@ export declare class PiSessionPool {
      * where that gets fixed.
      */
     private readonly modelEpoch;
+    /**
+     * Mints the OTHER per-session credentials the extensions need, at the moment the session is born.
+     *
+     * WHY A SECOND CALLBACK AND NOT PART OF THE CAPABILITY. The memory and knowledge extensions each
+     * need their own credential - the memory one even carries per-caller flags (read-only for a
+     * sub-agent) that a single session capability cannot express. The one-shot path has always minted
+     * them per turn; the SESSION path minted none, so those two extensions returned before registering
+     * a single tool or injecting a single line of prompt, and both features were absent in production -
+     * the SDK session path is the default backend, and only the test scripts use the one-shot path
+     * (ledger TEST-039).
+     *
+     * They are minted HERE, where the session is born, for the same reason the capability is: the
+     * extension reads its environment ONCE, when it is loaded, so a token minted per turn would be
+     * replaced before the second turn and the extension would still be holding the first turn's value.
+     */
+    private readonly mintExtensionTokens;
     private readonly sessions;
     constructor(
     /** Where Pi keeps its session files. */
@@ -122,7 +138,23 @@ export declare class PiSessionPool {
      * settings window makes every live session unable to reach the new model, and the next turn is
      * where that gets fixed.
      */
-    modelEpoch?: () => number);
+    modelEpoch?: () => number, 
+    /**
+     * Mints the OTHER per-session credentials the extensions need, at the moment the session is born.
+     *
+     * WHY A SECOND CALLBACK AND NOT PART OF THE CAPABILITY. The memory and knowledge extensions each
+     * need their own credential - the memory one even carries per-caller flags (read-only for a
+     * sub-agent) that a single session capability cannot express. The one-shot path has always minted
+     * them per turn; the SESSION path minted none, so those two extensions returned before registering
+     * a single tool or injecting a single line of prompt, and both features were absent in production -
+     * the SDK session path is the default backend, and only the test scripts use the one-shot path
+     * (ledger TEST-039).
+     *
+     * They are minted HERE, where the session is born, for the same reason the capability is: the
+     * extension reads its environment ONCE, when it is loaded, so a token minted per turn would be
+     * replaced before the second turn and the extension would still be holding the first turn's value.
+     */
+    mintExtensionTokens?: (conversationId: string) => Promise<Record<string, string>> | Record<string, string>);
     /**
      * The session for a conversation, built if there is none and REPLACED if the live one is stale.
      *

package/dist/server/pi-session-pool.js

@@ -49,6 +49,7 @@ export class PiSessionPool {
     factory;
     mintCapability;
     modelEpoch;
+    mintExtensionTokens;
     sessions = new Map();
     constructor(
     /** Where Pi keeps its session files. */
@@ -84,7 +85,23 @@ export class PiSessionPool {
      * settings window makes every live session unable to reach the new model, and the next turn is
      * where that gets fixed.
      */
-    modelEpoch = () => 0) {
+    modelEpoch = () => 0, 
+    /**
+     * Mints the OTHER per-session credentials the extensions need, at the moment the session is born.
+     *
+     * WHY A SECOND CALLBACK AND NOT PART OF THE CAPABILITY. The memory and knowledge extensions each
+     * need their own credential - the memory one even carries per-caller flags (read-only for a
+     * sub-agent) that a single session capability cannot express. The one-shot path has always minted
+     * them per turn; the SESSION path minted none, so those two extensions returned before registering
+     * a single tool or injecting a single line of prompt, and both features were absent in production -
+     * the SDK session path is the default backend, and only the test scripts use the one-shot path
+     * (ledger TEST-039).
+     *
+     * They are minted HERE, where the session is born, for the same reason the capability is: the
+     * extension reads its environment ONCE, when it is loaded, so a token minted per turn would be
+     * replaced before the second turn and the extension would still be holding the first turn's value.
+     */
+    mintExtensionTokens = () => ({})) {
         this.sessionDir = sessionDir;
         this.repositoryRoot = repositoryRoot;
         this.agentDir = agentDir;
@@ -92,6 +109,7 @@ export class PiSessionPool {
         this.factory = factory;
         this.mintCapability = mintCapability;
         this.modelEpoch = modelEpoch;
+        this.mintExtensionTokens = mintExtensionTokens;
     }
     /**
      * The session for a conversation, built if there is none and REPLACED if the live one is stale.
@@ -138,7 +156,7 @@ export class PiSessionPool {
         // server separately requires that a turn is RUNNING for the token to be usable, which is what keeps a
         // longer-lived token from being a weaker credential than a per-turn one.
         const capability = this.mintCapability(request.conversationId);
-        const extensionEnv = { ...request.extensionEnv, [CAPABILITY_ENV]: capability, [TOOLS_CAPABILITY_ENV]: capability };
+        const extensionEnv = { ...request.extensionEnv, [CAPABILITY_ENV]: capability, [TOOLS_CAPABILITY_ENV]: capability, ...await this.mintExtensionTokens(request.conversationId) };
         const building = this.build({ ...request, extensionEnv }, fingerprint);
         if (process.env.SUPER_PI_TRACE_LATENCY === "1")
             console.warn(`[super-pi latency] conversation=${request.conversationId} phase=session.build.begin`);

package/dist/server/pi-session.js

@@ -419,6 +419,9 @@ export function superPiExtensionPaths(repositoryRoot) {
         // whether to register anything: with no endpoint in its environment it returns without
         // registering a tool, so a runtime without a document endpoint mounts nothing harmful.
         join(repositoryRoot, "agents", "super-pi-documents", "index.ts"),
+        // The Feishu tools, mounted for every session on the same terms: the extension registers
+        // nothing without an endpoint in its environment.
+        join(repositoryRoot, "agents", "super-pi-feishu", "index.ts"),
     ];
     return paths.filter((path) => existsSync(path));
 }