@evandu/super-pi 0.1.132 → 0.1.135

package/dist/server/runtime.d.ts

@@ -164,7 +164,11 @@ export interface AnswerInput {
     onToolPreparing?(call: ToolCallPreparing): void;
     /** Called while the primary model is emitting reasoning, so the UI can show live progress. A call means
      *  the model is STILL THINKING - there is no separate flag, because Pi does not send one. */
-    onThinking?(delta: string): void;
+    /** Called while the primary model is emitting reasoning, so the UI can show live progress. A call means
+     *  the model is STILL THINKING - there is no separate flag, because Pi does not send one.
+     *  The handler may be async: the reasoning signal is the same "the model is producing" signal as
+     *  a text delta, and the caller waits for it so the state it writes is ordered with the delta. */
+    onThinking?(delta: string): void | Promise<void>;
     /** Called when the reasoning phase ends - the only signal that it has. */
     onThinkingEnd?(): void;
 }
@@ -560,6 +564,12 @@ export declare class PiRpcRuntime implements AgentRuntime {
     private readonly options;
     private memory?;
     setMemory(memory: ActiveMemory): void;
+    /**
+     * The memory and knowledge credentials minted for each LIVE session, so they can be released when
+     * the session goes. A credential whose session is gone must not keep working - that is exactly the
+     * shape of a secret with no owner.
+     */
+    private readonly sessionExtensionTokens;
     private knowledge?;
     setKnowledge(knowledge: KnowledgeBase): void;
     private readonly runs;
@@ -841,6 +851,21 @@ export declare class PiRpcRuntime implements AgentRuntime {
      * The TODO ENDPOINT is the one value here that is NOT per-turn derived from disk: it is this server's
      * own address, so it is the same string on every turn and is read once from the constructor's options.
      */
+    /**
+     * THE MEMORY AND KNOWLEDGE CREDENTIALS FOR A NEW SESSION.
+     *
+     * Both extensions read their environment ONCE, when they are loaded, so these are minted where the
+     * session is born - the same place, and for the same reason, as the session's capability. The
+     * one-shot path has always minted them (per turn); the session path minted none, so the memory and
+     * knowledge extensions returned before registering a tool or injecting a prompt, and both features
+     * were missing in production - the SDK session path is the DEFAULT backend, and only the test
+     * scripts take the one-shot path (ledger TEST-039).
+     *
+     * The endpoints are published as global environment variables (index.ts), and they are repeated
+     * here so the extension's contract is stated in one place: an endpoint and a credential travel
+     * together, and the credential is what proves the caller.
+     */
+    private mintSessionExtensionTokens;
     /**
      * The environment Super Pi's extensions read when they are loaded.
      *

package/dist/server/runtime.js

@@ -289,6 +289,12 @@ export class PiRpcRuntime {
     options;
     memory;
     setMemory(memory) { this.memory = memory; }
+    /**
+     * The memory and knowledge credentials minted for each LIVE session, so they can be released when
+     * the session goes. A credential whose session is gone must not keep working - that is exactly the
+     * shape of a secret with no owner.
+     */
+    sessionExtensionTokens = new Map();
     knowledge;
     setKnowledge(knowledge) { this.knowledge = knowledge; }
     runs = new Map();
@@ -466,7 +472,16 @@ export class PiRpcRuntime {
             // ABOUT that session and stop being true with it.
             this.sessionHosts.delete(conversationId);
             this.reportedSessionFiles.delete(conversationId);
-        }, options.sessionFactory ?? createPiSession, (conversationId) => mintCapability(conversationId), () => this.modelEpoch);
+            // The session held these credentials too, so they die with it.
+            const tokens = this.sessionExtensionTokens.get(conversationId);
+            if (tokens) {
+                if (tokens.memoryToken)
+                    this.memory?.release(tokens.memoryToken);
+                if (tokens.knowledgeToken)
+                    this.knowledge?.release(tokens.knowledgeToken);
+                this.sessionExtensionTokens.delete(conversationId);
+            }
+        }, options.sessionFactory ?? createPiSession, (conversationId) => mintCapability(conversationId), () => this.modelEpoch, (conversationId) => this.mintSessionExtensionTokens(conversationId));
     }
     /**
      * The configuration of the session that was built for a conversation, for tests to inspect.
@@ -628,6 +643,37 @@ export class PiRpcRuntime {
      * The TODO ENDPOINT is the one value here that is NOT per-turn derived from disk: it is this server's
      * own address, so it is the same string on every turn and is read once from the constructor's options.
      */
+    /**
+     * THE MEMORY AND KNOWLEDGE CREDENTIALS FOR A NEW SESSION.
+     *
+     * Both extensions read their environment ONCE, when they are loaded, so these are minted where the
+     * session is born - the same place, and for the same reason, as the session's capability. The
+     * one-shot path has always minted them (per turn); the session path minted none, so the memory and
+     * knowledge extensions returned before registering a tool or injecting a prompt, and both features
+     * were missing in production - the SDK session path is the DEFAULT backend, and only the test
+     * scripts take the one-shot path (ledger TEST-039).
+     *
+     * The endpoints are published as global environment variables (index.ts), and they are repeated
+     * here so the extension's contract is stated in one place: an endpoint and a credential travel
+     * together, and the credential is what proves the caller.
+     */
+    async mintSessionExtensionTokens(conversationId) {
+        const minted = {};
+        const env = {};
+        if (this.memory && (await this.memory.configuration()).enabled) {
+            minted.memoryToken = this.memory.issue(conversationId);
+            env.SUPER_PI_MEMORY_TOKEN = minted.memoryToken;
+            env.SUPER_PI_MEMORY_ENDPOINT = process.env.SUPER_PI_MEMORY_ENDPOINT ?? "";
+        }
+        if (this.knowledge && this.knowledge.enabled()) {
+            minted.knowledgeToken = this.knowledge.issue(conversationId);
+            env.SUPER_PI_KNOWLEDGE_TOKEN = minted.knowledgeToken;
+            env.SUPER_PI_KNOWLEDGE_ENDPOINT = process.env.SUPER_PI_KNOWLEDGE_ENDPOINT ?? "";
+        }
+        if (minted.memoryToken || minted.knowledgeToken)
+            this.sessionExtensionTokens.set(conversationId, minted);
+        return env;
+    }
     /**
      * The environment Super Pi's extensions read when they are loaded.
      *
@@ -895,7 +941,46 @@ export class PiRpcRuntime {
                 const promptOptions = images?.length
                     ? { images: images, preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) }
                     : { preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) };
+                // A STOP THAT ARRIVED WHILE THIS SESSION WAS BEING BUILT MUST NOT SEND THE PROMPT.
+                //
+                // The window between "the person pressed stop" and "the prompt goes out" is the whole session
+                // build: Pi's resource loader, the extensions, the transcript, the model lookup - seconds, on a
+                // cold session. The abort listener above already noticed the cancellation, but `session.abort()`
+                // on a session that has not started running is a no-op, so nothing stopped the prompt that was
+                // about to be sent: the model was asked a question the person had already cancelled, and it
+                // answered it - which is why pressing stop looked like it "took effect" only once the reply was
+                // over.
+                //
+                // So the cancellation is checked HERE, at the last moment before the prompt goes out, and a
+                // cancelled turn ends with no question asked at all.
+                //
+                // `turnController.signal.aborted` is the OTHER half of the same fact: the turn's own controller
+                // is what `abortTurn()` trips, and it is tripped by the very same cancellation. Both are checked
+                // because they are tripped by different readers - one by the person, one by Pi's abort.
+                if (signal.aborted || turnController.signal.aborted) {
+                    queue.push({ kind: "end" });
+                    return;
+                }
                 await session.prompt(prompt, promptOptions);
+                // THE CANCELLATION MAY HAVE ARRIVED WHILE PI WAS PREPARING THE PROMPT.
+                //
+                // `session.prompt()` is not one step: it runs Pi's input handlers (the extensions' hooks -
+                // Super Pi's own memory search is one of them), the compaction check and the auth check before
+                // the agent's run starts. An abort that lands in that window finds a session that has NOT
+                // started running, so Pi's abort has nothing to abort - and the prompt goes on to the model,
+                // which answers a question the person cancelled.
+                //
+                // The run IS started by the time `prompt()` resolves, so the abort is said AGAIN here. The
+                // second one is the one that lands.
+                if (signal.aborted) {
+                    // The same 5s backstop `runtime.stop` uses: a wedged session must not hang the turn forever.
+                    await Promise.race([
+                        session.abort().catch((error) => {
+                            console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} after a late cancellation threw: ${error instanceof Error ? error.message : "unknown error"}`);
+                        }),
+                        new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000)),
+                    ]);
+                }
                 // `prompt()` RETURNING IS NOT THE TURN ENDING. Pi's `prompt` resolves when the message has
                 // been ACCEPTED and the run has been started; the agent is still streaming, still executing
                 // tools, still settling. A turn that ended here would release the reader while the model was
@@ -906,13 +991,10 @@ export class PiRpcRuntime {
                 // pushes the terminal item when Pi settles, and the consumer below reads it. This promise
                 // waits for that signal, and the race with the prompt's own failure is what keeps a turn that
                 // never settles from hanging forever - a hung turn is a conversation that never answers.
-                await Promise.race([
-                    queue.settledSignal,
-                    // The safety net. A session that was aborted, or a Pi that died mid-turn, may never settle,
-                    // and the turn still has to end - otherwise the conversation is stuck on a turn that will
-                    // never produce anything and the next message can never be sent.
-                    new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000)),
-                ]);
+                // `prompt()` only means Pi accepted the request. Do not end this generator on a wall-clock
+                // timeout: the session may still be streaming or executing a tool, and ending here drops
+                // subsequent events while falsely allowing the next prompt onto a busy session.
+                await queue.settledSignal;
                 traceLatency(conversation.id, "session.settled", latencyStartedAt);
                 // THE REVERT BOUNDARY, recorded at the same moment the one-shot path records it: the turn has
                 // settled, so every entry this turn wrote - the user message included - is in the transcript.
@@ -1144,7 +1226,7 @@ export class PiRpcRuntime {
                 if (segment.kind === "text")
                     yield segment.text;
                 else if (segment.kind === "thinking")
-                    input.onThinking?.(segment.text);
+                    await input.onThinking?.(segment.text);
                 else
                     input.onThinkingEnd?.();
             }
@@ -1394,6 +1476,13 @@ export class PiRpcRuntime {
             const imagePayloads = this.options.uploadsDir && images?.length
                 ? await loadConversationImages(this.options.uploadsDir, conversation.id, images)
                 : undefined;
+            // A STOP THAT ARRIVED WHILE THE CHILD WAS STARTING MUST NOT SEND THE PROMPT.
+            //
+            // The same gap the session path has, and the same reason: `abort` above writes an `abort`
+            // command to a child that has not been given anything yet, so it does nothing - and the prompt
+            // went out anyway, and the model answered a question the person had already cancelled.
+            if (signal.aborted)
+                return;
             channel.write({ id: "prompt", type: "prompt", message: prompt, ...(imagePayloads?.length ? { images: imagePayloads } : {}) });
             traceLatency(conversation.id, "prompt.sent", latencyStartedAt);
             let settled = false;

package/dist/server/store.d.ts

@@ -11,6 +11,16 @@ import type { AppState, Conversation, Message, MessageDelivery, MessageImage, Mo
  *  disk, or a failed write would leave a conversation whose model context is silently empty. The runtime is
  *  therefore handed the id and the store is handed the same one back. See `ForkRequest.forkedConversationId`. */
 export declare function newConversationId(): string;
+/**
+ * ONE FOLDER, ONE KEY.
+ *
+ * The same directory reaches the app spelled several ways - `F:\code\app` and `F:/code/app/` and
+ * `f:\code\app` are one folder - and two workspaces for one folder are one project split in half.
+ * The key folds the separators and the trailing slash away, and folds case away only where the
+ * filesystem folds it too: Windows and macOS treat `F:\Code` and `f:\code` as one directory, Linux
+ * does not, and pretending otherwise would merge two real projects into one.
+ */
+export declare function workspacePathKey(path: string): string;
 /**
  * How many SETTLED sub-agent runs `state.json` keeps, so the file cannot grow without bound.
  *
@@ -101,6 +111,15 @@ export declare class Store {
     setDefaultModel(model?: ModelSelection): Promise<void>;
     setTerminalShell(shell?: import("./types.js").TerminalShell): Promise<void>;
     snapshot(): AppState;
+    /** Cheap scalar/entity reads for hot paths. Never expose the live mutable state object. */
+    hasWorkspace(workspaceId: string): boolean;
+    conversationStatus(conversationId: string): Conversation["status"] | undefined;
+    question(conversationId: string, messageId: string, index: number): ToolCallQuestion | undefined;
+    pendingQuestion(conversationId: string): {
+        messageId: string;
+        index: number;
+        question: ToolCallQuestion;
+    } | undefined;
     /**
      * Whether a conversation already holds a message with this id.
      *
@@ -126,6 +145,17 @@ export declare class Store {
         conversation: Conversation;
         workspace: Workspace;
     } | undefined;
+    /**
+     * THE PHYSICAL DIRECTORY IS THE WORKSPACE'S IDENTITY.
+     *
+     * A workspace is a folder, not a row in a table: two workspaces pointing at the same directory are
+     * the same project, and the app used to mint a fresh UUID for each one. That is what broke
+     * re-adding a workspace - the new id matched none of the conversations that belonged to that
+     * directory, so the history was unreachable (and, before the soft unmount, actually deleted).
+     *
+     * So the same folder always means the same workspace id, and the id is what the conversations
+     * point at.
+     */
     createWorkspace(name: string, path?: string): Promise<Workspace>;
     renameWorkspace(workspaceId: string, name: string): Promise<Workspace>;
     /**
@@ -151,7 +181,38 @@ export declare class Store {
         thinkingLevel?: string;
         agentId?: string | null;
     }): Promise<Workspace>;
+    /**
+     * TAKES A WORKSPACE OUT OF THE SIDEBAR. IT DOES NOT DELETE ANYTHING.
+     *
+     * This used to cascade: the workspace row AND every conversation that pointed at it were erased
+     * from the state, in one persist. That made the most natural thing a user could do - remove a
+     * workspace to tidy the sidebar, then add the same folder back - silently destroy the history of
+     * that project, and there was no way to get it back.
+     *
+     * So the removal is a SOFT UNMOUNT, the same shape as a session's archive: the workspace row
+     * stays (with `closedAt` on it), the conversations stay, the uploads stay, and nothing is
+     * broadcast for either (see `clientState`). Adding the same folder again re-opens the very same
+     * workspace - same id, same conversations - which is the whole point of the physical path being
+     * the workspace's identity.
+     *
+     * The returned list is the conversations that were STOPPED, not deleted: a turn that was still
+     * running under a workspace that just left the sidebar cannot keep burning a model session
+     * behind the user's back, and a pending question would otherwise wait for an answer that the
+     * sidebar can no longer reach.
+     */
     deleteWorkspace(workspaceId: string): Promise<string[]>;
+    /**
+     * THE STATE THE CLIENT IS ALLOWED TO SEE.
+     *
+     * `snapshot()` is the truth of what the store HOLDS; this is the truth of what is ON SCREEN. The
+     * difference is the closed workspaces: one that was removed from the sidebar is still in the store
+     * - that is exactly why re-adding the folder brings its history back - but it is not part of the
+     * app any more, so neither it nor its conversations are broadcast.
+     *
+     * Filtering HERE, in one place, rather than in every reader, is what keeps the client dumb: the
+     * sidebar renders `state.workspaces` and never has to know that a closed workspace exists.
+     */
+    clientState(): AppState;
     createConversation(workspaceId: string, configuration?: {
         agentId?: string;
         model?: ModelSelection | null;

package/dist/server/store.js

@@ -11,6 +11,19 @@ function id(prefix) { return `${prefix}_${crypto.randomUUID()}`; }
  *  disk, or a failed write would leave a conversation whose model context is silently empty. The runtime is
  *  therefore handed the id and the store is handed the same one back. See `ForkRequest.forkedConversationId`. */
 export function newConversationId() { return id("conversation"); }
+/**
+ * ONE FOLDER, ONE KEY.
+ *
+ * The same directory reaches the app spelled several ways - `F:\code\app` and `F:/code/app/` and
+ * `f:\code\app` are one folder - and two workspaces for one folder are one project split in half.
+ * The key folds the separators and the trailing slash away, and folds case away only where the
+ * filesystem folds it too: Windows and macOS treat `F:\Code` and `f:\code` as one directory, Linux
+ * does not, and pretending otherwise would merge two real projects into one.
+ */
+export function workspacePathKey(path) {
+    const folded = path.trim().replace(/\\/g, "/").replace(/\/+$/, "");
+    return process.platform === "linux" ? folded : folded.toLowerCase();
+}
 function now() { return new Date().toISOString(); }
 const DEFAULT_CONVERSATION_TITLE = "\u65b0\u4f1a\u8bdd";
 /** Whether a value survives a `new Date()` round-trip. `createdAt` is typed string, but state.json only
@@ -735,6 +748,35 @@ export class Store {
             console.warn(`[super-pi latency] phase=state.snapshot bytes=${JSON.stringify(value).length} cloneMs=${Math.round(performance.now() - startedAt)}`);
         return value;
     }
+    /** Cheap scalar/entity reads for hot paths. Never expose the live mutable state object. */
+    hasWorkspace(workspaceId) {
+        return this.state.workspaces.some((workspace) => workspace.id === workspaceId);
+    }
+    conversationStatus(conversationId) {
+        return this.state.conversations.find((conversation) => conversation.id === conversationId)?.status;
+    }
+    question(conversationId, messageId, index) {
+        const question = this.state.conversations.find((conversation) => conversation.id === conversationId)
+            ?.messages.find((message) => message.id === messageId)?.toolCalls?.[index]?.question;
+        return question ? structuredClone(question) : undefined;
+    }
+    pendingQuestion(conversationId) {
+        const conversation = this.state.conversations.find((item) => item.id === conversationId);
+        if (!conversation)
+            return undefined;
+        for (let messageIndex = conversation.messages.length - 1; messageIndex >= 0; messageIndex -= 1) {
+            const message = conversation.messages[messageIndex];
+            if (message.role !== "assistant")
+                continue;
+            for (let index = (message.toolCalls?.length ?? 0) - 1; index >= 0; index -= 1) {
+                const question = message.toolCalls?.[index]?.question;
+                if (message.toolCalls?.[index]?.label === "question" && question?.status === "pending") {
+                    return { messageId: message.id, index, question: structuredClone(question) };
+                }
+            }
+        }
+        return undefined;
+    }
     /**
      * Whether a conversation already holds a message with this id.
      *
@@ -767,6 +809,17 @@ export class Store {
             return undefined;
         return { conversation: structuredClone(conversation), workspace: structuredClone(workspace) };
     }
+    /**
+     * THE PHYSICAL DIRECTORY IS THE WORKSPACE'S IDENTITY.
+     *
+     * A workspace is a folder, not a row in a table: two workspaces pointing at the same directory are
+     * the same project, and the app used to mint a fresh UUID for each one. That is what broke
+     * re-adding a workspace - the new id matched none of the conversations that belonged to that
+     * directory, so the history was unreachable (and, before the soft unmount, actually deleted).
+     *
+     * So the same folder always means the same workspace id, and the id is what the conversations
+     * point at.
+     */
     async createWorkspace(name, path) {
         const cleanName = name.trim();
         if (!cleanName || cleanName.length > 80)
@@ -774,6 +827,19 @@ export class Store {
         const cleanPath = path?.trim() || process.cwd();
         if (cleanPath.length > 500)
             throw new Error("工作区路径太长了。");
+        // THE SAME FOLDER IS THE SAME WORKSPACE. Adding a directory that is already here re-opens it
+        // instead of forking a second one: the id stays, the conversations stay attached to it, and the
+        // name is left alone (renaming is an explicit action elsewhere, and silently renaming a
+        // workspace because someone typed a name into the add dialog would be its own surprise).
+        const existing = this.state.workspaces.find((item) => workspacePathKey(item.path) === workspacePathKey(cleanPath));
+        if (existing) {
+            if (existing.closedAt) {
+                delete existing.closedAt;
+                existing.updatedAt = now();
+                await this.persist();
+            }
+            return structuredClone(existing);
+        }
         const workspace = { id: id("workspace"), name: cleanName, path: cleanPath, updatedAt: now() };
         this.state.workspaces.push(workspace);
         await this.persist();
@@ -830,23 +896,55 @@ export class Store {
         await this.persist();
         return structuredClone(workspace);
     }
+    /**
+     * TAKES A WORKSPACE OUT OF THE SIDEBAR. IT DOES NOT DELETE ANYTHING.
+     *
+     * This used to cascade: the workspace row AND every conversation that pointed at it were erased
+     * from the state, in one persist. That made the most natural thing a user could do - remove a
+     * workspace to tidy the sidebar, then add the same folder back - silently destroy the history of
+     * that project, and there was no way to get it back.
+     *
+     * So the removal is a SOFT UNMOUNT, the same shape as a session's archive: the workspace row
+     * stays (with `closedAt` on it), the conversations stay, the uploads stay, and nothing is
+     * broadcast for either (see `clientState`). Adding the same folder again re-opens the very same
+     * workspace - same id, same conversations - which is the whole point of the physical path being
+     * the workspace's identity.
+     *
+     * The returned list is the conversations that were STOPPED, not deleted: a turn that was still
+     * running under a workspace that just left the sidebar cannot keep burning a model session
+     * behind the user's back, and a pending question would otherwise wait for an answer that the
+     * sidebar can no longer reach.
+     */
     async deleteWorkspace(workspaceId) {
-        if (!this.state.workspaces.some((item) => item.id === workspaceId))
+        const workspace = this.state.workspaces.find((item) => item.id === workspaceId);
+        if (!workspace)
             throw new Error("找不到这个工作区。");
-        // Deleting the LAST workspace is allowed: a fresh store starts with zero (see `openRepository`), so
-        // "at least one" was an artifact of the old first-run seed, and the client's zero-workspace empty
-        // state is the onboarding path back in.
-        // Cascade: workspaces and conversations live in one state.json, so this single atomic persist removes
-        // both together. A waiting message needs no sweep of its own any more - it is a message inside one of
-        // the conversations being removed, so it goes with its container, which is the whole reason it is a
-        // better shape than an entry keyed by conversation id in a separate array: that array needed this
-        // cascade to avoid naming a conversation that no longer exists, and could not have been trusted to
-        // get it right on its own.
-        const doomed = new Set(this.state.conversations.filter((item) => item.workspaceId === workspaceId).map((item) => item.id));
-        this.state.workspaces = this.state.workspaces.filter((item) => item.id !== workspaceId);
-        this.state.conversations = this.state.conversations.filter((item) => item.workspaceId !== workspaceId);
+        if (workspace.closedAt)
+            return [];
+        workspace.closedAt = now();
+        workspace.updatedAt = workspace.closedAt;
         await this.persist();
-        return [...doomed];
+        return [];
+    }
+    /**
+     * THE STATE THE CLIENT IS ALLOWED TO SEE.
+     *
+     * `snapshot()` is the truth of what the store HOLDS; this is the truth of what is ON SCREEN. The
+     * difference is the closed workspaces: one that was removed from the sidebar is still in the store
+     * - that is exactly why re-adding the folder brings its history back - but it is not part of the
+     * app any more, so neither it nor its conversations are broadcast.
+     *
+     * Filtering HERE, in one place, rather than in every reader, is what keeps the client dumb: the
+     * sidebar renders `state.workspaces` and never has to know that a closed workspace exists.
+     */
+    clientState() {
+        const state = this.snapshot();
+        const closed = new Set(state.workspaces.filter((item) => item.closedAt).map((item) => item.id));
+        if (!closed.size)
+            return state;
+        state.workspaces = state.workspaces.filter((item) => !closed.has(item.id));
+        state.conversations = state.conversations.filter((item) => !closed.has(item.workspaceId));
+        return state;
     }
     async createConversation(workspaceId, configuration) {
         const workspace = this.state.workspaces.find((item) => item.id === workspaceId);

package/dist/server/types.d.ts

@@ -586,6 +586,12 @@ export type AgentCatalog = {
  * the conversation's own field, an existing conversation is therefore immune to later workspace
  * edits, and deleting the workspace default cannot reach back into sessions already born.
  */
+/**
+ * `closedAt` marks a workspace that was REMOVED FROM THE SIDEBAR but is not gone: its conversations
+ * are still on disk and still belong to it. The removal is a soft unmount, exactly like a session's
+ * `archivedAt` - a state marker, never a deletion - and the marker is what lets the same physical
+ * directory be added again later and come back with its history instead of with an empty list.
+ */
 export type Workspace = {
     id: string;
     name: string;
@@ -594,6 +600,7 @@ export type Workspace = {
     defaultModel?: ModelSelection;
     defaultThinkingLevel?: string;
     defaultAgentId?: string;
+    closedAt?: string;
 };
 /**
  * Usage accumulated across one sub-agent run. `turns` is the number of finished assistant messages,
@@ -1469,6 +1476,9 @@ export type ChangedFile = {
     at: number;
 };
 export type ServerEvent = {
+    type: "run.stopping";
+    conversationId: string;
+} | {
     type: "tools.updated";
     tools: MountedToolSummary[];
 }

package/dist/server/ws-server.d.ts

@@ -13,6 +13,9 @@ export declare class WsBroadcaster implements EventBroadcaster {
     private readonly sockets;
     private readonly coalescedSockets;
     private readonly pendingStreams;
+    private cachedState?;
+    private cachedStatePayload?;
+    private stateFlushScheduled;
     constructor(getState: () => AppState);
     register(socket: WebSocket): void;
     unregister(socket: WebSocket): void;

package/dist/server/ws-server.js

@@ -1,5 +1,6 @@
 import { WebSocket, WebSocketServer } from "ws";
 import { isAuthorized } from "./http-server.js";
+import { describeThrown, describeThrownWithStack } from "./failure-text.js";
 /**
  * Concrete implementation of EventBroadcaster delivering server events
  * across active WebSocket connections.
@@ -9,6 +10,9 @@ export class WsBroadcaster {
     sockets = new Set();
     coalescedSockets = new Set();
     pendingStreams = new Map();
+    cachedState;
+    cachedStatePayload;
+    stateFlushScheduled = false;
     constructor(getState) {
         this.getState = getState;
     }
@@ -90,7 +94,23 @@ export class WsBroadcaster {
         }
     }
     broadcastState() {
-        this.broadcast({ type: "state", state: this.getState() });
+        if (this.stateFlushScheduled)
+            return;
+        this.stateFlushScheduled = true;
+        queueMicrotask(() => {
+            this.stateFlushScheduled = false;
+            this.cachedState = this.getState();
+            this.cachedStatePayload = JSON.stringify({ type: "state", state: this.cachedState });
+            const payload = this.cachedStatePayload;
+            for (const socket of this.sockets) {
+                if (socket.readyState !== WebSocket.OPEN)
+                    continue;
+                this.flushStreaming(socket);
+                socket.send(payload);
+            }
+            this.cachedState = undefined;
+            this.cachedStatePayload = undefined;
+        });
     }
     getStateSnapshot() {
         return this.getState();
@@ -228,7 +248,8 @@ export class WsServer {
                     parsed = JSON.parse(raw.toString());
                 }
                 catch {
-                    socket.send(JSON.stringify({ type: "error", message: "command failed" }));
+                    console.error("Super Pi command error: received a frame that is not valid JSON");
+                    socket.send(JSON.stringify({ type: "error", message: "收到一条无法解析的命令，已忽略。" }));
                     return;
                 }
                 if (parsed.type === "stream.configure") {
@@ -264,13 +285,21 @@ export class WsServer {
                         }
                     }
                     catch (error) {
+                        // A FAILED COMMAND WRITES ITSELF DOWN BEFORE IT ANSWERS.
+                        //
+                        // The server runs detached with its streams thrown away, so `console.error` here is not
+                        // decoration: the logger tees it into `<dataDir>/logs/server.log`, which is the only place
+                        // the stack survives. The browser gets the reason (never a stand-in phrase like
+                        // `command failed`), because the reader is the one who has to act on it.
+                        console.error("Super Pi command error:", describeThrownWithStack(error));
+                        const reason = describeThrown(error);
                         if (command?.operationRequestId) {
-                            socket.send(JSON.stringify({ type: "operation.result", requestId: command.operationRequestId, ok: false, message: error instanceof Error ? error.message : String(error) }));
+                            socket.send(JSON.stringify({ type: "operation.result", requestId: command.operationRequestId, ok: false, message: reason }));
                             return;
                         }
                         socket.send(JSON.stringify({
                             type: "error",
-                            message: error instanceof Error ? error.message : "command failed",
+                            message: reason || "服务端没有说明这次失败的原因。",
                         }));
                     }
                     finally {
@@ -284,11 +313,11 @@ export class WsServer {
                 };
                 if (runIndependently)
                     void execute().catch((error) => {
-                        console.warn(`Super Pi: command dispatch failed: ${error instanceof Error ? error.message : "unknown error"}`);
+                        console.error("Super Pi command dispatch failed:", describeThrownWithStack(error));
                     });
                 else
                     commandQueue = commandQueue.then(execute).catch((error) => {
-                        console.warn(`Super Pi: command dispatch failed: ${error instanceof Error ? error.message : "unknown error"}`);
+                        console.error("Super Pi command dispatch failed:", describeThrownWithStack(error));
                     });
             });
         });