@evandu/super-pi 0.1.137 → 0.1.139

package/dist/server/application/conversation-service.js

@@ -1,4 +1,4 @@
-import { assertModelAllowed, conversationWorkspace } from "../model-filter.js";
+import { assertModelAllowed } from "../model-filter.js";
 import { newConversationId } from "../store.js";
 /**
  * Service managing conversation lifecycle: creation, selection, archiving,
@@ -14,7 +14,13 @@ export class ConversationService {
     extensionUiService;
     agentsDir;
     /** Conversations whose Pi transcript is being cut RIGHT NOW. Read by the send path, below. */
-    reverting = new Set();
+    // This is a reference count rather than a Set. A revert is claimed at socket arrival and claimed a
+    // second time when the service starts the cut. More than one socket can also click revert before the
+    // first one finishes. A Set lets the first owner release the entry while the second cut is still
+    // running, admitting a send onto a transcript that has not been cut yet.
+    reverting = new Map();
+    /** Reverts for one conversation must never truncate the same Pi file concurrently. */
+    revertOps = new Map();
     /** The memory store, so a revert can undo what that conversation taught it. Set by `setMemory`. */
     memory;
     constructor(store, runtime, subagents, broadcaster, catalogService, runService, extensionUiService, agentsDir) {
@@ -34,7 +40,7 @@ export class ConversationService {
      * Creates a new conversation in a workspace.
      */
     async createConversation(workspaceId) {
-        const workspace = this.store.snapshot().workspaces.find(item => item.id === workspaceId);
+        const workspace = this.store.workspace(workspaceId);
         if (!workspace)
             throw new Error("找不到这个工作区。");
         // Workspace defaults are copied at birth, but Pi's model list can change after the
@@ -46,14 +52,20 @@ export class ConversationService {
         // override: a workspace that has a default of its own keeps it, and only a workspace with none
         // inherits the app-wide one. Both are copied onto the conversation and never consulted again,
         // so changing either default never rewrites an existing conversation.
-        const appDefault = this.store.snapshot().defaultModel;
-        const inheritsAppDefault = !workspace.defaultModel && Boolean(appDefault);
+        const appDefault = this.store.defaultModel();
         let model = workspace.defaultModel ?? appDefault;
         let thinkingLevel = workspace.defaultThinkingLevel;
+        // WHY A DEFAULT MODEL CAN BE DROPPED, IN WORDS. The two ways a default does not survive are
+        // both real and both the user's problem: Pi may no longer offer the model, and the workspace's
+        // model rules may forbid it. Either way the conversation starts on Pi's own default - and the
+        // user has to be TOLD, because the alternative is a conversation silently running on a model
+        // nobody chose (TEST-062). The note is carried on the conversation and read by the panel.
+        let modelNotice;
         const catalog = model || thinkingLevel ? await this.runtime.catalog() : undefined;
         if (catalog?.source === "pi" && model) {
             const option = catalog.models.find(item => item.provider === model?.provider && item.modelId === model?.modelId);
             if (!option) {
+                modelNotice = `你设的默认模型 ${model.label ?? `${model.provider}/${model.modelId}`} 现在不在 Pi 的模型列表里了，这个会话改用 Pi 自己的默认模型。`;
                 model = undefined;
                 thinkingLevel = undefined;
             }
@@ -66,15 +78,23 @@ export class ConversationService {
                 }
             }
         }
-        if (inheritsAppDefault && model) {
+        if (model) {
+            // THE MODEL RULES HOLD AT BIRTH, FOR EVERY DEFAULT. The check used to be guarded by
+            // `inheritsAppDefault` - that is, it only ran when the model came from the APP-wide default.
+            // A workspace with a default of its own skipped the check entirely, so the one default the
+            // user had chosen FOR THIS WORKSPACE was the one the workspace's own rules never applied to
+            // (TEST-061). The rules say 「this workspace only runs THIS model」; that is a statement about
+            // the workspace, so it holds for every model the workspace starts on.
+            //
             // An app-wide default belongs to no workspace, so the workspace's model rules are checked HERE,
             // at birth, where the workspace is finally known. A default the rules forbid is not stamped
             // on: the conversation starts on Pi's own default instead, which is the same outcome as a
             // workspace default that pointed at a model Pi no longer offers.
             try {
-                assertModelAllowed(this.store.snapshot().modelFilterRules, workspace, model);
+                assertModelAllowed(this.store.modelFilterRules(), workspace, model);
             }
-            catch {
+            catch (error) {
+                modelNotice = `你设的默认模型 ${model.label ?? `${model.provider}/${model.modelId}`} 被这个工作区的模型规则拦下了（${String(error instanceof Error ? error.message : error)}），这个会话改用 Pi 自己的默认模型。`;
                 model = undefined;
                 thinkingLevel = undefined;
             }
@@ -84,7 +104,7 @@ export class ConversationService {
             : { model, thinkingLevel };
         // `null` is intentional here: Store uses it to remove a workspace value that it
         // would otherwise have copied before applying the resolved configuration.
-        const defaults = { ...resolved, model: resolved.model ?? null, thinkingLevel: resolved.thinkingLevel ?? null };
+        const defaults = { ...resolved, model: resolved.model ?? null, thinkingLevel: resolved.thinkingLevel ?? null, ...(modelNotice ? { modelNotice } : {}) };
         const created = await this.store.createConversation(workspaceId, defaults);
         this.broadcaster.broadcastState();
         return created.id;
@@ -96,13 +116,13 @@ export class ConversationService {
      * a log and in a retry.
      */
     async autoRenameConversation(conversationId) {
-        const state = this.store.snapshot();
-        const conversation = state.conversations.find(item => item.id === conversationId);
+        const context = this.store.turnContext(conversationId);
+        const conversation = context?.conversation;
         if (!conversation)
             throw new Error("会话不存在");
         if (conversation.archivedAt)
             throw new Error("已归档的会话无法重命名，请先恢复会话");
-        const workspace = state.workspaces.find(item => item.id === conversation.workspaceId);
+        const workspace = context.workspace;
         if (!workspace)
             throw new Error("会话所属的工作区不存在");
         if (!this.runtime.summarizeConversation)
@@ -119,19 +139,21 @@ export class ConversationService {
     modelSelectionFor(conversationId) {
         if (!conversationId)
             return undefined;
-        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         return conversation?.model;
     }
     /**
      * Selects a conversation and broadcasts the catalog for that conversation's model.
      */
     async getConversationCatalog(conversationId) {
-        const conversation = this.store.snapshot().conversations.find(item => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         if (!conversation)
             throw new Error("找不到这个会话。");
-        const state = this.store.snapshot();
+        const workspace = this.store.workspaceForConversation(conversationId);
+        if (!workspace)
+            throw new Error("找不到这个工作区。");
         const catalog = await this.runtime.catalog();
-        assertModelAllowed(state.modelFilterRules, conversationWorkspace(state, conversationId), conversation.model ?? catalog.defaultModel);
+        assertModelAllowed(this.store.modelFilterRules(), workspace, conversation.model ?? catalog.defaultModel);
         return this.catalogService.getCatalog(conversation.model, conversationId);
     }
     async selectConversation(conversationId) {
@@ -156,7 +178,7 @@ export class ConversationService {
      * Renames a conversation.
      */
     async renameConversation(conversationId, name) {
-        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         if (conversation?.archivedAt)
             throw new Error("已归档的会话无法重命名，请先恢复会话");
         await this.store.renameConversation(conversationId, name);
@@ -176,8 +198,10 @@ export class ConversationService {
         const selection = option
             ? { provider: option.provider, modelId: option.modelId, label: option.label }
             : { provider, modelId, label: modelId };
-        const state = this.store.snapshot();
-        assertModelAllowed(state.modelFilterRules, conversationWorkspace(state, conversationId), selection);
+        const workspace = this.store.workspaceForConversation(conversationId);
+        if (!workspace)
+            throw new Error("找不到这个工作区。");
+        assertModelAllowed(this.store.modelFilterRules(), workspace, selection);
         await this.store.setConversationModel(conversationId, selection);
         this.broadcaster.broadcastState();
         await this.catalogService.broadcastCatalog(selection, conversationId);
@@ -186,7 +210,7 @@ export class ConversationService {
      * Sets the thinking level on a conversation, validating against the model's available levels.
      */
     async setThinking(conversationId, level) {
-        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         const catalog = await this.runtime.catalog(conversation?.model);
         if (catalog.source === "pi" && !catalog.levels.includes(level)) {
             throw this.catalogService.notOffered(`思考等级 ${level}`, catalog);
@@ -198,7 +222,7 @@ export class ConversationService {
      * Configures or clears the primary agent assigned to a conversation.
      */
     async setAgent(conversationId, agentId) {
-        const conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         if (!conversation)
             throw new Error("找不到这个会话。");
         if (agentId === null) {
@@ -209,7 +233,7 @@ export class ConversationService {
         const settings = await this.resolveAgentConfiguration(conversation, agentId);
         await this.store.setConversationConfiguration(conversationId, settings);
         this.broadcaster.broadcastState();
-        await this.catalogService.broadcastCatalog(this.store.snapshot().conversations.find((item) => item.id === conversationId)?.model, conversationId);
+        await this.catalogService.broadcastCatalog(this.store.conversation(conversationId)?.model, conversationId);
     }
     /**
      * Resolves the agent's model/thinking defaults against the catalog and the workspace's model rules.
@@ -217,7 +241,7 @@ export class ConversationService {
      * `workspaceId` must be passed when `conversation` is a workspace-shaped placeholder (the
      * createConversation path passes `{ id: workspaceId, ... }`), because matching a workspace by a
      * CONVERSATION id would never hit. Real conversations omit it: their workspace is resolved through
-     * `conversationWorkspace`, which reads `conversation.workspaceId`.
+     * `workspaceForConversation`, which resolves `conversation.workspaceId` without copying messages.
      */
     async resolveAgentConfiguration(conversation, agentId, workspaceId) {
         const agent = await this.runtime.agentFor?.({ id: conversation.id, agentId });
@@ -242,13 +266,12 @@ export class ConversationService {
                 throw this.catalogService.notOffered(`Agent ${agent.name} 指定的思考等级 ${agent.thinkingLevel}`, catalog);
             }
         }
-        const state = this.store.snapshot();
         const workspace = workspaceId
-            ? state.workspaces.find(item => item.id === workspaceId)
-            : conversationWorkspace(state, conversation.id);
+            ? this.store.workspace(workspaceId)
+            : this.store.workspaceForConversation(conversation.id);
         if (!workspace)
             throw new Error("找不到这个工作区。");
-        assertModelAllowed(state.modelFilterRules, workspace, selection ?? (await this.runtime.catalog()).defaultModel);
+        assertModelAllowed(this.store.modelFilterRules(), workspace, selection ?? (await this.runtime.catalog()).defaultModel);
         return { agentId: agent.id, model: selection, thinkingLevel: agent.thinkingLevel ?? conversation.thinkingLevel };
     }
     /**
@@ -257,21 +280,18 @@ export class ConversationService {
      */
     async revertMessage(conversationId, messageId, withdraw = false) {
         // CLAIMED FOR THE WHOLE CUT, and released in a `finally` however this ends - a revert that threw
-        // halfway must not leave the conversation permanently unable to send.
-        //
-        // WHY THE CLAIM EXISTS AT ALL. Truncating Pi's transcript is not instantaneous: it spawns a Pi to ask
-        // which file the session lives in, and only then writes. A message sent in that window would be
-        // appended to a history the model still reads in full - the very turn the person just withdrew would
-        // still be in its context, and the new answer would be built on top of it. So the send is what waits,
-        // NOT the text coming back: the browser restores the message optimistically and the person can edit
-        // it immediately, and what is refused is the next SEND until the cut has landed.
-        this.reverting.add(conversationId);
-        try {
-            return await this.cutTo(conversationId, messageId, withdraw);
-        }
-        finally {
-            this.reverting.delete(conversationId);
-        }
+        // halfway must not leave the conversation permanently unable to send. The per-conversation lane is
+        // separate from the WebSocket command queue: revert may start immediately, but two clicks against
+        // the same transcript still run strictly in order.
+        return this.serializeRevert(conversationId, async () => {
+            this.claimRevert(conversationId);
+            try {
+                return await this.cutTo(conversationId, messageId, withdraw);
+            }
+            finally {
+                this.releaseRevert(conversationId);
+            }
+        });
     }
     /**
      * The memory store, injected rather than constructed: `ActiveMemory` is built once in `index.ts` and
@@ -284,7 +304,7 @@ export class ConversationService {
     }
     /** Whether a revert is currently cutting this conversation's history. The send path asks. */
     isReverting(conversationId) {
-        return this.reverting.has(conversationId);
+        return (this.reverting.get(conversationId) ?? 0) > 0;
     }
     /**
      * CLAIM THE CUT AT THE MOMENT THE COMMAND ARRIVES, not at the moment it runs.
@@ -296,9 +316,9 @@ export class ConversationService {
      * started yet, and was admitted onto a transcript the cut was about to remove. The guard existed and
      * still could not see the case it was written for.
      *
-     * The claim therefore moves to the arrival edge, and `releaseRevert` below gives it back. A Set makes
-     * the two owners safe together: the service releases when the cut finishes, and the socket releases
-     * when the command finishes, and whichever runs first ends the claim - both are the same moment.
+     * The claim therefore moves to the arrival edge, and `releaseRevert` below gives it back. The claim is
+     * reference-counted: the service owns one count while the cut runs, and the socket owns one until the
+     * command finishes. This also remains safe when two browser tabs click revert before either cut ends.
      *
      * The cost is that a revert sitting behind a long queue refuses sends from the moment it ARRIVES
      * rather than from the moment it STARTS. That is the direction to err in: a send admitted during the
@@ -306,19 +326,46 @@ export class ConversationService {
      * is in its context.
      */
     claimRevert(conversationId) {
-        this.reverting.add(conversationId);
+        this.reverting.set(conversationId, (this.reverting.get(conversationId) ?? 0) + 1);
+        this.runService.holdHistoryCut?.(conversationId);
     }
     /** Give the claim back once the command that took it has finished, however it ended. */
     releaseRevert(conversationId) {
-        this.reverting.delete(conversationId);
+        const count = this.reverting.get(conversationId) ?? 0;
+        if (count <= 1)
+            this.reverting.delete(conversationId);
+        else
+            this.reverting.set(conversationId, count - 1);
+        this.runService.releaseHistoryCut?.(conversationId);
+    }
+    /**
+     * Serializes destructive transcript cuts for one conversation while keeping different conversations
+     * independent. The lane is intentionally local to this service: the socket layer can dispatch a
+     * revert without waiting behind unrelated commands, and this lane is the ordering boundary that the
+     * Pi file actually requires.
+     */
+    serializeRevert(conversationId, work) {
+        const previous = this.revertOps.get(conversationId) ?? Promise.resolve();
+        const next = previous.catch(() => undefined).then(work);
+        const lane = next.then(() => undefined, () => undefined);
+        this.revertOps.set(conversationId, lane);
+        void lane.finally(() => {
+            if (this.revertOps.get(conversationId) === lane)
+                this.revertOps.delete(conversationId);
+        });
+        return next;
     }
     async cutTo(conversationId, messageId, withdraw) {
         let plan = this.store.planRevert(conversationId, messageId, withdraw);
-        let conversation = this.store.snapshot().conversations.find((item) => item.id === conversationId);
+        // Revert is already a heavy path (Pi transcript truncation and memory cleanup), but it should not
+        // pay for cloning every other conversation merely to obtain these two rows. `turnContext` returns
+        // detached copies of exactly this conversation and its workspace and keeps the full-state clone
+        // out of the click-to-result path. This matters most when the user has many long historical tabs.
+        let context = this.store.turnContext(conversationId);
+        let conversation = context?.conversation;
+        let workspace = context?.workspace;
         if (!conversation)
             throw new Error("会话不存在");
-        const workspaceId = conversation.workspaceId;
-        const workspace = this.store.snapshot().workspaces.find((item) => item.id === workspaceId);
         if (!workspace)
             throw new Error(`会话所属的工作区 ${conversation.workspaceId} 已不存在，拒绝回退`);
         if (!this.runtime.revert) {
@@ -329,7 +376,8 @@ export class ConversationService {
             await this.runService.stopRun(conversationId);
             // The stopping turn may have recorded the user's Pi entry while it drained.
             plan = this.store.planRevert(conversationId, messageId, withdraw);
-            conversation = this.store.snapshot().conversations.find(item => item.id === conversationId);
+            context = this.store.turnContext(conversationId);
+            conversation = context?.conversation;
             if (!conversation)
                 throw new Error("会话不存在");
         }
@@ -344,6 +392,12 @@ export class ConversationService {
             boundaryEntryId: plan.boundaryEntryId,
             beforeBoundary: withdraw && Boolean(conversation.messages.find(item => item.id === messageId)?.piEntryId),
         });
+        // Capture both facts before Store splices the messages array. `store.conversation()` is a shallow
+        // copy, so reading them afterwards would read the already-shortened array and lose both the
+        // withdrawn message and the first memory timestamp that has to be removed (TEST-051).
+        const firstRemovedAt = conversation.messages[plan.boundaryIndex + (withdraw ? 0 : 1)]?.createdAt;
+        const withdrawn = conversation.messages.find(item => item.id === messageId);
+        const withdrawnContent = withdrawn ? { content: withdrawn.content, images: withdrawn.images } : undefined;
         const applied = await this.store.revertMessages(conversationId, messageId, withdraw);
         // THE MEMORY HALF OF THE REWIND, and the half that used to be missing. Everything above removes the
         // turn from Pi's file and from state.json; the memory store is a second durable copy of what the turn
@@ -351,11 +405,10 @@ export class ConversationService {
         // had withdrawn - measured by scripts/revert-real-pi.test.mjs, which answers a question about the
         // withdrawn turn correctly only with `SUPER_PI_MEMORY_ENABLED=0`.
         //
-        // The cut is the FIRST REMOVED message's timestamp, not the boundary's, because the boundary turn
-        // SURVIVES and anything it taught memory is still true. `revertMessages` has already removed the rest,
+        // The cut is the FIRST REMOVED message's timestamp. Revert keeps the boundary; withdraw removes
+        // it too, including memory written before its assistant placeholder existed. `revertMessages` has already removed the rest,
         // so this runs on data that is settled and cannot be racing the store's own writes.
-        const firstRemoved = conversation.messages[applied.boundaryIndex + 1];
-        const forgotten = firstRemoved ? await this.memory?.forgetAfter(conversationId, firstRemoved.createdAt) ?? 0 : 0;
+        const forgotten = firstRemovedAt ? await this.memory?.forgetAfter(conversationId, firstRemovedAt) ?? 0 : 0;
         // The recall index is a cache of the store's messages, and the store just lost several: left alone it
         // keeps answering the memory extension's searches with the withdrawn turns, so the model is told about
         // history the person reverted away even though the transcript, Pi's file and the memory store all
@@ -368,22 +421,20 @@ export class ConversationService {
             `Pi's file ${outcome.sessionFile} kept ${outcome.linesKept} line(s) and lost ${outcome.entriesDropped}; ` +
             `${forgotten} memory entr${forgotten === 1 ? "y" : "ies"} withdrawn with the turn.`);
         this.broadcaster.broadcastState();
-        const withdrawn = conversation.messages.find(item => item.id === messageId);
-        return withdraw && withdrawn ? { content: withdrawn.content, images: withdrawn.images } : undefined;
+        return withdraw ? withdrawnContent : undefined;
     }
     /**
      * Forks an existing conversation into a new parallel branch, cloning the Pi session.
      */
     async forkConversation(conversationId) {
-        const snapshot = this.store.snapshot();
-        const conversation = snapshot.conversations.find((item) => item.id === conversationId);
+        const conversation = this.store.conversation(conversationId);
         if (!conversation) {
             return { ok: false, message: "会话不存在" };
         }
         if (conversation.archivedAt) {
             return { ok: false, message: "已归档的会话无法分叉，请先恢复会话" };
         }
-        const workspace = snapshot.workspaces.find((item) => item.id === conversation.workspaceId);
+        const workspace = this.store.workspaceForConversation(conversationId);
         if (!workspace) {
             return { ok: false, message: `会话所属的工作区 ${conversation.workspaceId} 已不存在，拒绝分叉` };
         }

package/dist/server/application/run-service.d.ts

@@ -62,6 +62,8 @@ export declare class RunService {
     private agentsDir;
     private readonly workflows;
     private readonly questionWaiters;
+    /** A stop can race a late question callback; remember the stopped turn so it cannot park forever. */
+    private readonly cancelledQuestionConversations;
     private memory?;
     setMemory(memory: import("../active-memory.js").ActiveMemory): void;
     /**
@@ -83,6 +85,10 @@ export declare class RunService {
     setNameIndexes(indexes: Map<string, import("../file-name-index.js").FileNameIndex>): void;
     reviewMemoryBoundary(conversationId: string): void;
     private readonly activeRuns;
+    private readonly historyCutClaims;
+    holdHistoryCut(conversationId: string): void;
+    releaseHistoryCut(conversationId: string): void;
+    private assertHistoryAvailable;
     /**
      * The completion of the run currently holding a conversation's slot.
      *
@@ -182,6 +188,7 @@ export declare class RunService {
     private questionKey;
     private answerPayload;
     private settleQuestion;
+    private cancelQuestionWaiters;
     /**
      * THE `question` TOOL BLOCKS HERE, ON THE CALL THAT ASKED IT.
      *
@@ -223,6 +230,8 @@ export declare class RunService {
      * Checks whether a conversation has an active turn running.
      */
     isRunning(conversationId: string): boolean;
+    /** Returns true while a stop has been requested and the old producer is still unwinding. */
+    private isStopping;
     /**
      * Checks the session credential together with the application-level turn truth.
      *
@@ -250,6 +259,8 @@ export declare class RunService {
      * Stops an active turn run for a conversation.
      */
     stopRun(conversationId: string): Promise<void>;
+    /** Releases waits that can prevent Pi's abort from reaching its idle state. Idempotent by design. */
+    private cancelPendingRunInteractions;
     private stopRunUnsafe;
     /**
      * Handles queue snapshot updates from Pi RPC.
@@ -352,6 +363,8 @@ export declare class RunService {
      * stream it - which is why the two cases are expressed identically and cannot drift apart.
      */
     runConversationTurns(conversation: Conversation, workspace: Workspace, prompt: string, controller: AbortController, firstMessageId: string, initialImages?: MessageImage[]): Promise<void>;
+    /** Keep admission owned through final persistence and recheck the durable queue before releasing. */
+    private runUntilDrained;
     /**
      * Enqueues or starts execution for a user message.
      */