@evandu/super-pi 0.1.138 → 0.1.139

package/dist/server/runtime.js

@@ -411,6 +411,20 @@ export class PiRpcRuntime {
      * it was started.
      */
     pi;
+    /**
+     * HOW MANY LIVE SESSIONS THIS CONVERSATION HAS, and whether it has one at all.
+     *
+     * A reader of this number learns whether a conversation's context is still in Pi's memory. That is
+     * the fact a revert has to change: it rewrites the transcript on disk, and a live session keeps the
+     * OLD context in memory, so a session that outlived the revert is a model that answers from
+     * history the person withdrew - with nothing saying so.
+     *
+     * It is here because that failure is invisible from the outside: the file is shorter, the state is
+     * clean, and only the model knows something the reader cannot see.
+     */
+    liveSessionCount(conversationId) {
+        return this.sessionPool.has(conversationId) ? 1 : 0;
+    }
     canSteer(conversationId) {
         // A steer is only meaningful while a turn is RUNNING. A live session with nothing running is not a
         // steer target: there is no current answer for the message to be inserted into, and the transcript's
@@ -801,6 +815,7 @@ export class PiRpcRuntime {
         const session = await this.sessionPool.acquire({
             conversationId: conversation.id,
             cwd: resolve(cwd),
+            ...(conversation.piSessionFile ? { sessionFile: conversation.piSessionFile } : {}),
             agentId: conversation.agentId ?? null,
             extensionEnv: configuration.extensionEnv,
             ...(configuration.tools ? { tools: configuration.tools } : {}),
@@ -898,20 +913,18 @@ export class PiRpcRuntime {
         // The turn has its OWN controller, and the caller's signal aborts it. A run can span several turns
         // on one session, so "the caller wants this run to stop" and "Pi has to be told about the turn in
         // flight" are two different facts, and only the second one is Pi's business.
-        //
-        // `abortDone` is the abort's OWN promise, kept so `stop()` can await Pi actually going idle rather
-        // than merely having been ASKED to. `AgentSession.abort()` resolves when the session is idle, which
-        // is the fact an interrupt needs before the next prompt: prompting earlier is refused by Pi with
-        // "Agent is already processing".
         const turnController = new AbortController();
         let abortDone = Promise.resolve();
+        const abortSession = () => {
+            abortDone = session.abort().catch((error) => {
+                console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} threw: ${error instanceof Error ? error.message : "unknown error"}`);
+            });
+        };
         const abortTurn = () => {
             if (turnController.signal.aborted)
                 return;
             turnController.abort();
-            abortDone = session.abort().catch((error) => {
-                console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} threw: ${error instanceof Error ? error.message : "unknown error"}`);
-            });
+            abortSession();
         };
         const onAbort = () => { abortTurn(); };
         if (signal.aborted)
@@ -936,11 +949,29 @@ export class PiRpcRuntime {
             }
         };
         let firstTextSeen = false;
+        let markPromptFinished;
+        const promptFinished = new Promise((resolvePromise) => { markPromptFinished = resolvePromise; });
         const finished = (async () => {
             try {
-                const promptOptions = images?.length
-                    ? { images: images, preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) }
-                    : { preflightResult: () => traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize()) };
+                let promptAccepted = false;
+                const promptOptions = {
+                    ...(images?.length ? { images: images } : {}),
+                    preflightResult: (success) => {
+                        if (!success)
+                            return;
+                        promptAccepted = true;
+                        traceLatency(conversation.id, "session.prompt.accepted", latencyStartedAt, promptSize());
+                        // Pi calls this hook immediately BEFORE _runAgentPrompt synchronously marks the run
+                        // active. An abort during before_agent_start can have returned while Pi was idle. Repeat
+                        // it in the next microtask, after the active flag and the agent's controller exist. Waiting
+                        // for prompt() would wait for the entire answer and make the cancellation ineffective.
+                        if (turnController.signal.aborted)
+                            queueMicrotask(() => {
+                                if (!queue.isSettled)
+                                    abortSession();
+                            });
+                    },
+                };
                 // A STOP THAT ARRIVED WHILE THIS SESSION WAS BEING BUILT MUST NOT SEND THE PROMPT.
                 //
                 // The window between "the person pressed stop" and "the prompt goes out" is the whole session
@@ -962,38 +993,15 @@ export class PiRpcRuntime {
                     return;
                 }
                 await session.prompt(prompt, promptOptions);
-                // THE CANCELLATION MAY HAVE ARRIVED WHILE PI WAS PREPARING THE PROMPT.
-                //
-                // `session.prompt()` is not one step: it runs Pi's input handlers (the extensions' hooks -
-                // Super Pi's own memory search is one of them), the compaction check and the auth check before
-                // the agent's run starts. An abort that lands in that window finds a session that has NOT
-                // started running, so Pi's abort has nothing to abort - and the prompt goes on to the model,
-                // which answers a question the person cancelled.
-                //
-                // The run IS started by the time `prompt()` resolves, so the abort is said AGAIN here. The
-                // second one is the one that lands.
-                if (signal.aborted) {
-                    // The same 5s backstop `runtime.stop` uses: a wedged session must not hang the turn forever.
-                    await Promise.race([
-                        session.abort().catch((error) => {
-                            console.warn(`PiRpcRuntime: aborting the session of ${conversation.id} after a late cancellation threw: ${error instanceof Error ? error.message : "unknown error"}`);
-                        }),
-                        new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000)),
-                    ]);
-                }
-                // `prompt()` RETURNING IS NOT THE TURN ENDING. Pi's `prompt` resolves when the message has
-                // been ACCEPTED and the run has been started; the agent is still streaming, still executing
-                // tools, still settling. A turn that ended here would release the reader while the model was
-                // still producing, and the NEXT turn would arrive at a session Pi considers busy - which Pi
-                // refuses with "Agent is already processing".
-                //
-                // The turn's end is the `agent_settled` EVENT, and the queue is what carries it: the bridge
-                // pushes the terminal item when Pi settles, and the consumer below reads it. This promise
-                // waits for that signal, and the race with the prompt's own failure is what keeps a turn that
-                // never settles from hanging forever - a hung turn is a conversation that never answers.
-                // `prompt()` only means Pi accepted the request. Do not end this generator on a wall-clock
-                // timeout: the session may still be streaming or executing a tool, and ending here drops
-                // subsequent events while falsely allowing the next prompt onto a busy session.
+                markPromptFinished();
+                // Pi 0.86's prompt() awaits the whole agent run. Input hooks and extension commands can also
+                // handle it without starting a run, in which case no agent_settled event is emitted. Pi's idle
+                // flag distinguishes that legitimate completion from an asynchronous session adapter whose
+                // prompt promise returns before its stream finishes.
+                if (promptAccepted && session.isIdle === true && !queue.isSettled)
+                    queue.push({ kind: "end" });
+                // Drain every queued callback and delta before releasing this turn, even if Pi already went
+                // idle. An adapter that returns early must still provide the authoritative settled event.
                 await queue.settledSignal;
                 traceLatency(conversation.id, "session.settled", latencyStartedAt);
                 // THE REVERT BOUNDARY, recorded at the same moment the one-shot path records it: the turn has
@@ -1008,9 +1016,22 @@ export class PiRpcRuntime {
             catch (error) {
                 queue.fail(error instanceof Error ? error : new Error(String(error)));
             }
+            finally {
+                // Also release preparation failures and a turn cancelled before prompt() was called.
+                markPromptFinished();
+            }
         })();
-        this.activeTurns.set(conversation.id, { queue, unsubscribe, finished, abort: abortTurn, get abortDone() { return abortDone; } });
+        this.activeTurns.set(conversation.id, { queue, unsubscribe, finished, promptFinished, abort: abortTurn, get abortDone() { return abortDone; } });
         try {
+            // THE SPLITTER LIVES HERE, INSIDE THE LOOP THAT DRAINS THE QUEUE, and its thinking events are
+            // applied IN LINE rather than deferred. Two producers write into this one queue - Pi's session
+            // events (text deltas, tool calls) and the splitter's reading of the text - and the deferred way
+            // was to announce the second producer's findings at the END of the queue, which put "the thinking
+            // ended" BEHIND the tool call that Pi had announced after the very text that ended it. The tool
+            // callback then ran while the turn still thought it was thinking, and the call was filed inside
+            // the thinking block (UX-008). In line, the thinking lifecycle happens where its text sits, so
+            // the order Pi announced is the order the turn sees.
+            const splitter = new InlineThinkingSplitter();
             for (;;) {
                 const item = await queue.next();
                 if (item.kind === "text") {
@@ -1018,7 +1039,17 @@ export class PiRpcRuntime {
                         firstTextSeen = true;
                         traceLatency(conversation.id, "session.first-text", latencyStartedAt);
                     }
-                    yield item.delta;
+                    for (const segment of splitter.push(item.delta)) {
+                        if (segment.kind === "text") {
+                            yield segment.text;
+                        }
+                        else if (segment.kind === "thinking") {
+                            await input.onThinking?.(segment.text);
+                        }
+                        else {
+                            input.onThinkingEnd?.();
+                        }
+                    }
                     continue;
                 }
                 if (item.kind === "callback") {
@@ -1027,6 +1058,19 @@ export class PiRpcRuntime {
                 }
                 if (item.kind === "error")
                     throw item.error;
+                // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed
+                // region behind, and it belongs in the block rather than in the answer.
+                for (const segment of splitter.flush()) {
+                    if (segment.kind === "text") {
+                        yield segment.text;
+                    }
+                    else if (segment.kind === "thinking") {
+                        await input.onThinking?.(segment.text);
+                    }
+                    else {
+                        input.onThinkingEnd?.();
+                    }
+                }
                 break;
             }
         }
@@ -1220,27 +1264,20 @@ export class PiRpcRuntime {
      * transcript all work without knowing where the reasoning came from.
      */
     async *answer(input) {
-        const splitter = new InlineThinkingSplitter();
-        for await (const chunk of this.answerTurn(input)) {
-            for (const segment of splitter.push(chunk)) {
-                if (segment.kind === "text")
-                    yield segment.text;
-                else if (segment.kind === "thinking")
-                    await input.onThinking?.(segment.text);
-                else
-                    input.onThinkingEnd?.();
-            }
-        }
-        // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed
-        // region behind, and it belongs in the block rather than in the answer.
-        for (const segment of splitter.flush()) {
-            if (segment.kind === "text")
-                yield segment.text;
-            else if (segment.kind === "thinking")
-                input.onThinking?.(segment.text);
-            else
-                input.onThinkingEnd?.();
-        }
+        // THE SPLITTING HAPPENS INSIDE `answerTurn`, NOT HERE - and the reason is ORDER.
+        //
+        // The reasoning of an inline-thinking model is a `<think>…</think>` region INSIDE the answer text,
+        // so "the thinking ended" is a fact that only exists once the text carrying the closing tag has
+        // been read. When that fact was produced out here - one layer ABOVE the queue that carries Pi's
+        // events - it was announced by DEFERRED, and a deferred announcement lands at the END of the
+        // queue: BEHIND the tool call that Pi had already announced. So the tool callback ran while the
+        // turn still believed it was thinking, and the call was filed INSIDE the thinking block - a
+        // question that came after the answer was drawn inside the fold above it (UX-008).
+        //
+        // Splitting inside the queue's consumer keeps the two producers in ONE order: the thinking
+        // lifecycle derived from a piece of text happens where that text sits, and a tool call Pi
+        // announced after that text is announced after it too.
+        yield* this.answerTurn(input);
     }
     /**
      * THE TURN ITSELF, on whichever path it runs. See `answer`, which is the seam the reasoning is
@@ -1252,7 +1289,7 @@ export class PiRpcRuntime {
         // lifetimes, and folding them into a conversation's session would give them that conversation's
         // context. They are identified by the flags that describe exactly that.
         if (input.memoryReview || input.knowledgeRerank) {
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         // WHICH PATH A CONVERSATION RUNS ON, and why it is NOT decided by which Pi was named.
@@ -1275,7 +1312,7 @@ export class PiRpcRuntime {
         // anyone who started Super Pi the way most people do. The version number said 0.1.95; the speed said
         // 0.1.84.
         if (this.sessionMode === "oneshot") {
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         // The main path: a persistent session, reused across turns. When the SDK cannot be loaded the turn
@@ -1287,11 +1324,53 @@ export class PiRpcRuntime {
                 this.warnedMissingSdk = true;
                 console.warn(`PiRpcRuntime: ${support.reason} Falling back to one-shot Pi processes for conversations.`);
             }
-            yield* this.answerOneShot(input);
+            yield* this.answerOneShotWithInlineThinking(input);
             return;
         }
         yield* this.answerOnSession(input);
     }
+    /**
+     * THE ONE-SHOT PATH, WITH THE INLINE THINKING SPLIT OUT OF IT.
+     *
+     * WHY THIS IS A SEPARATE FUNCTION AND NOT A LINE IN `answerTurn`. The reasoning of an inline-thinking
+     * model is a `<think>…</think>` region INSIDE the answer text, so splitting it is not a formatting
+     * step - it is a reading of the text, and the facts it produces ("the thinking started", "the thinking
+     * ended") belong where the text is read.
+     *
+     * WHEN IT WAS FORGOTTEN, IT COST THE PRODUCT A BUG. The splitter used to live one layer up, in
+     * `answer()`, where it covered EVERY path. It was moved down into the SDK session path to fix the
+     * ordering of "the thinking ended" against a tool call (UX-008), and in that move the ONE-SHOT
+     * CONVERSATION path - the path a server without the Pi SDK falls back to, and the path the whole test
+     * suite drives - lost the splitting altogether: the `<think>` tags reached the answer verbatim.
+     * `scripts/inline-thinking.test.mjs` caught it; the SDK path was fine, which is why it took a test
+     * suite running the other path to notice.
+     *
+     * SO EVERY ONE-SHOT PATH GOES THROUGH HERE, and the session path keeps its own splitter inside the
+     * queue's consumer, where the ORDER of "thinking ended" and a tool call is decided.
+     */
+    async *answerOneShotWithInlineThinking(input) {
+        const splitter = new InlineThinkingSplitter();
+        for await (const chunk of this.answerOneShot(input)) {
+            for (const segment of splitter.push(chunk)) {
+                if (segment.kind === "text")
+                    yield segment.text;
+                else if (segment.kind === "thinking")
+                    await input.onThinking?.(segment.text);
+                else
+                    await input.onThinkingEnd?.();
+            }
+        }
+        // THE END OF THE TURN. A model that was still thinking when the turn ended leaves an unclosed region
+        // behind, and it belongs in the block rather than in the answer.
+        for (const segment of splitter.flush()) {
+            if (segment.kind === "text")
+                yield segment.text;
+            else if (segment.kind === "thinking")
+                await input.onThinking?.(segment.text);
+            else
+                await input.onThinkingEnd?.();
+        }
+    }
     /**
      * The one-shot path: a fresh child process for a single turn.
      *
@@ -1967,6 +2046,23 @@ export class PiRpcRuntime {
      * revert is a rare, deliberate act, and a second Pi answers in well under a second. It buys the
      * elimination of an entire class of "we truncated the wrong file and nothing said so" failures.
      */
+    /**
+     * THE LIVE SESSION MUST GO WHEN A REVERT REWRITES THE TRANSCRIPT.
+     *
+     * A revert rewrites Pi's transcript on disk. A live Pi session holds the OLD context in memory, and
+     * nothing in Pi would notice the difference: the model would keep answering from history the user
+     * has just withdrawn, while `state.json` and the file on disk both said it was gone. Three views of
+     * the conversation, two of them wrong, and no error anywhere. So the session is destroyed and the
+     * next turn rebuilds it from the truncated file.
+     *
+     * THIS IS A CORRECTNESS REQUIREMENT, NOT AN OPTIMIZATION, and it is why it lives in one place
+     * called by EVERY branch of `revert`. It used to be inline in two of the three, and the third -
+     * the one taken when the transcript path was not cached - missed it, so a session reverted before
+     * its path was ever learned kept talking about the withdrawn turn with nothing saying so.
+     */
+    async evictAfterRevert(conversationId) {
+        await this.sessionPool.evict(conversationId);
+    }
     async revert({ conversation, cwd, boundaryEntryId, beforeBoundary }) {
         if (this.runs.has(conversation.id) || this.activeTurns.has(conversation.id))
             throw new Error("这个会话还有一轮任务在跑，先停止它再回退");
@@ -1981,14 +2077,7 @@ export class PiRpcRuntime {
             const exists = await stat(cached).catch(() => undefined);
             if (exists?.isFile()) {
                 const result = await truncateSessionFile(cached, boundaryEntryId, conversation.id, beforeBoundary);
-                // THE SESSION MUST GO. The truncation above changed the transcript ON DISK, and a live session
-                // holds the OLD context in memory. Nothing in Pi would notice the difference: the model would
-                // keep answering from history the user has just withdrawn, while `state.json` and the file on
-                // disk both said it was gone. Three views of the conversation, two of them wrong, and no error
-                // anywhere - so the session is destroyed here and the next turn rebuilds it from the truncated
-                // file. This is the one place where eviction is a correctness requirement and not an
-                // optimization.
-                await this.sessionPool.evict(conversation.id);
+                await this.evictAfterRevert(conversation.id);
                 return { sessionFile: cached, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
             }
         }
@@ -2014,7 +2103,7 @@ export class PiRpcRuntime {
             if (!found?.isFile())
                 throw new Error(`Pi 还没有为这个会话建立记录文件（${resolved}），没有可以回退的历史。`);
             const result = await truncateSessionFile(resolved, boundaryEntryId, conversation.id, beforeBoundary);
-            await this.sessionPool.evict(conversation.id);
+            await this.evictAfterRevert(conversation.id);
             return { sessionFile: resolved, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
         }
         // NO agent flags and NO extension on this spawn. It sends no prompt and must leave nothing behind:
@@ -2065,6 +2154,7 @@ export class PiRpcRuntime {
         if (!exists?.isFile())
             throw new Error(`Pi 还没有为这个会话建立记录文件（${sessionFile}），没有可以回退的历史。`);
         const result = await truncateSessionFile(sessionFile, boundaryEntryId, conversation.id, beforeBoundary);
+        await this.evictAfterRevert(conversation.id);
         return { sessionFile, linesKept: result.linesKept, entriesDropped: result.entriesDropped };
     }
     /**
@@ -2236,12 +2326,21 @@ export class PiRpcRuntime {
         const turn = this.activeTurns.get(conversationId);
         if (turn) {
             turn.abort();
-            // WAIT FOR PI TO ACTUALLY GO IDLE, not merely to have been asked. `AgentSession.abort()` resolves
-            // when the session is idle, and idle is the fact the caller needs: an interrupt that starts the
-            // next turn before this one has unwound is refused by Pi with "Agent is already processing". The
-            // backstop keeps a wedged session from hanging a stop forever - the turn's own 5s safety net then
-            // still ends it.
-            await Promise.race([turn.abortDone, new Promise((resolvePromise) => setTimeout(resolvePromise, 5_000))]);
+            // abort() can resolve during prompt preflight, before any agent exists. Await the prompt call
+            // as well, which includes that preflight and the actual run in Pi 0.86. For adapters returning
+            // earlier, abortDone still waits for idle. Do not wait for the caller to drain the event queue:
+            // a caller may stop while paused at a yielded delta. A deadline bounds only this request;
+            // RunService retains the real run slot until the reader ends.
+            let stopDeadline;
+            try {
+                await Promise.race([Promise.all([turn.promptFinished, turn.abortDone]), new Promise((resolvePromise) => {
+                        stopDeadline = setTimeout(resolvePromise, 5_000);
+                    })]);
+            }
+            finally {
+                if (stopDeadline !== undefined)
+                    clearTimeout(stopDeadline);
+            }
             return;
         }
         // The one-shot path: a child process that has to be told to abort over its stdin.

package/dist/server/store.d.ts

@@ -119,6 +119,29 @@ export declare class Store {
      */
     workspaceForConversation(conversationId: string): Workspace | undefined;
     workspace(workspaceId: string): Workspace | undefined;
+    /** Read the app-wide default without cloning conversations or transcripts. */
+    defaultModel(): ModelSelection | undefined;
+    /** Read one detached conversation for lifecycle operations. */
+    conversation(conversationId: string): Conversation | undefined;
+    /** Return every pending question in one conversation without cloning unrelated history. */
+    pendingQuestions(conversationId: string): Array<{
+        messageId: string;
+        index: number;
+        question: ToolCallQuestion;
+    }>;
+    /**
+     * THE SCHEDULED TASKS, WITHOUT CLONING THE STATE TO FIND THEM.
+     *
+     * The same argument as the readers above, with a sharper edge: the scheduled-task clock sweeps
+     * every fifteen seconds and used to read its three-to-zero tasks through `snapshot()` - a deep
+     * clone of the whole application, every fifteen seconds, whether the user has any scheduled task or
+     * not. On a server holding a long transcript that is a full copy of the app four times a minute,
+     * produced for a list that is usually empty.
+     *
+     * The tasks are returned as a shallow copy of the array: the sweep reads `enabled` and
+     * `nextRunAt` and then hands the whole task back to the store, which owns the real one.
+     */
+    scheduledTasks(): ScheduledTask[];
     /** Small detached rows used when refreshing each conversation's scoped model catalog. */
     catalogConversationTargets(): Array<Pick<Conversation, "id" | "archivedAt" | "model">>;
     /** Clone only one workspace's transcripts, never unrelated workspaces or app state. */
@@ -239,11 +262,14 @@ export declare class Store {
      * Filtering HERE, in one place, rather than in every reader, is what keeps the client dumb: the
      * sidebar renders `state.workspaces` and never has to know that a closed workspace exists.
      */
-    clientState(): AppState;
+    clientState(scope?: {
+        conversationId?: string;
+    }): AppState;
     createConversation(workspaceId: string, configuration?: {
         agentId?: string;
         model?: ModelSelection | null;
         thinkingLevel?: string | null;
+        modelNotice?: string;
     }): Promise<Conversation>;
     /**
      * Copies a conversation into a NEW one, under an id the caller has already minted.
@@ -480,6 +506,20 @@ export declare class Store {
      * Every field is `undefined`-tested for the same reason `settleToolCall` does it: `""` and `[]` are
      * values a tool can genuinely produce, and treating them as "not reported" would erase a real answer.
      */
+    /**
+     * THE TOOL-CALL WRITES, PERSISTED AS ONE MESSAGE INSTEAD OF THE WHOLE APPLICATION.
+     *
+     * A tool call's lifecycle touches exactly ONE thing: the `toolCalls` array of ONE message. The
+     * write used to be `this.persist()`, which hands the ENTIRE state to the repository - every
+     * workspace, every conversation, every message of every conversation - to be serialized and
+     * written. A turn that calls five tools therefore wrote the whole application ten to fifteen
+     * times, and every one of those writes was proportional to the whole history rather than to the
+     * one row that changed (LAT-020).
+     *
+     * `message.replace` is the transaction that means 「this one message now reads like this」, and it
+     * is exactly the write this is: the row's content did not change, only its tool calls did.
+     */
+    private persistToolCallMessage;
     updateToolCall(conversationId: string, messageId: string, index: number, patch: {
         label?: string;
         detail?: string;
@@ -487,6 +527,9 @@ export declare class Store {
         live?: string;
         preparing?: boolean;
         question?: ToolCallQuestion;
+        at?: number;
+        thinkingAt?: number;
+        thinkingBlock?: number | null;
         backgroundTask?: ToolCallBlock["backgroundTask"];
     }): Promise<ToolCallBlock[]>;
     /**