@evandu/super-pi 0.1.76 → 0.1.78

package/dist/client/index.html

@@ -8,8 +8,8 @@
     <link rel="alternate icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
     <title>Super Pi</title>
-    <script type="module" crossorigin src="/assets/index-CHRkbLTs.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-CKdlMXJt.css">
+    <script type="module" crossorigin src="/assets/index-DCtDhAuw.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-C7wCG7Jn.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/application/run-service.d.ts

@@ -17,6 +17,18 @@ export interface SubagentDispatchRequestBody {
     role?: string;
     /** The per-turn dispatch capability, presented by the primary agent's extension. See `capability.ts`. */
     capability?: string;
+    /**
+     * Pi's id for the tool call that asked for this dispatch, which the extension already receives as
+     * `execute`'s first argument and previously discarded. The server resolves it to a position in the
+     * dispatching message so the card renders AT THE CALL rather than at a point in time.
+     *
+     * UNVERIFIED AND THEREFORE INERT: it is a claim about which row a card belongs in, not a credential,
+     * so it is checked against nothing. An id that resolves to no call is simply no anchor. That is
+     * deliberate - this field crosses a boundary a model can reach, and a sub-agent inventing an id to park
+     * its card inside somebody else's tool call would be a way to make a run look like it belongs to work it
+     * never did. A position is not a permission, and it grants none.
+     */
+    toolCallId?: string;
 }
 /**
  * A whole orchestrated plan, as it arrives over the wire.
@@ -32,6 +44,9 @@ export interface WorkflowRunRequestBody {
     steps?: unknown;
     /** The per-turn dispatch capability, presented by the primary agent's extension. See `capability.ts`. */
     capability?: string;
+    /** Pi's id for the tool call that asked for this, and resolved the same inert way as a sub-agent
+     *  dispatch's - a position in the transcript, never a permission. */
+    toolCallId?: string;
 }
 /**
  * Service managing execution of conversation turns, message queueing,
@@ -49,6 +64,36 @@ export declare class RunService {
     setMemory(memory: import("../active-memory.js").ActiveMemory): void;
     reviewMemoryBoundary(conversationId: string): void;
     private readonly activeRuns;
+    /**
+     * WHERE EACH TOOL CALL LANDED, per conversation, for as long as the turn that made it is still running.
+     *
+     * Keyed by Pi's own `toolCallId` - the id the model sees, which Pi also hands to the tool as `execute`'s
+     * first argument. That is the only handle shared by the two halves of a dispatch: the server learns the
+     * call exists while streaming the turn, and learns it was a sub-agent only when the child, running in a
+     * SEPARATE process, posts back over HTTP. `rowByToolCallId` already maps the same key to a row, but it is
+     * a local of `streamTurn` and the dispatch arrives in `dispatchTask` - a different closure, reached by an
+     * HTTP request. Without a bridge between them the server could only stamp a card with a start time, and
+     * a card sorted by start time lands BELOW every message still streaming after the call that asked for it.
+     *
+     * The outer map is per conversation rather than global so two conversations cannot read each other's
+     * positions, and it is dropped when the turn ends because that is when the fact stops being true: a
+     * dispatch that arrives after its turn has finished gets no anchor, which renders as it always did.
+     */
+    private readonly toolCallLanes;
+    private readonly toolCallWaiters;
+    private readonly toolCallSites;
+    /** Records that Pi's `toolCallId` became row `row` of `messageId`. */
+    private noteToolCallSite;
+    /**
+     * The call a dispatch belongs to, as the two fields a card carries. Absent - rather than row zero - when
+     * there is no call to point at: a person pressing 派子智能体 has no tool call, a dispatch from an older
+     * extension has no id, and a dispatch that landed after its turn ended has outlived the map.
+     */
+    originForToolCall(conversationId: string, toolCallId: string | undefined): {
+        originMessageId: string;
+        originCallRow: number;
+    } | undefined;
+    waitForToolCall(conversationId: string, toolCallId: string | undefined): Promise<ReturnType<RunService["originForToolCall"]>>;
     private execService;
     setExecService(execService: import("../exec-service.js").ExecService): void;
     /**

package/dist/server/application/run-service.js

@@ -58,6 +58,70 @@ export class RunService {
             this.memory?.review(conversation);
     }
     activeRuns = new Map();
+    /**
+     * WHERE EACH TOOL CALL LANDED, per conversation, for as long as the turn that made it is still running.
+     *
+     * Keyed by Pi's own `toolCallId` - the id the model sees, which Pi also hands to the tool as `execute`'s
+     * first argument. That is the only handle shared by the two halves of a dispatch: the server learns the
+     * call exists while streaming the turn, and learns it was a sub-agent only when the child, running in a
+     * SEPARATE process, posts back over HTTP. `rowByToolCallId` already maps the same key to a row, but it is
+     * a local of `streamTurn` and the dispatch arrives in `dispatchTask` - a different closure, reached by an
+     * HTTP request. Without a bridge between them the server could only stamp a card with a start time, and
+     * a card sorted by start time lands BELOW every message still streaming after the call that asked for it.
+     *
+     * The outer map is per conversation rather than global so two conversations cannot read each other's
+     * positions, and it is dropped when the turn ends because that is when the fact stops being true: a
+     * dispatch that arrives after its turn has finished gets no anchor, which renders as it always did.
+     */
+    toolCallLanes = new Map();
+    toolCallWaiters = new Map();
+    toolCallSites = new Map();
+    /** Records that Pi's `toolCallId` became row `row` of `messageId`. */
+    noteToolCallSite(conversationId, toolCallId, messageId, row) {
+        if (!toolCallId)
+            return;
+        let sites = this.toolCallSites.get(conversationId);
+        if (!sites) {
+            sites = new Map();
+            this.toolCallSites.set(conversationId, sites);
+        }
+        sites.set(toolCallId, { messageId, row });
+        for (const wake of this.toolCallWaiters.get(`${conversationId}:${toolCallId}`) ?? [])
+            wake();
+    }
+    /**
+     * The call a dispatch belongs to, as the two fields a card carries. Absent - rather than row zero - when
+     * there is no call to point at: a person pressing 派子智能体 has no tool call, a dispatch from an older
+     * extension has no id, and a dispatch that landed after its turn ended has outlived the map.
+     */
+    originForToolCall(conversationId, toolCallId) {
+        if (!toolCallId)
+            return undefined;
+        const site = this.toolCallSites.get(conversationId)?.get(toolCallId);
+        return site ? { originMessageId: site.messageId, originCallRow: site.row } : undefined;
+    }
+    async waitForToolCall(conversationId, toolCallId) {
+        const origin = this.originForToolCall(conversationId, toolCallId);
+        if (origin) {
+            await this.toolCallLanes.get(conversationId);
+            return origin;
+        }
+        if (!toolCallId || !this.activeRuns.has(conversationId))
+            return undefined;
+        // The tool POST and Pi's stdout use independent transports. HTTP may win even
+        // though Pi emitted tool_execution_start first; wait for that event, not a clock position.
+        const key = `${conversationId}:${toolCallId}`;
+        await new Promise(resolve => {
+            const waiters = this.toolCallWaiters.get(key) ?? new Set();
+            const wake = () => { clearTimeout(timer); waiters.delete(wake); if (!waiters.size)
+                this.toolCallWaiters.delete(key); resolve(); };
+            const timer = setTimeout(wake, 2000);
+            waiters.add(wake);
+            this.toolCallWaiters.set(key, waiters);
+        });
+        await this.toolCallLanes.get(conversationId);
+        return this.originForToolCall(conversationId, toolCallId);
+    }
     execService;
     setExecService(execService) { this.execService = execService; }
     /**
@@ -78,6 +142,15 @@ export class RunService {
         const message = `<task id="${sessionId}" state="${exitCode === 0 ? "completed" : "error"}" kind="exec">\n<summary>${task.title}</summary>\n<${tag}>\n${body}</${tag}>\n</task>`;
         void this.trackDetached((async () => {
             try {
+                // Keep the dispatch card at its call after the running-task list is cleaned up.
+                // The result message below keeps its separate arrival position in the transcript.
+                if (task.originMessageId !== undefined && task.originCallRow !== undefined
+                    && this.store.snapshot().conversations.find(conversation => conversation.id === task.conversationId)
+                        ?.messages.find(message => message.id === task.originMessageId)?.toolCalls?.[task.originCallRow]) {
+                    const toolCalls = await this.store.updateToolCall(task.conversationId, task.originMessageId, task.originCallRow, { backgroundTask: { id: sessionId, status: exitCode === 0 ? "completed" : "failed", output: (stdout + stderr).slice(-512_000), exitCode } });
+                    this.broadcaster.broadcast({ type: "message.tools", conversationId: task.conversationId, messageId: task.originMessageId, toolCalls });
+                }
+                this.broadcaster.broadcast({ type: "exec.exit", sessionId, exitCode, stdout, stderr });
                 await this.store.addToolMessage(task.conversationId, message);
                 this.broadcaster.broadcastState();
             }
@@ -367,6 +440,7 @@ export class RunService {
             }).catch((error) => {
                 console.warn(`Super Pi: recording ${what} failed: ${error instanceof Error ? error.message : "unknown error"}`);
             });
+            this.toolCallLanes.set(conversation.id, pendingTools);
         };
         // HOW MUCH OF THE ANSWER HAD BEEN SPOKEN WHEN EACH CALL WAS ANNOUNCED, counted HERE rather than read
         // from the store when the write runs.
@@ -383,6 +457,18 @@ export class RunService {
         // The running total is what lets a call made during reasoning anchor inside the thinking block rather than
         // after it, which is the order the events had.
         let thought = 0;
+        let thinkingActive = false;
+        let thinkingBlock = -1;
+        let thinkingAnswerAt = -1;
+        let thinkingInterrupted = false;
+        const currentThinkingBlock = () => {
+            if (thinkingActive)
+                return thinkingBlock;
+            // An outside call separates two thoughts even if no answer text was emitted.
+            if (thinkingBlock >= 0)
+                thinkingInterrupted = true;
+            return null;
+        };
         /**
          * ONE COUNTER FOR EVERY ROW, AND THE ONLY WAY A ROW NUMBER IS EVER MADE.
          *
@@ -432,6 +518,7 @@ export class RunService {
             // this one was not, and the JSON persistence backend's slower writes widen the window enough for
             // the browser test to catch the difference between capturing and reading.
             const thinkingAt = thought;
+            const callThinkingBlock = currentThinkingBlock();
             // The block says WHICH TOOL and WHAT IT IS AIMED AT as soon as either is known. 「工具」 as the name
             // and 「正在生成参数…」 as the only line below it told a reader nothing for the seconds a large `edit`
             // spends writing its replacement text - and by the time the file path was on screen, the block looked
@@ -443,6 +530,7 @@ export class RunService {
                 preparing: true,
                 at,
                 thinkingAt,
+                thinkingBlock: callThinkingBlock,
             }));
             preparingRows.set(call.contentIndex, { row, name: call.name });
         };
@@ -466,18 +554,23 @@ export class RunService {
                 // The id is bound to the row it was FILLED IN, not to a row of the caller's own counting. Every
                 // later update and the outcome resolve through this binding, so a wrong number here is a block
                 // that never settles and one that belongs to a different call.
-                if (call.id)
+                if (call.id) {
                     rowByToolCallId.set(call.id, row);
+                    this.noteToolCallSite(conversation.id, call.id, assistant.id, row);
+                }
                 enqueueTools("a tool call", () => this.store.updateToolCall(conversation.id, assistant.id, row, { label: call.name, detail: call.detail, args: call.args, live: "", preparing: false, ...(call.question ? { question: call.question } : {}) }));
                 return;
             }
             const row = rows++;
-            if (call.id)
+            if (call.id) {
                 rowByToolCallId.set(call.id, row);
+                this.noteToolCallSite(conversation.id, call.id, assistant.id, row);
+            }
             // Captured for the same reason as the preparing path above: the queued append must anchor the call
             // where it was MADE, not where the queue happened to be when it drained.
             const thinkingAt = thought;
-            enqueueTools("a tool call", () => this.store.appendToolCall(conversation.id, assistant.id, { label: call.name, detail: call.detail, args: call.args, at, thinkingAt, ...(call.question ? { question: call.question } : {}) }));
+            const callThinkingBlock = currentThinkingBlock();
+            enqueueTools("a tool call", () => this.store.appendToolCall(conversation.id, assistant.id, { label: call.name, detail: call.detail, args: call.args, at, thinkingAt, thinkingBlock: callThinkingBlock, ...(call.question ? { question: call.question } : {}) }));
         };
         const onToolUpdate = (call) => {
             const index = call.id ? rowByToolCallId.get(call.id) : undefined;
@@ -508,12 +601,36 @@ export class RunService {
                 // BROADCAST AND KEEP. It used to only broadcast, into an event no one handled - so the reasoning
                 // reached nobody, live or afterwards. Both halves now happen: the browser draws the delta as it
                 // arrives, and the message keeps it so the finished turn has something to go back to.
+                //
+                // `active: true` on every delta is not a field Pi sent - it is the conclusion Super Pi draws from
+                // having received one. Pi announces the END of reasoning with `thinking_end` and puts nothing on
+                // the delta, so these two halves together are the whole lifecycle.
                 onThinking: (delta) => {
+                    if (!delta)
+                        return;
+                    const newBlock = thinkingAnswerAt !== spoken || thinkingInterrupted;
+                    if (newBlock) {
+                        thinkingBlock++;
+                        thinkingAnswerAt = spoken;
+                    }
+                    thinkingInterrupted = false;
+                    thinkingActive = true;
+                    this.store.setThinkingActiveLive(conversation.id, assistant.id, true);
                     thought += delta.length;
-                    this.store.appendThinkingDeltaLive(conversation.id, assistant.id, delta, spoken);
-                    this.broadcaster.broadcast({ type: "message.thinking", conversationId: conversation.id, messageId: assistant.id, delta, active: true, at: spoken });
+                    this.store.appendThinkingDeltaLive(conversation.id, assistant.id, delta, spoken, newBlock);
+                    this.broadcaster.broadcast({ type: "message.thinking", conversationId: conversation.id, messageId: assistant.id, delta, active: true, at: spoken, blockIndex: thinkingBlock });
                     scheduleCheckpoint();
                 },
+                // AN EMPTY DELTA THAT ONLY CARRIES THE FLAG. `thinking_end` is a fact the browser needs and not
+                // text, so it rides as a delta of length zero and the client is required to leave `thinking` and
+                // `thinkingBlocks` alone when it sees one. Without that rule this event appends an EMPTY fold
+                // block to every turn whose second reasoning run starts after the answer has already begun,
+                // because that block's `at` then differs from the previous one's.
+                onThinkingEnd: () => {
+                    thinkingActive = false;
+                    this.store.setThinkingActiveLive(conversation.id, assistant.id, false);
+                    this.broadcaster.broadcast({ type: "message.thinking", conversationId: conversation.id, messageId: assistant.id, delta: "", active: false });
+                },
                 images,
             })) {
                 this.store.appendAssistantDeltaLive(conversation.id, assistant.id, delta);
@@ -529,8 +646,20 @@ export class RunService {
         finally {
             // A failed or cancelled producer still owns live text and a checkpoint timer.
             // Drain the lane before the caller changes status or permits another turn.
+            this.store.setThinkingActiveLive(conversation.id, assistant.id, false);
+            checkpointPending = true;
             checkpointNow();
             await pendingTools;
+            // The positions are facts ABOUT THIS TURN and stop being true when it ends, so they go with it.
+            // A dispatch whose POST arrives after this line gets no anchor and renders where it always did -
+            // which is the honest outcome, because by then the call that asked for it may no longer be on screen.
+            this.toolCallSites.delete(conversation.id);
+            this.toolCallLanes.delete(conversation.id);
+            for (const [key, waiters] of this.toolCallWaiters) {
+                if (key.startsWith(`${conversation.id}:`))
+                    for (const wake of waiters)
+                        wake();
+            }
         }
         if (!controller.signal.aborted) {
             const completed = this.store.snapshot().conversations.find(c => c.id === conversation.id);
@@ -741,6 +870,9 @@ export class RunService {
         if (parent)
             checkSubagentDepth(1);
         const backgroundId = body.background === true ? newSubagentRunId() : undefined;
+        // WHERE THE CARD GOES. Resolved once, here, and written onto the record at creation - the run is born
+        // knowing where it was asked for, so no later update has to supply it and a card cannot drift.
+        const origin = await this.waitForToolCall(conversationId, body.toolCallId);
         const dispatch = this.subagents.dispatch({
             ...(backgroundId ? { id: backgroundId } : {}),
             conversationId: conversation.id,
@@ -749,6 +881,7 @@ export class RunService {
             cwd,
             model: conversation.model,
             dispatchedBy: "model",
+            ...(origin ? origin : {}),
             ...(parent ? { parentRunId: parent.id } : {}),
             depth: authoritativeDepth,
             ...(body.loopId ? { loopId: body.loopId } : {}),
@@ -764,6 +897,7 @@ export class RunService {
                 status: "running",
                 startedAt: new Date().toISOString(),
                 resultBlockId: backgroundId,
+                ...(origin ? origin : {}),
             });
             this.broadcaster.broadcastState();
             void this.trackDetached(dispatch.then(async (run) => {

package/dist/server/http-server.js

@@ -18,6 +18,41 @@ const MIME_TYPES = {
     ".ico": "image/x-icon",
     ".png": "image/png",
 };
+/**
+ * The only browser API a mounted tool needs.  It is served beneath the tool's own
+ * mount, so every request stays relative to that mount and the server can derive
+ * the tool identity without exposing a registry id, a workspace, or a credential.
+ */
+function toolBrowserSdk() {
+    return String.raw `(() => {
+  const request = async (path, init) => {
+    const response = await fetch(path, init);
+    let body;
+    try { body = await response.json(); } catch { body = { error: "Super Pi returned an unreadable response" }; }
+    if (!response.ok) throw new Error(body && body.error ? body.error : "Tool request failed (HTTP " + response.status + ")");
+    return body;
+  };
+  const api = {
+    run: (params = {}) => request("./api/run", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ params }) }),
+    get: (runId) => request("./api/runs/" + encodeURIComponent(runId), { method: "GET" }),
+    cancel: (runId) => request("./api/runs/" + encodeURIComponent(runId), { method: "DELETE" }),
+    wait: async (runId, { intervalMs = 250, signal } = {}) => {
+      for (;;) {
+        if (signal && signal.aborted) throw new DOMException("Aborted", "AbortError");
+        const run = await api.get(runId);
+        if (run.status !== "running") return run;
+        await new Promise((resolve, reject) => {
+          const timer = setTimeout(resolve, Math.max(50, intervalMs));
+          if (signal) signal.addEventListener("abort", () => { clearTimeout(timer); reject(new DOMException("Aborted", "AbortError")); }, { once: true });
+        });
+      }
+    },
+    runAndWait: async (params = {}, options) => { const run = await api.run(params); return api.wait(run.id, options); },
+  };
+  Object.freeze(api);
+  Object.defineProperty(window, "SuperPiTool", { value: api, writable: false, configurable: false });
+})();`;
+}
 /**
  * Checks if the remote address is a local loopback interface.
  */
@@ -138,17 +173,18 @@ export function createHttpServer(options) {
     return createServer(async (request, response) => {
         // Internal tools use a narrow per-run capability, never the global management token.
         const requestPath = request.url?.split("?")[0] ?? "";
-        const opaqueToolApi = requestPath.startsWith("/api/tools/") && request.headers.origin === "null";
-        // Tool registration is checked after its JSON body is parsed: an agent proves its turn capability
-        // there, while an interactive browser uses the ordinary server access token.
-        if (requestPath !== "/api/memory/tool" && requestPath !== "/api/tools" && !opaqueToolApi && !isAuthorized(request, accessToken)) {
+        // Tool REGISTRATION is checked after its JSON body is parsed: an agent proves its turn capability
+        // there, while an interactive browser uses the ordinary server access token. Reading and DELETING
+        // the registry have no such second channel, so they are NOT exempted here and fall through to the
+        // ordinary token check below - exempting the whole path is what let any local process list and
+        // delete a person's mounted tools on a server that had `SUPER_PI_ACCESS_TOKEN` set.
+        if (requestPath !== "/api/memory/tool" && (requestPath !== "/api/tools" || request.method !== "POST") && !requestPath.startsWith("/tools/") && !isAuthorized(request, accessToken)) {
             response.writeHead(401, { "www-authenticate": "Bearer" }).end("Authentication required");
             return;
         }
         const url = new URL(request.url ?? "/", `http://${request.headers.host ?? "localhost"}`);
         const remote = request.socket.remoteAddress ?? "";
         const json = (status, body) => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store" }); response.end(JSON.stringify(body)); };
-        const toolJson = (status, body) => { response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "access-control-allow-origin": "null", "vary": "Origin" }); response.end(JSON.stringify(body)); };
         if (url.pathname === "/api/tools") {
             try {
                 if (request.method === "GET") {
@@ -161,7 +197,10 @@ export function createHttpServer(options) {
                         json(400, { error: "id required" });
                         return;
                     }
-                    json((await toolRegistry.remove(id)) ? 200 : 404, { ok: true });
+                    const removed = await toolRegistry.remove(id);
+                    if (removed)
+                        broadcaster.broadcast({ type: "tools.updated", tools: await toolRegistry.list() });
+                    json(removed ? 200 : 404, { ok: removed });
                     return;
                 }
                 if (request.method !== "POST") {
@@ -203,97 +242,128 @@ export function createHttpServer(options) {
             }
         }
         if (url.pathname.startsWith("/tools/")) {
-            const parts = url.pathname.slice("/tools/".length).split("/");
-            const id = decodeURIComponent(parts.shift() ?? "");
-            const resource = parts.filter(Boolean).map(decodeURIComponent).join("/");
-            const listed = (await toolRegistry.list()).find((x) => x.id === id && x.enabled);
-            if (!listed) {
-                response.writeHead(404).end("Tool not found");
-                return;
-            }
+            let id;
+            let resource;
             try {
-                const resolved = await toolRegistry.resolve(id, resource);
-                if (!resolved) {
-                    response.writeHead(404).end("Tool not found");
-                    return;
-                }
-                response.writeHead(200, { "content-type": MIME_TYPES[extname(resolved.file)] ?? "application/octet-stream", "cache-control": "no-store", "content-security-policy": "default-src 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'" });
-                createReadStream(resolved.file).pipe(response);
-                return;
+                const parts = url.pathname.slice("/tools/".length).split("/");
+                id = decodeURIComponent(parts.shift() ?? "");
+                resource = parts.filter(Boolean).map(decodeURIComponent).join("/");
             }
             catch {
-                response.writeHead(404).end("Tool file not found");
-                return;
-            }
-        }
-        if (url.pathname.startsWith("/api/tools/") && url.pathname.endsWith("/run")) {
-            const id = decodeURIComponent(url.pathname.slice("/api/tools/".length, -"/run".length));
-            if (!opaqueToolApi) {
-                toolJson(403, { error: "tool runtime API is only available to the sandboxed tool frame" });
+                response.writeHead(400).end("Malformed tool resource");
                 return;
             }
-            if (request.method === "OPTIONS") {
-                response.writeHead(204, { "access-control-allow-origin": "null", "access-control-allow-methods": "POST", "access-control-allow-headers": "content-type", "vary": "Origin" }).end();
+            const listed = (await toolRegistry.list()).find((x) => x.id === id && x.enabled);
+            if (!listed) {
+                response.writeHead(404).end("Tool not found");
                 return;
             }
-            if (request.method !== "POST") {
-                toolJson(405, { error: "method" });
+            // A mounted tool never learns its random registry id.  Its API is instead addressed relative
+            // to its own mount (`./api/run`), and this route supplies that identity from the URL.  Besides
+            // making a generated tool usable on its first render, this binds status and cancellation to the
+            // same tool that created a run: an opaque frame for tool A cannot inspect tool B's run ids.
+            const toolOrigin = request.headers.origin === "null";
+            const toolApi = (status, body) => {
+                response.writeHead(status, { "content-type": "application/json; charset=utf-8", "cache-control": "no-store", "access-control-allow-origin": "null", "vary": "Origin" });
+                response.end(JSON.stringify(body));
+            };
+            if (resource === "api/run") {
+                if (!toolOrigin) {
+                    toolApi(403, { error: "tool runtime API is only available to the sandboxed tool frame" });
+                    return;
+                }
+                if (request.method === "OPTIONS") {
+                    response.writeHead(204, { "access-control-allow-origin": "null", "access-control-allow-methods": "POST", "access-control-allow-headers": "content-type", "access-control-max-age": "300", "vary": "Origin" }).end();
+                    return;
+                }
+                if (request.method !== "POST") {
+                    toolApi(405, { error: "method" });
+                    return;
+                }
+                let raw = "";
+                for await (const chunk of request) {
+                    raw += chunk;
+                    if (raw.length > 64_000) {
+                        toolApi(413, { error: "request too large" });
+                        return;
+                    }
+                }
+                try {
+                    const body = JSON.parse(raw);
+                    const resolved = await toolRegistry.resolve(id);
+                    if (!resolved?.tool.script) {
+                        toolApi(404, { error: "python script is not registered" });
+                        return;
+                    }
+                    const run = toolRunner.start({ toolId: id, script: resolve(resolved.root, resolved.tool.script.path), cwd: resolved.root, definition: resolved.tool.script, params: body.params ?? {} });
+                    toolApi(202, run);
+                }
+                catch (error) {
+                    toolApi(400, { error: error instanceof Error ? error.message : "tool run failed" });
+                }
                 return;
             }
-            let raw = "";
-            for await (const chunk of request) {
-                raw += chunk;
-                if (raw.length > 64_000) {
-                    json(413, { error: "request too large" });
+            const runMatch = /^api\/runs\/([^/]+)$/.exec(resource);
+            if (runMatch) {
+                if (!toolOrigin) {
+                    toolApi(403, { error: "tool runtime API is only available to the sandboxed tool frame" });
                     return;
                 }
-            }
-            try {
-                const body = JSON.parse(raw);
-                const resolved = await toolRegistry.resolve(id);
-                if (!resolved?.tool.script) {
-                    toolJson(404, { error: "python script is not registered" });
+                if (request.method === "OPTIONS") {
+                    response.writeHead(204, { "access-control-allow-origin": "null", "access-control-allow-methods": "GET, DELETE", "access-control-max-age": "300", "vary": "Origin" }).end();
                     return;
                 }
-                const run = toolRunner.start({ toolId: id, script: resolve(resolved.root, resolved.tool.script.path), cwd: resolved.root, definition: resolved.tool.script, params: body.params ?? {} });
-                toolJson(202, run);
-            }
-            catch (error) {
-                toolJson(400, { error: error instanceof Error ? error.message : "tool run failed" });
-            }
-            return;
-        }
-        if (url.pathname.startsWith("/api/tools/runs/")) {
-            const parts = url.pathname.slice("/api/tools/runs/".length).split("/");
-            const runId = decodeURIComponent(parts[0] ?? "");
-            if (!opaqueToolApi) {
-                toolJson(403, { error: "tool runtime API is only available to the sandboxed tool frame" });
+                let runId;
+                try {
+                    runId = decodeURIComponent(runMatch[1]);
+                }
+                catch {
+                    toolApi(400, { error: "Malformed tool resource" });
+                    return;
+                }
+                if (request.method === "GET") {
+                    const run = toolRunner.get(runId, id);
+                    if (!run) {
+                        toolApi(404, { error: "run not found" });
+                        return;
+                    }
+                    toolApi(200, run);
+                    return;
+                }
+                if (request.method === "DELETE") {
+                    const run = toolRunner.cancel(runId, id);
+                    if (!run) {
+                        toolApi(404, { error: "run not found" });
+                        return;
+                    }
+                    toolApi(200, run);
+                    return;
+                }
+                toolApi(405, { error: "method" });
                 return;
             }
-            if (request.method === "OPTIONS") {
-                response.writeHead(204, { "access-control-allow-origin": "null", "access-control-allow-methods": "GET, DELETE", "vary": "Origin" }).end();
+            if (resource === "super-pi-tool.js") {
+                response.writeHead(200, { "content-type": "text/javascript; charset=utf-8", "cache-control": "no-store" }).end(toolBrowserSdk());
                 return;
             }
-            if (request.method === "GET") {
-                const run = [...(await toolRegistry.list())].map((tool) => toolRunner.get(runId, tool.id)).find(Boolean);
-                if (!run) {
-                    toolJson(404, { error: "run not found" });
+            try {
+                const resolved = await toolRegistry.resolve(id, resource);
+                if (!resolved) {
+                    response.writeHead(404).end("Tool not found");
                     return;
                 }
-                toolJson(200, run);
+                // Mounted tools run in an opaque sandbox origin (the iframe deliberately omits
+                // `allow-same-origin`).  In that context CSP's `'self'` is the opaque origin and
+                // does not authorize a request back to this server, even for a relative URL.
+                const policy = "default-src 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'";
+                response.writeHead(200, { "content-type": MIME_TYPES[extname(resolved.file)] ?? "application/octet-stream", "cache-control": "no-store", "content-security-policy": policy });
+                createReadStream(resolved.file).pipe(response);
                 return;
             }
-            if (request.method === "DELETE") {
-                const run = [...(await toolRegistry.list())].map((tool) => toolRunner.cancel(runId, tool.id)).find(Boolean);
-                if (!run) {
-                    toolJson(404, { error: "run not found" });
-                    return;
-                }
-                toolJson(200, run);
+            catch {
+                response.writeHead(404).end("Tool file not found");
                 return;
             }
-            toolJson(405, { error: "method" });
-            return;
         }
         /**
          * THE TERMINAL IS NOT AN API ENDPOINT, and the routing above deliberately cannot reach one.
@@ -523,7 +593,7 @@ export function createHttpServer(options) {
                 json(400, { error: "invalid JSON" });
                 return;
             }
-            const { cmd, cwd, conversationId, capability } = body;
+            const { cmd, cwd, conversationId, capability, toolCallId } = body;
             if (!cmd || !cwd || !conversationId) {
                 json(400, { error: "cmd, cwd and conversationId are required" });
                 return;
@@ -546,6 +616,10 @@ export function createHttpServer(options) {
             // Set up the background task record BEFORE spawning, so the UI shows it immediately
             const { randomUUID } = await import("node:crypto");
             const sessionId = `exec_${randomUUID()}`;
+            // The same anchor a sub-agent card carries, for the same reason: a background command asked for
+            // inside a turn belongs at that call. Resolved AFTER the capability check above, because a position
+            // is worth reading only from a caller already inside the turn.
+            const origin = await runService.waitForToolCall(conversationId, toolCallId);
             await store.setBackgroundTask({
                 id: sessionId,
                 conversationId,
@@ -554,13 +628,22 @@ export function createHttpServer(options) {
                 status: "running",
                 startedAt: new Date().toISOString(),
                 resultBlockId: sessionId,
+                ...(origin ? origin : {}),
             });
+            if (origin) {
+                const toolCalls = await store.updateToolCall(conversationId, origin.originMessageId, origin.originCallRow, { backgroundTask: { id: sessionId, status: "running" } });
+                broadcaster.broadcast({ type: "message.tools", conversationId, messageId: origin.originMessageId, toolCalls });
+            }
             broadcaster.broadcastState();
             try {
                 execService.spawn(sessionId, cmd, cwd);
                 json(202, { sessionId, status: "running" });
             }
             catch (error) {
+                if (origin) {
+                    const toolCalls = await store.updateToolCall(conversationId, origin.originMessageId, origin.originCallRow, { backgroundTask: { id: sessionId, status: "failed", output: error instanceof Error ? error.message : "spawn failed" } });
+                    broadcaster.broadcast({ type: "message.tools", conversationId, messageId: origin.originMessageId, toolCalls });
+                }
                 await store.removeBackgroundTask(sessionId);
                 broadcaster.broadcastState();
                 json(500, { error: error instanceof Error ? error.message : "spawn failed" });