@evandu/super-pi 0.1.94 → 0.1.95

package/dist/client/index.html

@@ -8,7 +8,7 @@
     <link rel="alternate icon" href="/favicon.ico" />
     <link rel="apple-touch-icon" href="/favicon.svg" />
     <title>Super Pi</title>
-    <script type="module" crossorigin src="/assets/index-zbxFjL-O.js"></script>
+    <script type="module" crossorigin src="/assets/index-gjLqMWYT.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-8olCbCbk.css">
   </head>
   <body>

package/dist/server/agents.d.ts

@@ -116,6 +116,24 @@ export declare function toolFlags(tools: Frontmatter | undefined, options?: Tool
  * of `toolFlags` because the picker needs to say "no tools" rather than render an empty allowlist.
  */
 export declare function deniesAllTools(tools: Frontmatter | undefined): boolean;
+/**
+ * The same translation `toolFlags` performs, expressed as the SDK's two lists rather than as argv.
+ *
+ * WHY A SECOND TRANSLATION AND NOT A PARSER. The argv form is `--tools a,b,c` or `--exclude-tools x,y`
+ * or `--no-tools`, and parsing it back would be reading a serialization of a decision to recover the
+ * decision. Worse, `--no-tools` has no SDK equivalent that means the same thing: Pi's `noTools: "all"`
+ * disables the built-ins while leaving extension tools on, which is NOT what an agent that declared
+ * `{"*": false}` asked for - that agent asked for NO tools at all, and an extension tool left enabled
+ * would be a tool the author explicitly refused.
+ *
+ * So the DECISION is made once, here, in the same terms `toolFlags` uses, and each consumer takes the
+ * form it needs. The two must agree, and `scripts/agent-config-regression.test.mjs` asserts that they
+ * do for every shape of `tools:` map.
+ */
+export declare function toolSelection(tools: Frontmatter | undefined, options?: ToolFlagOptions): {
+    tools?: string[];
+    excludeTools?: string[];
+};
 /** The tools an allowlist names, for display. Empty when the agent adds no allowlist of its own. */
 export declare function allowedToolNames(tools: Frontmatter | undefined): string[];
 /** `provider/modelId`, split into the two halves Pi's `set_model` and `--provider/--model` both need. */

package/dist/server/agents.js

@@ -304,6 +304,45 @@ export function deniesAllTools(tools) {
         return false;
     return tools["*"] === false && !Object.entries(tools).some(([key, on]) => key !== "*" && on === true);
 }
+/**
+ * The same translation `toolFlags` performs, expressed as the SDK's two lists rather than as argv.
+ *
+ * WHY A SECOND TRANSLATION AND NOT A PARSER. The argv form is `--tools a,b,c` or `--exclude-tools x,y`
+ * or `--no-tools`, and parsing it back would be reading a serialization of a decision to recover the
+ * decision. Worse, `--no-tools` has no SDK equivalent that means the same thing: Pi's `noTools: "all"`
+ * disables the built-ins while leaving extension tools on, which is NOT what an agent that declared
+ * `{"*": false}` asked for - that agent asked for NO tools at all, and an extension tool left enabled
+ * would be a tool the author explicitly refused.
+ *
+ * So the DECISION is made once, here, in the same terms `toolFlags` uses, and each consumer takes the
+ * form it needs. The two must agree, and `scripts/agent-config-regression.test.mjs` asserts that they
+ * do for every shape of `tools:` map.
+ */
+export function toolSelection(tools, options = {}) {
+    const denied = new Set((options.denyTools ?? []).filter((name) => name !== ""));
+    // No map at all is Pi's own default set. An inherited deny still has to become an exclusion, because
+    // there is no allowlist here to drop the name from.
+    if (!tools || typeof tools !== "object") {
+        return denied.size ? { excludeTools: [...denied] } : {};
+    }
+    const entries = Object.entries(tools).filter(([key]) => key !== "*");
+    const wildcard = tools["*"];
+    const explicit = new Map(entries);
+    const extra = (options.extraAllowedTools ?? []).filter((name) => name !== "" && explicit.get(name) !== false);
+    const declared = entries.filter(([, on]) => on === true).map(([name]) => name).filter((name) => !denied.has(name));
+    const deny = entries.filter(([, on]) => on === false).map(([name]) => name).filter((name) => !declared.includes(name));
+    if (wildcard === false) {
+        // An allowlist of nothing is an agent that talks and does not act. The SDK expresses that as an
+        // EMPTY allowlist - `tools: []` - which is different from omitting the option, and the difference
+        // matters: omitted means Pi's defaults, empty means none.
+        if (!declared.length)
+            return { tools: [] };
+        const allow = [...declared, ...extra.filter((name) => !declared.includes(name) && !denied.has(name))];
+        return { tools: allow };
+    }
+    const excluded = [...new Set([...deny, ...[...denied].filter((name) => !deny.includes(name))])];
+    return excluded.length ? { excludeTools: excluded } : {};
+}
 /** The tools an allowlist names, for display. Empty when the agent adds no allowlist of its own. */
 export function allowedToolNames(tools) {
     if (!isFrontmatter(tools) || tools["*"] !== false)

package/dist/server/application/run-service.d.ts

@@ -64,6 +64,21 @@ export declare class RunService {
     setMemory(memory: import("../active-memory.js").ActiveMemory): void;
     reviewMemoryBoundary(conversationId: string): void;
     private readonly activeRuns;
+    /**
+     * The completion of the run currently holding a conversation's slot.
+     *
+     * The slot and the promise are two halves of one fact - "this conversation has a run" and "that run is
+     * over" - and they are claimed and released together. A waiter that needs the slot (an interrupt, a
+     * send-now) AWAITS the promise rather than polling the map: polling samples a flag on a 10ms clock and
+     * has to guess at the state around it, while the promise IS the event, fired by the run's own `finally`.
+     */
+    private readonly runCompletions;
+    /** A selected interrupt owns the next free run slot, even while the old child exits. */
+    private readonly interruptTargets;
+    /** Claims the run slot and arms its completion promise. Call sites release with `releaseRunSlot`. */
+    private claimRunSlot;
+    /** Releases the run slot and settles its completion promise, so a waiter wakes on the SAME instruction. */
+    private releaseRunSlot;
     /**
      * WHERE EACH TOOL CALL LANDED, per conversation, for as long as the turn that made it is still running.
      *
@@ -162,6 +177,15 @@ export declare class RunService {
      * Checks whether a conversation has an active turn running.
      */
     isRunning(conversationId: string): boolean;
+    /**
+     * Checks the session credential together with the application-level turn truth.
+     *
+     * `activeRuns` is set synchronously before `runtime.answer()` is entered and cleared in that same
+     * turn's finally block. It is therefore the authoritative answer to "is there a primary turn to act
+     * for?". Keeping a second set in the runtime made correctness depend on two lifecycles agreeing and
+     * left HTTP-only paths with no owner at all.
+     */
+    verifyPrimaryCapability(conversationId: string, capability: unknown): import("../capability.js").CapabilityVerdict;
     /**
      * Aborts all active conversation runs and sub-agents.
      */
@@ -174,6 +198,8 @@ export declare class RunService {
     waitForIdle(): Promise<void>;
     private trackDetached;
     private serializeConversation;
+    /** Priority begins immediately after messages already handed to Pi, in their FIFO order. */
+    private moveAheadOfUnclaimed;
     /**
      * Stops an active turn run for a conversation.
      */
@@ -239,13 +265,31 @@ export declare class RunService {
     steer(conversationId: string, messageId: string): Promise<void>;
     /** Starts a chosen waiting message as the next turn, only when the conversation is idle. */
     sendQueued(conversationId: string, messageId: string): Promise<void>;
+    /**
+     * Waits for the run holding a conversation's slot to release it, by AWAITING ITS COMPLETION rather
+     * than polling a flag.
+     *
+     * Bounded, because a wedged run must not hang the message the user just asked for: after the deadline
+     * the caller proceeds to `processWaitingMessage`, whose slot check then refuses in words. With the
+     * session path the wait is short by construction - `runtime.stop()` has already awaited Pi going idle,
+     * so what is left is the old run's `finally` unwinding, which is local bookkeeping.
+     *
+     * `onlyWhileStopped` is `sendQueued`'s contract: it waits out the stop-clearing window after a stop,
+     * and nothing more. Waiting out an arbitrarily long RUNNING turn would turn "send now" into "send
+     * whenever the current answer finishes", which is what the queue is for.
+     */
+    private awaitRunSlotReleased;
     /**
      * Stops the current turn and immediately gives one waiting message its own fresh turn.
      *
      * `steer` cannot provide this meaning: Pi only reads its steering queue after the current tool batch
-     * finishes. Stopping first is what makes a long-running tool give way now. `sendQueued` already owns
-     * the hand-off window after a stop, so it waits until the old run has released its slot before opening
-     * the selected message. That preserves the one-Pi-per-conversation invariant.
+     * finishes. Stopping first is what makes a long-running tool give way now.
+     *
+     * THE HAND-OFF IS AN AWAITED HAND-OFF, not a poll. `stopRun` aborts the turn and - on the session
+     * path - `runtime.stop()` has already awaited Pi going idle, so what remains is the old run's own
+     * `finally` unwinding. `awaitRunSlotReleased` waits for exactly that event (the run's completion
+     * promise), then the selected message opens its turn ON THE SAME SESSION: the pool's fingerprint has
+     * not changed, so no process is spawned and no history is replayed.
      */
     interruptQueued(conversationId: string, messageId: string): Promise<void>;
     /**

package/dist/server/application/run-service.js

@@ -121,11 +121,7 @@ function composePrompt(message) {
     const bodyMatch = /<task_(?:result|error)>\n?([\s\S]*?)\n?<\/(?:task_result|task_error)>/.exec(content);
     const body = bodyMatch ? bodyMatch[1] : content;
     const stateLabel = state === "completed" ? "已完成" : state === "error" ? "失败" : state;
-    // The marker `@bgdelivery:` is at the end so the visible prose is what the model sees (it can ignore
-    // a trailing `@`-token, which is what its other tools do too). The fake-pi fixture recognises the
-    // marker and settles immediately so test paths through this turn do not hang on the BLOCKING
-    // extension-UI default. A real model treats the marker as part of the user's prose.
-    return `[后台任务「${summary}」${stateLabel}]\n\n${body}\n\n@bgdelivery:${state}`;
+    return `[后台任务「${summary}」${stateLabel}]\n\n${body}`;
 }
 /**
  * Service managing execution of conversation turns, message queueing,
@@ -147,6 +143,30 @@ export class RunService {
             this.memory?.review(conversation);
     }
     activeRuns = new Map();
+    /**
+     * The completion of the run currently holding a conversation's slot.
+     *
+     * The slot and the promise are two halves of one fact - "this conversation has a run" and "that run is
+     * over" - and they are claimed and released together. A waiter that needs the slot (an interrupt, a
+     * send-now) AWAITS the promise rather than polling the map: polling samples a flag on a 10ms clock and
+     * has to guess at the state around it, while the promise IS the event, fired by the run's own `finally`.
+     */
+    runCompletions = new Map();
+    /** A selected interrupt owns the next free run slot, even while the old child exits. */
+    interruptTargets = new Map();
+    /** Claims the run slot and arms its completion promise. Call sites release with `releaseRunSlot`. */
+    claimRunSlot(conversationId, controller) {
+        let resolve;
+        const promise = new Promise((resolvePromise) => { resolve = resolvePromise; });
+        this.runCompletions.set(conversationId, { promise, resolve });
+        this.activeRuns.set(conversationId, controller);
+    }
+    /** Releases the run slot and settles its completion promise, so a waiter wakes on the SAME instruction. */
+    releaseRunSlot(conversationId) {
+        this.activeRuns.delete(conversationId);
+        this.runCompletions.get(conversationId)?.resolve();
+        this.runCompletions.delete(conversationId);
+    }
     /**
      * WHERE EACH TOOL CALL LANDED, per conversation, for as long as the turn that made it is still running.
      *
@@ -245,15 +265,13 @@ export class RunService {
                 // QUEUE ITEM, NOT A NOTICE. `delivery: "waiting"` is what makes the row show in the dock; without
                 // it the message is a transcript entry only and `takeNextWaitingMessage` (which `runConversationTurns`
                 // calls after every turn) never picks it up.
-                const queued = await this.store.addToolMessage(task.conversationId, message, { delivery: "waiting" });
-                this.broadcaster.broadcastState();
-                // STEER PRIORITY. If anything else is already waiting, jump this one to the front of the queue
-                // so a 后台回传 cuts ahead of user sends - matching "按插队逻辑来处理".
-                const waiting = this.store.listWaitingMessages(task.conversationId);
-                if (waiting.length > 1) {
-                    await this.store.reorderWaitingMessage(task.conversationId, queued.id, 0);
+                const queued = await this.serializeConversation(task.conversationId, async () => {
+                    const row = await this.store.addToolMessage(task.conversationId, message, { delivery: "waiting" });
+                    // Pi already owns every `sending` row. Put a result ahead of unclaimed user messages.
+                    await this.moveAheadOfUnclaimed(task.conversationId, row.id);
                     this.broadcaster.broadcastState();
-                }
+                    return row;
+                });
                 // AUTO-TRIGGER WHEN IDLE. The conversation may already be busy (running turn, taking the next
                 // waiting message in its own follow-up loop); if so, the existing loop picks this one up and
                 // this branch is a no-op. If idle, kick off a fresh turn so the model processes the result
@@ -262,7 +280,7 @@ export class RunService {
                 // processes the result" contract, and the auto-triggered turn goes through the same
                 // `composePrompt` path the success case does (so a helper failure surfaces as `state="error"`
                 // prose the agent can react to).
-                if (!this.activeRuns.has(task.conversationId)) {
+                if (!this.activeRuns.has(task.conversationId) && !this.interruptTargets.has(task.conversationId)) {
                     void this.processWaitingMessage(task.conversationId, queued.id).catch((error) => {
                         console.warn(`Super Pi: auto-trigger for background exec result failed: ${error instanceof Error ? error.message : "unknown error"}`);
                     });
@@ -422,10 +440,22 @@ export class RunService {
     isRunning(conversationId) {
         return this.activeRuns.has(conversationId);
     }
+    /**
+     * Checks the session credential together with the application-level turn truth.
+     *
+     * `activeRuns` is set synchronously before `runtime.answer()` is entered and cleared in that same
+     * turn's finally block. It is therefore the authoritative answer to "is there a primary turn to act
+     * for?". Keeping a second set in the runtime made correctness depend on two lifecycles agreeing and
+     * left HTTP-only paths with no owner at all.
+     */
+    verifyPrimaryCapability(conversationId, capability) {
+        return verifyCapability(conversationId, capability, { running: this.isRunning(conversationId) });
+    }
     /**
      * Aborts all active conversation runs and sub-agents.
      */
     abortAll() {
+        this.interruptTargets.clear();
         this.memory?.cancelAll();
         for (const controller of this.activeRuns.values()) {
             controller.abort();
@@ -464,6 +494,12 @@ export class RunService {
             this.conversationOps.delete(conversationId); });
         return next;
     }
+    /** Priority begins immediately after messages already handed to Pi, in their FIFO order. */
+    async moveAheadOfUnclaimed(conversationId, messageId) {
+        const waiting = this.store.listWaitingMessages(conversationId);
+        const lastClaimed = waiting.reduce((last, item, index) => item.delivery === "sending" ? index : last, -1);
+        await this.store.reorderWaitingMessage(conversationId, messageId, lastClaimed + 1);
+    }
     /**
      * Stops an active turn run for a conversation.
      */
@@ -996,12 +1032,12 @@ export class RunService {
         // itself as an ordinary message and now finds the slot taken - its words are on screen with nobody
         // going to answer them. Repairing that is what the guard below is for; it is not a rare path, it is
         // what two fast sends looks like from the inside.
-        const busy = this.activeRuns.has(conversation.id);
+        const busy = this.activeRuns.has(conversation.id) || this.interruptTargets.has(conversation.id);
         const message = await this.store.addUserMessage(conversationId, trimmed, validImages, attachments, { clientId, ...(busy ? { delivery: "waiting" } : {}) });
         this.broadcaster.broadcastState();
         // Claim the run slot synchronously (no await between has() and set()) so two
         // rapid sends can never both pass the guard and start concurrent turns.
-        if (this.activeRuns.has(conversation.id)) {
+        if (this.activeRuns.has(conversation.id) || this.interruptTargets.has(conversation.id)) {
             if (!busy) {
                 // Lost the race described above. No turn has opened on this message and no model has seen it, so
                 // calling it waiting is a statement of fact - and it puts the words exactly where a message born
@@ -1012,7 +1048,7 @@ export class RunService {
             return;
         }
         const controller = new AbortController();
-        this.activeRuns.set(conversation.id, controller);
+        this.claimRunSlot(conversation.id, controller);
         try {
             let expanded;
             try {
@@ -1095,7 +1131,7 @@ export class RunService {
             throw error;
         }
         finally {
-            this.activeRuns.delete(conversation.id);
+            this.releaseRunSlot(conversation.id);
             this.extensionUiService.cancelPendingUi(conversation.id, "expired");
             this.broadcaster.broadcastState();
         }
@@ -1108,26 +1144,68 @@ export class RunService {
     }
     /** Starts a chosen waiting message as the next turn, only when the conversation is idle. */
     async sendQueued(conversationId, messageId) {
+        if (this.interruptTargets.has(conversationId))
+            throw new Error("打断回复正在启动，请等待所选消息开始回答");
         // A stop broadcasts `stopped` before the previous run has finished its finally block. Allow that
         // short cleanup window; a click on the newly visible button must not race the old run slot.
+        await this.awaitRunSlotReleased(conversationId, true);
+        await this.processWaitingMessage(conversationId, messageId);
+    }
+    /**
+     * Waits for the run holding a conversation's slot to release it, by AWAITING ITS COMPLETION rather
+     * than polling a flag.
+     *
+     * Bounded, because a wedged run must not hang the message the user just asked for: after the deadline
+     * the caller proceeds to `processWaitingMessage`, whose slot check then refuses in words. With the
+     * session path the wait is short by construction - `runtime.stop()` has already awaited Pi going idle,
+     * so what is left is the old run's `finally` unwinding, which is local bookkeeping.
+     *
+     * `onlyWhileStopped` is `sendQueued`'s contract: it waits out the stop-clearing window after a stop,
+     * and nothing more. Waiting out an arbitrarily long RUNNING turn would turn "send now" into "send
+     * whenever the current answer finishes", which is what the queue is for.
+     */
+    async awaitRunSlotReleased(conversationId, onlyWhileStopped = false) {
         const deadline = Date.now() + 15_000;
-        while (this.activeRuns.has(conversationId) && this.store.snapshot().conversations.find((item) => item.id === conversationId)?.status === "stopped" && Date.now() < deadline) {
-            await new Promise((resolve) => setTimeout(resolve, 10));
+        while (this.activeRuns.has(conversationId) && Date.now() < deadline) {
+            if (onlyWhileStopped && this.store.snapshot().conversations.find((item) => item.id === conversationId)?.status !== "stopped")
+                return;
+            const completion = this.runCompletions.get(conversationId)?.promise;
+            if (!completion)
+                return;
+            // The completion usually wins this race by a wide margin; the timer is what re-checks the
+            // `onlyWhileStopped` condition if the run keeps going, and what enforces the deadline.
+            await Promise.race([completion, new Promise((resolve) => setTimeout(resolve, Math.min(500, Math.max(1, deadline - Date.now()))))]);
         }
-        await this.processWaitingMessage(conversationId, messageId);
     }
     /**
      * Stops the current turn and immediately gives one waiting message its own fresh turn.
      *
      * `steer` cannot provide this meaning: Pi only reads its steering queue after the current tool batch
-     * finishes. Stopping first is what makes a long-running tool give way now. `sendQueued` already owns
-     * the hand-off window after a stop, so it waits until the old run has released its slot before opening
-     * the selected message. That preserves the one-Pi-per-conversation invariant.
+     * finishes. Stopping first is what makes a long-running tool give way now.
+     *
+     * THE HAND-OFF IS AN AWAITED HAND-OFF, not a poll. `stopRun` aborts the turn and - on the session
+     * path - `runtime.stop()` has already awaited Pi going idle, so what remains is the old run's own
+     * `finally` unwinding. `awaitRunSlotReleased` waits for exactly that event (the run's completion
+     * promise), then the selected message opens its turn ON THE SAME SESSION: the pool's fingerprint has
+     * not changed, so no process is spawned and no history is replayed.
      */
     async interruptQueued(conversationId, messageId) {
-        if (this.activeRuns.has(conversationId))
-            await this.stopRun(conversationId);
-        await this.sendQueued(conversationId, messageId);
+        if (this.interruptTargets.has(conversationId))
+            throw new Error("已有一条打断回复正在启动，请稍候");
+        const selected = this.store.listWaitingMessages(conversationId).find((item) => item.id === messageId);
+        if (!selected || selected.delivery !== "waiting")
+            throw new Error("这条消息已不在等待队列中，无法打断并回答");
+        this.interruptTargets.set(conversationId, messageId);
+        try {
+            if (this.activeRuns.has(conversationId))
+                await this.stopRun(conversationId);
+            await this.awaitRunSlotReleased(conversationId);
+            await this.processWaitingMessage(conversationId, messageId);
+        }
+        finally {
+            if (this.interruptTargets.get(conversationId) === messageId)
+                this.interruptTargets.delete(conversationId);
+        }
     }
     /**
      * The lower-level "wait for run slot, open the turn on a specific waiting message, run it" sequence.
@@ -1145,59 +1223,48 @@ export class RunService {
      * transcript, but the prose form of the same fact is what reaches Pi.
      */
     async processWaitingMessage(conversationId, messageId) {
-        return this.serializeConversation(conversationId, async () => {
+        // Serialize only the run claim. Holding the command lane for the entire Pi turn makes every
+        // steer/reorder/cancel wait until that turn ends, which is especially visible after a background
+        // result auto-starts a long follow-up. The activeRuns slot protects the turn after this lane exits.
+        const controller = await this.serializeConversation(conversationId, async () => {
+            const reserved = this.interruptTargets.get(conversationId);
+            if (reserved && reserved !== messageId)
+                throw new Error("打断回复正在启动，请等待所选消息开始回答");
             if (this.activeRuns.has(conversationId))
                 throw new Error("当前轮仍在运行；停止或等待它结束后再发送这条消息");
+            const message = this.store.listWaitingMessages(conversationId).find((item) => item.id === messageId);
+            if (!message || message.delivery !== "waiting")
+                throw new Error("等待中的消息不存在或已被处理");
             const controller = new AbortController();
-            this.activeRuns.set(conversationId, controller);
-            try {
-                const { conversation, workspace } = this.turnContext(conversationId);
-                const message = conversation.messages.find((item) => item.id === messageId);
-                if (!message)
-                    throw new Error("消息不存在或已被撤回");
-                // Do not call openTurnOnSpecificMessage here. runConversationTurns opens this exact first
-                // message before streaming it, which creates one assistant placeholder and one only.
-                await this.runConversationTurns(conversation, workspace, composePrompt(message), controller, message.id, message.images);
-                await this.store.setStatus(conversationId, controller.signal.aborted ? "stopped" : "completed");
-            }
-            catch (error) {
-                await this.store.setStatus(conversationId, controller.signal.aborted ? "stopped" : "failed");
-                if (!controller.signal.aborted) {
-                    await this.store.setFailureReason(conversationId, formatTurnFailure(error));
-                }
-                // A preflight failure must put the message BACK where the reader can see it. Re-adding it would
-                // duplicate the row that is still in the transcript, so this only re-marks the one that is
-                // there - which is what makes "the send failed, this row is still in the queue" a true statement.
-                await this.store.releaseWaitingMessage(conversationId, messageId).catch(() => undefined);
-                throw error;
-            }
-            finally {
-                this.activeRuns.delete(conversationId);
-                this.extensionUiService.cancelPendingUi(conversationId, "expired");
-                this.broadcaster.broadcastState();
-            }
+            this.claimRunSlot(conversationId, controller);
+            return controller;
         });
-    }
-    async steerUnsafe(conversationId, messageId) {
-        // MOVED TO THE FRONT FIRST, ALWAYS - AND THE MOVE IS BEST-EFFORT.
-        //
-        // The move is what makes "插到最前" mean what it says rather than leaving a flag nobody can explain.
-        // But the move CAN fail, and the case where it fails is a real one a person causes on purpose: two
-        // steers in a row. The first message is already in Pi's stdin, nothing can be placed in front of it,
-        // and the second click means "and this one too". Refusing it would break a capability the old
-        // implementation had and would leave the person with a message that cannot be sent at all until the
-        // turn ends - which is the thing they were trying to avoid by clicking twice.
-        //
-        // So the refusal is swallowed HERE and only here: being second in Pi's own FIFO queue is still a jump
-        // past everything else that is merely waiting, which is what the second click was asking for. The
-        // `message.reorder` command does not swallow it, because a button that says 「插到最前」 and silently
-        // did not move anything is the promise this refactor exists to stop making.
         try {
-            await this.store.reorderWaitingMessage(conversationId, messageId, 0);
+            const { conversation, workspace } = this.turnContext(conversationId);
+            const message = conversation.messages.find((item) => item.id === messageId);
+            if (!message)
+                throw new Error("消息不存在或已被撤回");
+            // runConversationTurns opens this first message; do not create a second assistant placeholder.
+            await this.runConversationTurns(conversation, workspace, composePrompt(message), controller, message.id, message.images);
+            await this.store.setStatus(conversationId, controller.signal.aborted ? "stopped" : "completed");
         }
-        catch {
-            // Nothing to do: the claim below is what actually delivers it, and Pi takes steers in order.
+        catch (error) {
+            await this.store.setStatus(conversationId, controller.signal.aborted ? "stopped" : "failed");
+            if (!controller.signal.aborted)
+                await this.store.setFailureReason(conversationId, formatTurnFailure(error));
+            throw error;
         }
+        finally {
+            this.releaseRunSlot(conversationId);
+            this.extensionUiService.cancelPendingUi(conversationId, "expired");
+            this.broadcaster.broadcastState();
+        }
+    }
+    async steerUnsafe(conversationId, messageId) {
+        if (this.interruptTargets.has(conversationId))
+            throw new Error("打断回复正在启动，请稍后再插队");
+        // Already-sent Pi steers are FIFO. Put this row directly behind them, ahead of unclaimed rows.
+        await this.moveAheadOfUnclaimed(conversationId, messageId);
         this.broadcaster.broadcastState();
         if (!this.runtime.steer)
             return;
@@ -1231,6 +1298,8 @@ export class RunService {
         return this.serializeConversation(conversationId, () => this.cancelQueuedUnsafe(conversationId, messageId));
     }
     async cancelQueuedUnsafe(conversationId, messageId) {
+        if (this.interruptTargets.get(conversationId) === messageId)
+            throw new Error("这条消息正在打断并回答，无法撤回");
         await this.store.cancelWaitingMessage(conversationId, messageId);
         this.broadcaster.broadcastState();
     }
@@ -1239,6 +1308,8 @@ export class RunService {
      */
     async editQueued(conversationId, messageId, content) {
         return this.serializeConversation(conversationId, async () => {
+            if (this.interruptTargets.get(conversationId) === messageId)
+                throw new Error("这条消息正在打断并回答，无法修改");
             await this.store.editWaitingMessage(conversationId, messageId, content);
             this.broadcaster.broadcastState();
         });
@@ -1248,6 +1319,8 @@ export class RunService {
      */
     async reorderQueued(conversationId, messageId, toIndex) {
         return this.serializeConversation(conversationId, async () => {
+            if (this.interruptTargets.get(conversationId) === messageId)
+                throw new Error("这条消息正在打断并回答，无法移动");
             await this.store.reorderWaitingMessage(conversationId, messageId, toIndex);
             this.broadcaster.broadcastState();
         });
@@ -1288,7 +1361,7 @@ export class RunService {
         // BEFORE anything else, including before the conversation is looked up: a request that cannot prove it
         // came from this server's primary agent gets no answer about what exists. Everything below this line
         // is about shaping a dispatch; this line is about whether the caller may have one at all.
-        const capability = verifyCapability(conversationId, body.capability);
+        const capability = this.verifyPrimaryCapability(conversationId, body.capability);
         if (!capability.ok)
             throw new Error(capability.message);
         if (body.depth !== undefined)
@@ -1344,14 +1417,13 @@ export class RunService {
                 // still the 后台回传 column.
                 const message = `<task id="${run.id}" state="${run.status === "completed" ? "completed" : "error"}" kind="subagent">\n<summary>Background task ${run.status === "completed" ? "completed" : "failed"}: ${body.description?.trim() || subagentType}</summary>\n<${tag}>\n${result}</${tag}>\n</task>`;
                 try {
-                    const queued = await this.store.addToolMessage(conversation.id, message, { delivery: "waiting" });
-                    this.broadcaster.broadcastState();
-                    const waiting = this.store.listWaitingMessages(conversation.id);
-                    if (waiting.length > 1) {
-                        await this.store.reorderWaitingMessage(conversation.id, queued.id, 0);
+                    const queued = await this.serializeConversation(conversation.id, async () => {
+                        const row = await this.store.addToolMessage(conversation.id, message, { delivery: "waiting" });
+                        await this.moveAheadOfUnclaimed(conversation.id, row.id);
                         this.broadcaster.broadcastState();
-                    }
-                    if (!this.activeRuns.has(conversation.id)) {
+                        return row;
+                    });
+                    if (!this.activeRuns.has(conversation.id) && !this.interruptTargets.has(conversation.id)) {
                         void this.processWaitingMessage(conversation.id, queued.id).catch((error) => {
                             console.warn(`Super Pi: auto-trigger for background sub-agent result failed: ${error instanceof Error ? error.message : "unknown error"}`);
                         });
@@ -1365,13 +1437,11 @@ export class RunService {
             }).catch(async (error) => {
                 const message = `<task id="${backgroundId}" state="error" kind="subagent">\n<summary>Background task failed: ${body.description?.trim() || subagentType}</summary>\n<task_error>Background task failed before completion: ${error instanceof Error ? error.message : "unknown error"}</task_error>\n</task>`;
                 try {
-                    const queued = await this.store.addToolMessage(conversationId, message, { delivery: "waiting" });
-                    this.broadcaster.broadcastState();
-                    const waiting = this.store.listWaitingMessages(conversationId);
-                    if (waiting.length > 1) {
-                        await this.store.reorderWaitingMessage(conversationId, queued.id, 0);
+                    await this.serializeConversation(conversationId, async () => {
+                        const queued = await this.store.addToolMessage(conversationId, message, { delivery: "waiting" });
+                        await this.moveAheadOfUnclaimed(conversationId, queued.id);
                         this.broadcaster.broadcastState();
-                    }
+                    });
                     // No auto-trigger on this failure branch (the result envelope says `state="error"` and the
                     // conversation is by construction not in a turn that asked for it). The row is visible in the
                     // dock for the reader to send-now or cancel.
@@ -1424,7 +1494,7 @@ export class RunService {
         // Same rule as `dispatchTask`, and for a larger reason: this endpoint triggers a SEQUENCE of
         // dispatches, so a caller that cannot prove it is the primary agent would get an unattended pipeline
         // of sub-agents writing to the workspace rather than one delegation.
-        const capability = verifyCapability(conversationId, body.capability);
+        const capability = this.verifyPrimaryCapability(conversationId, body.capability);
         if (!capability.ok)
             throw new Error(capability.message);
         const { conversation, cwd } = this.dispatchContext(conversationId);

package/dist/server/capability.d.ts

@@ -36,27 +36,41 @@
  */
 export declare const TASK_CAPABILITY_ENV = "SUPER_PI_TASK_CAPABILITY";
 /**
- * Mints the capability for one turn of one conversation, and returns it for the extension's environment.
+ * Mints the capability for one conversation's primary session, and returns it for the extension's
+ * environment.
  *
- * CALLED AT SPAWN, so the value is decided before the child exists and cannot be changed underneath it.
- * A turn that never reaches the spawn mints nothing, which is correct: there is no process to hand it to.
+ * CALLED WHEN THE SESSION IS CREATED, so the value is decided before the session exists and cannot be
+ * changed underneath it. A session that is never created mints nothing, which is correct: there is
+ * nothing to hand it to.
  *
- * ROTATED EVERY TURN, and that is the property the duration would not give on its own. A token valid for
- * the whole server lifetime would still be a token an unrelated process could not guess - but a token
- * valid only while its holder is alive is a token that stops being a credential the moment the turn ends,
- * so there is no window in which a leaked value is still live.
+ * ROTATED EVERY SESSION, and that is the property the duration would not give on its own. A token valid
+ * for the whole server lifetime would still be a token an unrelated process could not guess - but a token
+ * valid only while its holder is alive is a token that stops being a credential the moment the session
+ * ends, so there is no window in which a leaked value is still live.
+ *
+ * WHY IT IS THE SESSION AND NOT THE TURN. The capability travels in the extension's ENVIRONMENT, and an
+ * extension reads its environment when it is LOADED. A session that outlives its turns loads its
+ * extension once, so a per-turn token would have to be re-read from an environment that cannot change -
+ * and the second turn of a conversation would carry the FIRST turn's token, which the server would
+ * (correctly) refuse. The session is therefore the unit the credential belongs to, and the server
+ * enforces the turn separately. The application service owns the authoritative active-turn map, and
+ * passes that fact to `verifyCapability` at each protected endpoint. A stolen token is therefore worth
+ * nothing to a caller that cannot also start a turn.
  */
 export declare function mintCapability(conversationId: string): string;
 /**
- * Forgets a conversation's capability, at the end of its turn.
+ * Forgets a conversation's capability, when its session ends.
  *
- * CALLED FROM `answer()`'s `finally`, so it runs on every exit - a turn that answered, a turn that threw,
- * and a turn whose child was killed. A capability that outlived its turn would keep working for a process
- * that no longer exists, which is precisely the shape of a credential with no owner.
+ * CALLED WHEN THE SESSION IS DESTROYED, so it runs on every exit - a session that was evicted as idle, a
+ * session that was thrown away by a revert, a session that was replaced because the conversation's
+ * configuration changed, and a session that was disposed at shutdown. A capability that outlived its
+ * session would keep working for a session that no longer exists, which is precisely the shape of a
+ * credential with no owner.
  */
 export declare function releaseCapability(conversationId: string): void;
 /** Forgets every capability. Called on shutdown, so nothing survives the process that minted it. */
 export declare function releaseAllCapabilities(): void;
+/**
 /**
  * The capability currently valid for a conversation, or `undefined` when no primary turn is running.
  *
@@ -86,4 +100,6 @@ export type CapabilityVerdict = {
  * silently omitted the header would otherwise be indistinguishable from an attacker, and would keep
  * retrying forever.
  */
-export declare function verifyCapability(conversationId: string, presented: unknown): CapabilityVerdict;
+export declare function verifyCapability(conversationId: string, presented: unknown, options?: {
+    running?: boolean;
+}): CapabilityVerdict;