@agimon-ai/doompi-core 0.0.1-alpha.119 → 0.0.1-alpha.121

package/dist/contextDetailStore.cjs

@@ -29,7 +29,10 @@ const PRIVATE_FILE_MODE = 384;
 function agentDirectory(environment) {
 	return environment[AGENT_DIR_ENV] || node_path.default.join(node_os.default.homedir(), ".pi", "agent");
 }
-/** A session id reaches this from a query string, so it never becomes a path. */
+/**
+* A session id reaches this from a query string, so it never becomes a path.
+* `.` and `..` pass through unchanged: a caller using the result as a directory must refuse them.
+*/
 function safeName(sessionId) {
 	return sessionId.replace(/[^a-zA-Z0-9._-]/gu, "_");
 }
@@ -91,10 +94,12 @@ function findContextItem(file, itemKind, name) {
 	return file.items.find((item) => item.itemKind === itemKind && item.name === name);
 }
 //#endregion
+exports.agentDirectory = agentDirectory;
 exports.contextDetailPath = contextDetailPath;
 exports.findContextItem = findContextItem;
 exports.readContextDetail = readContextDetail;
 exports.removeContextDetail = removeContextDetail;
+exports.safeName = safeName;
 exports.writeContextDetail = writeContextDetail;
 
 //# sourceMappingURL=contextDetailStore.cjs.map

package/dist/contextDetailStore.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"contextDetailStore.cjs","names":["path","os","fs"],"sources":["../src/services/contextDetailStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { CONTEXT_DETAIL_VERSION } from '../../constants/contextApi';\nimport type { ContextDetailFile, ContextItemDetail, ContextItemKind } from '../../types/contextApi';\n\n/**\n * Where the agent leaves the composition's detail for the session API to find.\n *\n * The two are separate processes: the inventory only exists inside the agent,\n * and the API that answers the browser is served by the session's host. Every\n * other package-owned API in the repository bridges that gap through the\n * filesystem rather than through the frame protocol, and this one follows,\n * because a file is also what makes the answer survive the agent going quiet\n * between turns.\n *\n * One file per session, replaced whole. The detail is a projection of the\n * composition, not a log of it, so an older copy has no reader.\n */\n\nconst DIRECTORY_NAME = 'doom-context';\nconst AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';\n/** Owner-only: a tool schema is not secret, but it describes the machine. */\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction agentDirectory(environment: NodeJS.ProcessEnv): string {\n  return environment[AGENT_DIR_ENV] || path.join(os.homedir(), '.pi', 'agent');\n}\n\n/** A session id reaches this from a query string, so it never becomes a path. */\nfunction safeName(sessionId: string): string {\n  return sessionId.replace(/[^a-zA-Z0-9._-]/gu, '_');\n}\n\nexport function contextDetailPath(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): string {\n  return path.join(agentDirectory(environment), DIRECTORY_NAME, `${safeName(sessionId)}.json`);\n}\n\n/**\n * Publishes the detail for one session.\n *\n * Written through a temporary file so a reader never sees half a document, and\n * failures are reported to the caller rather than thrown: the panel works\n * without this, and a session must not be lost to a full disk.\n */\nexport function writeContextDetail(\n  sessionId: string,\n  revision: number,\n  items: readonly ContextItemDetail[],\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n  const target = contextDetailPath(sessionId, environment);\n  const payload: ContextDetailFile = { version: CONTEXT_DETAIL_VERSION, revision, items };\n  const temporary = `${target}.${String(process.pid)}.tmp`;\n  try {\n    fs.mkdirSync(path.dirname(target), { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n    fs.writeFileSync(temporary, JSON.stringify(payload), { mode: PRIVATE_FILE_MODE });\n    fs.renameSync(temporary, target);\n    return true;\n  } catch {\n    try {\n      fs.rmSync(temporary, { force: true });\n    } catch {\n      // The temporary file is already unreachable; nothing further to do.\n    }\n    return false;\n  }\n}\n\n/** Drops a session's file. Called when the session ends, so the directory does not grow forever. */\nexport function removeContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): void {\n  try {\n    fs.rmSync(contextDetailPath(sessionId, environment), { force: true });\n  } catch {\n    // A file that cannot be removed is stale, not fatal; the next session with\n    // this id overwrites it.\n  }\n}\n\nfunction isDetailFile(value: unknown): value is ContextDetailFile {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Record<string, unknown>;\n  return candidate.version === CONTEXT_DETAIL_VERSION && Array.isArray(candidate.items);\n}\n\n/** What the session wrote, or undefined when it has not written yet. */\nexport function readContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): ContextDetailFile | undefined {\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(contextDetailPath(sessionId, environment), 'utf8'));\n    return isDetailFile(parsed) ? parsed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One row's detail, matched the way the panel identifies it. */\nexport function findContextItem(\n  file: ContextDetailFile,\n  itemKind: ContextItemKind,\n  name: string,\n): ContextItemDetail | undefined {\n  return file.items.find((item) => item.itemKind === itemKind && item.name === name);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;;AAEtB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAE1B,SAAS,eAAe,aAAwC;CAC9D,OAAO,YAAY,kBAAkBA,UAAAA,QAAK,KAAKC,QAAAA,QAAG,QAAQ,GAAG,OAAO,OAAO;AAC7E;;AAGA,SAAS,SAAS,WAA2B;CAC3C,OAAO,UAAU,QAAQ,qBAAqB,GAAG;AACnD;AAEA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KAC5D;CACR,OAAOD,UAAAA,QAAK,KAAK,eAAe,WAAW,GAAG,gBAAgB,GAAG,SAAS,SAAS,EAAE,MAAM;AAC7F;;;;;;;;AASA,SAAgB,mBACd,WACA,UACA,OACA,cAA4D,QAAQ,KAC3D;CACT,MAAM,SAAS,kBAAkB,WAAW,WAAW;CACvD,MAAM,UAA6B;EAAE,SAAA;EAAiC;EAAU;CAAM;CACtF,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;CACnD,IAAI;EACF,QAAA,QAAG,UAAUA,UAAAA,QAAK,QAAQ,MAAM,GAAG;GAAE,WAAW;GAAM,MAAM;EAAuB,CAAC;EACpF,QAAA,QAAG,cAAc,WAAW,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,kBAAkB,CAAC;EAChF,QAAA,QAAG,WAAW,WAAW,MAAM;EAC/B,OAAO;CACT,QAAQ;EACN,IAAI;GACF,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;EACtC,QAAQ,CAER;EACA,OAAO;CACT;AACF;;AAGA,SAAgB,oBACd,WACA,cAA4D,QAAQ,KAC9D;CACN,IAAI;EACF,QAAA,QAAG,OAAO,kBAAkB,WAAW,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;CACtE,QAAQ,CAGR;AACF;AAEA,SAAS,aAAa,OAA4C;CAChE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OAAO,UAAU,YAAA,KAAsC,MAAM,QAAQ,UAAU,KAAK;AACtF;;AAGA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KACrC;CAC/B,IAAI;EACF,MAAM,SAAkB,KAAK,MAAME,QAAAA,QAAG,aAAa,kBAAkB,WAAW,WAAW,GAAG,MAAM,CAAC;EACrG,OAAO,aAAa,MAAM,IAAI,SAAS,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,gBACd,MACA,UACA,MAC+B;CAC/B,OAAO,KAAK,MAAM,MAAM,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,IAAI;AACnF"}
+{"version":3,"file":"contextDetailStore.cjs","names":["path","os","fs"],"sources":["../src/services/contextDetailStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { CONTEXT_DETAIL_VERSION } from '../../constants/contextApi';\nimport type { ContextDetailFile, ContextItemDetail, ContextItemKind } from '../../types/contextApi';\n\n/**\n * Where the agent leaves the composition's detail for the session API to find.\n *\n * The two are separate processes: the inventory only exists inside the agent,\n * and the API that answers the browser is served by the session's host. Every\n * other package-owned API in the repository bridges that gap through the\n * filesystem rather than through the frame protocol, and this one follows,\n * because a file is also what makes the answer survive the agent going quiet\n * between turns.\n *\n * One file per session, replaced whole. The detail is a projection of the\n * composition, not a log of it, so an older copy has no reader.\n */\n\nconst DIRECTORY_NAME = 'doom-context';\nconst AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';\n/** Owner-only: a tool schema is not secret, but it describes the machine. */\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function agentDirectory(environment: Readonly<Record<string, string | undefined>>): string {\n  return environment[AGENT_DIR_ENV] || path.join(os.homedir(), '.pi', 'agent');\n}\n\n/**\n * A session id reaches this from a query string, so it never becomes a path.\n * `.` and `..` pass through unchanged: a caller using the result as a directory must refuse them.\n */\nexport function safeName(sessionId: string): string {\n  return sessionId.replace(/[^a-zA-Z0-9._-]/gu, '_');\n}\n\nexport function contextDetailPath(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): string {\n  return path.join(agentDirectory(environment), DIRECTORY_NAME, `${safeName(sessionId)}.json`);\n}\n\n/**\n * Publishes the detail for one session.\n *\n * Written through a temporary file so a reader never sees half a document, and\n * failures are reported to the caller rather than thrown: the panel works\n * without this, and a session must not be lost to a full disk.\n */\nexport function writeContextDetail(\n  sessionId: string,\n  revision: number,\n  items: readonly ContextItemDetail[],\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n  const target = contextDetailPath(sessionId, environment);\n  const payload: ContextDetailFile = { version: CONTEXT_DETAIL_VERSION, revision, items };\n  const temporary = `${target}.${String(process.pid)}.tmp`;\n  try {\n    fs.mkdirSync(path.dirname(target), { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n    fs.writeFileSync(temporary, JSON.stringify(payload), { mode: PRIVATE_FILE_MODE });\n    fs.renameSync(temporary, target);\n    return true;\n  } catch {\n    try {\n      fs.rmSync(temporary, { force: true });\n    } catch {\n      // The temporary file is already unreachable; nothing further to do.\n    }\n    return false;\n  }\n}\n\n/** Drops a session's file. Called when the session ends, so the directory does not grow forever. */\nexport function removeContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): void {\n  try {\n    fs.rmSync(contextDetailPath(sessionId, environment), { force: true });\n  } catch {\n    // A file that cannot be removed is stale, not fatal; the next session with\n    // this id overwrites it.\n  }\n}\n\nfunction isDetailFile(value: unknown): value is ContextDetailFile {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Record<string, unknown>;\n  return candidate.version === CONTEXT_DETAIL_VERSION && Array.isArray(candidate.items);\n}\n\n/** What the session wrote, or undefined when it has not written yet. */\nexport function readContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): ContextDetailFile | undefined {\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(contextDetailPath(sessionId, environment), 'utf8'));\n    return isDetailFile(parsed) ? parsed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One row's detail, matched the way the panel identifies it. */\nexport function findContextItem(\n  file: ContextDetailFile,\n  itemKind: ContextItemKind,\n  name: string,\n): ContextItemDetail | undefined {\n  return file.items.find((item) => item.itemKind === itemKind && item.name === name);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;;AAEtB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAE1B,SAAgB,eAAe,aAAmE;CAChG,OAAO,YAAY,kBAAkBA,UAAAA,QAAK,KAAKC,QAAAA,QAAG,QAAQ,GAAG,OAAO,OAAO;AAC7E;;;;;AAMA,SAAgB,SAAS,WAA2B;CAClD,OAAO,UAAU,QAAQ,qBAAqB,GAAG;AACnD;AAEA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KAC5D;CACR,OAAOD,UAAAA,QAAK,KAAK,eAAe,WAAW,GAAG,gBAAgB,GAAG,SAAS,SAAS,EAAE,MAAM;AAC7F;;;;;;;;AASA,SAAgB,mBACd,WACA,UACA,OACA,cAA4D,QAAQ,KAC3D;CACT,MAAM,SAAS,kBAAkB,WAAW,WAAW;CACvD,MAAM,UAA6B;EAAE,SAAA;EAAiC;EAAU;CAAM;CACtF,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;CACnD,IAAI;EACF,QAAA,QAAG,UAAUA,UAAAA,QAAK,QAAQ,MAAM,GAAG;GAAE,WAAW;GAAM,MAAM;EAAuB,CAAC;EACpF,QAAA,QAAG,cAAc,WAAW,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,kBAAkB,CAAC;EAChF,QAAA,QAAG,WAAW,WAAW,MAAM;EAC/B,OAAO;CACT,QAAQ;EACN,IAAI;GACF,QAAA,QAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;EACtC,QAAQ,CAER;EACA,OAAO;CACT;AACF;;AAGA,SAAgB,oBACd,WACA,cAA4D,QAAQ,KAC9D;CACN,IAAI;EACF,QAAA,QAAG,OAAO,kBAAkB,WAAW,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;CACtE,QAAQ,CAGR;AACF;AAEA,SAAS,aAAa,OAA4C;CAChE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OAAO,UAAU,YAAA,KAAsC,MAAM,QAAQ,UAAU,KAAK;AACtF;;AAGA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KACrC;CAC/B,IAAI;EACF,MAAM,SAAkB,KAAK,MAAME,QAAAA,QAAG,aAAa,kBAAkB,WAAW,WAAW,GAAG,MAAM,CAAC;EACrG,OAAO,aAAa,MAAM,IAAI,SAAS,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,gBACd,MACA,UACA,MAC+B;CAC/B,OAAO,KAAK,MAAM,MAAM,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,IAAI;AACnF"}

package/dist/contextDetailStore.d.mts

@@ -1,5 +1,11 @@
 import { ContextDetailFile, ContextItemDetail, ContextItemKind } from "./typesContextApi.mjs";
 //#region src/services/contextDetailStore/index.d.ts
+export declare function agentDirectory(environment: Readonly<Record<string, string | undefined>>): string;
+/**
+ * A session id reaches this from a query string, so it never becomes a path.
+ * `.` and `..` pass through unchanged: a caller using the result as a directory must refuse them.
+ */
+export declare function safeName(sessionId: string): string;
 export declare function contextDetailPath(sessionId: string, environment?: Readonly<Record<string, string | undefined>>): string;
 /**
  * Publishes the detail for one session.

package/dist/contextDetailStore.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"contextDetailStore.d.mts","names":[],"sources":["../src/services/contextDetailStore/index.ts"],"mappings":";;wBAoCgB,kBACd,mBACA,cAAa,SAAS;;;;;;;;wBAYR,mBACd,mBACA,kBACA,gBAAgB,qBAChB,cAAa,SAAS;;wBAqBR,oBACd,mBACA,cAAa,SAAS;;wBAiBR,kBACd,mBACA,cAAa,SAAS,sCACrB;;wBAUa,gBACd,MAAM,mBACN,UAAU,iBACV,eACC"}
+{"version":3,"file":"contextDetailStore.d.mts","names":[],"sources":["../src/services/contextDetailStore/index.ts"],"mappings":";;wBA2BgB,eAAe,aAAa,SAAS;;;;;wBAQrC,SAAS;wBAIT,kBACd,mBACA,cAAa,SAAS;;;;;;;;wBAYR,mBACd,mBACA,kBACA,gBAAgB,qBAChB,cAAa,SAAS;;wBAqBR,oBACd,mBACA,cAAa,SAAS;;wBAiBR,kBACd,mBACA,cAAa,SAAS,sCACrB;;wBAUa,gBACd,MAAM,mBACN,UAAU,iBACV,eACC"}

package/dist/contextDetailStore.mjs

@@ -24,7 +24,10 @@ const PRIVATE_FILE_MODE = 384;
 function agentDirectory(environment) {
 	return environment[AGENT_DIR_ENV] || path.join(os.homedir(), ".pi", "agent");
 }
-/** A session id reaches this from a query string, so it never becomes a path. */
+/**
+* A session id reaches this from a query string, so it never becomes a path.
+* `.` and `..` pass through unchanged: a caller using the result as a directory must refuse them.
+*/
 function safeName(sessionId) {
 	return sessionId.replace(/[^a-zA-Z0-9._-]/gu, "_");
 }
@@ -86,6 +89,6 @@ function findContextItem(file, itemKind, name) {
 	return file.items.find((item) => item.itemKind === itemKind && item.name === name);
 }
 //#endregion
-export { contextDetailPath, findContextItem, readContextDetail, removeContextDetail, writeContextDetail };
+export { agentDirectory, contextDetailPath, findContextItem, readContextDetail, removeContextDetail, safeName, writeContextDetail };
 
 //# sourceMappingURL=contextDetailStore.mjs.map

package/dist/contextDetailStore.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"contextDetailStore.mjs","names":[],"sources":["../src/services/contextDetailStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { CONTEXT_DETAIL_VERSION } from '../../constants/contextApi';\nimport type { ContextDetailFile, ContextItemDetail, ContextItemKind } from '../../types/contextApi';\n\n/**\n * Where the agent leaves the composition's detail for the session API to find.\n *\n * The two are separate processes: the inventory only exists inside the agent,\n * and the API that answers the browser is served by the session's host. Every\n * other package-owned API in the repository bridges that gap through the\n * filesystem rather than through the frame protocol, and this one follows,\n * because a file is also what makes the answer survive the agent going quiet\n * between turns.\n *\n * One file per session, replaced whole. The detail is a projection of the\n * composition, not a log of it, so an older copy has no reader.\n */\n\nconst DIRECTORY_NAME = 'doom-context';\nconst AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';\n/** Owner-only: a tool schema is not secret, but it describes the machine. */\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nfunction agentDirectory(environment: NodeJS.ProcessEnv): string {\n  return environment[AGENT_DIR_ENV] || path.join(os.homedir(), '.pi', 'agent');\n}\n\n/** A session id reaches this from a query string, so it never becomes a path. */\nfunction safeName(sessionId: string): string {\n  return sessionId.replace(/[^a-zA-Z0-9._-]/gu, '_');\n}\n\nexport function contextDetailPath(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): string {\n  return path.join(agentDirectory(environment), DIRECTORY_NAME, `${safeName(sessionId)}.json`);\n}\n\n/**\n * Publishes the detail for one session.\n *\n * Written through a temporary file so a reader never sees half a document, and\n * failures are reported to the caller rather than thrown: the panel works\n * without this, and a session must not be lost to a full disk.\n */\nexport function writeContextDetail(\n  sessionId: string,\n  revision: number,\n  items: readonly ContextItemDetail[],\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n  const target = contextDetailPath(sessionId, environment);\n  const payload: ContextDetailFile = { version: CONTEXT_DETAIL_VERSION, revision, items };\n  const temporary = `${target}.${String(process.pid)}.tmp`;\n  try {\n    fs.mkdirSync(path.dirname(target), { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n    fs.writeFileSync(temporary, JSON.stringify(payload), { mode: PRIVATE_FILE_MODE });\n    fs.renameSync(temporary, target);\n    return true;\n  } catch {\n    try {\n      fs.rmSync(temporary, { force: true });\n    } catch {\n      // The temporary file is already unreachable; nothing further to do.\n    }\n    return false;\n  }\n}\n\n/** Drops a session's file. Called when the session ends, so the directory does not grow forever. */\nexport function removeContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): void {\n  try {\n    fs.rmSync(contextDetailPath(sessionId, environment), { force: true });\n  } catch {\n    // A file that cannot be removed is stale, not fatal; the next session with\n    // this id overwrites it.\n  }\n}\n\nfunction isDetailFile(value: unknown): value is ContextDetailFile {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Record<string, unknown>;\n  return candidate.version === CONTEXT_DETAIL_VERSION && Array.isArray(candidate.items);\n}\n\n/** What the session wrote, or undefined when it has not written yet. */\nexport function readContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): ContextDetailFile | undefined {\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(contextDetailPath(sessionId, environment), 'utf8'));\n    return isDetailFile(parsed) ? parsed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One row's detail, matched the way the panel identifies it. */\nexport function findContextItem(\n  file: ContextDetailFile,\n  itemKind: ContextItemKind,\n  name: string,\n): ContextItemDetail | undefined {\n  return file.items.find((item) => item.itemKind === itemKind && item.name === name);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;;AAEtB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAE1B,SAAS,eAAe,aAAwC;CAC9D,OAAO,YAAY,kBAAkB,KAAK,KAAK,GAAG,QAAQ,GAAG,OAAO,OAAO;AAC7E;;AAGA,SAAS,SAAS,WAA2B;CAC3C,OAAO,UAAU,QAAQ,qBAAqB,GAAG;AACnD;AAEA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KAC5D;CACR,OAAO,KAAK,KAAK,eAAe,WAAW,GAAG,gBAAgB,GAAG,SAAS,SAAS,EAAE,MAAM;AAC7F;;;;;;;;AASA,SAAgB,mBACd,WACA,UACA,OACA,cAA4D,QAAQ,KAC3D;CACT,MAAM,SAAS,kBAAkB,WAAW,WAAW;CACvD,MAAM,UAA6B;EAAE,SAAA;EAAiC;EAAU;CAAM;CACtF,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;CACnD,IAAI;EACF,GAAG,UAAU,KAAK,QAAQ,MAAM,GAAG;GAAE,WAAW;GAAM,MAAM;EAAuB,CAAC;EACpF,GAAG,cAAc,WAAW,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,kBAAkB,CAAC;EAChF,GAAG,WAAW,WAAW,MAAM;EAC/B,OAAO;CACT,QAAQ;EACN,IAAI;GACF,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;EACtC,QAAQ,CAER;EACA,OAAO;CACT;AACF;;AAGA,SAAgB,oBACd,WACA,cAA4D,QAAQ,KAC9D;CACN,IAAI;EACF,GAAG,OAAO,kBAAkB,WAAW,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;CACtE,QAAQ,CAGR;AACF;AAEA,SAAS,aAAa,OAA4C;CAChE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OAAO,UAAU,YAAA,KAAsC,MAAM,QAAQ,UAAU,KAAK;AACtF;;AAGA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KACrC;CAC/B,IAAI;EACF,MAAM,SAAkB,KAAK,MAAM,GAAG,aAAa,kBAAkB,WAAW,WAAW,GAAG,MAAM,CAAC;EACrG,OAAO,aAAa,MAAM,IAAI,SAAS,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,gBACd,MACA,UACA,MAC+B;CAC/B,OAAO,KAAK,MAAM,MAAM,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,IAAI;AACnF"}
+{"version":3,"file":"contextDetailStore.mjs","names":[],"sources":["../src/services/contextDetailStore/index.ts"],"sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\n\nimport { CONTEXT_DETAIL_VERSION } from '../../constants/contextApi';\nimport type { ContextDetailFile, ContextItemDetail, ContextItemKind } from '../../types/contextApi';\n\n/**\n * Where the agent leaves the composition's detail for the session API to find.\n *\n * The two are separate processes: the inventory only exists inside the agent,\n * and the API that answers the browser is served by the session's host. Every\n * other package-owned API in the repository bridges that gap through the\n * filesystem rather than through the frame protocol, and this one follows,\n * because a file is also what makes the answer survive the agent going quiet\n * between turns.\n *\n * One file per session, replaced whole. The detail is a projection of the\n * composition, not a log of it, so an older copy has no reader.\n */\n\nconst DIRECTORY_NAME = 'doom-context';\nconst AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';\n/** Owner-only: a tool schema is not secret, but it describes the machine. */\nconst PRIVATE_DIRECTORY_MODE = 0o700;\nconst PRIVATE_FILE_MODE = 0o600;\n\nexport function agentDirectory(environment: Readonly<Record<string, string | undefined>>): string {\n  return environment[AGENT_DIR_ENV] || path.join(os.homedir(), '.pi', 'agent');\n}\n\n/**\n * A session id reaches this from a query string, so it never becomes a path.\n * `.` and `..` pass through unchanged: a caller using the result as a directory must refuse them.\n */\nexport function safeName(sessionId: string): string {\n  return sessionId.replace(/[^a-zA-Z0-9._-]/gu, '_');\n}\n\nexport function contextDetailPath(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): string {\n  return path.join(agentDirectory(environment), DIRECTORY_NAME, `${safeName(sessionId)}.json`);\n}\n\n/**\n * Publishes the detail for one session.\n *\n * Written through a temporary file so a reader never sees half a document, and\n * failures are reported to the caller rather than thrown: the panel works\n * without this, and a session must not be lost to a full disk.\n */\nexport function writeContextDetail(\n  sessionId: string,\n  revision: number,\n  items: readonly ContextItemDetail[],\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): boolean {\n  const target = contextDetailPath(sessionId, environment);\n  const payload: ContextDetailFile = { version: CONTEXT_DETAIL_VERSION, revision, items };\n  const temporary = `${target}.${String(process.pid)}.tmp`;\n  try {\n    fs.mkdirSync(path.dirname(target), { recursive: true, mode: PRIVATE_DIRECTORY_MODE });\n    fs.writeFileSync(temporary, JSON.stringify(payload), { mode: PRIVATE_FILE_MODE });\n    fs.renameSync(temporary, target);\n    return true;\n  } catch {\n    try {\n      fs.rmSync(temporary, { force: true });\n    } catch {\n      // The temporary file is already unreachable; nothing further to do.\n    }\n    return false;\n  }\n}\n\n/** Drops a session's file. Called when the session ends, so the directory does not grow forever. */\nexport function removeContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): void {\n  try {\n    fs.rmSync(contextDetailPath(sessionId, environment), { force: true });\n  } catch {\n    // A file that cannot be removed is stale, not fatal; the next session with\n    // this id overwrites it.\n  }\n}\n\nfunction isDetailFile(value: unknown): value is ContextDetailFile {\n  if (typeof value !== 'object' || value === null) return false;\n  const candidate = value as Record<string, unknown>;\n  return candidate.version === CONTEXT_DETAIL_VERSION && Array.isArray(candidate.items);\n}\n\n/** What the session wrote, or undefined when it has not written yet. */\nexport function readContextDetail(\n  sessionId: string,\n  environment: Readonly<Record<string, string | undefined>> = process.env,\n): ContextDetailFile | undefined {\n  try {\n    const parsed: unknown = JSON.parse(fs.readFileSync(contextDetailPath(sessionId, environment), 'utf8'));\n    return isDetailFile(parsed) ? parsed : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** One row's detail, matched the way the panel identifies it. */\nexport function findContextItem(\n  file: ContextDetailFile,\n  itemKind: ContextItemKind,\n  name: string,\n): ContextItemDetail | undefined {\n  return file.items.find((item) => item.itemKind === itemKind && item.name === name);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAqBA,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;;AAEtB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;AAE1B,SAAgB,eAAe,aAAmE;CAChG,OAAO,YAAY,kBAAkB,KAAK,KAAK,GAAG,QAAQ,GAAG,OAAO,OAAO;AAC7E;;;;;AAMA,SAAgB,SAAS,WAA2B;CAClD,OAAO,UAAU,QAAQ,qBAAqB,GAAG;AACnD;AAEA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KAC5D;CACR,OAAO,KAAK,KAAK,eAAe,WAAW,GAAG,gBAAgB,GAAG,SAAS,SAAS,EAAE,MAAM;AAC7F;;;;;;;;AASA,SAAgB,mBACd,WACA,UACA,OACA,cAA4D,QAAQ,KAC3D;CACT,MAAM,SAAS,kBAAkB,WAAW,WAAW;CACvD,MAAM,UAA6B;EAAE,SAAA;EAAiC;EAAU;CAAM;CACtF,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,QAAQ,GAAG,EAAE;CACnD,IAAI;EACF,GAAG,UAAU,KAAK,QAAQ,MAAM,GAAG;GAAE,WAAW;GAAM,MAAM;EAAuB,CAAC;EACpF,GAAG,cAAc,WAAW,KAAK,UAAU,OAAO,GAAG,EAAE,MAAM,kBAAkB,CAAC;EAChF,GAAG,WAAW,WAAW,MAAM;EAC/B,OAAO;CACT,QAAQ;EACN,IAAI;GACF,GAAG,OAAO,WAAW,EAAE,OAAO,KAAK,CAAC;EACtC,QAAQ,CAER;EACA,OAAO;CACT;AACF;;AAGA,SAAgB,oBACd,WACA,cAA4D,QAAQ,KAC9D;CACN,IAAI;EACF,GAAG,OAAO,kBAAkB,WAAW,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;CACtE,QAAQ,CAGR;AACF;AAEA,SAAS,aAAa,OAA4C;CAChE,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAClB,OAAO,UAAU,YAAA,KAAsC,MAAM,QAAQ,UAAU,KAAK;AACtF;;AAGA,SAAgB,kBACd,WACA,cAA4D,QAAQ,KACrC;CAC/B,IAAI;EACF,MAAM,SAAkB,KAAK,MAAM,GAAG,aAAa,kBAAkB,WAAW,WAAW,GAAG,MAAM,CAAC;EACrG,OAAO,aAAa,MAAM,IAAI,SAAS,KAAA;CACzC,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,gBACd,MACA,UACA,MAC+B;CAC/B,OAAO,KAAK,MAAM,MAAM,SAAS,KAAK,aAAa,YAAY,KAAK,SAAS,IAAI;AACnF"}

package/dist/headlessServer.cjs

@@ -5,9 +5,11 @@ const require_harnessErrorMessage = require("./src/server/harnessErrorMessage.cj
 const require_contextDetailStore = require("./contextDetailStore.cjs");
 const require_serverTelemetry = require("./serverTelemetry.cjs");
 const require_packageApi = require("./src/schemas/packageApi.cjs");
-const require_index = require("./src/services/sessionMcpActivity/index.cjs");
-const require_index$1 = require("./src/services/sessionMcpConversations/index.cjs");
-const require_index$2 = require("./src/services/sessionMcpRegistrationStore/index.cjs");
+const require_sessionFiles = require("./src/constants/sessionFiles.cjs");
+const require_index = require("./src/services/sessionAttachments/index.cjs");
+const require_index$1 = require("./src/services/sessionMcpActivity/index.cjs");
+const require_index$2 = require("./src/services/sessionMcpConversations/index.cjs");
+const require_index$3 = require("./src/services/sessionMcpRegistrationStore/index.cjs");
 const require_runtimeContextApi = require("./runtimeContextApi.cjs");
 const require_headlessProtocol = require("./src/server/headlessProtocol.cjs");
 const require_sessionMcpRoutes = require("./src/server/sessionMcpRoutes.cjs");
@@ -40,27 +42,11 @@ const DOOM_PACKAGE_API_PATH_PATTERN = /^\/api(?:\/workspaces\/([^/]+)(?:\/sessio
 const HEALTH_ROLE = "hub";
 const PROTOCOL_VERSION = 1;
 const MAX_BODY_BYTES = 8388608;
-const MAX_SESSION_FILE_BYTES = 26214400;
 const DIRECTORY_SUGGESTION_LIMIT = 12;
 const DIRECTORY_CHILDREN_LIMIT = 500;
 const HOME_PREFIX = "~";
 const WORKSPACE_NAME_MAX_LENGTH = 80;
 const WORKSPACE_NAME_PATTERN = /^[A-Za-z0-9][A-Za-z0-9 ._-]*$/u;
-const SESSION_FILE_CONTENT_TYPES = {
-	".avif": "image/avif",
-	".bmp": "image/bmp",
-	".gif": "image/gif",
-	".jpeg": "image/jpeg",
-	".jpg": "image/jpeg",
-	".png": "image/png",
-	".svg": "image/svg+xml",
-	".webp": "image/webp",
-	".m4v": "video/mp4",
-	".mov": "video/quicktime",
-	".mp4": "video/mp4",
-	".webm": "video/webm",
-	".pdf": "application/pdf"
-};
 function sessionView(session) {
 	return {
 		id: session.id,
@@ -167,11 +153,11 @@ async function sessionFile(session, requestedPath) {
 	try {
 		const stat = await handle.stat();
 		if (!stat.isFile()) return Response.json({ error: "Session file not found." }, { status: 404 });
-		if (stat.size > MAX_SESSION_FILE_BYTES) return Response.json({ error: "Session file is too large." }, { status: 413 });
+		if (stat.size > 26214400) return Response.json({ error: "Session file is too large." }, { status: 413 });
 		const bytes = await handle.readFile();
-		if (bytes.byteLength > MAX_SESSION_FILE_BYTES) return Response.json({ error: "Session file is too large." }, { status: 413 });
+		if (bytes.byteLength > 26214400) return Response.json({ error: "Session file is too large." }, { status: 413 });
 		return new Response(bytes, { headers: {
-			"content-type": SESSION_FILE_CONTENT_TYPES[node_path.default.extname(filePath).toLowerCase()] ?? "application/octet-stream",
+			"content-type": require_sessionFiles.SESSION_FILE_CONTENT_TYPES[node_path.default.extname(filePath).toLowerCase()] ?? "application/octet-stream",
 			"content-length": String(bytes.byteLength),
 			"cache-control": "no-store",
 			"x-content-type-options": "nosniff"
@@ -243,13 +229,18 @@ async function directoryChildren(requested) {
 		directories
 	};
 }
+var RequestBodyTooLargeError = class extends Error {
+	constructor() {
+		super("Request body is too large.");
+	}
+};
 async function readBody(request) {
 	const chunks = [];
 	let size = 0;
 	for await (const chunk of request) {
 		const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		size += buffer.byteLength;
-		if (size > MAX_BODY_BYTES) throw new Error("Request body is too large.");
+		if (size > MAX_BODY_BYTES) throw new RequestBodyTooLargeError();
 		chunks.push(buffer);
 	}
 	return Buffer.concat(chunks);
@@ -367,9 +358,9 @@ async function serveHeadlessServer(options) {
 		publicOriginRevision: options.sessionMcpPublicOriginRevision,
 		onNotice: options.onNotice,
 		isSessionPersisted: options.isSessionPersisted,
-		activityStore: require_index.createSessionMcpActivityStore(sessionMcpStateDir),
-		conversationStore: require_index$1.createSessionMcpConversationStore(sessionMcpStateDir),
-		registrationStore: require_index$2.createSessionMcpRegistrationStore({
+		activityStore: require_index$1.createSessionMcpActivityStore(sessionMcpStateDir),
+		conversationStore: require_index$2.createSessionMcpConversationStore(sessionMcpStateDir),
+		registrationStore: require_index$3.createSessionMcpRegistrationStore({
 			stateDir: sessionMcpStateDir,
 			onNotice: options.onNotice
 		})
@@ -793,6 +784,18 @@ async function serveHeadlessServer(options) {
 			await writeResponse(response, await sessionFile(session, url.searchParams.get("path")));
 			return;
 		}
+		if (suffix === "/attachments" && request.method === "POST") {
+			let bytes;
+			try {
+				bytes = await readBody(request);
+			} catch (error) {
+				if (!(error instanceof RequestBodyTooLargeError)) throw error;
+				json(response, 413, { error: "The attachment exceeds the 8 MB upload limit." });
+				return;
+			}
+			json(response, 201, await require_index.writeSessionAttachment(sessionId, url.searchParams.get("name") ?? "file", bytes));
+			return;
+		}
 		if (suffix === "/restart" && request.method === "POST" && options.restartSession) {
 			const restart = options.restartSession(session);
 			const settled = restart.then(() => void 0, () => void 0);