@baique/pi-web-sky 0.1.35 → 0.1.36

package/lib/allowed-roots.ts

@@ -0,0 +1,31 @@
+import { toSlashPath } from "./paths";
+
+// In-memory roots that should be browsable in addition to roots derived from
+// persisted sessions. Stored on globalThis so Next.js hot-reload keeps them.
+declare global {
+  var __piAllowedRootsCache: { roots: Set<string>; expiresAt: number } | undefined;
+  var __piAdditionalAllowedRoots: Set<string> | undefined;
+}
+
+/**
+ * Allowed roots are internal bookkeeping keys that are never displayed, so they
+ * are stored slash-normalized for consistent Set membership. Correctness does
+ * not depend on it — isPathWithinRoots() re-normalizes whatever it is given.
+ */
+export function normalizeSlashes(filePath: string): string {
+  return toSlashPath(filePath);
+}
+
+export function getAdditionalAllowedRoots(): Set<string> {
+  if (!globalThis.__piAdditionalAllowedRoots) {
+    globalThis.__piAdditionalAllowedRoots = new Set();
+  }
+  return globalThis.__piAdditionalAllowedRoots;
+}
+
+export function allowFileRoot(root: string): void {
+  if (!root) return;
+  const normalizedRoot = normalizeSlashes(root);
+  getAdditionalAllowedRoots().add(normalizedRoot);
+  globalThis.__piAllowedRootsCache?.roots.add(normalizedRoot);
+}

package/lib/ansi.test.mjs

@@ -0,0 +1,52 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+async function loadSubject() {
+  return import("./ansi.ts");
+}
+
+test("strips ANSI escape sequences", async () => {
+  const { stripAnsi } = await loadSubject();
+
+  assert.equal(stripAnsi("\x1b[31mred\x1b[0m plain"), "red plain");
+  assert.equal(stripAnsi("answer\x1b_pi:c\x07"), "answer");
+});
+
+test("normalizes boxed custom panel lines while preserving ANSI codes", async () => {
+  const { normalizeCustomPanelLines, stripAnsi } = await loadSubject();
+  const lines = [
+    "┌──────┐",
+    "│ \x1b[32mOK\x1b[0m   │",
+    "└──────┘",
+  ];
+
+  const normalized = normalizeCustomPanelLines(lines);
+
+  assert.equal(normalized.length, 1);
+  assert.equal(stripAnsi(normalized[0]), "OK");
+  assert.match(normalized[0], /\x1b\[32m/);
+});
+
+test("removes pi-tui cursor markers from custom panel output", async () => {
+  const { normalizeCustomPanelLines } = await loadSubject();
+
+  assert.deepEqual(normalizeCustomPanelLines(["> value\x1b_pi:c\x07"]), ["> value"]);
+});
+
+test("parses ANSI style segments and reset codes", async () => {
+  const { parseAnsiLine } = await loadSubject();
+
+  assert.deepEqual(parseAnsiLine("\x1b[31;1mhot\x1b[0m cold"), [
+    { text: "hot", style: { color: "#dc2626", fontWeight: 700 } },
+    { text: " cold", style: {} },
+  ]);
+});
+
+test("maps 256-color SGR codes", async () => {
+  const { ansi256Color, parseAnsiLine } = await loadSubject();
+
+  assert.equal(ansi256Color(196), "rgb(255, 0, 0)");
+  assert.deepEqual(parseAnsiLine("\x1b[38;5;196mred"), [
+    { text: "red", style: { color: "rgb(255, 0, 0)" } },
+  ]);
+});

package/lib/ansi.ts

@@ -0,0 +1,211 @@
+import type { CSSProperties } from "react";
+
+const ANSI_ESCAPE_RE = /\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\))/g;
+const ANSI_ESCAPE_AT_START_RE = /^\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1B\\))/;
+const ANSI_SGR_RE = /\x1B\[([0-9;]*)m/g;
+const TUI_CURSOR_MARKER_RE = /\x1B_pi:c\x07/g;
+
+const ANSI_8_COLORS = [
+  "#1f2937",
+  "#dc2626",
+  "#16a34a",
+  "#d97706",
+  "#2563eb",
+  "#9333ea",
+  "#0891b2",
+  "#6b7280",
+];
+
+const ANSI_BRIGHT_COLORS = [
+  "#9ca3af",
+  "#ef4444",
+  "#22c55e",
+  "#f59e0b",
+  "#3b82f6",
+  "#a855f7",
+  "#06b6d4",
+  "#e5e7eb",
+];
+
+export interface AnsiSegment {
+  text: string;
+  style: CSSProperties;
+}
+
+export function stripAnsi(text: string): string {
+  return text.replace(TUI_CURSOR_MARKER_RE, "").replace(ANSI_ESCAPE_RE, "");
+}
+
+function visibleCharPositions(text: string): Array<{ start: number; end: number; char: string }> {
+  const positions: Array<{ start: number; end: number; char: string }> = [];
+  let i = 0;
+  while (i < text.length) {
+    if (text.charCodeAt(i) === 0x1b) {
+      const match = text.slice(i).match(ANSI_ESCAPE_AT_START_RE);
+      if (match) {
+        i += match[0].length;
+        continue;
+      }
+    }
+    const codePoint = text.codePointAt(i);
+    if (codePoint === undefined) break;
+    const char = String.fromCodePoint(codePoint);
+    positions.push({ start: i, end: i + char.length, char });
+    i += char.length;
+  }
+  return positions;
+}
+
+function removeVisibleCharAt(text: string, index: number): string {
+  const positions = visibleCharPositions(text);
+  const pos = positions[index];
+  if (!pos) return text;
+  return text.slice(0, pos.start) + text.slice(pos.end);
+}
+
+function firstVisibleChar(text: string): string | undefined {
+  return visibleCharPositions(text)[0]?.char;
+}
+
+function lastNonSpaceVisibleCharIndex(text: string): number {
+  const positions = visibleCharPositions(text);
+  for (let i = positions.length - 1; i >= 0; i--) {
+    if (positions[i].char.trim() !== "") return i;
+  }
+  return -1;
+}
+
+function trimEndVisibleSpaces(text: string): string {
+  let next = text;
+  while (true) {
+    const positions = visibleCharPositions(next);
+    const last = positions[positions.length - 1];
+    if (!last || last.char.trim() !== "") return next;
+    next = next.slice(0, last.start) + next.slice(last.end);
+  }
+}
+
+export function normalizeCustomPanelLines(lines: string[]): string[] {
+  const horizontalFrameLine = /^[┌├└╭╰][─┬┴┼]+[┐┤┘╮╯]$/;
+  const normalized: string[] = [];
+
+  for (const rawLine of lines) {
+    const lineWithoutCursor = rawLine.replace(TUI_CURSOR_MARKER_RE, "");
+    const plain = stripAnsi(lineWithoutCursor).trimEnd();
+    if (horizontalFrameLine.test(plain)) continue;
+
+    let line = lineWithoutCursor;
+    const first = firstVisibleChar(line);
+    if (first === "│" || first === "┃") {
+      line = removeVisibleCharAt(line, 0);
+      if (firstVisibleChar(line) === " ") line = removeVisibleCharAt(line, 0);
+    }
+
+    const rightBorderIndex = lastNonSpaceVisibleCharIndex(line);
+    const rightBorder = rightBorderIndex >= 0 ? visibleCharPositions(line)[rightBorderIndex]?.char : undefined;
+    if (rightBorder === "│" || rightBorder === "┃") {
+      line = removeVisibleCharAt(line, rightBorderIndex);
+    }
+
+    normalized.push(trimEndVisibleSpaces(line));
+  }
+
+  while (normalized.length > 0 && stripAnsi(normalized[0]).trim() === "") normalized.shift();
+  while (normalized.length > 0 && stripAnsi(normalized[normalized.length - 1]).trim() === "") normalized.pop();
+  return normalized.length ? normalized : lines;
+}
+
+export function ansi256Color(index: number): string | undefined {
+  if (index >= 0 && index < 8) return ANSI_8_COLORS[index];
+  if (index >= 8 && index < 16) return ANSI_BRIGHT_COLORS[index - 8];
+  if (index >= 16 && index <= 231) {
+    const n = index - 16;
+    const r = Math.floor(n / 36);
+    const g = Math.floor((n % 36) / 6);
+    const b = n % 6;
+    const scale = (v: number) => v === 0 ? 0 : 55 + v * 40;
+    return `rgb(${scale(r)}, ${scale(g)}, ${scale(b)})`;
+  }
+  if (index >= 232 && index <= 255) {
+    const gray = 8 + (index - 232) * 10;
+    return `rgb(${gray}, ${gray}, ${gray})`;
+  }
+  return undefined;
+}
+
+function applyAnsiCodes(style: CSSProperties, codes: number[]): CSSProperties {
+  const next: CSSProperties = { ...style };
+  for (let i = 0; i < codes.length; i++) {
+    const code = codes[i];
+    if (code === 0) {
+      for (const key of Object.keys(next) as Array<keyof CSSProperties>) delete next[key];
+    } else if (code === 1) {
+      next.fontWeight = 700;
+    } else if (code === 2) {
+      next.opacity = 0.65;
+    } else if (code === 3) {
+      next.fontStyle = "italic";
+    } else if (code === 4) {
+      next.textDecoration = "underline";
+    } else if (code === 22) {
+      delete next.fontWeight;
+      delete next.opacity;
+    } else if (code === 23) {
+      delete next.fontStyle;
+    } else if (code === 24) {
+      delete next.textDecoration;
+    } else if (code === 39) {
+      delete next.color;
+    } else if (code === 49) {
+      delete next.backgroundColor;
+    } else if (code >= 30 && code <= 37) {
+      next.color = ANSI_8_COLORS[code - 30];
+    } else if (code >= 90 && code <= 97) {
+      next.color = ANSI_BRIGHT_COLORS[code - 90];
+    } else if (code >= 40 && code <= 47) {
+      next.backgroundColor = ANSI_8_COLORS[code - 40];
+    } else if (code >= 100 && code <= 107) {
+      next.backgroundColor = ANSI_BRIGHT_COLORS[code - 100];
+    } else if ((code === 38 || code === 48) && codes[i + 1] === 2) {
+      const [r, g, b] = [codes[i + 2], codes[i + 3], codes[i + 4]];
+      if ([r, g, b].every((value) => typeof value === "number" && Number.isFinite(value))) {
+        if (code === 38) next.color = `rgb(${r}, ${g}, ${b})`;
+        else next.backgroundColor = `rgb(${r}, ${g}, ${b})`;
+      }
+      i += 4;
+    } else if ((code === 38 || code === 48) && codes[i + 1] === 5) {
+      const color = ansi256Color(codes[i + 2]);
+      if (color) {
+        if (code === 38) next.color = color;
+        else next.backgroundColor = color;
+      }
+      i += 2;
+    }
+  }
+  return next;
+}
+
+export function parseAnsiLine(line: string): AnsiSegment[] {
+  const segments: AnsiSegment[] = [];
+  let style: CSSProperties = {};
+  let lastIndex = 0;
+  let match: RegExpExecArray | null;
+  ANSI_SGR_RE.lastIndex = 0;
+
+  while ((match = ANSI_SGR_RE.exec(line)) !== null) {
+    if (match.index > lastIndex) {
+      segments.push({ text: line.slice(lastIndex, match.index), style });
+    }
+    const codes = match[1]
+      ? match[1].split(";").map((part) => Number(part || "0"))
+      : [0];
+    style = applyAnsiCodes(style, codes);
+    lastIndex = match.index + match[0].length;
+  }
+
+  if (lastIndex < line.length) {
+    segments.push({ text: line.slice(lastIndex), style });
+  }
+
+  return segments;
+}

package/lib/api-types.ts

@@ -0,0 +1,139 @@
+import type { ResourceDiagnostic } from "@earendil-works/pi-coding-agent";
+
+export interface SkillSearchResult {
+  package: string;
+  installs: string;
+  url: string;
+}
+
+export type SkillInstallScope = "global" | "project";
+
+export interface SkillInstallInfo {
+  package: string;
+  scope: SkillInstallScope;
+  source: string;
+  sourceType?: string;
+  skillsShUrl?: string;
+  skillPath?: string;
+  ref?: string;
+  versionHash?: string;
+  canCheckForUpdates: boolean;
+}
+
+export type SkillUpdateState =
+  | "up-to-date"
+  | "update-available"
+  | "unsupported"
+  | "error";
+
+export interface SkillUpdateResult {
+  package: string;
+  scope: SkillInstallScope;
+  state: SkillUpdateState;
+  currentVersion?: string;
+  latestVersion?: string;
+  message?: string;
+}
+
+export interface SkillInfo {
+  name: string;
+  description: string;
+  filePath: string;
+  baseDir: string;
+  disableModelInvocation: boolean;
+  sourceInfo: {
+    source?: string;
+    scope?: string;
+  };
+  install?: SkillInstallInfo;
+}
+
+export interface SkillsResponse {
+  skills: SkillInfo[];
+  diagnostics: ResourceDiagnostic[];
+  projectResourcesLoaded: boolean;
+}
+
+export interface ProjectTrustStatus {
+  requiresTrust: boolean;
+  trusted: boolean;
+}
+
+export interface AppUpdateResponse {
+  currentVersion: string;
+  latestVersion: string;
+  updateAvailable: boolean;
+  releaseUrl: string;
+}
+
+export type PluginScope = "global" | "project";
+export type PluginResourceKind = "extension" | "skill" | "prompt" | "theme";
+
+export interface PluginResourceCounts {
+  extensions: number;
+  skills: number;
+  prompts: number;
+  themes: number;
+}
+
+export interface PluginDiagnostic {
+  type: "warning" | "error";
+  message: string;
+  source?: string;
+  path?: string;
+}
+
+export interface PluginResourceInfo {
+  kind: PluginResourceKind;
+  name: string;
+  path: string;
+  relativePath: string;
+}
+
+export interface PluginPackageInfo {
+  source: string;
+  scope: PluginScope;
+  filtered: boolean;
+  disabled: boolean;
+  installedPath?: string;
+  packageName?: string;
+  version?: string;
+  configuredVersion?: string;
+  counts: PluginResourceCounts;
+  resources: PluginResourceInfo[];
+  status: "loaded" | "installed" | "missing" | "disabled";
+}
+
+export interface PluginsResponse {
+  packages: PluginPackageInfo[];
+  totals: PluginResourceCounts;
+  diagnostics: PluginDiagnostic[];
+  projectResourcesLoaded: boolean;
+}
+
+export type McpScope = "global" | "project";
+
+export interface McpServerInfo {
+  name: string;
+  scope: McpScope;
+  disabled: boolean;
+  kind: "command" | "url" | "socket";
+  command?: string;
+  args: string[];
+  url?: string;
+  socket?: string;
+  /** 环境变量名列表（不含值，避免泄露） */
+  envKeys: string[];
+  /** Remaining server options (lifecycle / directTools / timeout, etc.) */
+  options: Record<string, unknown>;
+  /** Path of the config file that defines this server */
+  source: string;
+}
+
+export interface McpResponse {
+  servers: McpServerInfo[];
+  /** Settings merged from global + project */
+  settings: Record<string, unknown>;
+  diagnostics: string[];
+  projectResourcesLoaded: boolean;
+}

package/lib/app-update.test.mjs

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { createJiti } from "jiti";
+
+const jiti = createJiti(import.meta.url);
+const { getPiWebReleaseUrl, isNewerStableVersion } = await jiti.import("./app-update.ts");
+
+test("detects newer stable Pi Web versions", () => {
+  assert.equal(isNewerStableVersion("0.8.8", "0.8.7"), true);
+  assert.equal(isNewerStableVersion("0.9.0", "0.8.7"), true);
+  assert.equal(isNewerStableVersion("1.0.0", "0.9.9"), true);
+});
+
+test("does not report equal, older, or unsupported versions as updates", () => {
+  assert.equal(isNewerStableVersion("0.8.7", "0.8.7"), false);
+  assert.equal(isNewerStableVersion("0.8.6", "0.8.7"), false);
+  assert.equal(isNewerStableVersion("0.8.8-beta.1", "0.8.7"), false);
+  assert.equal(isNewerStableVersion("invalid", "0.8.7"), false);
+});
+
+test("builds a release-notes URL only for stable versions", () => {
+  assert.equal(
+    getPiWebReleaseUrl("0.8.8"),
+    "https://github.com/agegr/pi-web/releases/tag/v0.8.8",
+  );
+  assert.equal(getPiWebReleaseUrl("0.8.8-beta.1"), null);
+});

package/lib/app-update.ts

@@ -0,0 +1,28 @@
+const STABLE_VERSION_PATTERN = /^(\d+)\.(\d+)\.(\d+)$/;
+
+function parseStableVersion(version: string): [number, number, number] | null {
+  const match = STABLE_VERSION_PATTERN.exec(version);
+  if (!match) return null;
+
+  const parts = match.slice(1).map(Number);
+  if (parts.some((part) => !Number.isSafeInteger(part))) return null;
+  return parts as [number, number, number];
+}
+
+export function isNewerStableVersion(candidate: string, current: string): boolean {
+  const candidateParts = parseStableVersion(candidate);
+  const currentParts = parseStableVersion(current);
+  if (!candidateParts || !currentParts) return false;
+
+  for (let index = 0; index < candidateParts.length; index += 1) {
+    if (candidateParts[index] !== currentParts[index]) {
+      return candidateParts[index] > currentParts[index];
+    }
+  }
+  return false;
+}
+
+export function getPiWebReleaseUrl(version: string): string | null {
+  if (!parseStableVersion(version)) return null;
+  return `https://github.com/agegr/pi-web/releases/tag/v${version}`;
+}

package/lib/atomic-file.test.mjs

@@ -0,0 +1,37 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+
+const { writePrivateFileAtomicSync } = await import("./atomic-file.ts");
+
+function createTempRoot(t) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "pi-web-atomic-file-"));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  return root;
+}
+
+test("atomically replaces a file with restrictive permissions", (t) => {
+  const root = createTempRoot(t);
+  const destination = path.join(root, "models.json");
+  fs.writeFileSync(destination, "old", { mode: 0o644 });
+
+  writePrivateFileAtomicSync(destination, "new");
+
+  assert.equal(fs.readFileSync(destination, "utf8"), "new");
+  assert.deepEqual(fs.readdirSync(root), ["models.json"]);
+  if (process.platform !== "win32") {
+    assert.equal(fs.statSync(destination).mode & 0o777, 0o600);
+  }
+});
+
+test("keeps the destination and removes the temporary file when replacement fails", (t) => {
+  const root = createTempRoot(t);
+  const destination = path.join(root, "models.json");
+  fs.mkdirSync(destination);
+
+  assert.throws(() => writePrivateFileAtomicSync(destination, "new"));
+  assert.equal(fs.statSync(destination).isDirectory(), true);
+  assert.deepEqual(fs.readdirSync(root), ["models.json"]);
+});

package/lib/atomic-file.ts

@@ -0,0 +1,34 @@
+import { randomUUID } from "crypto";
+import { renameSync, unlinkSync, writeFileSync } from "fs";
+import { basename, dirname, join } from "path";
+
+/**
+ * Replace a file atomically without exposing credentials through default
+ * process permissions. The caller must create the parent directory first.
+ */
+export function writePrivateFileAtomicSync(path: string, contents: string): void {
+  const dir = dirname(path);
+  const tempPath = join(dir, `.${basename(path)}-${randomUUID()}.tmp`);
+  let operationFailed = false;
+
+  try {
+    writeFileSync(tempPath, contents, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: 0o600,
+      flush: true,
+    });
+    renameSync(tempPath, path);
+  } catch (error) {
+    operationFailed = true;
+    throw error;
+  } finally {
+    try {
+      unlinkSync(tempPath);
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT" && !operationFailed) {
+        throw error;
+      }
+    }
+  }
+}