@baique/pi-web-sky 0.1.48 → 0.1.49

package/.next/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":10257289,"timestamp":767316688167,"id":14,"parentId":1,"tags":{},"startTime":1789029807990,"traceId":"1288c02042c822d4"},{"name":"run-typescript","duration":7893653,"timestamp":767326948300,"id":794,"parentId":1,"tags":{},"startTime":1789029818250,"traceId":"1288c02042c822d4"},{"name":"static-check","duration":1894277,"timestamp":767334849106,"id":797,"parentId":1,"tags":{},"startTime":1789029826151,"traceId":"1288c02042c822d4"},{"name":"static-generation","duration":2639059,"timestamp":767336903032,"id":941,"parentId":1,"tags":{},"startTime":1789029828205,"traceId":"1288c02042c822d4"},{"name":"collect-build-traces","duration":15906223,"timestamp":767336744974,"id":938,"parentId":1,"tags":{},"startTime":1789029828047,"traceId":"1288c02042c822d4"},{"name":"telemetry-flush","duration":19,"timestamp":767352653174,"id":950,"parentId":1,"tags":{},"startTime":1789029843955,"traceId":"1288c02042c822d4"},{"name":"next-build","duration":36107053,"timestamp":767316546144,"id":1,"tags":{"buildMode":"default","version":"16.3.1","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1789029807848,"traceId":"1288c02042c822d4"}]
+[{"name":"run-webpack","duration":8981522,"timestamp":768123845995,"id":14,"parentId":1,"tags":{},"startTime":1789030615100,"traceId":"ff0372cbd3f70d5f"},{"name":"run-typescript","duration":8270408,"timestamp":768132829087,"id":772,"parentId":1,"tags":{},"startTime":1789030624083,"traceId":"ff0372cbd3f70d5f"},{"name":"static-check","duration":1960226,"timestamp":768141106442,"id":775,"parentId":1,"tags":{},"startTime":1789030632360,"traceId":"ff0372cbd3f70d5f"},{"name":"static-generation","duration":2740074,"timestamp":768143204314,"id":919,"parentId":1,"tags":{},"startTime":1789030634458,"traceId":"ff0372cbd3f70d5f"},{"name":"collect-build-traces","duration":16174753,"timestamp":768143068236,"id":916,"parentId":1,"tags":{},"startTime":1789030634322,"traceId":"ff0372cbd3f70d5f"},{"name":"telemetry-flush","duration":20,"timestamp":768159244994,"id":928,"parentId":1,"tags":{},"startTime":1789030650499,"traceId":"ff0372cbd3f70d5f"},{"name":"next-build","duration":35492403,"timestamp":768123752616,"id":1,"tags":{"buildMode":"default","version":"16.3.1","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1789030615007,"traceId":"ff0372cbd3f70d5f"}]

package/bin/pi-web-options.js

@@ -34,7 +34,7 @@ function parseLaunchOptions(args = process.argv.slice(2), env = process.env) {
   });
 
   return {
-    port: normalizePort(cliArgs.port ?? env.PORT ?? "30141"),
+    port: normalizePort(cliArgs.port ?? env.PORT ?? "30143"),
     hostname: cliArgs.hostname ?? env.PI_WEB_HOSTNAME ?? "127.0.0.1",
     openBrowser: !cliArgs["no-open"] && !isEnabled(env.PI_WEB_NO_OPEN),
   };

package/lib/pi-web-options.test.mjs

@@ -7,7 +7,7 @@ const { parseLaunchOptions } = require("../bin/pi-web-options.js");
 
 test("opens the browser by default", () => {
   assert.deepEqual(parseLaunchOptions([], {}), {
-    port: "30141",
+    port: "30143",
     hostname: "127.0.0.1",
     openBrowser: true,
   });
@@ -42,11 +42,11 @@ test("preserves port and hostname options", () => {
 
 test("rejects port values that could inject cmd arguments", () => {
   assert.throws(
-    () => parseLaunchOptions(["-p", "30141&whoami"], {}),
+    () => parseLaunchOptions(["-p", "30143&whoami"], {}),
     /Port must be a non-negative integer/,
   );
   assert.throws(
-    () => parseLaunchOptions([], { PORT: "30141&whoami" }),
+    () => parseLaunchOptions([], { PORT: "30143&whoami" }),
     /Port must be a non-negative integer/,
   );
 });

package/lib/project-command-env.test.mjs

@@ -16,7 +16,7 @@ const {
 } = await createJiti(import.meta.url).import("./project-command-env.ts");
 
 const HOST_ENVIRONMENT = {
-  PORT: "30141",
+  PORT: "30143",
   NODE_ENV: "production",
   NEXT_RUNTIME: "nodejs",
   NEXT_PRIVATE_WORKER: "1",
@@ -41,7 +41,7 @@ test("sanitizes host variables using platform casing rules", () => {
   assert.deepEqual(
     sanitizeProjectCommandEnvironment(
       {
-        Port: "30141",
+        Port: "30143",
         node_env: "production",
         Next_Runtime: "nodejs",
         NEXT_PUBLIC_FLAG: "1",
@@ -54,7 +54,7 @@ test("sanitizes host variables using platform casing rules", () => {
   assert.deepEqual(
     sanitizeProjectCommandEnvironment(
       {
-        PORT: "30141",
+        PORT: "30143",
         Port: "project-value",
         NODE_ENV: "production",
         node_env: "project-mode",
@@ -80,7 +80,7 @@ test("agent bash removes host variables while preserving SDK and user environmen
     PI_USER_SETTING: process.env.PI_USER_SETTING,
   };
   Object.assign(process.env, {
-    PORT: "30141",
+    PORT: "30143",
     NODE_ENV: "production",
     NEXT_RUNTIME: "nodejs",
     NEXT_PRIVATE_WORKER: "1",

package/lib/request-security.test.mjs

@@ -7,27 +7,27 @@ async function loadSubject() {
 
 test("allows same-origin and non-browser API requests", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "localhost:30141",
-      origin: "http://localhost:30141",
+      host: "localhost:30143",
+      origin: "http://localhost:30143",
       "sec-fetch-site": "same-origin",
     },
   })), true);
-  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30143/api/test", {
     method: "POST",
-    headers: { host: "localhost:30141" },
+    headers: { host: "localhost:30143" },
   })), true);
 });
 
 test("allows LAN same-origin requests when Next.js uses an internal localhost URL", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  const request = new Request("http://localhost:30141/api/test", {
+  const request = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "192.168.32.7:30141",
-      origin: "http://192.168.32.7:30141",
+      host: "192.168.32.7:30143",
+      origin: "http://192.168.32.7:30143",
       "sec-fetch-site": "same-origin",
     },
   });
@@ -36,19 +36,19 @@ test("allows LAN same-origin requests when Next.js uses an internal localhost UR
 
 test("allows IPv6 and an explicitly configured hostname", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  const ipv6 = new Request("http://localhost:30141/api/test", {
+  const ipv6 = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "[::1]:30141",
-      origin: "http://[::1]:30141",
+      host: "[::1]:30143",
+      origin: "http://[::1]:30143",
       "sec-fetch-site": "same-origin",
     },
   });
-  const configured = new Request("http://localhost:30141/api/test", {
+  const configured = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "pi-web.internal:30141",
-      origin: "http://pi-web.internal:30141",
+      host: "pi-web.internal:30143",
+      origin: "http://pi-web.internal:30143",
       "sec-fetch-site": "same-origin",
     },
   });
@@ -58,16 +58,16 @@ test("allows IPv6 and an explicitly configured hostname", async () => {
 
 test("rejects cross-origin browser API requests", async () => {
   const { isApiRequestAllowed, shouldCheckApiRequestOrigin } = await loadSubject();
-  const post = new Request("http://localhost:30141/api/test", {
+  const post = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "localhost:30141",
+      host: "localhost:30143",
       origin: "https://attacker.example",
       "sec-fetch-site": "cross-site",
     },
   });
-  const crossSiteGet = new Request("http://localhost:30141/api/sessions", {
-    headers: { host: "localhost:30141", "sec-fetch-site": "cross-site" },
+  const crossSiteGet = new Request("http://localhost:30143/api/sessions", {
+    headers: { host: "localhost:30143", "sec-fetch-site": "cross-site" },
   });
   assert.equal(shouldCheckApiRequestOrigin(post), true);
   assert.equal(isApiRequestAllowed(post), false);
@@ -77,10 +77,10 @@ test("rejects cross-origin browser API requests", async () => {
 
 test("does not globally trust opaque iframe or alternate loopback origins", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  const previewUrl = "http://localhost:30141/api/files/tmp/test.docx?type=preview";
+  const previewUrl = "http://localhost:30143/api/files/tmp/test.docx?type=preview";
   const opaqueIframe = new Request(previewUrl, {
     headers: {
-      host: "localhost:30141",
+      host: "localhost:30143",
       origin: "null",
       "sec-fetch-site": "cross-site",
       "sec-fetch-mode": "navigate",
@@ -89,8 +89,8 @@ test("does not globally trust opaque iframe or alternate loopback origins", asyn
   });
   const alternateLoopback = new Request(previewUrl, {
     headers: {
-      host: "localhost:30141",
-      origin: "http://127.0.0.1:30141",
+      host: "localhost:30143",
+      origin: "http://127.0.0.1:30143",
       "sec-fetch-site": "cross-site",
     },
   });
@@ -102,7 +102,7 @@ test("does not globally trust opaque iframe or alternate loopback origins", asyn
 test("allows only user-initiated session export document navigations from a PWA", async () => {
   const { isApiRequestAllowed } = await loadSubject();
   const navigationHeaders = {
-    host: "127.0.0.1:30141",
+    host: "127.0.0.1:30143",
     "sec-fetch-site": "cross-site",
     "sec-fetch-mode": "navigate",
     "sec-fetch-dest": "document",
@@ -110,19 +110,19 @@ test("allows only user-initiated session export document navigations from a PWA"
   };
 
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    "http://127.0.0.1:30143/api/sessions/session-id/export?inline=1",
     { headers: navigationHeaders },
   )), true);
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions",
+    "http://127.0.0.1:30143/api/sessions",
     { headers: navigationHeaders },
   )), false);
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    "http://127.0.0.1:30143/api/sessions/session-id/export?inline=1",
     { headers: { ...navigationHeaders, "sec-fetch-dest": "empty" } },
   )), false);
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    "http://127.0.0.1:30143/api/sessions/session-id/export?inline=1",
     {
       headers: {
         ...navigationHeaders,
@@ -131,21 +131,21 @@ test("allows only user-initiated session export document navigations from a PWA"
     },
   )), false);
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
+    "http://127.0.0.1:30143/api/sessions/session-id/export?inline=1",
     { method: "POST", headers: navigationHeaders },
   )), false);
   assert.equal(isApiRequestAllowed(new Request(
-    "http://127.0.0.1:30141/api/sessions/session-id/export?inline=1",
-    { headers: { ...navigationHeaders, host: "attacker.example:30141" } },
+    "http://127.0.0.1:30143/api/sessions/session-id/export?inline=1",
+    { headers: { ...navigationHeaders, host: "attacker.example:30143" } },
   )), false);
 });
 
 test("rejects an origin that does not match the external request host", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  const request = new Request("http://localhost:30141/api/test", {
+  const request = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "192.168.32.7:30141",
+      host: "192.168.32.7:30143",
       origin: "http://attacker.example",
       "sec-fetch-site": "same-site",
     },
@@ -155,11 +155,11 @@ test("rejects an origin that does not match the external request host", async ()
 
 test("rejects DNS rebinding even when browser headers say same-origin", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  const request = new Request("http://localhost:30141/api/skills/install", {
+  const request = new Request("http://localhost:30143/api/skills/install", {
     method: "POST",
     headers: {
-      host: "attacker.example:30141",
-      origin: "http://attacker.example:30141",
+      host: "attacker.example:30143",
+      origin: "http://attacker.example:30143",
       "sec-fetch-site": "same-origin",
       "content-type": "application/json",
     },
@@ -169,21 +169,21 @@ test("rejects DNS rebinding even when browser headers say same-origin", async ()
 
 test("rejects missing, malformed, and unconfigured Host headers", async () => {
   const { isApiRequestAllowed } = await loadSubject();
-  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test")), false);
-  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
-    headers: { host: "localhost@attacker.example:30141" },
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30143/api/test")), false);
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30143/api/test", {
+    headers: { host: "localhost@attacker.example:30143" },
   })), false);
-  assert.equal(isApiRequestAllowed(new Request("http://localhost:30141/api/test", {
-    headers: { host: "pi-web.internal:30141" },
+  assert.equal(isApiRequestAllowed(new Request("http://localhost:30143/api/test", {
+    headers: { host: "pi-web.internal:30143" },
   })), false);
 });
 
 test("allows same-origin requests when Chromium strips the port from Origin", async () => {
   const { isApiRequestAllowed } = await loadSubject();
   // Loopback IP with the port stripped from Origin (Chromium 150+ behavior).
-  const loopback = new Request("http://127.0.0.1:30141/api/agent/running", {
+  const loopback = new Request("http://127.0.0.1:30143/api/agent/running", {
     headers: {
-      host: "127.0.0.1:30141",
+      host: "127.0.0.1:30143",
       origin: "http://127.0.0.1",
       "sec-fetch-site": "same-origin",
     },
@@ -191,10 +191,10 @@ test("allows same-origin requests when Chromium strips the port from Origin", as
   assert.equal(isApiRequestAllowed(loopback), true);
 
   // LAN IP with the port stripped from Origin.
-  const lan = new Request("http://192.168.32.7:30141/api/test", {
+  const lan = new Request("http://192.168.32.7:30143/api/test", {
     method: "POST",
     headers: {
-      host: "192.168.32.7:30141",
+      host: "192.168.32.7:30143",
       origin: "http://192.168.32.7",
       "sec-fetch-site": "same-origin",
       "content-type": "application/json",
@@ -203,10 +203,10 @@ test("allows same-origin requests when Chromium strips the port from Origin", as
   assert.equal(isApiRequestAllowed(lan), true);
 
   // Loopback name with the port stripped from Origin.
-  const named = new Request("http://localhost:30141/api/test", {
+  const named = new Request("http://localhost:30143/api/test", {
     method: "POST",
     headers: {
-      host: "localhost:30141",
+      host: "localhost:30143",
       origin: "http://localhost",
       "sec-fetch-site": "same-origin",
       "content-type": "application/json",
@@ -219,9 +219,9 @@ test("still rejects when Origin hostname differs from Host even with port stripp
   const { isApiRequestAllowed } = await loadSubject();
   // Cross-loopback-name origin should not slip through just because both
   // sides happen to be loopback addresses.
-  const crossName = new Request("http://localhost:30141/api/test", {
+  const crossName = new Request("http://localhost:30143/api/test", {
     headers: {
-      host: "localhost:30141",
+      host: "localhost:30143",
       origin: "http://127.0.0.1",
       "sec-fetch-site": "same-origin",
     },
@@ -230,10 +230,10 @@ test("still rejects when Origin hostname differs from Host even with port stripp
 
   // Attacker host matching its own Origin must still be blocked by the
   // Host allowlist, not the Origin comparison.
-  const dnsRebind = new Request("http://localhost:30141/api/skills/install", {
+  const dnsRebind = new Request("http://localhost:30143/api/skills/install", {
     method: "POST",
     headers: {
-      host: "attacker.example:30141",
+      host: "attacker.example:30143",
       origin: "http://attacker.example",
       "sec-fetch-site": "same-origin",
       "content-type": "application/json",

package/lib/request-security.ts

@@ -104,7 +104,7 @@ export function isApiRequestOriginAllowed(request: Request): boolean {
 
   // Chromium 150+ strips the port from the Origin header for same-origin
   // requests on non-default ports. Strict canonical-origin comparison would
-  // therefore reject those legitimate requests ("http://127.0.0.1:30141"
+  // therefore reject those legitimate requests ("http://127.0.0.1:30143"
   // vs. the browser-sent "http://127.0.0.1"). The Host header is the
   // authoritative source for where the request actually went, so accept any
   // Origin whose hostname matches it. Hostnames are case-insensitive, which

package/lib/sqlite-db.ts

@@ -1,4 +1,5 @@
 import { DatabaseSync } from "node:sqlite";
+import { mkdirSync } from "fs";
 import { homedir } from "os";
 import { join, normalize } from "path";
 
@@ -40,6 +41,10 @@ export function setDbForTesting(db: DatabaseSync): void {
  */
 export function getDb(): DatabaseSync {
   if (globalThis.__piWebDb) return globalThis.__piWebDb;
+  // SQLite 打不开不存在的父目录（unable to open database file）。全新机器上
+  // ~/.pi/agent 尚未被 SDK 创建，惰性打开也会炸——与 lib/yjs-room-server.mjs
+  // 的顶层打开是同类隐患，打开前必须确保目录存在。
+  mkdirSync(getAgentDir(), { recursive: true });
   const db = new DatabaseSync(dbPath());
   db.exec("PRAGMA journal_mode = WAL;");
   db.exec("PRAGMA foreign_keys = ON;");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baique/pi-web-sky",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "description": "Web UI for the pi coding agent — Sky skin edition (fork of @agegr/pi-web / earendil-labs pi-web, MIT)",
   "homepage": "https://github.com/baique/pi-web-sky#readme",
   "repository": {