@blackbelt-technology/pi-agent-dashboard 0.2.9 → 0.4.0

package/packages/server/src/session-bootstrap.ts

@@ -73,8 +73,22 @@ export async function discoverAndBroadcastSessions(deps: SessionBootstrapDeps):
     } as any);
   });
 
-  // Initial OpenSpec poll for all known directories
-  await Promise.all(
-    directoryService.knownDirectories().map((cwd) => directoryService.refreshOpenSpec(cwd)),
+  // Initial OpenSpec poll for all known directories.
+  //
+  // NOTE: `refreshOpenSpec` / `pollOpenSpec` is currently synchronous internally
+  // (spawnSync per change) — on Windows with many active changes (~19) and
+  // multiple pinned directories this can block the event loop for minutes,
+  // making the HTTP server unresponsive during startup. We intentionally do
+  // NOT await it here so HTTP + WebSocket startup completes immediately;
+  // openspec data populates in the background and pushes `openspec_update`
+  // broadcasts to browsers as each directory finishes.
+  //
+  // A proper fix is to migrate the openspec Recipe to async spawn; tracked
+  // separately. See change: consolidate-tool-resolution.
+  void Promise.all(
+    directoryService.knownDirectories().map(async (cwd) => {
+      try { await directoryService.refreshOpenSpec(cwd); }
+      catch (err) { console.error(`[dashboard] initial openspec poll failed for ${cwd}:`, err); }
+    }),
   );
 }

package/packages/server/src/session-diff.ts

@@ -2,8 +2,9 @@
  * Session diff extraction — scans session events for file changes
  * and optionally enriches with git diffs.
  */
-import { execSync } from "node:child_process";
-import { resolve, relative, isAbsolute } from "node:path";
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, relative, isAbsolute, sep as pathSep } from "node:path";
+import * as git from "@blackbelt-technology/pi-dashboard-shared/platform/git.js";
 import type { DashboardEvent } from "@blackbelt-technology/pi-dashboard-shared/types.js";
 import type { FileChangeEvent, FileDiffEntry, EditOperation } from "@blackbelt-technology/pi-dashboard-shared/diff-types.js";
 import { isGitRepo } from "./git-operations.js";
@@ -105,7 +106,11 @@ function normalizePath(rawPath: string, cwd: string): string | null {
     return null;
   }
 
-  return rel;
+  // Normalize to posix separators. These paths are embedded into git diff
+  // headers (`diff --git a/<path> b/<path>`) which expect forward slashes,
+  // and are also used by the client for display and URL construction.
+  // See change: fix-windows-server-parity.
+  return pathSep === "/" ? rel : rel.split(pathSep).join("/");
 }
 
 /**
@@ -130,32 +135,27 @@ export function enrichWithGitDiff(
 
   const enriched = files.map((file) => {
     try {
-      const diff = execSync(`git diff HEAD -- ${JSON.stringify(file.path)}`, {
-        cwd,
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: GIT_TIMEOUT,
-      }).trim();
+      // Delegate to the shared git tool module. The runner handles
+      // windowsHide, timeout, argv-array escaping (no shell), and the
+      // "no diff" exit-1 tolerance. See change: platform-command-executor.
+      const diff = git.diffOr({ cwd, path: file.path }).trim();
 
       if (diff) {
         return { ...file, gitDiff: diff };
       }
 
       // No diff from HEAD — try untracked (new file)
-      const status = execSync(`git status --porcelain -- ${JSON.stringify(file.path)}`, {
-        cwd,
-        encoding: "utf-8",
-        stdio: ["pipe", "pipe", "pipe"],
-        timeout: GIT_TIMEOUT,
-      }).trim();
+      const status = git.statusPorcelainOr({ cwd, path: file.path }).trim();
 
       if (status.startsWith("??") || status.startsWith("A")) {
-        // Untracked or newly added — generate synthetic diff
-        const content = execSync(`cat ${JSON.stringify(resolve(cwd, file.path))}`, {
-          encoding: "utf-8",
-          stdio: ["pipe", "pipe", "pipe"],
-          timeout: GIT_TIMEOUT,
-        });
+        // Untracked or newly added — generate synthetic diff.
+        // Read via fs.readFileSync rather than `cat` for cross-platform
+        // support (Windows has no `cat`). See change: fix-windows-server-parity.
+        const absPath = resolve(cwd, file.path);
+        if (!existsSync(absPath)) {
+          return file;
+        }
+        const content = readFileSync(absPath, "utf-8");
         const lines = content.split("\n");
         const diffLines = [
           `diff --git a/${file.path} b/${file.path}`,

package/packages/server/src/terminal-manager.ts

@@ -4,18 +4,25 @@
 import * as pty from "node-pty";
 import type { IPty } from "node-pty";
 import { randomBytes } from "node:crypto";
+import { fixPtyPermissions } from "./fix-pty-permissions.js";
 import type { TerminalSession, TerminalControlMessage } from "@blackbelt-technology/pi-dashboard-shared/terminal-types.js";
 import type { WebSocket } from "ws";
 
 const DEFAULT_BUFFER_SIZE = 256 * 1024; // 256KB
 
+// Delegate shell detection to the shared platform primitive. Back-compat
+// wrapper preserved so callers (and tests) that import `detectShell` from
+// this module continue to work. See change: consolidate-platform-handlers.
+import {
+  detectShell as platformDetectShell,
+  getTerminalEnvHints as platformTerminalEnvHints,
+} from "@blackbelt-technology/pi-dashboard-shared/platform/shell.js";
+import { killProcess } from "@blackbelt-technology/pi-dashboard-shared/platform/process.js";
+
 /** Detect the appropriate shell for the current platform. */
 export function detectShell(platform?: string): string {
-  const p = platform ?? process.platform;
-  if (p === "win32") {
-    return process.env.COMSPEC || "powershell.exe";
-  }
-  return process.env.SHELL || "/bin/bash";
+  // Keep the old `platform?: string` signature; coerce to the shared primitive's opts.
+  return platformDetectShell(platform ? { platform: platform as NodeJS.Platform } : undefined);
 }
 
 /** Circular buffer for PTY output replay. */
@@ -99,6 +106,9 @@ function generateId(): string {
 }
 
 export function createTerminalManager(options?: TerminalManagerOptions): TerminalManager {
+  // Fix node-pty spawn-helper permissions at runtime (defense in depth)
+  fixPtyPermissions();
+
   const entries = new Map<string, TerminalEntry>();
   const bufferSize = options?.bufferSize ?? DEFAULT_BUFFER_SIZE;
 
@@ -106,10 +116,7 @@ export function createTerminalManager(options?: TerminalManagerOptions): Termina
     const shell = detectShell();
     const id = generateId();
 
-    const env = { ...process.env } as Record<string, string>;
-    if (process.platform === "win32" && !env.TERM) {
-      env.TERM = "cygwin";
-    }
+    const env = { ...process.env, ...platformTerminalEnvHints() } as Record<string, string>;
 
     const p = pty.spawn(shell, [], {
       cwd,
@@ -207,18 +214,56 @@ export function createTerminalManager(options?: TerminalManagerOptions): Termina
   function kill(id: string): void {
     const entry = entries.get(id);
     if (!entry) throw new Error(`Terminal ${id} not found`);
-    // Interactive shells (e.g. bash on Linux) ignore SIGTERM.
-    // Use SIGHUP which shells honor, then escalate to SIGKILL.
-    entry.pty.kill("SIGHUP");
-    const escalation = setTimeout(() => {
-      if (entries.has(id)) {
-        try { entry.pty.kill("SIGKILL"); } catch {}
+
+    // Windows: node-pty's kill(signal) uses TerminateProcess on the shell
+    // handle, which (a) ignores the signal string, and (b) does not kill
+    // child processes of the shell (python.exe, node.exe, etc.). Worse, its
+    // onExit callback is not always fired after external kills, so the
+    // terminal entry would stay in the map forever — which is exactly why
+    // the X button "doesn't work" on Windows. Route through platform's
+    // killProcess() so taskkill /F /T /PID does a genuine tree kill.
+    //
+    // POSIX: keep the SIGHUP → SIGKILL idiom — interactive shells honor
+    // SIGHUP, giving them a chance to clean up tty state before we escalate.
+    if (process.platform === "win32") {
+      const pid = entry.pty.pid;
+      if (typeof pid === "number") {
+        void killProcess(pid, { timeoutMs: 2000 }).catch(() => { /* surfaced via onExit fallback below */ });
+      } else {
+        try { entry.pty.kill(); } catch { /* best-effort */ }
       }
-    }, 1000);
-    // Clear escalation timeout if the process exits promptly
-    const dispose = entry.pty.onExit(() => {
-      clearTimeout(escalation);
-      dispose.dispose();
+    } else {
+      entry.pty.kill("SIGHUP");
+      const escalation = setTimeout(() => {
+        if (entries.has(id)) {
+          try { entry.pty.kill("SIGKILL"); } catch {}
+        }
+      }, 1000);
+      const disposeEsc = entry.pty.onExit(() => {
+        clearTimeout(escalation);
+        disposeEsc.dispose();
+      });
+    }
+
+    // Fallback cleanup: if node-pty's onExit doesn't fire within 3s (common
+    // on Windows ConPTY after external termination), simulate it so the
+    // terminal entry is removed, clients are disconnected, and the server
+    // broadcasts terminal_removed. Without this, the X click never
+    // completes from the user's perspective.
+    const fallback = setTimeout(() => {
+      const stale = entries.get(id);
+      if (!stale) return; // onExit already ran
+      stale.session = { ...stale.session, status: "ended" };
+      for (const ws of stale.clients) {
+        try { ws.close(); } catch { /* ignore */ }
+      }
+      stale.clients.clear();
+      entries.delete(id);
+      options?.onExit?.(id);
+    }, 3000);
+    const disposeFb = entry.pty.onExit(() => {
+      clearTimeout(fallback);
+      disposeFb.dispose();
     });
   }
 

package/packages/server/src/test-env-guard.ts

@@ -0,0 +1,26 @@
+/**
+ * Defense-in-depth guard against destructive PID-registry sweeps during tests.
+ *
+ * Production startup code paths (headlessPidRegistry.cleanupOrphans/killAll,
+ * editorPidRegistry.cleanupOrphans) read PID files and send SIGTERM. If they
+ * ever run under vitest AGAINST the developer's real $HOME, they can kill
+ * live pi sessions.
+ *
+ * This guard returns true when:
+ *   - we appear to be inside a vitest run (VITEST env var), AND
+ *   - HOME still points at the real user home (tripwire missed).
+ *
+ * Callers SHOULD `console.warn` and return without performing destructive work
+ * when this returns true.
+ *
+ * Normal production servers (VITEST not set) always get `false` and behave as
+ * before.
+ */
+import os from "node:os";
+
+export function isUnsafeTestHomeScan(): boolean {
+  if (process.env.VITEST !== "true") return false;
+  const currentHome = process.env.HOME ?? "";
+  const realHome = os.userInfo().homedir;
+  return currentHome === "" || currentHome === realHome;
+}

package/packages/server/src/test-support/test-server.ts

@@ -0,0 +1,63 @@
+/**
+ * createTestServer — boot a real DashboardServer on OS-assigned ports for
+ * integration tests, with safe defaults (no auto-shutdown, no tunnel).
+ *
+ * Use with the `setup-home` vitest setupFile (in @blackbelt-technology/pi-dashboard-shared/test-support)
+ * so that HOME is also isolated.
+ *
+ * Example:
+ *   const { server, httpPort, piPort, stop } = await createTestServer();
+ *   const res = await fetch(`http://localhost:${httpPort}/api/health`);
+ *   ...
+ *   await stop();
+ */
+import { createServer, type DashboardServer, type ServerConfig } from "../server.js";
+
+export interface TestServerHandle {
+  server: DashboardServer;
+  httpPort: number;
+  piPort: number;
+  stop: () => Promise<void>;
+}
+
+export type TestServerOverrides = Partial<ServerConfig>;
+
+const DEFAULTS: ServerConfig = {
+  port: 0,
+  piPort: 0,
+  dev: true,
+  autoShutdown: false,
+  shutdownIdleSeconds: 999,
+  tunnel: false,
+  editor: { idleTimeoutMinutes: 10, maxInstances: 3 },
+};
+
+export async function createTestServer(
+  overrides: TestServerOverrides = {},
+): Promise<TestServerHandle> {
+  const config: ServerConfig = { ...DEFAULTS, ...overrides };
+  const server = await createServer(config);
+  await server.start();
+
+  const httpPort = server.httpPort();
+  const piPort = server.piPort();
+  if (httpPort == null || piPort == null) {
+    await server.stop();
+    throw new Error(
+      `createTestServer: failed to resolve ports (httpPort=${httpPort}, piPort=${piPort})`,
+    );
+  }
+
+  return {
+    server,
+    httpPort,
+    piPort,
+    stop: async () => {
+      try {
+        await server.stop();
+      } catch {
+        // best-effort — tests may race on shutdown
+      }
+    },
+  };
+}

package/packages/server/src/tunnel.ts

@@ -7,7 +7,15 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
-import { execSync, spawn, type ChildProcess } from "node:child_process";
+import { execSync, spawn, type ChildProcess } from "@blackbelt-technology/pi-dashboard-shared/platform/exec.js";
+import { ToolResolver } from "@blackbelt-technology/pi-dashboard-shared/platform/binary-lookup.js";
+import {
+  isProcessAlive,
+  killProcess,
+  killPidWithGroup,
+} from "@blackbelt-technology/pi-dashboard-shared/platform/process.js";
+
+const zrokResolver = new ToolResolver({ processExecPath: process.execPath });
 import type { TunnelStatus } from "@blackbelt-technology/pi-dashboard-shared/rest-api.js";
 import { CONFIG_FILE } from "@blackbelt-technology/pi-dashboard-shared/config.js";
 
@@ -27,17 +35,20 @@ const SPAWN_TIMEOUT_MS = 30_000;
 let activeProcess: ChildProcess | null = null;
 let activeTunnelUrl: string | null = null;
 let zrokAvailable: boolean | null = null;
+// Serialization: any concurrent createTunnel() call while one is already in
+// flight returns the same promise instead of spawning a second zrok process.
+// Without this, a UI double-click or a race between startup auto-connect and
+// an explicit `/api/tunnel-connect` created two parallel reservations and
+// two running `zrok share` processes for the same port.
+let pendingCreate: Promise<string | null> | null = null;
 
 // ── Binary Detection ────────────────────────────────────────────────
 
 function checkZrokOnPath(): boolean {
-  const cmd = process.platform === "win32" ? "where zrok" : "which zrok";
-  try {
-    execSync(cmd, { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
+  // Delegate binary lookup to the shared platform primitive (handles the
+  // where/which split on Windows vs Unix, managed-bin search, and login
+  // shell fallback). See change: consolidate-platform-handlers.
+  return zrokResolver.which("zrok") !== null;
 }
 
 /**
@@ -87,30 +98,22 @@ export function removeZrokPid(): void {
 
 // ── Stale Process Cleanup ───────────────────────────────────────────
 
-/**
- * Check if a process is alive by sending signal 0.
- */
-function isProcessAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 /**
  * Clean up stale zrok processes from previous server runs.
- * Reads PID file, kills process if running, removes PID file.
+ * Reads PID file, kills process if running (via the platform helper so
+ * Windows uses `taskkill /F /T /PID`), removes PID file.
+ * See change: route-kill-paths-through-platform.
  */
-export function cleanupStaleZrok(): void {
+export async function cleanupStaleZrok(): Promise<void> {
   const pid = readZrokPid();
   if (pid === null) return;
 
   if (isProcessAlive(pid)) {
     try {
-      process.kill(pid, "SIGTERM");
-      console.log(`Killed stale zrok process (PID ${pid})`);
+      const result = await killProcess(pid, { timeoutMs: 2000 });
+      if (result.ok) {
+        console.log(`Killed stale zrok process (PID ${pid})`);
+      }
     } catch (err: any) {
       console.warn(`Failed to kill stale zrok process (PID ${pid}): ${err.message}`);
     }
@@ -160,6 +163,75 @@ function saveReservedToken(token: string): void {
   }
 }
 
+/**
+ * Release a reserved share via `zrok release <token>`. Best-effort, non-throwing.
+ * Returns true if the release command exited cleanly, false otherwise. Callers
+ * should invoke this whenever abandoning a reserved token so the zrok edge
+ * doesn't keep an orphaned reservation record (which is what causes stale
+ * URLs like `tgbdzzvlar6b.share.zrok.io` to persist after the agent dies).
+ */
+export function releaseShare(token: string): boolean {
+  if (!token) return false;
+  try {
+    execSync(`zrok release ${token}`, {
+      timeout: 10_000,
+      stdio: ["ignore", "ignore", "ignore"],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Scan `ps` for orphan `zrok share` processes that point at the given port
+ * via `--override-endpoint http://localhost:<port>` and SIGTERM them.
+ *
+ * This complements `cleanupStaleZrok` (which only knows about the single PID
+ * in our pid-file): when the retry logic in `createTunnel` leaks processes
+ * across failures, or when a previous server instance crashed, the pid-file
+ * loses track of them. On startup we scavenge them directly from the process
+ * table so a fresh tunnel doesn't compete with orphans.
+ *
+ * Returns the list of PIDs we killed.
+ */
+export function scavengeOrphanZrokProcesses(port: number): number[] {
+  const killed: number[] = [];
+  let output = "";
+  try {
+    output = execSync("ps -ax -o pid=,args=", {
+      encoding: "utf-8",
+      timeout: 5_000,
+    }).toString();
+  } catch {
+    return killed;
+  }
+
+  const endpointMarker = `--override-endpoint http://localhost:${port}`;
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (!trimmed.includes("zrok share")) continue;
+    if (!trimmed.includes(endpointMarker)) continue;
+    const m = trimmed.match(/^(\d+)\s+/);
+    if (!m) continue;
+    const pid = parseInt(m[1], 10);
+    if (!Number.isFinite(pid) || pid <= 0) continue;
+    if (pid === process.pid) continue; // never kill ourselves
+    try {
+      // Group-kill on Unix so zrok's child workers die with it; taskkill /T
+      // already handles the tree on Windows (killPidWithGroup routes the
+      // platform-correct path).
+      killPidWithGroup(pid, "SIGTERM");
+      killed.push(pid);
+      console.log(`Scavenged orphan zrok process (PID ${pid})`);
+    } catch {
+      // Process may have exited between ps and kill — ignore
+    }
+  }
+  return killed;
+}
+
 /**
  * Create a reserved share via `zrok reserve public`.
  * Returns the share token or null on failure.
@@ -195,7 +267,29 @@ function reserveShare(port: number): Promise<string | null> {
  * On subsequent runs, reuses the reserved token.
  * Returns URL or null on failure.
  */
-export function createTunnel(port: number, reservedToken?: string): Promise<string | null> {
+export function createTunnel(
+  port: number,
+  reservedToken?: string,
+  retriesLeft: number = 1,
+): Promise<string | null> {
+  // Fast path: another caller is already creating a tunnel — join that promise.
+  if (pendingCreate) return pendingCreate;
+  // Fast path: tunnel already up — return its URL without spawning.
+  if (activeTunnelUrl) return Promise.resolve(activeTunnelUrl);
+
+  const promise = _createTunnelInner(port, reservedToken, retriesLeft);
+  pendingCreate = promise;
+  promise.finally(() => {
+    if (pendingCreate === promise) pendingCreate = null;
+  });
+  return promise;
+}
+
+function _createTunnelInner(
+  port: number,
+  reservedToken?: string,
+  retriesLeft: number = 1,
+): Promise<string | null> {
   return new Promise(async (resolve) => {
     if (!detectZrokBinary()) {
       resolve(null);
@@ -209,7 +303,11 @@ export function createTunnel(port: number, reservedToken?: string): Promise<stri
       return;
     }
 
-    // Try to get or create a reserved token
+    // Track whether this call reserved the token itself (so we know to
+    // release it if we subsequently time out or fail — the caller-provided
+    // `reservedToken` is owned by the caller / config and must not be released
+    // on transient timeouts).
+    const callerProvidedToken = !!reservedToken;
     let token = reservedToken;
     if (!token) {
       token = await reserveShare(port) ?? undefined;
@@ -228,12 +326,27 @@ export function createTunnel(port: number, reservedToken?: string): Promise<stri
       detached: false,
     });
 
-    // Timeout: kill process if URL not parsed in time
+    // Timeout: kill process if URL not parsed in time. Escalate SIGTERM
+    // → SIGKILL after a grace period so a wedged zrok doesn't keep a stale
+    // reservation attached after we've moved on. If we reserved the token
+    // just-in-time within this call, release it on the zrok edge too so we
+    // don't leak a dead reservation (root cause of stale URLs like
+    // `tgbdzzvlar6b.share.zrok.io`).
     const timeout = setTimeout(() => {
       if (!resolved) {
         resolved = true;
         console.warn("zrok tunnel creation timed out (30s)");
-        try { child.kill("SIGTERM"); } catch {}
+        try {
+          if (child.pid != null) killPidWithGroup(child.pid, "SIGTERM");
+          else child.kill("SIGTERM");
+        } catch { /* already dead */ }
+        setTimeout(() => {
+          try {
+            if (child.pid != null) killPidWithGroup(child.pid, "SIGKILL");
+            else child.kill("SIGKILL");
+          } catch { /* already dead */ }
+        }, 2_000);
+        if (token && !callerProvidedToken) releaseShare(token);
         removeZrokPid();
         resolve(null);
       }
@@ -270,10 +383,20 @@ export function createTunnel(port: number, reservedToken?: string): Promise<stri
       if (!resolved) {
         resolved = true;
         clearTimeout(timeout);
-        // If reserved share failed, token may be expired — retry with fresh reservation
-        if (token) {
-          console.warn(`Reserved share failed (code ${code}), creating new reservation...`);
-          resolve(createTunnel(port)); // retry without token
+        // If reserved share failed, token may be expired or already attached
+        // to an orphan process. Release it on the zrok edge before retrying so
+        // we don't leak dead reservations (which is what produced stale URLs
+        // like `tgbdzzvlar6b.share.zrok.io` pointing at nothing).
+        if (token && retriesLeft > 0) {
+          console.warn(`Reserved share failed (code ${code}), releasing token ${token} and creating new reservation...`);
+          releaseShare(token);
+          // Bypass the mutex wrapper so we don't self-deadlock: call the inner
+          // implementation directly for the retry attempt.
+          resolve(_createTunnelInner(port, undefined, retriesLeft - 1));
+        } else if (token) {
+          console.warn(`Reserved share failed (code ${code}) and retry budget exhausted; releasing token ${token}`);
+          releaseShare(token);
+          resolve(null);
         } else {
           console.warn(`zrok process exited before producing URL (code ${code})`);
           resolve(null);
@@ -291,20 +414,35 @@ export function createTunnel(port: number, reservedToken?: string): Promise<stri
 
 /**
  * Stop the active tunnel. Kills the subprocess and removes PID file.
+ * Also sweeps any orphan zrok processes bound to the given port so restart
+ * paths (which call `deleteTunnel` then spawn a new server) don't leave
+ * dead reservations attached to the zrok edge.
  */
-export async function deleteTunnel(): Promise<void> {
+export async function deleteTunnel(port?: number): Promise<void> {
   const child = activeProcess;
   activeProcess = null;
   activeTunnelUrl = null;
 
   if (child) {
     try {
-      child.kill("SIGTERM");
+      if (child.pid != null) {
+        // Route through the platform helper so Windows gets taskkill
+        // semantics (tree-kill). See change: route-kill-paths-through-platform.
+        await killProcess(child.pid, { timeoutMs: 2000 });
+      } else {
+        child.kill("SIGTERM");
+      }
     } catch (err: any) {
       console.warn(`zrok tunnel cleanup failed: ${err.message}`);
     }
   }
   removeZrokPid();
+
+  // Belt-and-braces: sweep any orphan zrok processes that escaped pid-file
+  // tracking (e.g. from a previous crash or a failed retry chain).
+  if (typeof port === "number") {
+    try { scavengeOrphanZrokProcesses(port); } catch { /* best-effort */ }
+  }
 }
 
 /**

package/packages/shared/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@blackbelt-technology/pi-dashboard-shared",
-  "version": "0.2.9",
+  "version": "0.4.0",
   "description": "Shared types and utilities for pi-dashboard",
   "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
   "exports": {
     "./*.js": "./src/*.ts",
     "./*": "./src/*"
@@ -10,6 +13,10 @@
   "files": [
     "src/"
   ],
-  "dependencies": {},
-  "devDependencies": {}
+  "dependencies": {
+    "bonjour-service": "^1.3.0"
+  },
+  "devDependencies": {
+    "memfs": "^4.57.2"
+  }
 }