@blackbelt-technology/pi-agent-dashboard 0.4.1 → 0.4.2

package/packages/server/src/pending-resume-intent-registry.ts

@@ -0,0 +1,107 @@
+/**
+ * In-memory tracker for user-initiated session-resume intents.
+ *
+ * Purpose: distinguish ended→alive transitions caused by a deliberate user
+ * action (Resume click, drag-to-resume, REST resume, prompt-auto-resume)
+ * from those caused by a bridge auto-reattach on dashboard reboot, AND
+ * differentiate between "surface this card at the top" (front) and
+ * "respect the slot the user just chose" (keep) for user-driven resumes.
+ *
+ * The `sessionManager.onChange` hook in `server.ts` consults this registry
+ * in its ended→alive branch:
+ *
+ *   - if `consume(sessionId) === "front"`  → moveToFront + broadcast
+ *   - if `consume(sessionId) === "keep"`   → no-op (drop position already
+ *                                             persisted via reorder_sessions)
+ *   - if `consume(sessionId) === null`     → bridge reattach → leave order alone
+ *
+ * Tagging happens in `handleResumeSession` (WS), the `/api/session/:id/resume`
+ * handler (REST), and `handleSendPrompt`'s ended-branch (prompt-auto-resume),
+ * immediately before `spawnPiSession`. The intent value is supplied by the
+ * caller — drag-to-resume tags `"keep"`; everyone else tags `"front"`.
+ *
+ * In-memory only. NOT persisted across server restarts. Stale entries (older
+ * than `ttlMs`, default 60 s) are silently dropped on read so a failed spawn
+ * cannot poison a later legitimate reattach.
+ *
+ * See changes: preserve-session-order-on-reboot, top-of-tier-on-status-change,
+ *              differentiate-resume-intent-by-trigger.
+ */
+
+export const PENDING_RESUME_INTENT_TTL_MS = 60_000;
+
+/** The two user-driven placement intents. */
+export type ResumeIntent = "front" | "keep";
+
+interface IntentEntry {
+  intent: ResumeIntent;
+  timestamp: number;
+}
+
+export interface PendingResumeIntentRegistry {
+  /**
+   * Tag a session id with a placement intent. Idempotent — re-recording the
+   * same id refreshes both timestamp and intent (last-write-wins).
+   */
+  record(sessionId: string, intent: ResumeIntent): void;
+  /**
+   * Returns the recorded intent and clears the entry iff the session was
+   * tagged within the TTL window. Stale entries are dropped silently and
+   * `null` is returned. `null` is also returned for never-tagged ids.
+   */
+  consume(sessionId: string): ResumeIntent | null;
+  /** Test helper — number of live (non-expired) entries. */
+  size(): number;
+}
+
+export interface PendingResumeIntentRegistryOptions {
+  /** Override the TTL in milliseconds. Defaults to 60_000. */
+  ttlMs?: number;
+  /** Override `Date.now` for tests. */
+  now?: () => number;
+}
+
+export function createPendingResumeIntentRegistry(
+  opts: PendingResumeIntentRegistryOptions = {},
+): PendingResumeIntentRegistry {
+  const ttl = opts.ttlMs ?? PENDING_RESUME_INTENT_TTL_MS;
+  const now = opts.now ?? (() => Date.now());
+
+  // sessionId -> { intent, timestamp } of most recent record() call.
+  const store = new Map<string, IntentEntry>();
+
+  function pruneStale(): void {
+    const cutoff = now() - ttl;
+    for (const [id, entry] of store) {
+      if (entry.timestamp < cutoff) store.delete(id);
+    }
+  }
+
+  return {
+    record(sessionId: string, intent: ResumeIntent): void {
+      if (!sessionId) return;
+      // Last-write-wins on re-record: a second user action for the same
+      // session (e.g. drag-then-button-click) should reflect the most
+      // recent intent. Also refreshes the timestamp so a slow bridge
+      // round-trip doesn't expire mid-resume.
+      store.set(sessionId, { intent, timestamp: now() });
+    },
+
+    consume(sessionId: string): ResumeIntent | null {
+      if (!sessionId) return null;
+      const entry = store.get(sessionId);
+      if (entry === undefined) return null;
+      if (entry.timestamp < now() - ttl) {
+        store.delete(sessionId);
+        return null;
+      }
+      store.delete(sessionId);
+      return entry.intent;
+    },
+
+    size(): number {
+      pruneStale();
+      return store.size;
+    },
+  };
+}

package/packages/server/src/pi-core-checker.ts

@@ -69,22 +69,17 @@ function resolveDisplayName(name: string): string {
 }
 
 /**
- * Heuristic to decide if a package is part of the pi ecosystem but NOT in
- * the known-names list above. Matches bare-name pi packages on npm:
- *   - bare `pi-<name>`
- *   - scoped `@<scope>/pi-<name>`
- * Note: extensions already managed by PackageManagerWrapper (via
- * `settings.json packages[]`) are deliberately included if they are ALSO
- * installed globally — the PiCoreChecker's discovery is a superset, and
- * the UI layer decides which surface to show a package in.
+ * Strict whitelist check: a package is part of the pi-ecosystem CORE
+ * tooling if and only if its name is in `CORE_PACKAGE_NAMES`. The
+ * previous `pi-*` name-prefix heuristic was removed because it caused
+ * recommended-extension packages (e.g. `pi-agent-browser`,
+ * `@tintinweb/pi-subagents`) to appear in BOTH the Core ecosystem panel
+ * and the Installed Packages panel. Recommended extensions are now
+ * surfaced exclusively through `/api/packages/installed`. See change:
+ * consolidate-packages-settings-ui.
  */
 function looksLikePiEcosystem(name: string): boolean {
-	if (CORE_PACKAGE_NAMES.includes(name)) return true;
-	// `pi-foo` or `pi` bare-scoped
-	if (/^pi-[a-z0-9-]+$/i.test(name)) return true;
-	// scoped variant: `@scope/pi-foo`
-	if (/^@[^/]+\/pi-[a-z0-9-]+$/i.test(name)) return true;
-	return false;
+	return CORE_PACKAGE_NAMES.includes(name);
 }
 
 export interface NpmListRunner {

package/packages/server/src/pi-gateway.ts

@@ -32,6 +32,14 @@ export interface PiGateway {
   onConnection?: () => void;
   onDisconnect?: (sessionId: string) => void;
   onSessionCreated?: (sessionId: string) => void;
+  /**
+   * Fired after a `session_register` message has been processed and the
+   * session is in the manager. Receives the registered sessionId and its
+   * cwd. Wired by the dashboard server to consume any pending
+   * spawn-with-attach intent. See change:
+   * add-folder-task-checker-and-spawn-attach.
+   */
+  onSessionRegistered?: (sessionId: string, cwd: string) => void;
 }
 
 export function createPiGateway(
@@ -57,6 +65,7 @@ export function createPiGateway(
   let onConnection: (() => void) | undefined;
   let onDisconnect: ((sessionId: string) => void) | undefined;
   let onSessionCreated: ((sessionId: string) => void) | undefined;
+  let onSessionRegistered: ((sessionId: string, cwd: string) => void) | undefined;
 
   function checkEmpty() {
     if (connections.size === 0) {
@@ -174,6 +183,10 @@ export function createPiGateway(
       onSessionCreated = handler;
     },
 
+    set onSessionRegistered(handler: ((sessionId: string, cwd: string) => void) | undefined) {
+      onSessionRegistered = handler;
+    },
+
     address() {
       const addr = wss?.address();
       if (addr && typeof addr === "object") return addr.port;
@@ -289,6 +302,7 @@ export function createPiGateway(
 
               resetHeartbeat(msg.sessionId);
               onConnection?.();
+              onSessionRegistered?.(msg.sessionId, msg.cwd);
             }
 
             if (msg.type === "session_heartbeat" && msg.sessionId) {

package/packages/server/src/proposal-attach-naming.ts

@@ -0,0 +1,47 @@
+/**
+ * Pure helpers for the idempotent attach/detach auto-rename rule.
+ *
+ * See change: fix-mobile-attach-proposal-display (design.md decision matrix).
+ *
+ * Auto-rename on attach when EITHER (a) name is empty/whitespace, OR
+ * (b) name === current attachedProposal (auto-set on a prior attach;
+ * user has not customised, so re-track the new attachment).
+ *
+ * Auto-revert on detach only when name === attachedProposal (the witness
+ * that the name was auto-set on a previous attach).
+ */
+import type { DashboardSession } from "@blackbelt-technology/pi-dashboard-shared/types.js";
+
+/** True when the session's current name is the equality witness for "auto-set". */
+export function isNameAutoSetFromAttachment(session: Pick<DashboardSession, "name" | "attachedProposal"> | undefined): boolean {
+  if (!session) return false;
+  const trimmed = session.name?.trim();
+  if (!trimmed) return false;
+  if (!session.attachedProposal) return false;
+  return trimmed === session.attachedProposal;
+}
+
+/**
+ * Decide whether attaching `changeName` to `session` should also rename it.
+ * Returns the new name to apply, or `undefined` if name should not change.
+ */
+export function attachRenameTarget(
+  session: Pick<DashboardSession, "name" | "attachedProposal"> | undefined,
+  changeName: string,
+): string | undefined {
+  if (!session) return undefined;
+  const trimmed = session.name?.trim();
+  if (!trimmed) return changeName;
+  if (isNameAutoSetFromAttachment(session)) return changeName;
+  return undefined;
+}
+
+/**
+ * Decide whether detaching from `session` should clear the name.
+ * Returns true when the name should be cleared (set to undefined).
+ */
+export function detachShouldClearName(
+  session: Pick<DashboardSession, "name" | "attachedProposal"> | undefined,
+): boolean {
+  return isNameAutoSetFromAttachment(session);
+}

package/packages/server/src/routes/file-routes.ts

@@ -6,7 +6,7 @@ import type { SessionManager } from "../memory-session-manager.js";
 import type { PreferencesStore } from "../preferences-store.js";
 import type { ApiResponse } from "@blackbelt-technology/pi-dashboard-shared/types.js";
 import type { NetworkGuard } from "./route-deps.js";
-import { listDirectories, createDirectory } from "../browse.js";
+import { listDirectories, createDirectory, classifyPaths, parseFlagsQuery } from "../browse.js";
 import path from "node:path";
 import fs from "node:fs/promises";
 
@@ -20,8 +20,13 @@ export function registerFileRoutes(
 ) {
   const { sessionManager, preferencesStore, networkGuard } = deps;
 
-  // Directory browse endpoint
-  fastify.get<{ Querystring: { path?: string; q?: string } }>(
+  // Directory browse endpoint.
+  // `detect=1` opts into eager `.git` / `.pi` classification on every entry
+  // (anything other than the literal string `"1"` is treated as falsy).
+  // Without `detect`, this is a single-readdir enumeration with no filesystem
+  // probes — use `GET /api/browse/flags` to classify lazily.
+  // See change: split-browse-flags.
+  fastify.get<{ Querystring: { path?: string; q?: string; detect?: string } }>(
     "/api/browse",
     { preHandler: networkGuard },
     async (request) => {
@@ -29,6 +34,7 @@ export function registerFileRoutes(
         const result = await listDirectories(
           request.query.path || undefined,
           request.query.q || undefined,
+          { detect: request.query.detect === "1" },
         );
         return { success: true, data: result } satisfies ApiResponse;
       } catch {
@@ -37,6 +43,26 @@ export function registerFileRoutes(
     },
   );
 
+  // Bulk directory flag classifier. Accepts `paths=<json-array>` (URL-encoded
+  // JSON array of absolute path strings, length ≤ 100). Returns
+  // `{ flags: { [path]: { isGit, isPi } } }`. Per-path probe failures map to
+  // `{ isGit: false, isPi: false }` — only malformed input or over-cap
+  // requests produce a top-level error (HTTP 400).
+  // See change: split-browse-flags.
+  fastify.get<{ Querystring: { paths?: string } }>(
+    "/api/browse/flags",
+    { preHandler: networkGuard },
+    async (request, reply) => {
+      const parsed = parseFlagsQuery(request.query.paths);
+      if (!parsed.ok) {
+        reply.code(400);
+        return { success: false, error: parsed.error } satisfies ApiResponse;
+      }
+      const flags = await classifyPaths(parsed.paths);
+      return { success: true, data: { flags } } satisfies ApiResponse;
+    },
+  );
+
   // Directory create endpoint
   fastify.post<{ Body: { parent?: unknown; name?: unknown } }>(
     "/api/browse/mkdir",

package/packages/server/src/routes/package-routes.ts

@@ -3,9 +3,16 @@
  */
 import type { FastifyInstance } from "fastify";
 import type { ApiResponse } from "@blackbelt-technology/pi-dashboard-shared/types.js";
-import type { PackageManagerWrapper } from "../package-manager-wrapper.js";
-import { PackageOperationBusyError } from "../package-manager-wrapper.js";
+import type { PackageManagerWrapper, PackageEntry } from "../package-manager-wrapper.js";
+import {
+  PackageOperationBusyError,
+  AlreadyAtDestinationError,
+  InvalidMoveRequestError,
+  UnsupportedSourceForDestinationError,
+} from "../package-manager-wrapper.js";
+import { parseSourceKind } from "../package-source-helpers.js";
 import { searchPackages, fetchReadme, PackageNotFoundError } from "../npm-search-proxy.js";
+import { enrichInstalledRows } from "../installed-package-enricher.js";
 
 export function registerPackageRoutes(
   fastify: FastifyInstance,
@@ -62,7 +69,8 @@ export function registerPackageRoutes(
       const cwd = request.query.cwd;
       try {
         const packages = await packageManagerWrapper.listInstalled(scope, cwd);
-        return { success: true, data: packages } satisfies ApiResponse;
+        const enriched = enrichInstalledRows(packages as any);
+        return { success: true, data: enriched } satisfies ApiResponse;
       } catch (err: any) {
         return { success: false, error: err.message } satisfies ApiResponse;
       }
@@ -157,6 +165,67 @@ export function registerPackageRoutes(
 
   // ── Check for updates ───────────────────────────────────────────
 
+  // Move package between scopes (see change: unify-package-management-ui)
+  fastify.post<{
+    Body: {
+      entry?: PackageEntry;
+      fromScope?: string;
+      fromCwd?: string;
+      toScope?: string;
+      toCwd?: string;
+    };
+  }>("/api/packages/move", async (request, reply) => {
+    const body = request.body ?? {};
+    const { entry, fromCwd, toCwd } = body;
+    const fromScope = body.fromScope === "local" ? "local" : body.fromScope === "global" ? "global" : null;
+    const toScope = body.toScope === "local" ? "local" : body.toScope === "global" ? "global" : null;
+
+    if (!entry || (typeof entry !== "string" && (typeof entry !== "object" || !entry.source))) {
+      reply.code(400);
+      return { success: false, error: "entry is required (string or { source, ...filters })" } satisfies ApiResponse;
+    }
+    if (!fromScope || !toScope) {
+      reply.code(400);
+      return { success: false, error: "fromScope and toScope are required ('global' or 'local')" } satisfies ApiResponse;
+    }
+
+    try {
+      const moveId = await packageManagerWrapper.move({
+        entry: entry as PackageEntry,
+        fromScope,
+        fromCwd,
+        toScope,
+        toCwd,
+      });
+      const sourceStr = typeof entry === "string" ? entry : entry.source;
+      const kind = parseSourceKind(sourceStr);
+      const phases = kind === "abs-path" || kind === "rel-path"
+        ? ["settings-edit" as const]
+        : ["install" as const, "remove" as const];
+      reply.code(202);
+      return { success: true, data: { moveId, phases } } satisfies ApiResponse;
+    } catch (err: any) {
+      if (err instanceof InvalidMoveRequestError) {
+        reply.code(400);
+        return { success: false, error: err.message, code: "invalid_request" } as any;
+      }
+      if (err instanceof UnsupportedSourceForDestinationError) {
+        reply.code(400);
+        return { success: false, error: err.message, code: "unsupported_source_for_destination" } as any;
+      }
+      if (err instanceof AlreadyAtDestinationError) {
+        reply.code(409);
+        return { success: false, error: err.message, code: "already_at_destination" } as any;
+      }
+      if (err instanceof PackageOperationBusyError) {
+        reply.code(409);
+        return { success: false, error: err.message, code: "operation_in_flight" } as any;
+      }
+      reply.code(500);
+      return { success: false, error: err?.message ?? String(err) } satisfies ApiResponse;
+    }
+  });
+
   fastify.post<{ Body: { cwd?: string } }>(
     "/api/packages/check-updates",
     async (request) => {

package/packages/server/src/routes/plugin-config-routes.ts

@@ -0,0 +1,129 @@
+/**
+ * Plugin config REST routes.
+ *
+ * POST /api/config/plugins/:id — write a partial plugin config.
+ * Validates against the plugin's configSchema (if declared).
+ * Broadcasts plugin_config_update to all subscribed browsers.
+ */
+import type { FastifyInstance } from "fastify";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import {
+  getPluginStatusStore,
+  discoverPlugins,
+} from "@blackbelt-technology/dashboard-plugin-runtime/server";
+import {
+  validatePluginConfig,
+  applySchemaDefaults,
+} from "@blackbelt-technology/dashboard-plugin-runtime/server";
+import type { NetworkGuard } from "./route-deps.js";
+import type { ServerToBrowserMessage } from "@blackbelt-technology/pi-dashboard-shared/browser-protocol.js";
+
+const CONFIG_DIR = path.join(os.homedir(), ".pi", "dashboard");
+const CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+
+function readRawConfig(): Record<string, unknown> {
+  try {
+    const raw = fs.readFileSync(CONFIG_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
+
+function writeRawConfig(merged: Record<string, unknown>): void {
+  fs.mkdirSync(CONFIG_DIR, { recursive: true });
+  const tmpFile = CONFIG_FILE + ".tmp." + process.pid;
+  fs.writeFileSync(tmpFile, JSON.stringify(merged, null, 2) + "\n");
+  fs.renameSync(tmpFile, CONFIG_FILE);
+}
+
+function loadSchemaForPlugin(
+  pluginId: string,
+  repoRoot?: string,
+): Record<string, unknown> | null {
+  const plugins = discoverPlugins(repoRoot);
+  const plugin = plugins.find(p => p.manifest.id === pluginId);
+  if (!plugin?.manifest.configSchema) return null;
+  const schemaPath = path.resolve(plugin.packageDir, plugin.manifest.configSchema);
+  try {
+    return JSON.parse(fs.readFileSync(schemaPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+
+export function registerPluginConfigRoutes(
+  fastify: FastifyInstance,
+  deps: {
+    networkGuard: NetworkGuard;
+    broadcast: (msg: ServerToBrowserMessage) => void;
+    repoRoot?: string;
+  },
+) {
+  const { networkGuard, broadcast, repoRoot } = deps;
+
+  fastify.post<{ Params: { id: string }; Body: Record<string, unknown> }>(
+    "/api/config/plugins/:id",
+    { preHandler: networkGuard },
+    async (request, reply) => {
+      const { id } = request.params;
+
+      const store = getPluginStatusStore();
+      const status = store.getStatus(id);
+
+      if (!status) {
+        return reply.status(404).send({ success: false, error: `Plugin "${id}" not found` });
+      }
+
+      if (!status.enabled) {
+        return reply.status(409).send({
+          success: false,
+          error: `Plugin "${id}" is disabled. Enable it before writing config.`,
+        });
+      }
+
+      const body = request.body ?? {};
+
+      // Validate against schema if the plugin has one
+      const schema = loadSchemaForPlugin(id, repoRoot);
+      if (schema) {
+        try {
+          validatePluginConfig(id, body as Record<string, unknown>, schema);
+        } catch (e: unknown) {
+          return reply.status(400).send({
+            success: false,
+            error: e instanceof Error ? e.message : String(e),
+          });
+        }
+      }
+
+      // Read existing config, merge, write
+      const existing = readRawConfig();
+      const existingPlugins = (existing.plugins as Record<string, unknown> | undefined) ?? {};
+      const existingPluginConfig =
+        (existingPlugins[id] as Record<string, unknown> | undefined) ?? {};
+
+      let merged = { ...existingPluginConfig, ...body };
+
+      // Apply schema defaults to merged result
+      if (schema) {
+        merged = applySchemaDefaults(merged, schema);
+      }
+
+      const updatedPlugins = { ...existingPlugins, [id]: merged };
+      const updatedConfig = { ...existing, plugins: updatedPlugins };
+      writeRawConfig(updatedConfig);
+
+      // Broadcast to all subscribed browsers
+      broadcast({
+        type: "plugin_config_update",
+        id,
+        config: merged,
+      });
+
+      return reply.status(200).send({ success: true, config: merged });
+    },
+  );
+}

package/packages/server/src/routes/system-routes.ts

@@ -18,6 +18,7 @@ import { spawn } from "@blackbelt-technology/pi-dashboard-shared/platform/exec.j
 import path from "node:path";
 import os from "node:os";
 import { localhostGuard, netmaskToCidrBits, networkAddress } from "../localhost-guard.js";
+import { getPluginStatusStore } from "@blackbelt-technology/dashboard-plugin-runtime/server";
 import type { NetworkInterface } from "@blackbelt-technology/pi-dashboard-shared/rest-api.js";
 
 export function registerSystemRoutes(
@@ -184,6 +185,7 @@ export function registerSystemRoutes(
         totalSessions: sessionManager.listAll().length,
       },
       agents: agentMetrics,
+      plugins: getPluginStatusStore().listAll(),
     };
   });