@blackbelt-technology/pi-agent-dashboard 0.5.0 → 0.5.2

package/packages/server/src/provider-auth-storage.ts

@@ -10,6 +10,9 @@
 import fs from "node:fs";
 import path from "node:path";
 import os from "node:os";
+import { createRequire } from "node:module";
+const _require = createRequire(import.meta.url);
+const _lockfile = _require("proper-lockfile") as typeof import("proper-lockfile");
 import type { ProviderAuthStatus } from "@blackbelt-technology/pi-dashboard-shared/rest-api.js";
 import type { ProviderInfo } from "@blackbelt-technology/pi-dashboard-shared/types.js";
 import { getAllHandlers, type ProviderHandler } from "./provider-auth-handlers.js";
@@ -19,10 +22,6 @@ import { getLatestCatalogue } from "./provider-catalogue-cache.js";
 
 const AUTH_DIR = path.join(os.homedir(), ".pi", "agent");
 const AUTH_PATH = path.join(AUTH_DIR, "auth.json");
-const LOCK_PATH = AUTH_PATH + ".lock";
-const LOCK_STALE_MS = 10_000;
-const LOCK_RETRY_MS = 50;
-const LOCK_MAX_RETRIES = 40; // 40 × 50ms = 2s max wait
 
 export type ApiKeyCredential = { type: "api_key"; key: string };
 export type OAuthCredential = { type: "oauth"; refresh: string; access: string; expires: number; [k: string]: unknown };
@@ -35,46 +34,35 @@ interface OAuthProviderMeta {
   flowType: "auth_code" | "device_code";
 }
 
-// ── Lock helpers ─────────────────────────────────────────────────────────────
+// ── Lock helpers (proper-lockfile) ───────────────────────────────────────────
+//
+// Upgraded from mkdir-based lock to proper-lockfile to match pi-coding-agent's
+// AuthStorage lock convention. See change: add-dashboard-model-proxy task 2.5.
 
-function acquireLock(): void {
-  // Ensure parent directory exists (fresh install may not have ~/.pi/agent/)
+/**
+ * Run `fn` while holding a proper-lockfile lock on auth.json.
+ * Ensures the file exists (lockfile requires the target to exist).
+ */
+function withLock<T>(fn: () => T): T {
   fs.mkdirSync(AUTH_DIR, { recursive: true });
-  for (let i = 0; i < LOCK_MAX_RETRIES; i++) {
-    try {
-      fs.mkdirSync(LOCK_PATH, { recursive: false });
-      return;
-    } catch (err: any) {
-      if (err.code === "EEXIST") {
-        // Check for stale lock
-        try {
-          const stat = fs.statSync(LOCK_PATH);
-          if (Date.now() - stat.mtimeMs > LOCK_STALE_MS) {
-            fs.rmdirSync(LOCK_PATH);
-            continue;
-          }
-        } catch { /* stat failed, retry */ }
-        // Wait and retry
-        const waitMs = LOCK_RETRY_MS + Math.random() * LOCK_RETRY_MS;
-        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, waitMs);
-        continue;
-      }
-      throw err;
-    }
+  if (!fs.existsSync(AUTH_PATH)) {
+    // Create empty auth file so lockfile can lock it
+    try { fs.writeFileSync(AUTH_PATH, "{}\n", { flag: "wx" }); } catch { /* race-safe */ }
   }
-  throw new Error("Failed to acquire auth.json lock after retries");
-}
 
-function releaseLock(): void {
-  try { fs.rmdirSync(LOCK_PATH); } catch { /* ignore */ }
+  const release = _lockfile.lockSync(AUTH_PATH, {
+    stale: 10_000,
+    realpath: false,
+  });
+  try {
+    return fn();
+  } finally {
+    try { release(); } catch { /* ignore cleanup errors */ }
+  }
 }
 
 // ── File operations ──────────────────────────────────────────────────────────
 
-function ensureDir(): void {
-  fs.mkdirSync(AUTH_DIR, { recursive: true });
-}
-
 export function readAuthJson(): AuthData {
   try {
     const raw = fs.readFileSync(AUTH_PATH, "utf-8");
@@ -86,7 +74,7 @@ export function readAuthJson(): AuthData {
 }
 
 function writeAuthJson(data: AuthData): void {
-  ensureDir();
+  fs.mkdirSync(AUTH_DIR, { recursive: true });
   const tmp = AUTH_PATH + ".tmp";
   const content = JSON.stringify(data, null, 2) + "\n";
 
@@ -104,25 +92,19 @@ function writeAuthJson(data: AuthData): void {
 // ── Public API: write/remove ─────────────────────────────────────────────────
 
 export function writeCredential(provider: string, credential: AuthCredential): void {
-  acquireLock();
-  try {
+  withLock(() => {
     const data = readAuthJson();
     data[provider] = credential;
     writeAuthJson(data);
-  } finally {
-    releaseLock();
-  }
+  });
 }
 
 export function removeCredential(provider: string): void {
-  acquireLock();
-  try {
+  withLock(() => {
     const data = readAuthJson();
     delete data[provider];
     writeAuthJson(data);
-  } finally {
-    releaseLock();
-  }
+  });
 }
 
 // ── Pure status builder (testable) ───────────────────────────────────────────

package/packages/server/src/provider-catalogue-cache.ts

@@ -1,41 +1,47 @@
 /**
- * In-memory cache of provider catalogues pushed by bridges.
+ * In-memory cache of the most-recently-pushed provider catalogue.
  *
  * Each pi process pushes a `providers_list` over WS, derived from its
- * `ModelRegistry`. The server caches per-session and tracks the most-recent
- * snapshot. `GET /api/provider-auth/status` reads `getLatestCatalogue()`.
+ * `ModelRegistry`. The server caches the latest snapshot. `GET
+ * /api/provider-auth/status` reads `getLatestCatalogue()`.
  *
- * See change: replace-hardcoded-provider-lists.
+ * The catalogue is a property of the machine's auth + provider config,
+ * not of individual sessions: every bridge in the same process tree
+ * derives an identical catalogue from `~/.pi/agent/auth.json` +
+ * `~/.pi/agent/providers.json` + pi-ai's MODELS table. We therefore
+ * keep ONE global snapshot — the last push wins. A previous version
+ * kept a per-session Map plus a `changed` deep-equality gate to avoid
+ * spurious `models_refreshed` broadcasts; that broadcast is gone
+ * (see change: simplify-model-selection-channels), so the gate is
+ * unnecessary and the per-session split was redundant.
+ *
+ * See changes: replace-hardcoded-provider-lists,
+ *              fix-providers-list-spurious-models-refreshed,
+ *              simplify-model-selection-channels.
  */
 import type { ProviderInfo } from "@blackbelt-technology/pi-dashboard-shared/types.js";
 
-const bySession = new Map<string, ProviderInfo[]>();
 let latest: ProviderInfo[] | null = null;
 
-export function setCatalogueForSession(sessionId: string, providers: ProviderInfo[]): void {
-  bySession.set(sessionId, providers);
+/**
+ * Replace the cached catalogue. Called from event-wiring.ts on every
+ * `providers_list` arrival. No-op semantically beyond the assignment;
+ * no signal to callers because no caller needs one.
+ */
+export function setCatalogueForSession(_sessionId: string, providers: ProviderInfo[]): void {
   latest = providers;
 }
 
-export function getCatalogueForSession(sessionId: string): ProviderInfo[] | undefined {
-  return bySession.get(sessionId);
-}
-
 /**
  * Most recent catalogue across any session. Returns [] when no bridge
- * has pushed yet — callers should treat that as "waiting for pi".
+ * has pushed yet — callers should treat that as "waiting for pi" and
+ * may issue a `request_providers` nudge to fetch one synchronously.
  */
 export function getLatestCatalogue(): ProviderInfo[] {
   return latest ?? [];
 }
 
-export function clearForSession(sessionId: string): void {
-  bySession.delete(sessionId);
-  if (bySession.size === 0) latest = null;
-}
-
 /** Test-only: reset all cached state. */
 export function _resetForTests(): void {
-  bySession.clear();
   latest = null;
 }

package/packages/server/src/restart-helper.ts

@@ -12,7 +12,7 @@
  * See change: fix-windows-server-parity.
  */
 import { spawn } from "@blackbelt-technology/pi-dashboard-shared/platform/exec.js";
-import { toFileUrl, shouldUrlWrapEntry } from "@blackbelt-technology/pi-dashboard-shared/platform/node-spawn.js";
+import { buildNodeImportArgvParts, toFileUrl, shouldUrlWrapEntry } from "@blackbelt-technology/pi-dashboard-shared/platform/node-spawn.js";
 import os from "node:os";
 import path from "node:path";
 
@@ -40,21 +40,22 @@ export function buildOrchestratorScript(params: RestartParams): string {
   // so quoting/path-separator handling is correct on Windows.
   // See change: fix-restart-bridge-auto-start-race.
   const pidPath = path.join(os.homedir(), ".pi", "dashboard", "dashboard.pid");
-  // Loader is always URL-wrapped (required on Windows for non-C: drives).
-  // Entry is URL-wrapped only on Windows + non-tsx loader. POSIX + jiti MUST
-  // pass raw path because jiti's resolver treats file:// URL entries as
-  // relative specifiers (normalises to file:/... then prepends cwd).
-  // See openspec/changes/archive/2026-04-24-fix-windows-entry-script-url.
-  const wrapEntry = shouldUrlWrapEntry(params.loader);
-  const spawnArgs: string[] = [];
-  if (params.loader) {
-    spawnArgs.push("--import", toFileUrl(params.loader));
-  }
-  spawnArgs.push(
-    wrapEntry ? toFileUrl(params.cliPath) : params.cliPath,
-    "start",
-    ...params.extraArgs,
-  );
+  // Argv shape (loader URL-wrapping + entry URL-wrapping rule) is
+  // owned by `buildNodeImportArgvParts` in `node-spawn.ts` — the same
+  // helper `spawnNodeScript` calls. Keeps the `--import` argv shape
+  // in exactly one place.
+  // See change: unify-server-launch-ts-loader.
+  const spawnArgs: string[] = params.loader
+    ? buildNodeImportArgvParts({
+        loader: params.loader,
+        entry: params.cliPath,
+        args: ["start", ...params.extraArgs],
+      })
+    : [
+        shouldUrlWrapEntry(params.loader) ? toFileUrl(params.cliPath) : params.cliPath,
+        "start",
+        ...params.extraArgs,
+      ];
 
   // The script runs in a fresh Node process. Keep it self-contained and use
   // only built-ins (net, http, fs, child_process). JSON.stringify is used to

package/packages/server/src/routes/bootstrap-routes.ts

@@ -13,6 +13,10 @@ import type { FastifyInstance } from "fastify";
 import { randomUUID } from "node:crypto";
 import type { BootstrapStateStore } from "../bootstrap-state.js";
 import type { NetworkGuard } from "./route-deps.js";
+import {
+  detectLegacyPiInstalls,
+  uninstallLegacyPi,
+} from "../legacy-pi-cleanup.js";
 
 export interface BootstrapRouteDeps {
   bootstrapState: BootstrapStateStore;
@@ -85,4 +89,37 @@ export function registerBootstrapRoutes(
       return reply.code(202).send({ ticketId, status: "accepted" });
     },
   );
+
+  // ── Legacy pi cleanup ──────────────────────────────────────────
+
+  // Refresh detection on demand (also runs at server startup).
+  fastify.get(
+    "/api/bootstrap/legacy-pi",
+    { preHandler: networkGuard },
+    async () => {
+      const installs = detectLegacyPiInstalls();
+      bootstrapState.set({ legacyPiInstalls: installs });
+      return { installs };
+    },
+  );
+
+  // Remove all currently-detected legacy installs. Returns per-install
+  // result; partial failures are reported but do not abort the others.
+  fastify.post(
+    "/api/bootstrap/legacy-pi/cleanup",
+    { preHandler: networkGuard },
+    async () => {
+      const before = detectLegacyPiInstalls();
+      if (before.length === 0) {
+        bootstrapState.set({ legacyPiInstalls: [] });
+        return { results: [], remaining: [] };
+      }
+      const results = uninstallLegacyPi(before);
+      // Re-scan so the UI shows any installs that survived (e.g. permission
+      // error). The store mirrors the post-cleanup state.
+      const remaining = detectLegacyPiInstalls();
+      bootstrapState.set({ legacyPiInstalls: remaining });
+      return { results, remaining };
+    },
+  );
 }

package/packages/server/src/routes/jj-routes.ts

@@ -22,6 +22,7 @@ import type { ApiResponse } from "@blackbelt-technology/pi-dashboard-shared/type
 import type { BrowserGateway } from "../browser-gateway.js";
 import type { PendingAttachRegistry } from "../pending-attach-registry.js";
 import { spawnPiSession } from "../process-manager.js";
+import { keeperOptsFromSpawnResult } from "../headless-pid-registry.js";
 import type { NetworkGuard } from "./route-deps.js";
 import { safeRealpathSync } from "../resolve-path.js";
 
@@ -218,6 +219,8 @@ export function registerJjRoutes(fastify: FastifyInstance, deps: JjRoutesDeps) {
             spawnResult.pid,
             realDestPath,
             spawnResult.process,
+            spawnResult.spawnToken,
+            keeperOptsFromSpawnResult(spawnResult),
           );
         }
         if (!spawnResult.success) {

package/packages/server/src/routes/model-proxy-api-key-routes.ts

@@ -0,0 +1,168 @@
+/**
+ * REST routes for proxy API key management.
+ *
+ *   GET    /api/model-proxy/api-keys           → list keys (redacted)
+ *   POST   /api/model-proxy/api-keys           → create key (cleartext returned ONCE)
+ *   POST   /api/model-proxy/api-keys/:id/revoke → soft-delete (set revokedAt)
+ *   DELETE /api/model-proxy/api-keys/:id       → hard-delete (purge)
+ *
+ * All routes are JWT-gated (NOT proxy-key-gated — this is the management surface).
+ *
+ * See change: add-dashboard-model-proxy.
+ */
+import crypto from "node:crypto";
+import type { FastifyInstance } from "fastify";
+import type { ProxyApiKey } from "@blackbelt-technology/pi-dashboard-shared/config.js";
+import type { NetworkGuard } from "./route-deps.js";
+import { generateKey, hashKey } from "../model-proxy/api-key-store.js";
+
+export interface ApiKeyRoutesDeps {
+  networkGuard: NetworkGuard;
+  getModelProxyConfig: () => import("@blackbelt-technology/pi-dashboard-shared/config.js").ModelProxyConfig;
+  writeModelProxyApiKeys: (apiKeys: ProxyApiKey[]) => Promise<void>;
+  getAdminEmail?: () => string | undefined;
+}
+
+function getUserEmail(request: any): string | undefined {
+  return request.user?.email;
+}
+
+export function registerModelProxyApiKeyRoutes(
+  fastify: FastifyInstance,
+  deps: ApiKeyRoutesDeps,
+): void {
+  const { networkGuard, getModelProxyConfig, writeModelProxyApiKeys, getAdminEmail } = deps;
+
+  // ── GET /api/model-proxy/api-keys ─────────────────────────────────
+  fastify.get(
+    "/api/model-proxy/api-keys",
+    { preHandler: networkGuard },
+    async (request) => {
+      const config = getModelProxyConfig();
+      const userEmail = getUserEmail(request);
+      const adminEmail = getAdminEmail?.();
+      const isAdmin = adminEmail != null && userEmail === adminEmail;
+
+      const filtered = config.apiKeys.filter(
+        (k) => isAdmin || !k.createdBy || k.createdBy === userEmail,
+      );
+
+      const active = filtered
+        .filter((k) => k.revokedAt == null)
+        .map((k) => ({ ...k, hash: "***" }));
+      const revoked = filtered
+        .filter((k) => k.revokedAt != null)
+        .map((k) => ({ ...k, hash: "***" }));
+
+      return { success: true, data: { keys: active, revoked } };
+    },
+  );
+
+  // ── POST /api/model-proxy/api-keys ────────────────────────────────
+  fastify.post(
+    "/api/model-proxy/api-keys",
+    { preHandler: networkGuard },
+    async (request, reply) => {
+      const body = request.body as any;
+      if (!body || typeof body.label !== "string" || !body.label.trim()) {
+        return reply.code(400).send({ success: false, error: "label is required" });
+      }
+
+      const scopes: string[] = Array.isArray(body.scopes) ? body.scopes : ["all"];
+      const expiresAt: number | undefined =
+        typeof body.expiresAt === "number" ? body.expiresAt : undefined;
+
+      if (expiresAt != null && expiresAt <= Date.now()) {
+        return reply.code(400).send({ success: false, error: "expiresAt must be in the future" });
+      }
+
+      const cleartext = generateKey();
+      const hash = hashKey(cleartext);
+      const userEmail = getUserEmail(request);
+
+      const entry: ProxyApiKey = {
+        id: crypto.randomUUID(),
+        label: body.label.trim(),
+        hash,
+        createdAt: Date.now(),
+        ...(userEmail ? { createdBy: userEmail } : {}),
+        scopes,
+        ...(expiresAt != null ? { expiresAt } : {}),
+      };
+
+      const config = getModelProxyConfig();
+      await writeModelProxyApiKeys([...config.apiKeys, entry]);
+
+      return reply.code(201).send({
+        success: true,
+        data: {
+          id: entry.id,
+          label: entry.label,
+          createdBy: entry.createdBy,
+          scopes: entry.scopes ?? ["all"],
+          createdAt: entry.createdAt,
+          ...(entry.expiresAt != null ? { expiresAt: entry.expiresAt } : {}),
+          key: cleartext, // revealed ONCE
+        },
+      });
+    },
+  );
+
+  // ── POST /api/model-proxy/api-keys/:id/revoke ─────────────────────
+  fastify.post(
+    "/api/model-proxy/api-keys/:id/revoke",
+    { preHandler: networkGuard },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const config = getModelProxyConfig();
+      const entry = config.apiKeys.find((k) => k.id === id);
+
+      if (!entry) {
+        return reply.code(404).send({ success: false, error: "Key not found" });
+      }
+
+      const userEmail = getUserEmail(request);
+      const adminEmail = getAdminEmail?.();
+      const isAdmin = adminEmail != null && userEmail === adminEmail;
+
+      if (!isAdmin && entry.createdBy && entry.createdBy !== userEmail) {
+        return reply.code(403).send({ success: false, error: "Not authorized to revoke this key" });
+      }
+
+      const updated = config.apiKeys.map((k) =>
+        k.id === id ? { ...k, revokedAt: Date.now() } : k,
+      );
+      await writeModelProxyApiKeys(updated);
+
+      return reply.code(204).send();
+    },
+  );
+
+  // ── DELETE /api/model-proxy/api-keys/:id ──────────────────────────
+  fastify.delete(
+    "/api/model-proxy/api-keys/:id",
+    { preHandler: networkGuard },
+    async (request, reply) => {
+      const { id } = request.params as { id: string };
+      const config = getModelProxyConfig();
+      const entry = config.apiKeys.find((k) => k.id === id);
+
+      if (!entry) {
+        return reply.code(404).send({ success: false, error: "Key not found" });
+      }
+
+      const userEmail = getUserEmail(request);
+      const adminEmail = getAdminEmail?.();
+      const isAdmin = adminEmail != null && userEmail === adminEmail;
+
+      if (!isAdmin && entry.createdBy && entry.createdBy !== userEmail) {
+        return reply.code(403).send({ success: false, error: "Not authorized to delete this key" });
+      }
+
+      const filtered = config.apiKeys.filter((k) => k.id !== id);
+      await writeModelProxyApiKeys(filtered);
+
+      return reply.code(204).send();
+    },
+  );
+}

package/packages/server/src/routes/model-proxy-refresh-routes.ts

@@ -0,0 +1,24 @@
+/**
+ * POST /api/model-proxy/refresh — force-refresh the model proxy registry.
+ *
+ * JWT-gated. Returns 200 on success, 503 if registry cannot be resolved.
+ * See change: add-dashboard-model-proxy, task 2.9.
+ */
+import type { FastifyInstance } from "fastify";
+import { refreshModelRegistry, getModelRegistry } from "../model-proxy/registry-singleton.js";
+
+export function registerModelProxyRefreshRoutes(fastify: FastifyInstance): void {
+  fastify.post("/api/model-proxy/refresh", async (_request, reply) => {
+    try {
+      // Ensure registry is initialized first, then refresh
+      await getModelRegistry();
+      await refreshModelRegistry();
+      return { ok: true };
+    } catch (err: any) {
+      return reply.code(503).send({
+        code: "MODEL_PROXY_RUNTIME_MISSING",
+        message: err.message || "Failed to refresh model proxy registry",
+      });
+    }
+  });
+}