@blackbelt-technology/pi-agent-dashboard 0.5.0 → 0.5.2

package/packages/server/src/routes/pi-changelog-routes.ts

@@ -0,0 +1,194 @@
+/**
+ * REST route for `GET /api/pi-core/changelog`.
+ *
+ * Returns the parsed `CHANGELOG.md` for a core package filtered to
+ * a `(from, to]` half-open version range, plus a derived `hasBreaking`
+ * flag and a public GitHub URL for the full changelog.
+ *
+ * Gated identically to other `/api/pi-core/*` routes via the shared
+ * bootstrap-status gate.
+ *
+ * See change: pi-update-whats-new-panel.
+ */
+import type { FastifyInstance } from "fastify";
+import type {
+  ChangelogResponse,
+} from "@blackbelt-technology/pi-dashboard-shared/changelog-types.js";
+import { CORE_PACKAGE_NAMES } from "../pi-core-checker.js";
+import { parseVersion, compareVersions } from "../pi-version-skew.js";
+import {
+  findChangelogPath,
+  readPackageJson,
+  deriveChangelogUrl,
+} from "../changelog-fs.js";
+import {
+  parseChangelog,
+  readAndParseChangelog,
+  getCachedRemoteChangelog,
+  setRemoteChangelog,
+  refreshRemoteChangelogTtl,
+} from "../changelog-parser.js";
+import {
+  deriveChangelogRawUrl,
+  fetchRemoteChangelog,
+} from "../changelog-remote.js";
+import type { ChangelogRelease } from "@blackbelt-technology/pi-dashboard-shared/changelog-types.js";
+import type { BootstrapStateStore } from "../bootstrap-state.js";
+
+export interface PiChangelogRouteDeps {
+  /** When provided, route returns 503 unless bootstrap status is "ready". */
+  bootstrapState?: BootstrapStateStore;
+}
+
+interface QueryShape {
+  pkg?: string;
+  from?: string;
+  to?: string;
+}
+
+export function registerPiChangelogRoutes(
+  fastify: FastifyInstance,
+  deps: PiChangelogRouteDeps,
+): void {
+  const { bootstrapState } = deps;
+
+  const bootstrapGate = async (
+    _req: unknown,
+    reply: { code: (n: number) => { send: (body: unknown) => unknown } },
+  ): Promise<unknown> => {
+    if (!bootstrapState) return undefined;
+    const status = bootstrapState.get().status;
+    if (status === "ready") return undefined;
+    return reply.code(503).send({
+      success: false,
+      error: `pi not yet installed (bootstrap status: ${status})`,
+      bootstrap: status,
+    });
+  };
+
+  fastify.get<{ Querystring: QueryShape }>(
+    "/api/pi-core/changelog",
+    { preHandler: bootstrapGate as any },
+    async (request, reply) => {
+      const pkg = (request.query.pkg ?? "").trim();
+      const from = (request.query.from ?? "").trim();
+      const to = (request.query.to ?? "").trim();
+
+      // Validate `pkg` against the core whitelist BEFORE touching
+      // the filesystem — prevents arbitrary path reads via crafted
+      // input.
+      if (!pkg || !CORE_PACKAGE_NAMES.includes(pkg)) {
+        return reply.code(400).send({
+          success: false,
+          error: `pkg must be one of: ${CORE_PACKAGE_NAMES.join(", ")}`,
+        });
+      }
+
+      // Validate version range using the existing parseVersion helper
+      // from pi-version-skew. Both endpoints are required.
+      if (!from || !to) {
+        return reply.code(400).send({
+          success: false,
+          error: "from and to query params are required",
+        });
+      }
+      if (!parseVersion(from) || !parseVersion(to)) {
+        return reply.code(400).send({
+          success: false,
+          error: "from and to must be parseable semver versions",
+        });
+      }
+
+      const located = findChangelogPath(pkg);
+
+      // Spec: package not installed / CHANGELOG missing → 200 with empty body.
+      if (!located) {
+        const body: ChangelogResponse = {
+          pkg,
+          from,
+          to,
+          releases: [],
+          hasBreaking: false,
+          changelogUrl: null,
+          parsedAt: new Date().toISOString(),
+        };
+        return body;
+      }
+
+      // Read package.json once for both URLs (raw for the parser,
+      // human for the dialog footer link).
+      const pkgJson = readPackageJson(located.packageDir);
+      const rawUrl = pkgJson ? deriveChangelogRawUrl(pkgJson.repository) : null;
+      const changelogUrl = pkgJson ? deriveChangelogUrl(pkgJson.repository) : null;
+
+      // Try remote first — the upstream CHANGELOG describes versions
+      // newer than the locally-installed tarball. Fall back to local
+      // on failure / offline / non-GitHub repo. See change:
+      // read-changelog-from-github.
+      let allReleases: ChangelogRelease[] | undefined;
+      let usedRemote = false;
+
+      if (rawUrl) {
+        const cached = getCachedRemoteChangelog(pkg);
+        if (cached && !cached.expired) {
+          // Within TTL — reuse cached result, no fetch.
+          allReleases = cached.releases;
+          usedRemote = true;
+        } else {
+          const fetchResult = await fetchRemoteChangelog(rawUrl, {
+            etag: cached?.etag ?? null,
+          });
+          if (fetchResult?.status === "ok") {
+            const parsed = parseChangelog(fetchResult.text);
+            setRemoteChangelog(pkg, parsed, fetchResult.etag);
+            allReleases = parsed;
+            usedRemote = true;
+          } else if (fetchResult?.status === "not-modified" && cached) {
+            refreshRemoteChangelogTtl(pkg);
+            allReleases = cached.releases;
+            usedRemote = true;
+          }
+          // null result (network error / offline / non-2xx): fall through
+          // to local read below.
+        }
+      }
+
+      if (!usedRemote) {
+        try {
+          allReleases = readAndParseChangelog(pkg, located.changelogPath);
+        } catch (err: any) {
+          request.log.warn(
+            { err: err?.message },
+            "[pi-changelog-routes] local read/parse failed; returning empty",
+          );
+          allReleases = [];
+        }
+      }
+
+      // Filter to (from, to]. Unparseable release versions are
+      // dropped — conservative.
+      const filtered = (allReleases ?? []).filter((r) => {
+        const rv = parseVersion(r.version);
+        if (!rv) return false;
+        return compareVersions(r.version, from) > 0 &&
+          compareVersions(r.version, to) <= 0;
+      });
+
+      const hasBreaking = filtered.some((r) => r.breaking.length > 0);
+
+      const body: ChangelogResponse = {
+        pkg,
+        from,
+        to,
+        releases: filtered,
+        hasBreaking,
+        changelogUrl,
+        parsedAt: new Date().toISOString(),
+      };
+      return body;
+    },
+  );
+}
+
+// Re-export for tests that need to bypass the cache.
+export { parseChangelog };

package/packages/server/src/routes/pi-core-routes.ts

@@ -5,7 +5,7 @@
  *   POST /api/pi-core/update                 { packages?: string[] }
  *
  * Complements /api/packages/* (extension management): this endpoint covers
- * globally-installed pi CLI packages like @mariozechner/pi-coding-agent,
+ * globally-installed pi CLI packages like @earendil-works/pi-coding-agent,
  * pi-dashboard itself, pi-model-proxy, etc.
  */
 import type { FastifyInstance } from "fastify";

package/packages/server/src/routes/provider-auth-routes.ts

@@ -22,6 +22,7 @@ import { getLatestCatalogue } from "../provider-catalogue-cache.js";
 import { startCallbackServer } from "../oauth-callback-server.js";
 import type { PiGateway } from "../pi-gateway.js";
 import type { BrowserGateway } from "../browser-gateway.js";
+import { refreshModelRegistry } from "../model-proxy/registry-singleton.js";
 
 // ── In-memory flow store (short-lived PKCE + device code state) ──────────────
 
@@ -88,8 +89,14 @@ export function registerProviderAuthRoutes(
   const { piGateway, browserGateway } = deps;
 
   function notifyBridges() {
+    // Tell every bridge to reload auth.json + refresh its model registry.
+    // Each bridge will then push a fresh per-session models_list (and
+    // providers_list); browsers pick those up via the existing per-session
+    // broadcast and update modelsMap / catalogue cache without needing a
+    // global wipe. See change: simplify-model-selection-channels.
     piGateway.broadcast({ type: "credentials_updated" });
-    browserGateway.broadcastToAll({ type: "models_refreshed" });
+    // Eager-refresh model proxy registry so /v1/models reflects the change.
+    refreshModelRegistry().catch(() => {});
   }
 
   // List OAuth providers

package/packages/server/src/routes/provider-routes.ts

@@ -9,6 +9,9 @@ import type { NetworkGuard } from "./route-deps.js";
 import type { PiGateway } from "../pi-gateway.js";
 import type { BrowserGateway } from "../browser-gateway.js";
 import { probeProvider, resolveProbeApiKey, type ProbeApi } from "../provider-probe.js";
+import { refreshModelRegistry } from "../model-proxy/registry-singleton.js";
+import { isSelfPointing, collectDashboardOrigins } from "../model-proxy/recursion-guard.js";
+import { getTunnelUrl } from "../tunnel.js";
 
 const REDACTED = "***";
 const CONFIG_PATH = join(homedir(), ".pi", "agent", "providers.json");
@@ -47,7 +50,7 @@ function redactProviders(
   return redacted;
 }
 
-export function registerProviderRoutes(fastify: FastifyInstance, deps: { networkGuard: NetworkGuard; piGateway?: PiGateway; browserGateway?: BrowserGateway }): void {
+export function registerProviderRoutes(fastify: FastifyInstance, deps: { networkGuard: NetworkGuard; piGateway?: PiGateway; browserGateway?: BrowserGateway; port?: number }): void {
   const { networkGuard, piGateway } = deps;
   fastify.get(
     "/api/providers",
@@ -68,6 +71,23 @@ export function registerProviderRoutes(fastify: FastifyInstance, deps: { network
       }
 
       const incoming = body.providers as Record<string, ProviderEntry>;
+
+      // Recursion guard: reject providers pointing back at the dashboard
+      const dashboardPort = deps.port ?? 8000;
+      const tunnelUrl = getTunnelUrl();
+      const tunnelHostname = tunnelUrl ? new URL(tunnelUrl).hostname : undefined;
+      const origins = collectDashboardOrigins(dashboardPort, { tunnelHostname });
+      for (const [name, entry] of Object.entries(incoming)) {
+        if (entry.baseUrl && isSelfPointing(entry.baseUrl, origins)) {
+          return reply.code(400).send({
+            success: false,
+            code: "RECURSIVE_PROXY",
+            message: `Provider "${name}" baseUrl points back at this dashboard`,
+            offendingBaseUrl: entry.baseUrl,
+          });
+        }
+      }
+
       const existing = readProvidersRaw();
 
       // Merge: preserve redacted apiKey values from existing file
@@ -98,13 +118,16 @@ export function registerProviderRoutes(fastify: FastifyInstance, deps: { network
       mkdirSync(dir, { recursive: true });
       writeFileSync(CONFIG_PATH, JSON.stringify(fileData, null, 2) + "\n", "utf-8");
 
-      // Broadcast credentials_updated so all sessions refresh their model registries
+      // Broadcast credentials_updated so each bridge re-reads providers.json
+      // and pushes a fresh per-session models_list. Browsers receive those
+      // pushes via the existing per-session broadcast — no global wipe.
+      // See change: simplify-model-selection-channels.
       if (piGateway) {
         piGateway.broadcast({ type: "credentials_updated" });
       }
-      if (deps.browserGateway) {
-        deps.browserGateway.broadcastToAll({ type: "models_refreshed" });
-      }
+
+      // Eager-refresh model proxy registry so /v1/models reflects the change.
+      refreshModelRegistry().catch(() => {});
 
       return { success: true };
     },

package/packages/server/src/routes/system-routes.ts

@@ -13,7 +13,9 @@ import type { NetworkGuard } from "./route-deps.js";
 import { detectEditors, EDITORS } from "../editor-registry.js";
 import { detectCodeServerBinary, resetDetectionCache } from "../editor-detection.js";
 import { readConfigRedacted, writeConfigPartial } from "../config-api.js";
-import { createTunnel, deleteTunnel, getTunnelStatus } from "../tunnel.js";
+import { createTunnel, deleteTunnel, getTunnelStatus, getTunnelUrl } from "../tunnel.js";
+import { getModelProxyStatus } from "../model-proxy/registry-singleton.js";
+import { startTunnelWatchdog, stopTunnelWatchdog } from "../tunnel-watchdog.js";
 import { spawnRestart } from "../restart-helper.js";
 import { spawn } from "@blackbelt-technology/pi-dashboard-shared/platform/exec.js";
 import path from "node:path";
@@ -152,6 +154,29 @@ export function registerSystemRoutes(
       if (partial.openspec !== undefined && directoryService) {
         directoryService.reconfigurePolling(reloaded.openspec);
       }
+      // Live-reload tunnel watchdog when its config changes (no restart needed).
+      // We always restart the watchdog when partial.tunnel is present and a
+      // tunnel is currently active — covers both watchdog flag changes and
+      // numeric tweaks. Cheap operation: stop + start with new config.
+      if (partial.tunnel !== undefined) {
+        config.tunnelWatchdog = reloaded.tunnel.watchdog;
+        if (getTunnelUrl()) {
+          stopTunnelWatchdog();
+          const wd = reloaded.tunnel.watchdog;
+          if (wd?.enabled !== false) {
+            startTunnelWatchdog(
+              {
+                getUrl: getTunnelUrl,
+                recycle: async () => {
+                  await deleteTunnel(config.port);
+                  return await createTunnel(config.port, config.tunnelReservedToken);
+                },
+              },
+              wd,
+            );
+          }
+        }
+      }
 
       return { success: true, restartRequired: result.restartRequired };
     },
@@ -167,13 +192,29 @@ export function registerSystemRoutes(
     if (status.status === "active") return { ok: true, url: status.url };
     if (status.status === "unavailable") return { ok: false, error: "zrok not installed" };
     const url = await createTunnel(config.port, config.tunnelReservedToken);
-    if (url) return { ok: true, url };
+    if (url) {
+      const wd = config.tunnelWatchdog;
+      if (wd?.enabled !== false) {
+        startTunnelWatchdog(
+          {
+            getUrl: getTunnelUrl,
+            recycle: async () => {
+              await deleteTunnel(config.port);
+              return await createTunnel(config.port, config.tunnelReservedToken);
+            },
+          },
+          wd,
+        );
+      }
+      return { ok: true, url };
+    }
     return { ok: false, error: "Failed to create tunnel" };
   });
 
   fastify.post("/api/tunnel-disconnect", async () => {
     // Pass port so orphan zrok processes bound to this endpoint are also
     // swept (not just the one we tracked via pid-file).
+    stopTunnelWatchdog();
     await deleteTunnel(config.port);
     return { ok: true };
   });
@@ -206,6 +247,7 @@ export function registerSystemRoutes(
       },
       agents: agentMetrics,
       plugins: getPluginStatusStore().listAll(),
+      proxy: getModelProxyStatus(),
     };
   });
 

package/packages/server/src/rpc-keeper/__tests__/fixtures/mock-pi-shim.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# PATH-shim used in keeper.test.ts to make `pi --mode rpc` invoke our
+# mock-pi.cjs instead of the real pi binary.
+#
+# The keeper spawns `pi --mode rpc` from PATH; we prepend the dir
+# containing this script (named `pi`) to PATH so this shim wins.
+# The path to mock-pi.cjs is passed via env var so the shim can be
+# placed anywhere without copying mock-pi.cjs alongside it.
+exec node "${MOCK_PI_CJS_PATH:?MOCK_PI_CJS_PATH env var required}" "$@"

package/packages/server/src/rpc-keeper/__tests__/fixtures/mock-pi.cjs

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+/**
+ * Mock pi for keeper integration tests.
+ *
+ * Reads JSON-line input from stdin and appends each line to the file at
+ * `process.env.MOCK_PI_LOG`. Exits 0 on stdin EOF.
+ *
+ * Behavior modes (via env):
+ *   MOCK_PI_MODE=normal (default) — read until EOF, log lines, exit 0
+ *   MOCK_PI_MODE=crash             — exit non-zero immediately (tests
+ *                                    keeper crash-detection window)
+ *
+ * CommonJS-pure, only Node built-ins.
+ */
+"use strict";
+
+const fs = require("fs");
+
+const mode = process.env.MOCK_PI_MODE || "normal";
+const logPath = process.env.MOCK_PI_LOG;
+
+if (mode === "crash") {
+  process.stderr.write("[mock-pi] crash mode: exiting 1 immediately\n");
+  process.exit(1);
+}
+
+if (!logPath) {
+  process.stderr.write("[mock-pi] FATAL: MOCK_PI_LOG env var required\n");
+  process.exit(2);
+}
+
+let buf = "";
+process.stdin.setEncoding("utf8");
+process.stdin.on("data", (chunk) => {
+  buf += chunk;
+  let nl;
+  // eslint-disable-next-line no-cond-assign
+  while ((nl = buf.indexOf("\n")) !== -1) {
+    const line = buf.slice(0, nl);
+    buf = buf.slice(nl + 1);
+    fs.appendFileSync(logPath, line + "\n");
+  }
+});
+process.stdin.on("end", () => {
+  if (buf.length > 0) {
+    fs.appendFileSync(logPath, buf + "\n");
+  }
+  process.exit(0);
+});
+process.stdin.on("error", () => process.exit(0));