@fitchmultz/pi-subagents 0.45.0 → 0.46.0

package/src/pi-intercom/bridge.ts

@@ -8,8 +8,9 @@ import { getBrokerSocketPath } from "./broker/paths.ts";
 import { loadConfig, sameListener, type Config, type Identity } from "./bridge-config.ts";
 import { ASK_TIMEOUT, Fault, fingerprint, log } from "./bridge-protocol.ts";
 import { Session } from "./bridge-session.ts";
-import { operationFor, routeFor } from "./bridge-routes.ts";
+import { operationFor, routeFor, type Operation } from "./bridge-routes.ts";
 import { reply } from "./bridge-http.ts";
+import { Launcher, sameIdentity } from "./bridge-launch.ts";
 
 const MAX_CONNECTIONS = 128;
 
@@ -24,6 +25,7 @@ class Bridge {
   private readonly configPath: string;
   private readonly sessions = new Map<string, Session>();
   private readonly losses = new Map<string, number>();
+  private readonly launcher = new Launcher();
   private readonly sockets = new Set<Socket>();
   private readonly connections = new Map<TLSSocket, Connection>();
   private readonly server: Server;
@@ -88,7 +90,7 @@ class Bridge {
   }
   private allowed(identity: Identity): boolean {
     const current = this.config.clients.get(identity.fingerprint256);
-    return !this.stopping && current?.name === identity.name && current.cwd === identity.cwd;
+    return !this.stopping && sameIdentity(identity, current);
   }
   private lost(fp: string, count = 1): void {
     if (count > 0 && this.config.clients.has(fp)) {
@@ -181,8 +183,9 @@ class Bridge {
       });
     });
     process.on("SIGHUP", () => this.reload());
-    process.once("SIGINT", () => this.stop());
-    process.once("SIGTERM", () => this.stop());
+    // Retain listeners during dispatch: selected SDK dependencies use signal-exit's listener check.
+    process.on("SIGINT", () => this.stop());
+    process.on("SIGTERM", () => this.stop());
   }
   private reload(): void {
     if (this.stopping) {
@@ -195,9 +198,13 @@ class Bridge {
       }
       this.config = next;
       this.revokeRemoved();
+      this.launcher.revoke(next.clients).catch(() => log("launch_cleanup", { result: "failed" }));
       log("allowlist_reloaded", { result: "accepted", clients: next.clients.size });
     } catch {
       this.config = { ...this.config, clients: new Map() };
+      this.launcher
+        .revoke(this.config.clients)
+        .catch(() => log("launch_cleanup", { result: "failed" }));
       for (const session of this.sessions.values()) {
         session.close(
           new Fault(
@@ -253,7 +260,11 @@ class Bridge {
     for (const socket of this.sockets) {
       socket.destroy();
     }
-    await Promise.all([...this.handlers, ...sessions.map((session) => session.settled())]);
+    await Promise.all([
+      ...this.handlers,
+      ...sessions.map((session) => session.settled()),
+      this.launcher.shutdown(),
+    ]);
     log("shutdown", { result: "closed" });
   }
   private admission(req: IncomingMessage): {
@@ -317,14 +328,16 @@ class Bridge {
       const signal = controller.signal;
       req.once("aborted", abort);
       res.once("close", onClose);
-      setDeadline(route === "POST /v1/ask" ? ASK_TIMEOUT + 15000 : 15000);
+      const duration = route === "POST /v1/ask" ? ASK_TIMEOUT + 15000 : 15000;
+      setDeadline(route === "POST /v1/start" ? 75000 : duration);
       const operation = await operationFor(req, route, signal);
       if (operation.route === "POST /v1/ask") {
         setDeadline(operation.timeoutMs + 15000);
       }
-      const data = await session.execute(operation, {
+      const data = await this.execute(operation, session, {
         signal,
         requestId,
+        expires,
         onPeer: (id) => {
           peer = id;
         },
@@ -351,6 +364,38 @@ class Bridge {
       }
     }
   }
+  private async execute(
+    operation: Operation,
+    session: Readonly<Session>,
+    context: {
+      readonly signal: AbortSignal;
+      readonly requestId: string;
+      readonly expires: number;
+      readonly onPeer: (id: string) => void;
+    },
+  ) {
+    switch (operation.route) {
+      case "POST /v1/start":
+        return this.launcher.start(operation.name, {
+          identity: session.identity,
+          expires: context.expires,
+          signal: context.signal,
+          peers: (signal) => session.connectedPeers(signal),
+        });
+      case "GET /v1/sessions":
+        return this.launcher.list(session.identity);
+      case "POST /v1/stop":
+        return this.launcher.stop(session.identity, operation.sessionId);
+      case "GET /v1/list":
+      case "GET /v1/inbox":
+      case "POST /v1/register":
+      case "POST /v1/ask":
+      case "POST /v1/send":
+      case "POST /v1/reply":
+      case "POST /v1/ack":
+        return session.execute(operation, context);
+    }
+  }
 }
 
 function main(): void {
@@ -371,7 +416,7 @@ function main(): void {
     new Bridge(loadConfig(path), path).start();
   } catch {
     process.stderr.write(
-      "Bridge startup failed: check config schema, file ownership/mode 0600, absolute TLS/cwd paths, and TLS credentials.\n",
+      "Bridge startup failed: check config schema, file ownership/mode 0600, absolute TLS/cwd paths, TLS credentials, and launch policy (0700 sessionDir, Pi packageRoot, extension paths).\n",
     );
     process.exitCode = 1;
   }

package/src/shared/native-session-loader.ts

@@ -0,0 +1,13 @@
+import * as path from "node:path";
+import { pathToFileURL } from "node:url";
+import type * as NativeSession from "@earendil-works/pi-coding-agent";
+
+export async function loadNativeSession(packageRoot: string): Promise<typeof NativeSession> {
+  // The trusted selected Pi package supplies this exact SDK declaration contract.
+  // A computed URL is required: Jiti rewrites literal SDK imports to its own host graph.
+  // oxlint-disable-next-line typescript/no-unsafe-assignment
+  const sessionModule: typeof NativeSession = await import(
+    pathToFileURL(path.join(packageRoot, "dist/index.js")).href
+  );
+  return sessionModule;
+}

package/src/shared/native-session.ts

@@ -1,13 +1,6 @@
-import * as path from "node:path";
-import { pathToFileURL } from "node:url";
-import type * as NativeSession from "@earendil-works/pi-coding-agent";
 import { requirePiPackageRoot } from "../runs/shared/pi-spawn.ts";
+import { loadNativeSession } from "./native-session-loader.ts";
 
 // Detached Node runners do not get Pi's extension-loader package aliases.
-const selectedSessionURL = pathToFileURL(path.join(requirePiPackageRoot(), "dist/index.js")).href;
-// The trusted selected Pi package supplies this exact SDK declaration contract.
-// A computed URL is required: Jiti rewrites literal SDK imports to its own host graph.
-// oxlint-disable-next-line typescript/no-unsafe-assignment
-const sessionModule: typeof NativeSession = await import(selectedSessionURL);
 export const { buildSessionContext, parseSessionEntries, migrateSessionEntries, SessionManager } =
-  sessionModule;
+  await loadNativeSession(requirePiPackageRoot());