@henlii/pidance 0.2.36 → 0.2.39

package/.next/static/vD56I5OFkAr4Y9TsF1L7c/_buildManifest.js

@@ -0,0 +1 @@
+self.__BUILD_MANIFEST={__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:49,errorRate:1e-4,numBits:940,numHashes:14,bitArray:[1,0,1,0,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,0,0,0,1,1,0,1,1,0,1,0,1,0,0,0,1,1,1,1,0,1,0,1,0,1,0,0,0,1,0,0,1,1,0,0,1,0,1,0,1,0,1,1,1,0,0,1,1,1,0,0,0,0,1,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,1,1,1,0,0,0,0,1,1,1,0,0,0,0,1,1,1,0,0,0,0,0,1,0,0,1,1,0,1,0,0,1,0,0,0,0,0,0,1,0,1,1,1,1,1,0,0,1,1,0,1,1,1,1,0,0,1,0,1,0,0,1,0,1,1,1,0,1,0,1,1,0,0,0,0,0,1,1,1,1,0,1,0,0,0,1,1,1,0,1,1,1,0,0,0,0,0,1,1,1,0,1,1,1,1,0,1,1,0,0,0,1,1,1,1,1,1,0,0,0,0,0,1,1,1,0,0,1,0,1,0,1,0,0,1,0,1,1,1,0,1,0,0,1,0,0,0,0,1,1,0,1,0,0,0,0,0,1,1,0,1,1,1,1,1,1,1,1,1,1,1,1,0,0,0,0,1,0,1,1,1,1,1,1,1,1,1,0,1,1,1,1,0,1,0,0,0,1,1,1,0,0,0,0,1,1,1,0,0,1,0,1,1,1,0,1,1,0,0,1,0,0,1,0,1,1,0,0,1,0,1,0,1,1,0,0,1,0,1,0,1,1,1,0,1,0,1,0,0,0,1,1,1,0,0,0,1,0,1,1,0,1,1,0,1,0,0,0,1,1,1,1,0,1,1,0,0,0,1,1,1,0,1,1,0,0,1,1,0,1,1,1,0,0,1,1,1,0,0,0,1,1,1,0,1,1,0,0,0,1,0,0,1,0,0,0,0,1,0,0,1,0,0,1,0,0,0,1,1,0,0,0,0,0,1,0,0,1,0,0,1,1,1,1,0,0,0,0,0,0,1,1,0,0,1,0,0,1,1,1,0,0,0,1,0,0,1,1,1,0,1,0,0,1,1,1,0,1,1,1,1,1,1,1,1,0,0,1,0,1,0,1,0,0,0,1,0,1,0,0,1,0,1,1,1,0,0,0,1,0,0,1,1,1,1,1,0,1,0,1,0,1,0,1,1,0,0,1,1,1,0,1,0,0,0,0,0,1,1,1,0,0,0,0,0,1,1,0,1,1,1,0,1,1,0,1,0,0,1,1,1,0,0,1,0,0,1,1,1,0,1,0,0,1,0,0,1,1,0,0,1,0,0,0,1,1,1,1,0,1,1,0,1,1,1,0,1,1,0,0,1,0,0,0,1,0,0,1,1,1,0,0,0,0,0,1,0,0,1,0,0,1,1,1,0,0,1,0,1,1,0,1,1,1,1,0,1,1,1,1,1,1,0,0,0,1,1,0,1,1,0,0,0,1,1,1,1,0,1,1,1,0,1,0,1,1,0,1,1,0,0,0,0,1,0,0,0,1,1,0,1,0,1,1,1,0,0,0,1,1,1,1,1,1,0,1,0,1,1,1,1,0,0,1,1,1,1,0,1,1,1,0,0,0,1,0,0,1,1,0,0,0,0,1,1,0,0,1,1,0,0,0,1,0,1,0,0,1,0,0,0,1,1,1,0,0,0,1,1,1,0,1,0,1,0,1,1,1,0,1,1,0,0,1,0,0,1,1,0,1,1,0,0,0,0,0,1,0,1,1,0,0,0,0,0,1,0,1,0,0,0,1,0,1,1,0,1,0,0,1,1,1,1,0,1,0,0,0,0,1,1,0,1,1,1,0,1,0,1,1,0,0,1,0,0,0,0,0,0,1,0,1,0,1,0,0,1,1,1,1,0,1,0,1,0,1,1,0,0,0,0,0,1,1,1,0,1,0,0,1,0,0,0,0,1,0,0,1,0,0,0,1,0,1,0,0,1,0,1,0,0,0,0,1,0,1,0,1,1,0,0,1,0,1,0,0,1,0,1,0,1,0,1,0,0,1,0,1,1,0,1,1,1,1,1,0,0,0,1,1,1,1,0,0,1,1,0,0,1,0,0,0,1,1,1,1,0,1,1,1,0,0,0,1]},__routerFilterDynamic:{numItems:8,errorRate:1e-4,numBits:154,numHashes:14,bitArray:[1,0,0,0,1,1,1,0,1,0,1,1,1,1,1,1,1,1,0,1,0,0,1,0,1,0,0,1,1,0,0,0,1,1,0,1,0,1,1,0,1,1,1,1,0,1,1,1,1,0,1,0,0,0,0,1,0,0,1,1,0,1,0,1,0,1,1,1,1,1,0,1,1,0,0,1,1,0,0,1,0,0,0,1,0,0,0,1,0,0,0,1,1,0,0,1,1,1,0,1,0,1,0,0,1,1,1,1,0,0,0,0,0,1,1,1,1,0,0,0,1,1,0,0,1,1,1,1,1,1,1,1,0,1,1,0,1,0,1,0,0,1,0,0,0,0,1,1,1,0,0,0,1,0]},sortedPages:["/_app"]},self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();

package/README.en.md

@@ -10,7 +10,16 @@
 
 Pidance is an open-source web client for the [Pi](https://github.com/badlogic/pi-mono) coding agent. It reads local Pi session files directly and preserves Pi SDK session and runtime semantics, bringing live chat, project files, Git, subagents, and configuration into one browser workspace. Pi remains the source of truth for data and execution semantics; Pidance provides a clearer and more complete interface.
 
-> Current version: `0.2.36` · npm package: `@henlii/pidance` · CLI: `pidance`
+> Current version: `0.2.39` · npm package: `@henlii/pidance` · CLI: `pidance`
+
+## Design principles
+
+**Compatibility first, then general display improvements on top of it.**
+
+1. **Content completeness comes first.** Pidance aims to let you experience what a native TUI session shows — **including extension (plugin) custom UI** — in the browser. Anything the native TUI can display, Pidance should display too; prefer showing it as-is over hiding it because it “looks off on the web”.
+2. **Compatibility outranks looks.** Content a plugin expresses through the TUI extension API (self-drawn components, overlays, widgets, status lines, dialogs) must always have a landing spot. When a capability is missing, degrade **visibly** — notify or return an explicit value, never drop it silently (silence makes plugin authors think it worked).
+3. **Improvements must be general.** Display-layer work (layout, collapsing, card shells, titles, accessibility) goes through mechanisms shared by every plugin — no per-plugin special cases. Plugin-specific code is allowed only in the compatibility layer: parsing a plugin's private payloads, or bridging TUI semantics to the web.
+4. **Pi stays the source of truth.** Session files, tool execution, compaction and branch semantics are decided by the Pi SDK; Pidance only projects and presents them. See [`docs/ui-vs-tui.md`](./docs/ui-vs-tui.md) for the surface-by-surface mapping.
 
 ## Preview
 

package/README.md

@@ -10,7 +10,16 @@
 
 Pidance 是面向 [Pi](https://github.com/badlogic/pi-mono) coding agent 的开源 Web 客户端。它直接读取本机 Pi 会话文件，并沿用 Pi SDK 的会话与运行时语义，把实时对话、项目文件、Git、工作树、子代理和配置管理汇集到一个浏览器工作区。Pi 仍是数据与执行语义的事实来源；Pidance 负责提供更清晰、更完整的操作界面。
 
-> 当前版本：`0.2.36` · npm 包：`@henlii/pidance` · CLI：`pidance`
+> 当前版本：`0.2.39` · npm 包：`@henlii/pidance` · CLI：`pidance`
+
+## 设计原则
+
+**兼容优先，然后在兼容之上做通用的显示优化。**
+
+1. **内容完整优先**：Pidance 的目标是在浏览器里体验原生 TUI 会话的内容，**包括扩展（插件）自定义的界面**。原生 TUI 里能显示的东西，Pidance 都要能显示；宁可先原样呈现，也不要因为「Web 里不好看」而少显示。
+2. **兼容高于观感**：插件用 TUI 扩展 API 表达的内容（自绘组件、overlay、widget、状态条、对话框）都必须有落点。暂不具备的能力按**可见方式**降级——给出提示或明确返回值，不静默丢弃（静默会让插件作者以为生效了）。
+3. **优化必须通用**：显示层的改进（排版、折叠、卡片壳、标题、无障碍）要走所有插件共用的机制，不为个别插件写特例。插件专属代码只允许出现在兼容层：解析它发的私有载荷、把 TUI 语义桥到 Web。
+4. **Pi 仍是事实来源**：会话文件、工具执行、压缩与分支语义由 Pi SDK 决定；Pidance 不复制、不覆盖这些语义，只负责投影与呈现。界面分区对照见 [`docs/ui-vs-tui.md`](./docs/ui-vs-tui.md)。
 
 ## 界面预览
 

package/bin/pidance-auth-gate.js

@@ -2,11 +2,50 @@
 
 // 启动认证门禁纯逻辑（CLI 门禁用；与 lib/request-guard.ts 的 isLoopbackHost 语义保持一致）：
 // 监听非回环地址且未设置认证密码 → 拒绝启动（fail-closed，发布阻断 P0）。
-// 密码来源：PIDANCE_PASSWORD 优先（产品名），兼容回退旧变量 PI_WEB_PASSWORD。
+// 密码来源：启动缓存（已搬走）→ PIDANCE_PASSWORD（产品名）→ 旧变量 PI_WEB_PASSWORD。
 
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { isIP } = require("net");
 
+/**
+ * 进程内密码缓存键，与 lib/request-guard.ts 的 __piAuthPassword 同形。
+ *
+ * 同进程共享：middleware / route / CLI 共用 globalThis（Next 的 Node middleware 是
+ * require 进同进程的），所以 CLI 写、服务端读。
+ */
+const AUTH_PASSWORD_CACHE_KEY = "__piAuthPassword";
+
+function readPasswordFromEnv(env) {
+  const p =
+    env && env.PIDANCE_PASSWORD && env.PIDANCE_PASSWORD.length > 0
+      ? env.PIDANCE_PASSWORD
+      : env && env.PI_WEB_PASSWORD;
+  return typeof p === "string" && p.length > 0 ? p : null;
+}
+
+/** 解析认证密码：启动缓存优先，否则读 env。 */
+function resolvePassword(env) {
+  const cached = globalThis[AUTH_PASSWORD_CACHE_KEY];
+  if (cached) return cached.value;
+  return readPasswordFromEnv(env);
+}
+
+/**
+ * 把 env 里的密码搬进进程内缓存，并从 process.env 删掉两个变量名。
+ *
+ * 为什么必须搬：主 agent 的 SDK bash 工具用 `{ ...process.env }` 构造命令环境，
+ * 密码留在 env 里会被 agent 一条 `env` 打进会话并永久落盘。删掉后命令环境拿不到，
+ * 认证改读缓存（只删不搬会让 resolvePassword fail-open）。
+ * 缓存不写盘。
+ */
+function primeAndScrubPassword(env = process.env) {
+  const value = readPasswordFromEnv(env);
+  globalThis[AUTH_PASSWORD_CACHE_KEY] = { value };
+  delete env.PIDANCE_PASSWORD;
+  delete env.PI_WEB_PASSWORD;
+  return value;
+}
+
 /** host 是否为回环（localhost / *.localhost / IPv4 127.x / IPv6 ::1）。 */
 function isLoopbackHost(host) {
   if (typeof host !== "string" || host.length === 0) return false; // 未指定 → Pidance 默认绑定 127.0.0.1
@@ -19,15 +58,6 @@ function isLoopbackHost(host) {
   return false;
 }
 
-/** 解析认证密码：PIDANCE_PASSWORD 优先（产品名，空/缺失时回退），兼容旧变量 PI_WEB_PASSWORD。 */
-function resolvePassword(env) {
-  const p =
-    env && env.PIDANCE_PASSWORD && env.PIDANCE_PASSWORD.length > 0
-      ? env.PIDANCE_PASSWORD
-      : env && env.PI_WEB_PASSWORD;
-  return typeof p === "string" && p.length > 0 ? p : null;
-}
-
 /**
  * 是否需要强制认证：非回环监听地址 + 未设置密码（env 明文或设置 → 通用 保存的服务端密码）。
  * serverConfig 来自 bin/pidance-server-config.js 的 { passwordSet, remoteEnabled } 投影。
@@ -44,4 +74,4 @@ function describeHost(host) {
   return typeof host === "string" && host.length > 0 ? host : "127.0.0.1（默认本机绑定）";
 }
 
-module.exports = { isLoopbackHost, resolvePassword, shouldRequireAuth, describeHost };
+module.exports = { isLoopbackHost, resolvePassword, primeAndScrubPassword, shouldRequireAuth, describeHost };

package/bin/pidance-http-server.js

@@ -58,6 +58,13 @@ async function startPidanceHttpServer(options) {
   const handle = app.getRequestHandler();
   const server = createHttpServer((req, res) => {
     installUpgradeHandler();
+    // 对端地址是我们唯一可信的客户端身份来源：先删掉客户端自带的同名头，
+    // 再写入 socket 地址。限流分桶读它（middleware 里读不到 socket）。
+    if (req.headers) {
+      delete req.headers["x-pidance-peer-ip"];
+      const address = req.socket?.remoteAddress;
+      if (address) req.headers["x-pidance-peer-ip"] = address;
+    }
     // Next 的 compress 只在它自己的内置服务器（router-server）里生效；
     // 自管 server 必须自己压缩，否则 JSON/HTML 明文下发。
     // 见 bin/pidance-compression.js。

package/bin/pidance.js

@@ -12,7 +12,7 @@ const { parseLaunchOptions } = require("./pidance-options");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { loadServerConfig } = require("./pidance-server-config");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
-const { shouldRequireAuth, resolvePassword, describeHost } = require("./pidance-auth-gate");
+const { shouldRequireAuth, resolvePassword, primeAndScrubPassword, describeHost } = require("./pidance-auth-gate");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { startPidanceHttpServer } = require("./pidance-http-server");
 
@@ -39,6 +39,10 @@ if (!nodeMeetsMin(process.versions.node)) {
 
 const { port: explicitPort, hostname: explicitHostname, openBrowser } = parseLaunchOptions();
 const serverConfig = loadServerConfig();
+// 密码只活在进程内缓存里：把 env 里的密码搬进缓存、再删掉两个变量名。
+// 必须在启动 Next 之前做——middleware / route / SDK bash 都在同一进程，读的是 globalThis
+// 缓存；env 里留着的密码会被 agent 的 bash 一条 `env` 打进会话并永久落盘。
+primeAndScrubPassword(process.env);
 // 默认绑定：设置 → 通用 开启远程服务 → 0.0.0.0；否则仅本机 127.0.0.1（免密码）。
 // 显式 --hostname / -H / HOSTNAME env 优先；显式 0.0.0.0 仍走密码门禁。
 const hostname = explicitHostname ?? (serverConfig.remoteEnabled ? "0.0.0.0" : "127.0.0.1");

package/bin/pty-ws.js

@@ -69,6 +69,10 @@ function isLoopbackHost(hostHeader) {
 const UI_SESSION_COOKIE_NAME = "pidance_ui_session";
 
 function resolvePassword(env) {
+  // 启动时密码已搬进同进程 globalThis 缓存（bin/pidance-auth-gate.js 的
+  // primeAndScrubPassword），env 里不再有明文；两条来源同形，缺一不可。
+  const cached = globalThis.__piAuthPassword;
+  if (cached) return cached.value;
   const p =
     env && env.PIDANCE_PASSWORD && env.PIDANCE_PASSWORD.length > 0
       ? env.PIDANCE_PASSWORD
@@ -215,15 +219,22 @@ function ptyGuardHeaders(req) {
     secFetchUser: header(req, "sec-fetch-user"),
     authorization: header(req, "authorization"),
     cookie: header(req, "cookie"),
+    xForwardedFor: header(req, "x-forwarded-for"),
     method: "GET",
     url,
     pathname,
   };
 }
 
-function reject(socket, status, message) {
+function reject(socket, status, message, extraHeaders) {
+  const headers = {
+    Connection: "close",
+    "Content-Length": 0,
+    ...(extraHeaders || {}),
+  };
+  const lines = Object.keys(headers).map((name) => `${name}: ${headers[name]}\r\n`).join("");
   try {
-    socket.write(`HTTP/1.1 ${status} ${message}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+    socket.write(`HTTP/1.1 ${status} ${message}\r\n${lines}\r\n`);
   } catch {
     // ignore
   }
@@ -234,6 +245,99 @@ function reject(socket, status, message) {
   }
 }
 
+// ── 密码尝试限流（与 lib/auth-throttle.ts 同桶）──────────────────────────
+//
+// WebSocket 升级不经过 Next middleware，所以这里必须自己挡一次：否则 /api/pty
+// 就是一条不限速的密码预言机（Basic 可全速猜）。状态放在与 lib/auth-throttle.ts
+// 相同的 globalThis 键、相同结构上，两条入口在同进程里共用同一个桶。
+//
+// bin/ 是自包含发布物（见文件头注释，不依赖 lib/ 源码树），所以退避公式与常量
+// 在内联实现里保持语义一致；bin/pty-ws.test.mjs 有一条与 lib/auth-throttle.ts
+// 的 parity 断言，改一边不改另一边会红。
+
+const AUTH_THROTTLE_GLOBAL_KEY = "__piAuthThrottle";
+const AUTH_THROTTLE_BASE_DELAY_MS = 1000;
+const AUTH_THROTTLE_MAX_DELAY_MS = 60000;
+const AUTH_THROTTLE_RESET_AFTER_MS = 5 * 60 * 1000;
+const AUTH_THROTTLE_MAX_BUCKETS = 256;
+
+function authThrottleStore() {
+  if (!globalThis[AUTH_THROTTLE_GLOBAL_KEY]) globalThis[AUTH_THROTTLE_GLOBAL_KEY] = new Map();
+  return globalThis[AUTH_THROTTLE_GLOBAL_KEY];
+}
+
+function backoffDelayMs(failures) {
+  if (failures <= 0) return 0;
+  const exponent = Math.min(failures - 1, 31);
+  return Math.min(AUTH_THROTTLE_BASE_DELAY_MS * 2 ** exponent, AUTH_THROTTLE_MAX_DELAY_MS);
+}
+
+function expireIfStale(state, now) {
+  if (state.failures > 0 && now - state.lastFailureAt >= AUTH_THROTTLE_RESET_AFTER_MS) {
+    state.failures = 0;
+    state.lastFailureAt = 0;
+    state.blockedUntil = 0;
+  }
+}
+
+/** 该桶还需等多久（毫秒）；0 表示可以尝试。 */
+function getAuthRetryAfterMs(key, now = Date.now()) {
+  const state = authThrottleStore().get(key);
+  if (!state) return 0;
+  expireIfStale(state, now);
+  return Math.max(0, state.blockedUntil - now);
+}
+
+function pruneAuthThrottle(now) {
+  const map = authThrottleStore();
+  if (map.size <= AUTH_THROTTLE_MAX_BUCKETS) return;
+  for (const [key, state] of map) {
+    if (state.failures === 0 || now - state.lastFailureAt >= AUTH_THROTTLE_RESET_AFTER_MS) map.delete(key);
+  }
+  while (map.size > AUTH_THROTTLE_MAX_BUCKETS) {
+    const oldest = [...map.entries()].sort((a, b) => a[1].lastFailureAt - b[1].lastFailureAt)[0];
+    if (!oldest) break;
+    map.delete(oldest[0]);
+  }
+}
+
+/** 记一次失败并返回施加的退避（毫秒）。 */
+function recordAuthFailure(key, now = Date.now()) {
+  const map = authThrottleStore();
+  let state = map.get(key);
+  if (!state) {
+    state = { failures: 0, lastFailureAt: 0, blockedUntil: 0 };
+    map.set(key, state);
+  }
+  expireIfStale(state, now);
+  state.failures += 1;
+  state.lastFailureAt = now;
+  state.blockedUntil = now + backoffDelayMs(state.failures);
+  pruneAuthThrottle(now);
+  return backoffDelayMs(state.failures);
+}
+
+/**
+ * 限流分桶的身份，与 lib/request-guard.ts 的 `authIdentity` 同规则：
+ * 只在显式 `PIDANCE_TRUST_PROXY` 时信 `x-forwarded-for`，否则用对端地址；
+ * 都拿不到时退回固定全局桶（宁可误伤也不放行）。
+ */
+function authThrottleKey(socket, headers, env) {
+  const trustProxy = env.PIDANCE_TRUST_PROXY === "1" || env.PIDANCE_TRUST_PROXY === "true";
+  if (trustProxy) {
+    const first = (headers.xForwardedFor || "").split(",")[0];
+    const trimmed = first ? first.trim() : "";
+    if (trimmed) return trimmed.replace(/^::ffff:/, "");
+  }
+  const peer = typeof socket?.remoteAddress === "string" ? socket.remoteAddress.trim() : "";
+  if (peer) return peer.replace(/^::ffff:/, "");
+  return "unknown";
+}
+
+function retryAfterSeconds(retryAfterMs) {
+  return Math.max(1, Math.ceil(retryAfterMs / 1000));
+}
+
 async function handlePtyUpgrade(req, socket, head) {
   if (!tryLoadNodePty()) {
     reject(socket, 503, "PTY Unavailable");
@@ -251,10 +355,20 @@ async function handlePtyUpgrade(req, socket, head) {
     return;
   }
   if (passwordEnabled(process.env)) {
+    // 与 middleware / 登录表单共用同一个桶：封锁期内密码正确也不放行，
+    // 否则升级路径就是一条不限速的密码预言机。
+    const throttleKey = authThrottleKey(socket, guardHeaders, process.env);
+    const retryAfterMs = getAuthRetryAfterMs(throttleKey);
+    if (retryAfterMs > 0) {
+      reject(socket, 429, "Too Many Requests", { "Retry-After": retryAfterSeconds(retryAfterMs) });
+      return;
+    }
     if (!checkAuthenticated(guardHeaders, process.env)) {
+      recordAuthFailure(throttleKey);
       reject(socket, 401, "auth-required");
       return;
     }
+    // 成功不回退计数：Basic 每个请求都带，复位会让穿插猜测回到基准延迟。
   } else if (!isLoopbackHost(guardHeaders.host)) {
     // fail-closed 兜底：未设密码时仅放行回环请求（与 middleware 一致）。
     reject(socket, 401, "auth-required");
@@ -268,4 +382,13 @@ async function handlePtyUpgrade(req, socket, head) {
   completePtyUpgrade(req, socket, head, cwd);
 }
 
-module.exports = { handlePtyUpgrade, ptyGuardHeaders };
+module.exports = {
+  handlePtyUpgrade,
+  ptyGuardHeaders,
+  // 导出限流内联实现：bin/pty-ws.test.mjs 用它断言与 lib/auth-throttle.ts 的
+  // 退避公式一致、且两条入口共用同一个桶。
+  authThrottleKey,
+  backoffDelayMs,
+  getAuthRetryAfterMs,
+  recordAuthFailure,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@henlii/pidance",
-  "version": "0.2.36",
+  "version": "0.2.39",
   "description": "Pidance：面向 Pi coding agent 的开源 Web 客户端",
   "homepage": "https://github.com/henlii/pidance#readme",
   "repository": {
@@ -55,20 +55,22 @@
     "check": "npm run typecheck && npm run lint && npm run test",
     "release:audit": "node scripts/audit-release-package.mjs --pre",
     "release:audit:tgz": "node scripts/audit-release-package.mjs --tgz",
+    "release:desktop-check": "node scripts/check-desktop-lockfile.mjs",
     "package:candidate": "node scripts/make-candidate-package.mjs",
     "release:check": "npm run check && npm run build && npm run release:audit",
     "test:browser:sse": "node --test scripts/sse-recording-replay.test.mjs"
   },
   "dependencies": {
-    "@earendil-works/pi-coding-agent": "0.85.1",
+    "@earendil-works/pi-coding-agent": "0.87.0",
+    "@earendil-works/pi-tui": "0.87.0",
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/xterm": "^6.0.0",
     "jiti": "^2.7.0",
     "lucide-react": "^0.562.0",
-    "next": "16.2.11",
+    "next": "16.3.6",
     "react": "^19.2.4",
     "react-dom": "^19.2.4",
-    "undici": "8.5.0",
+    "undici": "8.11.0",
     "ws": "^8.21.3"
   },
   "devDependencies": {

package/.next/server/app/_global-error.segments/_global-error.segment.rsc

@@ -1,5 +0,0 @@
-1:"$Sreact.fragment"
-2:I[57121,[],""]
-3:I[74581,[],""]
-4:[]
-0:{"rsc":["$","$1","c",{"children":[null,["$","$L2",null,{"parallelRouterKey":"children","template":["$","$L3",null,{}]}]]}],"isPartial":false,"staleTime":300,"varyParams":"$W4","buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/_global-error.segments/_head.segment.rsc

@@ -1,5 +0,0 @@
-1:"$Sreact.fragment"
-2:I[90484,[],"ViewportBoundary"]
-3:I[90484,[],"MetadataBoundary"]
-4:"$Sreact.suspense"
-0:{"rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/_global-error.segments/_index.segment.rsc

@@ -1,5 +0,0 @@
-1:"$Sreact.fragment"
-2:I[57121,[],""]
-3:I[74581,[],""]
-4:[]
-0:{"rsc":["$","$1","c",{"children":[null,["$","$L2",null,{"parallelRouterKey":"children","template":["$","$L3",null,{}]}]]}],"isPartial":false,"staleTime":300,"varyParams":"$W4","buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/_not-found.segments/_head.segment.rsc

@@ -1,6 +0,0 @@
-1:"$Sreact.fragment"
-2:I[90484,[],"ViewportBoundary"]
-3:I[90484,[],"MetadataBoundary"]
-4:"$Sreact.suspense"
-5:I[86869,[],"IconMark"]
-0:{"rsc":["$","$1","h",{"children":[["$","meta",null,{"name":"robots","content":"noindex"}],["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"Pidance"}],["$","meta","1",{"name":"description","content":"Open-source web client for the Pi coding agent"}],["$","link","2",{"rel":"icon","href":"/brand/pidance-logo.png"}],["$","link","3",{"rel":"apple-touch-icon","href":"/brand/pidance-logo.png"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/_not-found.segments/_index.segment.rsc

@@ -1,7 +0,0 @@
-1:"$Sreact.fragment"
-2:I[99780,["9780","static/chunks/9780-190981a7d5f4799b.js","7177","static/chunks/app/layout-88764b4be2728d3f.js"],"I18nProvider"]
-3:I[57121,[],""]
-4:I[74581,[],""]
-:HL["/_next/static/css/88714c00e109ce28.css","style"]
-:HL["/_next/static/css/82b378f5d9cf6c9d.css","style"]
-0:{"rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/88714c00e109ce28.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/_next/static/css/82b378f5d9cf6c9d.css","precedence":"next"}]],["$","html",null,{"lang":"en","translate":"no","className":"__variable_66b8ca notranslate","suppressHydrationWarning":true,"children":[["$","head",null,{"children":[["$","meta",null,{"name":"google","content":"notranslate"}],["$","script",null,{"dangerouslySetInnerHTML":{"__html":"(function(){try{var r=document.documentElement,m=localStorage.getItem(\"pi-theme\"),s=localStorage.getItem(\"pi-theme-style\");if(m!==\"light\"&&m!==\"dark\"&&m!==\"system\")m=\"light\";if(s!==\"fusion\"&&s!==\"chamber\")s=\"chamber\";var d=m===\"dark\"||(m===\"system\"&&matchMedia(\"(prefers-color-scheme: dark)\").matches);r.classList.toggle(\"dark\",d);r.dataset.themeMode=m;r.dataset.themeStyle=s}catch(e){}})();"}}]]}],["$","body",null,{"translate":"no","className":"notranslate","style":{"height":"100dvh","display":"flex","flexDirection":"column"},"children":["$","$L2",null,{"children":["$","$L3",null,{"parallelRouterKey":"children","template":["$","$L4",null,{}]}]}]}]]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/_not-found.segments/_not-found.segment.rsc

@@ -1,5 +0,0 @@
-1:"$Sreact.fragment"
-2:I[57121,[],""]
-3:I[74581,[],""]
-4:[]
-0:{"rsc":["$","$1","c",{"children":[null,["$","$L2",null,{"parallelRouterKey":"children","template":["$","$L3",null,{}]}]]}],"isPartial":false,"staleTime":300,"varyParams":"$W4","buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/index.segments/_head.segment.rsc

@@ -1,6 +0,0 @@
-1:"$Sreact.fragment"
-2:I[90484,[],"ViewportBoundary"]
-3:I[90484,[],"MetadataBoundary"]
-4:"$Sreact.suspense"
-5:I[86869,[],"IconMark"]
-0:{"rsc":["$","$1","h",{"children":[null,["$","$L2",null,{"children":[["$","meta","0",{"charSet":"utf-8"}],["$","meta","1",{"name":"viewport","content":"width=device-width, initial-scale=1"}]]}],["$","div",null,{"hidden":true,"children":["$","$L3",null,{"children":["$","$4",null,{"name":"Next.Metadata","children":[["$","title","0",{"children":"Pidance"}],["$","meta","1",{"name":"description","content":"Open-source web client for the Pi coding agent"}],["$","link","2",{"rel":"icon","href":"/brand/pidance-logo.png"}],["$","link","3",{"rel":"apple-touch-icon","href":"/brand/pidance-logo.png"}],["$","$L5","4",{}]]}]}]}],["$","meta",null,{"name":"next-size-adjust","content":""}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"9m7dmaudtohXTam6OFJrW"}

package/.next/server/app/index.segments/_index.segment.rsc

@@ -1,7 +0,0 @@
-1:"$Sreact.fragment"
-2:I[99780,["9780","static/chunks/9780-190981a7d5f4799b.js","7177","static/chunks/app/layout-88764b4be2728d3f.js"],"I18nProvider"]
-3:I[57121,[],""]
-4:I[74581,[],""]
-:HL["/_next/static/css/88714c00e109ce28.css","style"]
-:HL["/_next/static/css/82b378f5d9cf6c9d.css","style"]
-0:{"rsc":["$","$1","c",{"children":[[["$","link","0",{"rel":"stylesheet","href":"/_next/static/css/88714c00e109ce28.css","precedence":"next"}],["$","link","1",{"rel":"stylesheet","href":"/_next/static/css/82b378f5d9cf6c9d.css","precedence":"next"}]],["$","html",null,{"lang":"en","translate":"no","className":"__variable_66b8ca notranslate","suppressHydrationWarning":true,"children":[["$","head",null,{"children":[["$","meta",null,{"name":"google","content":"notranslate"}],["$","script",null,{"dangerouslySetInnerHTML":{"__html":"(function(){try{var r=document.documentElement,m=localStorage.getItem(\"pi-theme\"),s=localStorage.getItem(\"pi-theme-style\");if(m!==\"light\"&&m!==\"dark\"&&m!==\"system\")m=\"light\";if(s!==\"fusion\"&&s!==\"chamber\")s=\"chamber\";var d=m===\"dark\"||(m===\"system\"&&matchMedia(\"(prefers-color-scheme: dark)\").matches);r.classList.toggle(\"dark\",d);r.dataset.themeMode=m;r.dataset.themeStyle=s}catch(e){}})();"}}]]}],["$","body",null,{"translate":"no","className":"notranslate","style":{"height":"100dvh","display":"flex","flexDirection":"column"},"children":["$","$L2",null,{"children":["$","$L3",null,{"parallelRouterKey":"children","template":["$","$L4",null,{}],"notFound":[[["$","title",null,{"children":"404: This page could not be found."}],["$","div",null,{"style":{"fontFamily":"system-ui,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif,\"Apple Color Emoji\",\"Segoe UI Emoji\"","height":"100vh","textAlign":"center","display":"flex","flexDirection":"column","alignItems":"center","justifyContent":"center"},"children":["$","div",null,{"children":[["$","style",null,{"dangerouslySetInnerHTML":{"__html":"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}"}}],["$","h1",null,{"className":"next-error-h1","style":{"display":"inline-block","margin":"0 20px 0 0","padding":"0 23px 0 0","fontSize":24,"fontWeight":500,"verticalAlign":"top","lineHeight":"49px"},"children":404}],["$","div",null,{"style":{"display":"inline-block"},"children":["$","h2",null,{"style":{"fontSize":14,"fontWeight":400,"lineHeight":"49px","margin":0},"children":"This page could not be found."}]}]]}]}]],[]]}]}]}]]}]]}],"isPartial":false,"staleTime":300,"varyParams":null,"buildId":"9m7dmaudtohXTam6OFJrW"}