@herbertgao/pi-extensions 2026.10.1 → 2026.10.3

package/node_modules/remote-pi/dist/pairing/qr.js

@@ -1,125 +0,0 @@
-import { randomBytes } from "node:crypto";
-import qrTerminal from "qrcode-terminal";
-/** Default ephemeral-token lifetime (also the QR rotation period). */
-export const TOKEN_TTL_MS = 60_000;
-/** Bounds for a caller-supplied pairing TTL (e.g. `/remote-pi pair --ttl <s>`). */
-export const PAIR_TTL_MIN_MS = 10_000;
-export const PAIR_TTL_MAX_MS = 600_000;
-/** Clamp an arbitrary ttl (ms) into the safe pairing range; NaN → default. */
-export function clampPairTtlMs(ttlMs) {
-    if (!Number.isFinite(ttlMs))
-        return TOKEN_TTL_MS;
-    return Math.min(PAIR_TTL_MAX_MS, Math.max(PAIR_TTL_MIN_MS, Math.floor(ttlMs)));
-}
-/** Encapsulates the single active QR token. One instance per Pi process. */
-export class QRSession {
-    active = null;
-    /** Generates a fresh 16-byte random token encoded as base64url. */
-    generateToken() {
-        return randomBytes(16).toString("base64url");
-    }
-    /**
-     * Issues a new active token, invalidating any previous one.
-     * Returns the token and its expiry timestamp.
-     */
-    issueToken(ttlMs = TOKEN_TTL_MS) {
-        const token = this.generateToken();
-        const expiresAt = Date.now() + ttlMs;
-        this.active = { token, expiresAt, consumed: false };
-        return { token, expiresAt };
-    }
-    /** Validates and atomically consumes a token. */
-    consumeToken(token) {
-        if (!this.active || this.active.token !== token)
-            return "unknown";
-        if (this.active.consumed)
-            return "consumed";
-        if (Date.now() > this.active.expiresAt)
-            return "expired";
-        this.active.consumed = true;
-        return "ok";
-    }
-    clear() {
-        this.active = null;
-    }
-}
-export const qrSession = new QRSession();
-// ── URI + display ─────────────────────────────────────────────────────────────
-export function buildQRUri(token, longtermEdPk, // Ed25519 — only peer ID after E2E rollback
-sessionName, 
-/**
- * Pi room id (12 chars, base64url) derived from cwd. App routes pair_request
- * to this room so the relay delivers it to the right Pi instance among N
- * paralelos com mesmo epk. Adicionado no fix do plano 17 (sem `rm` o app
- * cai em room=main e o relay drops com "dest not found").
- */
-roomId) {
-    // `r` (relay URL) removed in plano 14 — relay now comes from app config /
-    // pi-ext env|config|default chain. Keeps QR ~30-50 chars shorter.
-    // `n` (session name) is kept: the app uses it for the pre-pair_ok preview
-    // screen (showing the agent name immediately after scan, before the
-    // handshake completes). Dropping it briefly shrank the QR but the QR
-    // size no longer matters now that the copy-paste URI is rendered via
-    // `pi.sendMessage` into the chat panel (not the QR overflow area).
-    const epkB64 = Buffer.from(longtermEdPk).toString("base64url");
-    const params = new URLSearchParams({
-        t: token,
-        epk: epkB64,
-        n: sessionName.slice(0, 80),
-    });
-    if (roomId)
-        params.set("rm", roomId);
-    return `remotepi://pair?${params.toString()}`;
-}
-/**
- * Returns the QR ASCII as a string (pure Unicode block characters —
- * `█ ▀ ▄` and space, NO ANSI escapes — qrcode-terminal v0.12 small mode
- * is escape-free, see lib/main.js:48-53).
- *
- * The caller can either write the string to stderr (legacy path, breaks
- * the Pi TUI layout) or inject it via `pi.sendMessage` (renders inside
- * the chat panel as proper content).
- */
-export function renderQRAscii(uri) {
-    let out = "";
-    qrTerminal.generate(uri, { small: true }, (qrcode) => { out = qrcode; });
-    return out;
-}
-/**
- * Legacy stderr writer — kept for the standalone CLI mode
- * (`pi-extension/src/index.ts` bottom block, which runs outside a Pi TUI).
- * Inside the Pi TUI extension flow, use `renderQRAscii` + `pi.sendMessage`
- * instead — direct stderr writes from inside an extension break the TUI's
- * scrollable output widget (the QR overflows the panel and other writes
- * collide with the prompt area).
- */
-export function displayQR(uri) {
-    const qrcode = renderQRAscii(uri);
-    process.stderr.write(`\n📱 Scan to pair:\n\n${qrcode}\n`);
-}
-/**
- * Starts a rotating QR session: generates a new QR every 60s, printing it
- * to stdout. Returns a `stop()` function that cancels the rotation and clears
- * the active token.
- */
-export function startQRRotation(longtermEdPk, sessionName, roomId) {
-    let timer = null;
-    let stopped = false;
-    const rotate = () => {
-        if (stopped)
-            return;
-        const { token, expiresAt } = qrSession.issueToken();
-        const uri = buildQRUri(token, longtermEdPk, sessionName, roomId);
-        displayQR(uri);
-        console.log(`⏱  Renews at ${new Date(expiresAt).toLocaleTimeString()} — waiting for scan…`);
-        timer = setTimeout(rotate, TOKEN_TTL_MS);
-    };
-    rotate();
-    return () => {
-        stopped = true;
-        if (timer !== null)
-            clearTimeout(timer);
-        qrSession.clear();
-    };
-}
-//# sourceMappingURL=qr.js.map

package/node_modules/remote-pi/dist/pairing/qr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAQD,4EAA4E;AAC5E,MAAM,OAAO,SAAS;IACZ,MAAM,GAAuB,IAAI,CAAC;IAE1C,mEAAmE;IACnE,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAgB,YAAY;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,YAAY,CACV,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,iFAAiF;AAEjF,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,YAAwB,EAAE,4CAA4C;AACtE,WAAmB;AACnB;;;;;GAKG;AACH,MAAe;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,EAAE,KAAK;QACR,GAAG,EAAE,MAAM;QACX,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAwB,EACxB,WAAmB,EACnB,MAAe;IAEf,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAC/E,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,EAAE,CAAC;IAET,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/remote-pi/dist/pairing/storage.d.ts

@@ -1,120 +0,0 @@
-import { type Ed25519Keypair } from "./crypto.js";
-/** Raised when the keyring is unreadable on a platform where it's a core OS
- *  service (macOS Keychain, Windows Credential Manager) AND no prior file
- *  identity exists. We refuse to generate a NEW identity here because that
- *  would break existing pairing — the caller surfaces this so the user can
- *  unlock the keychain and retry instead of silently re-pairing. */
-export declare class KeyringUnavailableError extends Error {
-    constructor(cause: unknown);
-}
-/** Raised when no identity can be resolved (keyring unreadable, no identity
- *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
- *  here would make SelfRevoke wipe those pairings — see issues #95 / #69. */
-export declare class PairedIdentityMissingError extends Error {
-    constructor(pairedCount: number, cause: unknown);
-}
-/**
- * Minimal backend interface for credential reads/writes. Swappable so
- * tests can inject a controlled in-memory store without touching the OS
- * keyring (which is shared with the developer's own credentials).
- *
- * Errors thrown by `read`/`write`/`delete` signal "backend unavailable on
- * this platform" — callers fall back to the file store on first failure.
- * Returning `undefined` from `read` means "no such entry" (a normal,
- * non-error condition).
- */
-export interface KeyStoreBackend {
-    read(service: string, account: string): Promise<string | undefined>;
-    write(service: string, account: string, value: string): Promise<void>;
-    delete(service: string, account: string): Promise<boolean>;
-}
-/** Test-only: force (or clear with `null`) a memoized binding-load failure, so
- *  the Bun/no-native-binding branch is reachable without a Bun host. */
-export declare function _setNativeBindingErrorForTest(err: unknown): void;
-/** Test-only: swap (or clear with `null`) the keyring backend. */
-export declare function _setKeyStoreBackendForTest(backend: KeyStoreBackend | null): void;
-/** Test-only: force `_keyringExpectedAvailable()` (so a darwin test host can
- *  exercise the Linux/headless branch and vice-versa). `null` restores the
- *  real platform check. */
-export declare function _setKeyringExpectedForTest(value: boolean | null): void;
-/** Test-only: shrink retry attempts/delay so the persistent-failure path is
- *  fast. `null`/omitted restores defaults. */
-export declare function _setKeyringRetryForTest(attempts: number | null, delayMs?: number): void;
-/**
- * Returns the Pi-secret Ed25519 keypair, generating + persisting one on
- * first call. Resolution order:
- *   1. Existing file `~/.pi/remote/identity.json`, if present — it WINS over
- *      the keyring. A file identity is only ever written by the headless/
- *      degraded fallback (step 4) or an explicit `REMOTE_PI_ALLOW_FILE_IDENTITY`
- *      opt-in, so its mere presence means this machine established its identity
- *      as a file and the mobile device paired against THAT pubkey. If the
- *      platform keyring later becomes readable (D-Bus/libsecret installed, a
- *      desktop session, or a stale/other entry from another install), reading
- *      it first would mask the file identity — returning a DIFFERENT key, or
- *      (when the keyring is empty) minting a fresh one and persisting it —
- *      silently breaking the existing pairing. So when both exist, file wins.
- *   2. New keyring service `dev.remotepi.pi` (read retried — a transiently
- *      locked Keychain throws; we don't treat that as "no key")
- *   3. Old keyring service `dev.remotepi.mac` (migrate → step 2, delete old)
- *   4. Generate a fresh keypair, BUT only when it's safe to: either both
- *      keyring reads succeeded and returned nothing (genuine first run), or
- *      the keyring is genuinely unavailable on a platform without a core one
- *      (headless Linux → a file identity is minted here). On macOS/Windows a
- *      persistent read failure with no file identity throws
- *      `KeyringUnavailableError` instead of minting a new key — generating
- *      there silently breaks existing pairing (the "lost pairing after idle"
- *      bug). `REMOTE_PI_ALLOW_FILE_IDENTITY=1` opts back into a file identity
- *      for headless macOS/Windows hosts.
- *
- * Idempotent: subsequent calls return the same identity. The migration
- * runs at most once per machine (the old entry is deleted after copy).
- */
-export declare function getOrCreateEd25519Keypair(): Promise<Ed25519Keypair>;
-export interface PeerRecord {
-    name: string;
-    remote_epk: string;
-    paired_at: string;
-}
-export declare function listPeers(): Promise<PeerRecord[]>;
-declare const _ownerStorageTokenBrand: unique symbol;
-/** Opaque, process-local provenance for one canonical Owner storage slot. */
-export type OwnerStorageToken = {
-    readonly [_ownerStorageTokenBrand]: true;
-};
-export interface OwnerStorageSnapshotRecord {
-    readonly rawOwnerPubkey: unknown;
-    readonly token: OwnerStorageToken;
-}
-export type ConditionalPeerRemoval = {
-    readonly outcome: "removed";
-    readonly nextToken: OwnerStorageToken;
-} | {
-    readonly outcome: "stale" | "not_found" | "no_authority";
-};
-export declare function addPeer(record: PeerRecord): Promise<void>;
-/**
- * Returns the set of distinct `remote_epk` values in peers.json.
- *
- * In the current pairing model (plan/23 + plan/24), each `remote_epk` is the
- * Owner's Ed25519 pubkey — and we treat each as a distinct Owner the Pi has
- * been paired with. Used by the mesh self-revoke poller (plan/24 Wave 3) to
- * know which Owners' mesh blobs to fetch.
- */
-export declare function listOwnerPubkeys(): Promise<unknown[]>;
-/**
- * Atomically snapshots raw Owner handles and their canonical-slot provenance.
- * The token is deliberately process-local and opaque to callers.
- */
-export declare function snapshotOwnerPubkeys(): Promise<readonly OwnerStorageSnapshotRecord[]>;
-/**
- * Removes one exact raw handle only when its snapshot provenance still owns
- * the target canonical Owner slot. The final authority/token checks and sync
- * write share the existing serialized mutation lane.
- */
-export declare function conditionalRemovePeer(remoteEpk: string, expectedToken: OwnerStorageToken, canCommit?: () => boolean): Promise<ConditionalPeerRemoval>;
-export declare function removePeer(remoteEpk: string, canCommit?: () => boolean): Promise<boolean>;
-/** Test-only: expose the identity-file path so tests can clean it. */
-export declare const _IDENTITY_FILE_FOR_TEST: string;
-/** Test-only: expose unlink for cleanup. */
-export declare const _unlinkIdentityFileForTest: () => Promise<void>;
-export {};