@herbertgao/pi-extensions 2026.8.2 → 2026.8.3

package/node_modules/remote-pi/dist/pairing/qr.js

@@ -0,0 +1,125 @@
+import { randomBytes } from "node:crypto";
+import qrTerminal from "qrcode-terminal";
+/** Default ephemeral-token lifetime (also the QR rotation period). */
+export const TOKEN_TTL_MS = 60_000;
+/** Bounds for a caller-supplied pairing TTL (e.g. `/remote-pi pair --ttl <s>`). */
+export const PAIR_TTL_MIN_MS = 10_000;
+export const PAIR_TTL_MAX_MS = 600_000;
+/** Clamp an arbitrary ttl (ms) into the safe pairing range; NaN → default. */
+export function clampPairTtlMs(ttlMs) {
+    if (!Number.isFinite(ttlMs))
+        return TOKEN_TTL_MS;
+    return Math.min(PAIR_TTL_MAX_MS, Math.max(PAIR_TTL_MIN_MS, Math.floor(ttlMs)));
+}
+/** Encapsulates the single active QR token. One instance per Pi process. */
+export class QRSession {
+    active = null;
+    /** Generates a fresh 16-byte random token encoded as base64url. */
+    generateToken() {
+        return randomBytes(16).toString("base64url");
+    }
+    /**
+     * Issues a new active token, invalidating any previous one.
+     * Returns the token and its expiry timestamp.
+     */
+    issueToken(ttlMs = TOKEN_TTL_MS) {
+        const token = this.generateToken();
+        const expiresAt = Date.now() + ttlMs;
+        this.active = { token, expiresAt, consumed: false };
+        return { token, expiresAt };
+    }
+    /** Validates and atomically consumes a token. */
+    consumeToken(token) {
+        if (!this.active || this.active.token !== token)
+            return "unknown";
+        if (this.active.consumed)
+            return "consumed";
+        if (Date.now() > this.active.expiresAt)
+            return "expired";
+        this.active.consumed = true;
+        return "ok";
+    }
+    clear() {
+        this.active = null;
+    }
+}
+export const qrSession = new QRSession();
+// ── URI + display ─────────────────────────────────────────────────────────────
+export function buildQRUri(token, longtermEdPk, // Ed25519 — only peer ID after E2E rollback
+sessionName, 
+/**
+ * Pi room id (12 chars, base64url) derived from cwd. App routes pair_request
+ * to this room so the relay delivers it to the right Pi instance among N
+ * paralelos com mesmo epk. Adicionado no fix do plano 17 (sem `rm` o app
+ * cai em room=main e o relay drops com "dest not found").
+ */
+roomId) {
+    // `r` (relay URL) removed in plano 14 — relay now comes from app config /
+    // pi-ext env|config|default chain. Keeps QR ~30-50 chars shorter.
+    // `n` (session name) is kept: the app uses it for the pre-pair_ok preview
+    // screen (showing the agent name immediately after scan, before the
+    // handshake completes). Dropping it briefly shrank the QR but the QR
+    // size no longer matters now that the copy-paste URI is rendered via
+    // `pi.sendMessage` into the chat panel (not the QR overflow area).
+    const epkB64 = Buffer.from(longtermEdPk).toString("base64url");
+    const params = new URLSearchParams({
+        t: token,
+        epk: epkB64,
+        n: sessionName.slice(0, 80),
+    });
+    if (roomId)
+        params.set("rm", roomId);
+    return `remotepi://pair?${params.toString()}`;
+}
+/**
+ * Returns the QR ASCII as a string (pure Unicode block characters —
+ * `█ ▀ ▄` and space, NO ANSI escapes — qrcode-terminal v0.12 small mode
+ * is escape-free, see lib/main.js:48-53).
+ *
+ * The caller can either write the string to stderr (legacy path, breaks
+ * the Pi TUI layout) or inject it via `pi.sendMessage` (renders inside
+ * the chat panel as proper content).
+ */
+export function renderQRAscii(uri) {
+    let out = "";
+    qrTerminal.generate(uri, { small: true }, (qrcode) => { out = qrcode; });
+    return out;
+}
+/**
+ * Legacy stderr writer — kept for the standalone CLI mode
+ * (`pi-extension/src/index.ts` bottom block, which runs outside a Pi TUI).
+ * Inside the Pi TUI extension flow, use `renderQRAscii` + `pi.sendMessage`
+ * instead — direct stderr writes from inside an extension break the TUI's
+ * scrollable output widget (the QR overflows the panel and other writes
+ * collide with the prompt area).
+ */
+export function displayQR(uri) {
+    const qrcode = renderQRAscii(uri);
+    process.stderr.write(`\n📱 Scan to pair:\n\n${qrcode}\n`);
+}
+/**
+ * Starts a rotating QR session: generates a new QR every 60s, printing it
+ * to stdout. Returns a `stop()` function that cancels the rotation and clears
+ * the active token.
+ */
+export function startQRRotation(longtermEdPk, sessionName, roomId) {
+    let timer = null;
+    let stopped = false;
+    const rotate = () => {
+        if (stopped)
+            return;
+        const { token, expiresAt } = qrSession.issueToken();
+        const uri = buildQRUri(token, longtermEdPk, sessionName, roomId);
+        displayQR(uri);
+        console.log(`⏱  Renews at ${new Date(expiresAt).toLocaleTimeString()} — waiting for scan…`);
+        timer = setTimeout(rotate, TOKEN_TTL_MS);
+    };
+    rotate();
+    return () => {
+        stopped = true;
+        if (timer !== null)
+            clearTimeout(timer);
+        qrSession.clear();
+    };
+}
+//# sourceMappingURL=qr.js.map

package/node_modules/remote-pi/dist/pairing/qr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAQD,4EAA4E;AAC5E,MAAM,OAAO,SAAS;IACZ,MAAM,GAAuB,IAAI,CAAC;IAE1C,mEAAmE;IACnE,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAgB,YAAY;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,YAAY,CACV,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,iFAAiF;AAEjF,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,YAAwB,EAAE,4CAA4C;AACtE,WAAmB;AACnB;;;;;GAKG;AACH,MAAe;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,EAAE,KAAK;QACR,GAAG,EAAE,MAAM;QACX,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAwB,EACxB,WAAmB,EACnB,MAAe;IAEf,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAC/E,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,EAAE,CAAC;IAET,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/node_modules/remote-pi/dist/pairing/storage.d.ts

@@ -0,0 +1,120 @@
+import { type Ed25519Keypair } from "./crypto.js";
+/** Raised when the keyring is unreadable on a platform where it's a core OS
+ *  service (macOS Keychain, Windows Credential Manager) AND no prior file
+ *  identity exists. We refuse to generate a NEW identity here because that
+ *  would break existing pairing — the caller surfaces this so the user can
+ *  unlock the keychain and retry instead of silently re-pairing. */
+export declare class KeyringUnavailableError extends Error {
+    constructor(cause: unknown);
+}
+/** Raised when no identity can be resolved (keyring unreadable, no identity
+ *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
+ *  here would make SelfRevoke wipe those pairings — see issues #95 / #69. */
+export declare class PairedIdentityMissingError extends Error {
+    constructor(pairedCount: number, cause: unknown);
+}
+/**
+ * Minimal backend interface for credential reads/writes. Swappable so
+ * tests can inject a controlled in-memory store without touching the OS
+ * keyring (which is shared with the developer's own credentials).
+ *
+ * Errors thrown by `read`/`write`/`delete` signal "backend unavailable on
+ * this platform" — callers fall back to the file store on first failure.
+ * Returning `undefined` from `read` means "no such entry" (a normal,
+ * non-error condition).
+ */
+export interface KeyStoreBackend {
+    read(service: string, account: string): Promise<string | undefined>;
+    write(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}
+/** Test-only: force (or clear with `null`) a memoized binding-load failure, so
+ *  the Bun/no-native-binding branch is reachable without a Bun host. */
+export declare function _setNativeBindingErrorForTest(err: unknown): void;
+/** Test-only: swap (or clear with `null`) the keyring backend. */
+export declare function _setKeyStoreBackendForTest(backend: KeyStoreBackend | null): void;
+/** Test-only: force `_keyringExpectedAvailable()` (so a darwin test host can
+ *  exercise the Linux/headless branch and vice-versa). `null` restores the
+ *  real platform check. */
+export declare function _setKeyringExpectedForTest(value: boolean | null): void;
+/** Test-only: shrink retry attempts/delay so the persistent-failure path is
+ *  fast. `null`/omitted restores defaults. */
+export declare function _setKeyringRetryForTest(attempts: number | null, delayMs?: number): void;
+/**
+ * Returns the Pi-secret Ed25519 keypair, generating + persisting one on
+ * first call. Resolution order:
+ *   1. Existing file `~/.pi/remote/identity.json`, if present — it WINS over
+ *      the keyring. A file identity is only ever written by the headless/
+ *      degraded fallback (step 4) or an explicit `REMOTE_PI_ALLOW_FILE_IDENTITY`
+ *      opt-in, so its mere presence means this machine established its identity
+ *      as a file and the mobile device paired against THAT pubkey. If the
+ *      platform keyring later becomes readable (D-Bus/libsecret installed, a
+ *      desktop session, or a stale/other entry from another install), reading
+ *      it first would mask the file identity — returning a DIFFERENT key, or
+ *      (when the keyring is empty) minting a fresh one and persisting it —
+ *      silently breaking the existing pairing. So when both exist, file wins.
+ *   2. New keyring service `dev.remotepi.pi` (read retried — a transiently
+ *      locked Keychain throws; we don't treat that as "no key")
+ *   3. Old keyring service `dev.remotepi.mac` (migrate → step 2, delete old)
+ *   4. Generate a fresh keypair, BUT only when it's safe to: either both
+ *      keyring reads succeeded and returned nothing (genuine first run), or
+ *      the keyring is genuinely unavailable on a platform without a core one
+ *      (headless Linux → a file identity is minted here). On macOS/Windows a
+ *      persistent read failure with no file identity throws
+ *      `KeyringUnavailableError` instead of minting a new key — generating
+ *      there silently breaks existing pairing (the "lost pairing after idle"
+ *      bug). `REMOTE_PI_ALLOW_FILE_IDENTITY=1` opts back into a file identity
+ *      for headless macOS/Windows hosts.
+ *
+ * Idempotent: subsequent calls return the same identity. The migration
+ * runs at most once per machine (the old entry is deleted after copy).
+ */
+export declare function getOrCreateEd25519Keypair(): Promise<Ed25519Keypair>;
+export interface PeerRecord {
+    name: string;
+    remote_epk: string;
+    paired_at: string;
+}
+export declare function listPeers(): Promise<PeerRecord[]>;
+declare const _ownerStorageTokenBrand: unique symbol;
+/** Opaque, process-local provenance for one canonical Owner storage slot. */
+export type OwnerStorageToken = {
+    readonly [_ownerStorageTokenBrand]: true;
+};
+export interface OwnerStorageSnapshotRecord {
+    readonly rawOwnerPubkey: unknown;
+    readonly token: OwnerStorageToken;
+}
+export type ConditionalPeerRemoval = {
+    readonly outcome: "removed";
+    readonly nextToken: OwnerStorageToken;
+} | {
+    readonly outcome: "stale" | "not_found" | "no_authority";
+};
+export declare function addPeer(record: PeerRecord): Promise<void>;
+/**
+ * Returns the set of distinct `remote_epk` values in peers.json.
+ *
+ * In the current pairing model (plan/23 + plan/24), each `remote_epk` is the
+ * Owner's Ed25519 pubkey — and we treat each as a distinct Owner the Pi has
+ * been paired with. Used by the mesh self-revoke poller (plan/24 Wave 3) to
+ * know which Owners' mesh blobs to fetch.
+ */
+export declare function listOwnerPubkeys(): Promise<unknown[]>;
+/**
+ * Atomically snapshots raw Owner handles and their canonical-slot provenance.
+ * The token is deliberately process-local and opaque to callers.
+ */
+export declare function snapshotOwnerPubkeys(): Promise<readonly OwnerStorageSnapshotRecord[]>;
+/**
+ * Removes one exact raw handle only when its snapshot provenance still owns
+ * the target canonical Owner slot. The final authority/token checks and sync
+ * write share the existing serialized mutation lane.
+ */
+export declare function conditionalRemovePeer(remoteEpk: string, expectedToken: OwnerStorageToken, canCommit?: () => boolean): Promise<ConditionalPeerRemoval>;
+export declare function removePeer(remoteEpk: string, canCommit?: () => boolean): Promise<boolean>;
+/** Test-only: expose the identity-file path so tests can clean it. */
+export declare const _IDENTITY_FILE_FOR_TEST: string;
+/** Test-only: expose unlink for cleanup. */
+export declare const _unlinkIdentityFileForTest: () => Promise<void>;
+export {};