@jmfederico/pi-web 1.202606.4 → 1.202606.6

package/dist/server/workspaces/pathAccessPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pathAccessPolicy.js","sourceRoot":"","sources":["../../../src/server/workspaces/pathAccessPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAgCxD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,iBAAyB,EAAE,UAA6C,EAAE,UAAmC,EAAE;IAC1J,OAAO;QACL,aAAa,EAAE,MAAM,kBAAkB,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC5E,YAAY,EAAE,MAAM,mBAAmB,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,OAAO,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,QAAgB,EAAE,aAAiC,EAAE,UAAkC,EAAE,UAAmC,EAAE;IACnL,MAAM,OAAO,GAAG,aAAa,IAAI,EAAE,CAAC;IACpC,MAAM,aAAa,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,UAAU,EAAE,YAAY,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1H,OAAO,uBAAuB,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,MAAwB,EAAE,aAAiC,EAAE,UAAmC,EAAE;IAC9I,MAAM,OAAO,GAAG,aAAa,IAAI,EAAE,CAAC;IACpC,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAEtF,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IACvF,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACrE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACvH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,YAA+B,EAAE,OAAgC;IAClG,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,OAAO,EAAE,kDAAkD,MAAM,EAAE,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;YAAE,SAAS;QAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAwB,EAAE,OAAe,EAAE,OAAgC;IAC7G,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAExF,MAAM,WAAW,GAAG,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,yBAAyB,OAAO,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACrG,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACzE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY,EAAE,OAAgC,EAAE,eAAuB;IACpG,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC;IAC1C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IAChG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,cAAc,GAAG,qBAAqB;IACvF,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5F,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc,EAAE,OAAe;IACjE,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC"}

package/dist/server/workspaces/pathSafety.js

@@ -1,17 +1,5 @@
 import { realpath } from "node:fs/promises";
 import { isAbsolute, join, relative, sep } from "node:path";
-export async function resolveInsideWorkspace(rootPath, relativePath) {
-    const requested = normalizeRelativePath(relativePath);
-    const root = await realpath(rootPath);
-    const joined = join(root, requested);
-    const target = await realpath(joined).catch((error) => {
-        if (isNodeErrorWithCode(error, "ENOENT"))
-            throw new Error("Path does not exist");
-        throw error;
-    });
-    ensureInside(root, target);
-    return { root, target, relativePath: requested };
-}
 export async function resolveParentInsideWorkspace(rootPath, relativePath) {
     const requested = normalizeRelativePath(relativePath);
     const root = await realpath(rootPath);
@@ -30,9 +18,6 @@ export function normalizeRelativePath(input) {
         throw new Error("Path traversal is not allowed");
     return parts.join("/");
 }
-function isNodeErrorWithCode(error, code) {
-    return typeof error === "object" && error !== null && "code" in error && error.code === code;
-}
 function ensureInside(root, target) {
     const rel = relative(root, target);
     if (rel === "")

package/dist/server/workspaces/pathSafety.js.map

@@ -1 +1 @@
-{"version":3,"file":"pathSafety.js","sourceRoot":"","sources":["../../../src/server/workspaces/pathSafety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,YAAgC;IAC7F,MAAM,SAAS,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC7D,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACjF,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IACvF,MAAM,SAAS,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC/F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvF,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"pathSafety.js","sourceRoot":"","sources":["../../../src/server/workspaces/pathSafety.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE5D,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,QAAgB,EAAE,YAAoB;IACvF,MAAM,SAAS,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAyB;IAC7D,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;IAC1B,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO;IACvB,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACvF,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC9F,CAAC"}

package/dist/server/workspaces/projectPiWebConfig.js

@@ -0,0 +1,56 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parsePathAccessConfig } from "../../config.js";
+export const PROJECT_PI_WEB_CONFIG_PATH = ".pi-web/config.json";
+export async function loadProjectPiWebConfig(projectPath) {
+    const path = join(projectPath, PROJECT_PI_WEB_CONFIG_PATH);
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        if (!isRecord(parsed))
+            throw new Error(`PI WEB project config must be a JSON object: ${path}`);
+        return { path, exists: true, config: parseProjectPiWebConfig(parsed, path) };
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "ENOENT"))
+            return { path, exists: false, config: {} };
+        throw error;
+    }
+}
+export async function loadEffectiveProjectPathAccess(projectPath, globalConfig) {
+    const projectConfig = await loadProjectPiWebConfig(projectPath);
+    return mergePathAccessConfigs(globalConfig.pathAccess, projectConfig.config.pathAccess);
+}
+export function mergePathAccessConfigs(...configs) {
+    const allowedPaths = dedupe(configs.flatMap((config) => config?.allowedPaths ?? []));
+    return allowedPaths.length === 0 ? undefined : { allowedPaths };
+}
+function parseProjectPiWebConfig(value, path) {
+    const version = value["version"];
+    return {
+        ...(version !== undefined ? { version: parseProjectConfigVersion(version, path) } : {}),
+        ...(value["pathAccess"] !== undefined ? { pathAccess: parsePathAccessConfig(value["pathAccess"], path) } : {}),
+    };
+}
+function parseProjectConfigVersion(value, path) {
+    if (value !== 1)
+        throw new Error(`PI WEB project config version must be 1: ${path}`);
+    return 1;
+}
+function dedupe(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        if (seen.has(value))
+            continue;
+        seen.add(value);
+        result.push(value);
+    }
+    return result;
+}
+function isNodeErrorWithCode(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=projectPiWebConfig.js.map

package/dist/server/workspaces/projectPiWebConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectPiWebConfig.js","sourceRoot":"","sources":["../../../src/server/workspaces/projectPiWebConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,qBAAqB,EAAoB,MAAM,iBAAiB,CAAC;AAG1E,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAahE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,WAAmB;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,0BAA0B,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,IAAI,EAAE,CAAC,CAAC;QAC/F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACrF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,WAAmB,EAAE,YAAyB;IACjG,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAChE,OAAO,sBAAsB,CAAC,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAG,OAA8C;IACtF,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,OAAO,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,uBAAuB,CAAC,KAA8B,EAAE,IAAY;IAC3E,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO;QACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/G,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,IAAY;IAC7D,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;IACrF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,MAAyB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC"}

package/dist/shared/apiTypes.d.ts

@@ -4,6 +4,7 @@ export declare const PI_WEB_CAPABILITIES: {
     readonly sessionsDeleteArchived: "sessions.deleteArchived";
     readonly sessionsReload: "sessions.reload";
     readonly promptAttachments: "prompt.attachments";
+    readonly workspaceFileSuggestions: "workspace.fileSuggestions";
 };
 export type PiWebCapability = typeof PI_WEB_CAPABILITIES[keyof typeof PI_WEB_CAPABILITIES];
 export interface Machine {
@@ -43,16 +44,28 @@ export interface PiWebPluginConfig {
     settings?: PiWebPluginSettings;
     [key: string]: unknown;
 }
+export interface PiWebPathAccessConfig {
+    allowedPaths?: string[];
+}
 export interface PiWebConfigValues {
     host?: string;
     port?: number;
     allowedHosts?: string[] | true;
     shortcuts?: PiWebShortcutConfig;
     plugins?: PiWebPluginConfigMap;
+    /** External filesystem roots PI WEB may expose outside a workspace. */
+    pathAccess?: PiWebPathAccessConfig;
     /** Maximum accepted HTTP request body size in bytes (uploads/attachments). */
     maxUploadBytes?: number;
     /** When true, LLMs can start new sessions via the spawn_session tool. */
     spawnSessions?: boolean;
+    /**
+     * Beta: when true, LLMs can start tracked child sessions via the
+     * spawn_subsession / list_subsessions / check_subsession / read_subsession
+     * tools. Off by default
+     * while the capability stabilizes. Requires spawnSessions to be enabled.
+     */
+    subsessions?: boolean;
 }
 export type PiWebPluginScope = "bundled" | "local" | "user" | "project";
 export interface PiWebPluginInfo {
@@ -71,6 +84,7 @@ export interface PiWebConfigEnvOverrides {
     port: boolean;
     allowedHosts: boolean;
     spawnSessions: boolean;
+    subsessions: boolean;
 }
 export interface PiWebConfigResponse {
     path: string;

package/dist/shared/apiTypes.js

@@ -2,5 +2,6 @@ export const PI_WEB_CAPABILITIES = {
     sessionsDeleteArchived: "sessions.deleteArchived",
     sessionsReload: "sessions.reload",
     promptAttachments: "prompt.attachments",
+    workspaceFileSuggestions: "workspace.fileSuggestions",
 };
 //# sourceMappingURL=apiTypes.js.map

package/dist/shared/apiTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiTypes.js","sourceRoot":"","sources":["../../src/shared/apiTypes.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,sBAAsB,EAAE,yBAAyB;IACjD,cAAc,EAAE,iBAAiB;IACjC,iBAAiB,EAAE,oBAAoB;CAC/B,CAAC"}
+{"version":3,"file":"apiTypes.js","sourceRoot":"","sources":["../../src/shared/apiTypes.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,sBAAsB,EAAE,yBAAyB;IACjD,cAAc,EAAE,iBAAiB;IACjC,iBAAiB,EAAE,oBAAoB;IACvC,wBAAwB,EAAE,2BAA2B;CAC7C,CAAC"}

package/dist/shared/capabilities.js

@@ -2,12 +2,13 @@ import { PI_WEB_CAPABILITIES } from "./apiTypes.js";
 export { PI_WEB_CAPABILITIES };
 export const KNOWN_PI_WEB_CAPABILITIES = Object.values(PI_WEB_CAPABILITIES);
 const knownPiWebCapabilities = new Set(KNOWN_PI_WEB_CAPABILITIES);
-export const WEB_RUNTIME_CAPABILITIES = [PI_WEB_CAPABILITIES.sessionsDeleteArchived, PI_WEB_CAPABILITIES.sessionsReload, PI_WEB_CAPABILITIES.promptAttachments];
+export const WEB_RUNTIME_CAPABILITIES = [PI_WEB_CAPABILITIES.sessionsDeleteArchived, PI_WEB_CAPABILITIES.sessionsReload, PI_WEB_CAPABILITIES.promptAttachments, PI_WEB_CAPABILITIES.workspaceFileSuggestions];
 export const SESSIOND_RUNTIME_CAPABILITIES = [PI_WEB_CAPABILITIES.sessionsDeleteArchived, PI_WEB_CAPABILITIES.sessionsReload, PI_WEB_CAPABILITIES.promptAttachments];
 const EFFECTIVE_CAPABILITY_REQUIREMENTS = {
     [PI_WEB_CAPABILITIES.sessionsDeleteArchived]: ["web", "sessiond"],
     [PI_WEB_CAPABILITIES.sessionsReload]: ["web", "sessiond"],
     [PI_WEB_CAPABILITIES.promptAttachments]: ["web", "sessiond"],
+    [PI_WEB_CAPABILITIES.workspaceFileSuggestions]: ["web"],
 };
 export function isPiWebCapability(value) {
     return typeof value === "string" && knownPiWebCapabilities.has(value);

package/dist/shared/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/shared/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAgF,MAAM,eAAe,CAAC;AAElI,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAC5E,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,cAAc,EAAE,mBAAmB,CAAC,iBAAiB,CAA+C,CAAC;AAC9M,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,cAAc,EAAE,mBAAmB,CAAC,iBAAiB,CAA+C,CAAC;AAEnN,MAAM,iCAAiC,GAAG;IACxC,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IACjE,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IACzD,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;CACgB,CAAC;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiE,EAAE,UAA2B;IACpI,OAAO,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA6G;IACtJ,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACrD,MAAM,kBAAkB,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;QACzE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/shared/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAgF,MAAM,eAAe,CAAC;AAElI,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAC5E,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,yBAAyB,CAAC,CAAC;AAEvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,cAAc,EAAE,mBAAmB,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,wBAAwB,CAA+C,CAAC;AAC5P,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,mBAAmB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,cAAc,EAAE,mBAAmB,CAAC,iBAAiB,CAA+C,CAAC;AAEnN,MAAM,iCAAiC,GAAG;IACxC,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IACjE,CAAC,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IACzD,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC;IAC5D,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,EAAE,CAAC,KAAK,CAAC;CACqB,CAAC;AAE/E,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiE,EAAE,UAA2B;IACpI,OAAO,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA6G;IACtJ,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACrD,MAAM,kBAAkB,GAAG,iCAAiC,CAAC,UAAU,CAAC,CAAC;QACzE,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,OAAO,EAAE,SAAS,KAAK,IAAI,IAAI,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/shared/federatedRoutes.js

@@ -9,6 +9,7 @@ export const FEDERATED_HTTP_ROUTES = [
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/tree" },
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/file" },
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/file/preview" },
+    { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/files" },
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/git/status" },
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/git/diff" },
     { method: "GET", path: "/projects/:projectId/workspaces/:workspaceId/terminals" },
@@ -44,6 +45,7 @@ export const FEDERATED_HTTP_ROUTES = [
     { method: "POST", path: "/sessions/:sessionId/archive-tree" },
     { method: "POST", path: "/sessions/:sessionId/restore" },
     { method: "DELETE", path: "/sessions/:sessionId" },
+    { method: "POST", path: "/sessions/:sessionId/reload" },
     { method: "POST", path: "/sessions/:sessionId/detach-parent" },
     { method: "GET", path: "/auth/providers" },
     { method: "POST", path: "/auth/api-key" },

package/dist/shared/federatedRoutes.js.map

@@ -1 +1 @@
-{"version":3,"file":"federatedRoutes.js","sourceRoot":"","sources":["../../src/shared/federatedRoutes.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACzC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE;IAC1D,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8CAA8C,EAAE;IAC1E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mDAAmD,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mDAAmD,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2DAA2D,EAAE;IACpF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yDAAyD,EAAE;IAClF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uDAAuD,EAAE;IAChF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;IACjF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wDAAwD,EAAE;IAClF,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wDAAwD,EAAE;IACpF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6EAA6E,EAAE;IACvG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oEAAoE,EAAE;IAChG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oEAAoE,EAAE;IAC9F,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACjD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAChE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACtD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE;IAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC5D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC7D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE;IACjE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACrD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC7D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,EAAE;IAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE;IACzC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACF,CAAC;AAEvD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,SAAS;IACT,kBAAkB;IAClB,6BAA6B;IAC7B,2EAA2E;CACvC,CAAC"}
+{"version":3,"file":"federatedRoutes.js","sourceRoot":"","sources":["../../src/shared/federatedRoutes.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE;IACzC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAC/C,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE;IAC1D,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8CAA8C,EAAE;IAC1E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mDAAmD,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mDAAmD,EAAE;IAC5E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2DAA2D,EAAE;IACpF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oDAAoD,EAAE;IAC7E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yDAAyD,EAAE;IAClF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uDAAuD,EAAE;IAChF,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wDAAwD,EAAE;IACjF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wDAAwD,EAAE;IAClF,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wDAAwD,EAAE;IACpF,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6EAA6E,EAAE;IACvG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oEAAoE,EAAE;IAChG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oEAAoE,EAAE;IAC9F,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE;IACjD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAChE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE;IACjC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACtD,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE;IAC/D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE;IACrE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC5D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC7D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE;IACjE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE;IACrD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC7D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE;IACxD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,EAAE;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,EAAE;IAC9D,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE;IACzC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE;IACxC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;IACvC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE;IACvD,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACF,CAAC;AAEvD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,SAAS;IACT,kBAAkB;IAClB,6BAA6B;IAC7B,2EAA2E;CACvC,CAAC"}

package/docs/config.md

@@ -0,0 +1,166 @@
+# PI WEB configuration reference
+
+PI WEB configuration covers the machine-local and project-local settings you usually need: the web/API bind address, trusted development-host settings, UI preferences, plugin enablement, file-explorer path access, upload limits, and session-daemon tools.
+
+This file is the markdown reference for agents and package consumers. The website page is <https://pi-web.dev/config>.
+
+## Config files
+
+PI WEB uses two config files:
+
+- **Global PI WEB config:** `$PI_WEB_CONFIG`, or `$XDG_CONFIG_HOME/pi-web/config.json`, or `~/.config/pi-web/config.json`.
+- **Project-local PI WEB config:** `<project>/.pi-web/config.json` for commit-able project settings.
+
+Each PI WEB machine has its own config. When using Fleet/machine federation, edit a remote machine's config by opening that machine directly or changing files on that machine.
+
+If you installed services with a custom config path, rerun `pi-web install --config /path/to/config.json` after changing that path or after upgrading from a version that only applied the custom path to the web service. This regenerates service files so the web/API and session daemon use the same `PI_WEB_CONFIG`.
+
+## Precedence and reloads
+
+Runtime values are resolved as:
+
+```text
+defaults → config file → environment overrides
+```
+
+Environment overrides include `PI_WEB_HOST`, `PI_WEB_PORT` / `PORT`, `PI_WEB_ALLOWED_HOSTS`, `PI_WEB_MAX_UPLOAD_BYTES`, `PI_WEB_SPAWN_SESSIONS`, and `PI_WEB_SUBSESSIONS`.
+
+Process restarts depend on the key:
+
+- `host` / `port`: restart the web/API service or process.
+- `maxUploadBytes`: restart both the web/API process and the session daemon.
+- `spawnSessions` / `subsessions`: restart the session daemon.
+- `pathAccess`: applies on the next request; existing file views may need a browser refresh.
+- `plugins`: reload the browser tab after changing plugin enablement.
+- `shortcuts`: saved settings apply in the browser after config refresh/save.
+
+## Global config example
+
+```json
+{
+  "host": "127.0.0.1",
+  "port": 8504,
+  "pathAccess": {
+    "allowedPaths": ["~/SDKs", "/opt/reference"]
+  },
+  "maxUploadBytes": 67108864,
+  "spawnSessions": true,
+  "subsessions": false,
+  "plugins": {
+    "workspace-tasks": { "enabled": true },
+    "updates": { "enabled": true },
+    "info": { "enabled": false }
+  },
+  "shortcuts": {
+    "core:view.chat": "mod+1",
+    "core:session.stop": null
+  }
+}
+```
+
+## Project-local config
+
+Project-local config lives at `<project>/.pi-web/config.json`. Use it for settings that should follow a repository.
+
+```json
+{
+  "version": 1,
+  "pathAccess": {
+    "allowedPaths": ["~/SDKs", "/opt/reference"]
+  }
+}
+```
+
+Project-local `pathAccess.allowedPaths` entries are merged after the global list and deduplicated. Paths must still be host-absolute or `~`-prefixed; relative roots are not supported.
+
+Plugins may own separate project files, such as `.pi-web/tasks.json` for the built-in Workspace Tasks plugin.
+
+## Configuration matrix
+
+Rows with JSON key `—` are runtime-only environment variables, not config-file keys.
+
+| Config | JSON key | Env var | Scope | Project-local behavior | Applies / restart |
+| --- | --- | --- | --- | --- | --- |
+| **Config-file keys** |  |  |  |  |  |
+| Web/API bind host | `host` | `PI_WEB_HOST` | Global | Not supported locally | Restart web/API |
+| Web/API port | `port` | `PI_WEB_PORT`, `PORT` | Global | Not supported locally | Restart web/API |
+| Dev-server allowed hosts | `allowedHosts` | `PI_WEB_ALLOWED_HOSTS` | Global | Not supported locally | Restart dev web/UI |
+| External filesystem roots | `pathAccess.allowedPaths` | — | Global + project | **Merges**: global roots first, then project roots; duplicates removed | Next file request; refresh existing views if needed |
+| Upload/body limit | `maxUploadBytes` | `PI_WEB_MAX_UPLOAD_BYTES` | Global | Not supported locally | Restart web/API and session daemon |
+| Agent can spawn sessions | `spawnSessions` | `PI_WEB_SPAWN_SESSIONS` | Global/session daemon | Not supported locally | Restart session daemon |
+| Tracked subsessions (beta) | `subsessions` | `PI_WEB_SUBSESSIONS` | Global/session daemon | Not supported locally; also requires `spawnSessions` | Restart session daemon |
+| Plugin enablement/settings | `plugins.<id>.enabled`, `plugins.<id>.settings` | — | Global | Not core local config; plugins may read their own project files | Reload browser tab |
+| Keyboard shortcuts | `shortcuts.<actionId>` | — | Global | Not supported locally | Applies after settings save/config refresh |
+| Project config version | `version` | — | Project | Project-local only; must be `1` when present | Next project-config read |
+| **Runtime-only environment variables** |  |  |  |  |  |
+| Global config file path | — | `PI_WEB_CONFIG` (`XDG_CONFIG_HOME` affects the default path) | Process/env | Selects the global config file; not a project config | Restart services/processes after changing env |
+| Managed data directory | — | `PI_WEB_DATA_DIR` | Process/env | Not supported locally | Restart services before changing; moves managed state location |
+| Session daemon socket | — | `PI_WEB_SESSIOND_SOCKET` | Web/API + session daemon env | Not supported locally | Restart daemon and web/API; both must match |
+| Session daemon TCP port | — | `PI_WEB_SESSIOND_PORT` | Session daemon env | Not supported locally | Restart session daemon; set `PI_WEB_SESSIOND_URL` for web/API too |
+| Session daemon TCP host | — | `PI_WEB_SESSIOND_HOST` | Session daemon env | Not supported locally | Restart session daemon |
+| Web-to-daemon URL | — | `PI_WEB_SESSIOND_URL` | Web/API env | Not supported locally | Restart web/API |
+| Projects storage file | — | `PI_WEB_PROJECTS_FILE` | Web/API + session daemon env | Not supported locally | Restart services; advanced state override |
+| Remote machines storage file | — | `PI_WEB_MACHINES_FILE` | Web/API env | Not supported locally | Restart web/API; advanced state override |
+| Pi session storage directory | — | `PI_CODING_AGENT_SESSION_DIR` | Pi/session daemon env | Not supported locally | Restart session daemon; follows Pi session priority |
+| Pi agent config directory | — | `PI_CODING_AGENT_DIR` | Pi/Web/API/session daemon env | Not supported locally | Restart services |
+| Skip update checks | — | `PI_WEB_SKIP_VERSION_CHECK`, `PI_WEB_OFFLINE`, `PI_SKIP_VERSION_CHECK`, `PI_OFFLINE` | Web/API env | Not supported locally | Restart web/API after env changes |
+
+## Key details
+
+### External path access
+
+`pathAccess.allowedPaths` grants PI WEB's file explorer and absolute `@` path completions access to specific filesystem roots outside the current workspace.
+
+By default, workspace-relative file reads stay inside the workspace and absolute paths are denied. Add only roots you trust PI WEB to list and read through the browser UI.
+
+Accepted root forms:
+
+- Unix absolute paths: `/opt/reference`
+- Home-relative paths: `~/SDKs`
+- Windows absolute paths on Windows hosts: `C:\Users\dev\SDKs`
+
+When an absolute request is served, PI WEB expands `~`, canonicalizes the configured roots with `realpath`, requires roots to be existing directories, and rejects symlink escapes outside the allowed roots.
+
+This is not a sandbox for the underlying Pi Coding Agent or your OS user. It only controls PI WEB UI/API file exposure outside a workspace.
+
+### Session daemon tools
+
+`spawnSessions` controls whether agents receive the `spawn_session` tool. It defaults to `true`; set it to `false` if you do not want an agent to start independent PI WEB sessions.
+
+`subsessions` is beta and controls whether agents receive the tracked-subsession tools: `spawn_subsession`, `list_subsessions`, `check_subsession`, and `read_subsession`. It defaults to `false` and also requires `spawnSessions` to be enabled.
+
+Tracked subsessions let an agent delegate work to child sessions, get notified when children stop working, and inspect their transcripts.
+
+### Plugin config
+
+Plugins are enabled by default. Set `plugins.<id>.enabled` to `false` to remove a plugin from `/pi-web-plugins/manifest.json` before the browser imports it.
+
+```json
+{
+  "plugins": {
+    "workspace-tasks": { "enabled": true, "settings": {} },
+    "updates": { "enabled": false }
+  }
+}
+```
+
+Reload the browser tab after changing plugin enablement. Already-loaded plugin JavaScript is not unloaded from the current page.
+
+### Shortcut config
+
+Shortcut values are keyed by action id. Values are shortcut strings such as `mod+k` or `mod+g p`; `null` disables that action's shortcut.
+
+```json
+{
+  "shortcuts": {
+    "core:view.chat": "mod+1",
+    "core:session.stop": null
+  }
+}
+```
+
+Prefer Settings → Keyboard for editing shortcuts interactively.
+
+## Optional completion tools
+
+File and path `@` completions work without extra tools. If `fzf` is available on the PI WEB server's `PATH`, PI WEB uses it to improve completion filtering/ranking; otherwise it falls back to built-in ranking.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jmfederico/pi-web",
-  "version": "1.202606.4",
+  "version": "1.202606.6",
   "description": "Web UI for persistent Pi Coding Agent sessions in real workspaces.",
   "license": "MIT",
   "author": "Federico Jaramillo Martinez",
@@ -17,6 +17,7 @@
     "LICENSE",
     "extensions",
     "docs/plugins.md",
+    "docs/config.md",
     "docs/assets",
     "plugin-api.d.ts",
     "plugin-api/unstable.d.ts"
@@ -31,6 +32,7 @@
     "build": "tsc -p tsconfig.build.json && npm run build:plugin-api && npm run build:plugins && vite build",
     "build:plugin-api": "tsc -p tsconfig.plugin-api.json",
     "build:plugins": "tsc -p tsconfig.plugins.json && node scripts/build-plugins.mjs",
+    "capture:screenshots": "node scripts/capture-screenshots.mjs",
     "typecheck": "tsc --noEmit",
     "knip": "knip",
     "lint": "eslint \"src/**/*.ts\" \"extensions/**/*.ts\" \"pi-web-plugins/**/*.ts\" vite.config.ts vitest.config.ts",