@larose/pi-web 0.3.0

package/dist/server/server.js

@@ -0,0 +1,190 @@
+import { readFile } from "node:fs/promises";
+import { createServer } from "node:http";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { handleApi, writeApiError } from "./api.js";
+import { DirectoryBrowser } from "./directory-browser.js";
+import { AppError } from "./errors.js";
+import { GitWorkspaceService } from "./git-workspaces.js";
+import { createRuntimeRegistry } from "./runtime-registry.js";
+import { SessionRepository } from "./session-repository.js";
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
+const homeDocument = {
+    path: join(packageRoot, "public/home.html"),
+    contentType: "text/html; charset=utf-8",
+};
+const sessionDocument = {
+    path: join(packageRoot, "public/session.html"),
+    contentType: "text/html; charset=utf-8",
+};
+const staticFiles = new Map([
+    ["/", homeDocument],
+    ["/styles.css", { path: join(packageRoot, "public/styles.css"), contentType: "text/css; charset=utf-8" }],
+    ["/home.js", { path: join(packageRoot, "dist/client/home.js"), contentType: "text/javascript; charset=utf-8" }],
+    ["/session.js", { path: join(packageRoot, "dist/client/session.js"), contentType: "text/javascript; charset=utf-8" }],
+]);
+function errorDetails(error) {
+    if (!(error instanceof Error)) {
+        return String(error);
+    }
+    const details = error.stack ?? error.message;
+    return error.cause === undefined ? details : `${details}\nCaused by: ${errorDetails(error.cause)}`;
+}
+function shouldReportError(error) {
+    return !(error instanceof AppError) || error.status >= 500 || error.cause !== undefined;
+}
+function applySecurityHeaders(response) {
+    response.setHeader("content-security-policy", "default-src 'self'; base-uri 'none'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self'");
+    response.setHeader("referrer-policy", "no-referrer");
+    response.setHeader("x-content-type-options", "nosniff");
+    response.setHeader("x-frame-options", "DENY");
+}
+function boundPort(server) {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        throw new Error("Server is not bound to a TCP address");
+    }
+    return address.port;
+}
+function validateLocalRequest(request, server) {
+    const host = request.headers.host;
+    if (!host) {
+        throw new AppError("invalid_host", "A Host header is required", 403);
+    }
+    let hostUrl;
+    try {
+        hostUrl = new URL(`http://${host}`);
+    }
+    catch {
+        throw new AppError("invalid_host", "The Host header is invalid", 403);
+    }
+    const expectedPort = String(boundPort(server));
+    if (!new Set(["127.0.0.1", "localhost"]).has(hostUrl.hostname) || hostUrl.port !== expectedPort) {
+        throw new AppError("invalid_host", "The Host header is not allowed", 403);
+    }
+    const origin = request.headers.origin;
+    if (!origin) {
+        return;
+    }
+    try {
+        const originUrl = new URL(origin);
+        if (originUrl.protocol !== "http:" ||
+            !new Set(["127.0.0.1", "localhost"]).has(originUrl.hostname) ||
+            originUrl.port !== expectedPort) {
+            throw new Error("Origin does not match the local server");
+        }
+    }
+    catch {
+        throw new AppError("invalid_origin", "The Origin header is not allowed", 403);
+    }
+}
+async function serveAsset(asset, response) {
+    const contents = await readFile(asset.path);
+    response.writeHead(200, {
+        "cache-control": "no-store",
+        "content-length": contents.byteLength,
+        "content-type": asset.contentType,
+    });
+    response.end(contents);
+}
+async function serveStatic(pathname, response) {
+    const asset = staticFiles.get(pathname);
+    if (!asset) {
+        return false;
+    }
+    await serveAsset(asset, response);
+    return true;
+}
+function newSessionSource(pathname) {
+    const match = /^\/sessions\/([^/]+)\/new\/?$/.exec(pathname);
+    if (!match?.[1]) {
+        return undefined;
+    }
+    try {
+        return decodeURIComponent(match[1]);
+    }
+    catch {
+        throw new AppError("invalid_path", "The source session id is not valid", 400);
+    }
+}
+export async function startServer(options = {}) {
+    const hostname = options.hostname ?? "127.0.0.1";
+    const port = options.port ?? 31_415;
+    if (hostname !== "127.0.0.1") {
+        throw new Error("Pi Web only supports the loopback host 127.0.0.1");
+    }
+    const repository = options.context?.repository ?? (await SessionRepository.create(options.startupCwd ?? process.cwd()));
+    const runtimes = options.context?.runtimes ?? (await createRuntimeRegistry(repository));
+    const directories = options.context?.directories ?? new DirectoryBrowser();
+    const gitWorkspaces = options.context?.gitWorkspaces ?? new GitWorkspaceService();
+    const context = { repository, runtimes, directories, gitWorkspaces };
+    let closing;
+    const server = createServer(async (request, response) => {
+        applySecurityHeaders(response);
+        try {
+            validateLocalRequest(request, server);
+            const url = new URL(request.url ?? "/", "http://127.0.0.1");
+            if (await handleApi(request, response, url.pathname, context)) {
+                return;
+            }
+            if (request.method === "GET") {
+                const sourceId = newSessionSource(url.pathname);
+                if (sourceId) {
+                    await repository.get(sourceId);
+                    await serveAsset(homeDocument, response);
+                    return;
+                }
+                if (/^\/sessions\/[^/]+\/?$/.test(url.pathname)) {
+                    await serveAsset(sessionDocument, response);
+                    return;
+                }
+                if (await serveStatic(url.pathname, response)) {
+                    return;
+                }
+            }
+            throw new AppError("not_found", "Not found", 404);
+        }
+        catch (error) {
+            if (shouldReportError(error)) {
+                process.stderr.write(`[pi-web] ${request.method ?? "UNKNOWN"} ${request.url ?? "/"} failed\n${errorDetails(error)}\n`);
+            }
+            writeApiError(response, error);
+        }
+    });
+    try {
+        await new Promise((resolveListening, reject) => {
+            server.once("error", reject);
+            server.listen(port, hostname, () => {
+                server.off("error", reject);
+                resolveListening();
+            });
+        });
+    }
+    catch (error) {
+        if (!options.context) {
+            await runtimes.close();
+        }
+        throw error;
+    }
+    return {
+        hostname,
+        port: boundPort(server),
+        server,
+        repository,
+        runtimes,
+        directories,
+        gitWorkspaces,
+        close: () => {
+            if (closing) {
+                return closing;
+            }
+            closing = (async () => {
+                await runtimes.close();
+                await new Promise((resolveClose, reject) => {
+                    server.close((error) => (error ? reject(error) : resolveClose()));
+                });
+            })();
+            return closing;
+        },
+    };
+}

package/dist/server/session-repository.js

@@ -0,0 +1,374 @@
+import { open, realpath, stat, unlink } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
+import { CURRENT_SESSION_VERSION, SessionManager, sessionEntryToContextMessages, } from "@earendil-works/pi-coding-agent";
+import { AppError } from "./errors.js";
+const MAX_SESSION_HEADER_BYTES = 1024 * 1024;
+function isCurrentSessionHeader(value) {
+    if (!value || typeof value !== "object") {
+        return false;
+    }
+    const header = value;
+    return (header.type === "session" &&
+        header.version === CURRENT_SESSION_VERSION &&
+        typeof header.id === "string" &&
+        header.id.trim() !== "" &&
+        typeof header.timestamp === "string" &&
+        header.timestamp.trim() !== "" &&
+        !Number.isNaN(new Date(header.timestamp).getTime()) &&
+        typeof header.cwd === "string" &&
+        header.cwd.trim() !== "" &&
+        (header.parentSession === undefined || typeof header.parentSession === "string"));
+}
+async function readCurrentSessionHeader(path) {
+    let file;
+    try {
+        file = await open(path, "r");
+        const buffer = Buffer.allocUnsafe(MAX_SESSION_HEADER_BYTES + 1);
+        let bytesRead = 0;
+        let newline = -1;
+        while (bytesRead < buffer.length && newline === -1) {
+            const result = await file.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+            if (result.bytesRead === 0) {
+                break;
+            }
+            newline = buffer.indexOf(0x0a, bytesRead);
+            bytesRead += result.bytesRead;
+            if (newline >= bytesRead) {
+                newline = -1;
+            }
+        }
+        const bounded = buffer.subarray(0, Math.min(bytesRead, MAX_SESSION_HEADER_BYTES));
+        if (newline === -1 && bytesRead > MAX_SESSION_HEADER_BYTES) {
+            return null;
+        }
+        const line = bounded.subarray(0, newline === -1 ? bounded.length : newline).toString("utf8");
+        const parsed = JSON.parse(line);
+        return isCurrentSessionHeader(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (file) {
+            await file.close().catch(() => undefined);
+        }
+    }
+}
+function toSummary(info, header) {
+    return {
+        id: header.id,
+        cwd: header.cwd,
+        ...(info.name ? { name: info.name } : {}),
+        created: header.timestamp,
+        modified: info.modified.toISOString(),
+        messageCount: info.messageCount,
+        firstMessage: info.firstMessage,
+    };
+}
+async function canonicalFile(path) {
+    try {
+        const file = await stat(path);
+        if (!file.isFile()) {
+            throw new AppError("stale_session", "The session path is no longer a file", 410);
+        }
+        return await realpath(path);
+    }
+    catch (error) {
+        if (error instanceof AppError) {
+            throw error;
+        }
+        throw new AppError("stale_session", "The session file no longer exists or is inaccessible", 410, {
+            cause: error,
+        });
+    }
+}
+export async function validateCwd(input) {
+    if (typeof input !== "string" || input.trim() === "") {
+        throw new AppError("invalid_cwd", "A working directory is required");
+    }
+    const candidate = input.trim();
+    if (!isAbsolute(candidate)) {
+        throw new AppError("invalid_cwd", "The working directory must be an absolute path");
+    }
+    try {
+        const canonical = await realpath(resolve(candidate));
+        const directory = await stat(canonical);
+        if (!directory.isDirectory()) {
+            throw new AppError("invalid_cwd", "The working directory is not a directory");
+        }
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof AppError) {
+            throw error;
+        }
+        throw new AppError("invalid_cwd", "The working directory does not exist or is inaccessible", 400, {
+            cause: error,
+        });
+    }
+}
+export class SessionRepository {
+    startupCwd;
+    sessionDir;
+    pathsById = new Map();
+    pendingManagers = new Map();
+    constructor(startupCwd, sessionDir) {
+        this.startupCwd = startupCwd;
+        this.sessionDir = sessionDir;
+    }
+    static async create(startupCwd, options = {}) {
+        const configuredSessionDir = options.sessionDir ?? process.env.PI_CODING_AGENT_SESSION_DIR;
+        const sessionDir = configuredSessionDir ? resolve(configuredSessionDir) : undefined;
+        return new SessionRepository(await validateCwd(startupCwd), sessionDir);
+    }
+    async list() {
+        const infos = this.sessionDir ? await SessionManager.listAll(this.sessionDir) : await SessionManager.listAll();
+        const nextPaths = new Map();
+        const groups = new Map();
+        for (const info of infos) {
+            const header = await readCurrentSessionHeader(info.path);
+            if (!header || header.id !== info.id || nextPaths.has(header.id)) {
+                continue;
+            }
+            nextPaths.set(header.id, info.path);
+            const sessions = groups.get(header.cwd) ?? [];
+            sessions.push(toSummary(info, header));
+            groups.set(header.cwd, sessions);
+        }
+        for (const [id, pending] of [...this.pendingManagers]) {
+            if (nextPaths.has(id)) {
+                continue;
+            }
+            let session;
+            try {
+                session = await this.get(id);
+            }
+            catch (error) {
+                if (!(error instanceof AppError) || error.code !== "invalid_session") {
+                    throw error;
+                }
+                this.pendingManagers.delete(id);
+                this.pathsById.delete(id);
+                continue;
+            }
+            const sessions = groups.get(session.cwd) ?? [];
+            sessions.unshift({
+                id: session.id,
+                cwd: session.cwd,
+                ...(session.name ? { name: session.name } : {}),
+                created: session.created,
+                modified: session.modified,
+                messageCount: session.messageCount,
+                firstMessage: session.firstMessage,
+            });
+            groups.set(session.cwd, sessions);
+            const file = pending.getSessionFile();
+            if (file) {
+                nextPaths.set(id, file);
+            }
+        }
+        this.pathsById = nextPaths;
+        const knownCwds = [this.startupCwd];
+        for (const sessions of groups.values()) {
+            const cwd = sessions[0]?.cwd;
+            if (cwd && !knownCwds.includes(cwd)) {
+                knownCwds.push(cwd);
+            }
+        }
+        return {
+            groups: [...groups].map(([cwd, sessions]) => ({ cwd, sessions })),
+            knownCwds,
+        };
+    }
+    async resolvePath(id) {
+        if (!id) {
+            throw new AppError("unknown_session", "A session id is required", 404);
+        }
+        let path = this.pathsById.get(id);
+        if (!path) {
+            await this.list();
+            path = this.pathsById.get(id);
+        }
+        if (!path) {
+            throw new AppError("unknown_session", `Unknown session: ${id}`, 404);
+        }
+        return canonicalFile(path);
+    }
+    async delete(id) {
+        if (!id) {
+            throw new AppError("unknown_session", "A session id is required", 404);
+        }
+        const pending = this.pendingManagers.get(id);
+        let path;
+        if (pending) {
+            const pendingFile = pending.getSessionFile();
+            if (!pendingFile) {
+                throw new AppError("invalid_session", "The session is not persisted", 422);
+            }
+            try {
+                await stat(pendingFile);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT") {
+                    throw new AppError("session_delete_failed", "Could not inspect the session file", 500, {
+                        cause: error,
+                    });
+                }
+                this.pendingManagers.delete(id);
+                this.pathsById.delete(id);
+                return;
+            }
+            path = await canonicalFile(pendingFile);
+        }
+        else {
+            path = await this.resolvePath(id);
+        }
+        const header = await readCurrentSessionHeader(path);
+        if (!header || header.id !== id) {
+            throw new AppError("invalid_session", "The session file is not in the current format", 422);
+        }
+        try {
+            await unlink(path);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                throw new AppError("stale_session", "The session file no longer exists", 410, { cause: error });
+            }
+            throw new AppError("session_delete_failed", "Could not delete the session file", 500, {
+                cause: error,
+            });
+        }
+        this.pendingManagers.delete(id);
+        this.pathsById.delete(id);
+    }
+    adoptManager(manager) {
+        const id = manager.getSessionId();
+        this.pendingManagers.set(id, manager);
+        const file = manager.getSessionFile();
+        if (file) {
+            this.pathsById.set(id, file);
+        }
+    }
+    async openManager(id) {
+        const pending = this.pendingManagers.get(id);
+        if (pending) {
+            const pendingFile = pending.getSessionFile();
+            if (!pendingFile) {
+                return pending;
+            }
+            try {
+                await stat(pendingFile);
+            }
+            catch {
+                return pending;
+            }
+            const header = await readCurrentSessionHeader(pendingFile);
+            if (!header || header.id !== id) {
+                throw new AppError("invalid_session", "The session file is not in the current format", 422);
+            }
+            this.pendingManagers.delete(id);
+            this.pathsById.set(id, pendingFile);
+        }
+        const path = await this.resolvePath(id);
+        const header = await readCurrentSessionHeader(path);
+        if (!header || header.id !== id) {
+            throw new AppError("invalid_session", "The session file is not in the current format", 422);
+        }
+        try {
+            const manager = SessionManager.open(path);
+            if (manager.getSessionId() !== id) {
+                throw new AppError("stale_session", "The session file id no longer matches", 410);
+            }
+            await validateCwd(manager.getCwd());
+            return manager;
+        }
+        catch (error) {
+            if (error instanceof AppError) {
+                throw error;
+            }
+            throw new AppError("invalid_session", "The session file could not be opened", 422, { cause: error });
+        }
+    }
+    async get(id) {
+        const manager = await this.openManager(id);
+        const context = manager.buildSessionContext();
+        const branch = manager.getBranch();
+        const transcriptEntries = [];
+        for (const entry of branch) {
+            if (entry.type === "message") {
+                const persisted = { entryId: entry.id, message: entry.message };
+                transcriptEntries.push({ kind: "message", ...persisted });
+                continue;
+            }
+            if (entry.type === "custom_message") {
+                for (const message of sessionEntryToContextMessages(entry)) {
+                    const persisted = { entryId: entry.id, message };
+                    transcriptEntries.push({ kind: "message", ...persisted });
+                }
+                continue;
+            }
+            if (entry.type === "custom") {
+                const persisted = { entryId: entry.id, customType: entry.customType, data: entry.data };
+                transcriptEntries.push({ kind: "custom", ...persisted });
+            }
+        }
+        const file = manager.getSessionFile();
+        if (!file) {
+            throw new AppError("invalid_session", "The session is not persisted", 422);
+        }
+        const details = await stat(file).catch(() => undefined);
+        const header = manager.getHeader();
+        if (!isCurrentSessionHeader(header)) {
+            throw new AppError("invalid_session", "The session file is not in the current format", 422);
+        }
+        const name = manager.getSessionName();
+        const created = header.timestamp;
+        return {
+            id: manager.getSessionId(),
+            cwd: manager.getCwd(),
+            ...(name ? { name } : {}),
+            created,
+            modified: details?.mtime.toISOString() ?? created,
+            messageCount: transcriptEntries.reduce((count, entry) => count + (entry.kind === "message" ? 1 : 0), 0),
+            firstMessage: this.firstUserText(transcriptEntries),
+            transcriptEntries,
+            model: context.model,
+            thinkingLevel: context.thinkingLevel,
+        };
+    }
+    async createSession(cwdInput) {
+        const cwd = await validateCwd(cwdInput);
+        let manager;
+        try {
+            manager = SessionManager.create(cwd, this.sessionDir);
+        }
+        catch (error) {
+            throw new AppError("session_create_failed", "Could not create the session file", 500, { cause: error });
+        }
+        const file = manager.getSessionFile();
+        if (!file) {
+            throw new AppError("session_create_failed", "Pi did not create a persistent session", 500);
+        }
+        this.adoptManager(manager);
+        return {
+            manager,
+            session: await this.get(manager.getSessionId()),
+        };
+    }
+    firstUserText(entries) {
+        for (const entry of entries) {
+            if (entry.kind !== "message" || entry.message.role !== "user") {
+                continue;
+            }
+            const { message } = entry;
+            if (typeof message.content === "string") {
+                return message.content;
+            }
+            return message.content
+                .filter((part) => part.type === "text")
+                .map((part) => part.text)
+                .join("");
+        }
+        return "";
+    }
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@larose/pi-web",
+  "version": "0.3.0",
+  "description": "Pi, in your browser",
+  "author": {
+    "name": "Mathieu Larose",
+    "email": "mathieu@mathieularose.com",
+    "url": "https://mathieularose.com"
+  },
+  "license": "AGPL-3.0-or-later",
+  "type": "module",
+  "keywords": [
+    "pi-package"
+  ],
+  "pi": {
+    "image": "https://unpkg.com/@larose/pi-web/screenshots/session.png"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist/",
+    "public/",
+    "screenshots/",
+    "THIRD_PARTY_LICENSES.md",
+    "src/**/*.ts"
+  ],
+  "bin": {
+    "pi-web": "dist/server/cli.js"
+  },
+  "dependencies": {
+    "@earendil-works/pi-coding-agent": "^0.85.0",
+    "@earendil-works/pi-server": "^0.85.0"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "2.5.12",
+    "@earendil-works/pi-agent-core": "0.85.0",
+    "@types/node": "22.20.1",
+    "esbuild": "0.28.1",
+    "marked": "^18.0.12",
+    "typescript": "5.9.3"
+  },
+  "engines": {
+    "node": ">=22.19.0"
+  }
+}