@matuto-ai/pi-broker-connector 0.3.0 → 0.3.1

package/README.md

@@ -2,7 +2,7 @@
 
 A native Pi extension providing durable, session-bound messaging through the [Psst broker](https://github.com/matuto-ai/psst). Runs **inside the Pi process in your existing sandbox**. No host launcher, local model, provider subscription, or additional service is required by the connector.
 
-**Version 0.3.0:** native private setup, persistent installation selection and automatic reconnection of independent Pi sessions, retaining automatic native delivery and transport-auth pause protection. Tested with the official Pi 1.4.0 SDK and a local fixture model; live authenticated user-sandbox acceptance remains a separate step.
+**Version 0.3.1:** native private setup, persistent installation selection and automatic reconnection of independent Pi sessions, retaining automatic native delivery and transport-auth pause protection. Tested with the official Pi 1.4.0 SDK and a local fixture model; live authenticated user-sandbox acceptance remains a separate step.
 
 ## Requirements
 
@@ -33,7 +33,7 @@ This uses the default branch. To pin a reviewed commit, append `@` and its exact
 ### From npm (only after publication)
 
 ```sh
-pi install npm:@matuto-ai/pi-broker-connector@0.3.0
+pi install npm:@matuto-ai/pi-broker-connector@0.3.1
 ```
 
 The command requires the version to be present on npm. If publication is still pending, use a reviewed checkout instead.
@@ -79,7 +79,7 @@ Use the existing bundle path; keep its `token` next to `connection.json`. After
 Install or update **inside the same sandbox**, then use `/reload` in the running Pi:
 
 ```sh
-pi install npm:@matuto-ai/pi-broker-connector@0.3.0
+pi install npm:@matuto-ai/pi-broker-connector@0.3.1
 ```
 
 This installer command is not a second agent session. No sandbox recreation or Pi process restart is required. Version 0.1.1 does not have `/psst-connect`; 0.1.2 adds that command, while automatic delivery requires 0.2.0 or later.
@@ -177,7 +177,7 @@ Tests cover private bundle validation, exact session isolation, duplicate owners
 
 ## Publishing
 
-This release uses package version `0.3.0` and matching GitHub release tag `v0.3.0`. The release workflow publishes the package only after its checks pass.
+This release uses package version `0.3.1` and matching GitHub release tag `v0.3.1`. The release workflow publishes the package only after its checks pass.
 
 The release workflow follows the existing Pi plugin convention: a published GitHub release triggers checks and npm publishing. It requires a `v<package.version>` tag and runs the native host gate before publishing. Nothing is published by CI on pull requests or ordinary pushes.
 
@@ -240,3 +240,7 @@ component, connects to a real fixture HTTPS broker, and recreates HOME while
 preserving the agent directory. It asserts one credential and two distinct
 sessions without a second setup. No model turn or authenticated user-sandbox
 acceptance is claimed. The broker checkout must include its enrollment TLS fixture.
+
+### Masked-field keyboard regression tests
+
+`npm test` requires Python 3 on Linux for the real POSIX PTY keyboard tests. They use only synthetic input and the pinned official Pi TUI 1.4.0 development dependency. Runtime imports resolve through Pi’s native extension loader; no terminal keyboard mode is changed by the connector itself. Legacy text/paste and Kitty printable input are supported, while control keys use the public host decoder. This does not claim complete xterm `modifyOtherKeys` printable-key support.

package/package.json

@@ -1,15 +1,50 @@
 {
   "name": "@matuto-ai/pi-broker-connector",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Session-bound Psst broker messaging tools for Pi",
   "type": "module",
   "license": "MIT",
-  "repository": { "type": "git", "url": "git+https://github.com/matuto-ai/pi-broker-connector.git" },
-  "engines": { "node": ">=24.19.0 <25" },
-  "keywords": ["pi-package", "pi", "psst", "broker"],
-  "files": ["extensions/", "src/", "vendor/", "README.md", "LICENSE"],
-  "pi": { "extensions": ["./extensions/psst.ts"] },
-  "peerDependencies": { "@earendil-works/pi-coding-agent": "*", "typebox": "*" },
-  "scripts": { "test": "node --test test/*.test.mjs", "check": "node scripts/check.mjs", "test:host": "node --test test/native-host.probe.mjs", "prepack": "npm run check && npm test" },
-  "publishConfig": { "access": "public", "registry": "https://registry.npmjs.org/" }
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/matuto-ai/pi-broker-connector.git"
+  },
+  "engines": {
+    "node": ">=24.19.0 <25"
+  },
+  "keywords": [
+    "pi-package",
+    "pi",
+    "psst",
+    "broker"
+  ],
+  "files": [
+    "extensions/",
+    "src/",
+    "vendor/",
+    "README.md",
+    "LICENSE"
+  ],
+  "pi": {
+    "extensions": [
+      "./extensions/psst.ts"
+    ]
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "typebox": "*",
+    "@earendil-works/pi-tui": "^1.4.0"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs",
+    "check": "node scripts/check.mjs",
+    "test:host": "node --test test/native-host.probe.mjs",
+    "prepack": "npm run check && npm test"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-tui": "1.4.0"
+  }
 }

package/src/private-input.mjs

@@ -1,25 +1,34 @@
+import { matchesKey, isKeyRelease, decodeKittyPrintable } from '@earendil-works/pi-tui';
 import { LocalError } from '../vendor/broker/reference/errors.mjs';
 
 // A focused native component: the value never enters Pi's editor or a message.
-// Only base64url ticket bytes are accepted, rendering is always masked.
+// Use public host decoders for control keys and Kitty printable input; legacy text/paste stays masked.
 export function maskedPairingComponent({done,requestRender}) {
-  let value='',closed=false,pasting=false;
-  const finish=result=>{if(closed)return;closed=true;value='';done(result);};
+  let value='',closed=false,pasting=false,paste='',invalidPaste=false,hint=false;
+  const finish=result=>{if(closed)return;closed=true;value='';paste='';done(result);};
+  const append=data=>{if(/^[A-Za-z0-9_-]+$/.test(data)&&value.length+data.length<=43){value+=data;hint=false;}};
   return {
-    render(width){return ['Psst: enter the one-time pairing secret (hidden)', '*'.repeat(value.length), 'Enter: connect   Esc: cancel'].map(line=>line.slice(0,Math.max(0,width)));},
+    render(width){return ['Psst: enter the one-time pairing secret (hidden)', '*'.repeat(value.length), hint?'Paste the complete 43-character pairing secret.':'Enter: connect   Esc or Ctrl+C: cancel'].map(line=>line.slice(0,Math.max(0,width)));},
     invalidate(){},
     handleInput(data){
-      if(closed)return;
-      if(data==='\x1b'||data==='\x03'){finish(undefined);return;}
-      if(data==='\r'||data==='\n'){if(!pasting&&/^[A-Za-z0-9_-]{43}$/.test(value))finish(value);return;}
-      if(data==='\x7f'||data==='\b'){value=value.slice(0,-1);requestRender();return;}
-      // Pi TUI may deliver bracketed paste as one event or separate chunks.
-      if(data.startsWith('\x1b[200~')){pasting=true;data=data.slice(6);}
-      if(data.endsWith('\x1b[201~')){pasting=false;data=data.slice(0,-6);}
-      if(/^[A-Za-z0-9_-]+$/.test(data)&&value.length+data.length<=43)value+=data;
+      if(closed||typeof data!=='string'||isKeyRelease(data))return;
+      if(matchesKey(data,'escape')||matchesKey(data,'ctrl+c')){finish(undefined);return;}
+      if(matchesKey(data,'enter')){if(!pasting){if(/^[A-Za-z0-9_-]{43}$/.test(value))finish(value);else{hint=true;requestRender();}}return;}
+      if(!pasting&&matchesKey(data,'backspace')){value=value.slice(0,-1);hint=false;requestRender();return;}
+      // Pi normally wraps a whole paste; tolerate marker/body/end delivered separately.
+      if(data.startsWith('\x1b[200~')){pasting=true;paste='';invalidPaste=false;data=data.slice(6);}
+      if(pasting){
+        const end=data.indexOf('\x1b[201~');
+        const body=end<0?data:data.slice(0,end);
+        if(!/^[A-Za-z0-9_-]*$/.test(body)||paste.length+body.length>43)invalidPaste=true;
+        if(!invalidPaste)paste+=body;
+        if(end>=0){if(data.slice(end+6))invalidPaste=true;if(!invalidPaste)append(paste);else hint=true;paste='';pasting=false;invalidPaste=false;}
+      }else{
+        append(decodeKittyPrintable(data)??data);
+      }
       requestRender();
     },
-    dispose(){closed=true;value='';},
+    dispose(){closed=true;value='';paste='';},
   };
 }
 export async function promptPairingSecret(ctx) {