@pasko70/pibo 1.2.0 → 1.3.1

package/dist/vscode/code-cli.js

@@ -0,0 +1,119 @@
+/**
+ * Detection of the VS Code CLI binary and wrapper around it.
+ *
+ * The `code` binary is what VS Code installs on `$PATH` when the user enables
+ * "Shell Command: Install 'code' command in PATH" from the VS Code command
+ * palette. It is the only supported way for `pibo vscode install` to install
+ * the extension. If no supported binary is on `$PATH`, install fails with a
+ * clear error pointing at https://code.visualstudio.com/.
+ */
+import { spawn as defaultSpawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { delimiter, join } from "node:path";
+export const SUPPORTED_CODE_BINARIES = ["code", "code-insiders", "codium"];
+function splitPathEnv(pathValue) {
+    if (!pathValue)
+        return [];
+    return pathValue.split(delimiter).filter((entry) => entry.length > 0);
+}
+function firstExisting(candidates) {
+    for (const candidate of candidates) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+export function detectCodeBinary(options = {}) {
+    const pathValue = options.path ?? options.env?.PATH ?? process.env.PATH ?? "";
+    const directories = splitPathEnv(pathValue);
+    for (const binary of SUPPORTED_CODE_BINARIES) {
+        const candidates = directories.map((dir) => join(dir, binary));
+        const found = firstExisting(candidates);
+        if (found)
+            return { binary, path: found };
+    }
+    return undefined;
+}
+const COLLECT_BUFFER_LIMIT = 1024 * 1024; // 1 MiB
+export function runCodeCommand(options) {
+    const spawnImpl = options.spawnImpl ?? defaultSpawn;
+    const env = options.env ?? process.env;
+    return new Promise((resolveInvocation, rejectInvocation) => {
+        let child;
+        try {
+            child = spawnImpl(options.binary, [...options.args], {
+                env,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch (error) {
+            rejectInvocation(error instanceof Error ? error : new Error(String(error)));
+            return;
+        }
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let stdoutLength = 0;
+        let stderrLength = 0;
+        let timedOut = false;
+        const timeoutHandle = typeof options.timeoutMs === "number"
+            ? setTimeout(() => {
+                timedOut = true;
+                child.kill("SIGKILL");
+            }, options.timeoutMs)
+            : null;
+        child.stdout?.on("data", (chunk) => {
+            stdoutLength += chunk.length;
+            if (stdoutLength <= COLLECT_BUFFER_LIMIT)
+                stdoutChunks.push(chunk);
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderrLength += chunk.length;
+            if (stderrLength <= COLLECT_BUFFER_LIMIT)
+                stderrChunks.push(chunk);
+        });
+        child.on("error", (error) => {
+            if (timeoutHandle)
+                clearTimeout(timeoutHandle);
+            rejectInvocation(error);
+        });
+        child.on("close", (code) => {
+            if (timeoutHandle)
+                clearTimeout(timeoutHandle);
+            if (timedOut) {
+                rejectInvocation(new Error(`code command timed out after ${options.timeoutMs}ms`));
+                return;
+            }
+            resolveInvocation({
+                stdout: Buffer.concat(stdoutChunks).toString("utf8"),
+                stderr: Buffer.concat(stderrChunks).toString("utf8"),
+                exitCode: code ?? -1,
+            });
+        });
+    });
+}
+export async function listInstalledExtensions(options) {
+    const result = await runCodeCommand({
+        binary: options.binary,
+        args: ["--list-extensions", "--show-versions"],
+        spawnImpl: options.spawnImpl,
+        env: options.env,
+        timeoutMs: 30_000,
+    });
+    if (result.exitCode !== 0) {
+        throw new Error(`code --list-extensions failed: ${result.stderr || result.stdout || `exit ${result.exitCode}`}`);
+    }
+    const entries = [];
+    for (const rawLine of result.stdout.split(/\r?\n/)) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        const atIndex = line.lastIndexOf("@");
+        if (atIndex > 0) {
+            entries.push({ id: line.slice(0, atIndex), version: line.slice(atIndex + 1) });
+        }
+        else {
+            entries.push({ id: line });
+        }
+    }
+    return entries;
+}

package/dist/vscode/install.js

@@ -0,0 +1,177 @@
+/**
+ * `pibo vscode install` — install the Pibo VS Code extension.
+ *
+ * Resolution order for the VSIX artifact:
+ *  1. `--vsix <path>`     → use the local file directly
+ *  2. `--from-url <url>`  → download from the given URL
+ *  3. default             → fetch the latest GitHub Release for the repo and
+ *                            use its `.vsix` asset (optionally pinned by
+ *                            `--version <tag>`)
+ *
+ * The resolved VSIX is cached under `~/.pibo/vscode/cache/<tagName>/` so
+ * repeated installs do not re-download.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { detectCodeBinary, listInstalledExtensions, runCodeCommand } from "./code-cli.js";
+import { downloadVsixAsset, fetchLatestVsix, isVsixAsset } from "./vsix-fetcher.js";
+import { DEFAULT_GITHUB_OWNER, DEFAULT_GITHUB_REPO, PIBO_VSCODE_CACHE_DIR, PIBO_VSCODE_EXTENSION_ID, } from "./types.js";
+import { findVsixAsset, fetchRelease } from "./vsix-fetcher.js";
+const DEFAULT_LOG = (message) => {
+    console.log(message);
+};
+const DEFAULT_ERROR = (message) => {
+    process.stderr.write(`${message}\n`);
+};
+function getCacheDir(options) {
+    if (options.cacheDir)
+        return options.cacheDir;
+    const base = options.env?.PIBO_HOME ?? join(homedir(), ".pibo");
+    return join(base, PIBO_VSCODE_CACHE_DIR, "cache");
+}
+function cacheKeyForVersion(tagName) {
+    return tagName.replace(/[^A-Za-z0-9._-]/g, "_");
+}
+function readCachedVsix(cacheDir, tagName) {
+    const dir = join(cacheDir, cacheKeyForVersion(tagName));
+    const path = join(dir, "pibo.vsix");
+    return existsSync(path) ? path : undefined;
+}
+function writeCachedVsix(cacheDir, tagName, bytes) {
+    const dir = join(cacheDir, cacheKeyForVersion(tagName));
+    mkdirSync(dir, { recursive: true });
+    const path = join(dir, "pibo.vsix");
+    writeFileSync(path, bytes);
+    return path;
+}
+function cachedTagManifestPath(cacheDir) {
+    return join(cacheDir, "last-installed.json");
+}
+function readCachedTagManifest(cacheDir) {
+    const path = cachedTagManifestPath(cacheDir);
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const json = JSON.parse(readFileSync(path, "utf8"));
+        return json;
+    }
+    catch {
+        return undefined;
+    }
+}
+function writeCachedTagManifest(cacheDir, tagName, vsixPath) {
+    const path = cachedTagManifestPath(cacheDir);
+    mkdirSync(cacheDir, { recursive: true });
+    writeFileSync(path, JSON.stringify({ tagName, vsixPath, installedAt: new Date().toISOString() }, null, 2));
+}
+export async function resolveVsixArtifact(options) {
+    if (options.vsixPath) {
+        const absolute = resolve(options.vsixPath);
+        if (!existsSync(absolute)) {
+            throw new Error(`VSIX file not found at ${absolute}`);
+        }
+        return { tagName: "local", vsixPath: absolute };
+    }
+    if (!options.skipCache && !options.version) {
+        const cachedTag = readCachedTagManifest(options.cacheDir);
+        if (cachedTag?.tagName && cachedTag.vsixPath && existsSync(cachedTag.vsixPath)) {
+            return { tagName: cachedTag.tagName, vsixPath: cachedTag.vsixPath };
+        }
+    }
+    if (options.fromUrl) {
+        const release = await fetchRelease({ owner: options.owner, repo: options.repo, fetchImpl: options.fetchImpl });
+        const asset = findVsixAsset(release) ?? { name: "remote.vsix", browserDownloadUrl: options.fromUrl, size: 0, contentType: "application/octet-stream" };
+        const bytes = await downloadVsixAsset({ url: options.fromUrl, fetchImpl: options.fetchImpl });
+        const cachedPath = writeCachedVsix(options.cacheDir, release.tagName, bytes);
+        return { tagName: release.tagName, vsixPath: cachedPath, bytes };
+    }
+    const result = await fetchLatestVsix({
+        owner: options.owner,
+        repo: options.repo,
+        tagName: options.version,
+        fetchImpl: options.fetchImpl,
+    });
+    if (!options.skipCache) {
+        const cached = readCachedVsix(options.cacheDir, result.tagName);
+        if (cached)
+            return { tagName: result.tagName, vsixPath: cached };
+    }
+    const cachedPath = writeCachedVsix(options.cacheDir, result.tagName, result.bytes);
+    return { tagName: result.tagName, vsixPath: cachedPath, bytes: result.bytes };
+}
+export async function runInstall(options) {
+    const log = options.log ?? DEFAULT_LOG;
+    const errorLog = options.error ?? DEFAULT_ERROR;
+    const owner = options.owner ?? DEFAULT_GITHUB_OWNER;
+    const repo = options.repo ?? DEFAULT_GITHUB_REPO;
+    const cacheDir = getCacheDir(options);
+    const detected = detectCodeBinary({ env: options.env });
+    if (!detected) {
+        const message = `No VS Code CLI found on PATH. Install VS Code (https://code.visualstudio.com/) and run 'Shell Command: Install code command in PATH' from the VS Code command palette.`;
+        errorLog(message);
+        return { status: "failed", reason: "no-code-cli" };
+    }
+    let artifact;
+    try {
+        artifact = await resolveVsixArtifact({
+            vsixPath: options.vsixPath,
+            fromUrl: options.fromUrl,
+            version: options.version,
+            owner,
+            repo,
+            fetchImpl: options.fetchImpl,
+            cacheDir,
+            skipCache: options.skipCache,
+        });
+    }
+    catch (fetchError) {
+        const reason = fetchError instanceof Error ? fetchError.message : String(fetchError);
+        errorLog(`Failed to obtain VSIX: ${reason}`);
+        return { status: "failed", reason };
+    }
+    log(`Installing pibo VS Code extension ${artifact.tagName} from ${artifact.vsixPath} via ${detected.path}…`);
+    let installResult;
+    try {
+        installResult = await runCodeCommand({
+            binary: detected.path,
+            args: ["--install-extension", artifact.vsixPath, "--force"],
+            spawnImpl: options.spawnImpl,
+            env: options.env,
+            timeoutMs: 120_000,
+        });
+    }
+    catch (spawnError) {
+        const reason = spawnError instanceof Error ? spawnError.message : String(spawnError);
+        errorLog(`Failed to invoke ${detected.binary}: ${reason}`);
+        return { status: "failed", reason, codeBinary: detected.path, tagName: artifact.tagName };
+    }
+    if (installResult.exitCode !== 0) {
+        const reason = `code --install-extension exited with code ${installResult.exitCode}: ${installResult.stderr || installResult.stdout}`;
+        errorLog(reason);
+        return { status: "failed", reason, codeBinary: detected.path, tagName: artifact.tagName };
+    }
+    writeCachedTagManifest(cacheDir, artifact.tagName, artifact.vsixPath);
+    try {
+        const installed = await listInstalledExtensions({
+            binary: detected.path,
+            spawnImpl: options.spawnImpl,
+            env: options.env,
+        });
+        const ours = installed.find((entry) => entry.id === PIBO_VSCODE_EXTENSION_ID);
+        if (ours) {
+            log(`Installed ${ours.id}@${ours.version ?? "?"} via ${detected.path}`);
+        }
+        else {
+            log(`code --install-extension reported success but ${PIBO_VSCODE_EXTENSION_ID} is not in the installed list.`);
+        }
+    }
+    catch (listError) {
+        // Listing the installed extensions is a best-effort check; do not fail the install on a listing error.
+        const reason = listError instanceof Error ? listError.message : String(listError);
+        log(`Install completed; failed to verify via --list-extensions: ${reason}`);
+    }
+    return { status: "installed", tagName: artifact.tagName, vsixPath: artifact.vsixPath, codeBinary: detected.path };
+}
+// Re-export for symmetry with code-cli.ts consumers.
+export { isVsixAsset };

package/dist/vscode/status.js

@@ -0,0 +1,80 @@
+/**
+ * `pibo vscode status` — report whether the Pibo VS Code extension is
+ * installed, the local VS Code CLI binary, and the cached VSIX artifacts.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { detectCodeBinary, listInstalledExtensions } from "./code-cli.js";
+import { fetchRelease } from "./vsix-fetcher.js";
+import { DEFAULT_GITHUB_OWNER, DEFAULT_GITHUB_REPO, PIBO_VSCODE_CACHE_DIR, PIBO_VSCODE_EXTENSION_ID, } from "./types.js";
+function getCacheDir(options) {
+    if (options.cacheDir)
+        return options.cacheDir;
+    const base = options.env?.PIBO_HOME ?? join(homedir(), ".pibo");
+    return join(base, PIBO_VSCODE_CACHE_DIR, "cache");
+}
+function listCachedReleases(cacheDir, limit) {
+    if (!existsSync(cacheDir))
+        return [];
+    const entries = readdirSync(cacheDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && entry.name !== "node_modules")
+        .map((entry) => ({ name: entry.name, mtimeMs: statSync(join(cacheDir, entry.name)).mtimeMs }))
+        .sort((a, b) => b.mtimeMs - a.mtimeMs)
+        .slice(0, limit)
+        .map((entry) => entry.name);
+    return entries;
+}
+export async function runStatus(options = {}) {
+    const owner = options.owner ?? DEFAULT_GITHUB_OWNER;
+    const repo = options.repo ?? DEFAULT_GITHUB_REPO;
+    const cacheDir = getCacheDir(options);
+    const limit = options.limit ?? 5;
+    const detected = detectCodeBinary({ env: options.env });
+    let installed = false;
+    let version;
+    if (detected) {
+        try {
+            const installedExtensions = await listInstalledExtensions({
+                binary: detected.path,
+                spawnImpl: options.spawnImpl,
+                env: options.env,
+            });
+            const ours = installedExtensions.find((entry) => entry.id === PIBO_VSCODE_EXTENSION_ID);
+            if (ours) {
+                installed = true;
+                version = ours.version;
+            }
+        }
+        catch {
+            // Listing failed; treat as not-installed for status purposes.
+            installed = false;
+        }
+    }
+    const cachedReleases = listCachedReleases(cacheDir, limit);
+    let availableReleases = [];
+    try {
+        const release = await fetchRelease({ owner, repo, fetchImpl: options.fetchImpl });
+        availableReleases = [release.tagName];
+    }
+    catch {
+        // Network failure is non-fatal for status.
+    }
+    return {
+        installed,
+        version,
+        codeBinary: detected?.path,
+        vsixCacheDir: cacheDir,
+        availableReleases,
+    };
+}
+export function formatStatusText(status) {
+    const lines = [];
+    lines.push(`extension: ${status.installed ? `${PIBO_VSCODE_EXTENSION_ID}@${status.version ?? "?"}` : "not installed"}`);
+    lines.push(`code binary: ${status.codeBinary ?? "(not on PATH)"}`);
+    lines.push(`vsix cache: ${status.vsixCacheDir}`);
+    if (status.availableReleases.length > 0) {
+        lines.push(`latest release: ${status.availableReleases[0]}`);
+    }
+    return lines.join("\n");
+}

package/dist/vscode/types.js

@@ -0,0 +1,14 @@
+/**
+ * Types and constants for the `pibo vscode` sub-command.
+ *
+ * The pibo VS Code extension is a thin VS Code client that opens a WebView
+ * pointing at the gateway-served chat-vscode-web app. The extension itself
+ * ships as a `.vsix` artifact, published to the VS Code Marketplace and
+ * mirrored on GitHub Releases.
+ */
+export const PIBO_VSCODE_EXTENSION_PUBLISHER = "pibo";
+export const PIBO_VSCODE_EXTENSION_NAME = "pibo-vscode";
+export const PIBO_VSCODE_EXTENSION_ID = `${PIBO_VSCODE_EXTENSION_PUBLISHER}.${PIBO_VSCODE_EXTENSION_NAME}`;
+export const DEFAULT_GITHUB_OWNER = "Pascapone";
+export const DEFAULT_GITHUB_REPO = "pibo";
+export const PIBO_VSCODE_CACHE_DIR = "vscode";

package/dist/vscode/uninstall.js

@@ -0,0 +1,49 @@
+/**
+ * `pibo vscode uninstall` — remove the installed Pibo VS Code extension.
+ */
+import { detectCodeBinary, runCodeCommand } from "./code-cli.js";
+import { PIBO_VSCODE_EXTENSION_ID } from "./types.js";
+const DEFAULT_LOG = (message) => {
+    console.log(message);
+};
+const DEFAULT_ERROR = (message) => {
+    process.stderr.write(`${message}\n`);
+};
+export async function runUninstall(options = {}) {
+    const log = options.log ?? DEFAULT_LOG;
+    const errorLog = options.error ?? DEFAULT_ERROR;
+    const detected = detectCodeBinary({ env: options.env });
+    if (!detected) {
+        errorLog(`No VS Code CLI found on PATH.`);
+        return { status: "failed", reason: "no-code-cli" };
+    }
+    log(`Uninstalling ${PIBO_VSCODE_EXTENSION_ID} via ${detected.path}…`);
+    let result;
+    try {
+        result = await runCodeCommand({
+            binary: detected.path,
+            args: ["--uninstall-extension", PIBO_VSCODE_EXTENSION_ID],
+            spawnImpl: options.spawnImpl,
+            env: options.env,
+            timeoutMs: 60_000,
+        });
+    }
+    catch (spawnError) {
+        const reason = spawnError instanceof Error ? spawnError.message : String(spawnError);
+        errorLog(`Failed to invoke ${detected.binary}: ${reason}`);
+        return { status: "failed", reason, codeBinary: detected.path };
+    }
+    if (result.exitCode !== 0) {
+        const stderr = result.stderr || result.stdout;
+        // VS Code returns a non-zero exit when the extension is not installed; treat that as "not-installed".
+        if (/not found|not installed|Cannot find extension/i.test(stderr)) {
+            log(`${PIBO_VSCODE_EXTENSION_ID} was not installed.`);
+            return { status: "not-installed", codeBinary: detected.path };
+        }
+        const reason = `code --uninstall-extension exited with code ${result.exitCode}: ${stderr}`;
+        errorLog(reason);
+        return { status: "failed", reason, codeBinary: detected.path };
+    }
+    log(`Uninstalled ${PIBO_VSCODE_EXTENSION_ID}`);
+    return { status: "uninstalled", codeBinary: detected.path };
+}

package/dist/vscode/vsix-fetcher.js

@@ -0,0 +1,131 @@
+/**
+ * GitHub Releases interaction for the Pibo VS Code extension.
+ *
+ * `pibo vscode install` defaults to fetching the latest VSIX asset from a
+ * GitHub Release. The fetch path is pure-functional so the install command
+ * can inject a mocked fetch and a mocked spawn in tests.
+ */
+export class VsixFetchError extends Error {
+    cause;
+    constructor(message, options) {
+        super(message);
+        this.name = "VsixFetchError";
+        if (options?.cause !== undefined)
+            this.cause = options.cause;
+    }
+}
+const VSIX_ASSET_PATTERN = /\.vsix$/i;
+export function isVsixAsset(asset) {
+    return VSIX_ASSET_PATTERN.test(asset.name);
+}
+export function findVsixAsset(release) {
+    return release.assets.find(isVsixAsset);
+}
+const GITHUB_API_ROOT = "https://api.github.com";
+function buildReleaseUrl(owner, repo, tagName) {
+    const base = `${GITHUB_API_ROOT}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases`;
+    if (tagName)
+        return `${base}/tags/${encodeURIComponent(tagName)}`;
+    return `${base}/latest`;
+}
+function parseRelease(payload) {
+    if (typeof payload !== "object" || payload === null) {
+        throw new VsixFetchError("GitHub Releases payload is not an object");
+    }
+    const record = payload;
+    const tagName = record.tag_name;
+    const name = record.name;
+    const publishedAt = record.published_at;
+    const htmlUrl = record.html_url;
+    const rawAssets = record.assets;
+    if (typeof tagName !== "string" || typeof name !== "string" || typeof publishedAt !== "string" || typeof htmlUrl !== "string") {
+        throw new VsixFetchError("GitHub Releases payload is missing required string fields");
+    }
+    if (!Array.isArray(rawAssets)) {
+        throw new VsixFetchError("GitHub Releases payload is missing assets array");
+    }
+    const assets = [];
+    for (const raw of rawAssets) {
+        if (typeof raw !== "object" || raw === null)
+            continue;
+        const r = raw;
+        if (typeof r.name === "string" &&
+            typeof r.browser_download_url === "string" &&
+            typeof r.size === "number" &&
+            typeof r.content_type === "string") {
+            assets.push({
+                name: r.name,
+                browserDownloadUrl: r.browser_download_url,
+                size: r.size,
+                contentType: r.content_type,
+            });
+        }
+    }
+    return { tagName, name, publishedAt, htmlUrl, assets };
+}
+export async function fetchRelease(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const url = buildReleaseUrl(options.owner, options.repo, options.tagName);
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            headers: { accept: "application/vnd.github+json", "user-agent": "pibo-cli" },
+        });
+    }
+    catch (error) {
+        throw new VsixFetchError(`Failed to call GitHub Releases API at ${url}`, { cause: error });
+    }
+    if (response.status === 404) {
+        throw new VsixFetchError(options.tagName
+            ? `GitHub release ${options.owner}/${options.repo}@${options.tagName} not found`
+            : `GitHub repository ${options.owner}/${options.repo} has no published releases`);
+    }
+    if (!response.ok) {
+        throw new VsixFetchError(`GitHub Releases API returned HTTP ${response.status}`);
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch (error) {
+        throw new VsixFetchError("GitHub Releases response was not valid JSON", { cause: error });
+    }
+    return parseRelease(payload);
+}
+export async function downloadVsixAsset(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const maxBytes = options.maxBytes ?? 64 * 1024 * 1024; // 64 MiB
+    let response;
+    try {
+        response = await fetchImpl(options.url, { headers: { "user-agent": "pibo-cli" } });
+    }
+    catch (error) {
+        throw new VsixFetchError(`Failed to download VSIX from ${options.url}`, { cause: error });
+    }
+    if (!response.ok) {
+        throw new VsixFetchError(`VSIX download returned HTTP ${response.status}`);
+    }
+    const arrayBuffer = await response.arrayBuffer();
+    if (arrayBuffer.byteLength > maxBytes) {
+        throw new VsixFetchError(`VSIX download is ${arrayBuffer.byteLength} bytes, exceeding limit of ${maxBytes} bytes`);
+    }
+    return Buffer.from(arrayBuffer);
+}
+export async function fetchLatestVsix(options) {
+    const release = await fetchRelease({
+        owner: options.owner,
+        repo: options.repo,
+        tagName: options.tagName,
+        fetchImpl: options.fetchImpl,
+    });
+    const asset = findVsixAsset(release);
+    if (!asset) {
+        throw new VsixFetchError(`Release ${release.tagName} has no .vsix asset`);
+    }
+    const bytes = await downloadVsixAsset({
+        url: asset.browserDownloadUrl,
+        maxBytes: options.maxBytes,
+        fetchImpl: options.fetchImpl,
+    });
+    return { tagName: release.tagName, asset, bytes };
+}

package/dist/web/channel.js

@@ -6,6 +6,15 @@ import { PiboWebHttpError, nodeRequestToWebRequest, responseHtml, responseJson,
 export const DEFAULT_WEB_CHANNEL_HOST = "127.0.0.1";
 export const DEFAULT_WEB_CHANNEL_PORT = 4788;
 export const WEB_CHANNEL_NAME = "web-host";
+/**
+ * Internal header that carries the TCP socket peer address from the web host
+ * channel to the auth plugin. This is one of three independent safety layers
+ * for the local auth service (see `docs/specs/capabilities/web-auth-and-same-origin-host.md`
+ * REQ-010). The header is added on the request side by the channel and MUST
+ * be stripped from any response by `sendWebResponse` so it never reaches the
+ * browser.
+ */
+export const SOCKET_PEER_HEADER = "x-pibo-socket-peer";
 function redirect(location) {
     return new Response(null, {
         status: 302,
@@ -33,6 +42,41 @@ function firstHeaderValue(value) {
 function isLoopbackAddress(address) {
     return address === "::1" || address === "127.0.0.1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
 }
+/**
+ * Return a new Request that includes the TCP socket peer address in the
+ * `x-pibo-socket-peer` header. The body is preserved via the request body
+ * stream consumed into a buffer because the original Request is not cloneable
+ * once the body has been read.
+ */
+function withSocketPeerHeader(request, peerAddress) {
+    const headers = new Headers(request.headers);
+    if (peerAddress)
+        headers.set(SOCKET_PEER_HEADER, peerAddress);
+    return new Request(request.url, {
+        method: request.method,
+        headers,
+        body: request.body,
+        duplex: "half",
+        redirect: request.redirect,
+        signal: request.signal,
+    });
+}
+/**
+ * Strip the internal socket peer header from a Response so it never reaches
+ * the browser. Auth plugins that accidentally echo the header will not leak
+ * the TCP peer information to the client.
+ */
+export function stripSocketPeerHeaderFromResponse(response) {
+    if (!response.headers.has(SOCKET_PEER_HEADER))
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete(SOCKET_PEER_HEADER);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
 function createRequestBaseURL(nodeRequest, host, port) {
     if (isLoopbackAddress(nodeRequest.socket.remoteAddress)) {
         const forwardedHost = firstHeaderValue(nodeRequest.headers["x-forwarded-host"]);
@@ -163,7 +207,9 @@ export function createWebHostChannel(options = {}) {
                 return;
             }
             if (url.pathname.startsWith("/api/auth/")) {
-                await sendWebResponse(nodeResponse, await handleAuthRequest(request));
+                const authRequest = withSocketPeerHeader(request, nodeRequest.socket.remoteAddress);
+                const authResponse = stripSocketPeerHeaderFromResponse(await handleAuthRequest(authRequest));
+                await sendWebResponse(nodeResponse, authResponse);
                 return;
             }
             const ctx = requireContext();

package/dist/web/http.js

@@ -1,6 +1,7 @@
 import { gzipSync } from "node:zlib";
 export const MAX_WEB_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
 const MIN_COMPRESS_RESPONSE_BYTES = 1024;
+const INTERNAL_SOCKET_PEER_HEADER = "x-pibo-socket-peer";
 export class PiboWebHttpError extends Error {
     statusCode;
     constructor(message, statusCode) {
@@ -115,9 +116,11 @@ function responseHeaders(webResponse) {
     const headers = {};
     const setCookie = webResponse.headers.getSetCookie?.();
     webResponse.headers.forEach((value, key) => {
-        if (key.toLowerCase() !== "set-cookie") {
-            headers[key] = value;
-        }
+        if (key.toLowerCase() === "set-cookie")
+            return;
+        if (key.toLowerCase() === INTERNAL_SOCKET_PEER_HEADER)
+            return;
+        headers[key] = value;
     });
     if (setCookie?.length) {
         headers["set-cookie"] = setCookie;