@pasko70/pibo 1.3.0 → 1.3.2

package/dist/apps/chat-ui/index.html

@@ -9,7 +9,7 @@
     <link rel="manifest" href="/apps/chat/manifest.webmanifest" />
     <link rel="apple-touch-icon" href="/apps/chat/assets/pwa-images/ios/180.png" />
     <title>Pibo Web Chat</title>
-    <script type="module" crossorigin src="/apps/chat/assets/index-CUkuvI3v.js"></script>
+    <script type="module" crossorigin src="/apps/chat/assets/index-CmxtUVG1.js"></script>
     <link rel="modulepreload" crossorigin href="/apps/chat/assets/rolldown-runtime-S-ySWqyJ.js">
     <link rel="modulepreload" crossorigin href="/apps/chat/assets/dist-SVPsM5Oi.js">
     <link rel="stylesheet" crossorigin href="/apps/chat/assets/index-C25VYnyb.css">

package/dist/cli.js

@@ -37,6 +37,10 @@ function parsePositiveInteger(value) {
     }
     return parsed;
 }
+function isLoopbackBindForCli(host) {
+    const normalized = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
+}
 export async function runPiboCli(argv = process.argv) {
     if (argv[2] === "--help" || argv[2] === "-h") {
         printRootDiscovery();
@@ -341,11 +345,21 @@ export async function runPiboCli(argv = process.argv) {
     program
         .command("gateway:web")
         .description("Start the authenticated web gateway")
+        .option("--auth <mode>", "Auth service mode: 'better-auth' (default) or 'local' (loopback-only, no Google OAuth)")
         .option("--web-host <host>", "Bind the HTTP web host, for example 0.0.0.0 for LAN access")
         .option("--web-port <port>", "Bind the HTTP web host port", parsePort)
         .action(async (options) => {
         const { runWebGatewayServer } = await import("./gateway/web.js");
+        const authMode = options.auth;
+        if (authMode !== undefined && authMode !== "better-auth" && authMode !== "local") {
+            throw new Error(`--auth must be 'better-auth' or 'local', got '${authMode}'`);
+        }
+        if (authMode === "local" && options.webHost !== undefined && !isLoopbackBindForCli(options.webHost)) {
+            throw new Error(`--auth=local requires a loopback bind (127.0.0.1, ::1, or localhost). Got --web-host='${options.webHost}'. ` +
+                "Either drop --web-host or pick --auth=better-auth for a public bind.");
+        }
         await runWebGatewayServer({
+            authMode: authMode,
             web: {
                 host: options.webHost,
                 port: options.webPort,
@@ -387,7 +401,7 @@ Commands:
   tui:routed   Start the local routed Pibo TUI
   tui:sessions  Start the reduced Web Chat-derived session UI
   gateway      Inspect and restart host gateways through safe CLI commands
-  gateway:web  Start a web gateway runtime
+  gateway:web  Start a web gateway runtime (use --auth=local for loopback-only local auth)
 
 Next:
   pibo <command> --help

package/dist/config/config.js

@@ -43,6 +43,12 @@ export const PIBO_CONFIG_KEYS = [
         type: "string",
         description: "SQLite path for Better Auth data.",
     },
+    {
+        key: "auth.mode",
+        type: "string",
+        description: "Auth service mode. Use 'local' to skip Google OAuth on a loopback bind. Default 'better-auth'.",
+        values: ["better-auth", "local"],
+    },
 ];
 function getKeyDefinition(key) {
     const definition = PIBO_CONFIG_KEYS.find((candidate) => candidate.key === key);
@@ -78,6 +84,9 @@ function parseConfigValue(definition, value) {
     if (definition.key === "auth.secret" && value.length < 32) {
         throw new Error("auth.secret must be at least 32 characters");
     }
+    if (definition.values && !definition.values.includes(value)) {
+        throw new Error(`${definition.key} must be one of: ${definition.values.join(", ")}`);
+    }
     return value;
 }
 function assertObject(value) {

package/dist/core/context-build.js

@@ -243,6 +243,29 @@ async function readSkillMarkdown(path) {
         return undefined;
     }
 }
+// Skills are advertised to the model via a small XML summary in the system
+// prompt (see formatSkillsForPrompt in @mariozechner/pi-coding-agent). Only the
+// name, description, and location land in the prompt; the full SKILL.md body
+// is loaded lazily by the model via the read tool. Mirror that exact
+// per-skill entry shape here so the inspector's token estimate matches what
+// the model actually sees, instead of the full markdown body.
+function escapeXmlAttribute(value) {
+    return value
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&apos;");
+}
+function formatSkillEntryForPrompt(skill) {
+    return [
+        "  <skill>",
+        `    <name>${escapeXmlAttribute(skill.name)}</name>`,
+        `    <description>${escapeXmlAttribute(skill.description)}</description>`,
+        `    <location>${escapeXmlAttribute(skill.filePath)}</location>`,
+        "  </skill>",
+    ].join("\n");
+}
 function diagnosticsNodes(diagnostics) {
     return diagnostics.map((diagnostic, index) => ({
         id: `diagnostics/${index}`,
@@ -516,20 +539,31 @@ export async function inspectPiboContextBuild(options = {}) {
         const skillChildren = [];
         for (const skill of skills) {
             const markdown = await readSkillMarkdown(skill.filePath);
+            const promptEntry = formatSkillEntryForPrompt(skill);
+            // The skill node reports only what is actually part of the model
+            // prompt: the formatted <skill>...</skill> entry. The full
+            // SKILL.md body is loaded lazily by the model via the read tool
+            // (or explicitly via /skill:name / $skill-name), so it must not
+            // inflate the model-context token estimate. The full file path
+            // and size are still surfaced via metadata for inspection.
             skillChildren.push({
                 id: `skills/${skill.name}`,
                 kind: "skill",
                 title: skill.name,
                 source: "plugin",
                 path: skill.filePath,
-                bytes: markdown ? byteLength(markdown) : undefined,
+                bytes: byteLength(promptEntry),
                 badges: ["ACTIVE"],
                 metadata: {
                     description: skill.description,
                     filePath: skill.filePath,
                     disableModelInvocation: skill.disableModelInvocation,
+                    fullFileBytes: markdown ? byteLength(markdown) : undefined,
+                    fullFileLoadableBy: "read tool, /skill:name command, $skill-name inline expansion",
                 },
-                hydratedText: markdown ?? `Skill metadata is loaded, but ${skill.filePath} could not be read for inspection.`,
+                hydratedText: markdown === undefined
+                    ? `Skill metadata is loaded, but ${skill.filePath} could not be read for inspection.`
+                    : promptEntry,
                 state: markdown ? "active" : "warning",
             });
         }

package/dist/core/wsl.js

@@ -0,0 +1,100 @@
+import { readFileSync, existsSync } from "node:fs";
+/**
+ * Pure parser for the WSL release string.
+ *
+ * WSL2 kernels report strings like:
+ *   "5.15.90.1-microsoft-standard-WSL2"
+ *   "5.15.0-1054-azure-wsl2"
+ * WSL1 kernels report:
+ *   "4.4.0-19041-Microsoft"
+ *
+ * Returns true when the string looks like a WSL kernel release.
+ */
+export function parseWslRelease(release) {
+    if (!release)
+        return false;
+    return /\b(microsoft|wsl2?)\b/i.test(release);
+}
+/**
+ * Pure parser that extracts the WSL major version (1 or 2) from a release string.
+ * Returns undefined when the string is not WSL or the version cannot be determined.
+ */
+export function parseWslVersion(release) {
+    if (!release)
+        return undefined;
+    if (!parseWslRelease(release))
+        return undefined;
+    // WSL2 explicitly mentions "WSL2" (with digit) in the osrelease.
+    // WSL1 mentions "Microsoft" without the digit.
+    if (/\bwsl2\b/i.test(release))
+        return 2;
+    // Some WSL2 kernels do not include the literal "WSL2" token; the kernel
+    // version alone is not a reliable signal because WSL1 also exists. We
+    // require the WSL2 marker or the "microsoft-standard-WSL2" suffix to claim
+    // WSL2; otherwise default to WSL1 when WSL is detected.
+    return 1;
+}
+/**
+ * Pure parser for /etc/os-release PRETTY_NAME. Returns undefined when the file
+ * is not the standard os-release format or cannot be parsed.
+ */
+export function parseDistroFromOsRelease(contents) {
+    if (!contents)
+        return undefined;
+    const match = contents.match(/^PRETTY_NAME=(.+)$/m);
+    if (!match)
+        return undefined;
+    const raw = match[1]?.trim();
+    if (!raw)
+        return undefined;
+    const unquoted = raw.replace(/^["']|["']$/g, "");
+    return unquoted.length > 0 ? unquoted : undefined;
+}
+function readProcOsRelease() {
+    try {
+        return readFileSync("/proc/sys/kernel/osrelease", "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function readEtcOsRelease() {
+    try {
+        return readFileSync("/etc/os-release", "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function detectWindowsMount() {
+    return existsSync("/mnt/c") || existsSync("/mnt/wsl");
+}
+/**
+ * Detect whether the current process is running inside a WSL distribution.
+ * Returns true on WSL1 and WSL2.
+ */
+export function isWsl() {
+    return parseWslRelease(readProcOsRelease());
+}
+/**
+ * Return structured WSL information for the current process. Safe to call on
+ * any platform; non-WSL hosts return { isWsl: false, version: undefined, ... }.
+ */
+export function getWslInfo() {
+    const release = readProcOsRelease();
+    const isWslResult = parseWslRelease(release);
+    if (!isWslResult) {
+        return {
+            isWsl: false,
+            version: undefined,
+            distro: undefined,
+            hasWindowsMount: false,
+        };
+    }
+    return {
+        isWsl: true,
+        version: parseWslVersion(release),
+        distro: parseDistroFromOsRelease(readEtcOsRelease()),
+        hasWindowsMount: detectWindowsMount(),
+    };
+}

package/dist/gateway/web.js

@@ -26,22 +26,61 @@ function isDockerRuntime() {
         return false;
     }
 }
+export function isLoopbackHost(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+    return LOOPBACK_HOSTS.has(normalized);
+}
+function bindHost(options) {
+    return options.web?.host ?? DEFAULT_WEB_CHANNEL_HOST;
+}
+function requireLocalAuthBind(options) {
+    const host = bindHost(options);
+    if (isLoopbackHost(host))
+        return;
+    if (isDockerRuntime()) {
+        console.error(`[pibo] WARNING: local auth is active in a Docker worker with bind ${host}. ` +
+            "The Docker network is the security boundary; ensure the host port mapping is loopback-only.");
+        return;
+    }
+    throw new Error(`Local auth requires a loopback bind (127.0.0.1, ::1, or localhost). Got '${host}'. ` +
+        "Either drop --web-host or pick authMode=better-auth for a public bind.");
+}
+function localAuthStartupWarning(options) {
+    const host = bindHost(options);
+    console.error(`[pibo] LOCAL AUTH ENABLED — bound to ${host}. ` +
+        "This mode is unsafe if the port is reachable from the public internet. " +
+        "Use authMode=better-auth for production deployments.");
+}
 export function resolveWebGatewayAuthMode(options = {}) {
-    if (!options.devAuth) {
-        if (process.env.PIBO_DEV_AUTH === "1") {
-            throw new Error("PIBO_DEV_AUTH no longer activates dev auth for gateway:web; use the Docker worker entrypoint instead.");
-        }
-        return "better-auth";
+    const configMode = loadPiboConfig().auth?.mode;
+    const explicit = options.authMode;
+    const legacyDevAuth = options.devAuth === true;
+    if (process.env.PIBO_DEV_AUTH === "1") {
+        throw new Error("PIBO_DEV_AUTH is deprecated. Use `pibo gateway:web --auth=local --web-host=127.0.0.1` on the host, " +
+            "or rely on the Docker worker entrypoint inside a worker.");
     }
-    if (!isDockerRuntime()) {
-        throw new Error("Pibo dev auth can only be enabled inside a Docker worker runtime.");
+    if (explicit === "local" || legacyDevAuth || configMode === "local") {
+        requireLocalAuthBind(options);
+        localAuthStartupWarning(options);
+        return "dev-auth";
     }
-    return "dev-auth";
+    if (explicit === "better-auth" || configMode === "better-auth") {
+        return "better-auth";
+    }
+    return "better-auth";
 }
 function authBaseURL(options) {
     return options.auth?.baseURL ?? loadPiboConfig().auth?.baseURL;
 }
-function defaultWebHost(baseURL) {
+function defaultWebHost(baseURL, options = {}) {
+    // When local auth is selected, always default to loopback bind to keep the
+    // loopback-bind gate trivially satisfied. The user can still override
+    // --web-host, but `resolveWebGatewayAuthMode` will then enforce the gate.
+    const mode = options.authMode ?? loadPiboConfig().auth?.mode ?? "better-auth";
+    if (mode === "local" && options.web?.host === undefined)
+        return DEFAULT_WEB_CHANNEL_HOST;
     if (!baseURL)
         return DEFAULT_WEB_CHANNEL_HOST;
     try {
@@ -58,7 +97,7 @@ export function resolveWebGatewayServerOptions(options = {}) {
         ...options,
         web: {
             ...options.web,
-            host: options.web?.host ?? defaultWebHost(baseURL),
+            host: options.web?.host ?? defaultWebHost(baseURL, options),
         },
     };
 }
@@ -96,7 +135,8 @@ export function createWebPiboPluginRegistry(options = {}) {
     });
 }
 function createChatAppURL(options, host, port) {
-    if (options.devAuth) {
+    const useLocalAuth = options.authMode === "local" || options.devAuth === true || loadPiboConfig().auth?.mode === "local";
+    if (useLocalAuth) {
         return `http://${host}:${port}/apps/chat`;
     }
     const baseURL = options.auth?.baseURL ?? loadPiboConfig().auth?.baseURL;

package/dist/plugins/dev-auth.js

@@ -1,5 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { definePiboPlugin } from "./registry.js";
+import { SOCKET_PEER_HEADER } from "../web/channel.js";
 const COOKIE_NAME = "pibo_dev_session";
 const COOKIE_MAX_AGE = 60 * 60 * 24 * 7; // 7 days
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
@@ -33,12 +34,50 @@ function isLoopbackHost(value) {
         return false;
     }
 }
+function isLoopbackSocketAddress(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+    return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.");
+}
+/**
+ * Read the TCP socket peer address attached to the request by the web host
+ * channel via the `x-pibo-socket-peer` header. The header is internal and
+ * stripped from any outgoing response, so it can be trusted.
+ */
+export function getSocketPeerForDevAuth(request) {
+    return firstHeaderValue(request.headers.get(SOCKET_PEER_HEADER));
+}
+/**
+ * Check whether the TCP socket peer attached by the channel is loopback.
+ * Returns `false` (fail-closed) when the header is missing, so a request
+ * that did not flow through the web host channel is never accepted.
+ */
+export function isLoopbackSocketPeerForDevAuth(request) {
+    return isLoopbackSocketAddress(getSocketPeerForDevAuth(request));
+}
 export function isLoopbackDevAuthRequest(request) {
     const host = firstHeaderValue(request.headers.get("host"));
     const forwardedHost = firstHeaderValue(request.headers.get("x-forwarded-host"));
     return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
 }
-function createDevAuthService() {
+/**
+ * Headers-only variants of the loopback predicates so `getSession` can
+ * evaluate the same checks without holding on to the full `Request`
+ * object. `getSession` is part of the auth service contract and only
+ * receives `headers`, but the channel guarantees that the same
+ * `host`, `x-forwarded-host`, and `x-pibo-socket-peer` headers are
+ * present as they would be on a full `Request`.
+ */
+export function isLoopbackDevAuthHeaders(headers) {
+    const host = firstHeaderValue(headers.get("host"));
+    const forwardedHost = firstHeaderValue(headers.get("x-forwarded-host"));
+    return isLoopbackHost(host) && (!forwardedHost || isLoopbackHost(forwardedHost));
+}
+export function isLoopbackSocketPeerForDevAuthHeaders(headers) {
+    return isLoopbackSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
+}
+export function createDevAuthService() {
     const containerToken = generateToken();
     const debugSession = {
         identity: {
@@ -58,6 +97,16 @@ function createDevAuthService() {
         },
         stop() { },
         async getSession(headers) {
+            // In local auth mode the loopback bind is the real security
+            // boundary. Once the channel has confirmed that the request
+            // reached us from a loopback host and a loopback TCP socket
+            // peer, the caller is on the same host as the gateway and
+            // there is no cookie jar to share. Headless clients (VS Code
+            // extension, CLI scripts) can use the same dev identity as the
+            // browser without needing the HttpOnly session cookie.
+            if (isLoopbackDevAuthHeaders(headers) && isLoopbackSocketPeerForDevAuthHeaders(headers)) {
+                return debugSession;
+            }
             const token = getCookieValue(headers);
             if (token === containerToken)
                 return debugSession;
@@ -76,6 +125,9 @@ function createDevAuthService() {
             if (!isLoopbackDevAuthRequest(request)) {
                 return Response.json({ error: "Dev auth only accepts loopback requests" }, { status: 403 });
             }
+            if (!isLoopbackSocketPeerForDevAuth(request)) {
+                return Response.json({ error: "Dev auth only accepts loopback socket peers" }, { status: 403 });
+            }
             const url = new URL(request.url);
             if (url.pathname === "/api/auth/sign-in/social") {
                 // Simulate the Google OAuth redirect — go straight to callback

package/dist/setup/cli.js

@@ -5,6 +5,7 @@ import { dirname, isAbsolute, join } from "node:path";
 import { Command } from "commander";
 import { getPiboConfigValue, loadPiboConfig } from "../config/config.js";
 import { getPiboHome } from "../core/pibo-home.js";
+import { getWslInfo, isWsl } from "../core/wsl.js";
 function parsePort(value) {
     const port = Number(value);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
@@ -117,6 +118,9 @@ export function createUserHostSetupPlan(options = {}) {
     const warnings = [];
     if (!options.domain)
         warnings.push("No production domain was provided; generated Caddy/Auth examples use placeholders.");
+    if (process.platform === "win32" && !isWsl()) {
+        warnings.push("Pibo host setup targets Linux. Native Windows is not supported. Install WSL2 (https://aka.ms/wsl) and run setup inside the WSL distribution. See docs/guides/pibo-on-windows-via-wsl.md.");
+    }
     const generatedFiles = [
         {
             path: `/etc/systemd/system/${serviceName}.service`,
@@ -187,6 +191,9 @@ export function createDeveloperHostSetupPlan(options = {}) {
         warnings.push("No origin fork was provided. Developer hosts should use a server-specific fork as origin.");
     if (!options.prodDomain || !options.devDomain)
         warnings.push("Production and dev domains should both be configured before requesting HTTPS certificates.");
+    if (process.platform === "win32" && !isWsl()) {
+        warnings.push("Pibo developer-host setup targets Linux. Native Windows is not supported. Install WSL2 (https://aka.ms/wsl) and run setup inside the WSL distribution. See docs/guides/pibo-on-windows-via-wsl.md.");
+    }
     const generatedFiles = [
         {
             path: "/etc/systemd/system/pibo-web.service",
@@ -365,7 +372,7 @@ function addCommandCheck(checks, command, required) {
 }
 function authConfigChecks(piboHome) {
     const configPath = join(piboHome, "config.json");
-    const notReady = "Pibo web will not start until Better Auth is configured. Set auth.baseURL, auth.secret, auth.googleClientId, auth.googleClientSecret, and auth.allowedEmails.";
+    const notReady = "Pibo web will not start until Better Auth is configured. Set auth.baseURL, auth.secret, auth.googleClientId, auth.googleClientSecret, and auth.allowedEmails. For local-only development, use `pibo config set auth.mode local` and run `pibo gateway:web --auth=local`.";
     if (!existsSync(configPath))
         return [
             { name: "auth.ready", status: "fail", detail: notReady },
@@ -375,6 +382,24 @@ function authConfigChecks(piboHome) {
         const config = loadPiboConfig(configPath);
         const checks = [];
         const missing = [];
+        const authModeValue = getPiboConfigValue(config, "auth.mode");
+        const isLocalMode = authModeValue === "local";
+        const isBetterAuthMode = authModeValue === "better-auth" || authModeValue === undefined;
+        checks.push({
+            name: "auth.mode",
+            status: isLocalMode || isBetterAuthMode ? "ok" : "fail",
+            detail: isLocalMode
+                ? "auth.mode is 'local' — Google OAuth is not required; gateway must be bound to loopback."
+                : isBetterAuthMode
+                    ? "auth.mode is unset (defaults to 'better-auth')."
+                    : `auth.mode is '${String(authModeValue)}' — must be 'better-auth' or 'local'.`,
+        });
+        if (isLocalMode) {
+            // Local mode does not require any of the Better Auth keys. We still
+            // surface what is configured for operator awareness.
+            checks.unshift({ name: "auth.ready", status: "ok", detail: "Auth is in local mode. No Google OAuth required. Bind the gateway to a loopback address." });
+            return checks;
+        }
         const requiredStrings = [
             { key: "auth.baseURL", detail: "Set with `pibo config set auth.baseURL https://your-domain.example`." },
             { key: "auth.secret", detail: "Set a random value with at least 32 characters." },
@@ -458,29 +483,56 @@ async function createDoctorStatus(options) {
         const dockerInfo = commandOutput("docker", ["info", "--format", "{{.ServerVersion}}"]);
         checks.push({ name: "docker.daemon", status: dockerInfo ? "ok" : options.requireDocker ? "fail" : "warn", detail: dockerInfo ? `Docker daemon ${dockerInfo}` : "Docker daemon is not reachable" });
     }
+    const wslInfo = getWslInfo();
+    if (wslInfo.isWsl) {
+        const versionLabel = wslInfo.version ? `WSL${wslInfo.version}` : "WSL";
+        const distroLabel = wslInfo.distro ? ` (${wslInfo.distro})` : "";
+        checks.push({ name: "platform.wsl", status: "ok", detail: `Running inside ${versionLabel}${distroLabel}; Pibo is fully supported here. See docs/guides/pibo-on-windows-via-wsl.md.` });
+    }
+    else if (process.platform === "win32") {
+        checks.push({
+            name: "platform.wsl",
+            status: "fail",
+            detail: "Native Windows is not supported. Install WSL2 (https://aka.ms/wsl) and run Pibo inside the WSL distribution. See docs/guides/pibo-on-windows-via-wsl.md.",
+        });
+    }
     checks.push(...swapCheck(options.minSwapGb));
     checks.push(...authConfigChecks(piboHome));
     checks.push(...await dnsChecks(options.domain, options.expectedIp, "production"));
     checks.push(...await dnsChecks(options.devDomain, options.expectedIp, "development"));
+    const recommendations = [
+        "Use user-host setup for normal npm installs.",
+        "Use developer-host setup only when you need prod/dev gateways, Docker compute workers, GitHub App PR flow, and branch worktrees.",
+        "Configure auth before starting pibo-web; Better Auth requires baseURL, secret, Google OAuth values, and allowed emails.",
+        "Docker is only required for developer-host compute workers; user-host installs can ignore Docker warnings.",
+        "Swap is not created automatically; for developer hosts, provision swap at the OS level and verify it with `--min-swap-gb`.",
+    ];
+    if (wslInfo.isWsl) {
+        recommendations.push("You are inside WSL: install pibo with `npm install -g @pasko70/pibo` in the WSL shell, then open this folder in VSCode via the WSL extension so the editor talks to the WSL gateway.");
+        recommendations.push("Browser-Use and Agent-Browser work directly under WSLg on Windows 11. On Windows 10, install an X server (e.g. VcXsrv) and export DISPLAY=:0 inside WSL.");
+    }
+    else if (process.platform === "win32") {
+        recommendations.push("Pibo does not run natively on Windows. Install WSL2 with `wsl --install` and follow docs/guides/pibo-on-windows-via-wsl.md.");
+    }
     return {
         node: process.versions.node,
         nodeMajorOk,
         platform: process.platform,
         uid: typeof process.getuid === "function" ? process.getuid() : undefined,
         piboHome,
+        wsl: wslInfo,
         checks,
-        recommendations: [
-            "Use user-host setup for normal npm installs.",
-            "Use developer-host setup only when you need prod/dev gateways, Docker compute workers, GitHub App PR flow, and branch worktrees.",
-            "Configure auth before starting pibo-web; Better Auth requires baseURL, secret, Google OAuth values, and allowed emails.",
-            "Docker is only required for developer-host compute workers; user-host installs can ignore Docker warnings.",
-            "Swap is not created automatically; for developer hosts, provision swap at the OS level and verify it with `--min-swap-gb`."
-        ],
+        recommendations,
     };
 }
 function printDoctorStatus(status) {
     console.log(`Node: ${status.node} (${status.nodeMajorOk ? "ok" : "requires >=24"})`);
     console.log(`Platform: ${status.platform}`);
+    if (status.wsl.isWsl) {
+        const versionLabel = status.wsl.version ? `WSL${status.wsl.version}` : "WSL";
+        const distroLabel = status.wsl.distro ? ` (${status.wsl.distro})` : "";
+        console.log(`WSL: ${versionLabel}${distroLabel}`);
+    }
     console.log(`PIBO_HOME: ${status.piboHome}`);
     console.log("Checks:");
     for (const check of status.checks)

package/dist/web/channel.js

@@ -6,6 +6,15 @@ import { PiboWebHttpError, nodeRequestToWebRequest, responseHtml, responseJson,
 export const DEFAULT_WEB_CHANNEL_HOST = "127.0.0.1";
 export const DEFAULT_WEB_CHANNEL_PORT = 4788;
 export const WEB_CHANNEL_NAME = "web-host";
+/**
+ * Internal header that carries the TCP socket peer address from the web host
+ * channel to the auth plugin. This is one of three independent safety layers
+ * for the local auth service (see `docs/specs/capabilities/web-auth-and-same-origin-host.md`
+ * REQ-010). The header is added on the request side by the channel and MUST
+ * be stripped from any response by `sendWebResponse` so it never reaches the
+ * browser.
+ */
+export const SOCKET_PEER_HEADER = "x-pibo-socket-peer";
 function redirect(location) {
     return new Response(null, {
         status: 302,
@@ -33,6 +42,41 @@ function firstHeaderValue(value) {
 function isLoopbackAddress(address) {
     return address === "::1" || address === "127.0.0.1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
 }
+/**
+ * Return a new Request that includes the TCP socket peer address in the
+ * `x-pibo-socket-peer` header. The body is preserved via the request body
+ * stream consumed into a buffer because the original Request is not cloneable
+ * once the body has been read.
+ */
+function withSocketPeerHeader(request, peerAddress) {
+    const headers = new Headers(request.headers);
+    if (peerAddress)
+        headers.set(SOCKET_PEER_HEADER, peerAddress);
+    return new Request(request.url, {
+        method: request.method,
+        headers,
+        body: request.body,
+        duplex: "half",
+        redirect: request.redirect,
+        signal: request.signal,
+    });
+}
+/**
+ * Strip the internal socket peer header from a Response so it never reaches
+ * the browser. Auth plugins that accidentally echo the header will not leak
+ * the TCP peer information to the client.
+ */
+export function stripSocketPeerHeaderFromResponse(response) {
+    if (!response.headers.has(SOCKET_PEER_HEADER))
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete(SOCKET_PEER_HEADER);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
 function createRequestBaseURL(nodeRequest, host, port) {
     if (isLoopbackAddress(nodeRequest.socket.remoteAddress)) {
         const forwardedHost = firstHeaderValue(nodeRequest.headers["x-forwarded-host"]);
@@ -144,7 +188,13 @@ export function createWebHostChannel(options = {}) {
     const handleRequest = async (nodeRequest, nodeResponse) => {
         try {
             const baseURL = createRequestBaseURL(nodeRequest, host, port);
-            const request = await nodeRequestToWebRequest(nodeRequest, baseURL);
+            const baseRequest = await nodeRequestToWebRequest(nodeRequest, baseURL);
+            // Inject the TCP socket peer into every request so the local auth
+            // plugin can apply the same loopback predicate from `getSession`
+            // regardless of whether the call came from a browser cookie, the
+            // VS Code extension, or a CLI script. The header is stripped from
+            // any outgoing response by `stripSocketPeerHeaderFromResponse`.
+            const request = withSocketPeerHeader(baseRequest, nodeRequest.socket.remoteAddress);
             const url = new URL(request.url);
             const canonicalRedirect = createCanonicalRedirect(request, options.canonicalBaseURL);
             if (canonicalRedirect) {
@@ -163,7 +213,8 @@ export function createWebHostChannel(options = {}) {
                 return;
             }
             if (url.pathname.startsWith("/api/auth/")) {
-                await sendWebResponse(nodeResponse, await handleAuthRequest(request));
+                const authResponse = stripSocketPeerHeaderFromResponse(await handleAuthRequest(request));
+                await sendWebResponse(nodeResponse, authResponse);
                 return;
             }
             const ctx = requireContext();

package/dist/web/http.js

@@ -1,6 +1,7 @@
 import { gzipSync } from "node:zlib";
 export const MAX_WEB_REQUEST_BODY_BYTES = 4 * 1024 * 1024;
 const MIN_COMPRESS_RESPONSE_BYTES = 1024;
+const INTERNAL_SOCKET_PEER_HEADER = "x-pibo-socket-peer";
 export class PiboWebHttpError extends Error {
     statusCode;
     constructor(message, statusCode) {
@@ -115,9 +116,11 @@ function responseHeaders(webResponse) {
     const headers = {};
     const setCookie = webResponse.headers.getSetCookie?.();
     webResponse.headers.forEach((value, key) => {
-        if (key.toLowerCase() !== "set-cookie") {
-            headers[key] = value;
-        }
+        if (key.toLowerCase() === "set-cookie")
+            return;
+        if (key.toLowerCase() === INTERNAL_SOCKET_PEER_HEADER)
+            return;
+        headers[key] = value;
     });
     if (setCookie?.length) {
         headers["set-cookie"] = setCookie;