@pasko70/pibo 1.3.0 → 1.3.2

package/docs/ops/install-user-host.md

@@ -39,6 +39,8 @@ systemctl daemon-reload
 
 ## Configure auth
 
+For a public deployment with Google OAuth:
+
 ```bash
 pibo config set auth.baseURL https://pibo.example.com
 pibo config set auth.secret <at-least-32-characters>
@@ -47,6 +49,24 @@ pibo config set auth.googleClientSecret <google-client-secret>
 pibo config set auth.allowedEmails you@example.com
 ```
 
+For a local development install on a developer laptop, use the local auth mode. This skips Google OAuth and binds the gateway to loopback only:
+
+```bash
+pibo config set auth.mode local
+pibo gateway:web --auth=local
+# Open http://localhost:4788/apps/chat and click "Sign in with Google".
+# The dev identity dev@pibo.local is auto-attached without OAuth.
+```
+
+Local auth refuses a non-loopback bind:
+
+```bash
+pibo gateway:web --auth=local --web-host=0.0.0.0
+# Error: --auth=local requires a loopback bind (127.0.0.1, ::1, or localhost).
+```
+
+Three independent request-time safety layers guard the local auth service. See `docs/specs/capabilities/web-auth-and-same-origin-host.md` REQ-010 and the `pibo-debug-auth` skill for the full model.
+
 ## Start the gateway
 
 `pibo-web` will not start until Better Auth config is complete. This cannot be automated because you must create/select your Google OAuth client and allowed user list. Check it first:
@@ -63,7 +83,7 @@ systemctl enable --now pibo-web
 pibo gateway web status
 ```
 
-If you use Caddy, point DNS at the host before expecting Let's Encrypt to issue a certificate.
+If you use Caddy, point DNS at the host before expecting Let's Encrypt to issue a certificate. Local auth mode bypasses the Better Auth requirement and prints a warning instead of a hard blocker.
 
 ## When not to use this path
 

package/docs/ops/vscode-extension-release.md

@@ -60,6 +60,8 @@ git push origin v1.3.0
 
 ### 4. Create a GitHub Release with the VSIX attached
 
+The maintainer's local machine has the `gh` CLI installed:
+
 ```bash
 gh release create v1.3.0 \
   dist/apps/vscode-artifacts/pibo-vscode-1.3.0.vsix \
@@ -67,7 +69,25 @@ gh release create v1.3.0 \
   --notes "..."
 ```
 
-This makes the VSIX downloadable from a stable URL (`https://github.com/Pascapone/pibo/releases/download/v1.3.0/pibo-vscode-1.3.0.vsix`). The `pibo vscode install` command uses the GitHub Releases API to discover this URL automatically.
+In environments where `gh` is not available (e.g. the pibo compute workers),
+`scripts/create-github-release.mjs` performs the same action via the Pibo
+GitHub App, which has been installed on `Pascapone/pibo` with the
+`contents: write` scope. The script accepts the GitHub App credentials from
+`PIBO_GITHUB_APP_ID` and `PIBO_GITHUB_APP_KEY` environment variables, or
+from the well-known env file at
+`/root/.pibo/uploads/github-app.env` (with the PEM key auto-discovered
+next to it).
+
+```bash
+node scripts/create-github-release.mjs \
+  --tag v1.3.0 \
+  --asset dist/apps/vscode-artifacts/pibo-vscode-1.3.0.vsix
+```
+
+Both paths make the VSIX downloadable from a stable URL
+(`https://github.com/Pascapone/pibo/releases/download/v1.3.0/pibo-vscode-1.3.0.vsix`).
+The `pibo vscode install` command uses the GitHub Releases API to discover
+this URL automatically.
 
 The release script can also do this in one step:
 
@@ -75,7 +95,9 @@ The release script can also do this in one step:
 node scripts/release.mjs --version 1.3.0 --create-release
 ```
 
-…if the tag has already been pushed.
+…if the tag has already been pushed. Internally the release script calls
+`scripts/create-github-release.mjs`, so it works in worker environments
+without `gh`.
 
 ### 5. Publish the npm package
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pasko70/pibo",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "type": "module",
   "description": "Minimal TypeScript wrapper around Pi Coding Agent.",
   "files": [
@@ -37,6 +37,7 @@
     "vscode:extension:build": "esbuild src/apps/chat-vscode/extension/src/extension.ts --bundle --platform=node --target=node24 --format=cjs --outfile=src/apps/chat-vscode/dist/extension/extension.cjs --external:vscode --sourcemap=inline",
     "vscode:package": "node scripts/vscode-package.mjs",
     "release": "node scripts/release.mjs",
+    "release:github": "node scripts/create-github-release.mjs",
     "build": "tsc -p tsconfig.json && npm run web-ui:build && npm run vscode:webview:build && node scripts/ensure-bin-executable.mjs",
     "start": "node dist/bin/pibo.js",
     "test": "npm run build && node --test test/*.test.mjs test/chat-vscode/*.test.mjs",