npm - @pasko70/pibo - Versions diffs - 1.7.1 → 1.7.2 - Mend

@pasko70/pibo 1.7.1 → 1.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (180) hide show

package/dist/apps/chat-vscode-web/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="theme-color" content="#101d22" />
 		<title>Pibo</title>
-		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-lOZ1r-No.js"></script>
+		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-CfeNUaRh.js"></script>
 		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-B5QK07zO.css">
 	</head>
 	<body>

package/dist/bin/pibo.js CHANGED Viewed

File without changes

package/dist/bin/rg.js CHANGED Viewed

File without changes

package/dist/cli.js CHANGED Viewed

@@ -52,6 +52,9 @@ function isLoopbackBindForCli(host) {
     const normalized = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
     return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
 }
+function isComputeWorkerRuntimeForCli() {
+    return process.env.PIBO_COMPUTE_WORKER === "1";
+}
 export async function runPiboCli(argv = process.argv) {
     if (argv[2] === "--help" || argv[2] === "-h") {
         printRootDiscovery();
@@ -371,7 +374,7 @@ export async function runPiboCli(argv = process.argv) {
         if (authMode !== undefined && authMode !== "better-auth" && authMode !== "local") {
             throw new Error(`--auth must be 'better-auth' or 'local', got '${authMode}'`);
         }
-        if (authMode === "local" && options.webHost !== undefined && !isLoopbackBindForCli(options.webHost)) {
+        if (authMode === "local" && options.webHost !== undefined && !isLoopbackBindForCli(options.webHost) && !isComputeWorkerRuntimeForCli()) {
             throw new Error(`--auth=local requires a loopback bind (127.0.0.1, ::1, or localhost). Got --web-host='${options.webHost}'. ` +
                 "Either drop --web-host or pick --auth=better-auth for a public bind.");
         }

package/dist/compute/docker.js CHANGED Viewed

@@ -200,16 +200,20 @@ export function buildDevWorkerDockerRunArgs(options) {
         "--name",
         options.id,
         ...buildDockerResourcePolicyArgs(policy),
+        "-e",
+        "PIBO_COMPUTE_WORKER=1",
+        "-e",
+        "PIBO_COMPUTE_WORKER_ROLE=dev",
         "-p",
-        `${options.gatewayPort}:4789`,
+        `127.0.0.1:${options.gatewayPort}:4789`,
         "-p",
-        `${options.cdpPort}:56663`,
+        `127.0.0.1:${options.cdpPort}:56663`,
         "-p",
-        `${options.webPort}:4788`,
+        `127.0.0.1:${options.webPort}:4788`,
         "-p",
-        `${options.webUIPortChat}:4790`,
+        `127.0.0.1:${options.webUIPortChat}:4790`,
         "-p",
-        `${options.webUIPortContext}:4791`,
+        `127.0.0.1:${options.webUIPortContext}:4791`,
         "-v",
         `${options.worktreePath}:/workspace`,
         ...(options.hostNodeModules ? ["-v", `${options.hostNodeModules}:/workspace/node_modules`] : []),
@@ -307,12 +311,16 @@ export function buildWorkerDockerRunArgs(options) {
         "--name",
         options.id,
         ...buildDockerResourcePolicyArgs(policy),
+        "-e",
+        "PIBO_COMPUTE_WORKER=1",
+        "-e",
+        "PIBO_COMPUTE_WORKER_ROLE=worker",
         "-p",
-        "4789",
+        "127.0.0.1::4789",
         "-p",
-        "56663",
+        "127.0.0.1::56663",
         "-p",
-        "4788",
+        "127.0.0.1::4788",
         ...buildComputeWorkerMetadataLabels({
             role: "worker",
             createdAt: options.createdAt,

package/dist/gateway/web.js CHANGED Viewed

@@ -1,4 +1,3 @@
-import { existsSync, readFileSync } from "node:fs";
 import { createDefaultPiboPlugins } from "../plugins/builtin.js";
 import { createPiboBetterAuthPlugin } from "../plugins/better-auth.js";
 import { createPiboChatWebPlugin } from "../plugins/chat-web.js";
@@ -15,16 +14,8 @@ import { PiboGatewayServer } from "./server.js";
 import { clearFallbackPidFile, clearPidFile, writeFallbackGatewayPid, writeGatewayPid } from "./pidfile.js";
 const PUBLIC_WEB_CHANNEL_HOST = "0.0.0.0";
 const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
-function isDockerRuntime() {
-    if (existsSync("/.dockerenv"))
-        return true;
-    try {
-        const cgroup = readFileSync("/proc/1/cgroup", "utf-8");
-        return /docker|kubepods|containerd/.test(cgroup);
-    }
-    catch {
-        return false;
-    }
+function isComputeWorkerRuntime() {
+    return process.env.PIBO_COMPUTE_WORKER === "1";
 }
 export function isLoopbackHost(value) {
     if (!value)
@@ -39,7 +30,7 @@ function requireLocalAuthBind(options) {
     const host = bindHost(options);
     if (isLoopbackHost(host))
         return;
-    if (isDockerRuntime()) {
+    if (isComputeWorkerRuntime()) {
         console.error(`[pibo] WARNING: local auth is active in a Docker worker with bind ${host}. ` +
             "The Docker network is the security boundary; ensure the host port mapping is loopback-only.");
         return;

package/dist/plugins/dev-auth.js CHANGED Viewed

@@ -40,6 +40,26 @@ function isLoopbackSocketAddress(value) {
     const normalized = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
     return normalized === "::1" || normalized === "127.0.0.1" || normalized.startsWith("127.");
 }
+function isPrivateDockerBridgeSocketAddress(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("::ffff:") ? value.slice("::ffff:".length) : value;
+    if (normalized.startsWith("10."))
+        return true;
+    if (normalized.startsWith("192.168."))
+        return true;
+    const match = normalized.match(/^172\.(\d{1,2})\./);
+    if (!match)
+        return false;
+    const secondOctet = Number(match[1]);
+    return secondOctet >= 16 && secondOctet <= 31;
+}
+function isComputeWorkerRuntime(env = process.env) {
+    return env.PIBO_COMPUTE_WORKER === "1";
+}
+function isTrustedLocalSocketAddress(value) {
+    return isLoopbackSocketAddress(value) || (isComputeWorkerRuntime() && isPrivateDockerBridgeSocketAddress(value));
+}
 /**
  * Read the TCP socket peer address attached to the request by the web host
  * channel via the `x-pibo-socket-peer` header. The header is internal and
@@ -77,6 +97,12 @@ export function isLoopbackDevAuthHeaders(headers) {
 export function isLoopbackSocketPeerForDevAuthHeaders(headers) {
     return isLoopbackSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
 }
+export function isTrustedLocalSocketPeerForDevAuth(request) {
+    return isTrustedLocalSocketAddress(getSocketPeerForDevAuth(request));
+}
+export function isTrustedLocalSocketPeerForDevAuthHeaders(headers) {
+    return isTrustedLocalSocketAddress(firstHeaderValue(headers.get(SOCKET_PEER_HEADER)));
+}
 export function createDevAuthService() {
     const containerToken = generateToken();
     const debugSession = {
@@ -104,7 +130,7 @@ export function createDevAuthService() {
             // there is no cookie jar to share. Headless clients (VS Code
             // extension, CLI scripts) can use the same dev identity as the
             // browser without needing the HttpOnly session cookie.
-            if (isLoopbackDevAuthHeaders(headers) && isLoopbackSocketPeerForDevAuthHeaders(headers)) {
+            if (isLoopbackDevAuthHeaders(headers) && isTrustedLocalSocketPeerForDevAuthHeaders(headers)) {
                 return debugSession;
             }
             const token = getCookieValue(headers);
@@ -125,7 +151,7 @@ export function createDevAuthService() {
             if (!isLoopbackDevAuthRequest(request)) {
                 return Response.json({ error: "Dev auth only accepts loopback requests" }, { status: 403 });
             }
-            if (!isLoopbackSocketPeerForDevAuth(request)) {
+            if (!isTrustedLocalSocketPeerForDevAuth(request)) {
                 return Response.json({ error: "Dev auth only accepts loopback socket peers" }, { status: 403 });
             }
             const url = new URL(request.url);

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@pasko70/pibo",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "type": "module",
   "imports": {
     "vscode": "./src/apps/chat-vscode/extension/src/vscode-shim.js"

package/skills/builtin/graphify/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/pi-agent-harness/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/pi-agent-harness/agents/openai.yaml CHANGED Viewed

File without changes

package/skills/builtin/pibo-docker-system/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/pibo-spec-writing/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/prd/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/ralph-loop/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/ralph-prd-json/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/LICENSE.txt CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/SKILL.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/agents/analyzer.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/agents/comparator.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/agents/grader.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/assets/eval_review.html CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/eval-viewer/generate_review.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/eval-viewer/viewer.html CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/references/schemas.md CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/__init__.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/aggregate_benchmark.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/generate_report.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/improve_description.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/package_skill.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/quick_validate.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/run_eval.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/run_loop.py CHANGED Viewed

File without changes

package/skills/builtin/skill-creator/scripts/utils.py CHANGED Viewed

File without changes

package/skills/builtin/web-annotations/SKILL.md CHANGED Viewed

File without changes

package/src/mcp/LICENSE.mcp-cli CHANGED Viewed

File without changes

package/README.md DELETED Viewed

@@ -1,183 +0,0 @@
-# pibo
-Pibo is a thin product boundary around Pi Coding Agent. Pi remains the inner engine for model turns, tools, streaming, sessions, and compaction. Pibo adds profiles, plugins, channels, local gateways, web auth, and operator tooling.
-The default posture is intentionally powerful: Pibo is built for agentic coding and server operation, not for a restrictive sandbox. Install and run it as the Linux user that should own its state and credentials.
-## Supported platforms
-Pibo is Linux-first. The supported hosts are:
-- **Linux** (any modern distribution) — primary target
-- **macOS** — supported, same code path as Linux
-- **Windows via WSL2** — fully supported; see [docs/guides/pibo-on-windows-via-wsl.md](./docs/guides/pibo-on-windows-via-wsl.md)
-- **Native Windows** — not supported; `pibo setup doctor` and `pibo setup user-host` will print a clear error pointing to the WSL guide
-## Install
-Pibo is distributed as an npm package:
-```bash
-npm install -g @pasko70/pibo
-pibo --help
-```
-The current package declares Node.js 24+. Some Linux distributions still ship Node 22 through `apt`, so install a recent Node release first when needed. A user-local Node/npm setup through `nvm`, `fnm`, or a user-writable npm prefix works well.
-For a user-local global npm prefix:
-```bash
-mkdir -p ~/.local
-npm config set prefix ~/.local
-export PATH="$HOME/.local/bin:$PATH"
-npm install -g @pasko70/pibo
-```
-## State and user paths
-Pibo stores product-wide state under:
-```text
-${PIBO_HOME:-~/.pibo}
-```
-That means the executing Linux user owns the installation state:
-```text
-alice -> /home/alice/.pibo
-pibo  -> /home/pibo/.pibo
-root  -> /root/.pibo
-```
-There is no requirement to run as `root`. If you SSH as root and run Pibo, state naturally lands in `/root/.pibo`. If you create or use a dedicated user, state lands in that user's home. This is the preferred way to keep SSH keys, config, logs, and sessions separated.
-Workspace-scoped files are separate and live under the active workspace:
-```text
-<workspace>/.pibo
-```
-Examples include custom prompts and Pi package registrations.
-## Server notes
-A fresh server install usually needs only three decisions:
-1. Choose the Linux user that should own Pibo.
-2. Install Node.js 24+ for that user or system-wide.
-3. Install Pibo through npm.
-Use the setup planner to keep the first run simple:
-```bash
-pibo setup doctor --domain pibo.example.com --expected-ip <server-ip>
-pibo setup user-host --domain pibo.example.com --print-files
-pibo setup user-host --domain pibo.example.com --write-to /tmp/pibo-setup
-```
-This is the normal user path: one gateway, one `PIBO_HOME`, no required Docker, no dev gateway, and no GitHub App setup. After reviewing staged files, use `--apply --yes` to write the generated systemd/Caddy files.
-Developer hosts are opt-in and add production/dev separation plus Docker compute workers:
-```bash
-pibo setup developer-host \
-  --origin git@github.com:<your-fork>/pibo.git \
-  --prod-domain pibo.example.com \
-  --dev-domain dev.pibo.example.com \
-  --print-files
-pibo setup developer-host \
-  --origin git@github.com:<your-fork>/pibo.git \
-  --prod-domain pibo.example.com \
-  --dev-domain dev.pibo.example.com \
-  --write-to /tmp/pibo-setup
-```
-See `docs/ops/install-user-host.md`, `docs/ops/install-developer-host.md`, and `docs/ops/upgrade-user-to-developer-host.md`. Developer-host services are source-pinned so production and dev do not fight over one global `pibo` symlink. Docker and swap are developer-host prerequisites only; verify them with `pibo setup doctor --require-docker --min-swap-gb 8`.
-If the agent should be able to perform server administration, give that Linux user the required sudo or Docker permissions explicitly. Pibo does not need a special onboarding user to work correctly; normal Unix ownership is enough.
-## Docker notes
-Docker is optional. If you run Pibo in a container, avoid hard-coding `/root` unless the container is intentionally root-owned. Prefer mapping the host user's state into the container user's home:
-```text
-$HOME/.pibo -> /home/pibo/.pibo
-$HOME/code  -> /workspace/code
-```
-Set `HOME` and `PIBO_HOME` consistently inside the container so the same path rule applies:
-```text
-HOME=/home/pibo
-PIBO_HOME=/home/pibo/.pibo
-```
-## Web gateway auth
-`pibo gateway:web` starts the authenticated web runtime. It requires Better Auth configuration before production use. This step is intentionally not automated because you must create/select the Google OAuth client and allowed user list:
-```bash
-pibo config set auth.baseURL https://your-host.example
-pibo config set auth.secret <at-least-32-characters>
-pibo config set auth.googleClientId <google-client-id>
-pibo config set auth.googleClientSecret <google-client-secret>
-pibo config set auth.allowedEmails you@example.com
-```
-For local loopback testing, `auth.baseURL` can be `http://localhost:4788`.
-## Development from source
-Use source installs for development, not normal usage:
-```bash
-git clone git@github.com:Pascapone-server/pibo.git
-cd pibo
-npm install
-npm run build
-npm run start -- --help
-```
-Useful scripts:
-```bash
-npm run dev -- --help
-npm run profile -- codex
-npm run tui:routed -- codex
-npm run gateway
-npm run gateway:web
-npm test
-npm run typecheck
-```
-## Main CLI areas
-```bash
-pibo config       # local config under ${PIBO_HOME:-~/.pibo}/config.json
-pibo mcp          # discover and call configured MCP servers
-pibo tools        # install and inspect curated external CLI tools
-pibo pi-packages  # register Pi Coding Agent packages
-pibo debug        # inspect local Pibo data stores
-pibo setup        # plan user-host installs and developer-host upgrades
-pibo profile      # inspect runtime profiles
-pibo tui          # start the direct Pi TUI
-pibo tui:routed   # start the routed Pibo TUI
-pibo gateway      # local gateway runtime
-pibo gateway:web  # authenticated web gateway runtime
-```
-## Further docs
-- `docs/architecture.md` describes runtime architecture and boundaries.
-- `docs/mcp.md` documents MCP configuration and commands.
-- `docs/tools.md` documents curated external CLI tools.
-- `docs/pi-packages.md` documents Pi package registration.
-- `docs/chat-rooms-event-log.md` documents Chat Web rooms and durable event storage.
-- `docs/progress.md` is the short implementation status snapshot.
-## Philosophy
-Keep Pibo thin. Pi Coding Agent should remain the inner engine; Pibo owns only the product boundary: profiles, plugins, channels, routing, auth, policy, and operator tooling.
-Optional integrations should stay outside the core package until installed. MCP servers, Python virtual environments, external CLIs, and user skills are configured on demand rather than bundled into every runtime.