@pasko70/pibo 1.9.9 → 1.9.11

package/dist/vscode/status.js

@@ -0,0 +1,80 @@
+/**
+ * `pibo vscode status` — report whether the Pibo VS Code extension is
+ * installed, the local VS Code CLI binary, and the cached VSIX artifacts.
+ */
+import { existsSync, readdirSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { detectCodeBinary, listInstalledExtensions } from "./code-cli.js";
+import { fetchRelease } from "./vsix-fetcher.js";
+import { DEFAULT_GITHUB_OWNER, DEFAULT_GITHUB_REPO, PIBO_VSCODE_CACHE_DIR, PIBO_VSCODE_EXTENSION_ID, } from "./types.js";
+function getCacheDir(options) {
+    if (options.cacheDir)
+        return options.cacheDir;
+    const base = options.env?.PIBO_HOME ?? join(homedir(), ".pibo");
+    return join(base, PIBO_VSCODE_CACHE_DIR, "cache");
+}
+function listCachedReleases(cacheDir, limit) {
+    if (!existsSync(cacheDir))
+        return [];
+    const entries = readdirSync(cacheDir, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() && entry.name !== "node_modules")
+        .map((entry) => ({ name: entry.name, mtimeMs: statSync(join(cacheDir, entry.name)).mtimeMs }))
+        .sort((a, b) => b.mtimeMs - a.mtimeMs)
+        .slice(0, limit)
+        .map((entry) => entry.name);
+    return entries;
+}
+export async function runStatus(options = {}) {
+    const owner = options.owner ?? DEFAULT_GITHUB_OWNER;
+    const repo = options.repo ?? DEFAULT_GITHUB_REPO;
+    const cacheDir = getCacheDir(options);
+    const limit = options.limit ?? 5;
+    const detected = detectCodeBinary({ env: options.env });
+    let installed = false;
+    let version;
+    if (detected) {
+        try {
+            const installedExtensions = await listInstalledExtensions({
+                binary: detected.path,
+                spawnImpl: options.spawnImpl,
+                env: options.env,
+            });
+            const ours = installedExtensions.find((entry) => entry.id === PIBO_VSCODE_EXTENSION_ID);
+            if (ours) {
+                installed = true;
+                version = ours.version;
+            }
+        }
+        catch {
+            // Listing failed; treat as not-installed for status purposes.
+            installed = false;
+        }
+    }
+    const cachedReleases = listCachedReleases(cacheDir, limit);
+    let availableReleases = [];
+    try {
+        const release = await fetchRelease({ owner, repo, fetchImpl: options.fetchImpl });
+        availableReleases = [release.tagName];
+    }
+    catch {
+        // Network failure is non-fatal for status.
+    }
+    return {
+        installed,
+        version,
+        codeBinary: detected?.path,
+        vsixCacheDir: cacheDir,
+        availableReleases,
+    };
+}
+export function formatStatusText(status) {
+    const lines = [];
+    lines.push(`extension: ${status.installed ? `${PIBO_VSCODE_EXTENSION_ID}@${status.version ?? "?"}` : "not installed"}`);
+    lines.push(`code binary: ${status.codeBinary ?? "(not on PATH)"}`);
+    lines.push(`vsix cache: ${status.vsixCacheDir}`);
+    if (status.availableReleases.length > 0) {
+        lines.push(`latest release: ${status.availableReleases[0]}`);
+    }
+    return lines.join("\n");
+}

package/dist/vscode/types.js

@@ -0,0 +1,14 @@
+/**
+ * Types and constants for the `pibo vscode` sub-command.
+ *
+ * The pibo VS Code extension is a thin VS Code client that opens a WebView
+ * pointing at the gateway-served chat-vscode-web app. The extension itself
+ * ships as a `.vsix` artifact, published to the VS Code Marketplace and
+ * mirrored on GitHub Releases.
+ */
+export const PIBO_VSCODE_EXTENSION_PUBLISHER = "pibo";
+export const PIBO_VSCODE_EXTENSION_NAME = "pibo-vscode-ext";
+export const PIBO_VSCODE_EXTENSION_ID = `${PIBO_VSCODE_EXTENSION_PUBLISHER}.${PIBO_VSCODE_EXTENSION_NAME}`;
+export const DEFAULT_GITHUB_OWNER = "Pascapone";
+export const DEFAULT_GITHUB_REPO = "pibo";
+export const PIBO_VSCODE_CACHE_DIR = "vscode";

package/dist/vscode/uninstall.js

@@ -0,0 +1,49 @@
+/**
+ * `pibo vscode uninstall` — remove the installed Pibo VS Code extension.
+ */
+import { detectCodeBinary, runCodeCommand } from "./code-cli.js";
+import { PIBO_VSCODE_EXTENSION_ID } from "./types.js";
+const DEFAULT_LOG = (message) => {
+    console.log(message);
+};
+const DEFAULT_ERROR = (message) => {
+    process.stderr.write(`${message}\n`);
+};
+export async function runUninstall(options = {}) {
+    const log = options.log ?? DEFAULT_LOG;
+    const errorLog = options.error ?? DEFAULT_ERROR;
+    const detected = detectCodeBinary({ env: options.env });
+    if (!detected) {
+        errorLog(`No VS Code CLI found on PATH.`);
+        return { status: "failed", reason: "no-code-cli" };
+    }
+    log(`Uninstalling ${PIBO_VSCODE_EXTENSION_ID} via ${detected.path}…`);
+    let result;
+    try {
+        result = await runCodeCommand({
+            binary: detected.path,
+            args: ["--uninstall-extension", PIBO_VSCODE_EXTENSION_ID],
+            spawnImpl: options.spawnImpl,
+            env: options.env,
+            timeoutMs: 60_000,
+        });
+    }
+    catch (spawnError) {
+        const reason = spawnError instanceof Error ? spawnError.message : String(spawnError);
+        errorLog(`Failed to invoke ${detected.binary}: ${reason}`);
+        return { status: "failed", reason, codeBinary: detected.path };
+    }
+    if (result.exitCode !== 0) {
+        const stderr = result.stderr || result.stdout;
+        // VS Code returns a non-zero exit when the extension is not installed; treat that as "not-installed".
+        if (/not found|not installed|Cannot find extension/i.test(stderr)) {
+            log(`${PIBO_VSCODE_EXTENSION_ID} was not installed.`);
+            return { status: "not-installed", codeBinary: detected.path };
+        }
+        const reason = `code --uninstall-extension exited with code ${result.exitCode}: ${stderr}`;
+        errorLog(reason);
+        return { status: "failed", reason, codeBinary: detected.path };
+    }
+    log(`Uninstalled ${PIBO_VSCODE_EXTENSION_ID}`);
+    return { status: "uninstalled", codeBinary: detected.path };
+}

package/dist/vscode/vsix-fetcher.js

@@ -0,0 +1,131 @@
+/**
+ * GitHub Releases interaction for the Pibo VS Code extension.
+ *
+ * `pibo vscode install` defaults to fetching the latest VSIX asset from a
+ * GitHub Release. The fetch path is pure-functional so the install command
+ * can inject a mocked fetch and a mocked spawn in tests.
+ */
+export class VsixFetchError extends Error {
+    cause;
+    constructor(message, options) {
+        super(message);
+        this.name = "VsixFetchError";
+        if (options?.cause !== undefined)
+            this.cause = options.cause;
+    }
+}
+const VSIX_ASSET_PATTERN = /\.vsix$/i;
+export function isVsixAsset(asset) {
+    return VSIX_ASSET_PATTERN.test(asset.name);
+}
+export function findVsixAsset(release) {
+    return release.assets.find(isVsixAsset);
+}
+const GITHUB_API_ROOT = "https://api.github.com";
+function buildReleaseUrl(owner, repo, tagName) {
+    const base = `${GITHUB_API_ROOT}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/releases`;
+    if (tagName)
+        return `${base}/tags/${encodeURIComponent(tagName)}`;
+    return `${base}/latest`;
+}
+function parseRelease(payload) {
+    if (typeof payload !== "object" || payload === null) {
+        throw new VsixFetchError("GitHub Releases payload is not an object");
+    }
+    const record = payload;
+    const tagName = record.tag_name;
+    const name = record.name;
+    const publishedAt = record.published_at;
+    const htmlUrl = record.html_url;
+    const rawAssets = record.assets;
+    if (typeof tagName !== "string" || typeof name !== "string" || typeof publishedAt !== "string" || typeof htmlUrl !== "string") {
+        throw new VsixFetchError("GitHub Releases payload is missing required string fields");
+    }
+    if (!Array.isArray(rawAssets)) {
+        throw new VsixFetchError("GitHub Releases payload is missing assets array");
+    }
+    const assets = [];
+    for (const raw of rawAssets) {
+        if (typeof raw !== "object" || raw === null)
+            continue;
+        const r = raw;
+        if (typeof r.name === "string" &&
+            typeof r.browser_download_url === "string" &&
+            typeof r.size === "number" &&
+            typeof r.content_type === "string") {
+            assets.push({
+                name: r.name,
+                browserDownloadUrl: r.browser_download_url,
+                size: r.size,
+                contentType: r.content_type,
+            });
+        }
+    }
+    return { tagName, name, publishedAt, htmlUrl, assets };
+}
+export async function fetchRelease(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const url = buildReleaseUrl(options.owner, options.repo, options.tagName);
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            headers: { accept: "application/vnd.github+json", "user-agent": "pibo-cli" },
+        });
+    }
+    catch (error) {
+        throw new VsixFetchError(`Failed to call GitHub Releases API at ${url}`, { cause: error });
+    }
+    if (response.status === 404) {
+        throw new VsixFetchError(options.tagName
+            ? `GitHub release ${options.owner}/${options.repo}@${options.tagName} not found`
+            : `GitHub repository ${options.owner}/${options.repo} has no published releases`);
+    }
+    if (!response.ok) {
+        throw new VsixFetchError(`GitHub Releases API returned HTTP ${response.status}`);
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch (error) {
+        throw new VsixFetchError("GitHub Releases response was not valid JSON", { cause: error });
+    }
+    return parseRelease(payload);
+}
+export async function downloadVsixAsset(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const maxBytes = options.maxBytes ?? 64 * 1024 * 1024; // 64 MiB
+    let response;
+    try {
+        response = await fetchImpl(options.url, { headers: { "user-agent": "pibo-cli" } });
+    }
+    catch (error) {
+        throw new VsixFetchError(`Failed to download VSIX from ${options.url}`, { cause: error });
+    }
+    if (!response.ok) {
+        throw new VsixFetchError(`VSIX download returned HTTP ${response.status}`);
+    }
+    const arrayBuffer = await response.arrayBuffer();
+    if (arrayBuffer.byteLength > maxBytes) {
+        throw new VsixFetchError(`VSIX download is ${arrayBuffer.byteLength} bytes, exceeding limit of ${maxBytes} bytes`);
+    }
+    return Buffer.from(arrayBuffer);
+}
+export async function fetchLatestVsix(options) {
+    const release = await fetchRelease({
+        owner: options.owner,
+        repo: options.repo,
+        tagName: options.tagName,
+        fetchImpl: options.fetchImpl,
+    });
+    const asset = findVsixAsset(release);
+    if (!asset) {
+        throw new VsixFetchError(`Release ${release.tagName} has no .vsix asset`);
+    }
+    const bytes = await downloadVsixAsset({
+        url: asset.browserDownloadUrl,
+        maxBytes: options.maxBytes,
+        fetchImpl: options.fetchImpl,
+    });
+    return { tagName: release.tagName, asset, bytes };
+}

package/dist/web/auth.js

@@ -0,0 +1,14 @@
+import { createUnauthenticatedError } from "../auth/types.js";
+import { PIBO_APP_CONTEXT } from "../app-context.js";
+export async function getWebAuthSession(context, request) {
+    return context.auth?.getSession(request.headers);
+}
+export async function requireWebSession(context, request) {
+    const authSession = await getWebAuthSession(context, request);
+    if (!authSession)
+        throw createUnauthenticatedError();
+    return {
+        authSession,
+        appContext: PIBO_APP_CONTEXT,
+    };
+}

package/dist/web/channel.js

@@ -0,0 +1,288 @@
+import { createServer } from "node:http";
+import { PiboAuthError } from "../auth/types.js";
+import { handleSimpleAgentApiRequest } from "../api/simple-agent-api.js";
+import { requireWebSession } from "./auth.js";
+import { PiboWebHttpError, nodeRequestToWebRequest, responseHtml, responseJson, sendWebResponse } from "./http.js";
+export const DEFAULT_WEB_CHANNEL_HOST = "127.0.0.1";
+export const DEFAULT_WEB_CHANNEL_PORT = 4788;
+export const WEB_CHANNEL_NAME = "web-host";
+/**
+ * Internal header that carries the TCP socket peer address from the web host
+ * channel to the auth plugin. This is one of three independent safety layers
+ * for the local auth service (see `docs/specs/capabilities/web-auth-and-same-origin-host.md`
+ * REQ-010). The header is added on the request side by the channel and MUST
+ * be stripped from any response by `sendWebResponse` so it never reaches the
+ * browser.
+ */
+export const SOCKET_PEER_HEADER = "x-pibo-socket-peer";
+function redirect(location) {
+    return new Response(null, {
+        status: 302,
+        headers: { location },
+    });
+}
+function matchPrefix(pathname, prefix) {
+    return pathname === prefix || pathname.startsWith(`${prefix}/`);
+}
+function notFound() {
+    return responseJson({ error: "Not found" }, { status: 404 });
+}
+function createAppContext(channelContext) {
+    return {
+        channelContext,
+        requireSession(input) {
+            return requireWebSession(channelContext, input.request);
+        },
+    };
+}
+function firstHeaderValue(value) {
+    const raw = Array.isArray(value) ? value[0] : value;
+    return raw?.split(",")[0]?.trim() || undefined;
+}
+function isLoopbackAddress(address) {
+    return address === "::1" || address === "127.0.0.1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
+}
+/**
+ * Return a new Request that includes the TCP socket peer address in the
+ * `x-pibo-socket-peer` header. The body is preserved via the request body
+ * stream consumed into a buffer because the original Request is not cloneable
+ * once the body has been read.
+ */
+function withSocketPeerHeader(request, peerAddress) {
+    const headers = new Headers(request.headers);
+    if (peerAddress)
+        headers.set(SOCKET_PEER_HEADER, peerAddress);
+    return new Request(request.url, {
+        method: request.method,
+        headers,
+        body: request.body,
+        duplex: "half",
+        redirect: request.redirect,
+        signal: request.signal,
+    });
+}
+/**
+ * Strip the internal socket peer header from a Response so it never reaches
+ * the browser. Auth plugins that accidentally echo the header will not leak
+ * the TCP peer information to the client.
+ */
+export function stripSocketPeerHeaderFromResponse(response) {
+    if (!response.headers.has(SOCKET_PEER_HEADER))
+        return response;
+    const headers = new Headers(response.headers);
+    headers.delete(SOCKET_PEER_HEADER);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+function createRequestBaseURL(nodeRequest, host, port) {
+    if (isLoopbackAddress(nodeRequest.socket.remoteAddress)) {
+        const forwardedHost = firstHeaderValue(nodeRequest.headers["x-forwarded-host"]);
+        const forwardedProto = firstHeaderValue(nodeRequest.headers["x-forwarded-proto"]);
+        if (forwardedHost && (forwardedProto === "http" || forwardedProto === "https")) {
+            return `${forwardedProto}://${forwardedHost}`;
+        }
+    }
+    return `http://${nodeRequest.headers.host ?? `${host}:${port}`}`;
+}
+function isActiveRunStatus(status) {
+    return typeof status === "string" && ["queued", "starting", "running", "streaming", "waiting", "blocked", "retrying", "compacting", "pausing"].includes(status);
+}
+function isActiveRunSnapshotStatus(status) {
+    return typeof status === "string" && (status === "queued" || status === "running");
+}
+function gatewayMode(options) {
+    if (process.env.PIBO_FALLBACK_MODE === "1")
+        return "fallback";
+    return options.gatewayMode ?? "unknown";
+}
+function collectActiveRuns(channelContext) {
+    const directRuns = channelContext.listRuns?.({ includeConsumed: true, includeDetached: true });
+    if (directRuns)
+        return directRuns.filter((run) => isActiveRunSnapshotStatus(run.status));
+    const sessions = channelContext.listSessions?.() ?? [];
+    const runs = [];
+    const seen = new Set();
+    for (const session of sessions) {
+        const snapshot = channelContext.snapshotSignalTree?.(session.id);
+        const snapshotObject = snapshot && typeof snapshot === "object" ? snapshot : undefined;
+        const rawSessions = snapshotObject?.sessions;
+        const sessionSnapshots = Array.isArray(rawSessions) ? rawSessions : rawSessions && typeof rawSessions === "object" ? Object.values(rawSessions) : [];
+        for (const item of sessionSnapshots) {
+            if (!item || typeof item !== "object")
+                continue;
+            const activeRuns = item.activeRuns;
+            if (!Array.isArray(activeRuns))
+                continue;
+            for (const run of activeRuns) {
+                if (!run || typeof run !== "object")
+                    continue;
+                const runId = String(run.runId ?? "");
+                const status = run.status;
+                if (!isActiveRunStatus(status))
+                    continue;
+                const key = runId || JSON.stringify(run);
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                runs.push(run);
+            }
+        }
+    }
+    return runs;
+}
+function createGatewayRuntimeStatuses(channelContext) {
+    const statuses = channelContext.listSessionRuntimeStatuses?.() ?? [];
+    return statuses.map((status) => {
+        try {
+            const snapshot = channelContext.snapshotSignalSession?.(status.piboSessionId);
+            const activeTelemetry = snapshot?.sessions[status.piboSessionId]?.activeTelemetry;
+            return activeTelemetry ? { ...status, activeTelemetry } : status;
+        }
+        catch {
+            return status;
+        }
+    });
+}
+function createGatewayStatusResponse(channelContext, options) {
+    const mode = gatewayMode(options);
+    return responseJson({
+        status: "ok",
+        mode,
+        health: { status: "ok", mode },
+        runtimeStatuses: createGatewayRuntimeStatuses(channelContext),
+        activeRuns: collectActiveRuns(channelContext),
+    });
+}
+function createCanonicalRedirect(request, canonicalBaseURL) {
+    if (!canonicalBaseURL || (request.method !== "GET" && request.method !== "HEAD"))
+        return undefined;
+    const url = new URL(request.url);
+    const canonical = new URL(canonicalBaseURL);
+    if (url.origin === canonical.origin)
+        return undefined;
+    if (url.pathname !== "/" && !matchPrefix(url.pathname, "/apps") && !matchPrefix(url.pathname, "/api/auth")) {
+        return undefined;
+    }
+    return redirect(new URL(`${url.pathname}${url.search}`, canonical.origin).toString());
+}
+export function createWebHostChannel(options = {}) {
+    const host = options.host ?? DEFAULT_WEB_CHANNEL_HOST;
+    const port = options.port ?? DEFAULT_WEB_CHANNEL_PORT;
+    let server;
+    let context;
+    const requireContext = () => {
+        if (!context)
+            throw new Error("Web channel is not started");
+        return context;
+    };
+    const handleAuthRequest = async (request) => {
+        const auth = requireContext().auth;
+        if (!auth?.handleRequest) {
+            return responseJson({ error: "Auth service does not expose HTTP routes" }, { status: 500 });
+        }
+        return auth.handleRequest(request);
+    };
+    const handleRequest = async (nodeRequest, nodeResponse) => {
+        try {
+            const baseURL = createRequestBaseURL(nodeRequest, host, port);
+            const baseRequest = await nodeRequestToWebRequest(nodeRequest, baseURL);
+            // Inject the TCP socket peer into every request so the local auth
+            // plugin can apply the same loopback predicate from `getSession`
+            // regardless of whether the call came from a browser cookie, the
+            // VS Code extension, or a CLI script. The header is stripped from
+            // any outgoing response by `stripSocketPeerHeaderFromResponse`.
+            const request = withSocketPeerHeader(baseRequest, nodeRequest.socket.remoteAddress);
+            const url = new URL(request.url);
+            const canonicalRedirect = createCanonicalRedirect(request, options.canonicalBaseURL);
+            if (canonicalRedirect) {
+                await sendWebResponse(nodeResponse, canonicalRedirect);
+                return;
+            }
+            if (url.pathname === "/health") {
+                await sendWebResponse(nodeResponse, responseJson({
+                    status: "ok",
+                    mode: process.env.PIBO_FALLBACK_MODE === "1" ? "fallback" : "main",
+                }));
+                return;
+            }
+            if (url.pathname === "/gateway/status") {
+                await sendWebResponse(nodeResponse, createGatewayStatusResponse(requireContext(), options));
+                return;
+            }
+            if (url.pathname.startsWith("/api/auth/")) {
+                const authResponse = stripSocketPeerHeaderFromResponse(await handleAuthRequest(request));
+                await sendWebResponse(nodeResponse, authResponse);
+                return;
+            }
+            const ctx = requireContext();
+            const simpleApiResponse = await handleSimpleAgentApiRequest(request, ctx);
+            if (simpleApiResponse) {
+                await sendWebResponse(nodeResponse, simpleApiResponse);
+                return;
+            }
+            const apps = ctx.getWebApps();
+            const app = apps.find((candidate) => matchPrefix(url.pathname, candidate.mountPath) || matchPrefix(url.pathname, candidate.apiPrefix));
+            if (app) {
+                const response = await app.handleRequest(request, createAppContext(ctx));
+                await sendWebResponse(nodeResponse, response ?? notFound());
+                return;
+            }
+            if (url.pathname === "/" && apps[0]) {
+                await sendWebResponse(nodeResponse, redirect(apps[0].mountPath));
+                return;
+            }
+            if (url.pathname === "/") {
+                await sendWebResponse(nodeResponse, responseHtml("<!doctype html><title>Pibo</title><p>No web apps registered.</p>"));
+                return;
+            }
+            await sendWebResponse(nodeResponse, notFound());
+        }
+        catch (error) {
+            const status = error instanceof PiboAuthError || error instanceof PiboWebHttpError ? error.statusCode : 500;
+            await sendWebResponse(nodeResponse, responseJson({ error: error instanceof Error ? error.message : String(error) }, { status }));
+        }
+    };
+    return {
+        name: WEB_CHANNEL_NAME,
+        kind: "web",
+        description: "Same-origin HTTP host for pibo web apps and auth routes.",
+        auth: { mode: "required" },
+        async start(channelContext) {
+            if (server)
+                return;
+            context = channelContext;
+            server = createServer((request, response) => {
+                void handleRequest(request, response);
+            });
+            await new Promise((resolve, reject) => {
+                server.once("error", reject);
+                server.listen(port, host, () => {
+                    server.off("error", reject);
+                    resolve();
+                });
+            });
+            const address = this.getAddress();
+            if (address && options.announce !== false) {
+                console.error(`pibo web host listening on http://${address.host}:${address.port}`);
+            }
+        },
+        async stop() {
+            context = undefined;
+            if (server) {
+                await new Promise((resolve, reject) => {
+                    server.close((error) => (error ? reject(error) : resolve()));
+                });
+                server = undefined;
+            }
+        },
+        getAddress() {
+            const address = server?.address();
+            if (!address || typeof address === "string")
+                return undefined;
+            return { host: address.address, port: address.port };
+        },
+    };
+}