@pasko70/pibo 1.9.9 → 1.9.11

package/dist/gateway/server.js

@@ -0,0 +1,399 @@
+import { createServer } from "node:net";
+import { createDefaultPiboPluginRegistry, createPiboProfileFromRegistryOrDefault, resolvePiboProfileNameFromRegistryOrDefault } from "../plugins/builtin.js";
+import { PiboSessionRouter } from "../core/session-router.js";
+import { loadPiboModelDefaults, selectRequestedModelProfile } from "../core/model-defaults.js";
+import { ResourceReaperService } from "../resources/reaper.js";
+import { DEFAULT_GATEWAY_HOST, DEFAULT_GATEWAY_PORT, encodeFrame, errorResponse, isGatewayRequestFrame, isGatewaySubscribeFrame, } from "./protocol.js";
+import { releaseFallbackGatewayPid, releaseGatewayPid, writeFallbackGatewayPid, writeGatewayPid } from "./pidfile.js";
+const DEFAULT_MAX_BACKPRESSURE_FRAMES = 1_000;
+const DEFAULT_MAX_BACKPRESSURE_BYTES = 4 * 1024 * 1024;
+function parseJsonLine(line) {
+    try {
+        return JSON.parse(line);
+    }
+    catch {
+        throw new Error("Invalid JSON frame");
+    }
+}
+function classifyGatewayEvent(event) {
+    if (event.type === "assistant_delta" || event.type === "thinking_delta" || event.type === "tool_execution_updated") {
+        return "live-delta";
+    }
+    if (event.type === "pi_event")
+        return "debug";
+    if (event.type === "session_error" || event.type === "execution_result" || event.type.endsWith("_finished")) {
+        return "critical";
+    }
+    return "structural";
+}
+function isDroppableRouterEvent(event) {
+    const eventClass = classifyGatewayEvent(event);
+    return eventClass === "live-delta" || eventClass === "debug";
+}
+function createConnection(socket, options) {
+    const queue = [];
+    const diagnostics = {
+        slow: false,
+        queuedFrames: 0,
+        queuedBytes: 0,
+        droppedEvents: 0,
+        closedForBackpressure: false,
+        subscription: { type: "legacy-all" },
+    };
+    function syncDiagnostics() {
+        diagnostics.queuedFrames = queue.length;
+        diagnostics.queuedBytes = queue.reduce((sum, item) => sum + item.bytes, 0);
+    }
+    function recordDroppedEvent() {
+        diagnostics.droppedEvents += 1;
+        options.onDroppedEvent();
+    }
+    function closeForBackpressure() {
+        if (!diagnostics.closedForBackpressure) {
+            diagnostics.closedForBackpressure = true;
+            options.onClosedForBackpressure();
+        }
+        socket.destroy(new Error("Gateway client closed because its send backlog exceeded the backpressure limit"));
+    }
+    function tryFlush() {
+        if (socket.destroyed)
+            return;
+        diagnostics.slow = false;
+        while (queue.length > 0) {
+            const next = queue[0];
+            const accepted = socket.write(encodeFrame(next.frame));
+            queue.shift();
+            syncDiagnostics();
+            if (!accepted) {
+                diagnostics.slow = true;
+                return;
+            }
+        }
+    }
+    socket.on("drain", tryFlush);
+    const connection = {
+        socket,
+        subscription: diagnostics.subscription,
+        diagnostics,
+        send(frame, sendOptions = {}) {
+            if (socket.destroyed)
+                return;
+            const encoded = encodeFrame(frame);
+            if (!diagnostics.slow && queue.length === 0) {
+                const accepted = socket.write(encoded);
+                if (accepted)
+                    return;
+                diagnostics.slow = true;
+            }
+            const queued = { frame, bytes: Buffer.byteLength(encoded), droppable: sendOptions.droppable === true };
+            if (queued.droppable && (queue.length >= options.maxBackpressureFrames || diagnostics.queuedBytes + queued.bytes > options.maxBackpressureBytes)) {
+                recordDroppedEvent();
+                return;
+            }
+            queue.push(queued);
+            syncDiagnostics();
+            if (queue.length > options.maxBackpressureFrames || diagnostics.queuedBytes > options.maxBackpressureBytes) {
+                const dropIndex = queue.findIndex((item) => item.droppable);
+                if (dropIndex >= 0) {
+                    queue.splice(dropIndex, 1);
+                    recordDroppedEvent();
+                    syncDiagnostics();
+                }
+                else {
+                    closeForBackpressure();
+                }
+            }
+        },
+        matches(event) {
+            if (connection.subscription.type === "legacy-all")
+                return true;
+            return event.piboSessionId === connection.subscription.piboSessionId;
+        },
+    };
+    return connection;
+}
+async function createGatewaySessionStore(options) {
+    if (options.sessionDbPath) {
+        const { SqlitePiboSessionStore } = await import("../sessions/sqlite-store.js");
+        return new SqlitePiboSessionStore(options.sessionDbPath);
+    }
+    const { createDefaultPiboDataSessionStore } = await import("../sessions/pibo-data-store.js");
+    return createDefaultPiboDataSessionStore();
+}
+export class PiboGatewayServer {
+    options;
+    pluginRegistry;
+    sessionStore;
+    ownsSessionStore = false;
+    router;
+    startedChannels = [];
+    connections = new Set();
+    droppedRouterEvents = 0;
+    closedSlowClients = 0;
+    server;
+    unsubscribe;
+    resourceReaper;
+    constructor(options = {}) {
+        this.options = options;
+        this.pluginRegistry = options.pluginRegistry ?? createDefaultPiboPluginRegistry();
+    }
+    async start() {
+        if (this.server)
+            return;
+        this.validateChannels();
+        this.sessionStore = this.options.sessionStore ?? (await createGatewaySessionStore(this.options));
+        this.ownsSessionStore = !this.options.sessionStore;
+        this.router = new PiboSessionRouter({
+            persistSession: this.options.persistSession,
+            pluginRegistry: this.pluginRegistry,
+            sessionStore: this.sessionStore,
+        });
+        this.unsubscribe = this.router.subscribe((event) => this.broadcastRouterEvent(event));
+        this.server = createServer((socket) => this.handleSocket(socket));
+        await this.pluginRegistry.getAuthService()?.start?.();
+        await new Promise((resolve, reject) => {
+            this.server.once("error", reject);
+            this.server.listen(this.options.port ?? DEFAULT_GATEWAY_PORT, this.options.host ?? DEFAULT_GATEWAY_HOST, () => {
+                this.server.off("error", reject);
+                resolve();
+            });
+        });
+        if (this.options.startChannels !== false) {
+            await this.startChannels();
+        }
+        if (this.options.resourceReaper) {
+            this.resourceReaper = new ResourceReaperService(this.options.resourceReaper);
+            await this.resourceReaper.start();
+        }
+    }
+    async stop() {
+        await this.resourceReaper?.stop();
+        this.resourceReaper = undefined;
+        await this.stopChannels();
+        await this.pluginRegistry.getAuthService()?.stop?.();
+        this.unsubscribe?.();
+        this.unsubscribe = undefined;
+        for (const connection of this.connections) {
+            connection.socket.destroy();
+        }
+        this.connections.clear();
+        if (this.server) {
+            await new Promise((resolve, reject) => {
+                this.server.close((error) => (error ? reject(error) : resolve()));
+            });
+            this.server = undefined;
+        }
+        await this.router?.disposeAll();
+        this.router = undefined;
+        if (this.ownsSessionStore) {
+            this.sessionStore?.close?.();
+        }
+        this.sessionStore = undefined;
+        this.ownsSessionStore = false;
+    }
+    handleSocket(socket) {
+        const connection = createConnection(socket, {
+            maxBackpressureFrames: this.options.maxBackpressureFrames ?? DEFAULT_MAX_BACKPRESSURE_FRAMES,
+            maxBackpressureBytes: this.options.maxBackpressureBytes ?? DEFAULT_MAX_BACKPRESSURE_BYTES,
+            onDroppedEvent: () => {
+                this.droppedRouterEvents += 1;
+            },
+            onClosedForBackpressure: () => {
+                this.closedSlowClients += 1;
+            },
+        });
+        this.connections.add(connection);
+        let buffer = "";
+        socket.setEncoding("utf-8");
+        socket.on("data", (chunk) => {
+            buffer += chunk;
+            let newlineIndex = buffer.indexOf("\n");
+            while (newlineIndex !== -1) {
+                const line = buffer.slice(0, newlineIndex).trim();
+                buffer = buffer.slice(newlineIndex + 1);
+                if (line) {
+                    void this.handleLine(connection, line);
+                }
+                newlineIndex = buffer.indexOf("\n");
+            }
+        });
+        socket.once("close", () => {
+            this.connections.delete(connection);
+        });
+        socket.once("error", () => {
+            this.connections.delete(connection);
+        });
+    }
+    async handleLine(connection, line) {
+        let frame;
+        try {
+            frame = parseJsonLine(line);
+        }
+        catch (error) {
+            connection.send(errorResponse("invalid", error));
+            return;
+        }
+        if (isGatewaySubscribeFrame(frame)) {
+            connection.subscription = frame.subscription;
+            connection.diagnostics.subscription = frame.subscription;
+            connection.send({ type: "res", id: frame.id, ok: true, payload: { subscription: frame.subscription } });
+            return;
+        }
+        if (!isGatewayRequestFrame(frame)) {
+            connection.send(errorResponse("invalid", new Error("Invalid request frame")));
+            return;
+        }
+        try {
+            const output = await this.requireRouter().emit(frame.event);
+            const response = {
+                type: "res",
+                id: frame.id,
+                ok: true,
+                payload: output,
+            };
+            connection.send(response);
+        }
+        catch (error) {
+            connection.send(errorResponse(frame.id, error));
+        }
+    }
+    broadcastRouterEvent(event) {
+        for (const connection of this.connections) {
+            if (!connection.matches(event))
+                continue;
+            connection.send({ type: "event", event: "router", payload: event }, { droppable: isDroppableRouterEvent(event) });
+        }
+    }
+    getDiagnostics() {
+        const connectionDetails = [...this.connections].map((connection) => ({ ...connection.diagnostics }));
+        return {
+            connections: connectionDetails.length,
+            slowConnections: connectionDetails.filter((connection) => connection.slow).length,
+            droppedEvents: this.droppedRouterEvents,
+            closedSlowClients: this.closedSlowClients,
+            connectionDetails,
+        };
+    }
+    async startChannels() {
+        const context = this.createChannelContext();
+        for (const channel of this.pluginRegistry.getChannels()) {
+            if (channel.auth.mode === "none") {
+                console.error(`Warning: channel "${channel.name}" starts without auth`);
+            }
+            await channel.start(context);
+            this.startedChannels.push(channel);
+        }
+    }
+    validateChannels() {
+        for (const channel of this.pluginRegistry.getChannels()) {
+            if (channel.auth.mode === "required" && !this.pluginRegistry.getAuthService()) {
+                throw new Error(`Channel "${channel.name}" requires auth, but no auth service is registered`);
+            }
+        }
+    }
+    async stopChannels() {
+        while (this.startedChannels.length > 0) {
+            const channel = this.startedChannels.pop();
+            await channel.stop?.();
+        }
+    }
+    createChannelContext() {
+        return {
+            emit: (event) => this.requireRouter().emit(event),
+            subscribe: (listener) => this.requireRouter().subscribe(listener),
+            getSession: (id) => this.requireSessionStore().get(id),
+            createSession: (input) => {
+                const profile = resolvePiboProfileNameFromRegistryOrDefault(this.pluginRegistry, input.profile);
+                const profileContext = createPiboProfileFromRegistryOrDefault(this.pluginRegistry, profile);
+                const activeModel = input.activeModel ?? selectRequestedModelProfile(profileContext, loadPiboModelDefaults());
+                return this.requireSessionStore().create({ ...input, profile, activeModel });
+            },
+            updateSession: (id, input) => this.requireSessionStore().update(id, input),
+            setLiveSessionActiveModel: (id, model) => this.requireRouter().setLiveSessionActiveModel(id, model),
+            reportSessionError: (id, error, options) => this.requireRouter().reportSessionError(id, error, options),
+            deleteSession: (id) => this.requireSessionStore().delete?.(id) ?? false,
+            findSessions: (input) => this.requireSessionStore().find(input),
+            listSessions: () => this.requireSessionStore().list?.() ?? [],
+            getSessionRuntimeStatus: (piboSessionId) => this.requireRouter().getSessionRuntimeStatus(piboSessionId),
+            listSessionRuntimeStatuses: () => this.requireRouter().listSessionRuntimeStatuses(),
+            listRuns: (options) => this.requireRouter().listRuns(options),
+            snapshotSignalSession: (piboSessionId) => this.requireRouter().snapshotSignalSession(piboSessionId),
+            snapshotSignalTree: (rootPiboSessionId) => this.requireRouter().snapshotSignalTree(rootPiboSessionId),
+            snapshotSignalStatuses: () => this.requireRouter().snapshotSignalStatuses(),
+            subscribeSignalTree: (rootPiboSessionId, listener) => this.requireRouter().subscribeSignalTree(rootPiboSessionId, listener),
+            subscribeSignalStatuses: (listener) => this.requireRouter().subscribeSignalStatuses(listener),
+            getGatewayActions: () => this.pluginRegistry.getGatewayActionInfos(),
+            getProfiles: () => this.pluginRegistry.getProfileInfos(),
+            createProfile: (name) => this.pluginRegistry.createProfile(name),
+            getCapabilityCatalog: () => this.pluginRegistry.getCapabilityCatalog(),
+            getRalphStopConditionDefinitions: () => this.pluginRegistry.getRalphStopConditionDefinitions(),
+            getRalphStopConditionInfos: () => this.pluginRegistry.getRalphStopConditionInfos(),
+            upsertProfile: (profile) => this.pluginRegistry.upsertProfile(profile),
+            removeProfile: (name) => this.pluginRegistry.removeProfile(name),
+            upsertContextFile: (contextFile) => this.pluginRegistry.upsertContextFile(contextFile),
+            removeContextFile: (key) => this.pluginRegistry.removeContextFile(key),
+            registerSkill: (skill) => this.pluginRegistry.registerSkill(skill),
+            unregisterSkill: (name) => this.pluginRegistry.unregisterSkill(name),
+            emitProductEvent: (event) => this.pluginRegistry.emitProductEvent(event),
+            subscribeProductEvents: (listener) => this.pluginRegistry.onProductEvent(listener),
+            auth: this.pluginRegistry.getAuthService(),
+            getWebApps: () => this.pluginRegistry.getWebApps(),
+        };
+    }
+    requireRouter() {
+        if (!this.router)
+            throw new Error("Gateway router is not started");
+        return this.router;
+    }
+    requireSessionStore() {
+        if (!this.sessionStore)
+            throw new Error("Gateway session store is not started");
+        return this.sessionStore;
+    }
+}
+export function resolveGatewayResourceReaperOptions(options) {
+    if (options.resourceReaper === false || process.env.PIBO_RESOURCE_REAPER_DISABLED === "1")
+        return false;
+    return options.resourceReaper ?? {};
+}
+export async function runGatewayServer(options = {}) {
+    const fallbackMode = process.env.PIBO_FALLBACK_MODE === "1";
+    try {
+        if (fallbackMode)
+            writeFallbackGatewayPid();
+        else
+            writeGatewayPid();
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+        return;
+    }
+    const releasePid = fallbackMode ? releaseFallbackGatewayPid : releaseGatewayPid;
+    let server;
+    try {
+        server = new PiboGatewayServer({ ...options, resourceReaper: resolveGatewayResourceReaperOptions(options) });
+        await server.start();
+    }
+    catch (error) {
+        releasePid();
+        throw error;
+    }
+    const host = options.host ?? DEFAULT_GATEWAY_HOST;
+    const port = options.port ?? DEFAULT_GATEWAY_PORT;
+    console.error(`pibo gateway listening on ${host}:${port}`);
+    const stop = async () => {
+        try {
+            await server.stop();
+        }
+        finally {
+            releasePid();
+        }
+    };
+    process.once("SIGINT", () => {
+        void stop().finally(() => process.exit(0));
+    });
+    process.once("SIGTERM", () => {
+        void stop().finally(() => process.exit(0));
+    });
+}

package/dist/gateway/tool.js

@@ -0,0 +1,72 @@
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { sendGatewayMessageAndWaitForReply } from "./request.js";
+export function createPiboGatewaySendTool(sendGatewayMessage = sendGatewayMessageAndWaitForReply) {
+    return defineTool({
+        name: "pibo_gateway_send",
+        label: "Pibo Gateway Send",
+        description: "Send a message through the local pibo gateway to a target session and return the target assistant reply.",
+        promptSnippet: "Send a message through the local pibo gateway to a target session and return the final assistant reply from that session.",
+        parameters: Type.Object({
+            piboSessionId: Type.String({ description: "Target Pibo gateway session id" }),
+            message: Type.String({ description: "Message to enqueue for the target session" }),
+        }),
+        async execute(_toolCallId, params) {
+            let result;
+            let response;
+            try {
+                result = await sendGatewayMessage({
+                    type: "message",
+                    piboSessionId: params.piboSessionId,
+                    text: params.message,
+                    source: "actor",
+                });
+                response = result.response;
+            }
+            catch (error) {
+                response = {
+                    type: "res",
+                    id: "",
+                    ok: false,
+                    error: { message: error instanceof Error ? error.message : String(error) },
+                };
+            }
+            if (!response.ok) {
+                const message = response.error?.message ?? "Gateway rejected the message";
+                const details = { ok: false, piboSessionId: params.piboSessionId, error: message };
+                return {
+                    content: [{ type: "text", text: `Gateway error: ${message}` }],
+                    details,
+                };
+            }
+            const details = {
+                ok: true,
+                piboSessionId: params.piboSessionId,
+                gatewayPayload: response.payload,
+                reply: result?.reply?.text,
+            };
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: result?.reply
+                            ? result.reply.text
+                            : `Queued message for pibo gateway session "${params.piboSessionId}", but no assistant reply was returned.`,
+                    },
+                ],
+                details,
+            };
+        },
+    });
+}
+const piboGatewaySendTool = createPiboGatewaySendTool();
+export function createPiboGatewayToolProfiles() {
+    return [createToolProfile(piboGatewaySendTool)];
+}
+function createToolProfile(definition) {
+    return {
+        name: definition.name,
+        description: definition.description,
+        definition,
+    };
+}

package/dist/gateway/web.js

@@ -0,0 +1,224 @@
+import { createDefaultPiboPlugins } from "../plugins/builtin.js";
+import { createPiboBetterAuthPlugin } from "../plugins/better-auth.js";
+import { createPiboChatCustomAgentProfilesPlugin } from "../plugins/chat-custom-agents.js";
+import { createPiboChatUserSkillsPlugin } from "../plugins/chat-user-skills.js";
+import { createPiboChatWebPlugin } from "../plugins/chat-web.js";
+import { createPiboChatVscodeWebPlugin } from "../plugins/chat-vscode-web.js";
+import { createPiboContextFilesPlugin } from "../plugins/context-files.js";
+import { createPiboCronPlugin } from "../cron/plugin.js";
+import { createPiboRalphPlugin } from "../ralph/plugin.js";
+import { createPiboDevAuthPlugin } from "../plugins/dev-auth.js";
+import { PiboPluginRegistry } from "../plugins/registry.js";
+import { createPiboWebHostPlugin } from "../plugins/web.js";
+import { DEFAULT_WEB_CHANNEL_HOST, DEFAULT_WEB_CHANNEL_PORT } from "../web/channel.js";
+import { loadPiboConfig } from "../config/config.js";
+import { PiboGatewayServer, resolveGatewayResourceReaperOptions } from "./server.js";
+import { releaseFallbackGatewayPid, releaseGatewayPid, writeFallbackGatewayPid, writeGatewayPid } from "./pidfile.js";
+const PUBLIC_WEB_CHANNEL_HOST = "0.0.0.0";
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "::1", "[::1]"]);
+function isComputeWorkerRuntime() {
+    return process.env.PIBO_COMPUTE_WORKER === "1";
+}
+export function isLoopbackHost(value) {
+    if (!value)
+        return false;
+    const normalized = value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+    return LOOPBACK_HOSTS.has(normalized);
+}
+function bindHost(options) {
+    return options.web?.host ?? DEFAULT_WEB_CHANNEL_HOST;
+}
+function requireLocalAuthBind(options) {
+    const host = bindHost(options);
+    if (isLoopbackHost(host))
+        return;
+    if (isComputeWorkerRuntime()) {
+        console.error(`[pibo] WARNING: local auth is active in a Docker worker with bind ${host}. ` +
+            "The Docker network is the security boundary; ensure the host port mapping is loopback-only.");
+        return;
+    }
+    throw new Error(`Local auth requires a loopback bind (127.0.0.1, ::1, or localhost). Got '${host}'. ` +
+        "Either drop --web-host or pick authMode=better-auth for a public bind.");
+}
+function localAuthStartupWarning(options) {
+    const host = bindHost(options);
+    console.error(`[pibo] LOCAL AUTH ENABLED — bound to ${host}. ` +
+        "This mode is unsafe if the port is reachable from the public internet. " +
+        "Use authMode=better-auth for production deployments.");
+}
+export function resolveWebGatewayAuthMode(options = {}) {
+    const configMode = loadPiboConfig().auth?.mode;
+    const explicit = options.authMode;
+    const legacyDevAuth = options.devAuth === true;
+    if (process.env.PIBO_DEV_AUTH === "1") {
+        throw new Error("PIBO_DEV_AUTH is deprecated. Use `pibo gateway:web --auth=local --web-host=127.0.0.1` on the host, " +
+            "or rely on the Docker worker entrypoint inside a worker.");
+    }
+    if (explicit === "local" || legacyDevAuth || configMode === "local") {
+        requireLocalAuthBind(options);
+        localAuthStartupWarning(options);
+        return "dev-auth";
+    }
+    if (explicit === "better-auth" || configMode === "better-auth") {
+        return "better-auth";
+    }
+    return "better-auth";
+}
+function rebaseLoopbackAuthBaseURL(baseURL, options) {
+    if (!baseURL)
+        return undefined;
+    if (options.web?.host === undefined && options.web?.port === undefined)
+        return baseURL;
+    try {
+        const parsed = new URL(baseURL);
+        if (!isLoopbackHost(parsed.hostname))
+            return baseURL;
+        if (options.web?.host !== undefined && isLoopbackHost(options.web.host)) {
+            parsed.hostname = options.web.host.startsWith("[") && options.web.host.endsWith("]") ? options.web.host.slice(1, -1) : options.web.host;
+        }
+        if (options.web?.port !== undefined)
+            parsed.port = String(options.web.port);
+        return parsed.toString().replace(/\/$/, "");
+    }
+    catch {
+        return baseURL;
+    }
+}
+function authBaseURL(options) {
+    return options.auth?.baseURL ?? rebaseLoopbackAuthBaseURL(loadPiboConfig().auth?.baseURL, options);
+}
+function defaultWebHost(baseURL, options = {}) {
+    // When local auth is selected, always default to loopback bind to keep the
+    // loopback-bind gate trivially satisfied. The user can still override
+    // --web-host, but `resolveWebGatewayAuthMode` will then enforce the gate.
+    const mode = options.authMode ?? loadPiboConfig().auth?.mode ?? "better-auth";
+    if (mode === "local" && options.web?.host === undefined)
+        return DEFAULT_WEB_CHANNEL_HOST;
+    if (!baseURL)
+        return DEFAULT_WEB_CHANNEL_HOST;
+    try {
+        const hostname = new URL(baseURL).hostname;
+        return LOOPBACK_HOSTS.has(hostname) ? DEFAULT_WEB_CHANNEL_HOST : PUBLIC_WEB_CHANNEL_HOST;
+    }
+    catch {
+        return DEFAULT_WEB_CHANNEL_HOST;
+    }
+}
+export function resolveWebGatewayServerOptions(options = {}) {
+    const baseURL = authBaseURL(options);
+    return {
+        ...options,
+        auth: {
+            ...options.auth,
+            ...(baseURL ? { baseURL } : {}),
+        },
+        web: {
+            ...options.web,
+            host: options.web?.host ?? defaultWebHost(baseURL, options),
+        },
+    };
+}
+function webGatewayMode(options, useDevAuth) {
+    if (process.env.PIBO_GATEWAY_MODE === "dev" || process.env.PIBO_GATEWAY_MODE === "prod")
+        return process.env.PIBO_GATEWAY_MODE;
+    if (useDevAuth)
+        return "dev";
+    if (options.web?.port === 4808)
+        return "dev";
+    const baseURL = authBaseURL(options);
+    if (baseURL) {
+        try {
+            if (new URL(baseURL).hostname.startsWith("dev."))
+                return "dev";
+        }
+        catch {
+            // Fall through to production mode.
+        }
+    }
+    return "prod";
+}
+export function createWebPiboPluginRegistry(options = {}) {
+    const resolvedOptions = resolveWebGatewayServerOptions(options);
+    const useDevAuth = resolveWebGatewayAuthMode(resolvedOptions) === "dev-auth";
+    return PiboPluginRegistry.create({
+        plugins: [
+            ...createDefaultPiboPlugins(),
+            useDevAuth ? createPiboDevAuthPlugin() : createPiboBetterAuthPlugin(resolvedOptions.auth),
+            createPiboWebHostPlugin({ announce: false, canonicalBaseURL: useDevAuth ? undefined : authBaseURL(resolvedOptions), gatewayMode: webGatewayMode(resolvedOptions, useDevAuth), ...resolvedOptions.web }),
+            createPiboCronPlugin({ cronStorePath: resolvedOptions.chat?.cronStorePath, dataStorePath: resolvedOptions.chat?.dataStorePath, dataPayloadRootDir: resolvedOptions.chat?.dataPayloadRootDir }),
+            createPiboChatUserSkillsPlugin({
+                globalRoot: resolvedOptions.chat?.userSkillGlobalRoot,
+                workspaceRoot: resolvedOptions.chat?.userSkillWorkspaceRoot,
+            }),
+            createPiboChatCustomAgentProfilesPlugin({ agentStorePath: resolvedOptions.chat?.agentStorePath }),
+            createPiboRalphPlugin({ ralphStorePath: resolvedOptions.chat?.ralphStorePath, dataStorePath: resolvedOptions.chat?.dataStorePath, dataPayloadRootDir: resolvedOptions.chat?.dataPayloadRootDir }),
+            createPiboContextFilesPlugin(resolvedOptions.contextFiles),
+            createPiboChatWebPlugin(resolvedOptions.chat),
+            createPiboChatVscodeWebPlugin(),
+        ],
+    });
+}
+function createChatAppURL(options, host, port) {
+    const useLocalAuth = options.authMode === "local" || options.devAuth === true || loadPiboConfig().auth?.mode === "local";
+    if (useLocalAuth) {
+        return `http://${host}:${port}/apps/chat`;
+    }
+    const baseURL = options.auth?.baseURL ?? loadPiboConfig().auth?.baseURL;
+    if (baseURL) {
+        try {
+            return new URL("/apps/chat", baseURL).toString();
+        }
+        catch {
+            // Fall through to the bound address below.
+        }
+    }
+    return `http://${host}:${port}/apps/chat`;
+}
+export async function runWebGatewayServer(options = {}) {
+    const fallbackMode = process.env.PIBO_FALLBACK_MODE === "1";
+    try {
+        if (fallbackMode)
+            writeFallbackGatewayPid();
+        else
+            writeGatewayPid();
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+        return;
+    }
+    const releasePid = fallbackMode ? releaseFallbackGatewayPid : releaseGatewayPid;
+    let resolvedOptions;
+    let server;
+    try {
+        resolvedOptions = resolveWebGatewayServerOptions(options);
+        const pluginRegistry = resolvedOptions.pluginRegistry ?? createWebPiboPluginRegistry(resolvedOptions);
+        server = new PiboGatewayServer({
+            ...resolvedOptions,
+            pluginRegistry,
+            resourceReaper: resolveGatewayResourceReaperOptions(resolvedOptions),
+        });
+        await server.start();
+    }
+    catch (error) {
+        releasePid();
+        throw error;
+    }
+    const host = resolvedOptions.web?.host ?? DEFAULT_WEB_CHANNEL_HOST;
+    const port = resolvedOptions.web?.port ?? DEFAULT_WEB_CHANNEL_PORT;
+    console.error(`pibo chat app available at ${createChatAppURL(resolvedOptions, host, port)}`);
+    const stop = async () => {
+        try {
+            await server.stop();
+        }
+        finally {
+            releasePid();
+        }
+    };
+    process.once("SIGINT", () => {
+        void stop().finally(() => process.exit(0));
+    });
+    process.once("SIGTERM", () => {
+        void stop().finally(() => process.exit(0));
+    });
+}