@pasko70/pibo 3.0.1 → 3.1.0

package/dist/compute/docker.js

@@ -1,11 +1,20 @@
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
-import { createHash } from "node:crypto";
-import { readFile, readdir, writeFile, mkdir } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { copyFile, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, rename, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+import dockerIgnoreModule from "@balena/dockerignore";
+import { piboHomePath } from "../core/pibo-home.js";
 import { COMPUTE_RESOURCE_POLICY_LABELS, buildComputeResourcePolicyLabels, buildDockerResourcePolicyArgs, resolveComputeResourcePolicy, } from "./resource-policy.js";
 const execFileAsync = promisify(execFile);
+const createDockerIgnore = dockerIgnoreModule;
 export const IMAGE_NAME = "pibo:latest";
+export const COMPUTE_IMAGE_ENV = "PIBO_COMPUTE_IMAGE";
+export const PACKAGED_COMPUTE_DOCKERFILE = "compute-image/Dockerfile";
+export const COMPUTE_PUBLISH_HOST = "127.0.0.1";
 export const LABEL_ROLE = "pibo.compute.role";
 export const LABEL_CREATED_AT = "pibo.compute.createdAt";
 export const LABEL_HOLDER = "pibo.compute.holder";
@@ -19,9 +28,67 @@ export const LABEL_CLEANUP_STATE = "pibo.compute.cleanupState";
 export const LABEL_DIRTY_REASON = "pibo.compute.dirtyReason";
 export const LABEL_RALPH_JOB_ID = "pibo.ralph.jobId";
 export const LABEL_RALPH_RUN_ID = "pibo.ralph.runId";
-export async function dockerBuild(workspaceDir) {
-    const { stderr } = await execFileAsync("docker", ["build", "-t", IMAGE_NAME, "."], {
-        cwd: workspaceDir,
+export function resolveComputeImageBuildConfig(workspaceDir, options = {}) {
+    const packageRoot = options.packageRoot ?? fileURLToPath(new URL("../../", import.meta.url));
+    const env = options.env ?? process.env;
+    const fileExists = options.fileExists ?? existsSync;
+    const readTextFile = options.readTextFile ?? ((candidate) => readFileSync(candidate, "utf8"));
+    const imageName = env[COMPUTE_IMAGE_ENV]?.trim() || IMAGE_NAME;
+    const workspaceDockerfile = path.join(workspaceDir, "Dockerfile");
+    const workspacePackageJson = path.join(workspaceDir, "package.json");
+    if (fileExists(workspaceDockerfile) && fileExists(workspacePackageJson)) {
+        try {
+            const manifest = JSON.parse(readTextFile(workspacePackageJson));
+            if (manifest.name === "@pasko70/pibo") {
+                return { imageName, buildContext: workspaceDir, source: "workspace" };
+            }
+        }
+        catch {
+            // An unrelated or malformed caller package is not a Pibo source checkout.
+        }
+    }
+    const dockerfile = path.join(packageRoot, PACKAGED_COMPUTE_DOCKERFILE);
+    if (!fileExists(dockerfile)) {
+        throw new Error(`No compute Dockerfile found in workspace ${workspaceDir} or installed package ${dockerfile}`);
+    }
+    return { imageName, buildContext: packageRoot, dockerfile, source: "package" };
+}
+export function buildDockerBuildArgs(config) {
+    return ["build", "-t", config.imageName, ...(config.dockerfile ? ["-f", config.dockerfile] : []), "."];
+}
+export async function dockerBuild(config) {
+    if (config.source === "workspace") {
+        await runDockerBuild(config);
+        return;
+    }
+    if (!config.dockerfile)
+        throw new Error("Packaged compute image build requires a Dockerfile");
+    const stagedContext = await mkdtemp(path.join(tmpdir(), "pibo-compute-image-"));
+    try {
+        const { stdout } = await execFileAsync("npm", ["pack", "--json", "--ignore-scripts", "--pack-destination", stagedContext], {
+            cwd: config.buildContext,
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        const report = JSON.parse(stdout);
+        const filename = report[0]?.filename;
+        if (typeof filename !== "string" || !filename.endsWith(".tgz")) {
+            throw new Error("npm pack did not return a packaged Pibo archive");
+        }
+        await rename(path.join(stagedContext, filename), path.join(stagedContext, "pibo-package.tgz"));
+        await copyFile(config.dockerfile, path.join(stagedContext, "Dockerfile"));
+        await runDockerBuild({
+            imageName: config.imageName,
+            buildContext: stagedContext,
+            source: "workspace",
+        });
+    }
+    finally {
+        await rm(stagedContext, { recursive: true, force: true });
+    }
+}
+async function runDockerBuild(config) {
+    const { stderr } = await execFileAsync("docker", buildDockerBuildArgs(config), {
+        cwd: config.buildContext,
         maxBuffer: 50 * 1024 * 1024,
     });
     if (stderr)
@@ -50,45 +117,83 @@ export async function getDependencyHash(workspaceDir) {
     }
     return hash.digest("hex");
 }
-export async function getSourceHash(workspaceDir) {
+export async function getSourceHash(workspaceDir, dockerfile = path.join(workspaceDir, "Dockerfile")) {
     const hash = createHash("sha256");
-    const files = [];
-    async function walk(dir) {
+    async function readOptionalFile(filePath) {
+        try {
+            return await readFile(filePath, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    const dockerfileIgnorePath = `${dockerfile}.dockerignore`;
+    const dockerfileIgnore = await readOptionalFile(dockerfileIgnorePath);
+    const rootIgnore = await readOptionalFile(path.join(workspaceDir, ".dockerignore"));
+    const activeIgnore = dockerfileIgnore ?? rootIgnore ?? "";
+    const requiredContextPaths = new Set([
+        path.relative(workspaceDir, dockerfile).split(path.sep).join("/"),
+        path.relative(workspaceDir, dockerfileIgnorePath).split(path.sep).join("/"),
+        ".dockerignore",
+    ]);
+    const contextIgnore = createDockerIgnore({ ignorecase: false }).add(activeIgnore
+        .split(/\r?\n/u)
+        .filter((line) => line.trim() !== ".")
+        .join("\n"));
+    const hasNegatedPattern = activeIgnore.split(/\r?\n/u).some((line) => /^\/*!/u.test(line.trim()));
+    const contextEntries = [];
+    function isIgnored(relativePath, directory) {
+        if (requiredContextPaths.has(relativePath))
+            return false;
+        return contextIgnore.ignores(directory ? `${relativePath}/` : relativePath);
+    }
+    async function walk(dir, relativeDir = "") {
+        let containsIncludedEntry = false;
         const entries = await readdir(dir, { withFileTypes: true });
         for (const entry of entries) {
             const fullPath = path.join(dir, entry.name);
+            const relativePath = relativeDir ? `${relativeDir}/${entry.name}` : entry.name;
             if (entry.isDirectory()) {
-                if (entry.name === "node_modules" ||
-                    entry.name === ".git" ||
-                    entry.name === "dist" ||
-                    entry.name === ".pibo" ||
-                    entry.name === "plans" ||
-                    entry.name === "Reports") {
+                const ignored = isIgnored(relativePath, true);
+                if (ignored && !hasNegatedPattern)
                     continue;
+                const containsIncludedChild = await walk(fullPath, relativePath);
+                if (!ignored || containsIncludedChild) {
+                    contextEntries.push({ relativePath, type: "directory" });
+                    containsIncludedEntry = true;
                 }
-                await walk(fullPath);
             }
-            else if (entry.isFile()) {
-                if (entry.name.endsWith(".ts") ||
-                    entry.name.endsWith(".tsx") ||
-                    entry.name === "package.json" ||
-                    entry.name === "package-lock.json" ||
-                    entry.name === "Dockerfile") {
-                    files.push(fullPath);
-                }
+            else if (!isIgnored(relativePath, false)) {
+                contextEntries.push({ relativePath, type: entry.isFile() ? "file" : entry.isSymbolicLink() ? "symlink" : "other" });
+                containsIncludedEntry = true;
             }
         }
+        return containsIncludedEntry;
     }
     await walk(workspaceDir);
-    files.sort();
-    for (const file of files) {
-        const content = await readFile(file);
-        hash.update(content);
+    contextEntries.sort((a, b) => (a.relativePath < b.relativePath ? -1 : a.relativePath > b.relativePath ? 1 : 0));
+    function update(value) {
+        const bytes = typeof value === "string" ? Buffer.from(value) : value;
+        hash.update(`${bytes.length}:`);
+        hash.update(bytes);
+    }
+    for (const entry of contextEntries) {
+        const fullPath = path.join(workspaceDir, entry.relativePath);
+        const stat = await lstat(fullPath);
+        update(entry.type);
+        update(entry.relativePath);
+        update(String(stat.mode & 0o777));
+        if (entry.type === "file")
+            update(await readFile(fullPath));
+        else if (entry.type === "symlink")
+            update(await readlink(fullPath));
     }
     return hash.digest("hex");
 }
-export async function shouldRebuild(workspaceDir, hashFile) {
-    const currentHash = await getSourceHash(workspaceDir);
+export async function shouldRebuild(workspaceDir, hashFile, dockerfile) {
+    const currentHash = await getSourceHash(workspaceDir, dockerfile);
     try {
         const savedHash = await readFile(hashFile, "utf-8");
         return savedHash.trim() !== currentHash;
@@ -107,8 +212,8 @@ export async function shouldRebuildDeps(workspaceDir, hashFile) {
         return true;
     }
 }
-export async function saveHash(workspaceDir, hashFile) {
-    const hash = await getSourceHash(workspaceDir);
+export async function saveHash(workspaceDir, hashFile, dockerfile) {
+    const hash = await getSourceHash(workspaceDir, dockerfile);
     await mkdir(path.dirname(hashFile), { recursive: true });
     await writeFile(hashFile, hash, "utf-8");
 }
@@ -119,6 +224,143 @@ export async function saveDepHash(workspaceDir, hashFile) {
 }
 const DEV_PORT_BASE = 4800;
 const DEV_PORT_BLOCK_SIZE = 10;
+const DEV_PORT_ALLOCATION_LOCK_TIMEOUT_MS = 30_000;
+const DEV_PORT_ALLOCATION_LOCK_POLL_MS = 25;
+const DEV_PORT_ALLOCATION_MALFORMED_STALE_MS = 5_000;
+function devPortAllocationLockPath() {
+    return piboHomePath("compute", "dev-port-allocation.lock");
+}
+function isErrnoException(error, code) {
+    return error instanceof Error && "code" in error && error.code === code;
+}
+function processIsAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return "active";
+    }
+    catch (error) {
+        if (isErrnoException(error, "ESRCH"))
+            return "dead";
+        return "ambiguous";
+    }
+}
+async function processIdentity(pid) {
+    if (process.platform !== "linux")
+        return { liveness: processIsAlive(pid) };
+    let raw;
+    try {
+        raw = await readFile(`/proc/${pid}/stat`, "utf8");
+    }
+    catch (error) {
+        if (isErrnoException(error, "ENOENT") || isErrnoException(error, "ESRCH"))
+            return { liveness: "dead" };
+        return { liveness: "ambiguous" };
+    }
+    const commandEnd = raw.lastIndexOf(")");
+    if (commandEnd < 2 || commandEnd + 2 >= raw.length)
+        return { liveness: "ambiguous" };
+    const fields = raw.slice(commandEnd + 2).trim().split(/\s+/);
+    if (fields[0] === "Z")
+        return { liveness: "dead" };
+    const startTicks = fields[19];
+    if (!startTicks || !/^[1-9][0-9]*$/.test(startTicks))
+        return { liveness: "ambiguous" };
+    return { liveness: "active", startId: `${pid}:${startTicks}` };
+}
+async function devPortAllocationLockOwnerLiveness(owner) {
+    const identity = await processIdentity(owner.pid);
+    if (identity.liveness !== "active")
+        return identity.liveness;
+    if (process.platform !== "linux")
+        return "active";
+    if (!owner.processStartId || !identity.startId)
+        return "ambiguous";
+    return owner.processStartId === identity.startId ? "active" : "dead";
+}
+async function removeAbandonedDevPortAllocationLock(lockPath) {
+    const raw = await readFile(lockPath, "utf8").catch(() => undefined);
+    if (raw === undefined)
+        return;
+    let owner = {};
+    try {
+        owner = JSON.parse(raw);
+    }
+    catch {
+        // A partially written lock can be reclaimed after a short grace period.
+    }
+    const validOwner = typeof owner.pid === "number"
+        && Number.isSafeInteger(owner.pid)
+        && owner.pid > 0
+        && typeof owner.token === "string"
+        && owner.token.length > 0
+        && typeof owner.createdAt === "string"
+        && (owner.processStartId === undefined || typeof owner.processStartId === "string");
+    if (!validOwner) {
+        const lockStat = await stat(lockPath).catch(() => undefined);
+        if (!lockStat || Date.now() - lockStat.mtimeMs <= DEV_PORT_ALLOCATION_MALFORMED_STALE_MS)
+            return;
+    }
+    else if (await devPortAllocationLockOwnerLiveness(owner) !== "dead") {
+        return;
+    }
+    if ((await readFile(lockPath, "utf8").catch(() => undefined)) === raw) {
+        await rm(lockPath, { force: true });
+    }
+}
+async function releaseDevPortAllocationLock(lockPath, token) {
+    try {
+        const owner = JSON.parse(await readFile(lockPath, "utf8"));
+        if (owner.token === token)
+            await rm(lockPath, { force: true });
+    }
+    catch {
+        // The lock was already removed or replaced.
+    }
+}
+async function withDevPortAllocationLock(run) {
+    const lockPath = devPortAllocationLockPath();
+    const token = randomUUID();
+    const startedAt = Date.now();
+    const identity = await processIdentity(process.pid);
+    if (identity.liveness !== "active")
+        throw new Error("Cannot establish compute dev port allocation lock owner identity");
+    while (true) {
+        try {
+            await mkdir(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+            const handle = await open(lockPath, "wx", 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({
+                    pid: process.pid,
+                    ...(identity.startId ? { processStartId: identity.startId } : {}),
+                    token,
+                    createdAt: new Date().toISOString(),
+                }), "utf8");
+            }
+            catch (error) {
+                await handle.close();
+                await rm(lockPath, { force: true });
+                throw error;
+            }
+            await handle.close();
+            break;
+        }
+        catch (error) {
+            if (!isErrnoException(error, "EEXIST"))
+                throw error;
+            await removeAbandonedDevPortAllocationLock(lockPath);
+            if (Date.now() - startedAt >= DEV_PORT_ALLOCATION_LOCK_TIMEOUT_MS) {
+                throw new Error(`Timed out waiting for compute dev port allocation lock ${lockPath}`);
+            }
+            await new Promise((resolve) => setTimeout(resolve, DEV_PORT_ALLOCATION_LOCK_POLL_MS));
+        }
+    }
+    try {
+        return await run();
+    }
+    finally {
+        await releaseDevPortAllocationLock(lockPath, token);
+    }
+}
 async function findNextPortBlock() {
     const { stdout } = await execFileAsync("docker", [
         "ps",
@@ -205,15 +447,15 @@ export function buildDevWorkerDockerRunArgs(options) {
         "-e",
         "PIBO_COMPUTE_WORKER_ROLE=dev",
         "-p",
-        `127.0.0.1:${options.gatewayPort}:4789`,
+        `${COMPUTE_PUBLISH_HOST}:${options.gatewayPort}:4789`,
         "-p",
-        `127.0.0.1:${options.cdpPort}:56663`,
+        `${COMPUTE_PUBLISH_HOST}:${options.cdpPort}:56663`,
         "-p",
-        `127.0.0.1:${options.webPort}:4788`,
+        `${COMPUTE_PUBLISH_HOST}:${options.webPort}:4788`,
         "-p",
-        `127.0.0.1:${options.webUIPortChat}:4790`,
+        `${COMPUTE_PUBLISH_HOST}:${options.webUIPortChat}:4790`,
         "-p",
-        `127.0.0.1:${options.webUIPortContext}:4791`,
+        `${COMPUTE_PUBLISH_HOST}:${options.webUIPortContext}:4791`,
         "-v",
         `${options.worktreePath}:/workspace`,
         ...(options.hostNodeModules ? ["-v", `${options.hostNodeModules}:/workspace/node_modules`] : []),
@@ -241,21 +483,14 @@ export function buildDevWorkerDockerRunArgs(options) {
         ...buildComputeResourcePolicyLabels(policy).flatMap((label) => ["--label", label]),
         "--entrypoint",
         "/bin/sh",
-        IMAGE_NAME,
+        options.imageName ?? IMAGE_NAME,
         "-c",
-        "tail -f /dev/null",
+        "ln -sf /workspace/dist/bin/pibo.js /usr/local/bin/pibo && exec tail -f /dev/null",
     ];
 }
 export async function spawnDevWorker(options) {
     const worktreePath = path.join(options.repoDir, ".worktrees", options.worktreeName);
     await createWorktree(options.repoDir, options.worktreeName);
-    const block = await findNextPortBlock();
-    const base = DEV_PORT_BASE + block * DEV_PORT_BLOCK_SIZE;
-    const gatewayPort = base;
-    const cdpPort = base + 1;
-    const webPort = base + 2;
-    const webUIPortChat = base + 3;
-    const webUIPortContext = base + 4;
     const id = `pibo-dev-${options.worktreeName}`;
     const createdAt = new Date().toISOString();
     // Mount host node_modules into the container so dependencies are immediately available
@@ -269,35 +504,41 @@ export async function spawnDevWorker(options) {
     catch {
         // host node_modules does not exist; skip mount
     }
-    const args = buildDevWorkerDockerRunArgs({
-        id,
-        worktreePath,
-        worktreeName: options.worktreeName,
-        block,
-        gatewayPort,
-        cdpPort,
-        webPort,
-        webUIPortChat,
-        webUIPortContext,
-        createdAt,
-        holder: options.holder,
-        ttlSeconds: options.ttlSeconds,
-        idleSeconds: options.idleSeconds,
-        ralphJobId: options.ralphJobId,
-        ralphRunId: options.ralphRunId,
-        hostNodeModules: nodeModulesMount,
+    const ports = await withDevPortAllocationLock(async () => {
+        const block = await findNextPortBlock();
+        const base = DEV_PORT_BASE + block * DEV_PORT_BLOCK_SIZE;
+        const gatewayPort = base;
+        const cdpPort = base + 1;
+        const webPort = base + 2;
+        const webUIPortChat = base + 3;
+        const webUIPortContext = base + 4;
+        const args = buildDevWorkerDockerRunArgs({
+            id,
+            imageName: options.imageName,
+            worktreePath,
+            worktreeName: options.worktreeName,
+            block,
+            gatewayPort,
+            cdpPort,
+            webPort,
+            webUIPortChat,
+            webUIPortContext,
+            createdAt,
+            holder: options.holder,
+            ttlSeconds: options.ttlSeconds,
+            idleSeconds: options.idleSeconds,
+            ralphJobId: options.ralphJobId,
+            ralphRunId: options.ralphRunId,
+            hostNodeModules: nodeModulesMount,
+        });
+        await execFileAsync("docker", args, { cwd: options.repoDir });
+        return { gatewayPort, cdpPort, webPort, webUIPortChat, webUIPortContext };
     });
-    await execFileAsync("docker", args, { cwd: options.repoDir });
-    const host = await detectHost();
     return {
         id,
-        image: IMAGE_NAME,
-        gatewayHost: host,
-        gatewayPort,
-        cdpPort,
-        webPort,
-        webUIPortChat,
-        webUIPortContext,
+        image: options.imageName ?? IMAGE_NAME,
+        gatewayHost: COMPUTE_PUBLISH_HOST,
+        ...ports,
         connect: `docker exec -it ${id} bash`,
         worktree: worktreePath,
     };
@@ -316,11 +557,11 @@ export function buildWorkerDockerRunArgs(options) {
         "-e",
         "PIBO_COMPUTE_WORKER_ROLE=worker",
         "-p",
-        "127.0.0.1::4789",
+        `${COMPUTE_PUBLISH_HOST}::4789`,
         "-p",
-        "127.0.0.1::56663",
+        `${COMPUTE_PUBLISH_HOST}::56663`,
         "-p",
-        "127.0.0.1::4788",
+        `${COMPUTE_PUBLISH_HOST}::4788`,
         ...buildComputeWorkerMetadataLabels({
             role: "worker",
             createdAt: options.createdAt,
@@ -335,7 +576,7 @@ export function buildWorkerDockerRunArgs(options) {
             ralphRunId: options.ralphRunId,
         }).flatMap((label) => ["--label", label]),
         ...buildComputeResourcePolicyLabels(policy).flatMap((label) => ["--label", label]),
-        IMAGE_NAME,
+        options.imageName ?? IMAGE_NAME,
         "gateway:web",
     ];
 }
@@ -345,6 +586,7 @@ export async function spawnWorker(options) {
     const args = buildWorkerDockerRunArgs({
         id,
         createdAt,
+        imageName: options.imageName,
         holder: options.holder,
         worktreePath: options.workspaceDir,
         ttlSeconds: options.ttlSeconds,
@@ -360,12 +602,10 @@ export async function spawnWorker(options) {
     const gatewayPort = parseHostPort(port4789);
     const cdpPort = parseHostPort(port56663);
     const webPort = parseHostPort(port4788);
-    // Detect host IP
-    const host = await detectHost();
     return {
         id,
-        image: IMAGE_NAME,
-        gatewayHost: host,
+        image: options.imageName ?? IMAGE_NAME,
+        gatewayHost: COMPUTE_PUBLISH_HOST,
         gatewayPort,
         cdpPort,
         webPort,
@@ -385,19 +625,6 @@ function parseHostPort(dockerPortOutput) {
     }
     return 0;
 }
-async function detectHost() {
-    try {
-        const { stdout } = await execFileAsync("hostname", ["-I"]);
-        const ips = stdout.trim().split(/\s+/);
-        const nonLocal = ips.find((ip) => !ip.startsWith("127."));
-        if (nonLocal)
-            return nonLocal;
-        return ips[0] || "127.0.0.1";
-    }
-    catch {
-        return "127.0.0.1";
-    }
-}
 export function parseDockerLabels(labelsStr) {
     const labels = {};
     for (const part of (labelsStr ?? "").split(",")) {
@@ -677,13 +904,33 @@ export function buildComputeWorkerReapPlan(workers, options = {}) {
     };
 }
 export async function releaseWorker(id) {
+    let inspected;
+    try {
+        const { stdout } = await execFileAsync("docker", ["inspect", id]);
+        inspected = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error(`Unable to inspect Docker container "${id}" before release. No container was changed. ` +
+            `Run "pibo compute list --all" to find Pibo compute workers and verify Docker is available.`);
+    }
+    const container = inspected[0];
+    const resolvedId = container?.Id?.trim();
+    if (!container || inspected.length !== 1 || !resolvedId) {
+        throw new Error(`Unable to resolve Docker container "${id}" before release. No container was changed.`);
+    }
+    const role = container.Config?.Labels?.[LABEL_ROLE];
+    if (role !== "worker" && role !== "dev") {
+        const identity = role === undefined ? `${LABEL_ROLE} is missing` : `${LABEL_ROLE}=${JSON.stringify(role)}`;
+        throw new Error(`Refusing to release Docker container "${id}": ${identity}; expected "worker" or "dev". ` +
+            `No container was changed. Run "pibo compute list --all" to find releasable workers.`);
+    }
     try {
-        await execFileAsync("docker", ["stop", "-t", "10", id]);
+        await execFileAsync("docker", ["stop", "-t", "10", resolvedId]);
     }
     catch {
         // might already be stopped
     }
-    await execFileAsync("docker", ["rm", id]);
+    await execFileAsync("docker", ["rm", resolvedId]);
 }
 export async function applyComputeWorkerReapPlan(plan, options = {}) {
     const release = options.release ?? releaseWorker;

package/dist/config/config.js

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { ensurePrivatePiboHomeForPath, piboHomePath } from "../core/pibo-home.js";
 import { protectPrivateFileSync } from "../core/private-path.js";
+import { parsePreviewBaseURL } from "../previews/base-url.js";
 export const DEFAULT_PIBO_CONFIG_PATH = "config.json";
 export function getDefaultPiboConfigPath() {
     return piboHomePath(DEFAULT_PIBO_CONFIG_PATH);
@@ -137,6 +138,8 @@ function parseConfigValue(definition, value) {
     if (definition.key === "auth.secret" && value.length < 32) {
         throw new Error("auth.secret must be at least 32 characters");
     }
+    if (definition.key === "preview.baseURL")
+        parsePreviewBaseURL(value);
     if (definition.values && !definition.values.includes(value)) {
         throw new Error(`${definition.key} must be one of: ${definition.values.join(", ")}`);
     }

package/dist/core/context-build.js

@@ -214,6 +214,7 @@ function withoutRequestedModels(profile) {
         mcpServers: profile.mcpServers,
         piPackages: profile.piPackages,
         contextFiles: profile.contextFiles,
+        diagnostics: profile.diagnostics,
         builtinTools: profile.builtinTools,
         builtinToolNames: profile.builtinToolNames,
         autoContextFiles: profile.autoContextFiles,
@@ -229,15 +230,15 @@ function toolDefinitionSchema(definition, toolInfo) {
 }
 function generatedOriginForTool(name, profile) {
     if (name === "runtime")
-        return "Generated Pibo runtime tool selected by the profile.";
+        return "pibo-runtime";
     if (name.startsWith("pibo_agents_"))
-        return "Generated shared agent-management tool from the profile's delegated-agent list.";
+        return "pibo-subagents";
     if (name.startsWith("pibo_run_"))
-        return "Generated run-control tool from the pibo-run-control capability package.";
+        return "pibo-run-control";
     if (PIBO_GOAL_TOOL_NAMES.includes(name))
-        return "Generated goal-control tool from the pibo-goal-control capability package.";
+        return "pibo-goal-control";
     if (name === "apply_patch" || name === "view_image")
-        return "Generated Codex-compatible tool from the codex-compat package.";
+        return "codex-compat";
     if (profile.builtinToolNames.includes(name) || DEFAULT_BUILTIN_TOOL_NAMES.includes(name))
         return undefined;
     return undefined;
@@ -502,17 +503,6 @@ export async function inspectPiboContextBuild(options = {}) {
                     },
                 });
             }
-            if (generatedOrigin) {
-                children.push({
-                    id: `tools/${name}/generated-origin`,
-                    kind: "metadata",
-                    title: "Generated Origin",
-                    source: "generated",
-                    state: "active",
-                    badges: ["GENERATED", "PIBO"],
-                    hydratedText: generatedOrigin,
-                });
-            }
             if (providerTool?.providerTool.kind === "web_search") {
                 children.push({
                     id: `tools/${name}/provider-payload`,
@@ -568,6 +558,7 @@ export async function inspectPiboContextBuild(options = {}) {
                     hasDefinition: Boolean(definition || info),
                     description: definition?.description ?? info?.description ?? providerTool?.description,
                     ...(toolSource === "pibo" || toolSource === "generated" ? { owner: "pibo", deliveryMode: "direct" } : {}),
+                    ...(generatedOrigin ? { inspectorOrigin: { label: generatedOrigin, modelVisible: false } } : {}),
                 },
                 children,
             };