@pasko70/pibo 3.2.2 → 3.2.4

package/dist/previews/manager.js

@@ -4,8 +4,7 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { basename } from "node:path";
 import { promisify } from "node:util";
-import { sanitizePreviewServerSettings } from "../core/preview-server-settings.js";
-import { loadPreviewConfig } from "./config.js";
+import { loadEffectivePreviewServerSettings } from "./config.js";
 import { findPreviewTargetProcess, isPreviewTargetProcessCurrent, previewProcessStartTicks, probePreviewTarget, } from "./network.js";
 import { previewExposureState } from "./store.js";
 const execFileAsync = promisify(execFile);
@@ -25,13 +24,7 @@ export function validatePreviewStartCommand(value) {
 }
 export async function startManagedPreview(store, id, options = {}) {
     const controller = options.controller ?? createDefaultPreviewProcessController();
-    const settings = options.settings ?? (() => {
-        const previewConfig = loadPreviewConfig();
-        return sanitizePreviewServerSettings({
-            maxRunningServers: previewConfig.maxRunningServers,
-            autoStopMinutes: previewConfig.autoStopMinutes,
-        });
-    })();
+    const settings = options.settings ?? loadEffectivePreviewServerSettings();
     const now = options.now?.() ?? new Date();
     await reconcileManagedPreviews(store, { ...options, controller, settings, now: () => now });
     let current = store.requireExposure(id);

package/dist/ralph/service.js

@@ -10,6 +10,9 @@ import { createDefaultPiboRalphStore } from './store.js';
 import { createBuiltInRalphStopConditions, evaluateRalphStopPolicy } from './stopping.js';
 const CHAT_WEB_CHANNEL = 'pibo.chat-web';
 function errorMessage(error) { return error instanceof Error ? error.message : String(error); }
+export class PiboRalphCapacityError extends Error {
+    constructor() { super('Ralph run capacity is currently full'); this.name = 'PiboRalphCapacityError'; }
+}
 class RalphRunTimeoutError extends Error {
     abortFailed;
     constructor(message, abortFailed = false) {
@@ -46,6 +49,7 @@ export class PiboRalphService {
     runTimeoutMs;
     timer;
     activeRuns = 0;
+    admissionTail = Promise.resolve();
     stopped = true;
     cancelledRuns = new Set();
     unsubscribeProductEvents;
@@ -63,9 +67,11 @@ export class PiboRalphService {
     stop() { this.stopped = true; if (this.timer)
         clearTimeout(this.timer); this.timer = undefined; this.unsubscribeProductEvents?.(); this.unsubscribeProductEvents = undefined; this.dataStore.close(); this.store.close(); }
     status() { return { enabled: !this.stopped, ...this.store.status() }; }
-    async startJob(id) { const job = this.store.updateJob(id, { enabled: true }); if (!job)
+    async startJob(id) { return await this.withAdmissionLock(async () => { const existing = this.store.getJob(id); if (!existing || existing.state.runningAt)
+        return undefined; if (this.activeRuns >= this.maxConcurrentRuns)
+        throw new PiboRalphCapacityError(); const job = this.store.updateJob(id, { enabled: true }); if (!job)
         return undefined; const reserved = await this.reserveAfterBeforeRunEvaluation(job); if (!reserved)
-        return undefined; void this.executeReserved(reserved.job, reserved.run).finally(() => this.armSoon()); return reserved.run; }
+        return undefined; void this.executeReserved(reserved.job, reserved.run).finally(() => this.armSoon()); return reserved.run; }); }
     stopJob(id) { const job = this.store.requestStop(id); this.armSoon(); return job; }
     async cancelJob(id) {
         const job = this.store.requestCancel(id);
@@ -82,14 +88,13 @@ export class PiboRalphService {
     async tick() { if (this.stopped)
         return; try {
         await this.abortCancelRequestedJobs();
-        const capacity = this.maxConcurrentRuns - this.activeRuns;
-        if (capacity > 0) {
-            const jobs = this.store.listJobs({ includeDisabled: false }).filter((job) => !job.state.runningAt).slice(0, capacity);
-            for (const job of jobs) {
-                const reserved = await this.reserveAfterBeforeRunEvaluation(job);
-                if (reserved)
-                    void this.executeReserved(reserved.job, reserved.run).finally(() => this.armSoon());
-            }
+        const jobs = this.store.listJobs({ includeDisabled: false }).filter((job) => !job.state.runningAt);
+        for (const job of jobs) {
+            const admitted = await this.withAdmissionLock(async () => { if (this.activeRuns >= this.maxConcurrentRuns)
+                return false; const reserved = await this.reserveAfterBeforeRunEvaluation(job); if (!reserved)
+                return true; void this.executeReserved(reserved.job, reserved.run).finally(() => this.armSoon()); return true; });
+            if (!admitted)
+                break;
         }
     }
     catch (error) {
@@ -98,6 +103,12 @@ export class PiboRalphService {
     finally {
         this.arm();
     } }
+    async withAdmissionLock(action) { const previous = this.admissionTail; let release; this.admissionTail = new Promise((resolve) => { release = resolve; }); await previous; try {
+        return await action();
+    }
+    finally {
+        release();
+    } }
     async reserveAfterBeforeRunEvaluation(job) {
         const fresh = this.store.getJob(job.id) ?? job;
         if (!fresh.enabled || fresh.state.runningAt)

package/dist/session-ui/statusViewModel.js

@@ -1,3 +1,4 @@
+import { redactSensitiveText } from "../core/sensitive-data-redaction.js";
 export function buildTerminalStatusViewModel(input = {}) {
     const fields = [];
     const progress = [];
@@ -56,10 +57,7 @@ export function progressBarText(descriptor, width = 20) {
     return `${"█".repeat(filled)}${"░".repeat(boundedWidth - filled)} ${descriptor.percent.toFixed(1)}%`;
 }
 export function redactTerminalSecret(text) {
-    return text
-        .replace(/\b([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*)\s*=\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(api[_-]?key|token|secret|password)\s*[:=]\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(?:sk|pk|pibo|ghp|github_pat)_[A-Za-z0-9_\-]{8,}\b/g, "[redacted]");
+    return redactSensitiveText(text).replace(/\b([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD|PASSWD)[A-Z0-9_]*)\s*:\s*\[redacted\]/gi, "$1=[redacted]");
 }
 function contextProgress(usage) {
     if (!usage || (usage.tokens === undefined && usage.contextWindow === undefined && usage.percent === undefined)) {

package/dist/sessions/pibo-data-store.js

@@ -147,6 +147,24 @@ export class PiboDataSessionStore {
 			`).run(sequence, new Date().toISOString(), piboSessionId);
         });
     }
+    claimAgentObservationSequence(parentPiboSessionId, minimum) {
+        return this.dataStore.transaction(() => {
+            const session = this.db.prepare("SELECT 1 AS present FROM sessions WHERE id = ? AND deleted_at IS NULL").get(parentPiboSessionId);
+            if (!session)
+                return minimum;
+            const row = this.db.prepare("SELECT next_sequence FROM session_agent_observation_counters WHERE parent_pibo_session_id = ?").get(parentPiboSessionId);
+            const migrationSafeSeed = Math.trunc(Date.now()) * 1_000;
+            const sequence = Math.max(minimum, row?.next_sequence ?? migrationSafeSeed);
+            this.db.prepare(`
+				INSERT INTO session_agent_observation_counters (parent_pibo_session_id, next_sequence, updated_at)
+				VALUES (?, ?, ?)
+				ON CONFLICT(parent_pibo_session_id) DO UPDATE SET
+					next_sequence = excluded.next_sequence,
+					updated_at = excluded.updated_at
+			`).run(parentPiboSessionId, sequence + 1, new Date().toISOString());
+            return sequence;
+        });
+    }
     claimOrAttachOutputPart(input) {
         return this.dataStore.transaction(() => {
             const indexAttribute = outputPartIndexAttribute(input.kind);

package/dist/sessions/store.js

@@ -49,6 +49,7 @@ export class InMemoryPiboSessionStore {
     byPiSessionId = new Map();
     byNativeSession = new Map();
     outputRenderHighWater = new Map();
+    agentObservationNextSequence = new Map();
     outputToolInvocationNextOrdinal = new Map();
     get(id) {
         return this.byId.get(id);
@@ -120,6 +121,13 @@ export class InMemoryPiboSessionStore {
         if (sequence > current)
             this.outputRenderHighWater.set(piboSessionId, sequence);
     }
+    claimAgentObservationSequence(parentPiboSessionId, minimum) {
+        if (!this.byId.has(parentPiboSessionId))
+            return minimum;
+        const sequence = Math.max(minimum, this.agentObservationNextSequence.get(parentPiboSessionId) ?? 1);
+        this.agentObservationNextSequence.set(parentPiboSessionId, sequence + 1);
+        return sequence;
+    }
     claimOutputToolInvocationOrdinal(piboSessionId, eventId, toolCallId) {
         const key = outputToolInvocationCounterKey(piboSessionId, eventId, toolCallId);
         const ordinal = this.outputToolInvocationNextOrdinal.get(key) ?? 0;
@@ -163,6 +171,7 @@ export class InMemoryPiboSessionStore {
         if (nativeKey)
             this.byNativeSession.delete(nativeKey);
         this.outputRenderHighWater.delete(id);
+        this.agentObservationNextSequence.delete(id);
         const counterPrefix = `${JSON.stringify([id]).slice(0, -1)},`;
         for (const key of this.outputToolInvocationNextOrdinal.keys()) {
             if (key.startsWith(counterPrefix))

package/dist/setup/cli.js

@@ -7,7 +7,7 @@ import { Command } from "commander";
 import { getPiboConfigValue, loadPiboConfig } from "../config/config.js";
 import { getPiboHome } from "../core/pibo-home.js";
 import { getWslInfo, isWsl } from "../core/wsl.js";
-import { createInstallationPlan, inspectInstallation, installationManifestPath, materializeInstallationPlan, parseInstallationComponent, parseInstallationProfile, readInstallationManifest, runPendingInstallationActions, uninstallInstallation, validateInstallationPlanTargets, } from "./installation-profiles.js";
+import { createInstallationPlan, inspectInstallation, installationManifestPath, installationOutputPath, materializeInstallationPlan, parseInstallationComponent, parseInstallationProfile, readInstallationManifest, runPendingInstallationActions, uninstallInstallation, validateInstallationPlanTargets, } from "./installation-profiles.js";
 function parsePort(value) {
     const port = Number(value);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
@@ -126,7 +126,7 @@ export function createUserHostSetupPlan(options = {}) {
     const wwwDomain = options.wwwDomain ?? (options.domain ? `www.${options.domain}` : undefined);
     const warnings = [];
     if (!options.domain)
-        warnings.push("No production domain was provided; generated Caddy/Auth examples use placeholders.");
+        warnings.push("No production domain was provided; the Caddyfile is omitted and Auth examples use placeholders.");
     if (process.platform === "win32" && !isWsl()) {
         warnings.push("Pibo host setup targets Linux. Native Windows is not supported. Install WSL2 (https://aka.ms/wsl) and run setup inside the WSL distribution. See docs/project/guides/pibo-on-windows-via-wsl.md.");
     }
@@ -149,7 +149,14 @@ export function createUserHostSetupPlan(options = {}) {
             content: userEnvTemplate({ domain: options.domain, piboHome }),
         },
     ];
-    if (options.includeCaddy !== false) {
+    if (serviceName !== "pibo-web") {
+        generatedFiles.push({
+            path: `${piboHome}/gateway-web-service`,
+            purpose: "Managed production gateway service identity",
+            content: `${serviceName}\n`,
+        });
+    }
+    if (options.includeCaddy !== false && options.domain) {
         generatedFiles.push({
             path: "/etc/caddy/Caddyfile",
             purpose: "HTTPS reverse proxy for the production gateway",
@@ -213,7 +220,7 @@ export function createDeveloperHostSetupPlan(options = {}) {
                 piboHome: prodHome,
                 serviceKind: "prod",
                 webPort: prodWebPort,
-                execStart: `${prodEntrypoint} gateway:web --web-host 127.0.0.1 --web-port ${prodWebPort}`,
+                execStart: `${prodEntrypoint} gateway:web --web-host 127.0.0.1 --web-port ${prodWebPort} --gateway-port ${prodGatewayPort}`,
             }),
         },
         {
@@ -871,7 +878,7 @@ export async function runSetupCli(argv = process.argv) {
         .action((options) => {
         if (options.root && options.apply)
             throw new Error("Use either --root for staging or --apply for the host, not both");
-        const manifestPath = options.root ? join(options.root, installationManifestPath(options.piboHome).replace(/^\/+/, "")) : installationManifestPath(options.piboHome);
+        const manifestPath = installationOutputPath(installationManifestPath(options.piboHome), options.root);
         const manifest = readInstallationManifest(manifestPath);
         if (!manifest)
             throw new Error(`No installation manifest found at ${manifestPath}`);
@@ -893,7 +900,7 @@ export async function runSetupCli(argv = process.argv) {
         .action((name, options) => {
         if (options.root && options.apply)
             throw new Error("Use either --root for staging or --apply for the host, not both");
-        const manifestPath = options.root ? join(options.root, installationManifestPath(options.piboHome).replace(/^\/+/, "")) : installationManifestPath(options.piboHome);
+        const manifestPath = installationOutputPath(installationManifestPath(options.piboHome), options.root);
         const manifest = readInstallationManifest(manifestPath);
         if (!manifest)
             throw new Error(`No installation manifest found at ${manifestPath}`);
@@ -915,7 +922,7 @@ export async function runSetupCli(argv = process.argv) {
         .action((options) => {
         if (options.root && options.apply)
             throw new Error("Use either --root for staging or --apply for the host, not both");
-        const manifestPath = options.root ? join(options.root, installationManifestPath(options.piboHome).replace(/^\/+/, "")) : installationManifestPath(options.piboHome);
+        const manifestPath = installationOutputPath(installationManifestPath(options.piboHome), options.root);
         const manifest = readInstallationManifest(manifestPath);
         if (!manifest)
             throw new Error(`No installation manifest found at ${manifestPath}`);

package/dist/setup/installation-profiles.js

@@ -1,6 +1,6 @@
 import { createHash } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { dirname, isAbsolute, join } from "node:path";
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 const CODE_SERVER_VERSION = "4.135.0";
 const BROWSER_USE_VERSION = "0.12.6";
 const AGENT_BROWSER_VERSION = "0.27.0";
@@ -28,6 +28,9 @@ function sha256(content) {
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+function systemdQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
 function normalizeContent(content) {
     return content.endsWith("\n") ? content : `${content}\n`;
 }
@@ -36,8 +39,8 @@ export function installationManifestPath(piboHome) {
 }
 function gatewayService(options) {
     const integrationEnvironment = [
-        ...(options.hasVscode ? ["Environment=PIBO_VSCODE_WEB_URL=/apps/vscode/", `Environment=PIBO_VSCODE_WORKSPACE_ROOT=${options.workspaceRoot}`] : []),
-        ...(options.hasMcpDefaults ? [`Environment=MCP_CONFIG_PATH=${options.piboHome}/setup/mcp-defaults.json`] : []),
+        ...(options.hasVscode ? ["Environment=PIBO_VSCODE_WEB_URL=/apps/vscode/", `Environment=${systemdQuote(`PIBO_VSCODE_WORKSPACE_ROOT=${options.workspaceRoot}`)}`] : []),
+        ...(options.hasMcpDefaults ? [`Environment=${systemdQuote(`MCP_CONFIG_PATH=${options.piboHome}/setup/mcp-defaults.json`)}`] : []),
     ];
     return `[Unit]
 Description=Pibo web gateway
@@ -49,7 +52,7 @@ Type=simple
 User=root
 WorkingDirectory=/root
 Environment=HOME=/root
-Environment=PIBO_HOME=${options.piboHome}
+Environment=${systemdQuote(`PIBO_HOME=${options.piboHome}`)}
 Environment=NODE_ENV=production
 Environment=PIBO_GATEWAY_WEB_PORT=4788
 ${integrationEnvironment.length > 0 ? `${integrationEnvironment.join("\n")}\n` : ""}ExecStart=${options.piboCommand} gateway:web --web-host 127.0.0.1 --web-port 4788
@@ -76,14 +79,14 @@ WorkingDirectory=${workspaceRoot}
 Environment=HOME=/var/lib/pibo-code
 Environment=XDG_DATA_HOME=/var/lib/pibo-code/.local/share
 Environment=XDG_CONFIG_HOME=/var/lib/pibo-code/.config
-ExecStart=/opt/pibo/code-server/${CODE_SERVER_VERSION}/bin/code-server --bind-addr 127.0.0.1:4790 --auth none --disable-telemetry --disable-update-check --disable-workspace-trust ${workspaceRoot}
+ExecStart=/opt/pibo/code-server/${CODE_SERVER_VERSION}/bin/code-server --bind-addr 127.0.0.1:4790 --auth none --disable-telemetry --disable-update-check --disable-workspace-trust ${systemdQuote(workspaceRoot)}
 Restart=always
 RestartSec=5
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
 ProtectHome=read-only
-ReadWritePaths=${workspaceRoot} /var/lib/pibo-code
+ReadWritePaths=${systemdQuote(workspaceRoot)} /var/lib/pibo-code
 
 [Install]
 WantedBy=multi-user.target
@@ -254,7 +257,17 @@ function ownedDirectoryMarkerParent(path) {
 function outputPath(path, root) {
     if (!root)
         return path;
-    return isAbsolute(path) ? join(root, path.replace(/^\/+/, "")) : join(root, path);
+    const resolvedRoot = resolve(root);
+    const stagedPath = isAbsolute(path) ? relative(parse(path).root, path) : path;
+    const destination = resolve(resolvedRoot, stagedPath);
+    const relativeDestination = relative(resolvedRoot, destination);
+    if (relativeDestination === ".." || relativeDestination.startsWith(`..${sep}`) || isAbsolute(relativeDestination)) {
+        throw new Error(`Refusing staged path outside root: ${path}`);
+    }
+    return destination;
+}
+export function installationOutputPath(path, root) {
+    return outputPath(path, root);
 }
 function atomicWrite(path, content, mode) {
     mkdirSync(dirname(path), { recursive: true });

package/dist/shared/trace-event-projection.js

@@ -55,6 +55,9 @@ export function applySingleEventToNodes(nodes, byId, piboSessionId, storedEvent,
     if (!node)
         return;
     applyStoredPayloadRef(node, payload, storedEvent.storedPayloadRef);
+    if (payload.type === "session_error" && payload.eventId) {
+        node.parentId = settleTurnFromSessionError(byId, payload.eventId, payload, storedEvent.createdAt);
+    }
     if (node.type === "user.message" &&
         node.status === "running" &&
         !node.parentId &&
@@ -280,10 +283,11 @@ export function markIncompletePersistedTurns(nodes, byId, piboSessionId, events,
         turn.status = "error";
         turn.summary = INCOMPLETE_TURN_SUMMARY;
         turn.error = INCOMPLETE_TURN_ERROR;
+        const last = lastByEventId.get(eventId) ?? start;
+        settleInterruptedTurnChildren(byId, turnId, INCOMPLETE_TURN_ERROR);
         const markerId = `event:incomplete-turn:${eventId}`;
         if (byId.has(markerId))
             continue;
-        const last = lastByEventId.get(eventId) ?? start;
         const marker = {
             id: markerId,
             parentId: turnId,
@@ -306,6 +310,33 @@ export function markIncompletePersistedTurns(nodes, byId, piboSessionId, events,
     }
     return [...incompleteEventIds].some((eventId) => byId.has(`event:incomplete-turn:${eventId}`));
 }
+function settleTurnFromSessionError(byId, eventId, event, completedAt) {
+    const turnId = messageTurnNodeId(eventId);
+    const turn = byId.get(turnId) ?? [...byId.values()].find((candidate) => candidate.type === "agent.turn" && candidate.eventId === eventId);
+    if (!turn)
+        return undefined;
+    turn.status = "error";
+    turn.completedAt = completedAt ?? turn.completedAt;
+    turn.summary = event.errorDetails?.userMessage ?? event.error;
+    turn.error = event.error;
+    settleInterruptedTurnChildren(byId, turn.id, event.error, completedAt);
+    return turn.id;
+}
+function settleInterruptedTurnChildren(byId, turnId, error, completedAt) {
+    for (const node of byId.values()) {
+        if (node.parentId !== turnId)
+            continue;
+        const isOpenContent = node.status === "running" && (node.type === "assistant.message" ||
+            node.type === "model.reasoning" ||
+            node.type === "tool.call");
+        const isUnfinishedTool = node.type === "tool.call" && node.completedAt === undefined;
+        if (!isOpenContent && !isUnfinishedTool)
+            continue;
+        node.status = "error";
+        node.completedAt = completedAt;
+        node.error = error;
+    }
+}
 export function eventsCanAffectAsyncAgentRunStatus(events) {
     return events.some((event) => {
         const type = event.payload.type;

package/dist/subagents/tool.js

@@ -34,12 +34,12 @@ function resultText(prefix, value) {
 export function normalizePiboAgentSessionName(value) {
     if (typeof value !== "string")
         throw new Error("Agent session name is required.");
-    if ([...value].length > PIBO_AGENT_SESSION_NAME_MAX_LENGTH) {
-        throw new Error(`Agent session name must be at most ${PIBO_AGENT_SESSION_NAME_MAX_LENGTH} characters.`);
-    }
     const normalized = value.trim();
     if (!normalized)
         throw new Error("Agent session name must not be empty.");
+    if ([...normalized].length > PIBO_AGENT_SESSION_NAME_MAX_LENGTH) {
+        throw new Error(`Agent session name must be at most ${PIBO_AGENT_SESSION_NAME_MAX_LENGTH} characters.`);
+    }
     return normalized;
 }
 function preparePiboAgentSessionNameInput(input) {

package/dist/tools/browser-use-leases.js

@@ -289,10 +289,10 @@ function killLeaseProcess(status, lease) {
 }
 async function releaseAssociatedBrowserPoolLease(status, lease) {
     if (!lease.browserPoolLeaseId)
-        return;
+        return undefined;
     const identity = browserPoolIdentityForLease(status, lease);
     const paths = browserPoolPaths(browserPoolRootForLease(status, lease), identity);
-    await releaseBrowserPoolLease(paths, identity, { leaseId: lease.browserPoolLeaseId });
+    return releaseBrowserPoolLease(paths, identity, { leaseId: lease.browserPoolLeaseId });
 }
 async function reapAssociatedBrowserPoolLeaseProcess(status, lease) {
     if (!lease.browserPoolLeaseId)
@@ -613,7 +613,15 @@ export async function releaseBrowserUseLease(context, id, options = {}) {
             }));
         }
         if (lease.browserPoolLeaseId) {
-            await releaseAssociatedBrowserPoolLease(context.status, lease);
+            const poolRelease = await releaseAssociatedBrowserPoolLease(context.status, lease);
+            if (poolRelease && (poolRelease.cleanupStatus === 'failed' || poolRelease.state.state === 'dirty')) {
+                throw new Error(formatCliError({
+                    code: ErrorCode.CLIENT_ERROR,
+                    type: 'BROWSER_USE_POOL_CLEANUP_FAILED',
+                    message: `Browser pool cleanup failed for lease "${lease.id}": ${poolRelease.lastError ?? 'managed browser cleanup failed'}`,
+                    suggestion: `The auth lease and profile were preserved. Run \`pibo tools browser-use pool reap --worker-id ${poolRelease.state.workerId} --pool-id ${poolRelease.state.poolId} --idle-timeout-ms 0\`, then retry release.`,
+                }));
+            }
         }
         else {
             killLeaseProcess(context.status, lease);

package/dist/tools/index.js

@@ -679,7 +679,6 @@ export async function runToolsCli(argv = process.argv) {
     program
         .name('pibo tools')
         .description('Install and inspect curated external CLI tools')
-        .helpOption(false)
         .showHelpAfterError();
     program
         .command('list')

package/dist/tools/runtime/node-worker-source.js

@@ -1,5 +1,6 @@
 export const NODE_RUNTIME_WORKER_SOURCE = String.raw `
 const vm = require("node:vm");
+const inspector = require("node:inspector");
 const util = require("node:util");
 const fs = require("node:fs");
 const childProcess = require("node:child_process");
@@ -153,6 +154,7 @@ const consoleProxy = {
 	dir: (value, options) => appendStdout(util.inspect(value, options) + "\n"),
 };
 
+const runtimeContextName = "pibo-runtime-" + process.pid;
 const context = vm.createContext({
 	console: consoleProxy,
 	require: runtimeRequire,
@@ -169,10 +171,24 @@ const context = vm.createContext({
 	setImmediate,
 	clearImmediate,
 	queueMicrotask,
-});
+}, { name: runtimeContextName });
 context.global = context;
 context.globalThis = context;
 
+const inspectorSession = new inspector.Session();
+let runtimeContextId;
+inspectorSession.on("Runtime.executionContextCreated", ({ params }) => {
+	if (params.context.name === runtimeContextName) runtimeContextId = params.context.id;
+});
+inspectorSession.connect();
+const inspectorReady = inspectorPost("Runtime.enable");
+
+function inspectorPost(method, params = {}) {
+	return new Promise((resolve, reject) => {
+		inspectorSession.post(method, params, (error, result) => error ? reject(error) : resolve(result));
+	});
+}
+
 async function execute(req) {
 	const mode = req.mode || "exec";
 	const code = req.code || "";
@@ -230,16 +246,31 @@ async function inspectValue(req) {
 	}
 }
 
-function listVars(req) {
+async function listVars(req) {
 	const includePrivate = Boolean(req.includePrivate);
 	const maxItems = Number(req.maxItems || 100);
 	const maxBytes = Number(req.maxBytes || 4096);
 	const hidden = new Set(["console", "require", "process", "Buffer", "URL", "URLSearchParams", "TextEncoder", "TextDecoder", "global", "globalThis"]);
+	const lexicalNames = new Set();
+	try {
+		await inspectorReady;
+		if (runtimeContextId !== undefined) {
+			const result = await inspectorPost("Runtime.globalLexicalScopeNames", { executionContextId: runtimeContextId });
+			for (const name of result.names || []) lexicalNames.add(name);
+		}
+	} catch {}
+	const names = new Set([...Object.keys(context), ...lexicalNames]);
 	const variables = [];
-	for (const name of Object.keys(context).sort()) {
+	for (const name of [...names].sort()) {
 		if (hidden.has(name)) continue;
 		if (!includePrivate && name.startsWith("_")) continue;
-		variables.push({ name, summary: summarize(context[name], maxBytes) });
+		let value;
+		try {
+			value = lexicalNames.has(name) ? vm.runInContext(name, context, { filename: "<pibo-runtime>", timeout: 15000 }) : context[name];
+		} catch {
+			continue;
+		}
+		variables.push({ name, summary: summarize(value, maxBytes) });
 		if (variables.length >= maxItems) break;
 	}
 	return { id: req.id, status: "ok", variables, truncated: variables.length >= maxItems };
@@ -253,7 +284,10 @@ async function handle(req) {
 	if (req.type === "exec") return await execute(req);
 	if (req.type === "inspect") return await inspectValue(req);
 	if (req.type === "vars") return listVars(req);
-	if (req.type === "shutdown") return { id: req.id, status: "ok", shutdown: true };
+	if (req.type === "shutdown") {
+		inspectorSession.disconnect();
+		return { id: req.id, status: "ok", shutdown: true };
+	}
 	return { id: req.id, status: "error", error: { name: "RuntimeProtocolError", message: "unknown request type " + req.type } };
 }
 

package/dist/tools/runtime/python-backend.js

@@ -90,6 +90,9 @@ export class PythonRuntimeBackend {
     isAlive() {
         return this.alive;
     }
+    isBusy() {
+        return [...this.pending.values()].some((pending) => pending.requestType === "exec");
+    }
     getRecord() {
         return { pid: this.child.pid, cwd: this.cwd, executable: this.executable };
     }
@@ -194,10 +197,11 @@ export class PythonRuntimeBackend {
         const id = `req_${++this.requestCounter}`;
         return new Promise((resolveRequest, rejectRequest) => {
             const timer = setTimeout(() => {
-                this.pending.delete(id);
+                if (!this.pending.has(id))
+                    return;
                 rejectRequest(new TimeoutError(`Runtime request ${type} timed out after ${timeoutMs}ms`));
             }, timeoutMs);
-            this.pending.set(id, { resolve: resolveRequest, reject: rejectRequest, timer });
+            this.pending.set(id, { requestType: type, resolve: resolveRequest, reject: rejectRequest, timer });
             this.child.stdin.write(`${JSON.stringify({ id, type, ...payload })}\n`);
         });
     }

package/dist/tools/runtime/registry.js

@@ -30,6 +30,7 @@ function notFoundVars(sessionId = "auto") {
 export class RuntimeSessionRegistry {
     options;
     sessions = new Map();
+    defaultStarts = new Map();
     maxHistoryEntries;
     constructor(options) {
         this.options = options;
@@ -79,9 +80,23 @@ export class RuntimeSessionRegistry {
         }
     }
     async exec(controllerPiboSessionId, input) {
-        const session = input.sessionId
+        let session = input.sessionId
             ? this.getSessionForController(controllerPiboSessionId, input.sessionId)
-            : await this.getOrStartDefault(controllerPiboSessionId, input);
+            : this.getDefault(controllerPiboSessionId, input.runtime ?? "python");
+        if (!input.sessionId && !session) {
+            const runtime = input.runtime ?? "python";
+            const started = await this.getOrStartDefault(controllerPiboSessionId, input);
+            if (started.status !== "ok" || !started.sessionId) {
+                return {
+                    status: started.status === "ok" ? "failed" : started.status,
+                    sessionId: started.sessionId ?? "auto",
+                    runtime: started.runtime ?? runtime,
+                    durationMs: 0,
+                    error: started.error ?? { name: "RuntimeStartError", message: "Runtime session failed to start." },
+                };
+            }
+            session = this.getSessionForController(controllerPiboSessionId, started.sessionId);
+        }
         const sessionId = input.sessionId ?? session?.sessionId ?? "auto";
         if (!session)
             return notFoundExec(sessionId);
@@ -106,7 +121,9 @@ export class RuntimeSessionRegistry {
         result.executionCount = session.executionCount;
         session.lastExecAt = startedAt;
         session.updatedAt = nowIso();
-        session.status = session.backend.isAlive() ? "idle" : "failed";
+        session.status = session.backend.isAlive()
+            ? session.backend.isBusy?.() === true ? "busy" : "idle"
+            : "failed";
         this.appendHistory(session, {
             id: randomUUID(),
             startedAt,
@@ -223,14 +240,25 @@ export class RuntimeSessionRegistry {
         const runtime = input.runtime ?? "python";
         const existing = this.getDefault(controllerPiboSessionId, runtime);
         if (existing)
-            return existing;
-        const started = await this.start(controllerPiboSessionId, {
+            return { status: "ok", sessionId: existing.sessionId, runtime: existing.runtime };
+        const key = `${controllerPiboSessionId}\0${runtime}`;
+        const pending = this.defaultStarts.get(key);
+        if (pending)
+            return pending;
+        const start = this.start(controllerPiboSessionId, {
             runtime,
             name: input.name,
             target: input.target,
             timeoutMs: input.timeoutMs,
         });
-        return started.sessionId ? this.getSessionForController(controllerPiboSessionId, started.sessionId) : undefined;
+        this.defaultStarts.set(key, start);
+        try {
+            return await start;
+        }
+        finally {
+            if (this.defaultStarts.get(key) === start)
+                this.defaultStarts.delete(key);
+        }
     }
     getSessionForController(controllerPiboSessionId, sessionId) {
         const session = this.sessions.get(sessionId);
@@ -243,6 +271,10 @@ export class RuntimeSessionRegistry {
             session.status = "failed";
             session.updatedAt = nowIso();
         }
+        else if (session.status === "busy" && session.backend.isBusy?.() === false) {
+            session.status = "idle";
+            session.updatedAt = nowIso();
+        }
         return session;
     }
     appendHistory(session, entry) {

package/dist/vscode/cli.js

@@ -50,9 +50,8 @@ export async function runVscodeCli(argv = process.argv) {
         else if (result.status === "installed") {
             console.log(`installed\t${result.tagName}\t${result.vsixPath}`);
         }
-        else {
+        if (result.status === "failed")
             process.exitCode = 1;
-        }
     });
     program
         .command("uninstall")