npm - @pasko70/pibo - Versions diffs - 3.2.3 → 3.2.5 - Mend

@pasko70/pibo 3.2.3 → 3.2.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (70) hide show

package/dist/agent-runtime/auth.js +3 -5
package/dist/agent-runtime/portable-history.js +1 -1
package/dist/agent-runtimes/codex-native/client.js +2 -5
package/dist/agent-runtimes/codex-native/redaction.js +3 -27
package/dist/agent-runtimes/omp/client.js +2 -4
package/dist/agent-runtimes/pi/adapter.js +1 -0
package/dist/agent-runtimes/pi/runtime.js +1 -1
package/dist/apps/chat/agent-store.js +1 -1
package/dist/apps/chat/chat-files.js +3 -1
package/dist/apps/chat/chat-request-normalizers.js +1 -1
package/dist/apps/chat/chat-user-skill-routes.js +7 -0
package/dist/apps/chat/data/project-service.js +49 -1
package/dist/apps/chat/data/session-query-service.js +46 -6
package/dist/apps/chat/loop-api.js +10 -1
package/dist/apps/chat/ralph-api.js +10 -1
package/dist/apps/chat/web-app.js +22 -5
package/dist/apps/chat-ui/assets/{dist-CTsyojIh.js → dist-CTC-_3l0.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-BHio-Mzx.js → dist-CftLEFd5.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-DJ6Bhcuk.js → dist-Dq27Wt2q.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-CPKEoSPK.js → dist-Y4fHV5-Z.js} +1 -1
package/dist/apps/chat-ui/assets/{dist-DNHFRMCk.js → dist-dGF-PDGY.js} +1 -1
package/dist/apps/chat-ui/assets/index-C_P0gXvJ.js +228 -0
package/dist/apps/chat-ui/assets/{index-Dc-6Xupt.css → index-DUGVw259.css} +1 -1
package/dist/apps/chat-ui/index.html +2 -2
package/dist/apps/chat-vscode-web/assets/{index-B1TuQNY5.js → index-B5X0NaRo.js} +4 -4
package/dist/apps/chat-vscode-web/index.html +1 -1
package/dist/apps/cli-ui/InkSessionApp.js +38 -28
package/dist/auth/cli.js +4 -6
package/dist/auth/machine-keys.js +20 -3
package/dist/cli-session/localSessionSource.js +2 -4
package/dist/compute/cli.js +16 -13
package/dist/compute/docker.js +96 -48
package/dist/core/base-prompt.js +27 -5
package/dist/core/context-build.js +5 -15
package/dist/core/sensitive-data-redaction.js +2 -2
package/dist/core/session-router.js +15 -4
package/dist/cron/cli.js +42 -10
package/dist/cron/store.js +1 -1
package/dist/data/cli.js +15 -7
package/dist/data/payload-store.js +55 -7
package/dist/data/schema.js +65 -23
package/dist/debug/index.js +5 -0
package/dist/debug/pty.js +45 -10
package/dist/gateway/cli.js +18 -2
package/dist/gateway/server.js +1 -0
package/dist/loops/service.js +32 -16
package/dist/mcp/runtime-session.js +2 -1
package/dist/pi-packages/cli.js +5 -0
package/dist/previews/cli.js +2 -6
package/dist/previews/config.js +10 -0
package/dist/previews/manager.js +2 -9
package/dist/ralph/service.js +21 -10
package/dist/session-ui/statusViewModel.js +2 -4
package/dist/sessions/pibo-data-store.js +18 -0
package/dist/sessions/store.js +9 -0
package/dist/setup/cli.js +14 -7
package/dist/setup/installation-profiles.js +20 -7
package/dist/shared/trace-event-projection.js +32 -1
package/dist/subagents/tool.js +3 -3
package/dist/tools/browser-use-leases.js +11 -3
package/dist/tools/index.js +0 -1
package/dist/tools/mcp-bridge.js +1 -1
package/dist/tools/runtime/node-worker-source.js +39 -5
package/dist/tools/runtime/python-backend.js +6 -2
package/dist/tools/runtime/registry.js +38 -6
package/dist/vscode/cli.js +1 -2
package/dist/vscode/install.js +21 -14
package/npm-shrinkwrap.json +2 -2
package/package.json +3 -1
package/dist/apps/chat-ui/assets/index-Y6jYzsaC.js +0 -228

package/dist/apps/chat-vscode-web/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="theme-color" content="#101d22" />
 		<title>Pibo</title>
-		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-B1TuQNY5.js"></script>
+		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-B5X0NaRo.js"></script>
 		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-b18ZkEo0.css">
 	</head>
 	<body>

package/dist/apps/cli-ui/InkSessionApp.js CHANGED Viewed

@@ -1,7 +1,7 @@
 import React, { useCallback, useEffect, useMemo, useRef, useState } from "react";
-import { Box, Text, useApp, useInput } from "ink";
+import { Box, Text, useApp, useInput, usePaste } from "ink";
 import { isCliSourceError } from "../../cli-session/index.js";
-import { buildCompactTerminalRows, buildSlashCommandCatalog, buildTerminalStatusViewModel, commandSupportLabel, filterSlashCommands, formatSlashCommand, groupSlashCommandsForHelp, normalizeCommandErrorDescriptor, progressBarText, } from "../../session-ui/index.js";
+import { buildCompactTerminalRows, buildSlashCommandCatalog, buildTerminalStatusViewModel, commandSupportLabel, filterSlashCommands, formatSlashCommand, groupSlashCommandsForHelp, normalizeCommandErrorDescriptor, progressBarText, redactTerminalSecret, } from "../../session-ui/index.js";
 import { InkTerminalView } from "./InkTerminalView.js";
 import { isExpandableTerminalRow } from "./InkTerminalRow.js";
 const IDENTIFIER_PATTERN = /^(?:user|room|ps|pi|entry|evt|run|create|provider|model|agent)[_:]/i;
@@ -32,6 +32,12 @@ export function InkSessionApp({ source, initialSessionId, maxRows, maxLineChars,
     const closedRef = useRef(false);
     const stateRef = useRef(state);
     const pickerActivationRef = useRef({ inFlight: false });
+    const commitInputState = useCallback((update) => {
+        const next = update(stateRef.current);
+        stateRef.current = next;
+        setState(next);
+        return next;
+    }, []);
     useEffect(() => {
         stateRef.current = state;
     }, [state]);
@@ -220,82 +226,89 @@ export function InkSessionApp({ source, initialSessionId, maxRows, maxLineChars,
             cleanup();
         };
     }, [cleanup, initialSessionId, openRoomPicker, openSession, source]);
+    usePaste((input) => {
+        if (closedRef.current || input.length === 0)
+            return;
+        commitInputState((current) => reduceInkSessionInputState(current, { type: "text", value: input }));
+    });
     useInput((input, key) => {
         if (closedRef.current)
             return;
+        const returnTerminatedInput = !key.ctrl && !key.meta && !key.return && (input.endsWith("\r") || input.endsWith("\n"));
+        if (returnTerminatedInput) {
+            const text = input.slice(0, -1);
+            if (text.length > 0)
+                commitInputState((current) => reduceInkSessionInputState(current, { type: "text", value: text }));
+        }
         if (key.ctrl && input === "c") {
             requestExit();
             return;
         }
         if (key.escape) {
-            setState((current) => reduceInkSessionInputState(current, { type: "escape" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "escape" }));
             return;
         }
         if (key.upArrow) {
-            setState((current) => reduceInkSessionInputState(current, { type: "up" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "up" }));
             return;
         }
         if (key.downArrow) {
-            setState((current) => reduceInkSessionInputState(current, { type: "down" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "down" }));
             return;
         }
         if (key.leftArrow) {
-            setState((current) => reduceInkSessionInputState(current, { type: "left" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "left" }));
             return;
         }
         if (key.rightArrow) {
-            setState((current) => reduceInkSessionInputState(current, { type: "right" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "right" }));
             return;
         }
         if (key.home) {
-            setState((current) => reduceInkSessionInputState(current, { type: "home" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "home" }));
             return;
         }
         if (key.end) {
-            setState((current) => reduceInkSessionInputState(current, { type: "end" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "end" }));
             return;
         }
-        if (key.return) {
+        if (key.return || returnTerminatedInput) {
             const submitted = stateRef.current.input;
             if (submitted.length === 0 && !stateRef.current.picker && !stateRef.current.slashSuggestions && canToggleSelectedRowDetails(stateRef.current)) {
-                setState((current) => reduceInkSessionInputState(current, { type: "toggle-details" }));
+                commitInputState((current) => reduceInkSessionInputState(current, { type: "toggle-details" }));
                 return;
             }
             if (stateRef.current.slashSuggestions && !stateRef.current.picker) {
                 const accepted = acceptSlashSuggestion(stateRef.current);
                 if (accepted.runInput) {
-                    setState((current) => ({ ...current, input: "", inputCursor: 0, slashSuggestions: undefined, message: undefined, error: undefined }));
+                    commitInputState((current) => ({ ...current, input: "", inputCursor: 0, slashSuggestions: undefined, message: undefined, error: undefined }));
                     void submitCommandOrMessage(accepted.runInput);
                 }
                 else {
-                    setState((current) => ({ ...current, input: accepted.input, inputCursor: accepted.input.length, slashSuggestions: undefined, message: `Accepted ${accepted.input.trim()}. Press Enter to run or add arguments.`, error: undefined }));
+                    commitInputState((current) => ({ ...current, input: accepted.input, inputCursor: accepted.input.length, slashSuggestions: undefined, message: `Accepted ${accepted.input.trim()}. Press Enter to run or add arguments.`, error: undefined }));
                 }
                 return;
             }
             if (submitted.trimStart().startsWith("/")) {
-                setState((current) => reduceInkSessionInputState(current, { type: "enter" }));
+                commitInputState((current) => reduceInkSessionInputState(current, { type: "enter" }));
                 void submitCommandOrMessage(submitted);
                 return;
             }
             if (stateRef.current.picker) {
-                setState((current) => reduceInkSessionInputState(current, { type: "enter" }));
+                commitInputState((current) => reduceInkSessionInputState(current, { type: "enter" }));
                 void selectPickerItem();
                 return;
             }
-            setState((current) => reduceInkSessionInputState(current, { type: "enter" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "enter" }));
             void submitCommandOrMessage(submitted);
             return;
         }
         if (key.backspace || key.delete) {
-            setState((current) => reduceInkSessionInputState(current, { type: "backspace" }));
-            return;
-        }
-        if (input === "d" && !key.ctrl && !key.meta && stateRef.current.input.length === 0 && !stateRef.current.picker && !stateRef.current.slashSuggestions && canToggleSelectedRowDetails(stateRef.current)) {
-            setState((current) => reduceInkSessionInputState(current, { type: "toggle-details" }));
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "backspace" }));
             return;
         }
-        if (input && !key.ctrl && !key.meta) {
-            setState((current) => reduceInkSessionInputState(current, { type: "text", value: input }));
+        if (input && !returnTerminatedInput && !key.ctrl && !key.meta) {
+            commitInputState((current) => reduceInkSessionInputState(current, { type: "text", value: input }));
         }
     });
     return React.createElement(InkSessionAppView, { state, maxRows, maxLineChars });
@@ -540,7 +553,7 @@ export function cliCommandSummaryText(catalog = buildSlashCommandCatalog()) {
     return `Commands: ${commands.join(" ")} (type / for suggestions, /help for catalog)`;
 }
 export function cliCommandHintText() {
-    return "commands: / opens palette · /status runtime · /room /session navigate · /help catalog · ↑↓ focus rows · d/enter details · ctrl-c exit";
+    return "commands: / opens palette · /status runtime · /room /session navigate · /help catalog · ↑↓ focus rows · enter details · ctrl-c exit";
 }
 export function cliSessionSlashHelpText(catalog = buildSlashCommandCatalog()) {
     const grouped = groupSlashCommandsForHelp(catalog);
@@ -1307,10 +1320,7 @@ export function formatCliSessionError(error) {
     return `${message}. Recovery: use /status for source state or restart the CLI if the problem persists.`;
 }
 function redactCliSessionStatusText(text) {
-    return text
-        .replace(/\b([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*)\s*=\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(api[_-]?key|token|secret|password)\s*[:=]\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(?:sk|pk|pibo|ghp|github_pat)_[A-Za-z0-9_\-]{8,}\b/g, "[redacted]");
+    return redactTerminalSecret(text);
 }
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);

package/dist/auth/cli.js CHANGED Viewed

@@ -5,7 +5,7 @@ import { Command } from "commander";
 import { loadPiboConfig } from "../config/config.js";
 import { piboHomePath } from "../core/pibo-home.js";
 import { protectPrivateFileSync } from "../core/private-path.js";
-import { generateMachineKey, getDefaultMachineKeyStorePath, importMachineKeyRecord, listMachineKeys, parseMachineKeyRecord, revokeMachineKey, } from "./machine-keys.js";
+import { generateMachineKey, getDefaultMachineKeyStorePath, importMachineKeyRecord, listMachineKeys, parseIsoTimestamp, parseMachineKeyRecord, revokeMachineKey, } from "./machine-keys.js";
 function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
@@ -117,12 +117,10 @@ function writePrivateNewFile(path, content) {
 function parseExpiresAt(value) {
     if (value === undefined)
         return undefined;
-    const timestamp = Date.parse(value);
-    if (Number.isNaN(timestamp))
-        throw new Error("--expires-at must be an ISO timestamp");
-    if (timestamp <= Date.now())
+    const expiresAt = parseIsoTimestamp(value, "--expires-at");
+    if (Date.parse(expiresAt) <= Date.now())
         throw new Error("--expires-at must be in the future");
-    return new Date(timestamp).toISOString();
+    return expiresAt;
 }
 export async function runAuthCli(argv = process.argv) {
     if (argv.length <= 2 || argv[2] === "--help" || argv[2] === "-h") {

package/dist/auth/machine-keys.js CHANGED Viewed

@@ -15,11 +15,28 @@ export function getDefaultMachineKeyStorePath() {
 function hashMachineKeyToken(token) {
     return createHash("sha256").update(token, "utf8").digest();
 }
-function parseIsoTimestamp(value, field) {
-    if (typeof value !== "string" || value.length === 0 || Number.isNaN(Date.parse(value))) {
+export function parseIsoTimestamp(value, field) {
+    if (typeof value !== "string")
+        throw new Error(`${field} must be an ISO timestamp`);
+    const match = value.match(/^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/);
+    if (!match)
+        throw new Error(`${field} must be an ISO timestamp`);
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText] = match;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const hour = Number(hourText);
+    const minute = Number(minuteText);
+    const second = Number(secondText);
+    const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    const daysByMonth = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+    if (month < 1 || month > 12 || day < 1 || day > daysByMonth[month - 1] || hour > 23 || minute > 59 || second > 59) {
         throw new Error(`${field} must be an ISO timestamp`);
     }
-    return new Date(value).toISOString();
+    const timestamp = Date.parse(value);
+    if (Number.isNaN(timestamp))
+        throw new Error(`${field} must be an ISO timestamp`);
+    return new Date(timestamp).toISOString();
 }
 function optionalString(value, field) {
     if (value === undefined)

package/dist/cli-session/localSessionSource.js CHANGED Viewed

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { redactSensitiveText } from "../core/sensitive-data-redaction.js";
 import { DEFAULT_PIBO_PROFILE_NAME, resolvePiboProfileNameFromRegistryOrDefault, } from "../plugins/builtin.js";
 import { createDefaultPiboUserProfileRegistry } from "../plugins/user-profile-resources.js";
 import { createDefaultPiboDataSessionStore } from "../sessions/pibo-data-store.js";
@@ -863,10 +864,7 @@ function parseCliOutputPersistenceState(value) {
     return { version: 1, piboSessionId: candidate.piboSessionId, deliveries };
 }
 export function redactCliSecretText(text) {
-    return text
-        .replace(/\b([A-Z0-9_]*(?:API[_-]?KEY|TOKEN|SECRET|PASSWORD)[A-Z0-9_]*)\s*=\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(api[_-]?key|token|secret|password)\s*[:=]\s*([^\s]+)/gi, "$1=[redacted]")
-        .replace(/\b(?:sk|pk|pibo|ghp|github_pat)_[A-Za-z0-9_\-]{8,}\b/g, "[redacted]");
+    return redactSensitiveText(text);
 }
 function sessionToSummary(session, defaultRoomId) {
     return {

package/dist/compute/cli.js CHANGED Viewed

@@ -13,11 +13,14 @@ function computeImageBuildConfig() {
 function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
-function parsePositiveIntegerOption(value) {
-    if (value === undefined || value.trim() === "")
-        return undefined;
-    const parsed = Number(value);
-    return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
+function positiveIntegerOption(optionName) {
+    return (value) => {
+        const parsed = Number(value);
+        if (value.trim() === "" || !Number.isInteger(parsed) || parsed <= 0) {
+            throw new InvalidArgumentError(`${optionName} must be a positive integer`);
+        }
+        return parsed;
+    };
 }
 function parseNonNegativeNumber(value) {
     const parsed = Number(value);
@@ -233,8 +236,8 @@ Next:
         .description("Create a one-time worker from the current Docker image")
         .option("--name <name>", "Set the container name")
         .option("--holder <holder>", "Tag the container holder")
-        .option("--ttl-seconds <n>", "Tag the worker TTL in seconds")
-        .option("--idle-seconds <n>", "Tag the worker idle retention in seconds")
+        .option("--ttl-seconds <n>", "Tag the worker TTL in seconds", positiveIntegerOption("--ttl-seconds"))
+        .option("--idle-seconds <n>", "Tag the worker idle retention in seconds", positiveIntegerOption("--idle-seconds"))
         .option("--ralph-job-id <id>", "Tag the Ralph job id when this worker is Ralph-owned")
         .option("--ralph-run-id <id>", "Tag the Ralph run id when this worker is Ralph-owned")
         .addHelpText("after", `
@@ -262,8 +265,8 @@ Environment:
             imageName: image.imageName,
             name: options.name,
             holder: options.holder,
-            ttlSeconds: parsePositiveIntegerOption(options.ttlSeconds),
-            idleSeconds: parsePositiveIntegerOption(options.idleSeconds),
+            ttlSeconds: options.ttlSeconds,
+            idleSeconds: options.idleSeconds,
             ralphJobId: options.ralphJobId,
             ralphRunId: options.ralphRunId,
         });
@@ -285,8 +288,8 @@ Next:
         .requiredOption("--worktree <name>", "Name the Git worktree and branch")
         .option("--repo <path>", "Use this repository", WORKSPACE_DIR)
         .option("--holder <holder>", "Tag the container holder")
-        .option("--ttl-seconds <n>", "Tag the worker TTL in seconds")
-        .option("--idle-seconds <n>", "Tag the worker idle retention in seconds")
+        .option("--ttl-seconds <n>", "Tag the worker TTL in seconds", positiveIntegerOption("--ttl-seconds"))
+        .option("--idle-seconds <n>", "Tag the worker idle retention in seconds", positiveIntegerOption("--idle-seconds"))
         .option("--ralph-job-id <id>", "Tag the Ralph job id when this worker is Ralph-owned")
         .option("--ralph-run-id <id>", "Tag the Ralph run id when this worker is Ralph-owned")
         .addHelpText("after", `
@@ -316,8 +319,8 @@ Example:
             worktreeName: options.worktree,
             imageName: image.imageName,
             holder: options.holder,
-            ttlSeconds: parsePositiveIntegerOption(options.ttlSeconds),
-            idleSeconds: parsePositiveIntegerOption(options.idleSeconds),
+            ttlSeconds: options.ttlSeconds,
+            idleSeconds: options.idleSeconds,
             ralphJobId: options.ralphJobId,
             ralphRunId: options.ralphRunId,
         });

package/dist/compute/docker.js CHANGED Viewed

@@ -401,6 +401,7 @@ function buildComputeWorkerMetadataLabels(options) {
         `${LABEL_PORT_BLOCK}=${options.portBlock}`,
         `${LABEL_TTL_SECONDS}=${options.ttlSeconds}`,
         `${LABEL_IDLE_SECONDS}=${options.idleSeconds}`,
+        `${LABEL_LAST_USED_AT}=${options.createdAt}`,
         ...(options.holder ? [`${LABEL_HOLDER}=${options.holder}`] : []),
         ...(options.worktree ? [`${LABEL_WORKTREE}=${options.worktree}`] : []),
         ...(options.worktreePath ? [`${LABEL_WORKTREE_PATH}=${options.worktreePath}`] : []),
@@ -488,60 +489,100 @@ export function buildDevWorkerDockerRunArgs(options) {
         "ln -sf /workspace/dist/bin/pibo.js /usr/local/bin/pibo && exec tail -f /dev/null",
     ];
 }
+export function validateDevWorktreeName(name) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(name)) {
+        throw new Error("Dev worktree name must use only letters, numbers, dots, underscores, and hyphens, and must start with a letter or number");
+    }
+}
+async function localBranchExists(repoDir, name) {
+    try {
+        await execFileAsync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${name}`], { cwd: repoDir });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === 1)
+            return false;
+        throw error;
+    }
+}
 export async function spawnDevWorker(options) {
+    validateDevWorktreeName(options.worktreeName);
+    const branchExisted = await localBranchExists(options.repoDir, options.worktreeName);
     const worktreePath = path.join(options.repoDir, ".worktrees", options.worktreeName);
     await createWorktree(options.repoDir, options.worktreeName);
-    const id = `pibo-dev-${options.worktreeName}`;
-    const createdAt = new Date().toISOString();
-    // Mount host node_modules into the container so dependencies are immediately available
-    const hostNodeModules = path.join(options.repoDir, "node_modules");
-    let nodeModulesMount;
     try {
-        const { stdout } = await execFileAsync("ls", ["-d", hostNodeModules]);
-        if (stdout.trim())
-            nodeModulesMount = hostNodeModules;
+        const id = `pibo-dev-${options.worktreeName}`;
+        const createdAt = new Date().toISOString();
+        // Mount host node_modules into the container so dependencies are immediately available
+        const hostNodeModules = path.join(options.repoDir, "node_modules");
+        let nodeModulesMount;
+        try {
+            const { stdout } = await execFileAsync("ls", ["-d", hostNodeModules]);
+            if (stdout.trim())
+                nodeModulesMount = hostNodeModules;
+        }
+        catch {
+            // host node_modules does not exist; skip mount
+        }
+        const ports = await withDevPortAllocationLock(async () => {
+            const block = await findNextPortBlock();
+            const base = DEV_PORT_BASE + block * DEV_PORT_BLOCK_SIZE;
+            const gatewayPort = base;
+            const cdpPort = base + 1;
+            const webPort = base + 2;
+            const webUIPortChat = base + 3;
+            const webUIPortContext = base + 4;
+            const args = buildDevWorkerDockerRunArgs({
+                id,
+                imageName: options.imageName,
+                worktreePath,
+                worktreeName: options.worktreeName,
+                block,
+                gatewayPort,
+                cdpPort,
+                webPort,
+                webUIPortChat,
+                webUIPortContext,
+                createdAt,
+                holder: options.holder,
+                ttlSeconds: options.ttlSeconds,
+                idleSeconds: options.idleSeconds,
+                ralphJobId: options.ralphJobId,
+                ralphRunId: options.ralphRunId,
+                hostNodeModules: nodeModulesMount,
+            });
+            await execFileAsync("docker", args, { cwd: options.repoDir });
+            return { gatewayPort, cdpPort, webPort, webUIPortChat, webUIPortContext };
+        });
+        return {
+            id,
+            image: options.imageName ?? IMAGE_NAME,
+            gatewayHost: COMPUTE_PUBLISH_HOST,
+            ...ports,
+            connect: `docker exec -it ${id} bash`,
+            worktree: worktreePath,
+        };
     }
-    catch {
-        // host node_modules does not exist; skip mount
+    catch (error) {
+        const cleanupErrors = [];
+        try {
+            await execFileAsync("git", ["worktree", "remove", "--force", worktreePath], { cwd: options.repoDir });
+        }
+        catch (cleanupError) {
+            cleanupErrors.push(cleanupError);
+        }
+        if (!branchExisted) {
+            try {
+                await execFileAsync("git", ["branch", "-D", options.worktreeName], { cwd: options.repoDir });
+            }
+            catch (cleanupError) {
+                cleanupErrors.push(cleanupError);
+            }
+        }
+        if (cleanupErrors.length > 0)
+            throw new AggregateError([error, ...cleanupErrors], `Dev worker spawn failed and cleanup was incomplete for ${options.worktreeName}`);
+        throw error;
     }
-    const ports = await withDevPortAllocationLock(async () => {
-        const block = await findNextPortBlock();
-        const base = DEV_PORT_BASE + block * DEV_PORT_BLOCK_SIZE;
-        const gatewayPort = base;
-        const cdpPort = base + 1;
-        const webPort = base + 2;
-        const webUIPortChat = base + 3;
-        const webUIPortContext = base + 4;
-        const args = buildDevWorkerDockerRunArgs({
-            id,
-            imageName: options.imageName,
-            worktreePath,
-            worktreeName: options.worktreeName,
-            block,
-            gatewayPort,
-            cdpPort,
-            webPort,
-            webUIPortChat,
-            webUIPortContext,
-            createdAt,
-            holder: options.holder,
-            ttlSeconds: options.ttlSeconds,
-            idleSeconds: options.idleSeconds,
-            ralphJobId: options.ralphJobId,
-            ralphRunId: options.ralphRunId,
-            hostNodeModules: nodeModulesMount,
-        });
-        await execFileAsync("docker", args, { cwd: options.repoDir });
-        return { gatewayPort, cdpPort, webPort, webUIPortChat, webUIPortContext };
-    });
-    return {
-        id,
-        image: options.imageName ?? IMAGE_NAME,
-        gatewayHost: COMPUTE_PUBLISH_HOST,
-        ...ports,
-        connect: `docker exec -it ${id} bash`,
-        worktree: worktreePath,
-    };
 }
 export function buildWorkerDockerRunArgs(options) {
     const policy = options.policy ?? resolveComputeResourcePolicy();
@@ -727,6 +768,8 @@ function workerFromLabels(base) {
         hostPid: base.hostPid,
         createdAt: base.labels[LABEL_CREATED_AT] ?? "unknown",
         lastUsedAt: base.labels[LABEL_LAST_USED_AT],
+        ttlSeconds: numberLabel(base.labels[LABEL_TTL_SECONDS]),
+        idleSeconds: numberLabel(base.labels[LABEL_IDLE_SECONDS]),
         holder: base.labels[LABEL_HOLDER],
         worktree: base.labels[LABEL_WORKTREE],
         worktreePath: base.labels[LABEL_WORKTREE_PATH],
@@ -865,6 +908,7 @@ export function buildComputeWorkerReapPlan(workers, options = {}) {
         const skipReasons = [];
         const created = new Date(worker.createdAt).getTime();
         const ageMinutes = Number.isNaN(created) ? undefined : (now.getTime() - created) / 1000 / 60;
+        const lastUsed = new Date(worker.lastUsedAt ?? worker.createdAt).getTime();
         if (worker.role === "dev" && !resolved.includeDev)
             skipReasons.push("dev-worker-preserved");
         if (worker.role !== "worker" && worker.role !== "dev")
@@ -875,6 +919,10 @@ export function buildComputeWorkerReapPlan(workers, options = {}) {
             reasons.push(worker.oomKilled ? "oom-killed" : "dirty");
         if (ageMinutes !== undefined && ageMinutes > resolved.maxAgeMinutes)
             reasons.push("old");
+        if (ageMinutes !== undefined && worker.ttlSeconds !== undefined && worker.ttlSeconds > 0 && ageMinutes * 60 >= worker.ttlSeconds)
+            reasons.push("ttl-expired");
+        if (!Number.isNaN(lastUsed) && worker.idleSeconds !== undefined && worker.idleSeconds > 0 && now.getTime() - lastUsed >= worker.idleSeconds * 1000)
+            reasons.push("idle-expired");
         if (reasons.length === 0)
             skipReasons.push("not-selected");
         const action = skipReasons.length === 0 ? "remove" : "skip";

package/dist/core/base-prompt.js CHANGED Viewed

@@ -10,6 +10,14 @@ function getBasePromptStatePath(cwd) {
 function getCustomBasePromptPath(cwd) {
     return resolve(cwd, ".pibo/base-prompt.md");
 }
+function getLegacyBasePromptPath(cwd) {
+    return resolve(cwd, ".pibo/SYSTEM.md");
+}
+function effectiveMode(state, customExists, legacyExists) {
+    if (legacyExists)
+        return "legacy";
+    return state.mode === "custom" && customExists ? "custom" : "library";
+}
 function normalizeMode(value) {
     return value === "custom" ? "custom" : "library";
 }
@@ -34,8 +42,7 @@ function writeBasePromptState(cwd, state) {
     writeFileSync(path, `${JSON.stringify(state, null, 2)}\n`);
 }
 export function getActivePiboBasePromptPath(cwd = process.cwd()) {
-    const legacyOverridePath = resolve(cwd, ".pibo/SYSTEM.md");
-    if (existsSync(legacyOverridePath))
+    if (existsSync(getLegacyBasePromptPath(cwd)))
         return undefined;
     const customPath = getCustomBasePromptPath(cwd);
     const state = readBasePromptState(cwd);
@@ -46,14 +53,17 @@ export function getActivePiboBasePromptPath(cwd = process.cwd()) {
 export async function readPiboBasePrompt(cwd = process.cwd()) {
     const state = readBasePromptState(cwd);
     const customPath = getCustomBasePromptPath(cwd);
+    const legacyPath = getLegacyBasePromptPath(cwd);
     const customExists = existsSync(customPath);
-    const [libraryMarkdown, customMarkdown] = await Promise.all([
+    const legacyExists = existsSync(legacyPath);
+    const [libraryMarkdown, customMarkdown, legacyMarkdown] = await Promise.all([
         readFile(PIBO_LIBRARY_BASE_PROMPT_PATH, "utf-8"),
         customExists ? readFile(customPath, "utf-8") : Promise.resolve(""),
+        legacyExists ? readFile(legacyPath, "utf-8") : Promise.resolve(""),
     ]);
     return {
         mode: state.mode,
-        effectiveMode: state.mode === "custom" && customExists ? "custom" : "library",
+        effectiveMode: effectiveMode(state, customExists, legacyExists),
         library: {
             path: PIBO_LIBRARY_BASE_PROMPT_PATH,
             markdown: libraryMarkdown,
@@ -64,6 +74,11 @@ export async function readPiboBasePrompt(cwd = process.cwd()) {
             exists: customExists,
             updatedAt: customExists ? state.updatedAt : undefined,
         },
+        legacy: {
+            path: legacyPath,
+            markdown: legacyMarkdown,
+            exists: legacyExists,
+        },
     };
 }
 export async function savePiboCustomBasePrompt(markdown, cwd = process.cwd()) {
@@ -87,9 +102,11 @@ export function setPiboBasePromptMode(mode, cwd = process.cwd()) {
     });
     const state = readBasePromptState(cwd);
     const customExists = existsSync(customPath);
+    const legacyPath = getLegacyBasePromptPath(cwd);
+    const legacyExists = existsSync(legacyPath);
     return {
         mode: state.mode,
-        effectiveMode: state.mode === "custom" && customExists ? "custom" : "library",
+        effectiveMode: effectiveMode(state, customExists, legacyExists),
         library: {
             path: PIBO_LIBRARY_BASE_PROMPT_PATH,
             markdown: readFileSync(PIBO_LIBRARY_BASE_PROMPT_PATH, "utf-8"),
@@ -100,5 +117,10 @@ export function setPiboBasePromptMode(mode, cwd = process.cwd()) {
             exists: customExists,
             updatedAt: customExists ? state.updatedAt : undefined,
         },
+        legacy: {
+            path: legacyPath,
+            markdown: legacyExists ? readFileSync(legacyPath, "utf-8") : "",
+            exists: legacyExists,
+        },
     };
 }

package/dist/core/context-build.js CHANGED Viewed

@@ -2,6 +2,7 @@ import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
 import { createDefaultPiboProfile } from "./default-profile.js";
 import { loadPiboModelDefaults, selectRequestedModelProfile, selectRequestedThinkingLevel } from "./model-defaults.js";
+import { redactSensitiveText } from "./sensitive-data-redaction.js";
 import { getMcpAgentContextFile } from "../mcp/agent-context.js";
 import { PIBO_GOAL_TOOL_NAMES } from "../loops/tools.js";
 import { getInstalledCliToolContextFile } from "../tools/registry.js";
@@ -38,11 +39,6 @@ export function createPiboRuntimeResolutionManifest(input) {
     };
 }
 const SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|cookie|credential|oauth|password|secret|token)/i;
-const SECRET_TEXT_PATTERNS = [
-    /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi,
-    /\b(sk|pk|rk)-[A-Za-z0-9_-]{16,}\b/g,
-    /\b(api[_-]?key|authorization|cookie|password|secret|token)\b\s*[:=]\s*[^\s\n,;]+/gi,
-];
 function byteLength(text) {
     return Buffer.byteLength(text, "utf-8");
 }
@@ -79,15 +75,7 @@ function applyTokenEstimates(node) {
     return node;
 }
 function redactText(text) {
-    let value = text;
-    for (const pattern of SECRET_TEXT_PATTERNS) {
-        value = value.replace(pattern, (match) => {
-            const separator = match.match(/[:=]/)?.[0];
-            if (!separator)
-                return "[REDACTED]";
-            return `${match.slice(0, match.indexOf(separator) + 1)} [REDACTED]`;
-        });
-    }
+    const value = redactSensitiveText(text).replaceAll("[redacted]", "[REDACTED]");
     return { value, redacted: value !== text };
 }
 function redactJson(value) {
@@ -340,7 +328,9 @@ export async function inspectPiboContextBuild(options = {}) {
         const generatedAt = new Date().toISOString();
         const resourceLoader = runtime.services.resourceLoader;
         const basePrompt = await readPiboBasePrompt(cwd);
-        const activePrompt = basePrompt.effectiveMode === "custom" ? basePrompt.custom : basePrompt.library;
+        const activePrompt = basePrompt.effectiveMode === "legacy"
+            ? basePrompt.legacy
+            : basePrompt.effectiveMode === "custom" ? basePrompt.custom : basePrompt.library;
         const activeToolNames = new Set(runtime.session.getActiveToolNames());
         const allTools = runtime.session.getAllTools();
         const toolInfoByName = new Map(allTools.map((tool) => [tool.name, tool]));

package/dist/core/sensitive-data-redaction.js CHANGED Viewed

@@ -1,9 +1,9 @@
 const SENSITIVE_KEY_PATTERN = /(?:authorization|cookie|credential|access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|bearer|oauth|token|secret|password|passwd)/i;
 const SENSITIVE_TEXT_PATTERNS = [
     [/\bBearer\s+\S+/gi, "Bearer [redacted]"],
-    [/\b(?:sk|pk|rk|ghp|gho|ghu|ghs|ghr|github_pat|pibo|xoxb|xoxp|xoxa|xoxr)[-_][A-Za-z0-9_-]{8,}\b/g, "[redacted]"],
+    [/\b(?:sk-(?:proj-)?[A-Za-z0-9_-]{16,}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}|gh[pousr]_[A-Za-z0-9_]{16,}|github_pat_[A-Za-z0-9_]{16,}|xox[baprs]-[A-Za-z0-9-]{16,})\b/g, "[redacted]"],
     [/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, "[redacted]"],
-    [/\b(access[_-]?token|refresh[_-]?token|id[_-]?token|api[_-]?key|authorization|cookie|credential|oauth|token|secret|password|passwd)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,;}]+)/gi, "$1$2[redacted]"],
+    [/\b([A-Z0-9_]*(?:ACCESS[_-]?TOKEN|REFRESH[_-]?TOKEN|ID[_-]?TOKEN|API[_-]?KEY|AUTHORIZATION|COOKIE|CREDENTIAL|OAUTH|TOKEN|SECRET|PASSWORD|PASSWD)[A-Z0-9_]*)\b(\s*["']?\s*[:=]\s*["']?)([^\s"'&,;}]+)/gi, "$1$2[redacted]"],
 ];
 export function redactSensitiveText(value) {
     let selected = value;