npm - @pasko70/pibo - Versions diffs - 3.2.7 → 3.4.0 - Mend

@pasko70/pibo 3.2.7 → 3.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (254) hide show

package/dist/apps/chat-vscode-web/index.html CHANGED Viewed

@@ -5,7 +5,7 @@
 		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
 		<meta name="theme-color" content="#101d22" />
 		<title>Pibo</title>
-		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-D1bpAUkR.js"></script>
+		<script type="module" crossorigin src="/apps/chat-vscode/assets/index-Spj6M0tn.js"></script>
 		<link rel="stylesheet" crossorigin href="/apps/chat-vscode/assets/index-b18ZkEo0.css">
 	</head>
 	<body>

package/dist/compute/pool/cli.js CHANGED Viewed

@@ -149,7 +149,7 @@ Provide exactly one source:
     program.command("seed")
         .action(() => console.log(`Deployment seed modes:
   full    Nearly complete Pibo home plus configured workspace; excludes active runtime, lock, browser, debug, and pool state.
-  medium  Operational config, selected product databases, projects, contexts, agents, and user skills; excludes heavy payload/tool/browser/debug state.
+  medium  Operational config, selected product and workflow databases, contexts, agents, and user skills; excludes heavy payload/tool/browser/debug state.
   fresh   Operational config, Google/Machine auth configuration, model defaults, contexts, and user skills; no existing product databases.
 `));
     await program.parseAsync(argv);

package/dist/compute/pool/seeds.js CHANGED Viewed

@@ -35,11 +35,10 @@ const MEDIUM_ALLOWED_TOP_LEVEL = new Set([
     "chat-agents.sqlite",
     "pibo.sqlite",
     "pibo-events.sqlite",
-    "web-projects.sqlite",
+    "pibo-workflows.sqlite",
     "web-annotations.sqlite",
     "context-files",
     "user-skills",
-    "projects",
 ]);
 const FRESH_ALLOWED_TOP_LEVEL = new Set([
     "config.json",
@@ -137,7 +136,7 @@ async function backupSeedDatabases(sourceHome, destinationHome, mode) {
     if (mode === "fresh")
         return [];
     const allowed = mode === "medium"
-        ? new Set(["chat-agents.sqlite", "pibo.sqlite", "pibo-events.sqlite", "web-projects.sqlite", "web-annotations.sqlite"])
+        ? new Set(["chat-agents.sqlite", "pibo.sqlite", "pibo-events.sqlite", "pibo-workflows.sqlite", "web-annotations.sqlite"])
         : undefined;
     const copied = [];
     for (const entry of await readdir(sourceHome, { withFileTypes: true })) {

package/dist/config/config.js CHANGED Viewed

@@ -59,7 +59,7 @@ export const PIBO_CONFIG_KEYS = [
     {
         key: "preview.baseURL",
         type: "string",
-        description: "Public preview base URL. Preview ids become subdomains, for example https://preview.example.com.",
+        description: "Public Preview base URL. Run `pibo preview setup --base-url https://preview.example.com` before enabling it.",
     },
     {
         key: "preview.databasePath",

package/dist/core/session-router.js CHANGED Viewed

@@ -231,7 +231,6 @@ function derivedSessionMetadata(value) {
     for (const key of [
         DERIVED_SESSION_RECONCILIATION_METADATA_KEY,
         "workflowSessionKind",
-        "projectSessionKind",
         "subagentName",
         "subagentToolName",
         "agentStatus",
@@ -1692,9 +1691,13 @@ export class PiboSessionRouter {
             catch (error) {
                 transitionError = error;
             }
-            // Always discard the source live handle after derivation. Bound native
-            // branches move that handle to the derived session; first-message Codex
-            // branches intentionally leave it on the source and persist unbound.
+            if (result.sourceSessionUnchanged) {
+                if (transitionError)
+                    throw transitionError;
+                return;
+            }
+            // Identity-moving forks and clones transfer the live native handle to the
+            // derived session, so the source must be reopened from its persisted binding.
             try {
                 await this.resetCachedSession(event.piboSessionId);
             }
@@ -2090,12 +2093,18 @@ export class PiboSessionRouter {
         for (const agentId of input.agentIds ?? [])
             this.requireManagedAgent(parentPiboSessionId, agentId);
         const query = preparePiboAgentObservationQuery(input);
-        const ordered = query.scanOrder === "asc"
-            ? this.agentObservations
-            : [...this.agentObservations].reverse();
-        return selectPiboAgentObservationPage(ordered
-            .filter((observation) => observation.managingParentId === parentPiboSessionId)
-            .map(({ managingParentId: _managingParentId, ...observation }) => observation), query, { evictedThrough: this.agentObservationEvictedThroughByParent.get(parentPiboSessionId) ?? 0 });
+        const observations = this.agentObservations;
+        function* ordered() {
+            const start = query.scanOrder === "asc" ? 0 : observations.length - 1;
+            const end = query.scanOrder === "asc" ? observations.length : -1;
+            const step = query.scanOrder === "asc" ? 1 : -1;
+            for (let index = start; index !== end; index += step) {
+                const { managingParentId, ...observation } = observations[index];
+                if (managingParentId === parentPiboSessionId)
+                    yield observation;
+            }
+        }
+        return selectPiboAgentObservationPage(ordered(), query, { evictedThrough: this.agentObservationEvictedThroughByParent.get(parentPiboSessionId) ?? 0 });
     }
     async killManagedAgent(parentPiboSessionId, agentId) {
         const child = this.requireManagedAgent(parentPiboSessionId, agentId);

package/dist/debug/agents.js CHANGED Viewed

@@ -47,6 +47,7 @@ export async function runDebugAgentsCli(args) {
         since: parsed.since,
         until: parsed.until,
         textContains: parsed.textContains,
+        textRegex: parsed.textRegex,
         afterSequence: parsed.afterSequence,
         order: parsed.order,
         limit: parsed.limit,
@@ -282,7 +283,7 @@ Filters use exact values. The command inspects only direct pibo.subagents childr
 Usage:
   pibo debug agents ${parentPiboSessionId} observe [--tool-call-id id] [--agent-id ps_...] [--name name]
     [--thread-key key] [--event-type type] [--kind message|thinking|tool|error|lifecycle|event]
-    [--role role] [--since iso] [--until iso] [--contains text] [--after-sequence n]
+    [--role role] [--since iso] [--until iso] [--contains text] [--regex pattern] [--after-sequence n]
     [--order asc|desc] [--limit 1..200] [--include-tools]
     [--tool-detail summary|full] [--details] [--json]
@@ -290,7 +291,9 @@ Default: the newest 20 completed assistant messages, with streaming deltas and t
 Use --include-tools for compact tool calls and terminal results. Explicit --event-type or --kind
 filters retain access to progress events. Repeat plural filters for OR within that field.
 Different fields combine with AND. With --after-sequence, pages always consume the oldest unseen rows;
---order desc reverses only the returned page, so nextAfterSequence remains safe for polling.`);
+--order desc reverses only the returned page, so nextAfterSequence remains safe for polling.
+--regex uses case-sensitive bundled rg/Rust-regex syntax; inline flags change case or multiline behavior.
+Regex rejects NUL text and literal or escaped NUL patterns and requires the optional rg platform binary.`);
 }
 function parseAgentDebugOptions(args) {
     const parsed = {
@@ -350,6 +353,8 @@ function parseAgentDebugOptions(args) {
             parsed.until = value;
         else if (arg === "--contains")
             parsed.textContains = value;
+        else if (arg === "--regex")
+            parsed.textRegex = value;
         else if (arg === "--after-sequence")
             parsed.afterSequence = parseNonNegativeInteger(value, arg);
         else if (arg === "--order") {
@@ -377,7 +382,8 @@ function validateAgentDebugOptions(command, parsed) {
         if (parsed.details || parsed.includeTools || parsed.toolCallIds.length > 0 || parsed.agentIds.length > 0
             || parsed.threadKeys.length > 0 || parsed.eventTypes.length > 0 || parsed.kinds.length > 0
             || parsed.roles.length > 0 || parsed.since !== undefined || parsed.until !== undefined
-            || parsed.textContains !== undefined || parsed.afterSequence !== undefined || parsed.order !== undefined
+            || parsed.textContains !== undefined || parsed.textRegex !== undefined
+            || parsed.afterSequence !== undefined || parsed.order !== undefined
             || parsed.limit !== undefined || parsed.toolDetail !== undefined)
             throw new Error("Unsupported option for pibo debug agents list. Run the list command with --help.");
         return;

package/dist/plugins/builtin.js CHANGED Viewed

@@ -7,6 +7,7 @@ import { parsePiboThinkingLevel } from "../core/thinking.js";
 import { createWebSearchToolProfile } from "../tools/web-search.js";
 import { CODEX_BROWSER_TOOL_NAMES, createCodexBrowserToolProfiles } from "../tools/codex-browser.js";
 import { createRuntimeToolProfile } from "../tools/runtime/tool.js";
+import { createHashlineToolProfile } from "../tools/hashline.js";
 import { loadModelCatalog } from "../apps/chat/model-catalog.js";
 import { piboCodexCompatPlugin } from "./codex-compat.js";
 import { piboCodexNativePlugin } from "./codex-native.js";
@@ -213,6 +214,7 @@ export const piboCorePlugin = definePiboPlugin({
         });
         api.registerTool(createWebSearchToolProfile());
         api.registerTool(createRuntimeToolProfile());
+        api.registerTool(createHashlineToolProfile());
         api.registerTools(createCodexBrowserToolProfiles());
         api.registerCapabilityPackage({
             name: "codex-browser-interface",

package/dist/plugins/registry.js CHANGED Viewed

@@ -553,6 +553,7 @@ export class PiboPluginRegistry {
                 yieldable: tool.yieldable !== false,
                 hasDefinition: tool.definition !== undefined || tool.createDefinition !== undefined,
                 portable: toolIsPortable(tool),
+                ...(tool.replacesBuiltinTools?.length ? { replacesBuiltinTools: [...tool.replacesBuiltinTools] } : {}),
                 pluginId: tool.pluginId,
                 pluginName: tool.pluginId ? this.pluginNames.get(tool.pluginId) : undefined,
                 ...(tool.providerTool ? { providerTool: tool.providerTool } : {}),

package/dist/previews/cli.js CHANGED Viewed

@@ -2,11 +2,13 @@ import { randomBytes } from "node:crypto";
 import { resolve } from "node:path";
 import { Command } from "commander";
 import { createDefaultPiboDataSessionStore } from "../sessions/pibo-data-store.js";
+import { resolvePreviewComputeWorkerTarget } from "./compute-worker.js";
 import { DEFAULT_PREVIEW_TTL_MINUTES, loadEffectivePreviewServerSettings, loadPreviewConfig, previewPublicURL, requirePreviewBaseURL } from "./config.js";
 import { reconcileManagedPreviews, startManagedPreview, stopManagedPreview, validatePreviewStartCommand, } from "./manager.js";
 import { findPreviewTargetProcess, isPiboControlProcess, isPiboYieldedProcess, isPreviewTargetProcessCurrent, probePreviewTarget, validatePreviewPort, } from "./network.js";
 import { createDefaultPreviewStore, previewExposureState } from "./store.js";
 import { DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS, DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS_PER_PREVIEW, } from "./proxy.js";
+import { createPreviewProductionSetupPlan, inspectPreviewPublicRoute } from "./public-setup.js";
 function printJson(value) {
     console.log(JSON.stringify(value, null, 2));
 }
@@ -19,6 +21,12 @@ function parsePositiveInteger(value) {
         throw new Error("Value must be a positive integer");
     return parsed;
 }
+function parseGatewayPort(value) {
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535)
+        throw new Error("Gateway port must be an integer between 1 and 65535");
+    return parsed;
+}
 function parsePreviewTtlMinutes(value) {
     const parsed = parsePositiveInteger(value);
     if (parsed > 7 * 24 * 60)
@@ -28,12 +36,6 @@ function parsePreviewTtlMinutes(value) {
 function createPreviewId() {
     return `pv-${randomBytes(9).toString("hex")}`;
 }
-function inferredProjectId(metadata) {
-    if (!metadata || typeof metadata !== "object" || Array.isArray(metadata))
-        return undefined;
-    const projectId = metadata.projectId;
-    return typeof projectId === "string" && projectId.trim() ? projectId.trim() : undefined;
-}
 async function previewHealth(exposure) {
     const state = previewExposureState(exposure);
     if (state !== "active")
@@ -64,23 +66,117 @@ async function exposureView(exposure) {
         ...(target ? { latencyMs: target.latencyMs } : {}),
     };
 }
+async function createPreviewExposure(port, options, defaults = {}) {
+    const baseURL = requirePreviewBaseURL();
+    const piboSessionId = options.session.trim();
+    if (!piboSessionId)
+        throw new Error("--session must contain a Pibo Session ID");
+    const sessionStore = createDefaultPiboDataSessionStore();
+    let session;
+    try {
+        session = sessionStore.get(piboSessionId);
+    }
+    finally {
+        sessionStore.close();
+    }
+    if (!session)
+        throw new Error(`Pibo Session "${piboSessionId}" was not found`);
+    const command = options.command === undefined ? undefined : validatePreviewStartCommand(options.command);
+    const target = command ? undefined : await probePreviewTarget(port);
+    if (!command && !target)
+        throw new Error(`No development server is reachable on loopback port ${port}`);
+    if (command && await probePreviewTarget(port, { timeoutMs: 150 }))
+        throw new Error(`Preview port ${port} is already occupied`);
+    const now = new Date();
+    const id = createPreviewId();
+    const targetProcess = target ? findPreviewTargetProcess(target.host, port) : undefined;
+    if (!command && process.platform === "linux" && !targetProcess) {
+        throw new Error(`Preview port ${port} is not bound exclusively to the selected loopback address`);
+    }
+    if (!command && targetProcess && isPiboControlProcess(targetProcess.pid)) {
+        throw new Error(`Preview port ${port} belongs to a Pibo control process and cannot be exposed`);
+    }
+    if (!command && process.env.NODE_ENV !== "test" && targetProcess && isPiboYieldedProcess(targetProcess.pid)) {
+        throw new Error("Preview servers cannot run as yielded agent resources; stop that process and use --command so Preview owns its lifecycle");
+    }
+    const store = createDefaultPreviewStore();
+    let exposure;
+    try {
+        exposure = store.createExposure({
+            id,
+            piboSessionId,
+            label: options.name?.trim() || defaults.label || `Preview ${port}`,
+            targetHost: target?.host ?? "127.0.0.1",
+            targetPort: port,
+            targetProcessId: targetProcess?.pid,
+            targetProcessStartTicks: targetProcess?.startTicks,
+            workspace: resolve(options.workspace ?? defaults.workspace ?? session.workspace ?? process.cwd()),
+            managementMode: command ? "managed" : "external",
+            proxyMode: defaults.proxyMode,
+            startCommand: command,
+            serverState: command ? "stopped" : undefined,
+            createdAt: now.toISOString(),
+            expiresAt: new Date(now.getTime() + options.ttlMinutes * 60_000).toISOString(),
+        });
+        if (command)
+            exposure = await startManagedPreview(store, id);
+    }
+    finally {
+        store.close();
+    }
+    return { ...await exposureView(exposure), publicUrl: previewPublicURL(id, baseURL).toString() };
+}
+function printCreatedPreview(result, json = false) {
+    if (json) {
+        printJson(result);
+        return;
+    }
+    console.log(`${result.id}\t${result.health}\t${result.label}`);
+    console.log(`url\t${result.publicUrl}`);
+    console.log(`session\t${result.piboSessionId}`);
+    console.log(`managed\t${result.managed}`);
+    console.log(`proxyMode\t${result.proxyMode}`);
+    if (result.serverStopAt)
+        console.log(`autoStop\t${result.serverStopAt}`);
+    console.log(`expires\t${result.expiresAt}`);
+}
 function printPreviewDiscovery() {
     console.log(`pibo preview - Session-linked live development previews
 Commands:
+  setup               Print production DNS, TLS, proxy, and restart instructions
   expose <port>       Register an external port or start a managed server with --command
+  expose-worker <id>  Register a running Pibo compute worker with local dev auth
   list                List preview registrations
   show <preview-id>   Inspect one preview
   start <preview-id>  Start a saved managed Preview server
   stop <preview-id>   Stop a managed Preview server without removing it
-  doctor [preview-id] Check preview configuration and reachability
+  doctor [preview-id] Check local state; add --public to verify DNS, TLS, and routing
   remove <preview-id> Stop and remove a preview definition
   close <preview-id>  Alias for remove
 Next:
+  pibo preview setup --help
   pibo preview expose --help
+  pibo preview expose-worker --help
 `);
 }
+function printProductionSetupPlan(plan) {
+    console.log("Preview production setup");
+    console.log(`baseURL\t${plan.baseURL}`);
+    console.log(`DNS\t${plan.dnsRecord.type} ${plan.dnsRecord.name} -> ${plan.dnsRecord.value}`);
+    console.log("\nCaddy global options (merge into an existing global block):");
+    console.log(plan.caddy.globalOptions);
+    console.log("\nCaddy site block:");
+    console.log(plan.caddy.siteBlock);
+    console.log("\nCommands:");
+    console.log(`configure\t${plan.commands.configure}`);
+    console.log(`validate proxy\t${plan.commands.validateCaddy}`);
+    console.log(`restart gateway\t${plan.commands.restartGateway}`);
+    console.log(`verify\t${plan.commands.verify}`);
+    for (const warning of plan.warnings)
+        console.log(`warning\t${warning}`);
+}
 export async function runPreviewCli(argv = process.argv) {
     if (argv.length <= 2 || argv[2] === "--help" || argv[2] === "-h") {
         printPreviewDiscovery();
@@ -88,86 +184,51 @@ export async function runPreviewCli(argv = process.argv) {
     }
     const program = new Command();
     program.name("pibo preview").description("Manage session-linked live development previews");
+    program
+        .command("setup")
+        .requiredOption("--base-url <url>", "Dedicated HTTPS base URL whose subdomains host Previews")
+        .option("--gateway-port <port>", "Loopback Pibo Web Gateway port", parseGatewayPort, 4788)
+        .option("--public-ip <address>", "Public IPv4 or IPv6 address for the exact DNS record")
+        .option("--json", "Print JSON")
+        .action((options) => {
+        const plan = createPreviewProductionSetupPlan({
+            baseURL: options.baseUrl,
+            gatewayPort: options.gatewayPort,
+            publicIp: options.publicIp,
+        });
+        if (options.json)
+            printJson(plan);
+        else
+            printProductionSetupPlan(plan);
+    });
     program
         .command("expose")
         .argument("<port>", "Reachable loopback development port", parsePort)
         .requiredOption("--session <pibo-session-id>", "Pibo Session that owns the preview")
-        .option("--project <project-id>", "Optional Project association")
         .option("--name <label>", "Preview label")
         .option("--workspace <path>", "Workspace used by the managed command and recorded for diagnostics")
         .option("--command <shell-command>", "Save and start this command as a Preview-managed server")
         .option("--ttl-minutes <minutes>", "Automatic preview-definition lifetime", parsePreviewTtlMinutes, DEFAULT_PREVIEW_TTL_MINUTES)
         .option("--json", "Print JSON")
         .action(async (port, options) => {
-        const baseURL = requirePreviewBaseURL();
-        const piboSessionId = options.session.trim();
-        if (!piboSessionId)
-            throw new Error("--session must contain a Pibo Session ID");
-        const sessionStore = createDefaultPiboDataSessionStore();
-        let session;
-        try {
-            session = sessionStore.get(piboSessionId);
-        }
-        finally {
-            sessionStore.close();
-        }
-        if (!session)
-            throw new Error(`Pibo Session "${piboSessionId}" was not found`);
-        const command = options.command === undefined ? undefined : validatePreviewStartCommand(options.command);
-        let target = command ? undefined : await probePreviewTarget(port);
-        if (!command && !target)
-            throw new Error(`No development server is reachable on loopback port ${port}`);
-        if (command && await probePreviewTarget(port, { timeoutMs: 150 }))
-            throw new Error(`Preview port ${port} is already occupied`);
-        const now = new Date();
-        const id = createPreviewId();
-        const targetProcess = target ? findPreviewTargetProcess(target.host, port) : undefined;
-        if (!command && process.platform === "linux" && !targetProcess) {
-            throw new Error(`Preview port ${port} is not bound exclusively to the selected loopback address`);
-        }
-        if (!command && targetProcess && isPiboControlProcess(targetProcess.pid)) {
-            throw new Error(`Preview port ${port} belongs to a Pibo control process and cannot be exposed`);
-        }
-        if (!command && process.env.NODE_ENV !== "test" && targetProcess && isPiboYieldedProcess(targetProcess.pid)) {
-            throw new Error("Preview servers cannot run as yielded agent resources; stop that process and use --command so Preview owns its lifecycle");
-        }
-        const store = createDefaultPreviewStore();
-        let exposure;
-        try {
-            exposure = store.createExposure({
-                id,
-                piboSessionId,
-                projectId: options.project?.trim() || inferredProjectId(session.metadata),
-                label: options.name?.trim() || `Preview ${port}`,
-                targetHost: target?.host ?? "127.0.0.1",
-                targetPort: port,
-                targetProcessId: targetProcess?.pid,
-                targetProcessStartTicks: targetProcess?.startTicks,
-                workspace: resolve(options.workspace ?? session.workspace ?? process.cwd()),
-                managementMode: command ? "managed" : "external",
-                startCommand: command,
-                serverState: command ? "stopped" : undefined,
-                createdAt: now.toISOString(),
-                expiresAt: new Date(now.getTime() + options.ttlMinutes * 60_000).toISOString(),
-            });
-            if (command)
-                exposure = await startManagedPreview(store, id);
-        }
-        finally {
-            store.close();
-        }
-        const result = { ...await exposureView(exposure), publicUrl: previewPublicURL(id, baseURL).toString() };
-        if (options.json)
-            printJson(result);
-        else {
-            console.log(`${result.id}\t${result.health}\t${result.label}`);
-            console.log(`url\t${result.publicUrl}`);
-            console.log(`session\t${result.piboSessionId}`);
-            console.log(`managed\t${result.managed}`);
-            if (result.serverStopAt)
-                console.log(`autoStop\t${result.serverStopAt}`);
-            console.log(`expires\t${result.expiresAt}`);
-        }
+        printCreatedPreview(await createPreviewExposure(port, options), options.json);
+    });
+    program
+        .command("expose-worker")
+        .argument("<worker>", "Running Pibo compute worker name or id")
+        .requiredOption("--session <pibo-session-id>", "Pibo Session that owns the preview")
+        .option("--name <label>", "Preview label")
+        .option("--workspace <path>", "Workspace recorded for diagnostics")
+        .option("--ttl-minutes <minutes>", "Automatic preview-definition lifetime", parsePreviewTtlMinutes, DEFAULT_PREVIEW_TTL_MINUTES)
+        .option("--json", "Print JSON")
+        .action(async (workerSelector, options) => {
+        const worker = await resolvePreviewComputeWorkerTarget(workerSelector);
+        const result = await createPreviewExposure(worker.webPort, options, {
+            label: worker.name,
+            workspace: worker.worktreePath,
+            proxyMode: "pibo-compute-dev-auth",
+        });
+        printCreatedPreview(result, options.json);
     });
     program
         .command("list")
@@ -258,9 +319,12 @@ export async function runPreviewCli(argv = process.argv) {
     program
         .command("doctor")
         .argument("[preview-id]")
+        .option("--public", "Verify public DNS, trusted TLS, and Preview-host routing")
         .option("--json", "Print JSON")
         .action(async (id, options) => {
         const baseURL = requirePreviewBaseURL();
+        if (options.public && !id)
+            throw new Error("--public requires a preview id. Create an active Preview, then run `pibo preview doctor <preview-id> --public`.");
         if (!id) {
             const config = loadPreviewConfig();
             const serverLimits = loadEffectivePreviewServerSettings();
@@ -277,6 +341,7 @@ export async function runPreviewCli(argv = process.argv) {
             const result = {
                 configured: true,
                 baseURL: baseURL.toString(),
+                productionSetup: createPreviewProductionSetupPlan({ baseURL: baseURL.toString() }),
                 limits: {
                     ...serverLimits,
                     maxProxyConnections: config.maxProxyConnections ?? DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS,
@@ -292,6 +357,8 @@ export async function runPreviewCli(argv = process.argv) {
                 console.log(`baseURL\t${result.baseURL}`);
                 console.log(`active\t${diagnostics.activeExposures}`);
                 console.log(`managed\t${diagnostics.managedStartingOrRunning}`);
+                console.log(`DNS required\t${result.productionSetup.dnsRecord.name}`);
+                console.log(`production guide\tpibo preview setup --base-url ${baseURL.origin}`);
             }
             return;
         }
@@ -304,15 +371,23 @@ export async function runPreviewCli(argv = process.argv) {
         finally {
             store.close();
         }
-        const result = await exposureView(exposure);
+        const publicChecks = options.public ? await inspectPreviewPublicRoute(baseURL, id) : undefined;
+        const result = {
+            ...await exposureView(exposure),
+            ...(publicChecks ? { publicChecks } : {}),
+        };
         if (options.json)
             printJson(result);
         else {
             console.log(`${result.id}\t${result.health}`);
             console.log(`target\t${result.targetHost}:${result.targetPort}`);
             console.log(`url\t${result.publicUrl}`);
+            if (publicChecks) {
+                console.log(`DNS\t${publicChecks.dns.status}\t${publicChecks.dns.detail}`);
+                console.log(`TLS and routing\t${publicChecks.tlsAndRouting.status}\t${publicChecks.tlsAndRouting.detail}`);
+            }
         }
-        if (result.health !== "online")
+        if (result.health !== "online" || publicChecks && (publicChecks.dns.status !== "ok" || publicChecks.tlsAndRouting.status !== "ok"))
             process.exitCode = 1;
     });
     const removeAction = async (id, options) => {

package/dist/previews/compute-worker.js ADDED Viewed

@@ -0,0 +1,37 @@
+import { listWorkers } from "../compute/docker.js";
+import { validatePreviewPort } from "./network.js";
+export function selectPreviewComputeWorkerTarget(workers, selector) {
+    const normalized = selector.trim();
+    if (!normalized)
+        throw new Error("Compute worker name or id is required");
+    const worker = workers.find((candidate) => candidate.name === normalized || candidate.id === normalized);
+    if (!worker)
+        throw new Error(`Pibo compute worker "${normalized}" was not found`);
+    if (worker.role !== "worker" && worker.role !== "dev")
+        throw new Error(`Pibo compute target "${worker.name}" is not a managed worker`);
+    if (worker.state !== "running")
+        throw new Error(`Pibo compute worker "${worker.name}" is not running`);
+    const webPort = Number(worker.portMap.web);
+    if (!Number.isInteger(webPort))
+        throw new Error(`Pibo compute worker "${worker.name}" does not publish a labeled Web port`);
+    const bindings = worker.portMap["4788/tcp"]?.split(",") ?? [];
+    if (!bindings.includes(`127.0.0.1:${webPort}`)) {
+        throw new Error(`Pibo compute worker "${worker.name}" Web port is not published on host loopback`);
+    }
+    return {
+        id: worker.id,
+        name: worker.name,
+        webPort: validatePreviewPort(webPort),
+        worktreePath: worker.worktreePath,
+    };
+}
+export async function resolvePreviewComputeWorkerTarget(selector) {
+    let workers;
+    try {
+        workers = await listWorkers({ all: true });
+    }
+    catch (error) {
+        throw new Error(`Unable to inspect Pibo compute workers: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return selectPreviewComputeWorkerTarget(workers, selector);
+}

package/dist/previews/config.js CHANGED Viewed

@@ -5,6 +5,7 @@ import { parsePreviewBaseURL } from "./base-url.js";
 export const DEFAULT_PREVIEW_TTL_MINUTES = 8 * 60;
 export const DEFAULT_PREVIEW_TICKET_TTL_SECONDS = 60;
 export const DEFAULT_PREVIEW_SESSION_TTL_MINUTES = 8 * 60;
+export const PREVIEW_TLS_AUTHORIZATION_PATH = "/api/previews/tls-authorize";
 export function loadPreviewConfig() {
     return loadPiboConfig().preview ?? {};
 }
@@ -18,7 +19,7 @@ export function loadEffectivePreviewServerSettings() {
 }
 export function requirePreviewBaseURL(value = loadPreviewConfig().baseURL) {
     if (!value)
-        throw new Error("preview.baseURL is required. Set it with `pibo config set preview.baseURL https://preview.example.com`.");
+        throw new Error("preview.baseURL is required. Run `pibo preview setup --base-url https://preview.example.com` for DNS, TLS, proxy, and restart instructions.");
     return parsePreviewBaseURL(value);
 }
 export function previewPublicURL(previewId, baseURL = requirePreviewBaseURL()) {

package/dist/previews/migrations/session-ownership.js ADDED Viewed

@@ -0,0 +1,7 @@
+/** One-time v4 upgrade: session identity already owns every exposure and authorization. */
+export function migratePreviewSessionOwnership(db) {
+    const columns = db.prepare("PRAGMA table_info(preview_exposures)").all();
+    if (columns.some((column) => column.name === "project_id")) {
+        db.exec("ALTER TABLE preview_exposures DROP COLUMN project_id");
+    }
+}

package/dist/previews/proxy.js CHANGED Viewed

@@ -154,8 +154,10 @@ function requestHeaders(incoming, exposure, requestURL, websocket) {
     }
     const targetHost = exposure.targetHost === "::1" ? `[::1]` : exposure.targetHost;
     headers.host = `${targetHost}:${exposure.targetPort}`;
-    headers["x-forwarded-host"] = requestURL.host;
-    headers["x-forwarded-proto"] = requestURL.protocol.slice(0, -1);
+    if (exposure.proxyMode !== "pibo-compute-dev-auth") {
+        headers["x-forwarded-host"] = requestURL.host;
+        headers["x-forwarded-proto"] = requestURL.protocol.slice(0, -1);
+    }
     if (websocket) {
         headers.connection = "Upgrade";
         headers.upgrade = incoming.upgrade ?? "websocket";