@pasko70/pibo 3.2.7 → 3.4.0

package/dist/previews/public-setup.js

@@ -0,0 +1,108 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { PREVIEW_TLS_AUTHORIZATION_PATH, previewPublicURL, requirePreviewBaseURL } from "./config.js";
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function validateGatewayPort(port) {
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        throw new Error("Gateway port must be an integer between 1 and 65535");
+    return port;
+}
+function validatePublicIp(value) {
+    if (!value)
+        return { type: "A or AAAA", value: "<public-gateway-ip>" };
+    const family = isIP(value);
+    if (family === 0)
+        throw new Error("Public IP must be a valid IPv4 or IPv6 address");
+    return { type: family === 4 ? "A" : "AAAA", value };
+}
+export function createPreviewProductionSetupPlan(input) {
+    const baseURL = requirePreviewBaseURL(input.baseURL);
+    const gatewayPort = validateGatewayPort(input.gatewayPort ?? 4788);
+    const publicIp = validatePublicIp(input.publicIp);
+    const wildcardHostname = `*.${baseURL.hostname}`;
+    const caddySiteAddress = baseURL.port ? `${wildcardHostname}:${baseURL.port}` : wildcardHostname;
+    const tlsAuthorizationURL = `http://127.0.0.1:${gatewayPort}${PREVIEW_TLS_AUTHORIZATION_PATH}`;
+    return {
+        baseURL: baseURL.toString(),
+        wildcardHostname,
+        dnsRecord: {
+            type: publicIp.type,
+            name: wildcardHostname,
+            value: publicIp.value,
+        },
+        gateway: {
+            host: "127.0.0.1",
+            port: gatewayPort,
+            tlsAuthorizationURL,
+        },
+        caddy: {
+            globalOptions: `on_demand_tls {\n\task ${tlsAuthorizationURL}\n}`,
+            siteBlock: `${caddySiteAddress} {\n\ttls {\n\t\ton_demand\n\t}\n\treverse_proxy 127.0.0.1:${gatewayPort}\n}`,
+        },
+        commands: {
+            configure: `pibo config set preview.baseURL ${shellQuote(baseURL.origin)}`,
+            restartGateway: "pibo gateway web restart",
+            validateCaddy: "caddy validate --config /etc/caddy/Caddyfile && systemctl reload caddy",
+            verify: "pibo preview doctor <preview-id> --public",
+        },
+        warnings: [
+            "Merge the on_demand_tls stanza into an existing Caddy global options block; a Caddyfile may contain only one global options block.",
+            "Create the wildcard DNS record before Caddy requests the first Preview certificate.",
+            "Restart the Pibo gateway after setting preview.baseURL; the safe restart may wait for active sessions.",
+        ],
+    };
+}
+async function resolveHostname(hostname) {
+    return (await lookup(hostname, { all: true })).map((entry) => entry.address);
+}
+async function requestPreview(url) {
+    const response = await fetch(url, {
+        method: "GET",
+        redirect: "manual",
+        signal: AbortSignal.timeout(10_000),
+    });
+    return { status: response.status, location: response.headers.get("location") ?? undefined };
+}
+function errorDetail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+export async function inspectPreviewPublicRoute(baseURLValue, previewId, options = {}) {
+    const baseURL = requirePreviewBaseURL(baseURLValue instanceof URL ? baseURLValue.toString() : baseURLValue);
+    const publicURL = previewPublicURL(previewId, baseURL);
+    let addresses = [];
+    let dns;
+    try {
+        addresses = await (options.resolveHostname ?? resolveHostname)(publicURL.hostname);
+        dns = addresses.length > 0
+            ? { status: "ok", detail: `Resolved ${publicURL.hostname}`, addresses }
+            : { status: "fail", detail: `${publicURL.hostname} returned no addresses`, addresses };
+    }
+    catch (error) {
+        dns = { status: "fail", detail: `DNS lookup failed: ${errorDetail(error)}`, addresses };
+    }
+    let tlsAndRouting;
+    try {
+        const response = await (options.request ?? requestPreview)(publicURL);
+        if (response.status === 401) {
+            tlsAndRouting = {
+                status: "ok",
+                detail: "HTTPS reached the Preview gateway and anonymous access was rejected",
+                httpStatus: response.status,
+            };
+        }
+        else {
+            tlsAndRouting = {
+                status: "fail",
+                detail: `Expected HTTP 401 from the Preview gateway, received HTTP ${response.status}`,
+                httpStatus: response.status,
+                ...(response.location ? { location: response.location } : {}),
+            };
+        }
+    }
+    catch (error) {
+        tlsAndRouting = { status: "fail", detail: `HTTPS request failed: ${errorDetail(error)}` };
+    }
+    return { publicURL: publicURL.toString(), dns, tlsAndRouting };
+}

package/dist/previews/store.js

@@ -5,7 +5,8 @@ import { DatabaseSync } from "node:sqlite";
 import { ensurePrivatePiboHomeForPath, piboHomePath } from "../core/pibo-home.js";
 import { protectPrivateFileSync } from "../core/private-path.js";
 import { loadPreviewConfig } from "./config.js";
-export const PREVIEW_SCHEMA_VERSION = 4;
+import { migratePreviewSessionOwnership } from "./migrations/session-ownership.js";
+export const PREVIEW_SCHEMA_VERSION = 6;
 export const MAX_ACTIVE_PREVIEW_EXPOSURES = 256;
 export const MAX_ACTIVE_PREVIEW_EXPOSURES_PER_SESSION = 16;
 export const MAX_OUTSTANDING_PREVIEW_TICKETS = 32;
@@ -52,8 +53,6 @@ function validateExposureInput(input) {
         throw new Error("Pibo Session id is invalid");
     if (!input.label.trim() || input.label.length > 120)
         throw new Error("Preview label must contain 1 to 120 characters");
-    if (input.projectId && input.projectId.length > 256)
-        throw new Error("Preview Project id is too long");
     if (!input.workspace || input.workspace.length > 4_096)
         throw new Error("Preview workspace is invalid");
     if (!Number.isInteger(input.targetPort) || input.targetPort < 1024 || input.targetPort > 65535) {
@@ -66,13 +65,15 @@ function validateExposureInput(input) {
     if ((input.managementMode ?? "external") === "managed" && !input.startCommand) {
         throw new Error("Managed Preview definitions require a start command");
     }
+    if (input.proxyMode !== undefined && input.proxyMode !== "standard" && input.proxyMode !== "pibo-compute-dev-auth") {
+        throw new Error("Preview proxy mode is invalid");
+    }
 }
 function exposureFromRow(row) {
     const managementMode = row.management_mode === "managed" ? "managed" : "external";
     return {
         id: row.id,
         piboSessionId: row.pibo_session_id,
-        projectId: row.project_id ?? undefined,
         label: row.label,
         targetHost: row.target_host,
         targetPort: row.target_port,
@@ -80,6 +81,7 @@ function exposureFromRow(row) {
         targetProcessStartTicks: row.target_process_start_ticks ?? undefined,
         workspace: row.workspace,
         managementMode,
+        proxyMode: row.proxy_mode === "pibo-compute-dev-auth" ? "pibo-compute-dev-auth" : "standard",
         startCommand: row.start_command ?? undefined,
         serverState: managementMode === "managed" && row.server_state !== "external" ? row.server_state : undefined,
         serverGeneration: row.server_generation ?? undefined,
@@ -107,6 +109,7 @@ function sameAuthorizationExposure(first, second) {
     return first.id === second.id &&
         first.createdAt === second.createdAt &&
         first.managementMode === second.managementMode &&
+        first.proxyMode === second.proxyMode &&
         first.serverGeneration === second.serverGeneration &&
         first.targetHost === second.targetHost &&
         first.targetPort === second.targetPort &&
@@ -165,7 +168,6 @@ export class PreviewStore {
 			CREATE TABLE IF NOT EXISTS preview_exposures (
 				id TEXT PRIMARY KEY,
 				pibo_session_id TEXT NOT NULL,
-				project_id TEXT,
 				label TEXT NOT NULL,
 				target_host TEXT NOT NULL CHECK (target_host IN ('127.0.0.1', '::1')),
 				target_port INTEGER NOT NULL CHECK (target_port BETWEEN 1024 AND 65535),
@@ -173,6 +175,7 @@ export class PreviewStore {
 				target_process_start_ticks TEXT,
 				workspace TEXT NOT NULL,
 				management_mode TEXT NOT NULL DEFAULT 'external' CHECK (management_mode IN ('external', 'managed')),
+				proxy_mode TEXT NOT NULL DEFAULT 'standard' CHECK (proxy_mode IN ('standard', 'pibo-compute-dev-auth')),
 				start_command TEXT,
 				server_state TEXT NOT NULL DEFAULT 'external' CHECK (server_state IN ('external', 'stopped', 'starting', 'running', 'stopping', 'error')),
 				server_generation TEXT,
@@ -217,6 +220,7 @@ export class PreviewStore {
                 ["target_process_id", "INTEGER"],
                 ["target_process_start_ticks", "TEXT"],
                 ["management_mode", "TEXT NOT NULL DEFAULT 'external'"],
+                ["proxy_mode", "TEXT NOT NULL DEFAULT 'standard' CHECK (proxy_mode IN ('standard', 'pibo-compute-dev-auth'))"],
                 ["start_command", "TEXT"],
                 ["server_state", "TEXT NOT NULL DEFAULT 'external'"],
                 ["server_generation", "TEXT"],
@@ -244,7 +248,6 @@ export class PreviewStore {
 					CREATE TABLE preview_exposures (
 						id TEXT PRIMARY KEY,
 						pibo_session_id TEXT NOT NULL,
-						project_id TEXT,
 						label TEXT NOT NULL,
 						target_host TEXT NOT NULL CHECK (target_host IN ('127.0.0.1', '::1')),
 						target_port INTEGER NOT NULL CHECK (target_port BETWEEN 1024 AND 65535),
@@ -252,6 +255,7 @@ export class PreviewStore {
 						target_process_start_ticks TEXT,
 						workspace TEXT NOT NULL,
 						management_mode TEXT NOT NULL DEFAULT 'external' CHECK (management_mode IN ('external', 'managed')),
+						proxy_mode TEXT NOT NULL DEFAULT 'standard' CHECK (proxy_mode IN ('standard', 'pibo-compute-dev-auth')),
 						start_command TEXT,
 						server_state TEXT NOT NULL DEFAULT 'external' CHECK (server_state IN ('external', 'stopped', 'starting', 'running', 'stopping', 'error')),
 						server_generation TEXT,
@@ -268,17 +272,17 @@ export class PreviewStore {
 						closed_at TEXT
 					);
 					INSERT INTO preview_exposures (
-						id, pibo_session_id, project_id, label, target_host, target_port,
+						id, pibo_session_id, label, target_host, target_port,
 						target_process_id, target_process_start_ticks, workspace,
-						management_mode, start_command, server_state, server_generation,
+						management_mode, proxy_mode, start_command, server_state, server_generation,
 						server_started_at, server_stop_at, server_stopped_at, server_error,
 						manager_kind, manager_id, manager_pid, manager_process_start_ticks,
 						created_at, expires_at, closed_at
 					)
 					SELECT
-						id, pibo_session_id, project_id, label, target_host, target_port,
+						id, pibo_session_id, label, target_host, target_port,
 						target_process_id, target_process_start_ticks, workspace,
-						management_mode, start_command, server_state, server_generation,
+						management_mode, proxy_mode, start_command, server_state, server_generation,
 						server_started_at, server_stop_at, server_stopped_at, server_error,
 						manager_kind, manager_id, manager_pid, manager_process_start_ticks,
 						created_at, expires_at, closed_at
@@ -292,6 +296,8 @@ export class PreviewStore {
 			CREATE INDEX IF NOT EXISTS preview_exposures_managed_state_idx
 				ON preview_exposures (management_mode, server_state, expires_at)
 		`);
+            if (currentVersion < 5)
+                migratePreviewSessionOwnership(this.db);
             this.db.exec(`PRAGMA user_version = ${PREVIEW_SCHEMA_VERSION}`);
             this.db.exec("COMMIT");
         }
@@ -314,6 +320,7 @@ export class PreviewStore {
     createExposure(input) {
         validateExposureInput(input);
         const managementMode = input.managementMode ?? "external";
+        const proxyMode = input.proxyMode ?? "standard";
         const serverState = managementMode === "managed" ? input.serverState ?? "stopped" : "external";
         this.db.exec("BEGIN IMMEDIATE");
         try {
@@ -327,12 +334,12 @@ export class PreviewStore {
             }
             this.db.prepare(`
 			INSERT INTO preview_exposures (
-				id, pibo_session_id, project_id, label, target_host, target_port,
+				id, pibo_session_id, label, target_host, target_port,
 				target_process_id, target_process_start_ticks, workspace,
-				management_mode, start_command, server_state,
+				management_mode, proxy_mode, start_command, server_state,
 				created_at, expires_at, closed_at
 			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
-			`).run(input.id, input.piboSessionId, input.projectId ?? null, input.label, input.targetHost, input.targetPort, input.targetProcessId ?? null, input.targetProcessStartTicks ?? null, input.workspace, managementMode, input.startCommand ?? null, serverState, input.createdAt, input.expiresAt);
+			`).run(input.id, input.piboSessionId, input.label, input.targetHost, input.targetPort, input.targetProcessId ?? null, input.targetProcessStartTicks ?? null, input.workspace, managementMode, proxyMode, input.startCommand ?? null, serverState, input.createdAt, input.expiresAt);
             const exposure = this.requireExposure(input.id);
             this.db.exec("COMMIT");
             return exposure;

package/dist/previews/web-app.js

@@ -1,6 +1,6 @@
 import { loadPiboConfig } from "../config/config.js";
 import { PiboWebHttpError, responseHtml, responseJson } from "../web/http.js";
-import { DEFAULT_PREVIEW_SESSION_TTL_MINUTES, DEFAULT_PREVIEW_TICKET_TTL_SECONDS, previewIdFromHostname, previewPublicURL, requirePreviewBaseURL, } from "./config.js";
+import { DEFAULT_PREVIEW_SESSION_TTL_MINUTES, DEFAULT_PREVIEW_TICKET_TTL_SECONDS, PREVIEW_TLS_AUTHORIZATION_PATH, previewIdFromHostname, previewPublicURL, requirePreviewBaseURL, } from "./config.js";
 import { createDefaultPreviewProcessController, reconcileManagedPreviews, startManagedPreview, stopManagedPreview, } from "./manager.js";
 import { isPreviewTargetProcessCurrent, probePreviewTarget } from "./network.js";
 import { cookieValue, DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS, DEFAULT_MAX_PREVIEW_PROXY_CONNECTIONS_PER_PREVIEW, PreviewProxyLimiter, previewSessionCookieName, proxyPreviewHttp, proxyPreviewWebSocket, } from "./proxy.js";
@@ -59,7 +59,7 @@ async function exposureHealth(exposure) {
     return online ? "online" : "offline";
 }
 async function publicExposure(exposure, baseURL) {
-    const { workspace: _workspace, startCommand: _startCommand, targetHost: _targetHost, targetPort: _targetPort, managementMode: _managementMode, targetProcessId: _targetProcessId, targetProcessStartTicks: _targetProcessStartTicks, serverError: _serverError, serverGeneration: _serverGeneration, managerKind: _managerKind, managerId: _managerId, managerPid: _managerPid, managerProcessStartTicks: _managerProcessStartTicks, ...publicFields } = exposure;
+    const { workspace: _workspace, startCommand: _startCommand, targetHost: _targetHost, targetPort: _targetPort, managementMode: _managementMode, proxyMode: _proxyMode, targetProcessId: _targetProcessId, targetProcessStartTicks: _targetProcessStartTicks, serverError: _serverError, serverGeneration: _serverGeneration, managerKind: _managerKind, managerId: _managerId, managerPid: _managerPid, managerProcessStartTicks: _managerProcessStartTicks, ...publicFields } = exposure;
     return {
         ...publicFields,
         managed: exposure.managementMode === "managed",
@@ -250,6 +250,16 @@ export function createPreviewWebApp(options = {}) {
             const url = new URL(request.url);
             if (!url.pathname.startsWith(PREVIEW_WEB_API_PREFIX))
                 return undefined;
+            if (url.pathname === PREVIEW_TLS_AUTHORIZATION_PATH) {
+                if (request.method !== "GET")
+                    return new Response(null, { status: 405, headers: { allow: "GET", "cache-control": "no-store" } });
+                const previewId = baseURL ? previewIdFromHostname(url.searchParams.get("domain") ?? "", baseURL) : undefined;
+                const allowed = previewId ? withStore(databasePath, (store) => {
+                    const exposure = store.getExposure(previewId);
+                    return Boolean(exposure && previewExposureState(exposure) === "active");
+                }) : false;
+                return new Response(null, { status: allowed ? 200 : 403, headers: { "cache-control": "no-store" } });
+            }
             await context.requireSession({ request });
             if (url.pathname === PREVIEW_WEB_API_PREFIX && request.method === "GET") {
                 const piboSessionId = url.searchParams.get("piboSessionId")?.trim();

package/dist/providers/openai-gpt56.js

@@ -9,6 +9,8 @@ export const OPENAI_CODEX_BASE_URL = "https://chatgpt.com/backend-api";
 const OPENAI_GPT_56_CONTEXT_WINDOW = 1_050_000;
 const OPENAI_CODEX_GPT_56_CONTEXT_WINDOW = 272_000;
 const GPT_56_MAX_TOKENS = 128_000;
+const OPENAI_CODEX_GPT_6_ASTRA_CONTEXT_WINDOW = 272_000;
+const GPT_6_ASTRA_MAX_TOKENS = 128_000;
 export const OPENAI_GPT_56_MODELS = [
     {
         id: "gpt-5.6",
@@ -31,6 +33,11 @@ export const OPENAI_GPT_56_MODELS = [
         cost: { input: 1, output: 6, cacheRead: 0.1, cacheWrite: 1.25 },
     },
 ];
+export const OPENAI_CODEX_GPT_6_ASTRA_MODEL = {
+    id: "gpt-6-astra",
+    name: "GPT-6-Astra",
+    cost: { input: 10, output: 50, cacheRead: 1, cacheWrite: 12.5 },
+};
 const OPENAI_GPT_56_MODEL_IDS = new Set(OPENAI_GPT_56_MODELS.map((model) => model.id));
 export function getBuiltInOpenAiModels() {
     return getBuiltInProviderModels(OPENAI_PROVIDER_ID);
@@ -60,7 +67,13 @@ export function buildOpenAiCodexGpt56Models(baseModels = getBuiltInOpenAiCodexMo
         modelCost: (model) => ({ ...model.cost, cacheWrite: 0 }),
     });
 }
-export function registerOpenAiGpt56Models(modelRegistry, options = {}) {
+export function buildOpenAiCodexSupplementalModels(baseModels = getBuiltInOpenAiCodexModels()) {
+    const models = buildOpenAiCodexGpt56Models(baseModels);
+    if (models.some((model) => model.id === OPENAI_CODEX_GPT_6_ASTRA_MODEL.id))
+        return models;
+    return [...models, openAiCodexAstraModelToRegistryModel()];
+}
+export function registerOpenAiSupplementalModels(modelRegistry, options = {}) {
     const baseOpenAiModels = options.baseOpenAiModels ?? getBuiltInOpenAiModels();
     const openAiModels = buildOpenAiGpt56Models(baseOpenAiModels);
     const openAiAdded = countMissingGpt56Models(baseOpenAiModels, OPENAI_PROVIDER_ID);
@@ -71,8 +84,10 @@ export function registerOpenAiGpt56Models(modelRegistry, options = {}) {
         models: openAiModels,
     });
     const baseOpenAiCodexModels = options.baseOpenAiCodexModels ?? getBuiltInOpenAiCodexModels();
-    const openAiCodexModels = buildOpenAiCodexGpt56Models(baseOpenAiCodexModels);
-    const openAiCodexAdded = countMissingGpt56Models(baseOpenAiCodexModels, OPENAI_CODEX_PROVIDER_ID);
+    const openAiCodexModels = buildOpenAiCodexSupplementalModels(baseOpenAiCodexModels);
+    const hasBuiltInAstra = baseOpenAiCodexModels.some((model) => model.provider === OPENAI_CODEX_PROVIDER_ID && model.id === OPENAI_CODEX_GPT_6_ASTRA_MODEL.id);
+    const openAiCodexAdded = countMissingGpt56Models(baseOpenAiCodexModels, OPENAI_CODEX_PROVIDER_ID)
+        + (hasBuiltInAstra ? 0 : 1);
     modelRegistry.registerProvider(OPENAI_CODEX_PROVIDER_ID, {
         baseUrl: OPENAI_CODEX_BASE_URL,
         api: OPENAI_CODEX_RESPONSES_API,
@@ -85,6 +100,7 @@ export function registerOpenAiGpt56Models(modelRegistry, options = {}) {
         added: openAiAdded + openAiCodexAdded,
     };
 }
+export const registerOpenAiGpt56Models = registerOpenAiSupplementalModels;
 export function findOpenAiGpt56Model(modelRegistry, model) {
     if (!model?.provider || !model.id)
         return undefined;
@@ -140,3 +156,25 @@ function openAiGpt56ModelToRegistryModel(model, options) {
         maxTokens: GPT_56_MAX_TOKENS,
     };
 }
+function openAiCodexAstraModelToRegistryModel() {
+    return {
+        id: OPENAI_CODEX_GPT_6_ASTRA_MODEL.id,
+        name: OPENAI_CODEX_GPT_6_ASTRA_MODEL.name,
+        api: OPENAI_CODEX_RESPONSES_API,
+        provider: OPENAI_CODEX_PROVIDER_ID,
+        baseUrl: OPENAI_CODEX_BASE_URL,
+        reasoning: true,
+        // Codex also advertises "ultra", but Pibo's portable thinking-level contract ends at "max".
+        thinkingLevelMap: { off: null, minimal: null, xhigh: "xhigh", max: "max" },
+        input: ["text", "image"],
+        compat: {
+            supportsOpenAIGrammarTools: true,
+            supportsAdditionalTools: true,
+            supportsToolSearch: true,
+        },
+        cost: { ...OPENAI_CODEX_GPT_6_ASTRA_MODEL.cost, cacheWrite: 0 },
+        // Codex uses 272k by default and advertises 872k only as an optional maximum override.
+        contextWindow: OPENAI_CODEX_GPT_6_ASTRA_CONTEXT_WINDOW,
+        maxTokens: GPT_6_ASTRA_MAX_TOKENS,
+    };
+}

package/dist/sessions/workflow-session-kind.js

@@ -7,9 +7,6 @@ export function workflowSessionKindFromMetadata(metadata) {
     const value = metadata?.[PIBO_WORKFLOW_SESSION_KIND_METADATA_KEY];
     if (isPiboWorkflowSessionKind(value))
         return value;
-    // Backfill the initial Project workflow metadata shape used before the stable enum.
-    if (metadata?.projectSessionKind === "main")
-        return "main_workflow";
     return undefined;
 }
 export function withWorkflowSessionKind(metadata, workflowSessionKind) {

package/dist/subagents/context.js

@@ -33,14 +33,14 @@ export function getDelegatedAgentContextFile(subagents) {
             "",
             "pibo_run_wait({ runId, timeoutMs? })       # bounded wait only; expiry does not stop the child",
             "pibo_run_status({ runId })                 # compact lifecycle state",
-            "pibo_agents_observe({ requestIds?: [runId], afterSequence?, limit?, includeTools?, toolDetail?, ... })",
+            "pibo_agents_observe({ requestIds?: [runId], textContains?, textRegex?, afterSequence?, limit?, includeTools?, toolDetail?, ... })",
             "pibo_run_read({ runId })                   # terminal result, including the complete final agent message",
             "pibo_run_cancel({ runId })                 # explicit request cancellation",
             "pibo_agents_list_agents({})                # available definitions and persistent child instances",
             "pibo_agents_kill({ agentId })              # terminate one persistent child session subtree",
             "```",
             "",
-            "Set `sessionName` on every send to a nonblank human-readable child title of at most 40 Unicode code points. Pibo trims surrounding whitespace and rejects missing, blank, non-string, or oversized names before creating a yielded run or child session. Reuse a stable `threadKey` to continue the same child Pibo Session; a new `sessionName` updates its title without changing identity. A wait timeout is only an orchestrator wake-up. Observe defaults to the newest 20 completed assistant messages with streaming deltas, duplicate tool progress events, and tools hidden. Set `includeTools: true` for compact tool call/result summaries, `toolDetail: \"full\"` only for bounded diagnostics, and `limit: 50` when a larger page is necessary. Use `afterSequence` from the prior result for polling.",
+            "Set `sessionName` on every send to a nonblank human-readable child title of at most 40 Unicode code points. Pibo trims surrounding whitespace and rejects missing, blank, non-string, or oversized names before creating a yielded run or child session. Reuse a stable `threadKey` to continue the same child Pibo Session; a new `sessionName` updates its title without changing identity. A wait timeout is only an orchestrator wake-up. Observe defaults to the newest 20 completed assistant messages with streaming deltas, duplicate tool progress events, and tools hidden. Use `textContains` for case-insensitive substring matching or `textRegex` for case-sensitive rg/Rust-regex matching; both must match when supplied together. Set `includeTools: true` for compact tool call/result summaries, `toolDetail: \"full\"` only for bounded diagnostics, and `limit: 50` when a larger page is necessary. Use `afterSequence` from the prior result for polling.",
             "",
             "Observe progress and decide whether to continue waiting, steer through a new message after the current turn, cancel the request, or kill the child session.",
             "",

package/dist/subagents/observation-query.js

@@ -1,4 +1,5 @@
 import { PIBO_AGENT_OBSERVATION_DEFAULT_EVENT_TYPES, PIBO_AGENT_OBSERVATION_DEFAULT_TOOL_EVENT_TYPES, normalizePiboAgentObservationCursor, normalizePiboAgentObservationLimit, normalizePiboAgentObservationOrder, normalizePiboAgentObservationToolDetail, parsePiboAgentObservationTimestamp, piboAgentObservationKind, piboAgentObservationToolSummary, } from "./observations.js";
+import { PIBO_AGENT_TEXT_REGEX_BATCH_MAX_ITEMS, PIBO_AGENT_TEXT_REGEX_BATCH_TARGET_BYTES, matchPiboAgentObservationTextRegex, preparePiboAgentObservationTextRegex, } from "./observation-text-regex.js";
 export function preparePiboAgentObservationQuery(input = {}) {
     const order = normalizePiboAgentObservationOrder(input.order);
     const limit = normalizePiboAgentObservationLimit(input.limit);
@@ -21,6 +22,7 @@ export function preparePiboAgentObservationQuery(input = {}) {
     const kinds = input.kinds ? new Set(input.kinds) : undefined;
     const roles = input.roles ? new Set(input.roles) : undefined;
     const textContains = input.textContains?.toLowerCase();
+    const textRegex = preparePiboAgentObservationTextRegex(input.textRegex);
     const defaultMessageView = eventTypes === undefined && kinds === undefined;
     const explicitlySelectsTools = input.eventTypes?.some((eventType) => piboAgentObservationKind(eventType) === "tool") === true
         || input.kinds?.includes("tool") === true
@@ -53,6 +55,7 @@ export function preparePiboAgentObservationQuery(input = {}) {
         includeTools,
         toolDetail,
         ...(scanEventTypes ? { scanEventTypes } : {}),
+        ...(textRegex ? { textRegex } : {}),
         matches(observation) {
             if (requestIds && (!observation.requestId || !requestIds.has(observation.requestId)))
                 return false;
@@ -89,12 +92,52 @@ export function preparePiboAgentObservationQuery(input = {}) {
 }
 export function selectPiboAgentObservationPage(observations, query, options = {}) {
     const matches = [];
-    for (const observation of observations) {
-        if (!query.matches(observation))
-            continue;
-        matches.push(observation);
-        if (matches.length > query.limit)
-            break;
+    if (query.textRegex) {
+        let candidates = [];
+        let candidateBytes = 0;
+        const matchCandidates = () => {
+            const regexMatches = matchPiboAgentObservationTextRegex(query.textRegex, candidates.map((observation) => observation.text ?? ""));
+            for (let index = 0; index < candidates.length; index += 1) {
+                if (!regexMatches[index])
+                    continue;
+                matches.push(candidates[index]);
+                if (matches.length > query.limit) {
+                    candidates = [];
+                    candidateBytes = 0;
+                    return true;
+                }
+            }
+            candidates = [];
+            candidateBytes = 0;
+            return false;
+        };
+        for (const observation of observations) {
+            if (!query.matches(observation))
+                continue;
+            const textBytes = Buffer.byteLength(observation.text ?? "", "utf8");
+            if (candidates.length > 0
+                && candidateBytes + textBytes > PIBO_AGENT_TEXT_REGEX_BATCH_TARGET_BYTES
+                && matchCandidates())
+                break;
+            candidates.push(observation);
+            candidateBytes += textBytes;
+            if (candidates.length >= PIBO_AGENT_TEXT_REGEX_BATCH_MAX_ITEMS
+                || candidateBytes >= PIBO_AGENT_TEXT_REGEX_BATCH_TARGET_BYTES) {
+                if (matchCandidates())
+                    break;
+            }
+        }
+        if (matches.length <= query.limit && candidates.length > 0)
+            matchCandidates();
+    }
+    else {
+        for (const observation of observations) {
+            if (!query.matches(observation))
+                continue;
+            matches.push(observation);
+            if (matches.length > query.limit)
+                break;
+        }
     }
     const pageLimited = matches.length > query.limit;
     const selected = matches.slice(0, query.limit);

package/dist/subagents/observation-text-regex.js

@@ -0,0 +1,124 @@
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+export const PIBO_AGENT_TEXT_REGEX_BATCH_MAX_ITEMS = 128;
+export const PIBO_AGENT_TEXT_REGEX_BATCH_TARGET_BYTES = 64 * 1024;
+const PIBO_AGENT_TEXT_REGEX_MAX_OUTPUT_BYTES = 64 * 1024;
+const requireFromHere = createRequire(import.meta.url);
+function escapedNulIndex(pattern) {
+    for (let index = 0; index < pattern.length; index += 1) {
+        if (pattern[index] !== "\\")
+            continue;
+        let slashEnd = index;
+        while (pattern[slashEnd + 1] === "\\")
+            slashEnd += 1;
+        const slashCount = slashEnd - index + 1;
+        if (slashCount % 2 === 1) {
+            const remainder = pattern.slice(slashEnd + 1);
+            if (/^(?:x00|x\{0+\}|u\{0+\})/i.test(remainder))
+                return index;
+        }
+        index = slashEnd;
+    }
+    return undefined;
+}
+function assertSupportedNulPattern(pattern) {
+    if (pattern.includes("\0") || escapedNulIndex(pattern) !== undefined) {
+        throw new Error("Agent observation textRegex is invalid: matching NUL bytes is not supported.");
+    }
+}
+function resolvePiboAgentObservationRipgrepPath() {
+    const arch = process.env.npm_config_arch || process.arch;
+    const binaryName = process.platform === "win32" ? "rg.exe" : "rg";
+    const platformPackage = `@vscode/ripgrep-${process.platform}-${arch}`;
+    try {
+        const wrapperPath = requireFromHere.resolve("@vscode/ripgrep");
+        return createRequire(wrapperPath).resolve(`${platformPackage}/bin/${binaryName}`);
+    }
+    catch {
+        throw new Error(`Agent observation textRegex is unavailable: ${platformPackage} is not installed for this platform.`);
+    }
+}
+function ripgrepErrorReason(stderr) {
+    if (stderr.includes("pattern contains \"\\0\""))
+        return "matching NUL bytes is not supported";
+    const reasons = [...stderr.matchAll(/^error:\s*(.+)$/gm)];
+    return reasons.at(-1)?.[1]?.trim().replace(/\.$/, "");
+}
+function runRipgrepTextRegex(prepared, args, options = {}) {
+    return spawnSync(prepared.rgPath, [
+        "--no-config",
+        "--color=never",
+        "--null-data",
+        ...args,
+    ], {
+        ...options,
+        encoding: "utf8",
+        maxBuffer: PIBO_AGENT_TEXT_REGEX_MAX_OUTPUT_BYTES,
+    });
+}
+function throwRipgrepExecutionError(action, error) {
+    const errorCode = error && "code" in error ? error.code : undefined;
+    if (errorCode === "ENOENT" || errorCode === "EACCES") {
+        throw new Error("Agent observation textRegex is unavailable: bundled rg could not be executed.");
+    }
+    const detail = errorCode === "ENOBUFS"
+        ? "bundled rg output exceeded the bounded observation batch limit"
+        : "bundled rg could not run";
+    throw new Error(`Agent observation textRegex ${action} failed: ${detail}.`);
+}
+export function preparePiboAgentObservationTextRegex(pattern) {
+    if (pattern === undefined)
+        return undefined;
+    assertSupportedNulPattern(pattern);
+    const prepared = { pattern, rgPath: resolvePiboAgentObservationRipgrepPath() };
+    const result = runRipgrepTextRegex(prepared, ["--quiet", "--", pattern, "-"], { input: "" });
+    if (result.error)
+        throwRipgrepExecutionError("validation", result.error);
+    if (result.status === 0 || result.status === 1)
+        return prepared;
+    const reason = ripgrepErrorReason(result.stderr);
+    if (reason)
+        throw new Error(`Agent observation textRegex is invalid: ${reason}.`);
+    throwRipgrepExecutionError("validation");
+}
+export function matchPiboAgentObservationTextRegex(prepared, texts) {
+    for (const text of texts) {
+        if (text.includes("\0")) {
+            throw new Error("Agent observation textRegex cannot match observation text containing NUL bytes.");
+        }
+    }
+    if (texts.length === 0)
+        return [];
+    // One private file per observation preserves record boundaries. --files-with-matches
+    // emits each fixed filename at most once, so output cannot grow with submatch count.
+    const directory = mkdtempSync(join(tmpdir(), "pibo-agent-observe-regex-"));
+    const filenames = texts.map((_, index) => index.toString().padStart(6, "0"));
+    try {
+        for (let index = 0; index < texts.length; index += 1) {
+            writeFileSync(join(directory, filenames[index]), `${texts[index]}\0`, {
+                encoding: "utf8",
+                flag: "wx",
+                mode: 0o600,
+            });
+        }
+        const result = runRipgrepTextRegex(prepared, ["--files-with-matches", "--null", "--", prepared.pattern, ...filenames], { cwd: directory });
+        if (result.error)
+            throwRipgrepExecutionError("matching", result.error);
+        if (result.status === 1)
+            return texts.map(() => false);
+        if (result.status !== 0) {
+            const reason = ripgrepErrorReason(result.stderr);
+            if (reason)
+                throw new Error(`Agent observation textRegex is invalid: ${reason}.`);
+            throwRipgrepExecutionError("matching");
+        }
+        const matched = new Set(result.stdout.split("\0").filter(Boolean));
+        return filenames.map((filename) => matched.has(filename));
+    }
+    finally {
+        rmSync(directory, { recursive: true, force: true });
+    }
+}

package/dist/subagents/tool.js

@@ -187,11 +187,11 @@ export function createAgentToolDefinitions(subagents, controller) {
             name: "pibo_agents_observe",
             title: "Pibo Agents Observe",
             description: [
-                "Read completed delegated-agent messages with bounded cursor, identity, event, time, text, order, and limit filters.",
+                "Read completed delegated-agent messages with bounded cursor, identity, event, time, substring, regex, order, and limit filters.",
                 "Default: the newest 20 completed assistant messages, with streaming deltas and tools hidden.",
                 "Set includeTools=true to add compact tool calls and terminal results, or pass toolCallIds to retrieve only those exact tool observations. Set toolDetail=full only for bounded diagnostic inspection.",
             ].join("\n"),
-            promptSnippet: "Observe child-agent progress through completed assistant messages. Defaults: newest 20 messages, no streaming deltas, no duplicate tool progress events, no tools. Set includeTools=true for compact tool call/result summaries, pass up to 50 exact toolCallIds to retrieve only those tool observations, use toolDetail=full for bounded raw tool text, or eventTypes/kinds for explicit progress diagnostics. Compact tool entries expose their toolCallId for follow-up queries. Pass afterSequence from the previous result for cursor polling; cursor pages consume the oldest unseen matches even when order is desc.",
+            promptSnippet: "Observe child-agent progress through completed assistant messages. Defaults: newest 20 messages, no streaming deltas, no duplicate tool progress events, no tools. Use textContains for case-insensitive substring matching or textRegex for case-sensitive rg/Rust-regex matching; when both are present, both must match. Set includeTools=true for compact tool call/result summaries, pass up to 50 exact toolCallIds to retrieve only those tool observations, use toolDetail=full for bounded raw tool text, or eventTypes/kinds for explicit progress diagnostics. Compact tool entries expose their toolCallId for follow-up queries. Pass afterSequence from the previous result for cursor polling; cursor pages consume the oldest unseen matches even when order is desc.",
             executionMode: "parallel",
             annotations: { readOnly: true },
             inputSchema: Type.Object({
@@ -206,6 +206,7 @@ export function createAgentToolDefinitions(subagents, controller) {
                 since: Type.Optional(Type.String({ description: "Inclusive ISO-8601 lower timestamp bound" })),
                 until: Type.Optional(Type.String({ description: "Inclusive ISO-8601 upper timestamp bound" })),
                 textContains: Type.Optional(Type.String({ description: "Case-insensitive substring match against normalized observation text" })),
+                textRegex: Type.Optional(Type.String({ description: "Case-sensitive rg/Rust-regex match against normalized observation text. Use inline flags such as (?i) to change case behavior. Combines with textContains using AND semantics. NUL text and literal or escaped NUL patterns are rejected; regex use requires the optional rg platform binary." })),
                 afterSequence: Type.Optional(Type.Integer({ description: "Exclusive live observation cursor. Cursor pages consume the oldest unseen matches; desc reverses only the returned page.", minimum: 0 })),
                 order: Type.Optional(piboStringEnum(["asc", "desc"], { default: "desc", description: "Newest first by default when no cursor is supplied" })),
                 limit: Type.Optional(Type.Integer({ description: "Maximum completed messages or activity records to return. Use 50 explicitly when needed.", minimum: 1, maximum: 200, default: 20 })),