npm - @pi-chamber/web - Versions diffs - 0.1.8 → 0.2.0 - Mend

@pi-chamber/web 0.1.8 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (82) hide show

package/dist/mini-chat.html CHANGED Viewed

@@ -89,14 +89,14 @@
       }
     </style>
-    <script type="module" crossorigin src="/assets/miniChat-BFotDgpO.js"></script>
+    <script type="module" crossorigin src="/assets/miniChat-B7kKqKHH.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DYyjh7Q0.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-CnsBKjP5.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-CRB7i1S2.js">
+    <link rel="modulepreload" crossorigin href="/assets/index-DQr8-8RF.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-katex-CHD9BdDO.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-C_Mo87uS.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-DYrJXRkU.css">
     <link rel="stylesheet" crossorigin href="/assets/vendor-katex-Cp579UoJ.css">
   </head>
   <body class="h-full bg-background text-foreground">

package/dist/mobile.html CHANGED Viewed

@@ -63,14 +63,14 @@
       })();
     </script>
-    <script type="module" crossorigin src="/assets/mobile-3LLzhN5Q.js"></script>
+    <script type="module" crossorigin src="/assets/mobile-DZPRce5z.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/vendor-vite-runtime-DD1OZmLC.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-scheduler-7OC5HNn7.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-react-DYyjh7Q0.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-zustand-CnsBKjP5.js">
-    <link rel="modulepreload" crossorigin href="/assets/index-CRB7i1S2.js">
+    <link rel="modulepreload" crossorigin href="/assets/index-DQr8-8RF.js">
     <link rel="modulepreload" crossorigin href="/assets/vendor-katex-CHD9BdDO.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-C_Mo87uS.css">
+    <link rel="stylesheet" crossorigin href="/assets/index-DYrJXRkU.css">
     <link rel="stylesheet" crossorigin href="/assets/vendor-katex-Cp579UoJ.css">
   </head>
   <body class="h-full bg-background text-foreground">

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@pi-chamber/web",
-  "version": "0.1.8",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "repository": {

package/server/lib/package-manager.js CHANGED Viewed

@@ -17,6 +17,13 @@ const CHANGELOG_URL = 'https://raw.githubusercontent.com/RyderAsKing/PiChamber/m
 const GITHUB_RELEASES_URL = 'https://github.com/RyderAsKing/PiChamber/releases';
 const GITHUB_RELEASES_API_URL = 'https://api.github.com/repos/RyderAsKing/PiChamber/releases';
 let cachedDetectedPm = null;
+const TRUSTED_UPDATE_REASONS = new Set([
+  'forced-env',
+  'install-path-owner',
+  'global-root-owner',
+  'cached',
+]);
+const UPDATE_PACKAGE_MANAGERS = new Set(['npm', 'pnpm', 'yarn', 'bun']);
 function getSpawnSyncBaseOptions() {
   return process.platform === 'win32' ? { windowsHide: true } : {};
@@ -373,6 +380,21 @@ function packageManagerOwnsCurrentInstall(pm) {
   return false;
 }
+function detectionResult(packageManager, reason) {
+  return {
+    packageManager,
+    reason,
+    packagePath: getCurrentPackagePath(),
+    packageManagerCommand: resolvePackageManagerCommand(packageManager),
+    globalNodeModulesRoot: getGlobalNodeModulesRoots(packageManager)[0] || null,
+  };
+}
+function cacheTrustedDetection(packageManager, reason) {
+  cachedDetectedPm = packageManager;
+  return detectionResult(packageManager, reason);
+}
 export function detectPackageManagerDetails() {
   // In desktop (Electron) runtime, package-manager detection is worthless —
   // the app ships as a .app bundle, not installed via npm/pnpm/yarn/bun, and
@@ -401,44 +423,23 @@ export function detectPackageManagerDetails() {
   }
   const forcedPm = process.env.PICHAMBER_PACKAGE_MANAGER?.trim();
-  if (forcedPm && ['npm', 'pnpm', 'yarn', 'bun'].includes(forcedPm)) {
+  if (forcedPm && UPDATE_PACKAGE_MANAGERS.has(forcedPm)) {
     const forcedPmCommand = resolvePackageManagerCommand(forcedPm);
     if (isCommandAvailable(forcedPmCommand)) {
-      cachedDetectedPm = forcedPm;
-      return {
-        packageManager: cachedDetectedPm,
-        reason: 'forced-env',
-        packagePath: getCurrentPackagePath(),
-        packageManagerCommand: forcedPmCommand,
-        globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-      };
+      return cacheTrustedDetection(forcedPm, 'forced-env');
     }
   }
   // First prefer the package manager that demonstrably owns the current install.
   const installPathPm = detectPackageManagerFromCurrentInstallPath();
   if (installPathPm && packageManagerOwnsCurrentInstall(installPathPm)) {
-    cachedDetectedPm = installPathPm;
-    return {
-      packageManager: cachedDetectedPm,
-      reason: 'install-path-owner',
-      packagePath: getCurrentPackagePath(),
-      packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-      globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-    };
+    return cacheTrustedDetection(installPathPm, 'install-path-owner');
   }
   const ownershipCandidates = ['pnpm', 'yarn', 'bun', 'npm'];
   for (const candidate of ownershipCandidates) {
     if (packageManagerOwnsCurrentInstall(candidate)) {
-      cachedDetectedPm = candidate;
-      return {
-        packageManager: cachedDetectedPm,
-        reason: 'global-root-owner',
-        packagePath: getCurrentPackagePath(),
-        packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-        globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-      };
+      return cacheTrustedDetection(candidate, 'global-root-owner');
     }
   }
@@ -471,29 +472,14 @@ export function detectPackageManagerDetails() {
   // Validate the hint against package visibility, but only after ownership checks failed.
   if (hintedPm && isCommandAvailable(resolvePackageManagerCommand(hintedPm)) && isPackageInstalledWith(hintedPm)) {
-    cachedDetectedPm = hintedPm;
-    return {
-      packageManager: cachedDetectedPm,
-      reason: 'hinted-visible-install',
-      packagePath: getCurrentPackagePath(),
-      packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-      globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-    };
+    return detectionResult(hintedPm, 'hinted-visible-install');
   }
   const runtimePm = detectPackageManagerFromRuntimePath(process.execPath);
   if (runtimePm && isCommandAvailable(resolvePackageManagerCommand(runtimePm)) && isPackageInstalledWith(runtimePm)) {
-    cachedDetectedPm = runtimePm;
-    return {
-      packageManager: cachedDetectedPm,
-      reason: 'runtime-visible-install',
-      packagePath: getCurrentPackagePath(),
-      packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-      globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-    };
+    return detectionResult(runtimePm, 'runtime-visible-install');
   }
-  // Last resort: pick a PM that can at least see the package.
   const pmChecks = [
     { name: 'pnpm', check: () => isCommandAvailable(resolvePackageManagerCommand('pnpm')) },
     { name: 'yarn', check: () => isCommandAvailable(resolvePackageManagerCommand('yarn')) },
@@ -502,35 +488,29 @@ export function detectPackageManagerDetails() {
   ];
   for (const { name, check } of pmChecks) {
-    if (check()) {
-      // Verify this PM actually has the package installed globally
-      if (isPackageInstalledWith(name)) {
-        cachedDetectedPm = name;
-        return {
-          packageManager: cachedDetectedPm,
-          reason: 'last-resort-visible-install',
-          packagePath: getCurrentPackagePath(),
-          packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-          globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-        };
-      }
+    if (check() && isPackageInstalledWith(name)) {
+      return detectionResult(name, 'last-resort-visible-install');
     }
   }
-  cachedDetectedPm = 'npm';
-  return {
-    packageManager: cachedDetectedPm,
-    reason: 'default-fallback',
-    packagePath: getCurrentPackagePath(),
-    packageManagerCommand: resolvePackageManagerCommand(cachedDetectedPm),
-    globalNodeModulesRoot: getGlobalNodeModulesRoots(cachedDetectedPm)[0] || null,
-  };
+  return detectionResult('npm', 'default-fallback');
 }
 export function detectPackageManager() {
   return detectPackageManagerDetails().packageManager;
 }
+export function resolveTrustedUpdatePackageManager(details = detectPackageManagerDetails()) {
+  if (
+    details
+    && TRUSTED_UPDATE_REASONS.has(details.reason)
+    && UPDATE_PACKAGE_MANAGERS.has(details.packageManager)
+  ) {
+    return details.packageManager;
+  }
+  return null;
+}
 function detectPackageManagerFromInstallPath(pkgPath) {
   if (!pkgPath) return null;
   const normalized = pkgPath.replace(/\\/g, '/').toLowerCase();
@@ -547,9 +527,8 @@ function detectPackageManagerFromRuntimePath(runtimePath) {
   if (normalized.includes('/.bun/bin/bun') || normalized.endsWith('/bun') || normalized.endsWith('/bun.exe')) {
     return 'bun';
   }
-  if (normalized.includes('/pnpm/')) return 'pnpm';
-  if (normalized.includes('/yarn/')) return 'yarn';
-  if (normalized.includes('/node') || normalized.endsWith('/node.exe')) return 'npm';
+  // `node` is the runtime for npm, pnpm, and yarn global bins. It is not an
+  // install owner.
   return null;
 }

package/server/lib/package-manager.test.js CHANGED Viewed

@@ -11,6 +11,7 @@ const {
   detectPackageManager,
   executeUpdate,
   getCurrentVersion,
+  resolveTrustedUpdatePackageManager,
 } = await import('./package-manager.js');
 function officialRegistryPackage(latest) {
@@ -366,5 +367,31 @@ describe('CLI update exports', () => {
   it('exports package-manager helpers used by the update command', () => {
     expect(typeof detectPackageManager).toBe('function');
     expect(typeof executeUpdate).toBe('function');
+    expect(typeof resolveTrustedUpdatePackageManager).toBe('function');
+  });
+});
+describe('resolveTrustedUpdatePackageManager', () => {
+  it('accepts only installs that this process can prove it owns', () => {
+    expect(resolveTrustedUpdatePackageManager({
+      packageManager: 'pnpm',
+      reason: 'install-path-owner',
+    })).toBe('pnpm');
+    expect(resolveTrustedUpdatePackageManager({
+      packageManager: 'bun',
+      reason: 'forced-env',
+    })).toBe('bun');
+    expect(resolveTrustedUpdatePackageManager({
+      packageManager: 'npm',
+      reason: 'default-fallback',
+    })).toBeNull();
+    expect(resolveTrustedUpdatePackageManager({
+      packageManager: 'npm',
+      reason: 'runtime-visible-install',
+    })).toBeNull();
+    expect(resolveTrustedUpdatePackageManager({
+      packageManager: 'pnpm',
+      reason: 'last-resort-visible-install',
+    })).toBeNull();
   });
 });

package/server/lib/pi/routes.js CHANGED Viewed

@@ -343,6 +343,12 @@ const projectEventFrame = (frame) => {
       } } };
     }
     case 'session.lifecycle': return { ...common, payload: { state: frame.payload.state } };
+    case 'session.updated': {
+      if (typeof frame.payload.title !== 'string') return null;
+      const title = frame.payload.title.trim();
+      if (title.length === 0 || title.length > 256) return null;
+      return { ...common, payload: { title } };
+    }
     case 'assistant.message.start': return { ...common, payload: { messageId: frame.payload.messageId, role: frame.payload.role, startedAt: frame.payload.startedAt, ...(typeof frame.payload.parentId === 'string' ? { parentId: frame.payload.parentId } : {}), ...(typeof frame.payload.text === 'string' ? { text: frame.payload.text } : {}), ...(frame.payload.model ? { model: frame.payload.model } : {}) } };
     case 'assistant.message.delta':
     case 'assistant.thinking.delta': return { ...common, payload: { messageId: frame.payload.messageId, contentIndex: frame.payload.contentIndex, delta: frame.payload.delta, ...(typeof frame.payload.partId === 'string' ? { partId: frame.payload.partId } : {}) } };

package/server/lib/pi/routes.test.js CHANGED Viewed

@@ -563,6 +563,38 @@ describe('Pi runtime route', () => {
     expect(text).not.toContain('/private/socket');
   });
+  it('projects session.updated titles onto the public event stream', async () => {
+    const runtime = {
+      health: async () => ({ state: 'ready', protocolVersion: 1, capabilities: [] }),
+      subscribe: async ({ onEvent }) => {
+        onEvent({
+          protocolVersion: 1,
+          kind: 'event',
+          event: 'session.updated',
+          sequence: 8,
+          payload: { sessionId: 'pi-session-5', directory: '/workspace', title: '  Fix the parser  ', endpoint: '/private/socket' },
+        });
+        return () => {};
+      },
+    };
+    const app = express();
+    registerPiRuntimeRoutes(app, { getPiSessionDaemonRuntime: () => runtime });
+    server = await listen(app);
+    const response = await fetch(`http://127.0.0.1:${server.address().port}/api/pi/events?sessionId=pi-session-5&fromSequence=7`);
+    const reader = response.body.getReader();
+    const first = await reader.read();
+    let text = new TextDecoder().decode(first.value);
+    while (!text.includes('"session.updated"')) {
+      const next = await reader.read();
+      if (next.done) break;
+      text += new TextDecoder().decode(next.value);
+    }
+    await reader.cancel();
+    expect(text).toContain('"name":"session.updated"');
+    expect(text).toContain('"title":"Fix the parser"');
+    expect(text).not.toContain('/private/socket');
+  });
   it('projects Pi usage through the public session and event envelopes', async () => {
     const sampleUsage = {
       input: 120, output: 80, cacheRead: 30, cacheWrite: 5, totalTokens: 235,

package/server/lib/pi/session-daemon/DOCUMENTATION.md CHANGED Viewed

@@ -25,7 +25,7 @@ This module is the Pi-owned session-daemon foundation. A detached local daemon p
 - The public health route deliberately whitelists its response fields. It never returns a daemon endpoint, credential, PID, cwd, agent directory, or transcript data. Public transcript and event projections preserve daemon-redacted assistant error messages so the UI can distinguish provider/runtime failures instead of reducing every failure to `ASSISTANT_ERROR`.
 - A client must send an `authenticate` frame carrying the host-private daemon credential before it can issue a request. Credentials are never logged or returned.
 - Frames are LF-delimited JSON. They have a 1 MiB maximum buffered size. A malformed, oversized, unauthenticated, or invalid request closes the connection.
-- The private core commands are `runtime.health`, `projects.list/select`, `providers.list/config.get/models.set/status/login/login.respond/login.status/logout`, `settings.get/set`, `resources.list/update/prompts.create/prompts.delete`, and session list/create/open/rename/delete/tree/navigate/fork/clone/prompt/steer/followUp/abort/model/thinking/compact operations. Resource lists use opaque IDs and never disclose server paths. Only top-level Pi prompt templates and applicable AGENTS.md sources are editable; package/path resources and skills are browse-only. Resource writes are rejected while a session streams, use an atomic replace, then recreate the idle runtime. Project trust changes are persisted in Pi trust.json and likewise recreate an idle runtime; extensions remain disabled regardless of trust. Provider login submits API keys only across authenticated private IPC or brokers Pi's OAuth/device/manual-code interaction; public projections contain only opaque login IDs, prompts, URLs/device codes, model catalog/configuration, and stable states, never credentials or write-only headers. `providers.models.set` is rejected while a session streams, atomically persists Pi's `models.json`, then rehydrates the idle runtime so the catalog is authoritative immediately. `providers.list` projects only catalog and authentication-status metadata, including Pi-supported `thinkingLevels` (`null` map entries hidden, `xhigh`/`max` opt-in). Session thinking overrides are clamped to the live model's supported levels. `sessions.list` revalidates the selected cwd's JSONL directory before SDK discovery and returns no JSONL paths. The browser explicitly selects an existing user-chosen project directory before listing it; the daemon's startup cwd is an internal fallback, not a user-visible default project. Unnamed persisted sessions use their first prompt as a readable list title when available. `sessions.open` and `getSession` project the last assistant `provider`/`model`/`thinkingLevel` onto the session record so reopening a chat keeps that cache identity. Session selection validates a persisted JSONL path before Pi opens it; inactive mutations are never directed by a browser-supplied path. Attachment paths originate in the server-local upload map and cross only private IPC into Pi's tool context. Pi may persist or echo those paths in its authoritative JSONL transcript, so every public projection redacts them recursively: session titles/previews, user and assistant text/thinking, tool arguments, errors, snapshots, and live message events never expose the server-local path. The daemon maps Pi message lifecycle, deltas, tools, queue changes, model/thinking, compaction, and interruption state to canonical events. Tool events carry redacted input arguments, cumulative partial-output snapshots, final output, error text, renderer metadata (edit diffs, truncation notes), and start/end timestamps. Persisted `toolResult` entries merge into their assistant `toolCall` parts as output/error/end time so hydrated sessions render complete tool cards; tool-result entries never surface as standalone messages. Assistant message projections and start events carry the owning user-message id so the restored turn renderer can group and display replies; all assistant entries in a tool loop remain attached to the latest user turn. Assistant message projections also pass through Pi's per-turn `Usage` (input, output, cacheRead, cacheWrite, totalTokens, and the same five numeric cost fields). The daemon sanitizes the raw payload through `projectUsage` before publication: every numeric must be finite and non-negative, the whole object is omitted when any field is missing or wrong type, and unknown keys are never copied. The `assistant.message.end` event carries the same sanitized usage so the last turn updates without waiting for a full `getSession` refetch. The public route whitelist re-applies the same sanitizer on each projection so a stale or malformed payload from a different daemon version cannot surface as `NaN` or `Infinity` in the reducer.
+- The private core commands are `runtime.health`, `projects.list/select`, `providers.list/config.get/models.set/status/login/login.respond/login.status/logout`, `settings.get/set`, `resources.list/update/prompts.create/prompts.delete`, and session list/create/open/rename/delete/tree/navigate/fork/clone/prompt/steer/followUp/abort/model/thinking/compact operations. Resource lists use opaque IDs and never disclose server paths. Only top-level Pi prompt templates and applicable AGENTS.md sources are editable; package/path resources and skills are browse-only. Resource writes are rejected while a session streams, use an atomic replace, then recreate the idle runtime. Project trust changes are persisted in Pi trust.json and likewise recreate an idle runtime; extensions remain disabled regardless of trust. Provider login submits API keys only across authenticated private IPC or brokers Pi's OAuth/device/manual-code interaction; public projections contain only opaque login IDs, prompts, URLs/device codes, model catalog/configuration, and stable states, never credentials or write-only headers. `providers.models.set` is rejected while a session streams, atomically persists Pi's `models.json`, then rehydrates the idle runtime so the catalog is authoritative immediately. `providers.list` projects only catalog and authentication-status metadata, including Pi-supported `thinkingLevels` (`null` map entries hidden, `xhigh`/`max` opt-in). Session thinking overrides are clamped to the live model's supported levels. `sessions.list` revalidates the selected cwd's JSONL directory before SDK discovery and returns no JSONL paths. The browser explicitly selects an existing user-chosen project directory before listing it; the daemon's startup cwd is an internal fallback, not a user-visible default project. Unnamed persisted sessions use their first prompt as a readable list title when available. `sessions.open` and `getSession` project the last assistant `provider`/`model`/`thinkingLevel` onto the session record so reopening a chat keeps that cache identity. Session selection validates a persisted JSONL path before Pi opens it; inactive mutations are never directed by a browser-supplied path. Attachment paths originate in the server-local upload map and cross only private IPC into Pi's tool context. Pi may persist or echo those paths in its authoritative JSONL transcript, so every public projection redacts them recursively: session titles/previews, user and assistant text/thinking, tool arguments, errors, snapshots, and live message events never expose the server-local path. The daemon maps Pi message lifecycle, deltas, tools, queue changes, model/thinking, compaction, interruption state, and session title updates (`session.updated` on create-with-title, first-prompt auto-title, and rename) to canonical events. Tool events carry redacted input arguments, cumulative partial-output snapshots, final output, error text, renderer metadata (edit diffs, truncation notes), and start/end timestamps. Persisted `toolResult` entries merge into their assistant `toolCall` parts as output/error/end time so hydrated sessions render complete tool cards; tool-result entries never surface as standalone messages. Assistant message projections and start events carry the owning user-message id so the restored turn renderer can group and display replies; all assistant entries in a tool loop remain attached to the latest user turn. Assistant message projections also pass through Pi's per-turn `Usage` (input, output, cacheRead, cacheWrite, totalTokens, and the same five numeric cost fields). The daemon sanitizes the raw payload through `projectUsage` before publication: every numeric must be finite and non-negative, the whole object is omitted when any field is missing or wrong type, and unknown keys are never copied. The `assistant.message.end` event carries the same sanitized usage so the last turn updates without waiting for a full `getSession` refetch. The public route whitelist re-applies the same sanitizer on each projection so a stale or malformed payload from a different daemon version cannot surface as `NaN` or `Infinity` in the reducer.
 - Each event and reconnect snapshot has a monotonic sequence. A reconnect receives a bounded contiguous replay after its cursor when available, otherwise an authoritative `session.snapshot`; unavailable runtimes are not represented as empty sessions.
 - Prompt, steer, and follow-up requests acknowledge acceptance immediately after Pi accepts the call; the daemon owns the still-running send promise and publishes any asynchronous rejection as `session.error`. A later prompt on the same session invalidates that rejection so it cannot error the new turn. If the rejected send left Pi streaming, the daemon aborts it. Steer/follow-up against an idle session starts a new prompt instead of `SESSION_NOT_RUNNING`. Agent completion is never held behind the 30-second public/private request budgets.
 - Registry keys combine the SDK session ID with its cwd. A replacement subscription is rebound to the replacement session so old-session events cannot be published under the new identity. A collision is a visible error; it never replaces or disposes an unrelated runtime.

package/server/lib/pi/session-daemon/session-daemon.js CHANGED Viewed

@@ -409,7 +409,7 @@ export function createSessionDaemon({
         throw new SessionDaemonProtocolError('INVALID_SESSION', 'Pi returned an invalid active session.');
       }
       manager.appendSessionInfo(title);
-      publish('session.updated', { title }, sessionId, targetDir);
+      publish('session.updated', { title: redactAttachmentPaths(title) }, sessionId, targetDir);
       return;
     }
@@ -421,7 +421,7 @@ export function createSessionDaemon({
     }
     await validatePiSessionJsonlFile(target.path);
     renamePersistedSession({ sessionFile: target.path, title, cwd: targetDir });
-    publish('session.updated', { title }, sessionId, targetDir);
+    publish('session.updated', { title: redactAttachmentPaths(title) }, sessionId, targetDir);
   };
   const findPersistedSession = async (sessionId, requestedDirectory) => {
@@ -664,7 +664,14 @@ export function createSessionDaemon({
     runtime = newRuntime;
     activeDirectory = targetCwd;
     rememberRuntimeSession();
-    return projectActiveSession(newRuntime, targetCwd);
+    const created = projectActiveSession(newRuntime, targetCwd);
+    const createdTitle = created.session.title
+      || (typeof payload.title === 'string' ? payload.title.trim() : '')
+      || newRuntime.session?.sessionManager?.getSessionName?.();
+    if (createdTitle) {
+      publish('session.updated', { title: redactAttachmentPaths(createdTitle) }, created.session.id, targetCwd);
+    }
+    return created;
   };
   const listProviders = async (requestedDirectory) => {
@@ -1320,7 +1327,7 @@ export function createSessionDaemon({
       const derived = deriveSessionTitle(payload.text);
       if (derived && typeof manager?.appendSessionInfo === 'function') {
         manager.appendSessionInfo(derived);
-        publish('session.updated', { title: derived }, payload.sessionId, activeRuntime.cwd);
+        publish('session.updated', { title: redactAttachmentPaths(derived) }, payload.sessionId, activeRuntime.cwd);
       }
     }

package/server/lib/pi/session-daemon/session-daemon.test.js CHANGED Viewed

@@ -45,6 +45,7 @@ class FakeSession {
       getLeafId: () => 'fake-entry',
       getTree: () => [{ entry: { id: 'fake-entry', parentId: undefined, timestamp: '2026-01-01T00:00:00.000Z' }, children: [] }],
       appendSessionInfo: (name) => this.names.push(name),
+      getSessionName: () => this.names[this.names.length - 1],
     };
   }
@@ -465,6 +466,29 @@ describe('Pi session daemon spike', () => {
     await client.close();
   });
+  it('publishes session.updated when a session is first prompted', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-'));
+    const endpoint = testDaemonEndpoint(root);
+    daemon = createSessionDaemon({
+      endpoint,
+      credential,
+      cwd: root,
+      createRuntime: async () => new FakeRuntime({ cwd: root, session: new FakeSession('pi-session-old') }),
+    });
+    await daemon.start();
+    const client = connectClient(endpoint);
+    await client.authenticate();
+    await client.request('sessions.create', { cwd: root });
+    const promptedUpdated = client.next((frame) => frame.event === 'session.updated' && frame.payload?.title === 'Inspect this report');
+    await client.request('sessions.prompt', { sessionId: 'pi-session-new', text: 'Inspect this report\n\nDetails' });
+    await expect(promptedUpdated).resolves.toMatchObject({
+      event: 'session.updated',
+      payload: { sessionId: 'pi-session-new', title: 'Inspect this report' },
+    });
+    await client.close();
+  });
   it('creates and selects a persisted Pi session with supported creation metadata', async () => {
     const root = await mkdtemp(join(tmpdir(), 'pichamber-pi-daemon-'));
     const endpoint = testDaemonEndpoint(root);

package/dist/assets/CommitSection-DGGArAb2.js DELETED Viewed

@@ -1 +0,0 @@

- import{R as C,j as e}from"./vendor-react-DYyjh7Q0.js";import{f as z,T as y,y as _,B as c,I as a,z as v,aG as I}from"./useAppFontEffects-DXASDavv.js";import{u as H}from"./index-CRB7i1S2.js";const N=38,h=200,k=({value:t,onChange:o,placeholder:m,disabled:i=!1,hasTouchInput:r=!1,isMobile:u=!1})=>{const n=C.useRef(null),j=H(s=>s.inputSpellcheckEnabled);return C.useLayoutEffect(()=>{const s=n.current;if(!s)return;const l=document.activeElement===s,d=()=>{s.style.height=`${N}px`;const p=s.scrollHeight,x=Math.min(Math.max(p,N),h);s.style.height=`${x}px`,s.style.overflowY=p>h?"auto":"hidden",p>h&&!l&&(s.scrollTop=s.scrollHeight)};d();const f=window.requestAnimationFrame(d);return()=>{window.cancelAnimationFrame(f)}},[t]),e.jsx("textarea",{ref:n,value:t,onChange:s=>o(s.target.value),placeholder:m??"Commit message",rows:1,disabled:i,autoCorrect:r?"on":"off",autoCapitalize:r?"sentences":"off",spellCheck:u||j,className:z("w-full rounded-lg border border-border/60 bg-surface-elevated px-3 py-2 typography-ui-label text-foreground placeholder:text-muted-foreground","resize-none outline-none transition-[border-color,box-shadow] duration-150","focus-visible:ring-2 focus-visible:ring-[var(--interactive-focus-ring)]",i&&"opacity-50"),style:{minHeight:N,maxHeight:h}})},F=({highlights:t,onInsert:o})=>{if(t.length===0)return null;const m=()=>{o(t)};return e.jsxs("div",{className:"space-y-2 rounded-xl border border-border/60 bg-transparent px-3 py-2",children:[e.jsxs("div",{className:"flex items-center justify-between gap-2",children:[e.jsx("p",{className:"typography-micro text-muted-foreground",children:"Highlights"}),e.jsxs(y,{children:[e.jsx(_,{asChild:!0,children:e.jsx(c,{variant:"ghost",size:"icon",className:"size-6",onClick:m,"aria-label":"Insert aria label",children:e.jsx(a,{name:"arrow-down",className:"size-4"})})}),e.jsx(v,{sideOffset:8,children:"Insert tooltip"})]})]}),e.jsx("ul",{className:"space-y-1",children:t.map((i,r)=>e.jsx("li",{className:"typography-meta text-foreground",children:i},`${i}-${r}`))})]})},q=({stagedCount:t,commitMessage:o,onCommitMessageChange:m,generatedHighlights:i,onInsertHighlights:r,onGenerateMessage:u,isGeneratingMessage:n,onCommit:j,onCommitAndPush:s,commitAction:l,hasPendingIndexMutation:d=!1,gitmojiEnabled:f,onOpenGitmojiPicker:p})=>{const x=t>0,b=o.trim()&&x&&l===null&&!d,{isMobile:g,hasTouchInput:w}=I();return e.jsxs("section",{className:"border-0 bg-transparent rounded-none",children:[e.jsxs("div",{className:"flex w-full items-baseline gap-2 px-0 pt-2 pb-1",children:[e.jsx("h3",{className:"typography-ui-header font-semibold text-foreground",children:"Commit"}),x?null:e.jsx("span",{className:"min-w-0 truncate typography-meta text-muted-foreground",children:"Stage files to enable commit."})]}),e.jsxs("div",{className:"flex flex-col gap-3 px-0 pt-1 pb-3",children:[e.jsx(F,{highlights:i,onInsert:r}),e.jsx(k,{value:o,onChange:m,placeholder:"Commit message",disabled:l!==null,hasTouchInput:w,isMobile:g}),f&&e.jsxs(c,{variant:"outline",size:"sm",onClick:p,className:"w-fit",type:"button",children:[e.jsx(a,{name:"emotion-happy",className:"size-4"}),"Add gitmoji"]}),e.jsxs("div",{className:"@container/commit-actions flex items-center gap-2 min-w-0",children:[e.jsxs(c,{variant:"outline",size:"sm",onClick:u,disabled:n||l!==null||d||t===0,type:"button","aria-label":"Generate commit message",className:"commit-actions__btn",children:[n?e.jsx(a,{name:"loader-4",className:"size-4 animate-spin"}):e.jsx(a,{name:"ai-generate-2",className:"size-4 text-primary"}),e.jsx("span",{className:"commit-actions__label",children:"Generate"})]}),e.jsx("div",{className:"flex-1"}),e.jsx(c,{size:"sm",variant:"outline",onClick:j,disabled:!b||n,className:"commit-actions__btn whitespace-nowrap","aria-label":"Commit aria label",children:l==="commit"?e.jsxs(e.Fragment,{children:[e.jsx(a,{name:"loader-4",className:"size-4 animate-spin"}),e.jsx("span",{className:"commit-actions__label",children:"Committing..."})]}):e.jsxs(e.Fragment,{children:[e.jsx(a,{name:"git-commit",className:"size-4"}),e.jsx("span",{className:"commit-actions__label",children:"Commit"})]})}),g?e.jsxs(y,{children:[e.jsx(_,{asChild:!0,children:e.jsx(c,{variant:"default",size:"sm",onClick:()=>s(),disabled:!b||n,className:"h-7 w-7 p-0","aria-label":"Commit and sync",children:l==="commitAndPush"?e.jsx(a,{name:"loader-4",className:"size-4 animate-spin"}):e.jsx(a,{name:"arrow-up",className:"size-3.5"})})}),e.jsx(v,{side:"top",children:e.jsx("p",{children:"Commit & sync"})})]}):e.jsx(c,{size:"sm",variant:"default",onClick:()=>s(),disabled:!b||n,className:"commit-actions__btn","aria-label":"Commit and sync",children:l==="commitAndPush"?e.jsxs(e.Fragment,{children:[e.jsx(a,{name:"loader-4",className:"size-4 animate-spin"}),e.jsx("span",{className:"commit-actions__label commit-actions__label--push",children:"Syncing..."})]}):e.jsxs(e.Fragment,{children:[e.jsx(a,{name:"arrow-up",className:"size-3.5"}),e.jsx("span",{className:"commit-actions__label commit-actions__label--push",children:"Commit & sync"})]})})]})]})]})};export{q as C};

package/dist/assets/DiagramEditor-ig5nYV6t.js DELETED Viewed

@@ -1 +0,0 @@

- import{R as e,j as h}from"./vendor-react-DYyjh7Q0.js";import{D as E}from"./vendor-react-drawio-Boqanm0j.js";import{f as x}from"./useAppFontEffects-DXASDavv.js";const D='<mxfile><diagram id="new" name="Page-1"><mxGraphModel dx="0" dy="0" grid="1" gridSize="10" guides="1" tooltips="1" connect="1" arrows="1" fold="1" page="1" pageScale="1" pageWidth="827" pageHeight="1169" math="0" shadow="0"><root><mxCell id="0"/><mxCell id="1" parent="0"/></root></mxGraphModel></diagram></mxfile>';function g(){if(typeof document>"u")return!1;const o=document.documentElement.getAttribute("data-theme");return o==="dark"||!o&&window.matchMedia("(prefers-color-scheme: dark)").matches}const X=e.forwardRef(function({xml:t,readOnly:a,className:R,onChange:c},v){const s=e.useRef(t),i=e.useRef(null),m=e.useRef(!1),[n,k]=e.useState(g),u=e.useRef(t),d=e.useRef(t);d.current!==t&&(d.current=t,u.current=t,s.current=t);const f=e.useRef(n);f.current!==n&&(f.current=n,u.current=s.current);const l=e.useRef(null);e.useEffect(()=>{const r=()=>k(g());r();const p=new MutationObserver(r);return p.observe(document.documentElement,{attributes:!0,attributeFilter:["data-theme"]}),()=>p.disconnect()},[]),e.useEffect(()=>{const r=setTimeout(()=>{l.current?.querySelector(".diagrams-iframe")?.focus()},600);return()=>clearTimeout(r)},[]),e.useImperativeHandle(v,()=>({getXml:()=>s.current}));const b=e.useCallback(()=>{!t&&!m.current&&(m.current=!0,setTimeout(()=>{i.current?.template({})},500))},[t]),w=e.useCallback(r=>{s.current=r.xml,c?.(r.xml)},[c]);return h.jsx("div",{ref:l,className:x("h-full w-full",R),children:h.jsx(E,{ref:i,xml:u.current||D,autosave:!0,urlParameters:{ui:a?"simple":n?"dark":"kennedy",spin:!0,libraries:!a,chrome:a,nav:a,layers:a,noSaveBtn:!0,noExitBtn:!0,saveAndExit:!1},onLoad:b,onAutoSave:w},n?"dark":"light")})});export{X as D};

package/dist/assets/DiagramView-8Qr6pwwI.js DELETED Viewed

@@ -1 +0,0 @@

- import{R as r,j as t}from"./vendor-react-DYyjh7Q0.js";import{u as a}from"./index-CRB7i1S2.js";import{K as v,I as m}from"./useAppFontEffects-DXASDavv.js";import{D as j}from"./DiagramEditor-ig5nYV6t.js";import"./vendor-scheduler-7OC5HNn7.js";import"./vendor-zustand-CnsBKjP5.js";import"./vendor-simplewebauthn-browser-VDA66rT_.js";import"./vendor-vite-runtime-DD1OZmLC.js";import"./vendor-base-ui-DwfTg5wD.js";import"./vendor-floating-ui-utils-BzXdqYpP.js";import"./vendor-floating-ui-react-dom-sVFnuruh.js";import"./vendor-floating-ui-dom-Bkw82kL9.js";import"./vendor-floating-ui-core-CXmKXOXc.js";import"./vendor-use-sync-external-store-B7OScDIw.js";import"./runtimeSurface-Cnqjhb6Y.js";import"./vendor-dnd-kit-core-GipZW2tY.js";import"./vendor-dnd-kit-utilities-CrOcp0Bp.js";import"./vendor-dnd-kit-accessibility-Cv52zwWT.js";import"./vendor-dnd-kit-sortable-Ct2QxIHb.js";import"./vendor-cmdk-BCEUzcHE.js";import"./vendor-radix-ui-react-dialog-jX3Dld8c.js";import"./vendor-radix-ui-primitive-Dc_FVRD7.js";import"./vendor-radix-ui-react-compose-refs-D1GnwnP9.js";import"./vendor-radix-ui-react-context-CM4yFQ2I.js";import"./vendor-radix-ui-react-id-BcxRjnbX.js";import"./vendor-radix-ui-react-use-layout-effect-0fyGwS2_.js";import"./vendor-radix-ui-react-use-controllable-state-C_ecoh35.js";import"./vendor-radix-ui-react-dismissable-layer-M7LsH3yL.js";import"./vendor-radix-ui-react-primitive-CfpW6_IT.js";import"./vendor-radix-ui-react-slot-BxUc3Pvz.js";import"./vendor-radix-ui-react-use-callback-ref-UKEWHtoP.js";import"./vendor-radix-ui-react-use-escape-keydown-Co13lHGj.js";import"./vendor-radix-ui-react-focus-scope-C2K7lNPv.js";import"./vendor-radix-ui-react-portal-xlJWBfDg.js";import"./vendor-radix-ui-react-presence-Btn-Dp7L.js";import"./vendor-radix-ui-react-focus-guards-D5MZ0nQs.js";import"./vendor-react-remove-scroll-CfeMe0DL.js";import"./vendor-tslib-De9GV7Vy.js";import"./vendor-react-remove-scroll-bar-C9YRs2nU.js";import"./vendor-react-style-singleton-B1H4bWSG.js";import"./vendor-get-nonce-C-Z93AgS.js";import"./vendor-use-sidecar-C-AuTczP.js";import"./vendor-use-callback-ref-CJB0R85I.js";import"./vendor-aria-hidden-DvXkyWUv.js";import"./vendor-codemirror-language-BuDklWi8.js";import"./vendor-lezer-common-B3-cUCR_.js";import"./vendor-codemirror-state-Wdz6Qsow.js";import"./vendor-marijn-find-cluster-break-DXwl3gUT.js";import"./vendor-codemirror-view-pXtfpqbT.js";import"./vendor-style-mod-NZ5MEPvj.js";import"./vendor-w3c-keyname-Vcq4gwWv.js";import"./vendor-crelt-C8TCjufn.js";import"./vendor-lezer-highlight-CDMHUZ74.js";import"./vendor-codemirror-lang-javascript-CrbeaEAU.js";import"./vendor-lezer-javascript-D7Tj24ot.js";import"./vendor-lezer-lr-bhwg1HMg.js";import"./vendor-codemirror-autocomplete-3xMyV7a2.js";import"./vendor-codemirror-lang-json-BTvAjwkJ.js";import"./vendor-lezer-json-Iaex0UN-.js";import"./vendor-codemirror-lang-css-C4jEScp7.js";import"./vendor-lezer-css-C5xB6jxd.js";import"./vendor-codemirror-lang-html-C1Svvdey.js";import"./vendor-lezer-html-C0I1p52t.js";import"./vendor-codemirror-lang-markdown-BloD9GN-.js";import"./vendor-lezer-markdown-C6g-d6P3.js";import"./vendor-codemirror-language-data-CFVH0pe8.js";import"./vendor-codemirror-lang-python-CR2g6ukK.js";import"./vendor-lezer-python-CvuFxeZl.js";import"./vendor-codemirror-commands-Bzf12ODH.js";import"./vendor-class-variance-authority-5VPnzWs2.js";import"./vendor-clsx-B-dksMZM.js";import"./vendor-tanstack-react-virtual-IrbCBGJ4.js";import"./vendor-tanstack-virtual-core-Dubg10g5.js";import"./vendor-framer-motion-DJASDzNt.js";import"./vendor-motion-dom-DJLgZh4Q.js";import"./vendor-motion-utils-BGh8QBgx.js";import"./vendor-sonner-dWA7qvjr.js";import"./vendor-tailwind-merge-CPcsbTWB.js";import"./vendor-fuse.js-Dw8P0qyA.js";import"./vendor-react-drawio-Boqanm0j.js";function Jt(){const{files:o}=v(),[e,d]=r.useState(null),[s,p]=r.useState(""),[x,n]=r.useState(!0),l=r.useRef(null),c=a(i=>i.pendingDiagramFile),u=r.useCallback(async i=>{n(!0),d(i);try{const f=await o?.readFile?.(i);f&&p(f.content)}catch{p("")}finally{n(!1)}},[o]);r.useEffect(()=>{if(!c)return;const i=a.getState().consumePendingDiagramFile();i&&u(i)},[u,c]);const g=r.useCallback(async()=>{const i=l.current?.getXml();e&&o?.writeFile&&i&&i!==s&&(await o.writeFile(e,i),p(i))},[e,o,s]),h=e?e.split("/").pop()||e:"";return e?x?t.jsx("div",{className:"flex h-full items-center justify-center p-3",children:t.jsx(m,{name:"loader-4",className:"size-4 animate-spin"})}):t.jsxs("div",{className:"flex h-full flex-col",children:[t.jsxs("div",{className:"flex items-center gap-2 border-b border-border/30 px-3 py-1.5",children:[t.jsx(m,{name:"file",className:"size-4 shrink-0 text-muted-foreground"}),t.jsx("span",{className:"typography-ui text-muted-foreground truncate flex-1",children:h}),t.jsx("button",{type:"button",onClick:()=>{g()},className:"size-6 flex items-center justify-center rounded-md text-foreground hover:bg-interactive-hover/50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary",title:"Save diagram",children:t.jsx(m,{name:"save-3",className:"size-4"})}),t.jsx("button",{type:"button",onClick:()=>a.getState().setActiveMainTab("chat"),className:"size-6 flex items-center justify-center rounded-md text-muted-foreground hover:bg-interactive-hover/50 hover:text-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-primary",title:"Close diagram view",children:t.jsx(m,{name:"close",className:"size-4"})})]}),t.jsx("div",{className:"flex-1 min-h-0",children:t.jsx(j,{ref:l,xml:s,className:"h-full"})})]}):t.jsx("div",{className:"flex h-full items-center justify-center p-3",children:t.jsx("div",{className:"typography-ui text-muted-foreground",children:"Pick a file from the tree."})})}export{Jt as DiagramView};