@pi-harness/pi-harness 0.1.1

package/packages/api-gateway/test/index.test.ts

@@ -0,0 +1,327 @@
+import { mkdtemp, writeFile } from "node:fs/promises";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Context } from "@deepseek-ai/cordis";
+import { afterEach, describe, expect, test } from "vitest";
+import webServerPlugin from "@pi-harness/host-webserver";
+import apiPlugin from "../src/index.js";
+
+const contexts: Context[] = [];
+const execFile = promisify(execFileCallback);
+
+afterEach(async () => {
+  await Promise.all(contexts.splice(0).map(async (context) => context.fiber.dispose()));
+});
+
+describe("API gateway plugin", () => {
+  test("serializes concurrent prompts and validates input", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { messages: [], subscribe: () => () => {} };
+    let promptStarted = false;
+    let releasePrompt: (() => void) | undefined;
+    const runtime = {
+      session,
+      prompt: () => {
+        promptStarted = true;
+        return new Promise<void>((resolve) => { releasePrompt = resolve; });
+      },
+    };
+    context.provide("piRuntime", runtime as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const first = fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "first" }) });
+    while (!promptStarted) await new Promise((resolve) => setTimeout(resolve, 1));
+    await expect(fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "second" }) })).resolves.toMatchObject({ status: 409 });
+    releasePrompt?.();
+    await expect(first).resolves.toMatchObject({ status: 200 });
+    await expect(fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "   " }) })).resolves.toMatchObject({ status: 400 });
+  });
+
+  test("returns the live session messages and trajectory events", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    type Listener = (event: { type: string; [key: string]: unknown }) => void;
+    const listeners = new Set<Listener>();
+    const session = {
+      sessionId: "session-test",
+      sessionFile: "/tmp/session-test.jsonl",
+      messages: [{ role: "user", content: "hello", timestamp: 1 }],
+      subscribe(listener: Listener) {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      },
+    };
+    const runtime = { session, prompt: () => {
+      listeners.forEach((listener) => listener({ type: "tool_execution_start", toolName: "read", toolCallId: "call-1", args: { path: "README.md" } }));
+      session.messages.push({ role: "assistant", content: [{ type: "text", text: "done" }], timestamp: 2 });
+    } };
+    context.provide("piRuntime", runtime as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    await fetch(context.webServer.url + "/api/prompt", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ prompt: "hello" }) });
+    const response = await fetch(context.webServer.url + "/api/session");
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({
+      sessionId: "session-test",
+      messages: [{ role: "user", content: "hello", timestamp: 1 }, { role: "assistant" }],
+      events: [{ type: "tool_execution_start", toolName: "read" }],
+    });
+  });
+
+  test("opens an event stream with the current trajectory snapshot", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    type Listener = (event: { type: string; [key: string]: unknown }) => void;
+    const listeners = new Set<Listener>();
+    const session = {
+      sessionId: "stream-session",
+      sessionFile: undefined,
+      messages: [],
+      subscribe(listener: Listener) {
+        listeners.add(listener);
+        return () => listeners.delete(listener);
+      },
+    };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/events");
+    expect(response.headers.get("content-type")).toContain("text/event-stream");
+    const reader = response.body?.getReader();
+    const first = await reader?.read();
+    const text = new TextDecoder().decode(first?.value);
+    expect(text).toContain('"type":"snapshot"');
+    expect(text).toContain('"sessionId":"stream-session"');
+    const next = reader?.read();
+    listeners.forEach((listener) => listener({ type: "tool_execution_start", toolName: "read" }));
+    const second = await next;
+    expect(new TextDecoder().decode(second?.value)).toContain('"type":"event"');
+    await reader?.cancel();
+  });
+
+  test("creates a new session through the live AgentSession", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    let sessionId = "old-session";
+    let resetCount = 0;
+    const session = {
+      get sessionId() { return sessionId; },
+      sessionFile: undefined,
+      messages: [{ role: "user", content: "old" }],
+      isStreaming: false,
+      sessionManager: { newSession() { sessionId = "new-session"; resetCount += 1; }, getEntries: () => [] },
+      agent: { state: { messages: [{ role: "user", content: "old" }] } },
+      subscribe: () => () => {},
+    };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const sessions = await fetch(context.webServer.url + "/api/sessions");
+    expect(sessions.status).toBe(200);
+    await expect(sessions.json()).resolves.toEqual({ items: [] });
+    const response = await fetch(context.webServer.url + "/api/session/new", { method: "POST" });
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({ sessionId: "new-session", messages: [] });
+    expect(resetCount).toBe(1);
+  });
+
+  test("opens a persisted session from the session list", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-sessions-"));
+    const path = join(directory, "2026-08-30T00-00-00-000Z_target.jsonl");
+    await writeFile(path, `${JSON.stringify({ type: "session", version: 3, id: "target-session", timestamp: new Date().toISOString(), cwd: "/tmp" })}\n${JSON.stringify({ type: "message", id: "message-1", parentId: null, timestamp: new Date().toISOString(), message: { role: "assistant", content: [{ type: "text", text: "saved" }], provider: "test", model: "model", usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, totalTokens: 0, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } }, stopReason: "stop", timestamp: Date.now() } })}\n`, "utf8");
+    let openedPath = "";
+    const session = {
+      sessionId: "active-session",
+      sessionFile: "/tmp/active.jsonl",
+      messages: [],
+      isStreaming: false,
+      sessionManager: { setSessionFile(nextPath: string) { openedPath = nextPath; }, getEntries: () => [], isPersisted: () => true, getSessionDir: () => directory, buildSessionContext: () => ({ messages: [] }) },
+      agent: { state: { messages: [] } },
+      subscribe: () => () => {},
+    };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/session/open", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ path }) });
+    expect(response.status).toBe(200);
+    expect(openedPath).toBe(path);
+  });
+
+  test("lists and selects models through the live Pi session", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const first = { provider: "test", id: "one", name: "Test One", reasoning: false, contextWindow: 8_000 };
+    const second = { provider: "test", id: "two", name: "Test Two", reasoning: true, contextWindow: 16_000 };
+    let selected = "one";
+    const session = {
+      sessionId: "model-session",
+      sessionFile: undefined,
+      messages: [],
+      isStreaming: false,
+      get model() { return selected === "one" ? first : second; },
+      setModel(model: { id: string }) { selected = model.id; return Promise.resolve(); },
+      subscribe: () => () => {},
+    };
+    const modelRuntime = { getModels: () => [first, second], getModel: (_provider: string, id: string) => id === "two" ? second : id === "one" ? first : undefined };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: first, runtime: modelRuntime } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    await expect(fetch(context.webServer.url + "/api/models")).resolves.toMatchObject({ status: 200 });
+    const list = await fetch(context.webServer.url + "/api/models");
+    await expect(list.json()).resolves.toMatchObject({ items: [{ id: "one", active: true }, { id: "two", active: false }] });
+    const providers = await fetch(context.webServer.url + "/api/providers");
+    await expect(providers.json()).resolves.toMatchObject({ items: [{ provider: "test", activeModel: { id: "one", active: true } }] });
+    const response = await fetch(context.webServer.url + "/api/model", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ provider: "test", model: "two" }) });
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({ model: { id: "two", active: true } });
+    expect(selected).toBe("two");
+  });
+
+  test("only exposes the active and configured providers", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const active = { provider: "active", id: "one", name: "Active", reasoning: false, contextWindow: 8_000 };
+    const configured = { provider: "configured", id: "one", name: "Configured", reasoning: false, contextWindow: 8_000 };
+    const hidden = { provider: "hidden", id: "one", name: "Hidden", reasoning: false, contextWindow: 8_000 };
+    const session = { sessionId: "provider-filter-session", sessionFile: undefined, messages: [], isStreaming: false, model: active, subscribe: () => () => {} };
+    const modelRuntime = { getProviders: () => [{ id: "active", name: "Active" }, { id: "configured", name: "Configured" }, { id: "hidden", name: "Hidden" }], getModels: (provider?: string) => provider === "configured" ? [configured] : provider === "hidden" ? [hidden] : [active], getProviderAuthStatus: (provider: string) => provider === "configured" ? { configured: true, source: "environment" } : { configured: false }, getModel: () => active };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: active, runtime: modelRuntime } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/providers");
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({ items: [{ provider: "active" }, { provider: "configured" }] });
+  });
+
+  test("lists commands from the live extension registry", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = {
+      sessionId: "command-session",
+      sessionFile: undefined,
+      messages: [],
+      isStreaming: false,
+      extensionRunner: { getRegisteredCommands: () => [{ name: "review", invocationName: "review", description: "Review changes", sourceInfo: { path: "/tmp/review.ts" } }] },
+      subscribe: () => () => {},
+    };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/commands");
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ items: [{ name: "review", invocationName: "review", description: "Review changes", source: "/tmp/review.ts" }] });
+  });
+
+  test("aborts a running prompt through the web API", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    let aborted = false;
+    const session = { sessionId: "abort-session", sessionFile: undefined, messages: [], isStreaming: true, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => { aborted = true; session.isStreaming = false; return Promise.resolve(); }, dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/abort", { method: "POST" });
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toEqual({ aborted: true });
+    expect(aborted).toBe(true);
+  });
+
+  test("reports workspace file status without exposing a fake action", async () => {
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "files-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: "/tmp", agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/files");
+    expect(response.status).toBe(200);
+    const payload = await response.json() as { items?: unknown };
+    expect(Array.isArray(payload.items)).toBe(true);
+
+    const diff = await fetch(context.webServer.url + "/api/files/diff?path=README.md");
+    expect(diff.status).toBe(200);
+    const diffPayload = await diff.json() as { path?: unknown; diff?: unknown };
+    expect(diffPayload.path).toBe("README.md");
+    expect(typeof diffPayload.diff).toBe("string");
+    const invalid = await fetch(context.webServer.url + "/api/files/diff?path=../secrets.txt");
+    expect(invalid.status).toBe(400);
+  });
+
+  test("commits selected workspace files only after an explicit message", async () => {
+    const context = new Context();
+    contexts.push(context);
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-commit-"));
+    await execFile("git", ["init", "-q"], { cwd: directory });
+    await execFile("git", ["config", "user.email", "pi-harness@test.invalid"], { cwd: directory });
+    await execFile("git", ["config", "user.name", "Pi Harness Test"], { cwd: directory });
+    await writeFile(join(directory, "README.md"), "before\n", "utf8");
+    await execFile("git", ["add", "README.md"], { cwd: directory });
+    await execFile("git", ["commit", "-qm", "initial"], { cwd: directory });
+    await writeFile(join(directory, "README.md"), "after\n", "utf8");
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "commit-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: directory, agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const missingMessage = await fetch(context.webServer.url + "/api/files/commit", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["README.md"] }) });
+    expect(missingMessage.status).toBe(400);
+    const response = await fetch(context.webServer.url + "/api/files/commit", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["README.md"], message: "Update README" }) });
+    expect(response.status).toBe(200);
+    await expect(response.json()).resolves.toMatchObject({ committed: true, message: "Update README" });
+    await expect(execFile("git", ["status", "--porcelain"], { cwd: directory })).resolves.toMatchObject({ stdout: "" });
+  });
+
+  test("rejects destructive workspace revert without explicit confirmation", async () => {
+    const context = new Context();
+    contexts.push(context);
+    const directory = await mkdtemp(join(tmpdir(), "pi-harness-api-revert-"));
+    await execFile("git", ["init", "-q"], { cwd: directory });
+    await writeFile(join(directory, "scratch.txt"), "discard me\n", "utf8");
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    const session = { sessionId: "revert-session", sessionFile: undefined, messages: [], isStreaming: false, subscribe: () => () => {} };
+    context.provide("piRuntime", { session, prompt: () => Promise.resolve(), abort: () => Promise.resolve(), dispose: () => Promise.resolve() } as never);
+    context.provide("piModels", { model: { provider: "test", id: "model" }, runtime: { getModels: () => [], getModel: () => undefined } } as never);
+    context.provide("piHarnessLaunch", { cwd: directory, agentDir: "/tmp/agent", args: [], requestExit() {} });
+    await context.plugin(apiPlugin);
+
+    const response = await fetch(context.webServer.url + "/api/files/revert", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ paths: ["scratch.txt"] }) });
+    expect(response.status).toBe(400);
+  });
+});

package/packages/api-gateway/tsconfig.build.json

@@ -0,0 +1 @@
+{"extends":"../../tsconfig.build.json","compilerOptions":{"outDir":"dist","paths":{},"rootDir":"src"},"include":["src/**/*.ts"]}

package/packages/api-gateway/tsconfig.json

@@ -0,0 +1 @@
+{"extends":"../../tsconfig.json","compilerOptions":{"paths":{}},"include":["src/**/*.ts"]}

package/packages/bundle-web-app/cordis.patch.yml

@@ -0,0 +1,12 @@
+- id: webserver
+  name: "@pi-harness/host-webserver"
+  config:
+    host: 127.0.0.1
+    port: 3080
+- id: api
+  name: "@pi-harness/api-gateway"
+  config: {}
+- id: web-app
+  name: "@pi-harness/web-app"
+  config:
+    staticDir: !!js process.env.PI_HARNESS_WEB_DIST

package/packages/bundle-web-app/dist/index.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from "@deepseek-ai/cordis";
+import "@pi-harness/host-webserver";
+export interface WebAppConfig {
+    readonly staticDir?: string;
+}
+declare const _default: {
+    name: string;
+    inject: string[];
+    apply(context: Context, config: WebAppConfig): void;
+};
+export default _default;
+//# sourceMappingURL=index.d.ts.map

package/packages/bundle-web-app/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEnD,OAAO,4BAA4B,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;;;;mBAuCgB,OAAO,UAAU,YAAY;;AAH9C,wBAsBE"}

package/packages/bundle-web-app/dist/index.js

@@ -0,0 +1,63 @@
+import { createReadStream, existsSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { pipeline } from "node:stream/promises";
+import "@pi-harness/host-webserver";
+const MIME_TYPES = {
+    ".css": "text/css; charset=utf-8",
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    ".svg": "image/svg+xml",
+};
+function contentType(path) {
+    const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
+    return MIME_TYPES[extension] ?? "application/octet-stream";
+}
+function safePath(root, pathname) {
+    const candidate = resolve(root, "." + pathname);
+    const rootWithSlash = root.endsWith("/") ? root : root + "/";
+    if (candidate !== root && !candidate.startsWith(rootWithSlash))
+        return undefined;
+    return candidate;
+}
+async function sendFile(path, response) {
+    const info = await stat(path);
+    if (!info.isFile())
+        throw new Error("Not a file");
+    response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache" });
+    await pipeline(createReadStream(path), response);
+}
+async function sendSafeFile(root, path, response) {
+    const [rootReal, pathReal] = await Promise.all([realpath(root), realpath(path)]);
+    const rootWithSlash = rootReal.endsWith("/") ? rootReal : rootReal + "/";
+    if (pathReal !== rootReal && !pathReal.startsWith(rootWithSlash))
+        throw new Error("Static file escapes web root");
+    await sendFile(pathReal, response);
+}
+export default {
+    name: "pi-web-app",
+    inject: ["webServer"],
+    apply(context, config) {
+        const root = resolve(config.staticDir ?? "dist");
+        if (!existsSync(root))
+            throw new Error("Web frontend dist does not exist: " + root);
+        const dispose = context.webServer.registerFallback(async (request, response) => {
+            const requestPath = new URL(request.url ?? "/", context.webServer.url).pathname;
+            const requested = safePath(root, requestPath);
+            const index = join(root, "index.html");
+            if (requested !== undefined) {
+                try {
+                    await sendSafeFile(root, requested, response);
+                    return;
+                }
+                catch {
+                    // SPA fallback below.
+                }
+            }
+            await sendSafeFile(root, index, response);
+        });
+        context.effect(() => dispose);
+    },
+};
+//# sourceMappingURL=index.js.map

package/packages/bundle-web-app/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,4BAA4B,CAAC;AAMpC,MAAM,UAAU,GAA2B;IACzC,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,gCAAgC;IACvC,OAAO,EAAE,iCAAiC;IAC1C,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,OAAO,UAAU,CAAC,SAAS,CAAC,IAAI,0BAA0B,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,QAAgB;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;IAC7D,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,IAAY,EAAE,QAAwB;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACzH,MAAM,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAwB;IAC9E,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC;IACzE,IAAI,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClH,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAED,eAAe;IACb,IAAI,EAAE,YAAY;IAClB,MAAM,EAAE,CAAC,WAAW,CAAC;IACrB,KAAK,CAAC,OAAgB,EAAE,MAAoB;QAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,IAAI,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAwB,EAAE,QAAwB,EAAE,EAAE;YAC9G,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,IAAI,CAAC;oBACH,MAAM,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;YACD,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;CACF,CAAC"}

package/packages/bundle-web-app/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@pi-harness/web-app",
+  "version": "0.1.1",
+  "description": "Patchable Web application bundle for Pi Harness",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./cordis.patch.yml": "./cordis.patch.yml"
+  },
+  "files": [
+    "dist",
+    "cordis.patch.yml"
+  ],
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json"
+  },
+  "dependencies": {
+    "@deepseek-ai/cordis": "4.0.1",
+    "@pi-harness/host-webserver": "0.1.1"
+  }
+}

package/packages/bundle-web-app/src/index.ts

@@ -0,0 +1,69 @@
+import { createReadStream, existsSync } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { pipeline } from "node:stream/promises";
+import type { Context } from "@deepseek-ai/cordis";
+import type { IncomingMessage, ServerResponse } from "node:http";
+import "@pi-harness/host-webserver";
+
+export interface WebAppConfig {
+  readonly staticDir?: string;
+}
+
+const MIME_TYPES: Record<string, string> = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml",
+};
+
+function contentType(path: string): string {
+  const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
+  return MIME_TYPES[extension] ?? "application/octet-stream";
+}
+
+function safePath(root: string, pathname: string): string | undefined {
+  const candidate = resolve(root, "." + pathname);
+  const rootWithSlash = root.endsWith("/") ? root : root + "/";
+  if (candidate !== root && !candidate.startsWith(rootWithSlash)) return undefined;
+  return candidate;
+}
+
+async function sendFile(path: string, response: ServerResponse): Promise<void> {
+  const info = await stat(path);
+  if (!info.isFile()) throw new Error("Not a file");
+  response.writeHead(200, { "content-type": contentType(path), "content-length": info.size, "cache-control": "no-cache" });
+  await pipeline(createReadStream(path), response);
+}
+
+async function sendSafeFile(root: string, path: string, response: ServerResponse): Promise<void> {
+  const [rootReal, pathReal] = await Promise.all([realpath(root), realpath(path)]);
+  const rootWithSlash = rootReal.endsWith("/") ? rootReal : rootReal + "/";
+  if (pathReal !== rootReal && !pathReal.startsWith(rootWithSlash)) throw new Error("Static file escapes web root");
+  await sendFile(pathReal, response);
+}
+
+export default {
+  name: "pi-web-app",
+  inject: ["webServer"],
+  apply(context: Context, config: WebAppConfig) {
+    const root = resolve(config.staticDir ?? "dist");
+    if (!existsSync(root)) throw new Error("Web frontend dist does not exist: " + root);
+    const dispose = context.webServer.registerFallback(async (request: IncomingMessage, response: ServerResponse) => {
+      const requestPath = new URL(request.url ?? "/", context.webServer.url).pathname;
+      const requested = safePath(root, requestPath);
+      const index = join(root, "index.html");
+      if (requested !== undefined) {
+        try {
+          await sendSafeFile(root, requested, response);
+          return;
+        } catch {
+          // SPA fallback below.
+        }
+      }
+      await sendSafeFile(root, index, response);
+    });
+    context.effect(() => dispose);
+  },
+};

package/packages/bundle-web-app/test/index.test.ts

@@ -0,0 +1,29 @@
+import { mkdtemp, symlink, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Context } from "@deepseek-ai/cordis";
+import { afterEach, describe, expect, test } from "vitest";
+import webServerPlugin from "@pi-harness/host-webserver";
+import webAppPlugin from "../src/index.js";
+
+const contexts: Context[] = [];
+
+afterEach(async () => {
+  await Promise.all(contexts.splice(0).map(async (context) => context.fiber.dispose()));
+});
+
+describe("web app plugin", () => {
+  test("serves the SPA and refuses symlink escapes", async () => {
+    const root = await mkdtemp(join(tmpdir(), "pi-harness-web-root-"));
+    await writeFile(join(root, "index.html"), "<main>console</main>", "utf8");
+    await symlink("/etc/hosts", join(root, "leak"));
+    const context = new Context();
+    contexts.push(context);
+    await context.plugin(webServerPlugin, { host: "127.0.0.1", port: 0 });
+    await context.plugin(webAppPlugin, { staticDir: root });
+
+    await expect(fetch(context.webServer.url + "/").then((response) => response.text())).resolves.toBe("<main>console</main>");
+    await expect(fetch(context.webServer.url + "/missing-route").then((response) => response.text())).resolves.toBe("<main>console</main>");
+    await expect(fetch(context.webServer.url + "/leak").then((response) => response.text())).resolves.toBe("<main>console</main>");
+  });
+});

package/packages/bundle-web-app/tsconfig.build.json

@@ -0,0 +1 @@
+{"extends":"../../tsconfig.build.json","compilerOptions":{"outDir":"dist","paths":{},"rootDir":"src"},"include":["src/**/*.ts"]}

package/packages/bundle-web-app/tsconfig.json

@@ -0,0 +1 @@
+{"extends":"../../tsconfig.json","compilerOptions":{"paths":{}},"include":["src/**/*.ts"]}

package/packages/cli/dist/args.d.ts

@@ -0,0 +1,16 @@
+export declare class CliUsageError extends Error {
+    readonly name = "CliUsageError";
+}
+export type LauncherInvocation = {
+    mode: "help";
+} | {
+    mode: "version";
+} | {
+    mode: "run";
+    profile?: string;
+    configPath?: string;
+    dumpConfig: boolean;
+    args: string[];
+};
+export declare function parseLauncherArgs(args: readonly string[]): LauncherInvocation;
+//# sourceMappingURL=args.d.ts.map

package/packages/cli/dist/args.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAkB,IAAI,mBAAmB;CAC1C;AAED,MAAM,MAAM,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAQtK,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,kBAAkB,CAqC7E"}

package/packages/cli/dist/args.js

@@ -0,0 +1,53 @@
+export class CliUsageError extends Error {
+    name = "CliUsageError";
+}
+function optionValue(args, index, option) {
+    const value = args[index + 1];
+    if (value === undefined || value === "--")
+        throw new CliUsageError(`${option} requires a value`);
+    return value;
+}
+export function parseLauncherArgs(args) {
+    let profile = "default";
+    let profileExplicit = false;
+    let configPath;
+    let dumpConfig = false;
+    const applicationArgs = [];
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === "--") {
+            applicationArgs.push(...args.slice(index + 1));
+            break;
+        }
+        if (arg === "--help" || arg === "-h")
+            return { mode: "help" };
+        if (arg === "--version" || arg === "-v")
+            return { mode: "version" };
+        if (arg === "--dump-config") {
+            dumpConfig = true;
+            continue;
+        }
+        if (arg === "--profile") {
+            if (profileExplicit)
+                throw new CliUsageError("--profile may only be specified once");
+            profile = optionValue(args, index, "--profile");
+            profileExplicit = true;
+            index += 1;
+            continue;
+        }
+        if (arg === "--config") {
+            if (configPath !== undefined)
+                throw new CliUsageError("--config may only be specified once");
+            configPath = optionValue(args, index, "--config");
+            index += 1;
+            continue;
+        }
+        applicationArgs.push(arg ?? "");
+    }
+    if (profileExplicit && configPath !== undefined)
+        throw new CliUsageError("--profile and --config cannot be used together");
+    return configPath === undefined
+        ? { mode: "run", profile, dumpConfig, args: applicationArgs }
+        : { mode: "run", configPath, dumpConfig, args: applicationArgs };
+}
+//# sourceMappingURL=args.js.map