@piagent/platform 1.16.0 → 1.16.1

package/packages/piagent-webui/dist/client/index.html

@@ -7,7 +7,7 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-Bj9Tlouu.js"></script>
+    <script type="module" crossorigin src="/assets/index-Bs8l37SR.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-Z91z6SlN.css">
   </head>
   <body>

package/packages/piagent-webui/gateway/update-center.ts

@@ -10,13 +10,14 @@ import { compareReleaseVersions, releaseVersion, writeUpdateCache } from "../../
 // past the version the newest Piagent pins (its peer dependency): that is the
 // host its managed runtime is qualified on. A newer Pi is shown as untested.
 //
-// The registry is asked in the background, at most every 6 hours unless the
+// The registry is asked in the background, at most every hour unless the
 // member asks now; the dashboard reads the cached answer. Everything read from
 // outside (registry answers, the cache and job files any local process could
 // write) is accepted only as release versions and known codes.
 const PLATFORM = "@piagent/platform";
 const HOST = "@earendil-works/pi-coding-agent";
-export const CHECK_EVERY_MS = 6 * 60 * 60 * 1000;
+// Releases ship several times a day; members should hear within the hour.
+export const CHECK_EVERY_MS = 60 * 60 * 1000;
 const FORCED_CHECK_GAP_MS = 30_000;
 const PROBE_TIMEOUT_MS = 20_000;
 const MAX_FILE_BYTES = 4096;

package/packages/piagent-webui/server/loopback-server.ts

@@ -448,6 +448,7 @@ export async function startLoopbackServer(options: {
   });
   const address = server.address();
   if (!address || typeof address === "string" || address.address !== "127.0.0.1") { server.close(); throw new Error("loopback-bind-failed"); }
+  auth.bindPort(address.port);
   origin = `http://127.0.0.1:${address.port}`;
   return {
     origin,

package/packages/piagent-webui/server/session-auth.ts

@@ -1,6 +1,10 @@
 import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import type { IncomingMessage } from "node:http";
 
+// Cookies are scoped by host, not by port: every Piagent server on 127.0.0.1
+// (the Gateway, a company service, an older launch) shares one cookie jar.
+// The name carries the port once bound, so one server's launch no longer
+// replaces the session of another server's open tab.
 const SESSION_COOKIE = "piagent_webui_session";
 
 function secret(): string { return randomBytes(32).toString("base64url"); }
@@ -23,6 +27,7 @@ export class SessionAuthority {
   readonly #bootstrapTtlMs: number;
   readonly #sessionTtlMs: number;
   readonly #cookieSigningKey = randomBytes(32);
+  #cookieName = SESSION_COOKIE;
   #bootstraps = new Map<string, number>();
   #sessions = new Map<string, BrowserSession>();
 
@@ -33,6 +38,12 @@ export class SessionAuthority {
   }
 
   get bootstrapCapability(): string { return this.#initialBootstrap; }
+  get cookieName(): string { return this.#cookieName; }
+
+  bindPort(port: number): void {
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) throw new Error("invalid-session-port");
+    this.#cookieName = `${SESSION_COOKIE}_${port}`;
+  }
 
   issueBootstrapCapability(now = Date.now()): string {
     for (const [value, createdAt] of this.#bootstraps) {
@@ -54,7 +65,7 @@ export class SessionAuthority {
   }
 
   authenticate(request: IncomingMessage, now = Date.now()): BrowserSession | null {
-    const value = cookie(request, SESSION_COOKIE);
+    const value = cookie(request, this.#cookieName);
     if (!value) return null;
     const separator = value.lastIndexOf(".");
     if (separator < 1) return null;
@@ -77,7 +88,7 @@ export class SessionAuthority {
   cookieHeader(session: BrowserSession): string {
     const seconds = Math.max(1, Math.floor((session.expiresAt - Date.now()) / 1000));
     const token = `${session.id}.${this.#cookieSignature(session.id)}`;
-    return `${SESSION_COOKIE}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${seconds}`;
+    return `${this.#cookieName}=${token}; HttpOnly; SameSite=Strict; Path=/; Max-Age=${seconds}`;
   }
 
   #cookieSignature(id: string): string {