@piagent/platform 1.32.0 → 1.33.0

package/packages/piagent-webui/dist/client/index.html

@@ -7,7 +7,7 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-B3ODBFGj.js"></script>
+    <script type="module" crossorigin src="/assets/index-CZ02zZjO.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-B5XOKQy-.css">
   </head>
   <body>

package/packages/piagent-webui/server/loopback-server.ts

@@ -112,6 +112,7 @@ export async function startLoopbackServer(options: {
     // Charging every tab and every prior launch to one localhost IP lets a
     // refresh or an unauthenticated local process lock out the active operator.
     const browserSession = auth.authenticate(request, now);
+    if (browserSession && auth.renew(browserSession, now)) response.setHeader("Set-Cookie", auth.cookieHeader(browserSession));
     const rateKey = browserSession ? `${remote}:${browserSession.id}` : `remote:${remote}`;
     for (const [key, value] of rates) if (now - value.windowStart >= 60_000) rates.delete(key);
     const rate = rates.get(rateKey) ?? { windowStart: now, requests: 0, bootstrapFailures: 0 };

package/packages/piagent-webui/server/session-auth.ts

@@ -20,20 +20,23 @@ function cookie(request: IncomingMessage, name: string): string | null {
   return null;
 }
 
-export type BrowserSession = { id: string; csrf: string; expiresAt: number };
+export type BrowserSession = { id: string; csrf: string; expiresAt: number; startedAt: number };
 
 export class SessionAuthority {
   readonly #initialBootstrap: string;
   readonly #bootstrapTtlMs: number;
   readonly #sessionTtlMs: number;
+  readonly #sessionMaxMs: number;
   readonly #cookieSigningKey = randomBytes(32);
   #cookieName = SESSION_COOKIE;
   #bootstraps = new Map<string, number>();
   #sessions = new Map<string, BrowserSession>();
 
-  constructor(options: { now?: number; bootstrapTtlMs?: number; sessionTtlMs?: number } = {}) {
+  constructor(options: { now?: number; bootstrapTtlMs?: number; sessionTtlMs?: number; sessionMaxMs?: number } = {}) {
     this.#bootstrapTtlMs = options.bootstrapTtlMs ?? 60_000;
+    // 8 hours unused; a tab in use is renewed (renew), up to 7 days.
     this.#sessionTtlMs = options.sessionTtlMs ?? 8 * 60 * 60_000;
+    this.#sessionMaxMs = options.sessionMaxMs ?? 7 * 24 * 60 * 60_000;
     this.#initialBootstrap = this.issueBootstrapCapability(options.now ?? Date.now());
   }
 
@@ -59,7 +62,7 @@ export class SessionAuthority {
     const match = [...this.#bootstraps].find(([value, createdAt]) => now <= createdAt + this.#bootstrapTtlMs && equal(candidate, value));
     if (!match) return null;
     this.#bootstraps.delete(match[0]);
-    const session = { id: randomUUID(), csrf: secret(), expiresAt: now + this.#sessionTtlMs };
+    const session = { id: randomUUID(), csrf: secret(), expiresAt: now + this.#sessionTtlMs, startedAt: now };
     this.#sessions.set(session.id, session);
     return session;
   }
@@ -79,6 +82,16 @@ export class SessionAuthority {
     return session;
   }
 
+  // A session ended 8 hours after its launch even while its tab was in use:
+  // a turn that ran or hung that long ended on the expired screen. An open
+  // tab asks every minute, so past half its time a request moves the expiry
+  // on, within the cap; true when the caller must send the cookie again.
+  renew(session: BrowserSession, now = Date.now()): boolean {
+    const next = Math.min(now + this.#sessionTtlMs, session.startedAt + this.#sessionMaxMs);
+    if (next - session.expiresAt < this.#sessionTtlMs / 2) return false;
+    session.expiresAt = next; return true;
+  }
+
   authorizeMutation(request: IncomingMessage, now = Date.now()): BrowserSession | null {
     const session = this.authenticate(request, now);
     const csrf = request.headers["x-piagent-csrf"];

package/scripts/check-runtime-advisories.mjs

@@ -45,7 +45,8 @@ if (report.auditReportVersion !== 2) {
   process.exit(1);
 }
 
-const { exceptions } = JSON.parse(fs.readFileSync(new URL("./runtime-advisory-exceptions.json", import.meta.url), "utf8"));
+// PIAGENT_ADVISORY_EXCEPTIONS points the tests at a fixture list.
+const { exceptions } = JSON.parse(fs.readFileSync(process.env.PIAGENT_ADVISORY_EXCEPTIONS || new URL("./runtime-advisory-exceptions.json", import.meta.url), "utf8"));
 // A test seam for the day exceptions are judged on; the gate uses today (UTC).
 const today = process.env.PIAGENT_ADVISORY_TODAY ?? new Date().toISOString().slice(0, 10);
 

package/scripts/runtime-advisory-exceptions.json

@@ -1,29 +1,4 @@
 {
   "version": 1,
-  "exceptions": [
-    {
-      "id": "GHSA-q2hr-2g5m-vwhr",
-      "package": "brace-expansion",
-      "node": "node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion",
-      "decided": "2026-10-02",
-      "until": "2026-10-31",
-      "reason": "Denial of service (CPU) through a crafted brace pattern in a glob; no data exposure. brace-expansion 5.0.9 is pinned by the npm-shrinkwrap of every published Pi host (0.87.1 to 1.0.0), so no Piagent change can update it; 5.0.12 fixes it. Remove when a Pi host carries brace-expansion >= 5.0.12."
-    },
-    {
-      "id": "GHSA-qhr7-859c-m2p7",
-      "package": "brace-expansion",
-      "node": "node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion",
-      "decided": "2026-10-02",
-      "until": "2026-10-31",
-      "reason": "Denial of service (stack exhaustion) through nested brace groups in a glob; no data exposure. Pinned by the Pi host's npm-shrinkwrap as above; fixed in 5.0.11."
-    },
-    {
-      "id": "GHSA-6j4f-fj2g-mc7p",
-      "package": "brace-expansion",
-      "node": "node_modules/@earendil-works/pi-coding-agent/node_modules/brace-expansion",
-      "decided": "2026-10-02",
-      "until": "2026-10-31",
-      "reason": "Denial of service (stack exhaustion) in parseCommaParts; no data exposure. Pinned by the Pi host's npm-shrinkwrap as above; fixed in 5.0.10."
-    }
-  ]
+  "exceptions": []
 }

package/scripts/verify-local.sh

@@ -641,8 +641,8 @@ if (!rootPkg.pi.subagents?.agents?.length) {
   throw new Error("root package.json missing pi.subagents.agents");
 }
 const expectedPeers = {
-  "@earendil-works/pi-ai": "0.87.1",
-  "@earendil-works/pi-coding-agent": "0.87.1",
+  "@earendil-works/pi-ai": "1.3.0",
+  "@earendil-works/pi-coding-agent": "1.3.0",
   typebox: "1.3.27"
 };
 for (const [name, version] of Object.entries(expectedPeers)) {

package/scripts/verify-release-identity.mjs

@@ -58,7 +58,7 @@ const packageLock = readJson("package-lock.json");
 const capabilityLock = readJson(".pi/piagent-profile.lock.json");
 const version = rootPackage.version;
 const expectedTag = `v${version}`;
-const supportedPiHost = "0.87.1";
+const supportedPiHost = "1.3.0";
 
 // The package is published now, so the old private-forever rule is gone. What
 // still has to hold is that a scoped package cannot reach the registry as