@piagent/platform 1.41.0 → 1.42.1

package/packages/piagent-webui/dist/client/assets/view-model-CWNiS4JN.js

@@ -0,0 +1 @@
+var e={active:`Đang hoạt động`,"pause-requested":`Đang yêu cầu tạm dừng`,paused:`Đã tạm dừng`,terminal:`Đã kết thúc`,idle:`Đang chờ`,running:`Đang chạy`,stopping:`Đang dừng`,settled:`Đã ổn định`,unknown:`Chưa xác định`,pending:`Chưa xong`,completed:`Hoàn thành`,blocked:`Bị chặn`,partial:`Một phần`,failed:`Thất bại`,satisfied:`Đã đạt`,unavailable:`Không có dữ liệu`,connected:`Đã kết nối`,disconnected:`Mất kết nối`,reconnecting:`Đang kết nối lại`,"resync-required":`Cần đồng bộ lại`,none:`Không có`,waiting:`Đang chờ duyệt`,current:`Mới nhất`,stale:`Đã cũ`,"not-run":`Chưa chạy`,"in-progress":`Đang làm`,done:`Đã xong`,skipped:`Bỏ qua`,resume:`Tiếp tục`,retry:`Thử lại`,observed:`Đã ghi nhận`,requested:`Đã yêu cầu`,"possible-interruption":`Có thể bị gián đoạn`,complete:`Đầy đủ`,"aggregate-only":`Chỉ có dữ liệu tổng hợp`,off:`Tắt`,minimal:`Tối thiểu`,low:`Thấp`,medium:`Trung bình`,high:`Cao`,xhigh:`Rất cao`,max:`Tối đa`,orphaned:`Mất owner`,cancelled:`Đã hủy`,succeeded:`Thành công`,"stale-result":`Kết quả đến muộn`,accepted:`Đã nhận`,rejected:`Không nhận`,"not-recorded":`Chưa có kết quả`,parent:`Task cha`,helper:`Helper`,"read-only":`Chỉ đọc`,"workspace-write":`Ghi trong project`,"trusted-full-access":`Toàn quyền`,bypass:`Bypass`,"single-writer":`Một writer`,retriever:`Retriever`,scout:`Scout`,planner:`Planner`,worker:`Worker`,reviewer:`Reviewer`,oracle:`Oracle`,researcher:`Researcher`,ready:`Sẵn sàng`,missing:`Chưa có bằng chứng`,interrupted:`Bị gián đoạn`,stopped:`Đã dừng`,aborted:`Đã hủy do lỗi`,incomplete:`Chưa có kết luận`,passed:`Đạt`,"not-applicable":`Không áp dụng`,smoke:`Smoke`,"public-regression":`Public regression`,capability:`Capability`,"private-holdout":`Private holdout`,"production-shadow":`Production shadow`,"pdf-converter-unavailable":`Host chưa cài pdftotext (poppler) nên chưa đọc được .pdf`,"pdf-text-unavailable":`PDF này không có text bóc được; nhiều khả năng là bản scan, cần OCR trước`,"pdf-extraction-failed":`Không chuyển được PDF này sang text`,"docx-unreadable":`File .docx này hỏng, bị mã hóa, hoặc không phải file Word thật`,"document-text-empty":`Tài liệu không có chữ nào để đọc`,"document-size-limit":`Tài liệu vượt giới hạn dung lượng`,"text-size-limit":`File text vượt giới hạn dung lượng`,"text-content-invalid":`Nội dung file không phải văn bản (file nhị phân), chưa gửi vào chat được`,"image-mime-mismatch":`Nội dung ảnh không khớp với đuôi file`,"model-image-input-unavailable":`Model hiện tại không nhận ảnh`,"attachment-capacity-limit":`Đã chạm giới hạn số file hoặc dung lượng đính kèm`,"no-readable-root":`Chưa có thư mục nào đọc được`,"document-roots-unavailable":`Không xác định được thư mục tài liệu`,"document-not-listed":`Tài liệu không còn trong danh sách; hãy tải lại`,"document-unavailable":`Không mở được tài liệu này`,"document-protected":`Tài liệu nằm trong protectedPaths nên không được đọc`,"document-changed":`File đã thay đổi sau khi liệt kê; chưa đọc gì cả`,"document-unreadable":`Không đọc được nội dung tài liệu`,"document-needs-ocr":`Tài liệu là bản scan, cần OCR trước khi đọc được chữ`,"document-converter-unavailable":`Host chưa cài pdftotext (poppler) nên chưa đọc được .pdf`,"session-command-effect-unknown":`Pi đã nhận yêu cầu nhưng đang đồng bộ trạng thái; không gửi lại để tránh chạy trùng`},t={active:`Active`,"pause-requested":`Pause requested`,paused:`Paused`,terminal:`Finished`,idle:`Idle`,running:`Running`,stopping:`Stopping`,settled:`Settled`,unknown:`Unknown`,pending:`Pending`,completed:`Completed`,blocked:`Blocked`,partial:`Partial`,failed:`Failed`,satisfied:`Satisfied`,unavailable:`Unavailable`,connected:`Connected`,disconnected:`Disconnected`,reconnecting:`Reconnecting`,"resync-required":`Resync required`,none:`None`,waiting:`Awaiting approval`,current:`Current`,stale:`Stale`,"not-run":`Not run`,"in-progress":`In progress`,done:`Done`,skipped:`Skipped`,resume:`Resume`,retry:`Retry`,observed:`Observed`,requested:`Requested`,"possible-interruption":`Possible interruption`,complete:`Complete`,"aggregate-only":`Aggregate only`,off:`Off`,minimal:`Minimal`,low:`Low`,medium:`Medium`,high:`High`,xhigh:`Extra high`,max:`Maximum`,orphaned:`Owner missing`,cancelled:`Cancelled`,succeeded:`Succeeded`,"stale-result":`Stale result`,accepted:`Accepted`,rejected:`Rejected`,"not-recorded":`Not recorded`,parent:`Parent task`,helper:`Helper`,"read-only":`Read only`,"workspace-write":`Workspace write`,"trusted-full-access":`Full access`,bypass:`Bypass`,"single-writer":`Single writer`,retriever:`Retriever`,scout:`Scout`,planner:`Planner`,worker:`Worker`,reviewer:`Reviewer`,oracle:`Oracle`,researcher:`Researcher`,ready:`Ready`,missing:`Evidence missing`,interrupted:`Interrupted`,stopped:`Stopped`,aborted:`Aborted`,incomplete:`Incomplete`,passed:`Passed`,"not-applicable":`Not applicable`,smoke:`Smoke`,"public-regression":`Public regression`,capability:`Capability`,"private-holdout":`Private holdout`,"production-shadow":`Production shadow`,"pdf-converter-unavailable":`This host has no pdftotext (poppler), so .pdf cannot be read`,"pdf-text-unavailable":`This PDF holds no extractable text; it is probably scanned and needs OCR first`,"pdf-extraction-failed":`The PDF could not be converted to text`,"docx-unreadable":`This .docx is corrupt, encrypted, or not really a Word document`,"document-text-empty":`The document contains no readable text`,"document-size-limit":`The document is over the size limit`,"text-size-limit":`The text file is over the size limit`,"text-content-invalid":`The file is not text (binary), so it cannot go into the chat`,"image-mime-mismatch":`The image content does not match its file extension`,"model-image-input-unavailable":`The current model does not accept images`,"attachment-capacity-limit":`The attachment count or size limit was reached`,"no-readable-root":`No readable directory is available`,"document-roots-unavailable":`The document directories could not be resolved`,"document-not-listed":`The document is no longer listed; reload the list`,"document-unavailable":`This document could not be opened`,"document-protected":`The document is under protectedPaths and is not readable`,"document-changed":`The file changed after it was listed; nothing was read`,"document-unreadable":`The document content could not be read`,"document-needs-ocr":`The document is scanned and needs OCR before it holds text`,"document-converter-unavailable":`This host has no pdftotext (poppler), so .pdf cannot be read`,"session-command-effect-unknown":`Pi received the request and is resyncing; do not resend it, to avoid a duplicate run`};function n(n,r=`vi`){return n?(r===`vi`?e:t)[n]??n.replaceAll(`-`,` `):r===`vi`?`Chưa có`:`Not available`}function r(e){return[`completed`,`satisfied`,`current`,`connected`,`done`,`passed`].includes(e??``)?`positive`:[`blocked`,`failed`,`error`,`expired`].includes(e??``)?`danger`:[`pause-requested`,`paused`,`waiting`,`stale`,`stale-result`,`orphaned`,`partial`,`reconnecting`].includes(e??``)?`warning`:[`running`,`active`,`in-progress`].includes(e??``)?`info`:`neutral`}function i(e){return e?e.length>22?`${e.slice(0,10)}…${e.slice(-7)}`:e:`—`}function a(e,t=`vi`){return e.session.model.state===`known`&&e.session.model.value?e.session.model.value.displayName:t===`vi`?`Model chưa xác định`:`Unknown model`}function o(e,t=`vi`){return e.session.thinking.state===`known`&&e.session.thinking.value?n(e.session.thinking.value,t):t===`vi`?`Chưa xác định`:`Unknown`}function s(e,t=`vi`){let r=e.session.permissionProfile;return r.state===`known`&&r.value?n(r.value,t):t===`vi`?`Quyền chưa xác định`:`Unknown permission`}function c(e,t=`vi`){let n=e.relatedFileRefs.length,r=e.verifierAttemptRefs.length;return!n&&!r?t===`vi`?`Chưa có bằng chứng liên kết`:`No linked evidence`:t===`vi`?`${n} file · ${r} lần kiểm tra`:`${n} files · ${r} verifier runs`}function l(e,t=`vi`){let n=e.task;return n?{completed:n.progress.completed,total:n.progress.total,percent:Math.max(0,Math.min(100,n.progress.percent)),text:t===`vi`?`${n.progress.completed}/${n.progress.total} tiêu chí`:`${n.progress.completed}/${n.progress.total} criteria`}:{completed:0,total:0,percent:0,text:t===`vi`?`Chưa có task đang chạy`:`No active task`}}export{s as a,r as c,a as i,c as n,l as o,n as r,o as s,i as t};

package/packages/piagent-webui/dist/client/assets/workspace-navigation-C8GtShbg.js

@@ -0,0 +1 @@
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{Dn as t,In as n,zt as r}from"./vendor-CA5pzJiI.js";import{i,n as a}from"./ui-preferences-Dy4qeODT.js";var o=e(n(),1),s=t(),c=`piagent-workspace-open`;function l(e,t=1){let n=/^(.+?)(?::(\d+)(?::\d+)?)?$/.exec(e.replace(/^@/,``)),r=n?.[1];return!r||r.length>4096||/^[~/]/.test(r)||/[\\\x00-\x1f\x7f:]/.test(r)||r.split(`/`).some(e=>!e||e===`.`||e===`..`)?null:{path:r,line:Math.max(1,Math.min(1e6,Number(n?.[2])||t||1))}}var u=(0,o.createContext)(null);function d({sessionRef:e,onOpen:t,children:n}){return(0,s.jsx)(u.Provider,{value:e?n=>{t(),window.dispatchEvent(new CustomEvent(c,{detail:{sessionRef:e,...n}}))}:null,children:n})}function f({path:e,line:t,children:n}){let c=(0,o.useContext)(u),{locale:d}=i(),f=l(e,t);return!c||!f?n?(0,s.jsx)(s.Fragment,{children:n}):null:(0,s.jsx)(r,{size:`small`,onClick:()=>c(f),sx:{textTransform:`none`,verticalAlign:`baseline`},children:n??a(d,`Mở trong editor`,`Open in editor`)})}function p({children:e}){return(0,s.jsx)(s.Fragment,{children:o.Children.map(e,e=>typeof e==`string`?e.split(/((?<![\w@])@[\w./-]+\.[\w]+(?::\d+)?)/g).map((e,t)=>e.startsWith(`@`)&&l(e)?(0,s.jsx)(f,{path:e,children:e},t):e):e)})}export{l as a,d as i,f as n,p as r,c as t};

package/packages/piagent-webui/dist/client/index.html

@@ -7,16 +7,11 @@
     <meta name="csp-nonce" content="__PIAGENT_CSP_NONCE__" />
     <meta name="piagent-webui-mode" content="__PIAGENT_WEBUI_MODE__" />
     <title>Piagent WebUI</title>
-    <script type="module" crossorigin src="/assets/index-rlyRccut.js"></script>
+    <script type="module" crossorigin src="/assets/index-qi6mjvTy.js"></script>
     <link rel="modulepreload" crossorigin href="/assets/rolldown-runtime-hePW80VL.js">
-    <link rel="modulepreload" crossorigin href="/assets/ui-preferences-BO3AV7QE.js">
-    <link rel="modulepreload" crossorigin href="/assets/useId-DEefKUAT.js">
-    <link rel="modulepreload" crossorigin href="/assets/Typography-B9om7Evq.js">
-    <link rel="modulepreload" crossorigin href="/assets/Alert-DGWhP2MM.js">
-    <link rel="modulepreload" crossorigin href="/assets/DialogTitle-CyaFPaiW.js">
-    <link rel="modulepreload" crossorigin href="/assets/Button-QItfZUNj.js">
-    <link rel="modulepreload" crossorigin href="/assets/bootstrap-CedkNtRG.js">
-    <link rel="stylesheet" crossorigin href="/assets/index-DBUTrEXi.css">
+    <link rel="modulepreload" crossorigin href="/assets/vendor-CA5pzJiI.js">
+    <link rel="modulepreload" crossorigin href="/assets/ui-preferences-Dy4qeODT.js">
+    <link rel="stylesheet" crossorigin href="/assets/index-Dqb2hNan.css">
   </head>
   <body>
     <div id="root"></div>

package/packages/piagent-webui/gateway/signed-session-journal.ts

@@ -2,6 +2,8 @@ import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 
+// Windows uses inherited ACLs in the Gateway profile; Node mode bits do not represent them.
+const POSIX_PERMISSIONS = process.platform !== "win32";
 const MAX_BYTES = 8 * 1024 * 1024, MAX_RECORDS = 4000;
 type SessionRecord = { identity: { sessionRef: string }; idempotencyKeyDigest: string };
 type Journal<T> = { version: 1; sequence: number; records: Array<{ sequence: number; receipt: T }> };
@@ -24,7 +26,7 @@ export class SignedSessionJournal<T extends SessionRecord> {
   }
   #checkDirectory(): void {
     const stat = fs.lstatSync(this.#root);
-    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077)
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (POSIX_PERMISSIONS && (stat.mode & 0o077))
       || typeof process.getuid === "function" && stat.uid !== process.getuid()
       || stat.dev !== this.#directory.dev || stat.ino !== this.#directory.ino) throw new Error("workspace-journal-unsafe");
   }
@@ -37,12 +39,17 @@ export class SignedSessionJournal<T extends SessionRecord> {
   }
   #read(sessionRef: string): Journal<T> {
     this.#checkDirectory();
-    let descriptor: number;
-    try { descriptor = fs.openSync(this.#file(sessionRef), fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK); }
+    let descriptor: number, before: fs.Stats;
+    const file = this.#file(sessionRef);
+    try {
+      before = fs.lstatSync(file);
+      if (!before.isFile() || before.isSymbolicLink()) throw new Error("workspace-journal-unsafe");
+      descriptor = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
+    }
     catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return { version: 1, sequence: 0, records: [] }; throw error; }
     try {
       const stat = fs.fstatSync(descriptor);
-      if (!stat.isFile() || stat.nlink !== 1 || stat.size > MAX_BYTES || (stat.mode & 0o077)
+      if (!stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino || stat.nlink !== 1 || stat.size > MAX_BYTES || (POSIX_PERMISSIONS && (stat.mode & 0o077))
         || typeof process.getuid === "function" && stat.uid !== process.getuid()) throw new Error("workspace-journal-unsafe");
       const { value, mac } = JSON.parse(fs.readFileSync(descriptor, "utf8")) as { value: Journal<T>; mac: string };
       if (!value || typeof mac !== "string" || !/^[a-f0-9]{64}$/.test(mac) || !timingSafeEqual(Buffer.from(mac, "hex"), Buffer.from(this.#sign(sessionRef, value), "hex"))
@@ -70,8 +77,11 @@ export class SignedSessionJournal<T extends SessionRecord> {
       descriptor = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
       fs.writeFileSync(descriptor, bytes); fs.fsyncSync(descriptor); fs.closeSync(descriptor); descriptor = undefined;
       this.#checkDirectory(); fs.renameSync(temporary, this.#file(sessionRef));
-      const directory = fs.openSync(this.#root, fs.constants.O_RDONLY);
-      try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
+      // Windows cannot open a directory with the Node read-only file API.
+      if (process.platform !== "win32") {
+        const directory = fs.openSync(this.#root, fs.constants.O_RDONLY);
+        try { fs.fsyncSync(directory); } finally { fs.closeSync(directory); }
+      }
     } finally { if (descriptor !== undefined) fs.closeSync(descriptor); fs.rmSync(temporary, { force: true }); }
   }
 }

package/packages/piagent-webui/server/loopback-server.ts

@@ -36,12 +36,27 @@ export type LoopbackServer = {
   close(): Promise<void>;
 };
 
-function serveAsset(response: ServerResponse, asset: StaticAsset): void {
+function acceptsGzip(header: string | undefined): boolean {
+  // Opt in only to an explicit gzip token, respecting a refusal/invalid quality.
+  const token = header?.split(",").map(value => value.trim().toLowerCase())
+    .find(value => value.split(";", 1)[0].trim() === "gzip");
+  if (!token) return false;
+  const parameters = token.split(";").slice(1).map(value => value.trim());
+  if (!parameters.length) return true;
+  return parameters.length === 1 && /^q\s*=\s*(?:0(?:\.\d{0,3})?|1(?:\.0{0,3})?)$/.test(parameters[0])
+    && Number(parameters[0].split("=")[1].trim()) > 0;
+}
+
+function serveAsset(response: ServerResponse, asset: StaticAsset, encoding: string | undefined, head: boolean): void {
+  const gzip = asset.gzipBody && acceptsGzip(encoding);
+  const body = gzip ? asset.gzipBody! : asset.body;
   response.statusCode = 200;
   response.setHeader("Cache-Control", "no-store");
   response.setHeader("Content-Type", asset.contentType);
-  response.setHeader("Content-Length", asset.body.length);
-  response.end(asset.body);
+  if (asset.gzipBody) response.setHeader("Vary", "Accept-Encoding");
+  if (gzip) response.setHeader("Content-Encoding", "gzip");
+  response.setHeader("Content-Length", body.length);
+  response.end(head ? undefined : body);
 }
 
 export async function startLoopbackServer(options: {
@@ -453,8 +468,7 @@ export async function startLoopbackServer(options: {
     if (request.method !== "GET" && request.method !== "HEAD") return errorResponse(response, 405, "method-not-allowed");
     const asset = assets.get(url.pathname);
     if (!asset || url.search) return errorResponse(response, 404, "not-found");
-    if (request.method === "HEAD") { response.statusCode = 200; response.setHeader("Content-Type", asset.contentType); return response.end(); }
-    serveAsset(response, asset);
+    serveAsset(response, asset, request.headers["accept-encoding"], request.method === "HEAD");
   });
   const gatewaySocket = options.gatewayProtocol ? attachGatewayWebSocket({
     server, origin: () => origin, authority: auth, protocol: options.gatewayProtocol

package/packages/piagent-webui/server/static-bundle.ts

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import { gzipSync } from "node:zlib";
 
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
 const MAX_TOTAL_BYTES = 16 * 1024 * 1024;
@@ -9,7 +10,7 @@ const MIME = new Map([
   [".svg", "image/svg+xml"], [".woff2", "font/woff2"]
 ]);
 
-export type StaticAsset = { body: Buffer; contentType: string };
+export type StaticAsset = { body: Buffer; contentType: string; gzipBody?: Buffer };
 
 export function loadStaticBundle(root: string): ReadonlyMap<string, StaticAsset> {
   const absoluteRoot = path.resolve(root), rootStat = fs.lstatSync(absoluteRoot);
@@ -30,7 +31,14 @@ export function loadStaticBundle(root: string): ReadonlyMap<string, StaticAsset>
       try {
         const opened = fs.fstatSync(descriptor);
         if (!opened.isFile() || opened.dev !== stat.dev || opened.ino !== stat.ino || opened.size !== stat.size) throw new Error("static-asset-race");
-        assets.set(relative === "index.html" ? "/" : `/${relative}`, { body: fs.readFileSync(descriptor), contentType });
+        const body = fs.readFileSync(descriptor);
+        // Only immutable code/styles. HTML receives a per-server CSP nonce later.
+        // Compression is paid once at startup, never on an API or asset request.
+        const compressed = body.length >= 1024 && [".js", ".css"].includes(path.extname(relative))
+          ? gzipSync(body) : undefined;
+        assets.set(relative === "index.html" ? "/" : `/${relative}`, {
+          body, contentType, gzipBody: compressed && compressed.length < body.length ? compressed : undefined
+        });
       } finally { fs.closeSync(descriptor); }
     }
   };