@qt4798/pi-web 0.17.11 → 0.17.12

package/.next/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":13496225,"timestamp":304901346623,"id":14,"parentId":1,"tags":{},"startTime":1789150145132,"traceId":"5e98cd14d676697c"},{"name":"run-typescript","duration":3282889,"timestamp":304914845271,"id":916,"parentId":1,"tags":{},"startTime":1789150158630,"traceId":"5e98cd14d676697c"},{"name":"static-check","duration":1626527,"timestamp":304918133611,"id":919,"parentId":1,"tags":{},"startTime":1789150161919,"traceId":"5e98cd14d676697c"},{"name":"static-generation","duration":2121902,"timestamp":304919861746,"id":1119,"parentId":1,"tags":{},"startTime":1789150163648,"traceId":"5e98cd14d676697c"},{"name":"collect-build-traces","duration":16029596,"timestamp":304919761546,"id":1116,"parentId":1,"tags":{},"startTime":1789150163547,"traceId":"5e98cd14d676697c"},{"name":"output-standalone","duration":1552515,"timestamp":304935791415,"id":1127,"parentId":1,"tags":{},"startTime":1789150179579,"traceId":"5e98cd14d676697c"},{"name":"telemetry-flush","duration":14,"timestamp":304937345589,"id":1130,"parentId":1,"tags":{},"startTime":1789150181133,"traceId":"5e98cd14d676697c"},{"name":"next-build","duration":36353005,"timestamp":304900992601,"id":1,"tags":{"buildMode":"default","version":"16.3.1","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1789150144778,"traceId":"5e98cd14d676697c"}]
+[{"name":"run-webpack","duration":14338442,"timestamp":332515778484,"id":14,"parentId":1,"tags":{},"startTime":1789177759529,"traceId":"2f72d34f606d37f4"},{"name":"run-typescript","duration":2970649,"timestamp":332530119189,"id":916,"parentId":1,"tags":{},"startTime":1789177773870,"traceId":"2f72d34f606d37f4"},{"name":"static-check","duration":1286373,"timestamp":332533096475,"id":919,"parentId":1,"tags":{},"startTime":1789177776847,"traceId":"2f72d34f606d37f4"},{"name":"static-generation","duration":2140316,"timestamp":332534486279,"id":1119,"parentId":1,"tags":{},"startTime":1789177778237,"traceId":"2f72d34f606d37f4"},{"name":"collect-build-traces","duration":15776393,"timestamp":332534385173,"id":1116,"parentId":1,"tags":{},"startTime":1789177778136,"traceId":"2f72d34f606d37f4"},{"name":"output-standalone","duration":1569130,"timestamp":332550189148,"id":1127,"parentId":1,"tags":{},"startTime":1789177793940,"traceId":"2f72d34f606d37f4"},{"name":"telemetry-flush","duration":13,"timestamp":332551759793,"id":1130,"parentId":1,"tags":{},"startTime":1789177795511,"traceId":"2f72d34f606d37f4"},{"name":"next-build","duration":36613802,"timestamp":332515146008,"id":1,"tags":{"buildMode":"default","version":"16.3.1","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1789177758896,"traceId":"2f72d34f606d37f4"}]

package/bin/pi-web.js

@@ -8,6 +8,8 @@ const path = require("path");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const fs = require("fs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const os = require("os");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const { parseLaunchOptions, assessLanExposure } = require("./pi-web-options");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { wireChildProcessLifecycle } = require("./process-lifecycle");
@@ -52,6 +54,51 @@ try {
   }
 }
 
+/**
+ * Load configuration from the user's home, not the install directory.
+ *
+ * A `.env` next to the package is lost on every `npm install -g`
+ * (the install directory is replaced wholesale), which silently drops the
+ * password and host allowlist. Reading from `~/.pi/` keeps the settings across
+ * upgrades. Values already present in the environment win, so a supervisor can
+ * still override a single variable.
+ */
+function loadUserEnv() {
+  const candidates = [
+    path.join(os.homedir(), ".pi", "agent", "pi-web.env"),
+    path.join(os.homedir(), ".pi", "pi-web.env"),
+  ];
+  const file = candidates.find((candidate) => fs.existsSync(candidate));
+  if (!file) return null;
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  const applied = [];
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) continue;
+    const key = trimmed.slice(0, separator).trim();
+    let value = trimmed.slice(separator + 1).trim();
+    // Strip one layer of matching quotes, as dotenv does.
+    if (value.length >= 2 && ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'")))) {
+      value = value.slice(1, -1);
+    }
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    if (process.env[key] !== undefined) continue;
+    process.env[key] = value;
+    applied.push(key);
+  }
+  return { file, applied };
+}
+
+// Before option parsing, so a port or host recorded in the file takes effect.
+const userEnv = loadUserEnv();
+
 let launchOptions;
 try {
   launchOptions = parseLaunchOptions();
@@ -66,6 +113,11 @@ if (launchOptions.help) {
 }
 const { port, hostname, openBrowser } = launchOptions;
 
+if (userEnv) {
+  // Names only — never echo values into a log that may be captured.
+  console.log(`Loaded ${userEnv.applied.length} setting(s) from ${userEnv.file}${userEnv.applied.length ? `: ${userEnv.applied.join(", ")}` : ""}`);
+}
+
 // Apply the same heap cap as the npm scripts so `pi-web` (production entry)
 // never lets the V8 heap balloon to Next.js's auto 50%-of-RAM default.
 const { mergedNodeOptions } = require("./with-memory-limit");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qt4798/pi-web",
-  "version": "0.17.11",
+  "version": "0.17.12",
   "description": "Web workspace for the pi coding agent",
   "homepage": "https://github.com/t479842598/pi-web-QT#readme",
   "repository": {