@qt4798/pi-web 0.18.11 → 0.18.13

package/.next/trace-build

@@ -1 +1 @@
-[{"name":"run-webpack","duration":87365054,"timestamp":96382725621,"id":14,"parentId":1,"tags":{},"startTime":1790523067360,"traceId":"979adc911b95e5d6"},{"name":"run-typescript","duration":20826820,"timestamp":96470148610,"id":18321,"parentId":1,"tags":{},"startTime":1790523154784,"traceId":"979adc911b95e5d6"},{"name":"static-check","duration":4418567,"timestamp":96490990701,"id":18324,"parentId":1,"tags":{},"startTime":1790523175626,"traceId":"979adc911b95e5d6"},{"name":"static-generation","duration":4001123,"timestamp":96495759831,"id":18530,"parentId":1,"tags":{},"startTime":1790523180395,"traceId":"979adc911b95e5d6"},{"name":"collect-build-traces","duration":34462197,"timestamp":96495415103,"id":18527,"parentId":1,"tags":{},"startTime":1790523180050,"traceId":"979adc911b95e5d6"},{"name":"output-standalone","duration":4171607,"timestamp":96529877916,"id":18538,"parentId":1,"tags":{},"startTime":1790523214513,"traceId":"979adc911b95e5d6"},{"name":"telemetry-flush","duration":49,"timestamp":96534058175,"id":18541,"parentId":1,"tags":{},"startTime":1790523218693,"traceId":"979adc911b95e5d6"},{"name":"next-build","duration":151467234,"timestamp":96382591000,"id":1,"tags":{"buildMode":"default","version":"16.3.6","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1790523067225,"traceId":"979adc911b95e5d6"}]
+[{"name":"run-webpack","duration":80717446,"timestamp":213926471571,"id":14,"parentId":1,"tags":{},"startTime":1791040210038,"traceId":"25b023912ecd0716"},{"name":"run-typescript","duration":15348693,"timestamp":214007209920,"id":18322,"parentId":1,"tags":{},"startTime":1791040290777,"traceId":"25b023912ecd0716"},{"name":"static-check","duration":5848786,"timestamp":214022576785,"id":18325,"parentId":1,"tags":{},"startTime":1791040306144,"traceId":"25b023912ecd0716"},{"name":"static-generation","duration":5544919,"timestamp":214028920696,"id":18531,"parentId":1,"tags":{},"startTime":1791040312488,"traceId":"25b023912ecd0716"},{"name":"collect-build-traces","duration":41451080,"timestamp":214028432664,"id":18528,"parentId":1,"tags":{},"startTime":1791040312000,"traceId":"25b023912ecd0716"},{"name":"output-standalone","duration":3774277,"timestamp":214069884223,"id":18539,"parentId":1,"tags":{},"startTime":1791040353451,"traceId":"25b023912ecd0716"},{"name":"telemetry-flush","duration":32,"timestamp":214073664684,"id":18542,"parentId":1,"tags":{},"startTime":1791040357232,"traceId":"25b023912ecd0716"},{"name":"next-build","duration":147255071,"timestamp":213926409652,"id":1,"tags":{"buildMode":"default","version":"16.3.6","bundler":"webpack","has-custom-webpack-config":"false","use-build-worker":"true"},"startTime":1791040209976,"traceId":"25b023912ecd0716"}]

package/bin/fix-pi-agent-undici.js

@@ -73,8 +73,10 @@ function applyUndiciFix(rootDir = path.join(__dirname, ".."), opts = {}) {
   if (!fs.existsSync(topUndici)) return;
 
   try {
-    const nestedVersion = require(path.join(nestedUndici, "package.json")).version;
-    const topVersion = require(path.join(topUndici, "package.json")).version;
+    // Read the manifests as data (never require() a path built from config —
+    // requiring would execute module code from an externally-resolved location).
+    const nestedVersion = JSON.parse(fs.readFileSync(path.join(nestedUndici, "package.json"), "utf8")).version;
+    const topVersion = JSON.parse(fs.readFileSync(path.join(topUndici, "package.json"), "utf8")).version;
     // Already a real dir with the correct version → nothing to do.
     if (!nestedIsSymlink && nestedVersion === topVersion) return;
 

package/bin/memory-watchdog.js

@@ -36,7 +36,6 @@ function resolveConfig(env) {
   if (!Number.isFinite(port) || port <= 0) return null;
   return {
     port,
-    hostname: env.PI_WEB_HOSTNAME || "127.0.0.1",
     restartMb: parsePositiveInt(rawRestart, DEFAULT_RESTART_MB, 1),
     checkMinutes: parsePositiveInt(env.PI_WEB_RSS_CHECK_MINUTES, DEFAULT_CHECK_MINUTES, 1),
   };
@@ -52,7 +51,17 @@ function basicAuthHeaders(env) {
 }
 
 async function isServerIdle(config, env) {
-  const res = await fetch(`http://${config.hostname}:${config.port}/api/agent/running`, {
+  // Literal loopback origin: the watchdog self-checks THIS process, which
+  // always answers on 127.0.0.1 regardless of the LAN bind address (-H), so
+  // the probe target is never derived from the environment. Only the port is
+  // injected, as a validated numeric URL component.
+  const probeUrl = new URL("/api/agent/running", "http://127.0.0.1");
+  const port = Number.isFinite(config.port) && config.port >= 1024 && config.port <= 65535
+    ? config.port
+    : 0;
+  if (!port) return null;
+  probeUrl.port = String(port);
+  const res = await fetch(probeUrl, {
     headers: basicAuthHeaders(env),
     signal: AbortSignal.timeout(RUNNING_CHECK_TIMEOUT_MS),
   });

package/bin/pi-web.js

@@ -182,7 +182,9 @@ child.stdout.on("data", (chunk) => {
     if (isWindows) {
       // `start` is a cmd.exe built-in, so invoke cmd directly. The empty
       // title argument is required by `start` before the target URL.
-      opener = spawn(process.env.ComSpec || "cmd.exe", ["/c", "start", "", url], {
+      // Literal "cmd.exe" (not %ComSpec%): the system shell is a fixed
+      // program, never taken from the environment.
+      opener = spawn("cmd.exe", ["/c", "start", "", url], {
         stdio: "ignore",
         detached: true,
       });

package/bin/with-memory-limit.js

@@ -6,64 +6,45 @@ const { spawnSync } = require("child_process");
 /** Keep the V8 heap from ballooning during local runs. Next.js dev auto-sets
  *  --max-old-space-size to 50% of physical RAM (12GB on a 24GB machine)
  *  unless the user already capped it. A 3GB cap makes GC engage earlier and
- *  bounds RSS growth for both dev and production start.
- */
-const MEMORY_LIMIT_MB = 3072;
-const SEMI_SPACE_MB = 128;
-
-/**
- * Merge a heap cap into an existing NODE_OPTIONS value. If the user already
- * set --max-old-space-size explicitly, theirs wins (we only add the semi-space
- * hint); otherwise we append both flags so V8 and Next.js see a hard cap.
+ *  bounds RSS growth for both dev and production start. Also consumed by
+ *  bin/pi-web.js to seed NODE_OPTIONS before spawning the server.
  */
 function mergedNodeOptions(existing) {
   const base = existing ?? "";
   const hasHeapLimit = /(^|\s)--max-old-space-size=\d+/.test(base);
-  const flags = hasHeapLimit ? [] : [`--max-old-space-size=${MEMORY_LIMIT_MB}`, `--max-semi-space-size=${SEMI_SPACE_MB}`];
+  const flags = hasHeapLimit ? [] : [`--max-old-space-size=3072`, `--max-semi-space-size=128`];
   return [...flags, base].filter(Boolean).join(" ");
 }
 
-module.exports = { mergedNodeOptions, MEMORY_LIMIT_MB, SEMI_SPACE_MB };
+module.exports = { mergedNodeOptions };
+
+// CLI: with-memory-limit <task> — runs a fixed Next.js task with the capped
+// heap. Each task is a fully literal spawn (constant program, constant argv,
+// relative to the package root that npm scripts guarantee as cwd), so nothing
+// from the command line or environment ever reaches a spawn. The heap cap
+// rides as literal V8 flags in argv, which take precedence over any inherited
+// NODE_OPTIONS for this process tree.
 
-// CLI: with-memory-limit <cmd> [args...] — runs cmd with the capped heap.
-// Child processes spawned by cmd inherit NODE_OPTIONS, so next dev / next
-// start and their next-server children all see the same limit.
 if (require.main === module) {
-  const [cmd, ...args] = process.argv.slice(2);
-  if (!cmd) {
-    console.error("usage: node bin/with-memory-limit.js <cmd> [args...]");
-    process.exit(1);
-  }
-  const env = { ...process.env, NODE_OPTIONS: mergedNodeOptions(process.env.NODE_OPTIONS) };
+  const [taskName] = process.argv.slice(2);
   let result;
-  if (process.platform === "win32") {
-    // spawnSync cannot execute npm's extensionless .bin shims on Windows
-    // (ENOENT), and .cmd shims need cmd.exe (EINVAL since the Node CVE fix).
-    // Prefer the .cmd/.bat sibling and run it through %ComSpec%.
-    const fs = require("fs");
-    let target = cmd;
-    if (!/\.(exe|cmd|bat)$/i.test(target)) {
-      for (const ext of [".cmd", ".bat"]) {
-        if (fs.existsSync(target + ext)) {
-          target += ext;
-          break;
-        }
-      }
-    }
-    if (/\.(cmd|bat)$/i.test(target)) {
-      // cmd.exe parses `/` as a switch character, so hand it a native path.
-      const native = require("path").win32.normalize(target);
-      const quote = (a) => (/["&<>^|()%!?\s]/.test(a) ? `"${a}"` : a);
-      const line = [native, ...args].map(quote).join(" ");
-      result = spawnSync(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", line], {
-        stdio: "inherit",
-        env,
-      });
-    } else {
-      result = spawnSync(target, args, { stdio: "inherit", env });
-    }
+  if (taskName === "nextDev") {
+    result = spawnSync("node", [
+      "--max-old-space-size=3072",
+      "--max-semi-space-size=128",
+      "node_modules/next/dist/bin/next",
+      "dev", "-H", "127.0.0.1", "-p", "0", "--turbopack",
+    ], { stdio: "inherit" });
+  } else if (taskName === "nextStart") {
+    result = spawnSync("node", [
+      "--max-old-space-size=3072",
+      "--max-semi-space-size=128",
+      "node_modules/next/dist/bin/next",
+      "start", "-H", "127.0.0.1", "-p", "0",
+    ], { stdio: "inherit" });
   } else {
-    result = spawnSync(cmd, args, { stdio: "inherit", env });
+    console.error("usage: node bin/with-memory-limit.js nextDev|nextStart");
+    process.exit(1);
   }
   if (result.error) {
     console.error(`with-memory-limit: ${result.error.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qt4798/pi-web",
-  "version": "0.18.11",
+  "version": "0.18.13",
   "description": "Web workspace for the pi coding agent",
   "homepage": "https://github.com/t479842598/pi-web-QT#readme",
   "repository": {
@@ -30,14 +30,14 @@
     "package.json"
   ],
   "scripts": {
-    "dev": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js node_modules/.bin/next dev -H 127.0.0.1 -p 0 --turbopack",
+    "dev": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js nextDev",
     "dev:lan": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js node_modules/.bin/next dev -H 0.0.0.0 -p 0 --turbopack",
     "postinstall": "node bin/prepare-terminal.js",
     "theme:css": "node scripts/generate-theme-css.mjs",
     "prebuild": "node scripts/generate-theme-css.mjs",
     "build": "env -u TURBOPACK -u __NEXT_PRIVATE_STANDALONE_CONFIG next build --webpack",
     "bundle:backend": "node scripts/bundle-backend.mjs",
-    "start": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js node_modules/.bin/next start -H 127.0.0.1 -p 0",
+    "start": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js nextStart",
     "start:lan": "node bin/fix-pi-agent-undici.js && node bin/with-memory-limit.js node_modules/.bin/next start -H 0.0.0.0 -p 0",
     "lint": "eslint .",
     "release": "npm version patch --no-git-tag-version && npm run build && npm publish --access public",