@rexvane/piweb 0.3.18 → 0.3.19

package/.next/types/app/api/remote/route.ts

@@ -0,0 +1,353 @@
+// File: /home/runner/work/PiWeb/PiWeb/src/app/api/remote/route.ts
+import * as entry from '../../../../../src/app/api/remote/route.js'
+import type { NextRequest } from 'next/server.js'
+
+import type { InstantConfigForTypeCheckInternal, Prefetch } from 'next/dist/build/segment-config/app/app-segment-config.js'
+
+type TEntry = typeof import('../../../../../src/app/api/remote/route.js')
+
+type SegmentParams<T extends Object = any> = T extends Record<string, any>
+  ? { [K in keyof T]: T[K] extends string ? string | string[] | undefined : never }
+  : T
+
+// Check that the entry is a valid entry
+checkFields<Diff<{
+  GET?: Function
+  HEAD?: Function
+  OPTIONS?: Function
+  POST?: Function
+  PUT?: Function
+  DELETE?: Function
+  PATCH?: Function
+  config?: {}
+  generateStaticParams?: Function
+  instant?: InstantConfigForTypeCheckInternal
+  prefetch?: Prefetch
+  unstable_dynamicStaleTime?: number
+  revalidate?: RevalidateRange<TEntry> | false
+  dynamic?: 'auto' | 'force-dynamic' | 'error' | 'force-static'
+  dynamicParams?: boolean
+  fetchCache?: 'auto' | 'force-no-store' | 'only-no-store' | 'default-no-store' | 'default-cache' | 'only-cache' | 'force-cache'
+  /** @deprecated The `preferredRegion` config is deprecated. Remove this export. */
+  preferredRegion?: 'auto' | 'global' | 'home' | string | string[]
+  runtime?: 'nodejs' | 'experimental-edge' | 'edge'
+  maxDuration?: number
+  
+}, TEntry, ''>>()
+
+type RouteContext = { params: Promise<SegmentParams> }
+// Check the prop type of the entry function
+if ('GET' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'GET'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'GET',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'GET',
+        __return_type__: ReturnType<MaybeField<TEntry, 'GET'>>
+      },
+      'GET'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('HEAD' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'HEAD'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'HEAD',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'HEAD',
+        __return_type__: ReturnType<MaybeField<TEntry, 'HEAD'>>
+      },
+      'HEAD'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('OPTIONS' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'OPTIONS'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'OPTIONS',
+        __return_type__: ReturnType<MaybeField<TEntry, 'OPTIONS'>>
+      },
+      'OPTIONS'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('POST' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'POST'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'POST',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'POST',
+        __return_type__: ReturnType<MaybeField<TEntry, 'POST'>>
+      },
+      'POST'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PUT' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PUT'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PUT',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PUT',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PUT'>>
+      },
+      'PUT'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('DELETE' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'DELETE'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'DELETE',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'DELETE',
+        __return_type__: ReturnType<MaybeField<TEntry, 'DELETE'>>
+      },
+      'DELETE'
+    >
+  >()
+}
+// Check the prop type of the entry function
+if ('PATCH' in entry) {
+  checkFields<
+    Diff<
+      ParamCheck<Request | NextRequest>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'first'
+        __param_type__: FirstArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  checkFields<
+    Diff<
+      ParamCheck<RouteContext>,
+      {
+        __tag__: 'PATCH'
+        __param_position__: 'second'
+        __param_type__: SecondArg<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+  
+  checkFields<
+    Diff<
+      {
+        __tag__: 'PATCH',
+        __return_type__: Response | void | never | Promise<Response | void | never>
+      },
+      {
+        __tag__: 'PATCH',
+        __return_type__: ReturnType<MaybeField<TEntry, 'PATCH'>>
+      },
+      'PATCH'
+    >
+  >()
+}
+
+// Check the arguments and return type of the generateStaticParams function
+if ('generateStaticParams' in entry) {
+  checkFields<Diff<{ params: SegmentParams }, FirstArg<MaybeField<TEntry, 'generateStaticParams'>>, 'generateStaticParams'>>()
+  checkFields<Diff<{ __tag__: 'generateStaticParams', __return_type__: any[] | Promise<any[]> }, { __tag__: 'generateStaticParams', __return_type__: ReturnType<MaybeField<TEntry, 'generateStaticParams'>> }>>()
+}
+
+export interface PageProps {
+  params?: Promise<SegmentParams>
+  searchParams?: Promise<any>
+}
+export interface LayoutProps {
+  children?: React.ReactNode
+
+  params?: Promise<SegmentParams>
+}
+
+// =============
+// Utility types
+type RevalidateRange<T> = T extends { revalidate: any } ? NonNegative<T['revalidate']> : never
+
+// If T is unknown or any, it will be an empty {} type. Otherwise, it will be the same as Omit<T, keyof Base>.
+type OmitWithTag<T, K extends keyof any, _M> = Omit<T, K>
+type Diff<Base, T extends Base, Message extends string = ''> = 0 extends (1 & T) ? {} : OmitWithTag<T, keyof Base, Message>
+
+type FirstArg<T extends Function> = T extends (...args: [infer T, any]) => any ? unknown extends T ? any : T : never
+type SecondArg<T extends Function> = T extends (...args: [any, infer T]) => any ? unknown extends T ? any : T : never
+type MaybeField<T, K extends string> = T extends { [k in K]: infer G } ? G extends Function ? G : never : never
+
+type ParamCheck<T> = {
+  __tag__: string
+  __param_position__: string
+  __param_type__: T
+}
+
+function checkFields<_ extends { [k in keyof any]: never }>() {}
+
+// https://github.com/sindresorhus/type-fest
+type Numeric = number | bigint
+type Zero = 0 | 0n
+type Negative<T extends Numeric> = T extends Zero ? never : `${T}` extends `-${string}` ? T : never
+type NonNegative<T extends Numeric> = T extends Zero ? T : Negative<T> extends never ? T : '__invalid_negative_number__'

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/login"
-type AppRouteHandlerRoutes = "/api/agent/[id]" | "/api/agent/[id]/events" | "/api/agent/[id]/tree" | "/api/agent/new" | "/api/config" | "/api/files" | "/api/git" | "/api/growth" | "/api/health" | "/api/models" | "/api/pi-settings" | "/api/plugins" | "/api/prompts" | "/api/security" | "/api/sessions" | "/api/sessions/[id]" | "/api/sessions/[id]/export" | "/api/sessions/import" | "/api/skills" | "/api/update" | "/api/version" | "/api/web-auth" | "/api/workspaces"
+type AppRouteHandlerRoutes = "/api/agent/[id]" | "/api/agent/[id]/events" | "/api/agent/[id]/tree" | "/api/agent/new" | "/api/config" | "/api/files" | "/api/fs" | "/api/git" | "/api/growth" | "/api/health" | "/api/models" | "/api/pi-settings" | "/api/plugins" | "/api/prompts" | "/api/remote" | "/api/security" | "/api/sessions" | "/api/sessions/[id]" | "/api/sessions/[id]/export" | "/api/sessions/import" | "/api/skills" | "/api/update" | "/api/version" | "/api/web-auth" | "/api/workspaces"
 type PageRoutes = never
 type LayoutRoutes = "/"
 type RedirectRoutes = never
@@ -18,6 +18,7 @@ interface ParamMap {
   "/api/agent/new": {}
   "/api/config": {}
   "/api/files": {}
+  "/api/fs": {}
   "/api/git": {}
   "/api/growth": {}
   "/api/health": {}
@@ -25,6 +26,7 @@ interface ParamMap {
   "/api/pi-settings": {}
   "/api/plugins": {}
   "/api/prompts": {}
+  "/api/remote": {}
   "/api/security": {}
   "/api/sessions": {}
   "/api/sessions/[id]": { "id": string; }

package/.next/types/validator.ts

@@ -119,6 +119,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/fs/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/fs">> = Specific
+  const handler = {} as typeof import("../../src/app/api/fs/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/git/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/git">> = Specific
@@ -182,6 +191,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/remote/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/remote">> = Specific
+  const handler = {} as typeof import("../../src/app/api/remote/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/security/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/security">> = Specific

package/README.md

@@ -47,15 +47,9 @@ Sessions grouped by project folder, with a native folder picker (Windows / macOS
 
 <p align="center"><img src="assets/archive.jpg" alt="Archived: archived conversations in one place" width="400" /></p>
 
-### Import Local Sessions
-
-Bring conversation history from Codex, Claude Code, Grok, ZCode, dsh and opencode on this machine into pi sessions without loss: text, thinking, tool calls and their results, timestamps and usage are all kept, and the source data is **read-only** — nothing in the other tools is modified. Each source lists only its 15 most recent **main** conversations; work the main agent handed to a subagent is ignored, because the conversation you want is your own. If the original project directory still exists locally the session lands in that workspace, otherwise it falls back to one you pick — and anything already imported is marked and never imported twice.
-
-<p align="center"><img src="assets/import.jpg" alt="Settings → Import sessions: pick a source, tick, import" width="840" /></p>
-
 ### Project Growth Tree
 
-Every file operation pi makes is snapshotted, grouped one round per message you send. Each round shows what changed **relative to the previous one** — files added, modified and deleted, with line-level diffs one click away — so you can review the work round by round, or drill into single steps inside a round. A round with no file changes says so instead of being skipped, and the record is independent of git: it works on a project with no version history at all.
+Every file operation pi makes is snapshotted, grouped one round per message you send. Each round shows what changed **relative to the previous one** — files added, modified and deleted, with line-level diffs one click away — so you can review the work round by round, or drill into single steps inside a round. A round with no file changes says so instead of being skipped. Each round is stored as a commit in the workspace's own git repository on a private ref (`refs/piweb/rounds/…`), never touching your branches or index; if the folder is not a git repository yet (or is only a subfolder of another one), PiWeb asks before creating one there, remembers the answer per workspace, and records nothing if you decline.
 
 <p align="center"><img src="assets/growth-1.jpg" alt="Project growth tree (1 of 2)" width="840" /></p>
 <p align="center"><img src="assets/growth-2.jpg" alt="Project growth tree (2 of 2)" width="840" /></p>
@@ -92,7 +86,7 @@ Install, update, and uninstall pi packages directly from the UI. Enable/disable
 
 ### Security
 
-Optional login via `PI_WEB_PASSWORD` (required for non-loopback binds), origin validation on write actions, strict path boundary checks, and tool presets (Read Only / Workspace Write / Full Access).
+Launch-token login for anything reachable beyond this machine, origin validation on write actions, strict path boundary checks, and tool presets (Read Only / Workspace Write / Full Access).
 
 ## Usage
 
@@ -132,7 +126,7 @@ This removes PiWeb only — your pi data lives in `~/.pi/agent/` and is left unt
 ```bash
 piweb                    # http://127.0.0.1:30141 (auto-increments if busy)
 piweb -p 30143 --no-open # custom port, don't open the browser
-piweb -H 0.0.0.0         # LAN access (requires PI_WEB_PASSWORD)
+piweb -H 0.0.0.0         # LAN access (launch-token login is enabled automatically)
 ```
 
 | Option | Description |
@@ -141,8 +135,60 @@ piweb -H 0.0.0.0         # LAN access (requires PI_WEB_PASSWORD)
 | `-H, --hostname <host>` | Bind address (default 127.0.0.1, env `PI_WEB_HOSTNAME`) |
 | `--dev` | Development mode |
 | `--no-open` | Do not auto-open the browser |
+| `--public-url <url>` | Public address, used for the login link and added to the Host allowlist automatically (env `PI_WEB_PUBLIC_URL`) |
+
+Authentication is opened by `PI_WEB_AUTH=1` (the launcher sets it by default whenever PiWeb may be reachable from
+outside this machine). Login is **launch-token only**: open the printed `…/?token=…` link, which exchanges the token
+for a signed cookie. `PI_WEB_PASSWORD` has been removed — setting it makes the launcher refuse to start. Do not
+expose PiWeb over plain HTTP.
+
+Scripts authenticate the same way: `GET /?token=…` once to receive the session cookie, then send that cookie with
+every API request. There is no Basic Auth fallback.
+
+### Use it on your phone: the built-in "Remote access" plugin
+
+PiWeb ships a built-in plugin for this. Toggle it in **Settings → Remote access**; nothing is installed on the client.
+
+It has two entry points:
+
+**Local network (on by default)** — a reverse proxy that only adds the mobile layout, bound to `0.0.0.0:30142`.
+Any device on the same Wi-Fi can open one of the addresses listed in the panel and gets the phone layout;
+connecting to `127.0.0.1:30141` on this machine still serves the untouched desktop page.
+
+**Public access (off by default)** — turning it on starts a Cloudflare quick tunnel (`cloudflared`).
+Cloudflare assigns an `https://<random>.trycloudflare.com` address that any browser can open with
+**nothing to install on any device**. Two costs:
+
+- the address changes on every start, and takes about fifteen seconds to resolve worldwide
+  (the panel shows "taking effect" meanwhile);
+- TLS terminates at Cloudflare, so that hop sees plaintext. Use a trusted VPN if you need end-to-end encryption.
+
+`cloudflared` is looked up as: `PIWEB_CLOUDFLARED` → `<agent dir>/web-bin/cloudflared{,.exe}` (managed by PiWeb) → `PATH`.
+The panel says so explicitly when it cannot find it.
+
+> Turning public access on makes authentication mandatory. The plugin adds the tunnel hostname to the Host
+> allowlist once the tunnel is live and removes it when the tunnel stops. The launch token is never accepted
+> on API paths or through the `Authorization` header.
+
+### Bring your own reverse proxy or tunnel
+
+You can front PiWeb yourself instead (Caddy, nginx, a named Cloudflare tunnel, a VPN). In that case:
+
+- Point the proxy at **`127.0.0.1:30142`** (the local-network entry) to get the mobile layout, or at
+  `127.0.0.1:30141` if you only want the desktop page.
+- Set `PI_WEB_AUTH=1`. A loopback bind cannot tell PiWeb that it is exposed, so authentication must be explicit.
+- A reverse proxy passes the external hostname through unchanged, so allowlist it or requests are rejected
+  with 403 `untrusted host`:
+
+  ```bash
+  PI_WEB_TRUSTED_HOSTS=<your-domain> piweb
+  ```
+
+- Use `--public-url https://your-address/` to tell PiWeb its public address: the hostname joins the allowlist
+  automatically, and the login link printed at startup uses it instead of the loopback address.
 
-Set `PI_WEB_PASSWORD` to enable the login page and HTTP Basic Auth (user `pi`). Remote access over plain HTTP is not recommended; use HTTPS or a trusted VPN.
+> Disable the local-network entry with `PIWEB_REMOTE_LAN=0`; disable authentication entirely with `PI_WEB_AUTH=0`
+> (only safe when PiWeb is used strictly on this machine).
 
 ## License
 

package/next.config.ts

@@ -9,8 +9,9 @@ import { resolveBuildOutput } from "./scripts/build-output.mjs";
  * 让构建期的文件追踪看不到用户主目录。
  *
  * next-trace-entrypoints-plugin 会调 @vercel/nft 静态分析服务端代码，把
- * `fs.readdir()` 的实参求值成绝对路径：session-import 的 `path.join(os.homedir(), ".grok", "sessions")`
- * 一类写法于是变成真实路径，整个 ~/.grok、~/.claude、~/.agents、~/.pi 目录被当成构建资产递归遍历。后果：
+ * `fs.readdir()` 的实参求值成绝对路径：prompt-sources / skills-service 里的
+ * `path.join(os.homedir(), ".agents")`、以及 `getAgentDir()` 的 `~/.pi/agent` 一类写法
+ * 于是变成真实路径，整个 ~/.agents、~/.pi 目录被当成构建资产递归遍历。后果：
  *   1. 目录里任何一个文件读不了（权限/ACL 损坏、被独占）都会让构建以 EPERM 直接失败；
  *   2. 这些绝对路径被写进 .next/**\/*.nft.json，而 .next 随 npm 包一起发布，
  *      等于把构建者的用户名与目录布局发给了所有用户。

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rexvane/piweb",
-	"version": "0.3.18",
+	"version": "0.3.19",
 	"license": "MIT",
 	"type": "module",
 	"description": "Modern web UI for the pi coding agent, driven by the official pi SDK without modifying pi",
@@ -52,8 +52,8 @@
 	},
 	"dependencies": {
 		"@automann/maple-mono-cn": "^7.9.2",
-		"@earendil-works/pi-ai": "0.85.1",
-		"@earendil-works/pi-coding-agent": "0.85.1",
+		"@earendil-works/pi-ai": "1.1.0",
+		"@earendil-works/pi-coding-agent": "1.1.0",
 		"@lobehub/icons-static-svg": "^1.95.0",
 		"@tailwindcss/postcss": "^4.2.2",
 		"@types/node": "^26",