@rexvane/piweb 0.3.21 → 0.3.23

package/scripts/verify-package.mjs

@@ -2,7 +2,8 @@
 /**
  * Release gate for the prebuilt artifact: pack the package exactly as
  * `npm publish` would, unpack it somewhere else, and validate the copy with the
- * same check the launcher runs before starting.
+ * same check the launcher runs before starting. The CLI also installs the tarball
+ * into an empty global prefix and imports the real Pi SDK.
  *
  * `files` is a whitelist, so enumerating Next internals by hand ships a package
  * that installs cleanly and then dies on first start with a missing manifest
@@ -16,6 +17,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { readProductionBuild } from "./build-output.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import { PI_PACKAGE, verifyPiRuntimePins } from "./runtime/pi-packages.mjs";
 
 const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -31,17 +33,36 @@ function run(command, args, options = {}) {
  * as well as unsafe with paths containing spaces. Whenever npm invoked us (npm test,
  * npm run verify:package, CI) it hands us its own CLI entry, so run that with node.
  */
-function runNpm(args, { cwd }) {
-	const cli = process.env.npm_execpath;
-	if (cli && cli.endsWith(".js") && fs.existsSync(cli)) return run(process.execPath, [cli, ...args], { cwd });
-	return run("npm", args, { cwd, shell: process.platform === "win32" });
+function runNpm(args, options) {
+	const cli = [process.env.npm_execpath, path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")]
+		.find((file) => file?.endsWith(".js") && fs.existsSync(file));
+	if (cli) return run(process.execPath, [cli, ...args], options);
+	return run("npm", args, { ...options, shell: process.platform === "win32" });
+}
+
+/** Install the tarball into an empty global prefix; checkout node_modules cannot hide drift. */
+function verifyInstalledRuntime(tarball, tmp, manifest, log) {
+	const prefix = path.join(tmp, "installed");
+	const env = { ...process.env, PI_CODING_AGENT_DIR: path.join(tmp, "agent"), PI_OFFLINE: "1" };
+	runNpm(["install", "--global", "--prefix", prefix, "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund", tarball], {
+		cwd: tmp, env, timeout: 600_000,
+	});
+	const modules = process.platform === "win32" ? path.join(prefix, "node_modules") : path.join(prefix, "lib", "node_modules");
+	const installed = path.join(modules, ...manifest.name.split("/"));
+	run(process.execPath, [path.join(installed, "scripts", "runtime", "check-installed.mjs")], {
+		cwd: installed, timeout: 180_000,
+		env: { ...env, NODE_ENV: "production", PI_WEB_ROOT: installed, PIWEB_REMOTE_LAN: "0", PI_WEB_AUTH: "0", PI_WEB_UPDATE_CHECK: "0", NEXT_TELEMETRY_DISABLED: "1" },
+	});
+	log("[piweb] Clean global installation: Pi " + verifyPiRuntimePins(manifest) + " SDK, production startup, home page and first-paint APIs passed");
 }
 
 /**
  * @param {string} root
  * @returns {{filename: string, files: string[], buildId: string, bytes: number}}
  */
-export function verifyPackedPackage(root, { log = console.log } = {}) {
+export function verifyPackedPackage(root, { log = console.log, runtime = false } = {}) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	if (manifest.dependencies?.[PI_PACKAGE]) verifyPiRuntimePins(manifest);
 	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "piweb-verify-"));
 	try {
 		const packed = JSON.parse(runNpm(["pack", "--json", "--pack-destination", tmp], { cwd: root }));
@@ -58,6 +79,7 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 		run("tar", ["-xzf", entry.filename, "-C", "unpacked"], { cwd: tmp });
 		// Same validation the launcher applies to an installed package.
 		const build = readProductionBuild(path.join(unpacked, "package"), ".next");
+		if (runtime) verifyInstalledRuntime(path.join(tmp, entry.filename), tmp, manifest, log);
 		const bytes = fs.statSync(path.join(tmp, entry.filename)).size;
 		log(`[piweb] ${entry.filename}: ${files.length} files, ${(bytes / 1024 / 1024).toFixed(1)} MB, build ${build.buildId}`);
 		return { filename: entry.filename, files, buildId: build.buildId, bytes };
@@ -68,7 +90,7 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 
 if (isMainModule(import.meta.url)) {
 	try {
-		verifyPackedPackage(DEFAULT_ROOT);
+		verifyPackedPackage(DEFAULT_ROOT, { runtime: true });
 	} catch (error) {
 		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;

package/src/app/api/agent/[id]/side-chat/route.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from "next/server";
+import { BoundaryError, resolveSessionPath } from "@/lib/path-security";
+import { parseSideChatRequest } from "@/lib/side-chat/context";
+import { pollSideChat, startSideChat, stopSideChat } from "@/lib/side-chat/service";
+import { isSideChatId, SIDE_CHAT_BODY_LIMIT } from "@/lib/side-chat/types";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+type RouteParams = { params: Promise<{ id: string }> };
+const headers = { "Cache-Control": "no-store" };
+
+function failure(error: unknown): NextResponse {
+	return NextResponse.json({ success: false, error: error instanceof Error ? error.message : "side-chat request failed" }, {
+		status: error instanceof BoundaryError || error instanceof SyntaxError ? 400 : 500, headers,
+	});
+}
+
+async function readBody(req: Request): Promise<unknown> {
+	if (!req.body) throw new BoundaryError("missing side-chat request");
+	const reader = req.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			size += chunk.value.byteLength;
+			if (size > SIDE_CHAT_BODY_LIMIT) {
+				await reader.cancel();
+				throw new BoundaryError("side-chat history is too large; start a new side chat");
+			}
+			chunks.push(chunk.value);
+		}
+		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	} finally {
+		reader.releaseLock();
+	}
+}
+
+export async function POST(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const request = parseSideChatRequest(await readBody(req));
+		if (req.signal.aborted) throw new BoundaryError("side-chat request was cancelled");
+		return NextResponse.json({ success: true, data: startSideChat(sessionPath, request) }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}
+
+export async function GET(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const query = new URL(req.url).searchParams;
+		const requestId = query.get("requestId");
+		const after = Number(query.get("after") ?? "-1");
+		if (!isSideChatId(requestId) || !Number.isSafeInteger(after) || after < -1) throw new BoundaryError("invalid side-chat cursor");
+		return NextResponse.json({ success: true, data: await pollSideChat(sessionPath, requestId, after, req.signal) }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}
+
+export async function DELETE(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const requestId = new URL(req.url).searchParams.get("requestId");
+		if (!isSideChatId(requestId)) throw new BoundaryError("invalid side-chat id");
+		stopSideChat(sessionPath, requestId);
+		return NextResponse.json({ success: true }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}

package/src/app/api/files/route.ts

@@ -1,16 +1,19 @@
 import { NextResponse } from "next/server";
 import { BoundaryError } from "@/lib/path-security";
-import { listWorkspaceDir, openInEditor, parseUploadLength, readWorkspaceFile, saveUploadStream } from "@/lib/files-service";
+import { listWorkspaceDir, listWorkspaceIndex, openInEditor, parseUploadLength, readWorkspaceFile, saveUploadStream } from "@/lib/files-service";
 
 export const dynamic = "force-dynamic";
 
-/** 工作区文件浏览：?cwd=&path=（目录列表）；?read=1&cwd=&path=（文本预览） */
+/** 工作区文件浏览：?cwd=&path=（目录列表）；?read=1&cwd=&path=（文本预览）；?index=1&cwd=（@ 引用候选全量清单） */
 export async function GET(req: Request) {
 	const url = new URL(req.url);
 	try {
 		if (url.searchParams.get("read") === "1") {
 			return NextResponse.json({ success: true, data: await readWorkspaceFile(url.searchParams.get("cwd"), url.searchParams.get("path")) });
 		}
+		if (url.searchParams.get("index") === "1") {
+			return NextResponse.json({ success: true, data: await listWorkspaceIndex(url.searchParams.get("cwd")) });
+		}
 		return NextResponse.json({ success: true, data: await listWorkspaceDir(url.searchParams.get("cwd"), url.searchParams.get("path"), url.searchParams.get("offset")) });
 	} catch (err: any) {
 		return NextResponse.json(

package/src/app/api/github/route.ts

@@ -0,0 +1,26 @@
+import { NextResponse } from "next/server";
+import { repoRoot } from "@/lib/git-service";
+import { awaitGithubIdentity } from "@/lib/github-identity";
+import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+/**
+ * Git 面板头部的 GitHub 身份（头像 + 账号）。
+ *
+ * 与 /api/git 分开：身份要走网络（gh / 头像），不该拖慢分支与文件状态那条纯本地读取。
+ * 取不到就回 identity: null，前端只显示分支信息，不报错。
+ */
+export async function GET(req: Request) {
+	const cwd = new URL(req.url).searchParams.get("cwd");
+	try {
+		const resolved = await resolveWorkspacePath(cwd);
+		const { root } = await repoRoot(resolved);
+		if (!root) return NextResponse.json({ success: true, data: { identity: null } });
+		return NextResponse.json({ success: true, data: { identity: await awaitGithubIdentity(root) } });
+	} catch (err: any) {
+		if (err instanceof BoundaryError) return NextResponse.json({ success: false, error: err.message }, { status: 400 });
+		// 身份只是装饰：任何失败都不该让面板变红
+		return NextResponse.json({ success: true, data: { identity: null } });
+	}
+}

package/src/app/api/models/defaults/route.ts

@@ -0,0 +1,18 @@
+import { NextResponse } from "next/server";
+import { newSessionDefaults } from "@/lib/model-defaults";
+import { BoundaryError, resolveWorkspacePath } from "@/lib/path-security";
+
+export const dynamic = "force-dynamic";
+
+/** 新会话页的默认模型与思考档位：按工作区读 pi 的设置 */
+export async function GET(req: Request) {
+	try {
+		const cwd = await resolveWorkspacePath(new URL(req.url).searchParams.get("cwd"));
+		return NextResponse.json({ success: true, data: await newSessionDefaults(cwd) });
+	} catch (error) {
+		return NextResponse.json(
+			{ success: false, error: error instanceof Error ? error.message : "request failed" },
+			{ status: error instanceof BoundaryError ? 400 : 500 },
+		);
+	}
+}

package/src/app/api/models/route.ts

@@ -2,7 +2,9 @@ import { gzipSync } from "node:zlib";
 import { NextResponse } from "next/server";
 import {
 	answerLogin,
+	builtinCatalogModelIds,
 	cancelLogin,
+	contextWindowInfo,
 	CustomProvidersConflictError,
 	CustomProvidersValidationError,
 	discoverModels,
@@ -14,6 +16,7 @@ import {
 	readCustomProviders,
 	removeApiKey,
 	setApiKey,
+	setModelContextWindow,
 	startLogin,
 	writeCustomProviders,
 } from "@/lib/models-service";
@@ -58,7 +61,13 @@ export async function GET(req: Request) {
 		const providers = full
 			? data.providers
 			: data.providers.map((p) => ({ id: p.id, name: p.name, authReady: p.authReady, builtIn: p.builtIn, modelCount: p.modelCount }));
-		return jsonMaybeGzip(req, { success: true, data: { providers, models, customProviders } }, `${modelListStamp()}:${full ? "full" : "piweb"}`);
+		// 设置页编辑内置 provider 时据此把「覆盖已有模型」写进 modelOverrides，而不是 models[]
+		const catalogModelIds = customProviders ? await builtinCatalogModelIds(customProviders.content, data.models) : undefined;
+		return jsonMaybeGzip(
+			req,
+			{ success: true, data: { providers, models, customProviders, ...(catalogModelIds ? { catalogModelIds } : {}) } },
+			`${modelListStamp()}:${custom ? "custom" : full ? "full" : "piweb"}`,
+		);
 	} catch (err: any) {
 		return NextResponse.json({ success: false, error: String(err?.message ?? err) }, { status: 500 });
 	}
@@ -73,11 +82,15 @@ export async function POST(req: Request) {
 				| "saveCustomProviders"
 				| "discoverModels"
 				| "providerUsage"
+				| "contextWindowInfo"
+				| "setContextWindow"
 				| "loginStart"
 				| "loginState"
 				| "loginAnswer"
 				| "loginCancel";
 			providerId?: string;
+			modelId?: string;
+			contextWindow?: number;
 			apiKey?: string;
 			baseUrl?: string;
 			api?: string;
@@ -115,6 +128,16 @@ export async function POST(req: Request) {
 			const usage = await providerUsage(body.providerId, body.force === true);
 			return NextResponse.json({ success: true, data: { usage } });
 		}
+		if (body.action === "contextWindowInfo" || body.action === "setContextWindow") {
+			if (typeof body.providerId !== "string" || !body.providerId || typeof body.modelId !== "string" || !body.modelId) {
+				return NextResponse.json({ success: false, error: "missing providerId or modelId" }, { status: 400 });
+			}
+			if (body.action === "contextWindowInfo") {
+				return NextResponse.json({ success: true, data: await contextWindowInfo(body.providerId, body.modelId) });
+			}
+			if (typeof body.contextWindow !== "number") return NextResponse.json({ success: false, error: "missing contextWindow" }, { status: 400 });
+			return NextResponse.json({ success: true, data: await setModelContextWindow(body.providerId, body.modelId, body.contextWindow) });
+		}
 		if (body.action === "loginStart") {
 			if (!body.providerId) return NextResponse.json({ success: false, error: "missing providerId" }, { status: 400 });
 			await startLogin(body.providerId);