@rexvane/piweb 0.3.22 → 0.3.24

package/scripts/release.mjs

@@ -7,6 +7,8 @@ import { pathToFileURL, fileURLToPath } from "node:url";
 import { assertInstallation, assertLocalPath, readProductionBuild, resolveBuildOutput, RELEASES_DIR, RELEASE_MANIFEST } from "./build-output.mjs";
 import { runCommand } from "./process-runner.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import { installPiRuntime, PI_PACKAGE } from "./runtime/pi-packages.mjs";
+export { PI_PACKAGE, PI_AI_PACKAGE } from "./runtime/pi-packages.mjs";
 
 /**
  * Root of the PiWeb installation this module belongs to.
@@ -92,9 +94,6 @@ export async function verifyReleaseConfig(root = process.cwd(), env = process.en
 	}
 }
 
-export const PI_PACKAGE = "@earendil-works/pi-coding-agent";
-export const PI_AI_PACKAGE = "@earendil-works/pi-ai";
-
 /**
  * Shared by the UI and update:pi; called only after the building state is durable.
  * @param {{root: string, env: Record<string, string | undefined>, run: typeof runCommand, signal?: AbortSignal}} context
@@ -102,10 +101,7 @@ export const PI_AI_PACKAGE = "@earendil-works/pi-ai";
  * @returns {Promise<string>}
  */
 export async function installPiUpdate({ root, env, run, signal }, assertIdle = async () => {}) {
-	await assertIdle();
-	await run("npm", ["install", "--save-exact", `${PI_PACKAGE}@latest`, `${PI_AI_PACKAGE}@latest`, "--no-audit", "--no-fund"], {
-		cwd: root, env, timeoutMs: 600_000, signal,
-	});
+	await installPiRuntime({ root, env, run, signal }, { assertIdle });
 	await run("npm", ["run", "sync:provider-icons"], { cwd: root, env, timeoutMs: 60_000, signal });
 	const manifest = JSON.parse(await fs.readFile(path.join(root, "node_modules", PI_PACKAGE, "package.json"), "utf8"));
 	if (typeof manifest.version !== "string" || !manifest.version) throw new Error("Pi engine package version is missing");

package/scripts/runtime/check-installed.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/** Exercise the SDK and production startup inside the freshly installed artifact. */
+import fs from "node:fs";
+import path from "node:path";
+import http from "node:http";
+import { fileURLToPath } from "node:url";
+import next from "next";
+import { isMainModule } from "../entrypoint.mjs";
+import { PI_RUNTIME_PACKAGES, verifyPiRuntimePins } from "./pi-packages.mjs";
+
+export async function checkInstalledRuntime(root = process.cwd()) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	const version = verifyPiRuntimePins(manifest);
+	for (const name of PI_RUNTIME_PACKAGES) {
+		let dir = path.dirname(fileURLToPath(import.meta.resolve(name)));
+		while (!fs.existsSync(path.join(dir, "package.json"))) {
+			const parent = path.dirname(dir);
+			if (parent === dir) throw new Error("package.json missing: " + name);
+			dir = parent;
+		}
+		const actual = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8")).version;
+		if (actual !== version) throw new Error(name + " resolved to " + actual + ", expected " + version);
+	}
+	await import("@earendil-works/pi-coding-agent");
+	await import("@earendil-works/pi-ai");
+
+	const app = next({ dev: false, dir: root });
+	const server = http.createServer(app.getRequestHandler());
+	const routes = ["/api/health", "/api/version", "/api/models", "/api/sessions", "/api/workspaces", "/api/pi-settings"];
+	try {
+		await app.prepare();
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(0, "127.0.0.1", resolve);
+		});
+		const base = "http://127.0.0.1:" + server.address().port;
+		for (const route of routes) {
+			const response = await fetch(base + route, { signal: AbortSignal.timeout(30_000) });
+			const body = await response.json();
+			if (!response.ok || body.success !== true) {
+				throw new Error(route + " failed: " + response.status + " " + JSON.stringify(body));
+			}
+		}
+		const page = await fetch(base + "/", { signal: AbortSignal.timeout(30_000) });
+		if (!page.ok || !(page.headers.get("content-type") ?? "").includes("text/html") || (await page.text()).length < 500) {
+			throw new Error("production home page failed: " + page.status);
+		}
+		return { version, routes, homePage: true };
+	} finally {
+		if (server.listening) {
+			server.closeAllConnections();
+			await new Promise((resolve) => server.close(resolve));
+		}
+		await app.close();
+	}
+}
+
+if (isMainModule(import.meta.url)) {
+	try {
+		console.log(JSON.stringify(await checkInstalledRuntime()));
+		process.exit(0);
+	} catch (error) {
+		console.error(error);
+		process.exit(1);
+	}
+}

package/scripts/runtime/pi-packages.mjs

@@ -0,0 +1,52 @@
+/** Pi's packages are released together and must resolve to the same runtime version. */
+export const PI_PACKAGE = "@earendil-works/pi-coding-agent";
+export const PI_AI_PACKAGE = "@earendil-works/pi-ai";
+export const PI_RUNTIME_PACKAGES = Object.freeze([
+	PI_PACKAGE, PI_AI_PACKAGE,
+	"@earendil-works/pi-agent-core",
+	"@earendil-works/pi-codemode",
+	"@earendil-works/pi-mcp",
+	"@earendil-works/pi-telemetry",
+	"@earendil-works/pi-tui",
+	"@earendil-works/chord",
+]);
+
+/** @param {string} version */
+export function piRuntimeSpecs(version) {
+	if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(version)) {
+		throw new Error("Pi runtime requires an exact version; received " + JSON.stringify(version));
+	}
+	return PI_RUNTIME_PACKAGES.map((name) => name + "@" + version);
+}
+
+/** The repository lockfile is not used when a user installs a published package. */
+export function verifyPiRuntimePins(manifest) {
+	const version = manifest.dependencies?.[PI_PACKAGE];
+	piRuntimeSpecs(version);
+	for (const name of PI_RUNTIME_PACKAGES) {
+		if (manifest.dependencies?.[name] !== version) {
+			throw new Error("Pi runtime dependency " + name + " must be pinned to " + version
+				+ "; a published package can otherwise mix incompatible Pi versions");
+		}
+	}
+	return version;
+}
+
+/**
+ * Resolve the release once, then install every Pi package at that exact version.
+ * Separate @latest lookups can mix releases while upstream is publishing.
+ * @param {{root: string, env: Record<string, string | undefined>, run: typeof import("../process-runner.mjs").runCommand, signal?: AbortSignal}} context
+ * @param {{omitDev?: boolean, assertIdle?: () => Promise<void>}} [options]
+ */
+export async function installPiRuntime({ root, env, run, signal }, { omitDev = false, assertIdle = async () => {} } = {}) {
+	await assertIdle();
+	const version = (await run("npm", ["view", PI_PACKAGE + "@latest", "version"], {
+		cwd: root, env, timeoutMs: 30_000, signal,
+	})).trim();
+	const specs = piRuntimeSpecs(version);
+	await assertIdle();
+	await run("npm", ["install", "--save-exact", ...specs, ...(omitDev ? ["--omit=dev"] : []), "--no-audit", "--no-fund"], {
+		cwd: root, env, timeoutMs: 600_000, signal,
+	});
+	return version;
+}

package/scripts/verify-package.mjs

@@ -2,7 +2,8 @@
 /**
  * Release gate for the prebuilt artifact: pack the package exactly as
  * `npm publish` would, unpack it somewhere else, and validate the copy with the
- * same check the launcher runs before starting.
+ * same check the launcher runs before starting. The CLI also installs the tarball
+ * into an empty global prefix and imports the real Pi SDK.
  *
  * `files` is a whitelist, so enumerating Next internals by hand ships a package
  * that installs cleanly and then dies on first start with a missing manifest
@@ -16,6 +17,7 @@ import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { readProductionBuild } from "./build-output.mjs";
 import { isMainModule } from "./entrypoint.mjs";
+import { PI_PACKAGE, verifyPiRuntimePins } from "./runtime/pi-packages.mjs";
 
 const DEFAULT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -31,17 +33,36 @@ function run(command, args, options = {}) {
  * as well as unsafe with paths containing spaces. Whenever npm invoked us (npm test,
  * npm run verify:package, CI) it hands us its own CLI entry, so run that with node.
  */
-function runNpm(args, { cwd }) {
-	const cli = process.env.npm_execpath;
-	if (cli && cli.endsWith(".js") && fs.existsSync(cli)) return run(process.execPath, [cli, ...args], { cwd });
-	return run("npm", args, { cwd, shell: process.platform === "win32" });
+function runNpm(args, options) {
+	const cli = [process.env.npm_execpath, path.join(path.dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js")]
+		.find((file) => file?.endsWith(".js") && fs.existsSync(file));
+	if (cli) return run(process.execPath, [cli, ...args], options);
+	return run("npm", args, { ...options, shell: process.platform === "win32" });
+}
+
+/** Install the tarball into an empty global prefix; checkout node_modules cannot hide drift. */
+function verifyInstalledRuntime(tarball, tmp, manifest, log) {
+	const prefix = path.join(tmp, "installed");
+	const env = { ...process.env, PI_CODING_AGENT_DIR: path.join(tmp, "agent"), PI_OFFLINE: "1" };
+	runNpm(["install", "--global", "--prefix", prefix, "--omit=dev", "--ignore-scripts", "--no-audit", "--no-fund", tarball], {
+		cwd: tmp, env, timeout: 600_000,
+	});
+	const modules = process.platform === "win32" ? path.join(prefix, "node_modules") : path.join(prefix, "lib", "node_modules");
+	const installed = path.join(modules, ...manifest.name.split("/"));
+	run(process.execPath, [path.join(installed, "scripts", "runtime", "check-installed.mjs")], {
+		cwd: installed, timeout: 180_000,
+		env: { ...env, NODE_ENV: "production", PI_WEB_ROOT: installed, PIWEB_REMOTE_LAN: "0", PI_WEB_AUTH: "0", PI_WEB_UPDATE_CHECK: "0", NEXT_TELEMETRY_DISABLED: "1" },
+	});
+	log("[piweb] Clean global installation: Pi " + verifyPiRuntimePins(manifest) + " SDK, production startup, home page and first-paint APIs passed");
 }
 
 /**
  * @param {string} root
  * @returns {{filename: string, files: string[], buildId: string, bytes: number}}
  */
-export function verifyPackedPackage(root, { log = console.log } = {}) {
+export function verifyPackedPackage(root, { log = console.log, runtime = false } = {}) {
+	const manifest = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+	if (manifest.dependencies?.[PI_PACKAGE]) verifyPiRuntimePins(manifest);
 	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "piweb-verify-"));
 	try {
 		const packed = JSON.parse(runNpm(["pack", "--json", "--pack-destination", tmp], { cwd: root }));
@@ -58,6 +79,7 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 		run("tar", ["-xzf", entry.filename, "-C", "unpacked"], { cwd: tmp });
 		// Same validation the launcher applies to an installed package.
 		const build = readProductionBuild(path.join(unpacked, "package"), ".next");
+		if (runtime) verifyInstalledRuntime(path.join(tmp, entry.filename), tmp, manifest, log);
 		const bytes = fs.statSync(path.join(tmp, entry.filename)).size;
 		log(`[piweb] ${entry.filename}: ${files.length} files, ${(bytes / 1024 / 1024).toFixed(1)} MB, build ${build.buildId}`);
 		return { filename: entry.filename, files, buildId: build.buildId, bytes };
@@ -68,7 +90,7 @@ export function verifyPackedPackage(root, { log = console.log } = {}) {
 
 if (isMainModule(import.meta.url)) {
 	try {
-		verifyPackedPackage(DEFAULT_ROOT);
+		verifyPackedPackage(DEFAULT_ROOT, { runtime: true });
 	} catch (error) {
 		console.error(`[piweb] ${error instanceof Error ? error.message : error}`);
 		process.exitCode = 1;

package/src/app/api/agent/[id]/side-chat/route.ts

@@ -0,0 +1,77 @@
+import { NextResponse } from "next/server";
+import { BoundaryError, resolveSessionPath } from "@/lib/path-security";
+import { parseSideChatRequest } from "@/lib/side-chat/context";
+import { pollSideChat, startSideChat, stopSideChat } from "@/lib/side-chat/service";
+import { isSideChatId, SIDE_CHAT_BODY_LIMIT } from "@/lib/side-chat/types";
+
+export const dynamic = "force-dynamic";
+export const runtime = "nodejs";
+type RouteParams = { params: Promise<{ id: string }> };
+const headers = { "Cache-Control": "no-store" };
+
+function failure(error: unknown): NextResponse {
+	return NextResponse.json({ success: false, error: error instanceof Error ? error.message : "side-chat request failed" }, {
+		status: error instanceof BoundaryError || error instanceof SyntaxError ? 400 : 500, headers,
+	});
+}
+
+async function readBody(req: Request): Promise<unknown> {
+	if (!req.body) throw new BoundaryError("missing side-chat request");
+	const reader = req.body.getReader();
+	const chunks: Uint8Array[] = [];
+	let size = 0;
+	try {
+		for (;;) {
+			const chunk = await reader.read();
+			if (chunk.done) break;
+			size += chunk.value.byteLength;
+			if (size > SIDE_CHAT_BODY_LIMIT) {
+				await reader.cancel();
+				throw new BoundaryError("side-chat history is too large; start a new side chat");
+			}
+			chunks.push(chunk.value);
+		}
+		return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+	} finally {
+		reader.releaseLock();
+	}
+}
+
+export async function POST(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const request = parseSideChatRequest(await readBody(req));
+		if (req.signal.aborted) throw new BoundaryError("side-chat request was cancelled");
+		return NextResponse.json({ success: true, data: startSideChat(sessionPath, request) }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}
+
+export async function GET(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const query = new URL(req.url).searchParams;
+		const requestId = query.get("requestId");
+		const after = Number(query.get("after") ?? "-1");
+		if (!isSideChatId(requestId) || !Number.isSafeInteger(after) || after < -1) throw new BoundaryError("invalid side-chat cursor");
+		return NextResponse.json({ success: true, data: await pollSideChat(sessionPath, requestId, after, req.signal) }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}
+
+export async function DELETE(req: Request, { params }: RouteParams) {
+	try {
+		const { id } = await params;
+		const sessionPath = await resolveSessionPath(id, { allowPending: true });
+		const requestId = new URL(req.url).searchParams.get("requestId");
+		if (!isSideChatId(requestId)) throw new BoundaryError("invalid side-chat id");
+		stopSideChat(sessionPath, requestId);
+		return NextResponse.json({ success: true }, { headers });
+	} catch (error) {
+		return failure(error);
+	}
+}