@timqi/pier 0.0.15 → 0.0.17

package/dist/web/public/index.html

@@ -33,8 +33,8 @@
        which style.css pays for with the safe-area inset. -->
   <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent" />
   <title>Pier</title>
-  <script type="module" crossorigin src="/assets/index-BWDlAMK2.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-DHqZnZr7.css">
+  <script type="module" crossorigin src="/assets/index-DAxKtidH.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-CtR-Ob4T.css">
 </head>
 <!-- The document never scrolls: this is a fixed-viewport workbench, and every
      scrollable region is an inner pane. h-dvh, not h-screen, because 100vh can

package/dist/web/push.js

@@ -10,6 +10,7 @@
 import { readableTitle } from "../core/identity.js";
 import { pierDb } from "../db.js";
 import { logger } from "../log.js";
+import { sessionIdOf } from "./auth.js";
 import { generateVapidKeys, sendPush, } from "./webpush.js";
 const log = logger("push");
 /** Devices kept at once. A browser mints a new subscription whenever the old
@@ -29,6 +30,10 @@ const MAX_BODY_CHARS = 160;
  *  browser bug rather than as an unnamed session — and a listing that could
  *  not answer must not silence the push. */
 const label = (s) => readableTitle(s?.title) || s?.cwd.split("/").filter(Boolean).at(-1) || "Pier session";
+/** SQLite's "that parent row does not exist" — the session ended. Anything
+ *  else that goes wrong here is a broken database, not a signed-out browser. */
+const FOREIGN_KEY_VIOLATION = 787;
+const sessionGone = (err) => err.errcode === FOREIGN_KEY_VIOLATION;
 /** Subscriptions and the instance's VAPID identity. Both are per-instance
  *  facts nobody edits by hand, so they live beside every other one. */
 export class PushStore {
@@ -59,14 +64,16 @@ export class PushStore {
             .all();
     }
     /** Upsert: a browser re-posts the same subscription on every load, which is
-     *  what repairs a row this instance lost. */
-    save(target, label) {
+     *  what repairs a row this instance lost — and what re-attaches one to the
+     *  session that is signed in now. */
+    save(target, label, sessionId) {
         this.#db
-            .prepare(`INSERT INTO push_subscriptions(endpoint, p256dh, auth, label, created_at)
-         VALUES (?, ?, ?, ?, ?)
+            .prepare(`INSERT INTO push_subscriptions(endpoint, p256dh, auth, label, created_at, session_id)
+         VALUES (?, ?, ?, ?, ?, ?)
          ON CONFLICT(endpoint) DO UPDATE SET
-           p256dh = excluded.p256dh, auth = excluded.auth, label = excluded.label`)
-            .run(target.endpoint, target.p256dh, target.auth, label, Date.now());
+           p256dh = excluded.p256dh, auth = excluded.auth, label = excluded.label,
+           session_id = excluded.session_id`)
+            .run(target.endpoint, target.p256dh, target.auth, label, Date.now(), sessionId);
         this.#db
             .prepare(`DELETE FROM push_subscriptions WHERE endpoint NOT IN
            (SELECT endpoint FROM push_subscriptions ORDER BY created_at DESC LIMIT ?)`)
@@ -222,7 +229,23 @@ export function registerPushRoutes(app, deps) {
         if (!target)
             return c.json({ error: "not a push subscription" }, 400);
         const label = String(body.label ?? "a browser").slice(0, 80);
-        store.save(target, label);
+        // The session that is asking owns the subscription, and the foreign key is
+        // what makes signing this browser out take the subscription with it. It can
+        // refuse: the boundary let this request in and the browser was signed out
+        // while its body was still arriving. Say so rather than 500 — the browser
+        // is about to be sent to the login form by its next request anyway.
+        try {
+            store.save(target, label, sessionIdOf(c));
+        }
+        catch (err) {
+            // Only that. A full or read-only database answering 401 would send a
+            // signed-in browser to the login form, where the password it types will
+            // not help either.
+            if (!sessionGone(err))
+                throw err;
+            log.warn(`subscription refused for a session that ended: ${String(err)}`);
+            return c.json({ error: "session ended" }, 401);
+        }
         log.info(`subscribed ${label}`);
         return c.json({ ok: true }, 201);
     });

package/dist/web/terminal.js

@@ -11,7 +11,7 @@ import { isAbsolute } from "node:path";
 import { spawn } from "node-pty";
 import { WebSocketServer } from "ws";
 import { logger } from "../log.js";
-import { upgradeAuthorized } from "./auth.js";
+import { ALL, upgradeAuthorized } from "./auth.js";
 const log = logger("terminal");
 /** Live shells at once — a guard against forgotten spawns, not a quota. */
 const MAX_TERMS = 8;
@@ -276,10 +276,18 @@ export function attachTerminal(server, auth, opts = {}) {
     });
     server.once("close", () => hub.close());
     wss.on("error", (err) => log.error("terminal WebSocket server failed", err));
-    auth.onRotation(() => {
-        log.info("password changed; closing terminal clients");
-        for (const client of wss.clients)
-            client.close(1008, "password changed");
+    // A shell outlives the request that opened it, so revocation has to reach it
+    // here: the session that opened this socket was signed out (or every session
+    // was, by a password change), and the terminal goes with it.
+    const sessionOf = new WeakMap();
+    const revoked = new WeakSet();
+    auth.onRevoke((id) => {
+        for (const client of wss.clients) {
+            if (id !== ALL && sessionOf.get(client) !== id)
+                continue;
+            revoked.add(client);
+            client.close(1008, "signed out");
+        }
     });
     server.on("upgrade", (req, socket, head) => {
         let url;
@@ -296,14 +304,15 @@ export function attachTerminal(server, auth, opts = {}) {
             socket.destroy();
             return;
         }
-        if (!upgradeAuthorized(auth, req)) {
+        const sessionId = upgradeAuthorized(auth, req);
+        if (!sessionId) {
             log.warn("refused terminal upgrade (unauthorized)");
             socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n");
             socket.destroy();
             return;
         }
-        const authKey = auth.cookieKey;
         wss.handleUpgrade(req, socket, head, (ws) => {
+            sessionOf.set(ws, sessionId);
             alive.add(ws);
             ws.on("pong", () => alive.add(ws));
             // Frames can land while attach() is resolving realpath; hold a bounded
@@ -320,9 +329,10 @@ export function attachTerminal(server, auth, opts = {}) {
             ws.on("message", (data, binary) => {
                 if (closed)
                     return;
-                if (auth.cookieKey !== authKey) {
+                // A frame can already be in flight when the close above goes out.
+                if (revoked.has(ws)) {
                     closed = true;
-                    ws.close(1008, "password changed");
+                    ws.close(1008, "signed out");
                     return;
                 }
                 if (binary) {

package/docs/deploy.md

@@ -177,9 +177,9 @@ journalctl --user -u pier --since -1h | grep 'tasks:'   # one area
 ```
 
 Every line is `area: message` — `core`, `agent`, `tasks`, `slack`, `telegram`,
-`channels`, `slack.tool`, `auth`, `boards`, `client`, `db`, `drain`, `secrets`,
-`settings`, `credentials`, `update`, `web.providers`, `pier` — so an area is a
-grep
+`lark`, `channels`, `slack.tool`, `auth`, `boards`, `client`, `db`, `drain`,
+`secrets`, `settings`, `credentials`, `update`, `tools`, `terminal`, `push`,
+`web`, `web.providers`, `pier` — so an area is a grep
 and a level is a `-p`. The level reaches journald as a syslog priority prefix, which Pier
 emits only when systemd says the output is a journal (`$JOURNAL_STREAM`); run
 in a terminal, the same lines carry a timestamp and a level word instead.
@@ -229,14 +229,23 @@ sqlite3 ~/.pier/db/pier.db 'DELETE FROM auth'
 pier restart
 ```
 
-Changing the password invalidates every session cookie: the cookies are signed
-with the stored hash.
+Changing the password signs out every browser: the session rows behind the
+cookies are deleted. So does the recovery above — a new password does not leave
+the old one's browsers signed in. To end one browser without changing the
+password, use Settings → Instance → Signed-in devices. A session that is not
+used expires 7 days after its last request. However a session ends — signed
+out, expired, password changed, password recovered — its push subscription is
+deleted with it, so that browser stops being notified as well.
+
+The upgrade that introduced these rows signs everyone out once: a cookie issued
+before it names no row. Have the password to hand.
 
 ## Restarting and reloading
 
 ```sh
 pier restart          # finish active work, then restart the service
 pier reload           # apply channel config and recycle idle sessions in place
+pier tools sync       # install/update the managed CLI tools
 ```
 
 Both commands signal the installed systemd service; they are not foreground
@@ -246,6 +255,14 @@ next process. At the deadline it records every aborted IM turn first, and the
 next process posts that note after its adapter starts. Cleanup after the deadline
 has one shared 10-second bound regardless of how many sessions are stuck.
 
+`pier tools sync` converges the command-line tools switched on in Console →
+Settings — they install into `~/.pier/tools/bin`, which the service puts first
+on the PATH every session, task and terminal inherits. Normally a switch runs
+it for you as a task; typing it is for a machine that was offline when one was
+flipped. One sync runs at a time per machine: an overlapping one waits for the
+lock (and converges on the switches as they stand when its turn comes) instead
+of racing the other's installs.
+
 `pier reload` does not stop active work. It reloads Slack and Telegram adapters
 and immediately evicts idle sessions nobody is watching, so their next message
 opens with current agent files and configuration. Streaming sessions and
@@ -391,7 +408,8 @@ elsewhere, pick a tunnel rather than a wider bind:
   there, preserve the external `Host` (or pass `X-Forwarded-Host`), and pass
   `X-Forwarded-For`; Pier uses the external host for write-origin checks and
   counts login failures per forwarded client. Its session cookie is marked
-  `Secure` when the proxy reports `X-Forwarded-Proto: https`. The proxy must
+  `Secure` when a loopback proxy reports `X-Forwarded-Proto: https` (the header
+  is ignored from anywhere else, where it is a header the client wrote). The proxy must
   pass WebSocket upgrades for `/api/terminal` (Caddy does automatically;
   nginx needs its usual HTTP/1.1 `Upgrade`/`Connection` forwarding).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timqi/pier",
-  "version": "0.0.15",
+  "version": "0.0.17",
   "description": "A self-hosted workspace for coding agents: web workbench and IM channels in front of Pi sessions",
   "license": "AGPL-3.0-only",
   "repository": "github:timqi/pier",