@timqi/pier 0.0.2 → 0.0.3

package/dist/web/public/index.html

@@ -16,8 +16,8 @@
   <meta name="apple-mobile-web-app-capable" content="yes" />
   <meta name="apple-mobile-web-app-title" content="Pier" />
   <title>Pier</title>
-  <script type="module" crossorigin src="/assets/index-BK64pHmP.js"></script>
-  <link rel="stylesheet" crossorigin href="/assets/index-De4GlOq4.css">
+  <script type="module" crossorigin src="/assets/index-fASxMPr6.js"></script>
+  <link rel="stylesheet" crossorigin href="/assets/index-cCIuQnDr.css">
 </head>
 <!-- The document never scrolls: this is a fixed-viewport workbench, and every
      scrollable region is an inner pane. h-dvh, not h-screen, because 100vh can
@@ -31,7 +31,7 @@
        moves it between the rail's top-right (open) and main's top-left
        (closed), flipping the chevron, so expand and collapse are the same
        control in the same band. -->
-  <button type="button" id="rail-toggle" title="Toggle sidebar" aria-label="Toggle sidebar"
+  <button type="button" id="rail-toggle" aria-label="Toggle sidebar"
     class="fixed top-1.5 z-40 hidden h-7 w-7 cursor-pointer items-center justify-center rounded-md text-neutral-400 hover:bg-neutral-200 hover:text-neutral-700 md:flex">
     <svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" class="h-3.5 w-3.5">
       <path d="M9.5 4 5.5 8l4 4" stroke-linecap="round" stroke-linejoin="round" />
@@ -77,8 +77,8 @@
     </details>
     <div class="flex items-center gap-1 px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wide text-neutral-500">
       Projects
-      <button type="button" id="open-archive" title="Search all sessions"
-        class="icon-btn ml-auto" aria-label="Search all sessions">
+      <button type="button" id="open-archive"
+        class="icon-btn ml-auto" aria-label="Search sessions and Console">
         <svg viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" class="h-3.5 w-3.5">
           <circle cx="7" cy="7" r="4.25" /><path d="M10.2 10.2 14 14" stroke-linecap="round" />
         </svg>
@@ -217,9 +217,12 @@
     </form>
   </dialog>
 
-  <dialog id="archive-dialog" class="m-auto w-[35rem] max-w-[90vw] rounded-xl border border-neutral-200 p-0 shadow-xl backdrop:bg-black/20">
+  <!-- Not m-auto: a palette that grows downward as you type should not also
+       drift upward to stay centred. Pinned near the top instead, which is
+       where the eye already is and where every other ⌘K lives. -->
+  <dialog id="archive-dialog" class="mx-auto mb-auto mt-[12vh] w-[35rem] max-w-[90vw] rounded-xl border border-neutral-200 p-0 shadow-xl backdrop:bg-black/20">
     <div class="flex items-center gap-2 border-b border-neutral-200 px-3 py-2">
-      <input id="archive-search" type="text" placeholder="Search all sessions…"
+      <input id="archive-search" type="text" placeholder="Search sessions and Console…"
         class="w-full bg-transparent text-[14px] focus:outline-none" />
       <span id="archive-count" class="flex-none rounded bg-neutral-100 px-1.5 text-[11px] text-neutral-500"></span>
       <button type="button" id="archive-close" class="btn flex-none text-[12px]">Close</button>

package/dist/web/server.js

@@ -1,11 +1,14 @@
 // Web workbench backend: REST + SSE, a pure consumer of core.
 // See docs/design/03-web-workbench.md for the route contract.
-import { relative } from "node:path";
+import { hostname } from "node:os";
+import { readFile } from "node:fs/promises";
+import { join, relative } from "node:path";
 import { fileURLToPath } from "node:url";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { EventHub } from "../core/hub.js";
+import { logger } from "../log.js";
 import { Router } from "../core/router.js";
 import { registerExplorerRoutes } from "./explorer.js";
 import { guarded, registerFileRoutes } from "./files.js";
@@ -14,10 +17,20 @@ import { saveInbound } from "../core/inbox.js";
 import { MAX_INBOUND_BYTES } from "../core/inbound-file.js";
 import { registerInstanceRoutes } from "./instance.js";
 import { registerProviderRoutes } from "./providers.js";
+const log = logger("web");
+/** What goes in front of `Pier` in the tab: `$PIER_TITLE`, then the machine.
+ *  The label leads because a tab is narrow and "which instance is this" is the
+ *  question it has to answer before the browser truncates — `staging - g1`. */
+export const tabPrefix = (title, host) => [title?.trim(), host.trim()].filter(Boolean).join(" - ").slice(0, 60);
+/** `<title>staging - g1 - Pier</title>`. Nothing to say, or a shell that does
+ *  not say `Pier`: leave it exactly as built. */
+export const withTabPrefix = (html, prefix) => prefix
+    ? html.replace("<title>Pier</title>", `<title>${prefix.replace(/&/g, "&amp;").replace(/</g, "&lt;")} - Pier</title>`)
+    : html;
 const HEARTBEAT_MS = 15_000;
 // Canonical base64 only: Buffer.from(.., "base64") happily "decodes" garbage.
 const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
-export function createServer({ factory, router, hub, sessions: state, config, providers, settings, secrets, onUnlocked, updates, backgroundRuns, }) {
+export function createServer({ factory, router, hub, sessions: state, config, providers, settings, secrets, onUnlocked, updates, updater, backgroundRuns, }) {
     const app = new Hono();
     // A finished turn marks its session unread until some client reports it was
     // seen (session selected + tab visible → POST read below). Server-side so
@@ -278,16 +291,66 @@ export function createServer({ factory, router, hub, sessions: state, config, pr
             }
         });
     });
-    registerInstanceRoutes(app, { settings, updates, secrets, onUnlocked });
-    registerProviderRoutes(app, providers);
-    registerFileRoutes(app, { factory, config, nascentCwd: (id) => nascent.get(id)?.cwd });
-    registerExplorerRoutes(app, { factory, nascentCwds: () => [...nascent.values()].map((n) => n.cwd) });
+    // Provider credentials, the agent files and the surface prompt are read when
+    // a session *opens*: a live one keeps what it opened with, so a Console save
+    // would otherwise reach nothing until the idle sweep got around to it half an
+    // hour later. Letting the idle sessions go is what `pier reload` does — the
+    // next message re-opens them with the configuration just written. Watched
+    // included, unlike the background sweep: the session open in the tab that
+    // just saved is the likeliest one to need it. A turn in flight is still never
+    // interrupted; it picks the change up at its next natural eviction.
+    const recycle = (what) => {
+        void router.evictIdle(0, Date.now(), { includeWatched: true })
+            .then((n) => {
+            if (n)
+                log.info(`${what} changed — recycled ${n} idle session(s)`);
+        })
+            .catch((err) => log.error(`recycling sessions after ${what} failed`, err));
+    };
+    registerInstanceRoutes(app, {
+        settings,
+        updates,
+        updater,
+        secrets,
+        onUnlocked,
+        onSettingsChanged: () => recycle("instance settings"),
+    });
+    registerProviderRoutes(app, providers, () => recycle("provider configuration"));
+    registerFileRoutes(app, {
+        factory,
+        config,
+        nascentCwd: (id) => nascent.get(id)?.cwd,
+        onConfigWritten: () => recycle("an agent file"),
+    });
+    registerExplorerRoutes(app);
     // serveStatic resolves `root` against the *working directory*, and an
     // installed Pier is started from wherever the operator happens to be. The
     // bundle sits beside this module in both trees — src/web/public when tsx
     // runs the source, dist/web/public in a build — so the path is derived from
     // the module and handed over as the relative form the option wants.
     const bundle = fileURLToPath(new URL("./public", import.meta.url));
+    // The tab says which instance this is (`staging - g1 - Pier`): an operator
+    // keeps a workbench open per environment and they are otherwise identical,
+    // and mistaking the test one for production is the mistake worth a few lines.
+    // Both facts are known only at runtime, so they are patched into the shell
+    // here rather than built in — and served behind the auth guard, so a stranger
+    // at /login learns neither. Read once: neither can change under a process.
+    const prefix = tabPrefix(process.env.PIER_TITLE, hostname().split(".")[0] ?? "");
+    let shell = null;
+    app.get("/", async (c, next) => {
+        if (shell === null) {
+            try {
+                shell = withTabPrefix(await readFile(join(bundle, "index.html"), "utf8"), prefix);
+            }
+            catch (err) {
+                // A workbench that will not load is not worth a nicer tab: hand the
+                // request back to the static handler, which answers as it always did.
+                log.warn(`shell unreadable, serving it unpatched: ${String(err)}`);
+                return next();
+            }
+        }
+        return c.html(shell);
+    });
     app.use("/*", serveStatic({ root: relative(process.cwd(), bundle) || "." }));
     return app;
 }

package/docs/deploy.md

@@ -270,12 +270,34 @@ systemctl --user start pier
 ```
 
 For a service install, `pier update` stops Pier first; it does not use the
-graceful `pier restart` path. It snapshots the database to
+graceful `pier restart` path. The Console's **Update now** and the automatic
+path do: both drain (new work refused, running turns finished, the rest
+ledgered for the next boot to report) before the updater unit is started.
+
+Either way the updater snapshots the database to
 `~/.pier/db/pier.db.release.bak` before npm touches the package. This happens for
 every release, including releases with no schema change. If installation or
 backup fails, the updater unit still tries to start the previously installed
 service and reports the failure in its journal.
 
+### Automatic updates
+
+Off by default. Switched on from the version panel, it checks every 15 minutes
+and hands over only when all three hold: the switch is on, a newer release
+exists, and the instance is idle (nothing streaming, no task run in flight).
+systemd only — without the unit there is nothing to hand the install to.
+
+The unit records **absolute** paths to the node and npm that installed Pier,
+because systemd's PATH has neither. That pins it to one directory of one version
+manager: with fnm or nvm, `fnm uninstall v24` deletes the Node that `ExecStart`
+names while the running process survives (Linux keeps a deleted binary mapped).
+Pier checks those paths at boot and before every handover, and reports it in the
+journal and in the version panel rather than letting the next restart fail:
+
+```
+pier service install --force    # re-records the current node and npm
+```
+
 A newer Pier brings its own schema up on the next start: the migrations run in
 one transaction before the port opens, and the version they leave behind is
 stamped in the database. It also snapshots the immediately preceding schema to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timqi/pier",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "A self-hosted workspace for coding agents: web workbench and IM channels in front of Pi sessions",
   "license": "AGPL-3.0-only",
   "repository": "github:timqi/pier",

package/skills/pier-boards/SKILL.md

@@ -38,18 +38,23 @@ Those four fields are the whole manifest.
 
 `"public": true` serves the board at `/p/<slug>/` **with no password**. Set it
 only if the user asked for a public or shareable board *in this request*;
-otherwise leave it `false`, say the board is private, and mention that Console →
-Boards flips it. Never publish credentials, internal paths, personal data or
-anything the user has not seen.
+otherwise leave it `false` and say the board is private. Never publish personal
+data or anything the user has not seen.
 
-The message announcing the board carries **one clickable link** — a bare path is
-not something a person can open, and a board nobody reached was not delivered.
+Asked to make an existing board public? Flip `"public"` to `true` in
+`board.json` and reply with the `/p/<slug>/` link — that is the whole answer.
+No verification step, no narrating the edit, no restating what the page holds.
+
+The message announcing the board carries **one bare URL** — paste the address
+itself, never `[title](url)`: link labels get mangled or truncated on some chat
+surfaces, and the title is already on the page. No filesystem paths either —
+`…/boards/<slug>/board.json` means nothing to the reader.
 `<pier>/AGENTS.md` gives you the address, so there is nothing to look up:
 
 | The user asked for | Send |
 | --- | --- |
-| a board, nothing about sharing | `[Weekly digest](https://pier.example.com/boards/weekly-digest/)` — behind the Pier password |
-| a **public** board | `[Weekly digest](https://pier.example.com/p/weekly-digest/)` — no password |
+| a board, nothing about sharing | `https://pier.example.com/boards/weekly-digest/` — behind the Pier password; Console → Boards makes it public |
+| a **public** board | `https://pier.example.com/p/weekly-digest/` — no password |
 
 Never both: the pair invites pasting the password-free URL of a board that was
 never meant to leave the workspace, and `/p/<slug>/` 404s unless the manifest
@@ -180,6 +185,10 @@ what makes it read as signal.
 
 ## Rules
 
+- **No secrets, ever.** Tokens, API keys, credentials, internal hostnames and
+  private paths never go into a board — not in the page, not in a `<details>`
+  fold, not in a code sample. A private board is one Console toggle from
+  public, so write every page as if it already were.
 - **Static and self-contained.** Everything the page needs lives under `site/`
   with relative paths. No CDN, no external fonts, no analytics, no `fetch()` —
   a published board is served under a CSP that blocks all of it, so an external

package/skills/pier-slack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pier-slack
-description: Read and write Slack through Pier's slack tool — a channel's history for a time range, one thread, posting into a thread, and the Slack-specific syntax for mentions and links. Read before answering questions about Slack conversations or posting anything to a workspace.
+description: Read and write Slack through Pier's slack tool — a channel's history for a time range, one thread, posting into a thread, deleting a message Pier posted, and the Slack-specific syntax for mentions and links. Read before answering questions about Slack conversations or posting anything to a workspace.
 ---
 
 # Reading and writing Slack
@@ -97,6 +97,22 @@ Going top-level takes the explicit `"none"`: a channel's main flow is wider
 than a thread. A `thread_ts` is never inherited across a change of `channel`.
 The response carries `ts` and `threadTs` for replying under what you posted.
 
+## Deleting
+
+```json
+{"operation":"delete","channel":"#ops","ts":"1717243800.000100"}
+```
+
+Slack only lets Pier delete what **its own bot** posted — a person's message
+answers `cant_delete_message`, and the answer is to ask them, not to retry.
+
+- `ts` is always explicit. There is no "delete the last one" and no default
+  from the thread you are in: the wrong `ts` cannot be undone.
+- A `ts` means nothing outside the conversation it came from — pass the
+  `channel` it was read in.
+- Deleting a thread parent does not remove its replies. Say what you removed;
+  a message vanishing with no word looks like a Slack bug to everyone watching.
+
 ## Message syntax
 
 `text` is **standard markdown** and Slack renders it natively: `**bold**`,