@timqi/pier 0.0.2 → 0.0.4

package/dist/update.js

@@ -1,20 +1,22 @@
-// Whether a newer Pier exists. Checking, and nothing more.
+// The newer Pier: whether one exists, and when this one may become it.
 //
 // The registry is asked, not the GitHub API: `registry.npmjs.org` is a CDN with
 // no rate limit and no token, and it is the same place `npm i -g` would look,
 // so what it reports is what an update would actually get.
 //
-// Deliberately only an answer. Applying it is `pier update`, a command someone
-// types: this process holds provider keys and can run a shell, so a service
-// that rewrites its own code on a timer is a supply-chain surface (AGENTS.md 8)
-// — and the updater's hard stop would kill whatever turn was mid-flight.
+// Nothing here installs anything. Applying is handed to whatever supervises
+// this process (service.ts's oneshot unit, injected as `apply`): a web server
+// holding provider keys must not npm-install as its own child, and the two
+// gates below — the operator switched it on, and nothing is running — are why
+// a self-replacing timer is not simply a supply-chain surface (AGENTS.md 8).
 import { createRequire } from "node:module";
 import { logger } from "./log.js";
 const log = logger("update");
 const PACKAGE = "@timqi/pier";
 const ENDPOINT = `https://registry.npmjs.org/${PACKAGE}/latest`;
-/** Long, because the answer changes on release days and never in between. */
-const TTL_MS = 6 * 60 * 60_000;
+/** One conditional-GET-sized request against a CDN, so the cost of asking is
+ *  not what sets this — how long a released fix may sit unnoticed is. */
+const TTL_MS = 30 * 60_000;
 const TIMEOUT_MS = 5_000;
 export const currentVersion = () => createRequire(import.meta.url)("../package.json").version;
 export const isValidVersion = (version) => /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.test(version);
@@ -59,6 +61,15 @@ export class UpdateCheck {
             available: this.#latest !== null && isNewer(this.#latest, this.current),
         };
     }
+    /** The answer, waiting for the very first check instead of reporting "no
+     *  idea". A browser asks once per page load, so a process that had never
+     *  checked told every one of them `latest: null` — which is exactly how a
+     *  published release looked undetected. Later loads are served from cache. */
+    async statusNow() {
+        if (this.#checkedAt === 0)
+            await this.refresh();
+        return this.status();
+    }
     /** Ask now. Concurrent callers share the one request. */
     refresh() {
         this.#inFlight ??= this.fetchLatest()
@@ -77,6 +88,47 @@ export class UpdateCheck {
         return this.#inFlight;
     }
 }
+/** Often enough to catch an idle window on a busy box, and cheap: the registry
+ *  itself is still only asked once per TTL (`status()` owns that). */
+const AUTO_POLL_MS = 15 * 60_000;
+/** Watch for the moment all three conditions hold. Returns its own stop. */
+export function startAutoUpdate(check, auto, pollMs = AUTO_POLL_MS) {
+    // A handover drains first, which can outlast a poll interval; a second
+    // attempt on top of it would drain an already-draining Pier.
+    let handingOver = false;
+    const tick = async () => {
+        if (handingOver || !auto.enabled())
+            return;
+        // Refreshes in the background when stale; today's answer is good enough,
+        // because the next tick is a quarter of an hour away either way.
+        const { latest, available } = check.status();
+        if (!available || !auto.idle())
+            return;
+        log.info(`auto-update: idle and ${latest ?? "a newer version"} is out — handing over to the updater`);
+        handingOver = true;
+        try {
+            const started = await auto.apply();
+            // Not silent (§5b): an update that never happens must not look like an
+            // update that was never wanted. `busy` is the one non-start that is
+            // fine — someone else is already restarting this Pier.
+            if (started === "busy")
+                log.info("auto-update: a handover or restart is already in progress");
+            else if (started !== "started")
+                log.error(`auto-update could not start: ${started}`);
+        }
+        catch (err) {
+            log.error("auto-update failed", err);
+        }
+        finally {
+            // Only reached when the handover did *not* take the process with it, so
+            // the next tick is allowed to try again.
+            handingOver = false;
+        }
+    };
+    const timer = setInterval(() => void tick(), pollMs);
+    timer.unref(); // a pending check must never be what keeps the process alive
+    return () => clearInterval(timer);
+}
 export async function fetchLatestVersion() {
     // Plain JSON: the abbreviated-packument content type npm uses for a whole
     // package is a 406 on this endpoint, which answers one version already.

package/dist/web/auth.js

@@ -17,7 +17,7 @@
 // header) because the workbench lives on SSE, and EventSource sends no headers.
 import { createHash, createHmac, randomBytes, randomInt, scryptSync, timingSafeEqual, } from "node:crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { getCookie, setCookie } from "hono/cookie";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { pierDb } from "../db.js";
 import { logger } from "../log.js";
 const log = logger("auth");
@@ -271,9 +271,19 @@ export function registerAuthRoutes(app, store) {
         }
         failures.delete(client);
         store.setPassword(next);
-        // The rotation just killed this caller's cookie too; re-issue rather than
-        // bounce the person who is holding the new password to the login form.
-        issueCookie(c, store);
+        // The rotation just killed every cookie out there, this caller's included —
+        // a password is changed because the old one may be known, and "everyone
+        // signs in again" is the whole point. Clear the dead cookie; the client
+        // sends the person to the login form with the password they just chose.
+        deleteCookie(c, COOKIE, { path: "/" });
+        return c.json({ ok: true });
+    });
+    // Signs out this browser by clearing its cookie. The value itself stays
+    // verifiable until it expires — it is a signature, not a stored id — so the
+    // full revocation story remains the password change above. Behind the
+    // boundary like every write: only a signed-in browser has anything to end.
+    app.post("/logout", (c) => {
+        deleteCookie(c, COOKIE, { path: "/" });
         return c.json({ ok: true });
     });
 }

package/dist/web/explorer.js

@@ -1,7 +1,9 @@
 // Files view backend: read-only directory listing, file bytes and git
-// ref/diff queries for the Console's Files view. Every route is scoped to a
-// known project cwd — the picker offers exactly those roots, and nothing
-// outside one is ever listed, read or diffed.
+// ref/diff queries for the Console's Files view. `root` is any directory the
+// process can read — sessions work in worktrees and siblings of their cwd, and
+// an owner who is already past the Console password can reach those paths
+// anyway. `path` is still confined to the `root` it was asked under, so a
+// listing can never widen itself, and nothing here writes.
 import { execFile } from "node:child_process";
 import { readdir, readFile, realpath, stat } from "node:fs/promises";
 import { basename, extname, isAbsolute, resolve, sep } from "node:path";
@@ -27,17 +29,16 @@ const MAX_DIFF_BYTES = 2 * 1024 * 1024;
 const REF_RE = /^[^-\s][^\s]*$/;
 /** git in `root`, output capped — a diff is display data, not an archive. */
 const git = async (root, ...args) => (await run("git", ["-C", root, ...args], { maxBuffer: MAX_DIFF_BYTES })).stdout;
-export function registerExplorerRoutes(app, { factory, nascentCwds }) {
-    /** The scope check every route shares: `root` must be a project cwd Pi
-     *  already knows, and `path` must resolve inside it (realpath both ends —
-     *  neither `..` nor a symlink steps outside). Returns the real target. */
+export function registerExplorerRoutes(app) {
+    /** The scope check every route shares: `root` must be an absolute directory,
+     *  and `path` must resolve inside it (realpath both ends — neither `..` nor a
+     *  symlink steps outside). Returns the real target. */
     const resolveScoped = async (root, path = "") => {
         if (!root || !isAbsolute(root))
-            throw new Error("root must be a known project directory");
-        const known = new Set([...(await factory.list()).map((s) => s.cwd), ...nascentCwds()]);
-        if (!known.has(root))
-            throw new Error("root must be a known project directory");
+            throw new Error("root must be an absolute directory");
         const real = await realpath(root);
+        if (!(await stat(real)).isDirectory())
+            throw new Error("root must be an absolute directory");
         const target = await realpath(resolve(real, path));
         if (target !== real && !target.startsWith(real + sep))
             throw new Error("path escapes root");
@@ -91,13 +92,13 @@ export function registerExplorerRoutes(app, { factory, nascentCwds }) {
             return { name: line.slice(0, tab), subject: line.slice(tab + 1) };
         });
         // Unit/record separators, because a body is multi-line by nature.
-        const commits = (await git(root, "log", "-20", "--format=%h\u001f%at\u001f%an\u001f%s\u001f%b\u001e"))
+        const commits = (await git(root, "log", "-20", "--format=%h\u001f%at\u001f%an\u001f%ae\u001f%s\u001f%b\u001e"))
             .split("\u001e")
             .map((r) => r.trimStart())
             .filter(Boolean)
             .map((r) => {
-            const [hash = "", at = "", author = "", subject = "", body = ""] = r.split("\u001f");
-            return { hash, at: Number(at) * 1000, author, subject, body: body.trim() };
+            const [hash = "", at = "", author = "", email = "", subject = "", body = ""] = r.split("\u001f");
+            return { hash, at: Number(at) * 1000, author, email, subject, body: body.trim() };
         });
         return c.json({ branch, refs, commits });
     });

package/dist/web/files.js

@@ -39,7 +39,7 @@ export function guarded(app, method, path, status, fn) {
         }
     });
 }
-export function registerFileRoutes(app, { factory, config, nascentCwd }) {
+export function registerFileRoutes(app, { factory, config, nascentCwd, onConfigWritten }) {
     // Scope comes from the client as "global" or a project cwd; only cwds Pi
     // already knows (the session list) are accepted — never an arbitrary path.
     const parseScope = async (raw) => {
@@ -77,6 +77,7 @@ export function registerFileRoutes(app, { factory, config, nascentCwd }) {
         }
         const name = c.req.param("name");
         await config.writeFile(scope, name, body.content, body.expected);
+        onConfigWritten?.();
         return c.json({ ok: true, content: await config.readFile(scope, name) });
     });
     // Resource names may contain slashes — query params, not path params.

package/dist/web/instance.js

@@ -7,7 +7,12 @@ import { normalizeModelMenu, normalizePublicUrl } from "../settings.js";
  *  a loop, and the journal is shared with everything else Pier says. */
 const CLIENT_LOG_PER_MINUTE = 60;
 export function registerInstanceRoutes(app, deps) {
-    const { settings, updates, secrets, onUnlocked } = deps;
+    const { settings, updates, updater = null, secrets, onUnlocked, onSettingsChanged } = deps;
+    const updateLog = logger("update");
+    // How long POST /api/update may hold its response open. A busy Pier drains
+    // first, which can take minutes, and a response held that long dies at every
+    // proxy on the way (principle 7): past this cap the answer is "draining".
+    const APPLY_REPLY_CAP_MS = 10_000;
     // The browser's half of the log. A workbench that threw after the response
     // left the server is otherwise invisible here (ui/report.ts) — this is the
     // one route whose entire purpose is to make it visible.
@@ -35,16 +40,69 @@ export function registerInstanceRoutes(app, deps) {
     // Instance settings. The password lives behind its own route (web/auth.ts):
     // it is a credential, and changing it takes the old one.
     app.get("/api/settings", (c) => c.json(settings.get()));
-    // Read-only on purpose: the workbench says a newer Pier exists, and applying
-    // it stays `pier update` in a terminal. An HTTP route that installs packages
-    // is a supply-chain surface behind one password.
-    app.get("/api/update", (c) => c.json(updates.status()));
+    // What the version badge reads: the two versions, whether this instance can
+    // do anything about the gap, and whether it is allowed to do it unattended.
+    // `statusNow` so a browser opened seconds after a restart is told the truth
+    // rather than "no idea yet".
+    app.get("/api/update", async (c) => c.json({
+        ...(await updates.statusNow()),
+        canApply: updater !== null,
+        autoUpdate: settings.get().autoUpdate,
+        // Reported whether or not an update is pending: the repair is the same,
+        // and finding out at the next restart is finding out too late.
+        problem: updater?.problem() ?? null,
+    }));
+    // Applying. Nothing is installed here: the work is handed to the service
+    // manager's own oneshot unit, which stops Pier, backs the database up,
+    // installs and starts Pier again — an npm child of this process would be
+    // killed by the very restart it is performing.
+    app.post("/api/update", async (c) => {
+        if (!updater) {
+            return c.json({ error: "no service manager owns this Pier — update it with: pier update" }, 409);
+        }
+        const { current, latest, available } = await updates.statusNow();
+        if (!available) {
+            return c.json({ error: latest === null ? "the registry could not be reached" : `${current} is the latest` }, 409);
+        }
+        const problem = updater.problem();
+        if (problem !== null) {
+            updateLog.error(`update to ${latest} refused: ${problem}`);
+            return c.json({ error: problem }, 409);
+        }
+        const applied = updater.apply().catch((err) => {
+            updateLog.error("update handover failed", err);
+            return "failed";
+        });
+        const started = await Promise.race([
+            applied,
+            new Promise((resolve) => setTimeout(resolve, APPLY_REPLY_CAP_MS, "draining").unref()),
+        ]);
+        if (started === "draining") {
+            // The handover keeps running behind this response; if it fails later,
+            // main.ts's takeWorkAgain reports it and reopens the gate (§5b).
+            updateLog.info(`updating to ${latest} on the Console's request — waiting for running work to finish`);
+            return c.json({ started: true, draining: true, latest }, 202);
+        }
+        if (started === "busy") {
+            return c.json({ error: "an update or restart is already in progress" }, 409);
+        }
+        if (started !== "started") {
+            updateLog.error(`update to ${latest} refused by the updater: ${started}`);
+            return c.json({
+                error: started === "not-installed"
+                    ? "the systemd unit is not installed — run: pier service install"
+                    : "the updater could not be started; see the journal",
+            }, 500);
+        }
+        updateLog.info(`updating to ${latest} on the Console's request — Pier stops and starts again`);
+        return c.json({ started: true, latest });
+    });
     // Partial on purpose: each surface sends only the setting it edits, and a
     // malformed field is rejected before anything is written.
     app.put("/api/settings", async (c) => {
         const body = await c.req.json().catch(() => null);
-        if (!body || (body.publicUrl === undefined && body.modelMenu === undefined)) {
-            return c.json({ error: "publicUrl or modelMenu required" }, 400);
+        if (!body || (body.publicUrl === undefined && body.modelMenu === undefined && body.autoUpdate === undefined)) {
+            return c.json({ error: "publicUrl, modelMenu or autoUpdate required" }, 400);
         }
         if (body.publicUrl !== undefined) {
             if (typeof body.publicUrl !== "string")
@@ -62,6 +120,14 @@ export function registerInstanceRoutes(app, deps) {
             }
             settings.setModelMenu(menu);
         }
+        if (body.autoUpdate !== undefined) {
+            if (typeof body.autoUpdate !== "boolean")
+                return c.json({ error: "autoUpdate must be a boolean" }, 400);
+            settings.setAutoUpdate(body.autoUpdate);
+        }
+        // Only the URL: the model menu is read per picker call, not per session.
+        if (body.publicUrl !== undefined)
+            onSettingsChanged?.();
         return c.json(settings.get());
     });
     // Layer-1 key status and control (Console → Settings → Security). The GET

package/dist/web/providers.js

@@ -37,7 +37,11 @@ function setupFrom(raw) {
         models,
     };
 }
-export function registerProviderRoutes(app, providers) {
+export function registerProviderRoutes(app, providers, 
+/** A session picks its providers up when it opens, so one that is already
+ *  live cannot use what was just configured: server.ts recycles the idle
+ *  ones after every change of credentials or structure. */
+onProvidersChanged = () => { }) {
     const flows = new ProviderFlows(providers);
     const configure = async (setup) => {
         await providers.setup(setup);
@@ -67,8 +71,11 @@ export function registerProviderRoutes(app, providers) {
             if (setup.kind === "custom" && authType === "oauth") {
                 return c.json({ error: "custom providers support API-key authentication" }, 400);
             }
-            if (authType === null)
-                return c.json({ ok: true, provider: await configure(setup) });
+            if (authType === null) {
+                const provider = await configure(setup);
+                onProvidersChanged();
+                return c.json({ ok: true, provider });
+            }
             const before = (await providers.providers()).find((candidate) => candidate.id === setup.id);
             if (setup.kind === "builtin" && !before?.builtin) {
                 return c.json({ error: "unknown built-in provider" }, 400);
@@ -78,9 +85,13 @@ export function registerProviderRoutes(app, providers) {
             const flow = await flows.start(setup.id, authType, async () => {
                 if (!before)
                     requireMethod(await configure(setup), authType);
-            }, async () => {
+            }, 
+            // Runs once the login itself succeeded: the credential is new even
+            // where the structure was already written by `prepare`.
+            async () => {
                 if (before)
                     await configure(setup);
+                onProvidersChanged();
             });
             return c.json(flow, 202);
         }
@@ -120,6 +131,7 @@ export function registerProviderRoutes(app, providers) {
     app.post("/api/providers/:provider/logout", async (c) => {
         try {
             await providers.logout(c.req.param("provider"));
+            onProvidersChanged();
             return c.json({ ok: true });
         }
         catch (err) {