@timqi/pier 0.0.21 → 0.0.22

package/dist/agent/config-sync.js

@@ -1,54 +1,98 @@
 // Credential-blind projection of the portable agent configuration.
-const MODEL_KEYS = ["id", "name", "reasoning", "input", "cost", "contextWindow", "maxTokens", "api"];
-const COST_KEYS = ["input", "output", "cacheRead", "cacheWrite"];
+/** Never leaves the instance, at any depth of a models.json provider: the
+ *  credentials, and the endpoint they authenticate against — a sharing link is
+ *  public. Every other field is metadata Pi's own schema already validates, so
+ *  it travels as-is instead of through a field list chasing Pi's versions. */
+const PRIVATE_KEYS = ["apiKey", "headers", "baseUrl"];
+/** The catalog is the part of a provider sync owns outright: absent on the
+ *  source means deleted here, while a field the source never states stays. */
+const CATALOG_KEYS = ["models", "modelOverrides"];
+/** Dropped strings shorter than this ("", "Bearer") collide with legitimate
+ *  metadata; a credential or an endpoint does not. */
+const SECRET_CHARS = 8;
+const asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
 function record(value, where) {
-    if (!value || typeof value !== "object" || Array.isArray(value) ||
-        ![Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+    const plain = asRecord(value);
+    if (!plain || ![Object.prototype, null].includes(Object.getPrototypeOf(plain))) {
         throw new Error(`${where} must be an object`);
     }
-    return value;
+    return plain;
 }
 function only(value, keys, where) {
     if (Object.keys(value).some((key) => !keys.includes(key))) {
         throw new Error(`${where} contains unsupported fields`);
     }
 }
-function modelDefinition(value) {
-    const model = record(value, "model");
-    only(model, MODEL_KEYS, "model");
-    if (typeof model.id !== "string" || !model.id.trim() || model.id !== model.id.trim()) {
-        throw new Error("model id must be a non-empty trimmed string");
-    }
-    if (model.name !== undefined && (typeof model.name !== "string" || !model.name.length))
-        throw new Error("model name must be a non-empty string");
-    if (model.reasoning !== undefined && typeof model.reasoning !== "boolean") {
-        throw new Error("model reasoning must be a boolean");
-    }
-    if (model.api !== undefined && (typeof model.api !== "string" || !/^[a-z][a-z0-9-]*$/.test(model.api))) {
-        throw new Error("model api must be a protocol name");
+/** Every string in a JSON value, so one containment test covers the whole
+ *  projection however deeply Pi nests a future field. */
+function strings(value, found = []) {
+    const nested = asRecord(value);
+    if (typeof value === "string")
+        found.push(value);
+    else if (Array.isArray(value))
+        for (const entry of value)
+            strings(entry, found);
+    else if (nested)
+        for (const entry of Object.values(nested))
+            strings(entry, found);
+    return found;
+}
+/** Deep copy of JSON-only data; the private fields are dropped and handed to
+ *  `onPrivate` — collected on the way out, refused on the way in. */
+function project(value, where, onPrivate) {
+    if (value === null || ["string", "boolean", "number"].includes(typeof value))
+        return value;
+    if (Array.isArray(value))
+        return value.map((entry) => project(entry, where, onPrivate));
+    return Object.fromEntries(Object.entries(record(value, where)).flatMap(([key, entry]) => {
+        if (PRIVATE_KEYS.includes(key)) {
+            onPrivate(key, entry);
+            return [];
+        }
+        return [[key, project(entry, `${where} ${key}`, onPrivate)]];
+    }));
+}
+/** The shape both sides must agree on: a provider id that cannot address
+ *  anything but its own record, and a catalog addressable by model id. */
+function portable(id, value, onPrivate) {
+    if (id.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || ["constructor", "prototype"].includes(id)) {
+        throw new Error("invalid snapshot provider id");
     }
-    if (model.input !== undefined && (!Array.isArray(model.input) || !model.input.length ||
-        model.input.some((input) => input !== "text" && input !== "image") ||
-        new Set(model.input).size !== model.input.length)) {
-        throw new Error("model input must contain text or image without duplicates");
+    const provider = record(project(value, `provider ${id}`, onPrivate), `provider ${id}`);
+    const models = provider.models ?? [];
+    if (!Array.isArray(models))
+        throw new Error("models must be an array");
+    const ids = models.map((model) => record(model, "model").id);
+    if (ids.some((modelId) => typeof modelId !== "string" || !modelId.trim() || modelId !== modelId.trim())) {
+        throw new Error("model id must be a non-empty trimmed string");
     }
-    for (const key of ["contextWindow", "maxTokens"]) {
-        if (model[key] !== undefined && (typeof model[key] !== "number" || !Number.isSafeInteger(model[key]) || model[key] <= 0)) {
-            throw new Error(`model ${key} must be a positive integer`);
-        }
+    if (new Set(ids).size !== ids.length)
+        throw new Error("duplicate model ids");
+    const overrides = provider.modelOverrides ?? {};
+    for (const [overrideId, override] of Object.entries(record(overrides, "modelOverrides"))) {
+        record(override, `modelOverrides ${overrideId}`);
     }
-    if (model.cost !== undefined) {
-        const cost = record(model.cost, "model cost");
-        only(cost, COST_KEYS, "model cost");
-        for (const key of COST_KEYS) {
-            if (typeof cost[key] !== "number" || !Number.isFinite(cost[key]) || cost[key] < 0) {
-                throw new Error(`model cost ${key} must be a non-negative finite number`);
-            }
-        }
+    return provider;
+}
+/** Project disk metadata before validation, then fail closed if anything the
+ *  projection removed still appears in it: a deny list cannot foresee the field
+ *  Pi adds next, but it can refuse to publish a value it just dropped. */
+export function snapshotProviders(providers = {}) {
+    const dropped = [];
+    const shared = Object.fromEntries(Object.entries(providers).flatMap(([id, provider]) => {
+        const value = portable(id, provider, (_key, entry) => {
+            dropped.push(...strings(entry).filter((secret) => secret.length >= SECRET_CHARS));
+        });
+        return Object.keys(value).length ? [[id, value]] : [];
+    }));
+    const exported = strings(shared);
+    if (dropped.some((secret) => exported.some((value) => value.includes(secret)))) {
+        throw new Error("models.json repeats a credential or endpoint in a shared field; remove it before sharing");
     }
-    return structuredClone(model);
+    return shared;
 }
-/** Strict import boundary: unknown fields are rejected, never treated as masked secrets. */
+/** Strict import boundary: a source that states a private field is refused,
+ *  never trusted as a mask over the local one. */
 export function normalizeAgentSnapshot(raw) {
     const snapshot = record(raw, "agent snapshot");
     only(snapshot, ["files", "providers"], "agent snapshot");
@@ -59,65 +103,53 @@ export function normalizeAgentSnapshot(raw) {
             throw new Error(`${name} must be a string or null`);
         }
     }
-    const providers = Object.fromEntries(Object.entries(record(snapshot.providers, "snapshot providers")).map(([id, value]) => {
-        if (id.length > 100 || !/^[a-z0-9][a-z0-9._-]*$/.test(id) || ["constructor", "prototype"].includes(id)) {
-            throw new Error("invalid snapshot provider id");
-        }
-        const provider = record(value, "snapshot provider");
-        only(provider, ["models"], "snapshot provider");
-        if (!Array.isArray(provider.models))
-            throw new Error("snapshot provider models must be an array");
-        const models = provider.models.map(modelDefinition);
-        if (new Set(models.map((model) => model.id)).size !== models.length)
-            throw new Error("duplicate model ids");
-        return [id, { models }];
-    }));
-    return { files: { "SYSTEM.md": files["SYSTEM.md"], "AGENTS.md": files["AGENTS.md"] }, providers };
+    const providers = Object.fromEntries(Object.entries(record(snapshot.providers, "snapshot providers"))
+        .map(([id, provider]) => [id, portable(id, provider, (key) => {
+            throw new Error(`snapshot provider must not carry ${key}`);
+        })]));
+    return {
+        files: { "SYSTEM.md": files["SYSTEM.md"], "AGENTS.md": files["AGENTS.md"] },
+        providers,
+    };
 }
-/** Project disk metadata before validation, so no nested transport object can escape. */
-export function snapshotProviders(providers = {}) {
-    return Object.fromEntries(Object.entries(providers).flatMap(([id, provider]) => {
-        if (provider.models === undefined)
-            return [];
-        if (!Array.isArray(provider.models))
-            throw new Error("models.json models must be an array");
-        const models = provider.models.map((value) => {
-            const source = record(value, "models.json model");
-            const model = Object.fromEntries(MODEL_KEYS.flatMap((key) => source[key] === undefined ? [] : [[key, source[key]]]));
-            if (source.cost !== undefined) {
-                const cost = record(source.cost, "models.json model cost");
-                model.cost = Object.fromEntries(COST_KEYS.flatMap((key) => cost[key] === undefined ? [] : [[key, cost[key]]]));
-            }
-            return modelDefinition(model);
-        });
-        return [[id, { models }]];
-    }));
+/** A model or override arrives whole; only the local private fields survive it. */
+function withLocalPrivate(incoming, local) {
+    const merged = { ...incoming };
+    for (const key of PRIVATE_KEYS)
+        if (local && Object.hasOwn(local, key))
+            merged[key] = local[key];
+    return merged;
 }
-/** Replace only portable fields, retaining excluded fields for matching local model ids. */
+const modelsById = (models) => new Map((Array.isArray(models) ? models : []).flatMap((model) => {
+    const value = asRecord(model);
+    return value ? [[value.id, value]] : [];
+}));
+/** The source sets what it states and replaces the catalog; credentials and
+ *  endpoints stay local, matched by provider, model id and override id. */
 export function mergeSnapshotProviders(local = {}, incoming) {
-    const providers = structuredClone(local);
-    for (const [id, provider] of Object.entries(providers)) {
-        if (!Object.hasOwn(incoming, id)) {
-            delete provider.models;
-        }
-    }
-    for (const [id, { models }] of Object.entries(incoming)) {
-        if (!Object.hasOwn(local, id)) {
+    for (const id of Object.keys(incoming)) {
+        if (!Object.hasOwn(local, id))
             throw new Error(`provider ${id} must be configured locally before importing models`);
-        }
-        const provider = providers[id];
-        if (provider.models !== undefined && !Array.isArray(provider.models))
-            throw new Error("models.json models must be an array");
-        const existing = new Map((provider.models ?? []).map((value) => {
-            const model = record(value, "models.json model");
-            return [model.id, model];
-        }));
-        provider.models = models.map((model) => {
-            const retained = { ...existing.get(model.id) };
-            for (const key of MODEL_KEYS)
-                delete retained[key];
-            return { ...retained, ...model };
-        });
     }
-    return providers;
+    return Object.fromEntries(Object.entries(local).map(([id, provider]) => {
+        const current = record(provider, "models.json provider");
+        const source = incoming[id];
+        if (!source)
+            return [id, Object.fromEntries(Object.entries(current).filter(([key]) => !CATALOG_KEYS.includes(key)))];
+        // The catalog shapes are the ones normalizeAgentSnapshot already proved.
+        const merged = { ...current, ...structuredClone(source) };
+        for (const key of CATALOG_KEYS)
+            if (!Object.hasOwn(source, key))
+                delete merged[key];
+        if (merged.models !== undefined) {
+            const previous = modelsById(current.models);
+            merged.models = merged.models.map((model) => withLocalPrivate(model, previous.get(model.id)));
+        }
+        if (merged.modelOverrides !== undefined) {
+            const previous = asRecord(current.modelOverrides) ?? {};
+            merged.modelOverrides = Object.fromEntries(Object.entries(merged.modelOverrides)
+                .map(([key, override]) => [key, withLocalPrivate(override, asRecord(previous[key]))]));
+        }
+        return [id, merged];
+    }));
 }

package/dist/db.js

@@ -361,9 +361,11 @@ let shared;
  * defaults to it; a test passes `openDb(":memory:")` instead.
  */
 export const pierDb = () => (shared ??= openDb(PIER_DB));
-/** A release-level restore point, taken while the service is stopped even when
- * the release has no schema migration. The previous complete copies stay put if
- * writing this one fails.
+/** A release-level restore point, taken for every release even when it has no
+ * schema migration. The previous complete copies stay put if writing this one
+ * fails, and the service may be running while it is written: `copyDatabase`
+ * reads through a read-only connection, so what it writes is one consistent
+ * snapshot of a live database rather than a torn `cp`.
  *
  * `version` is the Pier that produced this database, not the one being
  * installed: the updater runs this from the tree it is about to replace, and

package/dist/main.js

@@ -205,8 +205,9 @@ await configurationSync.reconcile();
 tasks.start();
 readyForConfigReload = true;
 void secrets.unlock().then(startChannels, (err) => log.error("secrets locked — channels not started; unlock from Console → Settings → Security, or repair master.key", err));
-// Replacing Pier is systemd's job, not this process's: the oneshot unit stops
-// the service, snapshots the database, installs and starts it again. Without
+// Replacing Pier is systemd's job, not this process's: the oneshot unit
+// snapshots the database, installs, then stops the service and starts it again
+// on the new version — in that order, so only the last two are downtime. Without
 // that unit there is nothing to hand the work to, and the Console says so
 // instead of offering a button that cannot work.
 const updates = new UpdateCheck();
@@ -247,8 +248,14 @@ const takeWorkAgain = (why) => {
 };
 /** How long the handover has to actually stop us. `systemctl start --no-block`
  *  returns when the job is *queued*, so "started" is not proof of anything;
- *  the real outcome is a SIGTERM a second or two later. */
-const HANDOVER_GRACE_MS = 60_000;
+ *  the real outcome is a SIGTERM — but only after the updater has snapshotted
+ *  the database and installed the new version, which is a registry download on
+ *  someone else's network — ten seconds on a good day, minutes on a bad one.
+ *  So this waits far longer than the stop itself needs, because reopening the
+ *  gate mid-install would take work we are about to be SIGTERM'd out of, and
+ *  still short enough that a handover which never happens does not refuse
+ *  messages all afternoon. */
+const HANDOVER_GRACE_MS = 5 * 60_000;
 const handOverToUpdater = async () => {
     // One handover at a time, and never on top of a restart: the Console button,
     // the auto-update tick and SIGUSR2 would otherwise drain the same Pier

package/dist/service.js

@@ -104,8 +104,14 @@ function legacyOptions(home) {
         ...(pierHome ? { pierHome } : {}),
     };
 }
-/** A separate cgroup stops Pier, takes a consistent backup, updates the exact
- * npm installation recorded at install time, and always starts Pier again. */
+/** A separate cgroup snapshots the database, updates the exact npm
+ * installation recorded at install time, and only then restarts Pier.
+ *
+ * Both slow steps run while the service is still up, so the downtime is one
+ * stop and one start rather than the ~10s an install takes. The snapshot is
+ * consistent on a live database — `VACUUM INTO` off a read-only connection
+ * (db.ts) — and it still runs from the tree npm is about to replace, so the
+ * copy carries the version whose schema it pairs with. */
 export function renderUpdateUnit(options) {
     const { execPath, npmPath, entry, pierHome, shellPath } = options;
     const cli = join(dirname(entry), "cli.js");
@@ -120,12 +126,16 @@ Type=oneshot
 # resolves node from PATH, and systemd's minimal PATH has no fnm/nvm node —
 # the install then dies with "node: not found" with the tree half written.
 ${environment("PATH", pathEnv(execPath, shellPath))}
-${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=systemctl --user stop ${UNIT_NAME}
-ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
+${pierHome ? `${environment("PIER_HOME", pierHome)}\n` : ""}ExecStart=${quote(execPath, true)} ${quote(cli, true)} backup
 # npm runs under the recorded node: its shebang needs a node on PATH too.
 ExecStart=${quote(execPath, true)} ${quote(npmPath, true)} install -g @timqi/pier@latest
-# ExecStopPost runs on success and failure, so a failed backup or npm install
-# does not leave the previously working service stopped.
+# Last, because everything above it is downtime the running Pier does not owe
+# anyone. A failed backup or install never gets here: the service stays up on
+# the code it already loaded.
+ExecStart=systemctl --user stop ${UNIT_NAME}
+# ExecStopPost runs on success and failure. After a failed step above, Pier was
+# never stopped and this is a no-op; it is here for the window that is still
+# fatal — the unit dying between that stop and the start of the new version.
 ExecStopPost=systemctl --user start ${UNIT_NAME}
 `;
 }
@@ -300,7 +310,7 @@ export function startUpdate(options) {
     if (!run(["systemctl", "--user", "start", "--no-block", UPDATE_UNIT_NAME]))
         return "failed";
     say(`updating in the background — follow it with: journalctl --user -u ${UPDATE_UNIT_NAME} -f`);
-    say(`Pier stops, snapshots the database into db/backups/, installs, then starts again.`);
+    say(`Pier snapshots the database into db/backups/ and installs while still up, then stops and starts on the new version.`);
     return "started";
 }
 export function uninstall(home = homedir(), say = console.log, exec) {

package/dist/tasks/definitions.js

@@ -247,6 +247,10 @@ export class TaskDefinitions {
         return this.router.stateOf(sessionId) !== undefined ||
             (await this.factory.find(sessionId)) !== undefined;
     }
+    /** A caller's own directory — what a relative or omitted cwd resolves against. */
+    async sessionCwd(sessionId) {
+        return (await this.factory.find(sessionId))?.cwd;
+    }
     /** The guard `ownerOf` exists for, on the three ways a definition changes. */
     assertOwner(task, by, what) {
         const owner = ownerOf(task);

package/dist/tasks/tool.js

@@ -1,3 +1,4 @@
+import { isAbsolute, resolve } from "node:path";
 import { Type } from "typebox";
 import { TaskDefinitions, record, requiredString } from "./definitions.js";
 import { TaskMessenger } from "./messages.js";
@@ -57,10 +58,14 @@ const summarizeGroup = (group, members, messages) => defined({
     winnerRunId: group.winnerRunId,
     members: members.map((run) => trimResult(summarize(run, messages.openDecisionId(run.id)))),
 });
+const LaunchSchema = Type.Object({
+    model: Type.Optional(Type.Object({ provider: Type.String(), id: Type.String() })),
+    thinking: Type.Optional(Type.String()),
+});
 // Model-facing draft shape. Guidance only: runtime truth stays in parseDraft,
 // so schema drift can never loosen boundary validation.
 const DraftSchema = Type.Object({
-    name: Type.String(),
+    name: Type.Optional(Type.String({ description: "Defaults to the prompt's first line." })),
     description: Type.Optional(Type.String()),
     trigger: Type.Optional(Type.Union([
         Type.Object({ type: Type.Literal("manual") }),
@@ -77,14 +82,11 @@ const DraftSchema = Type.Object({
         Type.Object({
             type: Type.Literal("agent"),
             session: Type.Union([
-                Type.Object({ mode: Type.Literal("fresh"), cwd: Type.String() }),
+                Type.Object({ mode: Type.Literal("fresh"), cwd: Type.Optional(Type.String({ description: "Absolute, or relative to your session's directory; omitted = your directory." })) }),
                 Type.Object({ mode: Type.Literal("reuse"), sessionId: Type.String() }),
             ]),
             prompt: Type.String(),
-            launch: Type.Optional(Type.Object({
-                model: Type.Optional(Type.Object({ provider: Type.String(), id: Type.String() })),
-                thinking: Type.Optional(Type.String()),
-            })),
+            launch: Type.Optional(LaunchSchema),
         }),
         Type.Object({ type: Type.Literal("bash"), script: Type.String(), cwd: Type.String() }),
         Type.Object({ type: Type.Literal("task"), taskId: Type.String() }),
@@ -101,7 +103,7 @@ export function taskToolSpec(execute) {
     return {
         name: "task",
         label: "Pier Task",
-        description: "Manage durable Pier tasks and subagents. Agent tasks run in a fresh session or a reused one. Run executes a stored task by task_id, a one-shot subagent from an inline task draft, or a core-joined fan-out via tasks[] with join all|first. Get accepts run_id, group_id, or task_id for that task's recent runs. Every operation returns immediately: results, group joins, and decision replies arrive as callback messages. Use steer/follow_up/resume for child control and contact/reply for supervisor decisions. models lists the deployment's model menu (operator pins with intent notes, else the live catalog).",
+        description: "Manage durable Pier tasks and subagents. Agent tasks run in a fresh session or a reused one. Run executes a stored task by task_id, a one-shot subagent from a prompt (shorthand: prompt + optional cwd/launch/name — cwd defaults to your own directory, relative paths resolve against it, name comes from the prompt) or from a full inline task draft, or a core-joined fan-out via tasks[] with join all|first. Get accepts run_id, group_id, or task_id for that task's recent runs. Every operation returns immediately: results, group joins, and decision replies arrive as callback messages. Use steer/follow_up/resume for child control and contact/reply for supervisor decisions. models lists the deployment's model menu (operator pins with intent notes, else the live catalog).",
         parameters: Type.Object({
             operation: strEnum("list", "create", "update", "run", "get", "cancel", "steer", "follow_up", "resume", "contact", "reply", "models"),
             task_id: Type.Optional(Type.String()),
@@ -111,13 +113,19 @@ export function taskToolSpec(execute) {
             message: Type.Optional(Type.String()),
             reason: Type.Optional(strEnum("progress", "decision")),
             session_mode: Type.Optional(strEnum("fresh")),
+            // The one-shot shorthand: a prompt is the whole delegation, and the
+            // fresh session in the caller's own directory is what it means.
+            prompt: Type.Optional(Type.String()),
+            cwd: Type.Optional(Type.String()),
+            launch: Type.Optional(LaunchSchema),
+            name: Type.Optional(Type.String()),
             task: Type.Optional(DraftSchema),
             // The same draft again, spelled out, cost more tokens in every session
             // than the whole rest of this contract. One copy is the guidance; this
             // one points at it, and `parseDraft` is what actually validates either.
             tasks: Type.Optional(Type.Unsafe({
                 type: "array",
-                description: "2+ entries, each either a task draft shaped exactly like `task`, or {task_id}.",
+                description: "2+ entries, each a prompt string, {prompt, cwd?, launch?, name?}, a task draft shaped exactly like `task`, or {task_id}.",
                 items: { type: "object" },
             })),
             join: Type.Optional(strEnum("all", "first")),
@@ -140,12 +148,12 @@ export async function handleTaskTool(host, definitions, store, messages, raw, ca
     if (input.operation === "create") {
         if (active)
             throw new Error("subagents cannot create task definitions");
-        return definitions.create(input.task, `session:${callerSessionId}`);
+        return definitions.create(await expandDraft(definitions, input.task, callerSessionId), `session:${callerSessionId}`);
     }
     if (input.operation === "update") {
         if (active)
             throw new Error("subagents cannot update task definitions");
-        return definitions.update(requiredString(input.task_id, "task_id"), input.task);
+        return definitions.update(requiredString(input.task_id, "task_id"), await expandDraft(definitions, input.task, callerSessionId));
     }
     if (input.operation === "run") {
         if (Array.isArray(input.tasks)) {
@@ -158,7 +166,7 @@ export async function handleTaskTool(host, definitions, store, messages, raw, ca
                 throw new Error("tasks[] needs at least 2 entries; use task for a single run");
             const resolved = [];
             for (const rawEntry of input.tasks) {
-                const entry = record(rawEntry);
+                const entry = typeof rawEntry === "string" ? { prompt: rawEntry } : record(rawEntry);
                 if (!entry)
                     throw new Error("invalid tasks[] entry");
                 resolved.push(entry.task_id === undefined
@@ -168,7 +176,7 @@ export async function handleTaskTool(host, definitions, store, messages, raw, ca
             const { group, runs } = host.runGroup(resolved, input.join === "first" ? "first" : "all", callerSessionId, active?.id ?? null, input.callback === "none" ? null : callerSessionId);
             return summarizeGroup(group, runs, messages);
         }
-        const draft = input.task_id === undefined ? record(input.task) : undefined;
+        const draft = input.task_id === undefined ? inlineDraft(input) : undefined;
         const task = draft
             ? await resolveDraft(definitions, draft, active, callerSessionId)
             : resolveStored(definitions, input.task_id, active);
@@ -245,9 +253,58 @@ export async function handleTaskTool(host, definitions, store, messages, raw, ca
     }
     throw new Error("unknown task operation");
 }
+/** A single run's draft: the top-level shorthand (`prompt` …) or `task`, never both. */
+function inlineDraft(input) {
+    const { prompt, cwd, launch, name } = input;
+    if (prompt === undefined)
+        return record(input.task) ?? undefined;
+    if (input.task !== undefined)
+        throw new Error("use either prompt or task");
+    return { prompt, cwd, launch, name };
+}
+/** The prompt's first line, unmarked and cut short: a label for the Console,
+ *  not an identifier — the run's id is what anything addresses. */
+function nameFromPrompt(prompt) {
+    const line = prompt.split("\n")
+        .map((l) => l.replace(/^[\s#>*-]+/, "").replace(/[*_`]/g, "").replace(/\s+/g, " ").trim())
+        .find(Boolean) ?? "subagent";
+    return line.length > 60 ? `${line.slice(0, 59).trimEnd()}…` : line;
+}
+/**
+ * The shape a draft is validated in, from the shapes a caller may write it in.
+ * A `prompt` shorthand becomes a fresh Agent action; a fresh session's cwd
+ * resolves against the caller's own directory (and is that directory when
+ * omitted); a missing name is the prompt's first line. Everything the caller
+ * did spell out passes through untouched — parseDraft still judges it.
+ */
+async function expandDraft(definitions, raw, callerSessionId) {
+    let draft = record(raw);
+    if (!draft)
+        return raw;
+    if (typeof draft.prompt === "string") {
+        if (draft.action !== undefined)
+            throw new Error("use either prompt (shorthand) or action");
+        const { prompt, cwd, launch, name, ...rest } = draft;
+        draft = { ...rest, name, action: { type: "agent", session: { mode: "fresh", cwd }, prompt, launch } };
+    }
+    const action = record(draft.action);
+    const session = record(action?.session);
+    if (action?.type === "agent" && session?.mode === "fresh" && (session.cwd === undefined || (typeof session.cwd === "string" && !isAbsolute(session.cwd)))) {
+        const base = await definitions.sessionCwd(callerSessionId);
+        if (!base)
+            throw new Error(`cwd ${session.cwd === undefined ? "omitted" : `"${session.cwd}" is relative`} and the calling session has no working directory; give an absolute path`);
+        draft = { ...draft, action: { ...action, session: { ...session, cwd: resolve(base, session.cwd ?? ".") } } };
+    }
+    if (draft.name === undefined && typeof action?.prompt === "string")
+        draft = { ...draft, name: nameFromPrompt(action.prompt) };
+    return draft;
+}
 /** Inline one-shot subagent: persisted like any task (kind "subagent",
  * filtered from default lists) so runs stay auditable and resumable. */
-async function resolveDraft(definitions, draft, active, callerSessionId) {
+async function resolveDraft(definitions, raw, active, callerSessionId) {
+    const draft = record(await expandDraft(definitions, raw, callerSessionId));
+    if (!draft)
+        throw new Error("task definition required");
     if (draft.trigger !== undefined && record(draft.trigger)?.type !== "manual") {
         throw new Error("inline subagent tasks must use a manual trigger");
     }

package/dist/web/instance.js

@@ -78,9 +78,9 @@ export function registerInstanceRoutes(app, deps) {
         problem: updater?.problem() ?? null,
     }));
     // Applying. Nothing is installed here: the work is handed to the service
-    // manager's own oneshot unit, which stops Pier, backs the database up,
-    // installs and starts Pier again — an npm child of this process would be
-    // killed by the very restart it is performing.
+    // manager's own oneshot unit, which backs the database up and installs while
+    // Pier still runs, then stops it and starts the new version — an npm child of
+    // this process would be killed by the very restart it is performing.
     app.post("/api/update", async (c) => {
         if (!updater) {
             return c.json({ error: "no service manager owns this Pier — update it with: pier update" }, 409);

package/dist/web/public/assets/activity-Bv8fc5Wj.js

@@ -0,0 +1,5 @@
+import{B as e,C as t,H as n,I as r,L as i,N as a,k as o,m as s,q as c,v as l,z as u}from"./index-BrBNzaid.js";var d=(e,t={})=>{let n=document.createElementNS(`http://www.w3.org/2000/svg`,e);for(let[e,r]of Object.entries(t))n.setAttribute(e,r);return n},f=e=>e===null?`-`:r(Date.now()-e),p={light:{edge:`#a3a3a3`,callback:`#0891b2`,message:`#d97706`,scheduler:{fill:`#f5f3ff`,stroke:`#a78bfa`,text:`#5b21b6`},console:{fill:`#eff6ff`,stroke:`#93c5fd`,text:`#1d4ed8`},task:{fill:`#fffbeb`,stroke:`#fbbf24`,text:`#92400e`},process:{fill:`#f5f5f5`,stroke:`#a3a3a3`,text:`#525252`,dash:`4 3`},streaming:{fill:`#ffffff`,stroke:`#10b981`,text:`#262626`},idle:{fill:`#fafafa`,stroke:`#d4d4d4`,text:`#737373`}},dark:{edge:`#7a7a7a`,callback:`#3fc3dd`,message:`#e0a13a`,scheduler:{fill:`#2b2440`,stroke:`#7d63c9`,text:`#c9b8f5`},console:{fill:`#1f2a3d`,stroke:`#4a7fbf`,text:`#a8c8f0`},task:{fill:`#3a2f1c`,stroke:`#b8862a`,text:`#f0d49a`},process:{fill:`#262626`,stroke:`#5c5c5c`,text:`#a3a3a3`,dash:`4 3`},streaming:{fill:`#22302a`,stroke:`#10b981`,text:`#e5e5e5`},idle:{fill:`#212121`,stroke:`#4a4a4a`,text:`#9a9a9a`}}},m=()=>p[document.documentElement.dataset.theme===`dark`?`dark`:`light`];function h(r,p,h){let g=`sessions`,_=`active`,v={sessions:[],runs:[],messages:[]},y=``,b=e(async()=>{let e=_,t=await n(`/api/activity?scope=${e}`,`Failed to load activity`);if(!t.ok){y=``,r.replaceChildren(i(`p`,`p-4 text-[13px] text-red-600`,t.error));return}if(e!==_)return;let a=JSON.stringify(t.value);if(`${e}:${a}`===y)return;y=`${e}:${a}`;let o=t.value;v={...o,sessions:o.sessions.map(e=>({...e,title:c(e.title)}))},x()});function x(){let e=o(t([[`Sessions`,`sessions`],[`Relationships`,`dependencies`]],g,e=>{g=e,x()}),i(`span`,`ml-auto text-[11.5px] text-neutral-400`,`${v.sessions.length} sessions · ${v.runs.length} runs`),t([[`Current`,`active`],[`Last 24h`,`recent`]],_,e=>{_=e,x(),b()})),n=i(`div`,`min-h-0 flex-1 overflow-auto`);g===`sessions`?S(n):w(n),r.replaceChildren(e,n)}function S(e){let t=document.createElement(`table`);t.className=`w-full table-fixed text-left text-[12.5px]`,t.innerHTML=`<thead class="sticky top-0 bg-neutral-50 text-[10.5px] uppercase tracking-wide text-neutral-400 shadow-[inset_0_-1px_0_var(--color-neutral-200)]"><tr>
+      <th class="w-[50%] px-4 py-2 font-semibold md:w-[34%]">Session</th>
+      <th class="hidden w-[38%] px-2 py-2 font-semibold md:table-cell">Project</th>
+      <th class="px-2 py-2 font-semibold md:w-[14%]">State</th>
+      <th class="px-2 py-2 font-semibold">In state</th></tr></thead>`;let n=document.createElement(`tbody`);for(let e of v.sessions){let t=document.createElement(`tr`);t.className=`cursor-pointer border-b border-neutral-100 transition-colors hover:bg-neutral-50`,t.onclick=()=>p(e.id);let r=i(`button`,`block w-full cursor-pointer truncate text-left font-medium text-neutral-800`,e.title??u(e.cwd));r.setAttribute(`type`,`button`),r.title=`${e.id}\n${e.cwd}`,r.onclick=t=>{t.stopPropagation(),p(e.id)},t.append(i(`td`,`px-4 py-2.5`,r,i(`div`,`truncate font-mono text-[11px] text-neutral-400 md:hidden`,e.cwd||`-`)),i(`td`,`hidden truncate px-2 py-2.5 font-mono text-[11.5px] text-neutral-500 md:table-cell`,e.cwd||`-`),i(`td`,`px-2 py-2.5`,C(e.state)),i(`td`,`px-2 py-2.5 font-mono text-[11.5px] text-neutral-400`,f(e.stateSince))),n.append(t)}t.append(n),e.append(t),v.sessions.length||e.append(i(`div`,`p-4`,l(_===`active`?`No active sessions.`:`No sessions in the last 24 hours.`)))}function C(e){return e===`streaming`?s(e,`bg-emerald-50 text-emerald-700 ring-emerald-200`,`animate-pulse bg-emerald-500`):s(e,`bg-neutral-100 text-neutral-600 ring-neutral-200`,`bg-neutral-300`)}function w(e){let t=new Map,n=[],r=(e,n,r,i)=>{t.has(e)||t.set(e,{id:e,label:n,kind:r,state:i})};for(let e of v.sessions)r(e.id,e.title??e.id.slice(0,10),`session`,e.state);for(let e of v.runs){let t=e.invokedBySessionId??`scheduler`,i=e.targetSessionId??(e.context.definition.action.type===`bash`?`process:${e.id}`:`task:${e.id}`);r(t,t===`scheduler`?`Scheduler`:t.slice(0,10),t===`scheduler`?`scheduler`:`session`),r(i,e.targetSessionId?e.targetSessionId.slice(0,10):e.context.definition.action.type===`bash`?`Bash process`:`Task`,e.targetSessionId?`session`:e.context.definition.action.type===`bash`?`process`:`task`),n.push({from:t,to:i,run:e,kind:`invocation`}),e.callbackSessionId&&(r(e.callbackSessionId,e.callbackSessionId.slice(0,10),`session`),n.push({from:i,to:e.callbackSessionId,run:e,kind:`callback`}))}for(let e of v.messages){if(!e.fromSessionId||!e.toSessionId||e.fromSessionId===e.toSessionId)continue;let t=v.runs.find(t=>t.id===e.runId);if(t){for(let t of[e.fromSessionId,e.toSessionId])r(t,t===`console`?`Console`:t.slice(0,10),t===`console`?`console`:`session`);n.push({from:e.fromSessionId,to:e.toSessionId,run:t,kind:`message`})}}if(!t.size){e.append(i(`div`,`p-4`,l(_===`active`?`No active dependencies.`:`No dependencies in the last 24 hours.`)));return}let a=[...t.values()],o=new Set(n.map(e=>e.to)),s=new Map,c=a.filter(e=>!o.has(e.id)).map(e=>e.id);c.length||c.push(a[0].id);for(let e of c)s.set(e,0);for(;c.length;){let e=c.shift();for(let t of n)t.from!==e||s.has(t.to)||(s.set(t.to,s.get(e)+1),c.push(t.to))}for(let e of a)s.has(e.id)||s.set(e.id,0);let u=new Map;for(let e of a){let t=s.get(e.id);u.set(t,[...u.get(t)??[],e])}let f=Math.max(...u.keys())+1,g=Math.max(...[...u.values()].map(e=>e.length)),y=n.some(e=>e.from!==e.to&&s.get(e.from)===s.get(e.to))?40:0,b=56+f*180+(f-1)*110+y,x=56+g*46+(g-1)*30,S=new Map;for(let[e,t]of u)t.forEach((t,n)=>S.set(t.id,{x:28+e*290+90,y:28+n*76+23}));let C=d(`svg`,{width:String(b),height:String(x),viewBox:`0 0 ${b} ${x}`,class:`block`}),w=d(`defs`),T=m();for(let[e,t]of[[`activity-arrow`,T.edge],[`activity-arrow-cb`,T.callback],[`activity-arrow-msg`,T.message]]){let n=d(`marker`,{id:e,viewBox:`0 0 10 10`,refX:`9`,refY:`5`,markerWidth:`6`,markerHeight:`6`,orient:`auto-start-reverse`});n.append(d(`path`,{d:`M 0 0 L 10 5 L 0 10 z`,fill:t})),w.append(n)}C.append(w);let E=new Set;for(let e of n){let t=`${e.from}→${e.to}:${e.kind}`;if(E.has(t))continue;E.add(t);let n=S.get(e.from),r=S.get(e.to),i=d(`path`,{d:n.x===r.x?`M ${n.x+90} ${n.y} C ${n.x+90+46} ${n.y}, ${r.x+90+46} ${r.y}, ${r.x+90} ${r.y}`:(()=>{let e=r.x>n.x,t=n.x+(e?90:-90),i=r.x+(e?-90:90),a=Math.max(36,Math.abs(i-t)*.45)*(e?1:-1);return`M ${t} ${n.y} C ${t+a} ${n.y}, ${i-a} ${r.y}, ${i} ${r.y}`})(),fill:`none`,stroke:e.kind===`callback`?T.callback:e.kind===`message`?T.message:T.edge,"stroke-width":`1.5`,"marker-end":e.kind===`callback`?`url(#activity-arrow-cb)`:e.kind===`message`?`url(#activity-arrow-msg)`:`url(#activity-arrow)`});e.kind===`callback`&&i.setAttribute(`stroke-dasharray`,`6 5`),e.kind===`message`&&i.setAttribute(`stroke-dasharray`,`2 5`),i.classList.add(`cursor-pointer`),i.onclick=()=>h(e.run.id),C.append(i)}let D=/[\u1100-\u11FF\u2E80-\uA4CF\uAC00-\uD7A3\uF900-\uFAFF\uFE30-\uFE4F\uFF00-\uFF60\uFFE0-\uFFE6]/,O=(e,t)=>{let n=0;for(let r=0;r<e.length;r++)if(n+=D.test(e[r])?2:1,n>t)return`${e.slice(0,r)}…`;return e};for(let e of a){let t=S.get(e.id),n=e.kind===`session`?e.state===`streaming`?T.streaming:T.idle:T[e.kind],r=d(`g`,{transform:`translate(${t.x},${t.y})`});e.kind===`session`&&r.classList.add(`cursor-pointer`),r.onclick=()=>{e.kind===`session`&&p(e.id)};let i=d(`rect`,{x:`-90`,y:`-23`,width:`180`,height:`46`,rx:`8`,fill:n.fill,stroke:n.stroke,"stroke-width":e.kind===`session`&&e.state===`streaming`?`1.5`:`1`});n.dash&&i.setAttribute(`stroke-dasharray`,n.dash),r.append(i);let a=-78;if(e.kind===`session`){let t=d(`circle`,{cx:`-75`,cy:`0`,r:`3.5`,fill:n.stroke});if(e.state===`streaming`){let e=d(`animate`,{attributeName:`opacity`,values:`1;0.3;1`,dur:`1.6s`,repeatCount:`indefinite`});t.append(e)}r.append(t),a=-64}let o=d(`text`,{x:String(a),"text-anchor":`start`,"dominant-baseline":`middle`,"font-size":`11.5`,"font-weight":e.kind===`session`?`500`:`400`,fill:n.text});o.textContent=O(e.label,e.kind===`session`?22:25);let s=d(`title`);s.textContent=e.label===e.id?e.id:`${e.label}\n${e.id}`,r.append(o,s),C.append(r)}let k=e=>i(`span`,`inline-block h-2 w-2 rounded-full ${e}`),A=e=>i(`span`,`inline-block h-0 w-6 border-t-2 ${e}`);e.append(i(`div`,`w-max p-4`,C),i(`div`,`flex flex-wrap gap-x-5 gap-y-1.5 border-t border-neutral-200 bg-neutral-50/60 px-4 py-2 text-[11px] text-neutral-500`,i(`span`,`inline-flex items-center gap-2`,A(`border-solid border-neutral-400`),`task invocation`),i(`span`,`inline-flex items-center gap-2 text-cyan-700`,A(`border-dashed border-cyan-500`),`callback`),i(`span`,`inline-flex items-center gap-2 text-amber-700`,A(`border-dotted border-amber-500`),`supervisor / control`),i(`span`,`inline-flex items-center gap-1.5`,k(`bg-emerald-500`),`streaming`),i(`span`,`inline-flex items-center gap-1.5`,k(`bg-neutral-300`),`idle`)))}let T=a(r,e=>{e===`dependencies`?g=`dependencies`:e===`sessions`&&(g=`sessions`),b()},()=>{r.replaceChildren(),v={sessions:[],runs:[],messages:[]},y=``});return window.addEventListener(`pier:theme`,()=>{T.visible&&x()}),Object.assign(T,{refresh(){T.visible&&b()}})}export{h as createActivityView};

package/dist/web/public/assets/boards-BRKjgEYX.js

@@ -0,0 +1 @@
+import{G as e,H as t,K as n,L as r,N as i,O as a,P as o,R as s,V as c,h as l}from"./index-BrBNzaid.js";var u=e=>e.public&&e.token?`/p/${e.slug}-${e.token}/`:`/boards/${e.slug}/`;function d(d,f){let p=[],m=``,h=r(`header`,`sticky top-0 z-30 flex h-10 items-center gap-3 border-b border-neutral-200 bg-white px-4`,r(`span`,`font-medium max-md:hidden`,`Boards`)),g=r(`div`,`px-4 py-5`);d.append(r(`div`,`min-h-0 flex-1 overflow-y-auto`,h,g));async function _(e,t){let r=await n(`/api/boards/${e.slug}`,{public:t},`PATCH`);if(r.ok)return e.token=(await r.json().catch(()=>({}))).token??``,x();m=await c(r,`Could not change ${e.slug}`),await S()}async function v(t){m=await e(`/api/boards/${t}`,`DELETE`,`Could not delete ${t}`)??``,await S()}function y(e){let t=r(`div`,`group flex flex-col gap-1 border-b border-neutral-200/70 px-1 py-2.5 last:border-b-0`),n=document.createElement(`a`);n.className=`truncate font-medium text-neutral-800 hover:text-indigo-700`,n.href=u(e),n.target=`_blank`,n.rel=`noreferrer`,n.textContent=e.title;let i=r(`div`,`flex items-center gap-2`,n,r(`span`,`flex-none font-mono text-[11.5px] text-neutral-400`,e.slug)),c=a(``,``,e.public,t=>{e.public=t,_(e,t)});c.className=`ml-auto flex flex-none cursor-pointer items-center gap-1.5 text-[11.5px] text-neutral-500`,c.append(r(`span`,``,`Public`));let d=l(`Delete`,`flex-none cursor-pointer text-[11.5px] text-neutral-400 opacity-0 transition-opacity hover:text-red-600 group-hover:opacity-100`);d.title=`Renames the folder on disk; nothing is erased`,d.onclick=()=>void v(e.slug);let p=o(`flex-none cursor-pointer text-[11.5px] text-neutral-400 opacity-0 transition-opacity hover:text-indigo-600 group-hover:opacity-100`,()=>`${location.origin}${u(e)}`);p.title=`Copy the board's link`,i.append(c,p,d),t.append(i);let m=r(`div`,`flex flex-wrap items-center gap-x-3 gap-y-1 text-[11.5px] text-neutral-500`);e.description&&m.append(r(`span`,`min-w-0 truncate`,e.description)),m.append(r(`span`,`flex-none text-neutral-400`,s(Date.parse(e.updatedAt))));for(let t of e.sessions){let e=l(t.slice(0,8),`flex-none cursor-pointer font-mono text-indigo-600 hover:underline`);e.title=`Open session ${t}`,e.onclick=()=>f(t),m.append(e)}if(e.public&&e.token){let t=r(`span`,`flex-none font-mono text-neutral-400`,u(e));t.title=`Public URL — anyone holding this link can read the board, no password`,m.append(t)}return t.append(m),t}let b=[{title:`Public`,hint:`Readable at /p/<slug>-<token>/ by anyone holding the link.`,wanted:!0},{title:`Private`,hint:`Reachable from the Console only.`,wanted:!1}];function x(){let e=r(`div`,`mx-auto flex max-w-3xl flex-col`);p.length===0&&e.append(r(`p`,`rounded-xl border border-dashed border-neutral-300 px-4 py-6 text-center text-[12.5px] text-neutral-500`,`No boards yet. Ask an agent to build one — it writes a folder under ~/.pier/boards.`));for(let{title:t,hint:n,wanted:i}of b){let a=p.filter(e=>e.public===i);if(a.length===0)continue;let o=r(`section`,`mb-6`);o.append(r(`h2`,`text-[13px] font-semibold text-neutral-700`,t)),o.append(r(`p`,`mb-1 text-[11.5px] leading-snug text-neutral-500`,n));let s=r(`div`,`rounded-xl border border-neutral-200 bg-white px-3`);s.append(...a.map(y)),o.append(s),e.append(o)}g.replaceChildren(...m?[r(`p`,`mb-3 text-[13px] text-red-600`,m)]:[],e)}async function S(){let e=await t(`/api/boards`,`Could not load boards`);if(!e.ok)return m=e.error,x();p=e.value,x(),m=``}let C=i(d,()=>void S());return window.addEventListener(`focus`,()=>{C.visible&&S()}),C}export{d as createBoardsView};

package/dist/web/public/assets/{code-C86xKk2k.js → code-BgAXjUH3.js}

@@ -1 +1 @@
-import{I as e,u as t}from"./index-DHxoYoeq.js";var n=2e4,r=e=>e.map((e,t)=>({nums:[t+1],text:e,tone:``}));function i(t,r){let i=t.length<=n?r:null,o=Math.max(2,...t.map(e=>e.nums.reduce((e,t)=>Math.max(e,String(t).length),0))),s=e(`div`,`py-2 font-mono text-[12px] leading-[1.5]`);for(let n of t){let t=e(`div`,`flex pl-2 pr-4 ${n.tone===`add`?`bg-emerald-50`:n.tone===`del`?`bg-red-50`:``}`);for(let r of n.nums){let n=e(`span`,`flex-none select-none pr-1.5 text-right text-neutral-300`,r===``?``:String(r));n.style.width=`calc(${o}ch + 0.375rem)`,t.append(n)}t.append(a(n,i)),s.append(t)}return s}function a(n,r){let i=`min-w-0 flex-1 whitespace-pre-wrap [overflow-wrap:anywhere]`;if(!n.mark||n.mark[0]>=n.mark[1]){let e=t(n.text,r);return e.className=i,e}let[a,o]=n.mark,s=t(n.text.slice(a,o),r);return s.className=`rounded-xs ${n.tone===`add`?`bg-emerald-200/80`:`bg-red-200/70`}`,e(`span`,i,t(n.text.slice(0,a),r),s,t(n.text.slice(o),r))}export{r as n,i as t};
+import{L as e,u as t}from"./index-BrBNzaid.js";var n=2e4,r=e=>e.map((e,t)=>({nums:[t+1],text:e,tone:``}));function i(t,r){let i=t.length<=n?r:null,o=Math.max(2,...t.map(e=>e.nums.reduce((e,t)=>Math.max(e,String(t).length),0))),s=e(`div`,`py-2 font-mono text-[12px] leading-[1.5]`);for(let n of t){let t=e(`div`,`flex pl-2 pr-4 ${n.tone===`add`?`bg-emerald-50`:n.tone===`del`?`bg-red-50`:``}`);for(let r of n.nums){let n=e(`span`,`flex-none select-none pr-1.5 text-right text-neutral-300`,r===``?``:String(r));n.style.width=`calc(${o}ch + 0.375rem)`,t.append(n)}t.append(a(n,i)),s.append(t)}return s}function a(n,r){let i=`min-w-0 flex-1 whitespace-pre-wrap [overflow-wrap:anywhere]`;if(!n.mark||n.mark[0]>=n.mark[1]){let e=t(n.text,r);return e.className=i,e}let[a,o]=n.mark,s=t(n.text.slice(a,o),r);return s.className=`rounded-xs ${n.tone===`add`?`bg-emerald-200/80`:`bg-red-200/70`}`,e(`span`,i,t(n.text.slice(0,a),r),s,t(n.text.slice(o),r))}export{r as n,i as t};