@timqi/pier 0.0.4 → 0.0.6

package/dist/core/inbox.js

@@ -10,7 +10,7 @@ import { mkdir, writeFile } from "node:fs/promises";
 import { randomBytes } from "node:crypto";
 import { basename, join } from "node:path";
 import { pierPath } from "../paths.js";
-import { safeName } from "./inbound-file.js";
+import { fileMarker, lostMarker, MAX_INBOUND_BYTES, safeName } from "./inbound-file.js";
 /** Where every inbound file lives; web/files.ts allowlists this root. */
 export const INBOX_DIR = pierPath("inbox");
 /**
@@ -30,3 +30,69 @@ export async function saveInbound(channelId, name, mimeType, bytes) {
     await writeFile(path, bytes, { mode: 0o600, flag: "wx" });
     return path;
 }
+/**
+ * Collect a fetch response's body, refusing past `maxBytes` mid-stream. The
+ * metadata size gate in saveInboundAll is only as honest as the platform's
+ * metadata — absent or wrong, `arrayBuffer()` buffers whatever arrives — so
+ * the read itself is bounded too. Throws with "too large" in the message,
+ * which the loop below translates into the honest lost-marker reason.
+ */
+export async function readCapped(body, maxBytes) {
+    if (!body)
+        return new Uint8Array(0);
+    const parts = [];
+    let size = 0;
+    const reader = body.getReader();
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > maxBytes)
+                throw new Error(`attachment too large (>${maxBytes} bytes)`);
+            parts.push(value);
+        }
+    }
+    finally {
+        // Also cancels the transfer on the too-large throw.
+        reader.releaseLock();
+        await body.cancel().catch(() => { });
+    }
+    const bytes = new Uint8Array(size);
+    let at = 0;
+    for (const part of parts) {
+        bytes.set(part, at);
+        at += part.byteLength;
+    }
+    return bytes;
+}
+/**
+ * Save a message's attachments; each becomes a marker line for the prompt —
+ * and a failed or oversized one becomes a lost-marker line, never silence
+ * (5b). Written three times, once per adapter, before landing here: the
+ * size gate before the fetch (an unauthorized sender is already filtered by
+ * then, but a movie must not be buffered whole either) and the never-silent
+ * failure path are invariants, and invariants drift when copied.
+ */
+export async function saveInboundAll(channelId, files, log) {
+    const markers = [];
+    for (const file of files) {
+        if (file.size !== undefined && file.size > MAX_INBOUND_BYTES) {
+            markers.push(lostMarker(file.label, "too large"));
+            continue;
+        }
+        try {
+            const got = await file.fetch();
+            const path = await saveInbound(channelId, file.name ?? got.name, got.mimeType ?? file.mimeType, got.bytes);
+            markers.push(fileMarker(path));
+        }
+        catch (err) {
+            log(`attachment download failed: ${String(err)}`);
+            // A fetch that refused mid-stream names its reason; keep it honest.
+            const why = String(err).includes("too large") ? "too large" : "download failed";
+            markers.push(lostMarker(file.label, why));
+        }
+    }
+    return markers;
+}

package/dist/core/types.js

@@ -1,6 +1,10 @@
 // Normative seam types — THIS FILE is the system contract (docs/architecture.md
 // documents the rules around it). Changing a seam is a design decision, not a
 // refactor; keep it implementable over RPC (no Pi types may appear here).
+/** How much of a tool result any surface ever shows. A transcript replay
+ *  carries no more than that: a session's tool output is most of its history
+ *  payload, and the bytes past this point were downloaded to be sliced off. */
+export const MAX_STEP_OUTPUT = 8_000;
 /** Every level Pi accepts, in order. The union is derived so the two cannot
  *  drift, and boundary validators use isThinkingLevel instead of their own copy. */
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];

package/dist/db.js

@@ -11,15 +11,16 @@
 // So: one connection, one ordered list of migrations, applied in one
 // transaction before any store exists. A store receives the handle and owns
 // only its queries.
-import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { logger } from "./log.js";
 import { PIER_DB } from "./paths.js";
 const log = logger("db");
-/** Pre-migration snapshots to keep. Three is two upgrades of regret plus one:
+/** Snapshots to keep *of each kind*. Three is two upgrades of regret plus one:
  *  they are full copies of the database, and the one that matters is the
- *  newest. */
+ *  newest. Counted per kind because the two kinds answer different questions —
+ *  a run of releases must not evict the pre-migration copies. */
 const KEEP_BACKUPS = 3;
 /** How long a second process may wait for the write lock before failing. Two
  *  Pier processes on one PIER_HOME contend exactly once — at boot, when both
@@ -138,6 +139,12 @@ const MIGRATIONS = [
     note TEXT NOT NULL,
     created_at INTEGER NOT NULL
   );
+  `,
+    // 4 — Projects can render from SQLite without scanning every Pi transcript.
+    `
+  ALTER TABLE session_state ADD COLUMN cwd TEXT;
+  ALTER TABLE session_state ADD COLUMN title TEXT;
+  ALTER TABLE session_state ADD COLUMN created_at INTEGER;
   `,
 ];
 let shared;
@@ -147,14 +154,25 @@ let shared;
  */
 export const pierDb = () => (shared ??= openDb(PIER_DB));
 /** A release-level restore point, taken while the service is stopped even when
- * the release has no schema migration. The previous complete copy stays put if
- * writing its replacement fails. */
-export function backupDb(path = PIER_DB) {
+ * the release has no schema migration. The previous complete copies stay put if
+ * writing this one fails.
+ *
+ * `version` is the Pier that produced this database, not the one being
+ * installed: the updater runs this from the tree it is about to replace, and
+ * restoring a database means reinstalling the code that speaks its schema
+ * (`migrate` refuses one from a newer Pier). So the name carries the other half
+ * of the pair. Backing up twice at one version replaces that version's copy —
+ * the pairing is identical, so a second name for it would say nothing. */
+export function backupDb(version, path = PIER_DB) {
     if (!existsSync(path))
         return undefined;
-    const bak = `${path}.release.bak`;
+    // In a filename, so it may not carry a separator or a traversal; a version
+    // this malformed is a broken install, not something to guess at.
+    const safe = version.replaceAll(/[^0-9A-Za-z.+-]/g, "_") || "unknown";
+    const bak = join(backupsDir(path, true), `${basename(path)}.release-${safe}.bak`);
     copyDatabase(path, bak);
     log.info(`pre-update backup: ${bak}`);
+    prune(releases(path));
     return bak;
 }
 /** Open a database, bring it to the current schema, and lock down its files.
@@ -186,9 +204,9 @@ function migrate(db, path, migrations) {
     if (at > target) {
         // Name the snapshot that exists rather than a pattern: the operator is
         // reading this because the service will not start.
-        const newest = path === ":memory:" ? undefined : backups(path)[0]?.file;
+        const newest = path === ":memory:" ? undefined : snapshots(path)[0]?.file;
         throw new Error(`${path} is at schema ${at}, this Pier speaks ${target}: a database is ` +
-            `never downgraded. Restore ${newest ?? `${path}.v*.bak`}, or run the newer Pier.`);
+            `never downgraded. Restore ${newest ?? `a copy from ${backupsDir(path)}`}, or run the newer Pier.`);
     }
     // Version 0 with tables is a database from before versioning existed.
     // Migration 1 assumes an empty file, so the collision it would hit says
@@ -244,7 +262,7 @@ function migrate(db, path, migrations) {
     }
     log.info(locked === 0 ? `schema created at version ${target}` : `schema ${locked} → ${target}`);
     if (path !== ":memory:")
-        prune(path);
+        prune(snapshots(path).map(({ file }) => file));
 }
 /**
  * The copy that exists because `user_version` only counts up: the transaction
@@ -259,7 +277,7 @@ function migrate(db, path, migrations) {
  * ever refers to a finished copy.
  */
 function snapshot(path, at) {
-    const bak = `${path}.v${at}.bak`;
+    const bak = join(backupsDir(path, true), `${basename(path)}.v${at}.bak`);
     copyDatabase(path, bak);
     log.info(`pre-migration backup: ${bak}`);
 }
@@ -276,22 +294,64 @@ function copyDatabase(path, bak) {
     chmodSync(tmp, 0o600); // it holds everything the 0600 database holds
     renameSync(tmp, bak);
 }
-/** Snapshots beside the database, newest schema first. */
-function backups(path) {
+/**
+ * One directory for every copy of this database, `db/backups/`. Beside the
+ * database was fine while there was one snapshot per schema; a restore point
+ * per release turns that into a listing where the live file and its sidecars
+ * are hard to pick out, and "which of these do I not delete" is the wrong
+ * question to make an operator answer under pressure.
+ *
+ * `create` also adopts what an older Pier wrote next to the database, so the
+ * restore procedure names one location instead of two forever.
+ */
+function backupsDir(path, create = false) {
+    const dir = join(dirname(path), "backups");
+    if (!create)
+        return dir;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const prefix = `${basename(path)}.`;
+    for (const name of readdirSync(dirname(path))) {
+        if (!name.startsWith(prefix) || !name.endsWith(".bak"))
+            continue;
+        renameSync(join(dirname(path), name), join(dir, name));
+        log.info(`moved ${name} into ${dir}`);
+    }
+    return dir;
+}
+/** The copies of one kind: `v<schema>` or `release-<version>`. Disjoint
+ *  prefixes, so each kind is counted and pruned on its own. */
+function listBackups(path, kind) {
+    const dir = backupsDir(path);
+    if (!existsSync(dir))
+        return [];
+    const prefix = `${basename(path)}.${kind}`;
+    return readdirSync(dir).filter((name) => name.startsWith(prefix) && name.endsWith(".bak"));
+}
+/** Pre-migration snapshots, newest schema first — the number in the name is an
+ *  ordinal, so it orders them without asking the filesystem. */
+function snapshots(path) {
     const prefix = `${basename(path)}.v`;
-    return readdirSync(dirname(path))
-        .filter((name) => name.startsWith(prefix) && name.endsWith(".bak"))
+    return listBackups(path, "v")
         .map((name) => ({
         version: Number(name.slice(prefix.length, -".bak".length)),
-        file: join(dirname(path), name),
+        file: join(backupsDir(path), name),
     }))
         .filter(({ version }) => Number.isInteger(version))
         .sort((a, b) => b.version - a.version);
 }
-/** Keep the newest few. Nobody restores a database from four upgrades ago, and
- *  every one of these is the size of the whole database. */
-function prune(path) {
-    for (const { file } of backups(path).slice(KEEP_BACKUPS)) {
+/** Release restore points, newest copy first. Ordered by mtime: the name holds
+ *  a Pier version, and comparing those means reimplementing semver here — while
+ *  two updates of one instance are never in flight at the same moment. Legacy
+ *  `pier.db.release.bak` shares the prefix, so it ages out like the rest. */
+function releases(path) {
+    return listBackups(path, "release")
+        .map((name) => join(backupsDir(path), name))
+        .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
+}
+/** Keep the newest few, oldest first out. Nobody restores a database from four
+ *  upgrades ago, and every one of these is the size of the whole database. */
+function prune(newestFirst) {
+    for (const file of newestFirst.slice(KEEP_BACKUPS)) {
         rmSync(file, { force: true });
         log.info(`removed superseded backup: ${file}`);
     }
@@ -311,4 +371,7 @@ function restrict(path) {
             chmodSync(file, 0o600);
     }
     chmodSync(dirname(path), 0o700);
+    // Full copies of the same secrets, one directory down.
+    if (existsSync(backupsDir(path)))
+        chmodSync(backupsDir(path), 0o700);
 }

package/dist/main.js

@@ -34,6 +34,7 @@ import { startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
+import { attachTerminal } from "./web/terminal.js";
 const log = logger("pier");
 // Pier owns the Pi runtime dir. Set before any SDK call resolves a path, so
 // everything Pi derives from its agent dir (auth.json, models.json, sessions,
@@ -280,6 +281,9 @@ const server = serve({ fetch: app.fetch, port, hostname }, () => {
     log.info(`workbench on http://${hostname}:${port}`);
     log.info(`pid ${process.pid}, node ${process.version}, home ${PIER_HOME}`);
 });
+// The one WebSocket surface (see web/terminal.ts); `serve` above builds a
+// plain node:http server, which is the only shape with an upgrade event.
+const terminals = attachTerminal(server, auth);
 // A crash and a clean stop must be distinguishable after the fact, and both
 // left nothing behind before this.
 process.on("uncaughtException", (err) => {
@@ -302,6 +306,7 @@ const shutdown = (stopTasks = true) => {
     // `systemctl restart` into a 90-second wait for SIGKILL.
     setTimeout(() => process.exit(0), 3000).unref();
     stopEviction();
+    terminals.close(); // no shell outlives the workbench
     // The drain path leaves task runs alone: aborting them here would record
     // them cancelled and race their callbacks against dying channels, when the
     // boot-time interrupted marking is the recovery that was promised.

package/dist/service.js

@@ -300,7 +300,7 @@ export function startUpdate(options) {
     if (!run(["systemctl", "--user", "start", "--no-block", UPDATE_UNIT_NAME]))
         return "failed";
     say(`updating in the background — follow it with: journalctl --user -u ${UPDATE_UNIT_NAME} -f`);
-    say(`Pier stops, snapshots pier.db.release.bak, installs, then starts again.`);
+    say(`Pier stops, snapshots the database into db/backups/, installs, then starts again.`);
     return "started";
 }
 export function uninstall(home = homedir(), say = console.log, exec) {

package/dist/web/auth.js

@@ -59,6 +59,7 @@ export class AuthStore {
     #db;
     /** HMAC key for cookies: the hash, so rotating the password expires them. */
     #key;
+    #rotationListeners = new Set();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
         let row = this.#row();
@@ -99,6 +100,13 @@ export class AuthStore {
             .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
             .run(salt, next, Date.now());
         this.#key = next;
+        for (const listener of this.#rotationListeners)
+            listener();
+    }
+    /** A long-lived authenticated surface closes itself when every cookie is
+     *  revoked. The store and listeners share the process lifetime. */
+    onRotation(listener) {
+        this.#rotationListeners.add(listener);
     }
     /** Cookie signing key. Never the password: that is not stored anywhere. */
     get cookieKey() {
@@ -181,19 +189,14 @@ function noteFailure(client) {
         failures.set(client, { count: 1, resetAt: Date.now() + WINDOW_MS });
 }
 /** Browsers name the source of unsafe requests. Compare hosts rather than
- * schemes because TLS commonly terminates at the reverse proxy. */
-function sameOrigin(c) {
-    const origin = c.req.header("origin");
+ * schemes because TLS commonly terminates at the reverse proxy. Shared by HTTP
+ * and WebSocket so the password boundary cannot disagree with itself. */
+function originMatches(origin, host) {
     if (!origin)
         return true; // curl and other non-browser clients
     try {
         const parsed = new URL(origin);
-        const remote = remoteOf(c);
-        const forwarded = remote && loopback(remote)
-            ? c.req.header("x-forwarded-host")?.split(",").at(-1)?.trim()
-            : undefined;
-        const host = forwarded || c.req.header("host") || new URL(c.req.url).host;
-        const external = new URL(`${parsed.protocol}//${host}`);
+        const external = new URL(`${parsed.protocol}//${host ?? ""}`);
         return parsed.origin === origin && external.origin === parsed.origin &&
             external.pathname === "/" && !external.search && !external.hash;
     }
@@ -201,6 +204,30 @@ function sameOrigin(c) {
         return false;
     }
 }
+function sameOrigin(c) {
+    const remote = remoteOf(c);
+    const forwarded = remote && loopback(remote)
+        ? c.req.header("x-forwarded-host")?.split(",").at(-1)?.trim()
+        : undefined;
+    return originMatches(c.req.header("origin"), forwarded || c.req.header("host") || new URL(c.req.url).host);
+}
+/** The same cookie + Origin boundary for a WebSocket upgrade, where no Hono
+ *  context exists before the handshake completes. */
+export function upgradeAuthorized(store, req) {
+    const raw = req.headers.cookie
+        ?.split(";")
+        .map((part) => part.trim())
+        .find((part) => part.startsWith(`${COOKIE}=`))
+        ?.slice(COOKIE.length + 1);
+    if (!valid(store.cookieKey, raw))
+        return false;
+    const remote = req.socket.remoteAddress ?? "";
+    const forwardedHeader = req.headers["x-forwarded-host"];
+    const forwarded = loopback(remote) && typeof forwardedHeader === "string"
+        ? forwardedHeader.split(",").at(-1)?.trim()
+        : undefined;
+    return originMatches(req.headers.origin, forwarded || req.headers.host);
+}
 /** Every route, in one place — no per-route opt-in to forget on the next one. */
 export function requireAuth(store) {
     return async (c, next) => {