@timqi/pier 0.0.5 → 0.0.6

package/dist/core/types.js

@@ -1,6 +1,10 @@
 // Normative seam types — THIS FILE is the system contract (docs/architecture.md
 // documents the rules around it). Changing a seam is a design decision, not a
 // refactor; keep it implementable over RPC (no Pi types may appear here).
+/** How much of a tool result any surface ever shows. A transcript replay
+ *  carries no more than that: a session's tool output is most of its history
+ *  payload, and the bytes past this point were downloaded to be sliced off. */
+export const MAX_STEP_OUTPUT = 8_000;
 /** Every level Pi accepts, in order. The union is derived so the two cannot
  *  drift, and boundary validators use isThinkingLevel instead of their own copy. */
 export const THINKING_LEVELS = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];

package/dist/db.js

@@ -139,6 +139,12 @@ const MIGRATIONS = [
     note TEXT NOT NULL,
     created_at INTEGER NOT NULL
   );
+  `,
+    // 4 — Projects can render from SQLite without scanning every Pi transcript.
+    `
+  ALTER TABLE session_state ADD COLUMN cwd TEXT;
+  ALTER TABLE session_state ADD COLUMN title TEXT;
+  ALTER TABLE session_state ADD COLUMN created_at INTEGER;
   `,
 ];
 let shared;

package/dist/main.js

@@ -34,6 +34,7 @@ import { startAutoUpdate, UpdateCheck } from "./update.js";
 import { AuthStore, registerAuthRoutes, requireAuth } from "./web/auth.js";
 import { SessionStateStore } from "./web/session-state.js";
 import { createServer } from "./web/server.js";
+import { attachTerminal } from "./web/terminal.js";
 const log = logger("pier");
 // Pier owns the Pi runtime dir. Set before any SDK call resolves a path, so
 // everything Pi derives from its agent dir (auth.json, models.json, sessions,
@@ -280,6 +281,9 @@ const server = serve({ fetch: app.fetch, port, hostname }, () => {
     log.info(`workbench on http://${hostname}:${port}`);
     log.info(`pid ${process.pid}, node ${process.version}, home ${PIER_HOME}`);
 });
+// The one WebSocket surface (see web/terminal.ts); `serve` above builds a
+// plain node:http server, which is the only shape with an upgrade event.
+const terminals = attachTerminal(server, auth);
 // A crash and a clean stop must be distinguishable after the fact, and both
 // left nothing behind before this.
 process.on("uncaughtException", (err) => {
@@ -302,6 +306,7 @@ const shutdown = (stopTasks = true) => {
     // `systemctl restart` into a 90-second wait for SIGKILL.
     setTimeout(() => process.exit(0), 3000).unref();
     stopEviction();
+    terminals.close(); // no shell outlives the workbench
     // The drain path leaves task runs alone: aborting them here would record
     // them cancelled and race their callbacks against dying channels, when the
     // boot-time interrupted marking is the recovery that was promised.

package/dist/web/auth.js

@@ -59,6 +59,7 @@ export class AuthStore {
     #db;
     /** HMAC key for cookies: the hash, so rotating the password expires them. */
     #key;
+    #rotationListeners = new Set();
     constructor(db = pierDb(), print = (m) => log.info(m)) {
         this.#db = db;
         let row = this.#row();
@@ -99,6 +100,13 @@ export class AuthStore {
             .prepare("UPDATE auth SET salt = ?, hash = ?, created_at = ? WHERE id = 1")
             .run(salt, next, Date.now());
         this.#key = next;
+        for (const listener of this.#rotationListeners)
+            listener();
+    }
+    /** A long-lived authenticated surface closes itself when every cookie is
+     *  revoked. The store and listeners share the process lifetime. */
+    onRotation(listener) {
+        this.#rotationListeners.add(listener);
     }
     /** Cookie signing key. Never the password: that is not stored anywhere. */
     get cookieKey() {
@@ -181,19 +189,14 @@ function noteFailure(client) {
         failures.set(client, { count: 1, resetAt: Date.now() + WINDOW_MS });
 }
 /** Browsers name the source of unsafe requests. Compare hosts rather than
- * schemes because TLS commonly terminates at the reverse proxy. */
-function sameOrigin(c) {
-    const origin = c.req.header("origin");
+ * schemes because TLS commonly terminates at the reverse proxy. Shared by HTTP
+ * and WebSocket so the password boundary cannot disagree with itself. */
+function originMatches(origin, host) {
     if (!origin)
         return true; // curl and other non-browser clients
     try {
         const parsed = new URL(origin);
-        const remote = remoteOf(c);
-        const forwarded = remote && loopback(remote)
-            ? c.req.header("x-forwarded-host")?.split(",").at(-1)?.trim()
-            : undefined;
-        const host = forwarded || c.req.header("host") || new URL(c.req.url).host;
-        const external = new URL(`${parsed.protocol}//${host}`);
+        const external = new URL(`${parsed.protocol}//${host ?? ""}`);
         return parsed.origin === origin && external.origin === parsed.origin &&
             external.pathname === "/" && !external.search && !external.hash;
     }
@@ -201,6 +204,30 @@ function sameOrigin(c) {
         return false;
     }
 }
+function sameOrigin(c) {
+    const remote = remoteOf(c);
+    const forwarded = remote && loopback(remote)
+        ? c.req.header("x-forwarded-host")?.split(",").at(-1)?.trim()
+        : undefined;
+    return originMatches(c.req.header("origin"), forwarded || c.req.header("host") || new URL(c.req.url).host);
+}
+/** The same cookie + Origin boundary for a WebSocket upgrade, where no Hono
+ *  context exists before the handshake completes. */
+export function upgradeAuthorized(store, req) {
+    const raw = req.headers.cookie
+        ?.split(";")
+        .map((part) => part.trim())
+        .find((part) => part.startsWith(`${COOKIE}=`))
+        ?.slice(COOKIE.length + 1);
+    if (!valid(store.cookieKey, raw))
+        return false;
+    const remote = req.socket.remoteAddress ?? "";
+    const forwardedHeader = req.headers["x-forwarded-host"];
+    const forwarded = loopback(remote) && typeof forwardedHeader === "string"
+        ? forwardedHeader.split(",").at(-1)?.trim()
+        : undefined;
+    return originMatches(req.headers.origin, forwarded || req.headers.host);
+}
 /** Every route, in one place — no per-route opt-in to forget on the next one. */
 export function requireAuth(store) {
     return async (c, next) => {