@timqi/pier 0.0.9 → 0.0.16

package/docs/deploy.md

@@ -177,9 +177,9 @@ journalctl --user -u pier --since -1h | grep 'tasks:'   # one area
 ```
 
 Every line is `area: message` — `core`, `agent`, `tasks`, `slack`, `telegram`,
-`channels`, `slack.tool`, `auth`, `boards`, `client`, `db`, `drain`, `secrets`,
-`settings`, `credentials`, `update`, `web.providers`, `pier` — so an area is a
-grep
+`lark`, `channels`, `slack.tool`, `auth`, `boards`, `client`, `db`, `drain`,
+`secrets`, `settings`, `credentials`, `update`, `tools`, `terminal`, `push`,
+`web`, `web.providers`, `pier` — so an area is a grep
 and a level is a `-p`. The level reaches journald as a syslog priority prefix, which Pier
 emits only when systemd says the output is a journal (`$JOURNAL_STREAM`); run
 in a terminal, the same lines carry a timestamp and a level word instead.
@@ -237,6 +237,7 @@ with the stored hash.
 ```sh
 pier restart          # finish active work, then restart the service
 pier reload           # apply channel config and recycle idle sessions in place
+pier tools sync       # install/update the managed CLI tools
 ```
 
 Both commands signal the installed systemd service; they are not foreground
@@ -246,6 +247,14 @@ next process. At the deadline it records every aborted IM turn first, and the
 next process posts that note after its adapter starts. Cleanup after the deadline
 has one shared 10-second bound regardless of how many sessions are stuck.
 
+`pier tools sync` converges the command-line tools switched on in Console →
+Settings — they install into `~/.pier/tools/bin`, which the service puts first
+on the PATH every session, task and terminal inherits. Normally a switch runs
+it for you as a task; typing it is for a machine that was offline when one was
+flipped. One sync runs at a time per machine: an overlapping one waits for the
+lock (and converges on the switches as they stand when its turn comes) instead
+of racing the other's installs.
+
 `pier reload` does not stop active work. It reloads Slack and Telegram adapters
 and immediately evicts idle sessions nobody is watching, so their next message
 opens with current agent files and configuration. Streaming sessions and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timqi/pier",
-  "version": "0.0.9",
+  "version": "0.0.16",
   "description": "A self-hosted workspace for coding agents: web workbench and IM channels in front of Pi sessions",
   "license": "AGPL-3.0-only",
   "repository": "github:timqi/pier",

package/skills/pier-boards/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pier-boards
-description: Publish a Board — a folder of static HTML Pier serves at a stable URL — to present a report, digest, dashboard or handover note to the user. Read before building any page-shaped deliverable, or before editing an existing board.
+description: Publish a Board — a folder of static HTML Pier serves at a stable URL. Read before building any page-shaped deliverable (report, digest, dashboard) or editing an existing board.
 ---
 
 # Building a Pier board
@@ -27,23 +27,33 @@ session may read or rewrite any board, and closing this one changes nothing.
 }
 ```
 
-Those four fields are the whole manifest.
+Those four fields are the whole manifest (publishing adds a fifth — below).
 
-- `slug`: `[a-z0-9][a-z0-9-]{0,63}`, and it is the URL — short and stable.
+- `slug`: `[a-z0-9][a-z0-9-]{0,63}`, and it is the URL — short and stable. Do
+  not add random characters of your own; publishing adds them (see below).
 - `description` is the Console list entry: write it for someone who has
   forgotten this conversation.
 - `sessions`: append your own id, never replace — other ids are provenance too.
 
 ## Publish, then hand over the link
 
-`"public": true` serves the board at `/p/<slug>/` **with no password**. Set it
-only if the user asked for a public or shareable board *in this request*;
-otherwise leave it `false` and say the board is private. Never publish personal
-data or anything the user has not seen.
+`"public": true` serves the board **with no password**. Set it only if the user
+asked for a public or shareable board *in this request*; otherwise leave it
+`false` and say the board is private. Never publish personal data or anything
+the user has not seen.
 
-Asked to make an existing board public? Flip `"public"` to `true` in
-`board.json` and reply with the `/p/<slug>/` link — that is the whole answer.
-No verification step, no narrating the edit, no restating what the page holds.
+The published address is `/p/<slug>-<token>/`, not `/p/<slug>/`, so a public
+board's URL cannot be guessed from its name. `token` is a fifth manifest field
+you write next to `"public": true` — eight hex characters from
+`openssl rand -hex 4`, never invented in your head, never reused between
+boards. Leave it out and Pier mints one on the first request, but then the link
+is only visible in the Console, so write it yourself and you can hand it over
+in the same message.
+
+Asked to make an existing board public? Set `"public": true` and a fresh
+`token` in `board.json`, then reply with the `/p/<slug>-<token>/` link — that is
+the whole answer. Already has a token? Keep it: the link may be out there. No
+verification step, no narrating the edit, no restating what the page holds.
 
 The message announcing the board carries **one bare URL** — paste the address
 itself, never `[title](url)`: link labels get mangled or truncated on some chat
@@ -54,10 +64,10 @@ surfaces, and the title is already on the page. No filesystem paths either —
 | The user asked for | Send |
 | --- | --- |
 | a board, nothing about sharing | `https://pier.example.com/boards/weekly-digest/` — behind the Pier password; Console → Boards makes it public |
-| a **public** board | `https://pier.example.com/p/weekly-digest/` — no password |
+| a **public** board | `https://pier.example.com/p/weekly-digest-3f9ac128/` — no password; the suffix is the manifest's `token`, copied verbatim |
 
 Never both: the pair invites pasting the password-free URL of a board that was
-never meant to leave the workspace, and `/p/<slug>/` 404s unless the manifest
+never meant to leave the workspace, and `/p/<slug>-<token>/` 404s unless the manifest
 says `"public": true`. No address configured? Give the path, say Console →
 Settings turns it into a link, and never guess a host.
 
@@ -74,7 +84,7 @@ build, no npm, no framework:
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Weekly digest — infra</title>
-<link rel="stylesheet" href="/boards/_assets/pier.css">
+<link rel="stylesheet" href="/p/_assets/pier.css">
 </head>
 <body>
 <div class="hero">

package/skills/pier-help/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pier-help
-description: How Pier itself works — durable sessions and what survives a restart, how messages and files reach you from Slack and Telegram, in-chat commands (/stop, /settings, /bind), interrupting a running turn, and what only the operator's Console can change. Read before explaining Pier's behavior or advising a user on how to use it.
+description: How Pier itself works — durable sessions, what survives a restart, how messages and files reach you from IM, in-chat commands, and what only the operator's Console can change. Read before explaining Pier's behavior or advising a user on it.
 ---
 
 # How Pier works

package/skills/pier-slack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pier-slack
-description: Read and write Slack through Pier's slack tool — a channel's history for a time range, one thread, posting into a thread, deleting a message Pier posted, and the Slack-specific syntax for mentions and links. Read before answering questions about Slack conversations or posting anything to a workspace.
+description: Read and write Slack through Pier's slack tool, including the Slack-specific syntax for mentions and links. Read before answering questions about Slack conversations or posting anything to a workspace.
 ---
 
 # Reading and writing Slack
@@ -97,6 +97,26 @@ Going top-level takes the explicit `"none"`: a channel's main flow is wider
 than a thread. A `thread_ts` is never inherited across a change of `channel`.
 The response carries `ts` and `threadTs` for replying under what you posted.
 
+## Editing
+
+```json
+{"operation":"edit","channel":"#ops","ts":"1717243800.000100",
+ "text":"**Deploy done** — 3 services, 1 rollback."}
+```
+
+`text` replaces the message outright; there is no partial edit. Read the
+message first if you are changing part of it.
+
+- Slack only lets Pier edit what **its own bot** posted — anyone else's message
+  answers `cant_update_message`, and the answer is to reply, not to retry.
+- `ts` is always explicit, as with `delete`, and means nothing outside the
+  channel it was read in.
+- The old text is gone — Slack keeps no version a reader can open, and may not
+  mark the message as edited at all. When the previous wording mattered to
+  people reading, say what changed rather than quietly rewriting history.
+- A long-running update — a status line, a running tally — is better as one
+  message edited in place than as a new message per change.
+
 ## Deleting
 
 ```json

package/skills/pier-tasks/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pier-tasks
-description: Delegate work to Pier subagents with the task tool — one-shot delegation, core-joined parallel fan-out, chained steps, and mid-run control (steer/resume/contact). Read before delegating to a subagent, coordinating multiple agents, or running long background work.
+description: Delegate work to Pier subagents with the task tool — one-shot, parallel fan-out, chains, mid-run control. Read before delegating to a subagent, coordinating agents, or running long background work.
 ---
 
 # Orchestrating Pier tasks
@@ -38,7 +38,7 @@ schedule policy, where `manual` means on-demand — by a human or by you.
 - The child inherits your current model unless `launch.model` is set.
   Unknown models fail with the available list in the error. `launch` applies to
   `fresh` and `fork` only — a `reuse` session owns its own model and tools.
-- The child has the same tools you do; there is no capability knob to pick.
+- The child has the same tools you do.
 - Runs time out after 900s by default; set `timeoutSeconds` in the draft for
   longer jobs.