@timqi/pier 0.0.9 → 0.0.16

package/dist/web/auth.js

@@ -118,15 +118,17 @@ const hash = (password, salt) => scryptSync(password, salt, KEY_BYTES).toString(
  * What a logged-out visitor must still reach: the login form, published
  * boards, and the stylesheet those boards link — a published board rendering
  * unstyled for the person it was published to is the same bug as not serving
- * it. `/boards/*` stays behind the boundary; `/p/*` is the published mirror,
- * the single exempt prefix `docs/architecture.md` reserved for this.
+ * it. Both live under `/p/*` (the stylesheet at `/p/_assets/pier.css`), the
+ * single exempt prefix `docs/architecture.md` reserved for this, so the rule
+ * is one prefix here and one prefix in anything fronting Pier; `/boards/*`
+ * stays behind the boundary.
  */
 function isPublic(method, path) {
     if (path === "/login")
         return method === "GET" || method === "HEAD" || method === "POST";
     if (method !== "GET" && method !== "HEAD")
         return false;
-    return path.startsWith("/p/") || path === "/boards/_assets/pier.css";
+    return path.startsWith("/p/");
 }
 const sign = (secret, expiresAt) => createHmac("sha256", secret).update(String(expiresAt)).digest("base64url");
 /** Constant-time equality that also hides length: both sides are digested. */

package/dist/web/explorer.js

@@ -82,8 +82,21 @@ export function registerExplorerRoutes(app) {
             branch = (await git(root, "rev-parse", "--abbrev-ref", "HEAD")).trim();
         }
         catch {
-            return c.json({ branch: null, refs: [], commits: [] }); // not a repo, or no commits yet
+            // not a repo, or no commits yet
+            return c.json({ branch: null, refs: [], commits: [], worktrees: [] });
         }
+        // Every checkout of this repository, from git rather than from the
+        // sessions that happen to live in one: a worktree created ten seconds ago
+        // has no session in it yet, and that is exactly when its files are worth
+        // opening. Detached heads have no `branch` line, so the path stands alone.
+        const worktrees = (await git(root, "worktree", "list", "--porcelain"))
+            .split("\n\n")
+            .map((block) => {
+            const path = /^worktree (.+)$/m.exec(block)?.[1];
+            const on = /^branch refs\/heads\/(.+)$/m.exec(block)?.[1];
+            return path ? { path, ...(on ? { branch: on } : {}) } : null;
+        })
+            .filter((w) => w !== null);
         const refs = (await git(root, "for-each-ref", "--format=%(refname:short)\t%(subject)", "refs/heads", "refs/tags"))
             .split("\n")
             .filter(Boolean)
@@ -100,7 +113,7 @@ export function registerExplorerRoutes(app) {
             const [hash = "", at = "", author = "", email = "", subject = "", body = ""] = r.split("\u001f");
             return { hash, at: Number(at) * 1000, author, email, subject, body: body.trim() };
         });
-        return c.json({ branch, refs, commits });
+        return c.json({ branch, refs, commits, worktrees });
     });
     // One endpoint, two shapes: without `file` the changed-file list
     // (name-status), with it that file's unified diff. `head` empty or absent

package/dist/web/files.js

@@ -96,7 +96,7 @@ export function registerFileRoutes(app, { factory, config, nascentCwd, onConfigW
     /** Real path of a file a session may expose: inside its cwd or the inbox
      *  (where inbound user attachments land — core/inbox.ts), nothing else. */
     const resolveFile = async (id, raw) => {
-        const cwd = nascentCwd(id) ?? (await factory.list()).find((s) => s.id === id)?.cwd;
+        const cwd = nascentCwd(id) ?? (await factory.find(id))?.cwd;
         if (!cwd || !isAbsolute(raw))
             return null;
         try {

package/dist/web/instance.js

@@ -2,12 +2,24 @@
 // layer-1 secrets control, the browser's error reports. Nothing here touches
 // a session; server.ts stays the session/event surface.
 import { logger } from "../log.js";
-import { normalizeExtensions, normalizeModelMenu, normalizePublicUrl, normalizeTerminalInitCommand, } from "../settings.js";
+import { normalizeModelMenu, normalizePublicUrl, normalizeTerminalInitCommand, } from "../settings.js";
+/** A rule that failed inside the transaction — its own class so the route can
+ *  tell it from a real fault. 400 when the request named something this Pier
+ *  does not have, 409 when it collided with the state as it stands. */
+class Refusal extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+/** One name added to or removed from a stored set, order preserved. */
+const withName = (current, { name, on }) => on ? [...new Set([...current, name])] : current.filter((each) => each !== name);
 /** Client reports per minute, for the whole server: a browser bug can fire in
  *  a loop, and the journal is shared with everything else Pier says. */
 const CLIENT_LOG_PER_MINUTE = 60;
 export function registerInstanceRoutes(app, deps) {
-    const { settings, updates, updater = null, secrets, extensions, onUnlocked, onSettingsChanged } = deps;
+    const { settings, updates, updater = null, secrets, catalog, names = { extensions: [], tools: [] }, onUnlocked, onSettingsChanged, onToolsChanged, validateCustomTools, } = deps;
     const updateLog = logger("update");
     // How long POST /api/update may hold its response open. A busy Pier drains
     // first, which can take minutes, and a response held that long dies at every
@@ -42,8 +54,17 @@ export function registerInstanceRoutes(app, deps) {
     // The catalog rides along: one round trip for the whole page, and the
     // switches cannot disagree with the setting they are drawn from. One shape
     // for both the read and the write, or the page reconciles two answers.
-    const instanceSettings = () => ({ ...settings.get(), extensionCatalog: extensions?.() ?? [] });
-    app.get("/api/settings", (c) => c.json(instanceSettings()));
+    const instanceSettings = async () => {
+        const shown = await catalog?.();
+        return {
+            ...settings.get(),
+            catalog: shown?.entries ?? [],
+            /** Where the runs are: the install and every daily update is one task's
+             *  history, not a second status surface this route invented. */
+            toolsTaskId: shown?.toolsTaskId ?? null,
+        };
+    };
+    app.get("/api/settings", async (c) => c.json(await instanceSettings()));
     // What the version badge reads: the two versions, whether this instance can
     // do anything about the gap, and whether it is allowed to do it unattended.
     // `statusNow` so a browser opened seconds after a restart is told the truth
@@ -103,56 +124,164 @@ export function registerInstanceRoutes(app, deps) {
     });
     // Partial on purpose: each surface sends only the setting it edits, and a
     // malformed field is rejected before anything is written.
+    //
+    // A switch sends a *delta* (`tool`/`extension`), not the list it computed:
+    // two quick clicks each carry a list built from what the page knew a moment
+    // ago, so the second silently drops the first.
     app.put("/api/settings", async (c) => {
         const body = await c.req.json().catch(() => null);
-        const given = body &&
-            [body.publicUrl, body.modelMenu, body.autoUpdate, body.terminalInitCommand, body.extensions]
-                .some((v) => v !== undefined);
-        if (!given) {
+        const fields = body
+            ? [body.publicUrl, body.modelMenu, body.autoUpdate, body.terminalInitCommand, body.customTools, body.extension, body.tool]
+            : [];
+        if (!fields.some((v) => v !== undefined)) {
             return c.json({
-                error: "publicUrl, modelMenu, autoUpdate, terminalInitCommand or extensions required",
+                error: "publicUrl, modelMenu, autoUpdate, terminalInitCommand, customTools, extension or tool required",
             }, 400);
         }
-        if (body.publicUrl !== undefined) {
+        // Everything is validated before anything is written, and everything is
+        // written in one transaction: a request carrying a new custom tool *and*
+        // the switch that turns it on must not leave one of the two stored.
+        const writes = [];
+        const refuse = (error) => c.json({ error }, 400);
+        if (body?.publicUrl !== undefined) {
             if (typeof body.publicUrl !== "string")
-                return c.json({ error: "publicUrl must be a string" }, 400);
+                return refuse("publicUrl must be a string");
             const publicUrl = normalizePublicUrl(body.publicUrl);
-            if (publicUrl === null) {
-                return c.json({ error: "not a URL: expected http(s)://host, no query or fragment" }, 400);
-            }
-            settings.setPublicUrl(publicUrl);
+            if (publicUrl === null)
+                return refuse("not a URL: expected http(s)://host, no query or fragment");
+            writes.push(() => settings.setPublicUrl(publicUrl));
         }
-        if (body.modelMenu !== undefined) {
+        if (body?.modelMenu !== undefined) {
             const menu = normalizeModelMenu(body.modelMenu);
-            if (menu === null) {
-                return c.json({ error: "modelMenu must be [{provider, id, note?}] (≤32 entries)" }, 400);
-            }
-            settings.setModelMenu(menu);
+            if (menu === null)
+                return refuse("modelMenu must be [{provider, id, note?}] (≤32 entries)");
+            writes.push(() => settings.setModelMenu(menu));
         }
-        if (body.autoUpdate !== undefined) {
-            if (typeof body.autoUpdate !== "boolean")
-                return c.json({ error: "autoUpdate must be a boolean" }, 400);
-            settings.setAutoUpdate(body.autoUpdate);
+        if (body?.autoUpdate !== undefined) {
+            const { autoUpdate } = body;
+            if (typeof autoUpdate !== "boolean")
+                return refuse("autoUpdate must be a boolean");
+            writes.push(() => settings.setAutoUpdate(autoUpdate));
         }
-        if (body.terminalInitCommand !== undefined) {
+        if (body?.terminalInitCommand !== undefined) {
             const command = normalizeTerminalInitCommand(body.terminalInitCommand);
-            if (command === null) {
-                return c.json({ error: "terminalInitCommand must be one line of at most 500 characters" }, 400);
-            }
-            settings.setTerminalInitCommand(command);
+            if (command === null)
+                return refuse("terminalInitCommand must be one line of at most 500 characters");
+            writes.push(() => settings.setTerminalInitCommand(command));
+        }
+        /** The blocks this request declares, or null when it does not touch them.
+         *  Adding a tool is declaring it *and* switching it on, so a name declared
+         *  here is switchable in the same write. */
+        let declared = null;
+        if (body?.customTools !== undefined) {
+            const validated = validateCustomTools?.(body.customTools) ??
+                { error: "this Pier cannot store custom tools" };
+            if ("error" in validated)
+                return refuse(validated.error);
+            declared = validated.tools;
+            const custom = validated.tools;
+            writes.push(() => settings.setCustomTools(custom));
+        }
+        /** A single switch, applied to the set as it is *now* rather than to the
+         *  list the browser had. Returns the name, or the refusal. */
+        const delta = (raw) => {
+            const given = typeof raw === "object" && raw !== null ? raw : null;
+            const name = typeof given?.name === "string" ? given.name.trim() : "";
+            if (!name || name.length > 64 || typeof given?.on !== "boolean")
+                return "expected {name, on}";
+            return { name, on: given.on };
+        };
+        let extensionOne = null;
+        if (body?.extension !== undefined) {
+            const one = delta(body.extension);
+            if (typeof one === "string")
+                return refuse(`extension: ${one}`);
+            extensionOne = one;
+            writes.push(() => settings.setExtensions(withName(settings.get().extensions, one)));
         }
-        if (body.extensions !== undefined) {
-            const names = normalizeExtensions(body.extensions);
-            if (names === null) {
-                return c.json({ error: "extensions must be a list of names (≤32)" }, 400);
+        // Whether the enabled set moved, for the install below. The delta itself
+        // is resolved inside the transaction, against the set as it was stored.
+        let toolsChanged = false;
+        let toolOne = null;
+        if (body?.tool !== undefined) {
+            const one = delta(body.tool);
+            if (typeof one === "string")
+                return refuse(`tool: ${one}`);
+            toolOne = one;
+            toolsChanged = true;
+            writes.push(() => settings.setTools(withName(settings.get().tools, one)));
+        }
+        // What ubix says about the blocks this request would undeclare. Asked out
+        // here because answering it spawns a subprocess, and a transaction may not
+        // wait on one; the *sets* below are read inside the transaction, where
+        // nothing can move them.
+        const dropping = declared !== null &&
+            settings.get().customTools.some((tool) => !declared?.some((kept) => kept.name === tool.name));
+        const shown = dropping ? await catalog?.() : undefined;
+        const binaryOf = (name) => {
+            const entry = shown?.entries.find((row) => row.source === "binary" && row.name === name);
+            return entry?.source === "binary" ? entry.binary : null;
+        };
+        /**
+         * The rules that are about *sets*, applied inside the transaction against
+         * the settings as they are at that instant. Outside it they are a
+         * time-of-check: a request dropping a declaration and another switching
+         * that tool on both passed, and left an enabled tool nothing declares.
+         *
+         * What may be switched on comes from `names`, which is code and cannot
+         * change while this runs, plus what this request declares. What may be
+         * undeclared is the second rule: a block is the only thing that can
+         * uninstall its binary, so it may not go while the tool is on, installed,
+         * broken, or while ubix's answer about it could not be read. Switching a
+         * name *off* is never refused — that is the repair, and it is the first
+         * half of removing one.
+         */
+        const check = () => {
+            const current = settings.get();
+            const after = (declared ?? current.customTools).map((tool) => tool.name);
+            const toolsAfter = toolOne ? withName(current.tools, toolOne) : current.tools;
+            if (extensionOne?.on && !names.extensions.includes(extensionOne.name)) {
+                throw new Refusal(`extension: this Pier has no extension called ${extensionOne.name}`, 400);
+            }
+            if (toolOne?.on && !names.tools.includes(toolOne.name) && !after.includes(toolOne.name)) {
+                throw new Refusal(`tool: this Pier manages no tool called ${toolOne.name}`, 400);
+            }
+            for (const gone of current.customTools.filter((tool) => !after.includes(tool.name))) {
+                if (toolsAfter.includes(gone.name)) {
+                    throw new Refusal(`${gone.name} is still switched on — switch it off first, so the next sync uninstalls it`, 409);
+                }
+                const binary = binaryOf(gone.name);
+                if (!binary)
+                    throw new Refusal(`${gone.name}: Pier cannot read what is installed, so its block stays for now`, 409);
+                if (binary.installed) {
+                    throw new Refusal(`${gone.name} is still installed — its block stays until ubix reports the binary gone`, 409);
+                }
+                if (binary.error)
+                    throw new Refusal(`${gone.name}: ${binary.error} — its block stays until that is resolved`, 409);
             }
-            settings.setExtensions(names);
+        };
+        try {
+            settings.transact(() => {
+                check();
+                for (const write of writes)
+                    write();
+            });
+        }
+        catch (err) {
+            // Nothing was written: the transaction rolled back with it.
+            if (err instanceof Refusal)
+                return c.json({ error: err.message }, err.status);
+            throw err;
         }
+        // Stored first, then acted on: the switch shows what was written even when
+        // the install cannot start — and then says why, here, rather than leaving
+        // "saved" as the last thing anyone was told.
+        const note = toolsChanged ? await onToolsChanged?.() : null;
         // The URL and the extension set are both read when a session opens; the
         // model menu is read per picker call, so it needs no recycle.
-        if (body.publicUrl !== undefined || body.extensions !== undefined)
+        if (body?.publicUrl !== undefined || body?.extension !== undefined)
             onSettingsChanged?.();
-        return c.json(instanceSettings());
+        return c.json({ ...(await instanceSettings()), ...(note ? { toolsSync: note } : {}) });
     });
     // Layer-1 key status and control (Console → Settings → Security). The GET
     // is what a locked instance shows; unlock is how it recovers without a